Abnormality detection method and device, electronic equipment, storage medium and computer program product

Abstract

The embodiment of the invention provides an anomaly detection method and device, electronic equipment, a storage medium and a computer program product, and is at least applied to the field of artificial intelligence, and the method comprises the steps: carrying out the standardization processing of an index data sequence of a to-be-detected object in a preset time window, and obtaining a standardized index sequence; performing data reconstruction on the standardized index sequence to obtain reconstructed index data; determining a reconstruction error of the to-be-detected object in a preset time window based on the index data sequence and the reconstruction index data; and performing anomaly detection on the to-be-detected object based on the reconstruction error. According to the invention, the detection efficiency of the anomaly detection process can be improved, and the detection quality of the anomaly detection process is ensured.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of artificial intelligence, and relate to but are not limited to an anomaly detection method and device, an electronic device, a storage medium, and a computer program product. BACKGROUND

[0002] System anomaly detection is an important means to ensure the stability, security and reliability of a system. It detects the behavior and performance of the system, and identifies and responds to patterns or signals that may indicate problems or abnormal behavior of the system in a timely manner.

[0003] In related technologies, an anomaly detection model is used to detect abnormal conditions of multiple indicators of a system. The number of neurons of the anomaly detection model depends on the number of indicators. When the number of indicators changes, the anomaly detection model becomes completely unusable. When new indicators are added or old indicators are deleted, the anomaly detection model needs to be retrained from scratch after collecting data for a certain period of time, which results in a long period of unavailability of the system anomaly detection process. SUMMARY

[0004] Embodiments of the present application provide an anomaly detection method, device, electronic device, storage medium and computer program product, which can at least be applied to the field of artificial intelligence. When the indicators corresponding to the indicator data change, the anomaly detection task can also be quickly responded to in a timely manner. The anomaly detection model can detect the to-be-detected object based on the indicator data sequence in the preset time window, without waiting for a long period of unavailability, thereby improving the detection efficiency of the anomaly detection process and ensuring the detection quality of the anomaly detection process.

[0005] The technical solution of the embodiments of the present application is as follows:

[0006] The anomaly detection method provided by the embodiments of the present application comprises: performing standardization processing on an indicator data sequence of a to-be-detected object in a preset time window to obtain a standardized indicator sequence; performing data reconstruction on the standardized indicator sequence to obtain reconstructed indicator data; determining a reconstruction error of the to-be-detected object in the preset time window based on the indicator data sequence and the reconstructed indicator data; and performing anomaly detection on the to-be-detected object based on the reconstruction error.

[0007] The embodiment of the present application provides an anomaly detection device, the device comprises: a standardization processing module, used for performing standardization processing on index data sequence of a to-be-detected object in a preset time window to obtain a standardized index sequence; a data reconstruction module, used for performing data reconstruction on the standardized index sequence to obtain reconstructed index data; a determination module, used for determining a reconstruction error of the to-be-detected object in the preset time window based on the index data sequence and the reconstructed index data; and an anomaly detection module, used for performing anomaly detection on the to-be-detected object based on the reconstruction error.

[0008] In the above scheme, the standardization processing module is further configured to: determine quantile of index data in the index data sequence; determine index data in a preset quantile interval as candidate index data based on the quantile of the index data; and perform standardization processing on each index data in the index data sequence based on the candidate index data to obtain the standardized index sequence.

[0009] In the above scheme, the standardization processing module is further configured to: determine variance and mean of the candidate index data; and perform standardization processing on each index data in the index data sequence based on the variance and the mean to obtain the standardized index sequence.

[0010] In the above scheme, the data reconstruction module is further configured to: perform feature extraction on the standardized index sequence to obtain an index feature matrix; encode the index feature matrix based on a self-attention mechanism to obtain an encoding matrix; and perform full connection processing on the encoding matrix to obtain the reconstructed index data.

[0011] In the above scheme, the data reconstruction module is further configured to: perform full connection processing on the standardized index sequence through a full connection layer to obtain a full connection matrix; perform activation processing on the full connection matrix through an activation layer to obtain an activation matrix; and perform regularization processing on the activation matrix through a regularization processing layer to obtain the index feature matrix.

[0012] In the above scheme, the determination module is further configured to: determine mean square error between the index data sequence and the reconstructed index data; and determine the mean square error as the reconstruction error of the to-be-detected object in the preset time window.

[0013] In the above scheme, the anomaly detection module is further configured to: determine an anomaly score of the to-be-detected object in the preset time window based on the reconstruction error; and perform anomaly detection on the to-be-detected object based on the anomaly score and a preset score threshold.

[0014] In the scheme, the device further comprises an anomaly detection result determination module configured to: if the anomaly score is greater than the preset score threshold, determine that the anomaly detection result of the to-be-detected object is detection anomaly, generate an alarm information, and send the alarm information; if the anomaly score is less than or equal to the preset score threshold, collect a new index data sequence in a time window with the same length as the preset time window from the current time point; and the anomaly detection module is further configured to perform anomaly detection on the to-be-detected object based on the new index data sequence.

[0015] In the scheme, the device further comprises a preset time window determination module configured to determine a preset time length before the current time as the preset time window; a data collection module configured to collect index data corresponding to each index in a first number of indexes in the preset time window; and a data aggregation module configured to aggregate the index data corresponding to each index to obtain the index data sequence.

[0016] In the scheme, the preset time window determination module is further configured to: obtain a preset data collection interval and a preset window length value; determine the product of the data collection interval and the window length value as the preset time length; and determine a time interval before the current time and having the preset time length as the preset time window with the current time as a time window cutoff point.

[0017] In the scheme, the device further comprises an obtaining module configured to obtain a first index corresponding to the index data in the index data sequence; obtain a historical index data sequence in a historical time window before the preset time window, and a second index corresponding to the historical index data; and a sequence collection module configured to collect a target index data sequence in a time window with the same length as the preset time window from the current time point if the second index is different from the first index; and the anomaly detection module is further configured to perform anomaly detection on the to-be-detected object based on the target index data sequence.

[0018] In the scheme, the index data sequence of the to-be-detected object is reconstructed by a pre-trained index reconstruction model; the device further comprises a model training module configured to train the index reconstruction model by the following steps: performing standardization processing on a sample index data sequence of a sample object in a sample time window to obtain a sample standardized index sequence; inputting the sample standardized index sequence into a to-be-trained index reconstruction model; reconstructing the sample standardized index data sequence by the index reconstruction model to obtain a sample reconstructed index data; determining a sample reconstruction error of the sample object in the sample time window based on the sample index data sequence and the sample reconstructed index data; updating model parameters in the index reconstruction model based on the sample reconstruction error to obtain a trained index reconstruction model.

[0019] In the scheme, after obtaining the trained index reconstruction model, the model training module is further configured to: obtain a first sample index corresponding to current sample index data in a sample index data sequence collected at a current time; obtain a second sample index corresponding to a sample index data sequence in the sample time window; if the second sample index is different from the first sample index, collect a target sample index data sequence in a time window with the same length as the sample time window from the current time; and perform incremental training on the trained index reconstruction model by using the target sample index data sequence.

[0020] An electronic device is provided in an embodiment of the present application, and the electronic device comprises: a memory configured to store computer executable instructions or computer programs; and a processor configured to implement the abnormality detection method described above when executing the computer executable instructions or computer programs stored in the memory.

[0021] A computer program product is provided in an embodiment of the present application, and the computer program product comprises computer executable instructions or computer programs, and the computer executable instructions or computer programs are executed by a processor to implement the abnormality detection method described above.

[0022] A computer readable storage medium is provided in an embodiment of the present application, and the computer readable storage medium stores computer executable instructions or computer programs, and the computer executable instructions or computer programs are executed by a processor to implement the abnormality detection method described above.

[0023] The embodiments of the present application have the following beneficial effects:

[0024] In the abnormality detection, the electronic device first performs standardization processing on the index data sequence of the to-be-detected object in the preset time window, so that the consistency, accuracy and comparability of the index data in the index data sequence are ensured, and accurate abnormality detection is performed on the to-be-detected object based on the standardized index sequence. In addition, the data reconstruction is performed on the standardized index sequence, and the sequence length of the standardized index sequence is not limited, so that the input sequence (i.e. the standardized index sequence) of different lengths can be flexibly processed. Therefore, when the index in the index data sequence changes, for example, the index increases or decreases, the abnormality detection method is not unusable. That is, when the index corresponding to the index data changes, the abnormality detection method provided in the embodiment of the present application can also respond quickly to the abnormality detection task, and the to-be-detected object can be detected based on the index data sequence in the preset time window, without waiting for a long unusable period to determine a new abnormality detection method or collect a new index data sequence, so that the detection efficiency of the abnormality detection process is improved, and the detection quality of the abnormality detection process is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is an optional architecture schematic diagram of an abnormality detection system provided by the embodiment of the present application;

[0026] Figure 2 is a structural schematic diagram of an electronic device provided by the embodiment of the present application;

[0027] Figure 3 is an optional flow schematic diagram of an abnormality detection method provided by the embodiment of the present application;

[0028] Figure 4 is another optional flow schematic diagram of an abnormality detection method provided by the embodiment of the present application;

[0029] Figure 5 is an implementation flow schematic diagram of standardization processing provided by the embodiment of the present application;

[0030] Figure 6 is an implementation flow schematic diagram of data reconstruction provided by the embodiment of the present application;

[0031] Figure 7 is an implementation flow schematic diagram of determining reconstruction error provided by the embodiment of the present application;

[0032] Figure 8 is still another optional flow schematic diagram of an abnormality detection method provided by the embodiment of the present application;

[0033] Figure 9 is a flow schematic diagram of a training method of an index reconstruction model provided by the embodiment of the present application;

[0034] Figure 10 is a processing flow schematic diagram of a feature extraction module of an index reconstruction model provided by an embodiment of the present application;

[0035] Figure 11 is a processing flow schematic diagram of an encoding module of an index reconstruction model provided by an embodiment of the present application;

[0036] Figure 12 is a processing flow schematic diagram of a decoding module of an index reconstruction model provided by an embodiment of the present application;

[0037] Figure 13 is a schematic diagram of an overall calculation process of an index reconstruction model provided by an embodiment of the present application;

[0038] Figure 14 is a flow schematic diagram of a training phase of an index reconstruction model provided by an embodiment of the present application;

[0039] Figure 15 is a flow schematic diagram of an anomaly detection phase of an index reconstruction model provided by an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings, and the described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by those skilled in the art without making creative efforts fall within the scope of protection of the present application.

[0041] In the following description, "some embodiments" are related to a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meaning as understood by those skilled in the art to which the embodiments of the present application belong. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0042] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the functions of the module or unit.

[0043] Before explaining the anomaly detection method provided by the embodiments of the present application, the method in the related art is first described.

[0044] In the related art, when performing anomaly detection, a plurality of time series data is usually used to implement the anomaly detection method. The anomaly detection method in the related art includes the following steps: first, obtaining to-be-processed data, and dividing the to-be-processed data into a plurality of time series segment data; calculating a reconstruction value of each time series segment data of the plurality of time series segment data by an offline training model; calculating a reconstruction probability of each time series segment data based on the reconstruction value of each time series segment data; comparing the reconstruction probability of the time series segment data corresponding to an abnormal time with an abnormal threshold to obtain an abnormal result, and analyzing the abnormal result.

[0045] In the related art, the number of indicators needs to be specified when the model is initialized, and the number of neurons of the model depends on the number of indicators. When the number of indicators changes, the model will be completely unavailable. After adding / deleting indicators, a period of time of data needs to be collected again, and the model needs to be trained from the beginning. Therefore, the anomaly detection system will also have a long period of unavailability.

[0046] To solve at least one of the above problems existing in the method in the related art, the embodiment of the present application provides an anomaly detection method. When new indicators are added or old indicators are deleted, the embodiment of the present application can continue to work after collecting data of a window length. Therefore, when new indicators are added or old indicators are deleted, the refractory period of the anomaly detection system is only tens of minutes. Specifically, the anomaly detection method provided by the embodiment of the present application first normalizes the indicator data sequence of the to-be-detected object in the preset time window by the electronic device to obtain a standardized indicator sequence. Then, the standardized indicator sequence is reconstructed to obtain reconstructed indicator data. Then, based on the indicator data sequence and the reconstructed indicator data, the reconstruction error of the to-be-detected object in the preset time window is determined. Finally, based on the reconstruction error, the to-be-detected object is detected for anomaly. In this way, since the embodiment of the present application does not limit the length of the input indicator data sequence, the length of the standardized indicator sequence will also be variable. Therefore, when data is reconstructed, different lengths of input sequences (i.e., standardized indicator sequences) can be flexibly processed. Because the representation of the input position of each input sequence is dynamically calculated according to the entire input sequence, rather than a fixed length of a fixed window, when the indicators corresponding to the indicator data in the indicator data sequence change, for example, when indicators are added or deleted, the anomaly detection method will not be unavailable. That is, when the indicators corresponding to the indicator data change, the anomaly detection method provided by the embodiment of the present application can also quickly respond to the anomaly detection task in a timely manner. Based on the indicator data sequence in the preset time window, the to-be-detected object can be detected for anomaly without waiting for a long refractory period to determine a new anomaly detection method or collect a new indicator data sequence. Therefore, the detection efficiency of the anomaly detection process can be improved, and the detection quality of the anomaly detection process can be ensured.

[0047] Here, first, an exemplary application of the anomaly detection device of the embodiments of the present application, which is an electronic device for implementing the anomaly detection method, is described. In an implementation manner, the anomaly detection device (i.e., the electronic device) provided by the embodiments of the present application can be implemented as a terminal or a server. In an implementation manner, the anomaly detection device provided by the embodiments of the present application can be implemented as any terminal with data processing and anomaly detection functions, such as a notebook computer, a tablet computer, a desktop computer, a mobile phone, a portable music player, a personal digital assistant, a dedicated message device, a portable game device, a smart robot, a smart home appliance, and a smart vehicle device. In another implementation manner, the anomaly detection device provided by the embodiments of the present application can also be implemented as a server. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, and the like. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the embodiments of the present application. In the following, an exemplary application of the anomaly detection device implemented as a server is described.

[0048] Referring to Figure 1 , Figure 1 is an optional architecture diagram of the anomaly detection system provided by the embodiments of the present application. The anomaly detection system 10 of the embodiments of the present application at least includes a terminal 100, a network 200, and a server 300. The terminal 100 is installed with an anomaly detection application, which can provide an anomaly detection function. The anomaly detection function can be to detect the system performance under any index of the server, for example, to detect the system performance such as CPU usage and disk usage, or to detect the performance under any index of the terminal.

[0049] In the following, the anomaly detection application installed on the terminal is taken as an example for description. In the embodiments of the present application, the server 300 can be a server of the anomaly detection application. The server 300 can constitute the anomaly detection device of the embodiments of the present application, that is, the anomaly detection method of the embodiments of the present application is implemented through the server 300. The terminal 100 is connected to the server 300 through the network 200. The network 200 can be a wide area network or a local area network, or a combination of the two.

[0050] Referring to Figure 1When the user wants to detect the system performance of the server, the client of the anomaly detection application can input an anomaly detection operation for selecting the to-be-detected object or inputting the object identifier of the to-be-detected object. Then, the terminal 100 encapsulates the object identifier of the to-be-detected object into an anomaly detection request and sends the anomaly detection request to the server 300 through the network 200. After that, the server 300 acquires the index data sequence of the to-be-detected object in the preset time window in response to the anomaly detection request, and performs standardization processing on the index data sequence of the to-be-detected object in the preset time window to obtain a standardized index sequence. Then, the server 300 performs data reconstruction on the standardized index sequence to obtain reconstructed index data. Then, the server 300 determines the reconstruction error of the to-be-detected object in the preset time window based on the index data sequence and the reconstructed index data. Finally, the server 300 performs anomaly detection on the to-be-detected object based on the reconstruction error to obtain an anomaly detection result. After obtaining the anomaly detection result, the server 300 sends the anomaly detection result to the terminal 100, and the terminal 100 can display the anomaly detection result on the current interface of the anomaly detection application.

[0051] In some embodiments, the implementation steps in the anomaly detection method can also be performed by the terminal 100, that is, after determining the to-be-detected object, the terminal 100 acquires the index data sequence of the to-be-detected object in the preset time window and performs standardization processing on the index data sequence of the to-be-detected object in the preset time window to obtain a standardized index sequence. The terminal 100 performs data reconstruction on the standardized index sequence to obtain reconstructed index data. The terminal 100 determines the reconstruction error of the to-be-detected object in the preset time window based on the index data sequence and the reconstructed index data. Finally, the terminal 100 performs anomaly detection on the to-be-detected object based on the reconstruction error to obtain an anomaly detection result.

[0052] The anomaly detection method provided in the embodiments of the present application can also be implemented based on a cloud platform and through cloud technology, for example, the server 300 described above can be a cloud server. The cloud server can perform standardization processing on the index data sequence of the to-be-detected object in the preset time window, or can also perform data reconstruction on the standardized index sequence, or can also determine the reconstruction error of the to-be-detected object in the preset time window, or can also perform anomaly detection on the to-be-detected object based on the reconstruction error.

[0053] In some embodiments, a cloud storage can also be provided, and the index data sequence of the object to be detected within a preset time window, or the abnormality detection result can be stored in the cloud storage. Thus, when the next abnormality detection is performed, the abnormality detection result at the current time can be obtained from the cloud storage as the reference information for the next abnormality detection.

[0054] It should be noted that the cloud technology refers to a hosting technology of unifying a series of resources such as hardware, software, network, etc. in a wide area network or a local area network to realize data calculation, storage, processing and sharing. The cloud technology is a general term of network technology, information technology, integration technology, management platform technology, application technology and the like based on the cloud computing business model application, can form a resource pool, and is used on demand, flexibly and conveniently. The cloud computing technology will become an important support. The background service of the technical network system needs a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the high development and application of the Internet industry, in the future, every item may have its own identification mark, and needs to be transmitted to the background system for logical processing. Different levels of data will be processed separately, and various industry data needs strong system support, which can be realized through cloud computing.

[0055] Figure 2 is a structural schematic diagram of an electronic device provided by an embodiment of the present application, Figure 2 The electronic device shown can be an abnormality detection device, and the abnormality detection device includes at least one processor 310, a memory 350, at least one network interface 320 and a user interface 330. The various components in the abnormality detection device are coupled together through a bus system 340. It can be understood that the bus system 340 is used to realize the connection and communication between the components. In addition to including a data bus, the bus system 340 also includes a power bus, a control bus and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 340 in Figure 2 .

[0056] The processor 310 can be an integrated circuit chip with signal processing capability, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0057] The user interface 330 includes one or more output devices 331 that enable the presentation of media content, and one or more input devices 332.

[0058] The memory 350 can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. The memory 350 optionally includes one or more storage devices remotely located from the processor(s) 310. The memory 350 comprises a volatile memory or non-volatile memory, and can also include both volatile and non-volatile memory. Non-volatile memory can be read only memory (ROM), volatile memory can be random access memory (RAM). The memory 350 described in embodiments of the present application is intended to include any suitable type of memory. In some embodiments, the memory 350 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or a subset or superset thereof, which are described below.

[0059] The operating system 351 includes a system program for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks; a network communication module 352 for reaching other computing devices via one or more (wired or wireless) network interfaces 320, exemplary network interfaces 320 including Bluetooth, wireless fidelity (WiFi), and universal serial bus (USB), etc.; an input processing module 353 for detecting and translating one or more user inputs or interactions from one or more input devices 332.

[0060] In some embodiments, the apparatus provided by embodiments of the present application can be implemented in software, Figure 2 An anomaly detection apparatus 354 stored in the memory 350 is shown, which can be an anomaly detection apparatus in an electronic device, and can be software in the form of programs and plug-ins, etc., including the following software modules: a standardization processing module 3541, a data reconstruction module 3542, a determination module 3543, and an anomaly detection module 3544. These modules are logical, and thus can be combined or further split according to the implemented functions. The functions of each module will be described below.

[0061] In some embodiments, the apparatus provided by the embodiments of the present application can be implemented in a hardware manner. For example, the apparatus provided by the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to perform the anomaly detection method provided by the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can be implemented by using one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic elements.

[0062] The anomaly detection method provided by the embodiments of the present application can be executed by an electronic device, which can be a server or a terminal. That is, the anomaly detection method provided by the embodiments of the present application can be executed by a server, a terminal, or the interaction between the server and the terminal.

[0063] Figure 3 is an optional flowchart of the anomaly detection method provided by the embodiments of the present application. The following will be described with reference to the steps shown in Figure 3 , as shown in Figure 3 , taking the server as an example of the execution subject of the anomaly detection method, the method includes the following steps S101 to S104:

[0064] Step S101: performing standardization processing on the index data sequence of the to-be-detected object in the preset time window to obtain a standardized index sequence.

[0065] The to-be-detected object can be any entity that can be detected for performance anomaly, for example, the to-be-detected object can be an individual object such as a physical machine, a virtual machine, or a container.

[0066] In the embodiments of the present application, when the specified time window is n, the index data of n-1 time points before the current time are combined to form a preset time window with a length of n, and the index data in the preset time window are combined to form the index data sequence. The index data sequence is a time series data, and the index data sequence includes a plurality of index data sequentially counted according to a time dimension. The plurality of index data correspond to at least one index. The index can also be referred to as a collection index or a performance index, and is an index possessed by the to-be-detected object. For example, when the to-be-detected object is a virtual machine, the collection index can include performance indexes such as processor performance, memory performance, storage performance, network performance, graphics performance, and system virtualization performance of the virtual machine; when the to-be-detected object is a physical machine, the collection index can include performance indexes such as processor performance, memory performance, storage performance, network performance, graphics processing performance, network performance, heat dissipation performance, power supply performance, system scalability, system stability, and other hardware characteristics of the physical machine; and when the to-be-detected object is a container, the collection index can include performance indexes such as startup time, resource occupation, I / O performance, network delay, concurrency performance, context switching overhead, storage performance, container density, resource limitation, performance detection, container image size, container life cycle management, container orchestration performance, security, and compatibility of the container.

[0067] The standardization process refers to the conversion of the index data before inputting it into the algorithm or model, so that the index data has the same scale, thereby eliminating the influence of the dimension and order of magnitude between different indicators. Standardization is an important step to ensure the consistency, accuracy and comparability of data. In the embodiments of the present application, the index data sequence of the to-be-detected object in the preset time window is standardized, which can be realized by the following steps: (1) data collection, first, the relevant performance index data of the to-be-detected object such as physical machine or virtual machine needs to be collected, which may include: CPU usage, memory usage, disk I / O, network bandwidth of physical machine, CPU usage, memory usage, storage I / O, network delay of virtual machine, etc. (2) data preprocessing, before standardization, the following preprocessing steps may be needed: missing value processing: filling or deleting missing data points. Outlier processing: identify and process outliers to prevent them from adversely affecting the standardization process. (3) Standardization method, the following are several commonly used standardization methods: Z-Score standardization (standard score standardization), which is based on the mean (μ) and standard deviation (σ) of the feature to standardize; Min-Max standardization, which scales the data to a specified range (usually [0, 1] or [-1, 1]); Quantile standardization (Quantile standardization), which is based on the quantile of the data to standardize, so that the distribution of the standardized data is the same as that of the original data. (4) Apply standardization, after selecting the appropriate standardization method, apply the standardization algorithm to the collected index data. For example, in Python, you can use the StandardScaler or MinMax Scaler class of the scikit-learn library to implement these standardization methods. (5) Keep standardization parameters, during the standardization process, the parameters used to standardize the data (such as mean, standard deviation, minimum value, maximum value, etc.) need to be saved, because these parameters will be used for inverse standardization in subsequent data processing and model evaluation. (6) Inverse standardization, after the model training is completed, if you need to convert the output of the model back to the original data scale, you can use the saved standardization parameters to perform inverse standardization. Standardization is crucial to improve model training efficiency and model performance, especially when dealing with performance data of physical machines, virtual machines and containers, because different indicators may have very different magnitudes and distribution characteristics. In the embodiments of the present application, any one of the above standardization processing methods can be used to standardize the index data sequence. It should be noted that the standardization of the index data sequence is actually the standardization of each index data in the index data sequence.

[0068] In some embodiments, the standardized index sequence can have an arbitrary sequence length, the sequence length of the standardized index sequence is not fixed, and the sequence length of the standardized index sequence can change accordingly according to the change in the length of the index data sequence, that is, the length of the index data sequence can also be arbitrary, so that after the index data sequence is standardized, a standardized index sequence with the same length as the index data sequence can be obtained.

[0069] In step S102, the standardized index sequence is subjected to data reconstruction to obtain reconstructed index data.

[0070] In the embodiments of the present application, the standardized index sequence can be subjected to data reconstruction by using an index reconstruction model. The index reconstruction model can be a data processing module based on a self-attention mechanism. That is, the standardized index sequence can be subjected to data reconstruction based on the self-attention mechanism to obtain reconstructed index data. For example, in one implementation, the reconstruction model can be implemented based on a Transformer model. The self-attention mechanism enables the index reconstruction model to assign different attention weights according to the correlation between different elements when processing the standardized index sequence, thereby capturing long-distance dependencies in the standardized index sequence, and the input standardized index sequence can be processed by the model even if the collected indicators change (for example, increase or decrease), that is, the standardized index sequence can be subjected to data reconstruction even if the number of collected indicators changes, thereby adapting to the data reconstruction process of standardized index sequences with different numbers of indicators.

[0071] Here, the key components and working principles of self-attention mechanism are explained. The components of self-attention mechanism include Query, Key, and Value. Query indicates the relevant information of the current processing element, which is used to query the relationship with other elements. Key indicates the information of other elements in the standardized index sequence, which is used to match with Query. Value indicates the actual content of other elements in the standardized index sequence, which is used to generate output data after attention weight determination. The working principles of self-attention mechanism are as follows: first, calculate attention scores: for each element in the standardized index sequence, calculate its attention score with all other elements, which is usually achieved by calculating the dot product between Query and Key. The attention score reflects the degree of association between Query and Key. Second, apply softmax function: normalize the calculated attention scores by softmax function, and convert the normalized results into probability distribution. In this way, each score corresponds to a probability, which represents the attention degree of the element corresponding to the score to other elements in the context of the current element. Finally, weighted sum: use the probability converted by softmax function as weight to perform weighted sum on Value. The result of this weighted sum forms the context representation of the current element, which takes into account the information of other elements in the standardized index sequence.

[0072] It should be noted that the features of self-attention mechanism include but are not limited to: (1) parallel processing: self-attention mechanism allows the index reconstruction model to process all elements in the standardized index sequence at once, rather than sequentially as in recurrent neural network (RNN) or convolutional neural network (CNN). This greatly improves the computational efficiency. (2) Long-distance dependence: self-attention mechanism can capture long-distance dependence relationships in the standardized index sequence, because self-attention mechanism does not rely on fixed sequence order, but allocates attention according to the association between elements. (3) Position information: in order to preserve the position information of elements in the standardized index sequence, Transformer model introduces position encoding, which is a kind of information added to the sequence elements to represent the position of the elements. (4) Multi-head attention: in Transformer model, self-attention mechanism is usually combined with multi-head attention mechanism. Multi-head attention allows the index reconstruction model to learn different relationships in different subspaces in parallel, increasing the expressiveness of the index reconstruction model. Each head has its own Query, Key, and Value matrices, independently calculates attention weights and output, and finally combines the outputs of all heads.

[0073] In the embodiments of the present application, the reconstructed indicator data is also a time series data, which is a two-dimensional array with the same dimension as the original input window dimension (indicator number * window length), that is, the reconstructed indicator data has the same dimension as the input standardized indicator sequence. Here, taking painting as an example, if the input is a picture of a kitten, the output is equivalent to a picture of a kitten that is painted. If the painting is relatively similar, the loss function between the indicator data sequence and the reconstructed indicator data will be relatively low, and correspondingly, the anomaly score will also be relatively low.

[0074] In step S103, the reconstructed error of the to-be-detected object in the preset time window is determined based on the indicator data sequence and the reconstructed indicator data.

[0075] In the embodiments of the present application, the error calculation can be performed based on the indicator data sequence and the reconstructed indicator data, and the error calculation result is determined as the reconstructed error of the to-be-detected object in the preset time window. Error calculation is an important step to evaluate the difference between the predicted value of the model prediction, that is, the predicted indicator data sequence, and the actual value, that is, the actual indicator data sequence. There are various methods that can be used to calculate the error, and the embodiments of the present application can use any one of the error calculation methods to calculate the error between the indicator data sequence and the reconstructed indicator data.

[0076] For example, the error calculation method can include but is not limited to any one of the following: absolute error, relative error, mean squared error (MSE), root mean squared error (RMSE), mean absolute error (MAE), median absolute error (MedAE), maximum absolute error, relative mean squared error (RMSE), etc. The absolute error is the absolute value of the difference between the predicted value and the actual value. The relative error is the ratio of the absolute error to the actual value, which is usually used to represent the proportion of the error. The mean squared error is the average of the squares of all data point errors, which emphasizes the influence of large errors. The root mean squared error is the square root of the mean squared error, which gives the average size of the error. The mean absolute error is the average of all data point absolute errors, which gives the average level of the error. The median absolute error is the median of all absolute errors, which is not sensitive to outliers. The maximum absolute error is the maximum value of all absolute errors, which represents the worst-case error. The relative mean squared error is the ratio of the mean squared error to the average of the squares of the actual values. In the embodiments of the present application, the mean squared error, the root mean squared error and the mean absolute error can be used to calculate the reconstructed error of the to-be-detected object in the preset time window.

[0077] In step S104, the abnormality detection is performed on the to-be-detected object based on the reconstruction error.

[0078] In the embodiments of the present application, after the reconstruction error of the to-be-detected object in the preset time window is determined, the abnormality score of the to-be-detected object in the preset time window can be determined based on the reconstruction error.

[0079] The greater the reconstruction error is, the greater the difference between the reconstruction index data obtained by the data reconstruction process and the standardized index sequence of the original input is, the less accurate the calculation of the data reconstruction process is, and the data reconstruction process cannot accurately reconstruct the index change rule of the input standardized index sequence. Therefore, the greater the determined abnormality score is. The greater the abnormality score is, the greater the possibility of index abnormality of the to-be-detected object is. The smaller the reconstruction error is, the smaller the difference between the reconstruction index data obtained by the data reconstruction process and the standardized index sequence of the original input is, the more accurate the calculation of the data reconstruction process is, and the data reconstruction process can accurately reconstruct the index change rule of the input standardized index sequence. Therefore, the smaller the determined abnormality score is. The smaller the abnormality score is, the smaller the possibility of index abnormality of the to-be-detected object is.

[0080] In the embodiments of the present application, a preset score threshold can be preset. When the determined abnormality score is greater than the preset score threshold, it indicates that the abnormality detection result of the to-be-detected object is detection abnormality. It should be noted that the abnormality score can be an abnormality score of a certain determined collection index, or an abnormality score of all collection indexes of the to-be-detected object at the current moment. The all collection indexes can be determined according to the collected index data sequence, that is, the indexes corresponding to the index data in the index data sequence can be determined as the all collection indexes.

[0081] The abnormality detection method provided in the embodiments of the present application can ensure the consistency, accuracy and comparability of the index data in the index data sequence by performing standardization processing on the index data sequence of the to-be-detected object in the preset time window, so as to accurately detect the abnormality of the to-be-detected object based on the standardized index sequence. Furthermore, the data of the standardized index sequence is reconstructed based on the self-attention mechanism. As the self-attention mechanism can flexibly process input sequences (i.e., the standardized index sequence) of different lengths, because the representation of the input position of each input sequence is dynamically calculated according to the entire input sequence, rather than a fixed window of fixed length, when the index in the index data sequence changes, for example, the index is increased or decreased, the abnormality detection method is still usable. That is, when the index corresponding to the index data changes, the abnormality detection method provided in the embodiments of the present application can also quickly respond to the abnormality detection task in a timely manner. The abnormality of the to-be-detected object can be detected based on the index data sequence in the preset time window, without waiting for a long unusable period to determine a new abnormality detection method or collect a new index data sequence, so as to improve the detection efficiency of the abnormality detection process and ensure the detection quality of the abnormality detection process.

[0082] The application scenarios of the abnormality detection method provided in the embodiments of the present application are exemplified below.

[0083] Scenario one: in the running process of the virtual machine, in order to ensure the normal running of the virtual machine, it is necessary to confirm whether the virtual machine is abnormal at any time, therefore, the performance of the virtual machine needs to be detected. When performing abnormal detection, the virtual machine as a detection object can obtain the index data sequence of the virtual machine in the preset time window, for example, the index data sequence can include performance related index data of the virtual machine, such as processor performance, memory performance, storage performance, network performance, graphics performance and system virtualization performance. Among them, the processor performance includes but is not limited to virtual CPU (vCPU) core number, CPU frequency and CPU affinity, the virtual CPU core number refers to the number of virtual CPU cores allocated in the virtual machine, which affects the parallel processing capability of the virtual machine; the CPU frequency refers to the frequency of the processor that can be used by the virtual machine, which determines the operation speed of the processor; the CPU affinity specifies the allocation of CPU cores of the virtual machine on the physical server to optimize performance and reduce delay. The memory performance includes but is not limited to memory size, memory speed and memory bandwidth, the memory size refers to the memory capacity allocated to the virtual machine, which directly affects the multitasking processing capability and application performance of the virtual machine; the memory speed refers to the speed of memory reading and writing, which is usually measured in MHz; the memory bandwidth refers to the data transmission capacity of the memory per unit time. The storage performance includes but is not limited to storage space, I / O performance and storage type, the storage space refers to the hard disk space allocated to the virtual machine, including the size and number of virtual hard disks; the I / O performance refers to the efficiency of input / output operation, including read / write speed and I / O operation times; the storage type such as SSD and HDD, the read / write speed of SSD is usually much higher than that of HDD. The network performance includes but is not limited to network bandwidth, network delay and concurrent connection number, the network bandwidth refers to the network transmission rate of the virtual machine, which is usually measured in Mbps; the network delay refers to the delay time of data transmission in the network; the concurrent connection number refers to the number of concurrent network connections that can be processed by the virtual machine. The graphics performance includes but is not limited to graphics processing unit (GPU) and video memory size, the graphics processing unit is a physical GPU resource that some virtual machines support to allocate to improve graphics processing capability; the video memory size is the memory capacity allocated to graphics processing. The system virtualization performance includes but is not limited to virtualization technology, such as hardware virtualization (HVM) and operating system virtualization (OSV), different virtualization technologies have different effects on performance.

[0084] In scene two, in order to ensure the normal operation of the physical machine, it is necessary to confirm whether the physical machine has an abnormality at any time during the operation of the physical machine, and therefore, it is necessary to perform abnormality detection on various performances of the physical machine. When performing the abnormality detection, the physical machine as a to-be-detected object can obtain an index data sequence of the physical machine in a preset time window, for example, the index data sequence can include performance-related index data of the processor performance, the memory performance, the storage performance, the network performance, the graphics processing performance, the network performance, the heat dissipation performance, the power supply performance, the system scalability, the system stability, and other hardware characteristics of the physical machine. Among them, the processor performance includes but is not limited to the core number, the thread number, the main frequency, the cache size, and the thermal design power (TDP, Thermal Design Power), the core number refers to the number of cores in the processor, which determines the parallel processing capability of the processor; the thread number refers to the number of supported threads, which can improve the multi-task processing capability through the hyper-threading technology; the main frequency refers to the basic working frequency of the processor, which is usually represented by GHz; the cache size refers to the size of the internal cache of the processor, including L1, L2, and L3 cache, which plays an important role in improving the data access speed; the TDP refers to the maximum heat dissipation of the processor during normal operation, which is usually proportional to the power consumption. The memory performance includes but is not limited to the memory capacity, the memory speed, the memory channel number, and the memory type, the memory capacity refers to the total memory size of the system, which determines the amount of data that can be processed and the number of application programs; the memory speed refers to the clock speed of the memory, which is usually represented by MHz, and affects the read / write speed of data; the memory channel number refers to the number of memory interface channels, which determines the memory bandwidth; the memory type is, for example, DDR4, DDR3, etc., different types of memory have different performance and capacity. The storage performance includes but is not limited to the hard disk capacity, the hard disk type, the I / O speed, and the RAID level, the hard disk capacity refers to the total storage space of the hard disk; the hard disk type includes mechanical hard disk (HDD, Hard Disk Drive), solid state disk (SSD, Solid State Disk), etc., different types of hard disks have different read / write speeds and lifespans; the I / O speed refers to the read / write speed of the hard disk, which is usually represented by MB / s or GB / s; the RAID level refers to the configuration method of the hard disk array, which affects the storage performance and the redundancy of data. The graphics processing performance includes but is not limited to the GPU core number, the video memory size, and the graphics processing interface, the GPU core number refers to the number of cores of the graphics processor, which affects the graphics processing capability; the video memory size refers to the memory capacity allocated by the GPU, which affects the data amount and speed of graphics processing; the graphics processing interface is, for example, the PCIe version, which determines the data transmission speed between the GPU and the system. The network performance includes but is not limited to the network bandwidth, the network delay, and the concurrent connection number, the network bandwidth refers to the maximum transmission rate of the network interface card (NIC), which is usually represented by Mbps or Gbps; the network delay refers to the time delay of data transmission in the network; the concurrent connection number refers to the number of concurrent connections that can be handled by the network interface.The heat dissipation performance includes but is not limited to the heat dissipation system and the heat dissipation capacity, the heat dissipation system includes fans, heat sinks, etc., which affect the heat dissipation efficiency and stability of the system; the heat dissipation capacity is the heat dissipation capacity of the heat dissipation system, which is usually expressed in terms of heat dissipation power (W). The power supply performance includes but is not limited to the power supply capacity and the power supply efficiency, the power supply capacity refers to the rated power of the power supply, which determines the maximum power consumption that the system can carry; the power supply efficiency refers to the efficiency of the power supply in converting electrical energy into usable energy for the system. The system scalability includes but is not limited to the expansion slot and the memory scalability, the expansion slot includes PCIe slots, etc., which determine the expansion capability of the system; the memory scalability refers to the number of memory slots and the maximum supported memory capacity. The system stability includes but is not limited to the redundancy design and the fault diagnosis, the redundancy design such as power supply redundancy, fan redundancy, etc., improves the stability of the system; the fault diagnosis refers to the ability of the system to detect and diagnose faults. Other hardware characteristics include but are not limited to the motherboard chipset and BIOS / UEFI, the motherboard chipset determines the type and performance of the hardware supported by the system; BIOS / UEFI refers to the basic input / output system of the system, which affects the initialization and performance of the hardware.

[0085] Scenario three: during the running of the container, in order to ensure the normal running of the container, it is necessary to confirm whether the container has an abnormality at all times, and therefore, the performance of the container needs to be detected for abnormality. When performing abnormality detection, the container as a to-be-detected object can obtain an index data sequence of the container in a preset time window, for example, the index data sequence can include performance-related index data of the container, such as startup time, resource occupation, I / O performance, network delay, concurrency performance, context switching overhead, storage performance, container density, resource limitation, performance detection, container image size, container lifecycle management, container orchestration performance, security, and compatibility. Among them, the startup time refers to the time required for the container to change from creation to a runnable state, which reflects the deployment speed of the container. The resource occupation includes but is not limited to CPU usage, memory usage, and disk usage. The CPU usage refers to the percentage of CPU resources occupied by the container runtime. The memory usage refers to the amount of memory occupied by the container runtime. The disk usage refers to the disk space occupied by the container storage layer and data volume. The I / O performance includes but is not limited to disk I / O and network I / O. The disk I / O refers to the speed of reading and writing a disk by the container, including sequential reading and writing performance and random reading and writing performance. The network I / O refers to the network transmission rate of the container, including upload and download speed. The network delay refers to the response time of a network request inside the container, which reflects the performance of the network stack. The concurrency performance refers to the performance of the container when processing multiple concurrent requests, including the maximum number of concurrent connections and processing capacity. The context switching overhead refers to the overhead of context switching at the operating system level of the container, which is directly related to the lightweight feature of the container. The storage performance refers to the performance of the container storage solution, such as the performance when using overlay, aufs, or other storage drivers. The container density refers to the number of containers that can be simultaneously run on a given hardware resource, which reflects the resource utilization. The resource limitation refers to the hard limit that the container can set for the resources (such as CPU, memory, and I / O) it uses. The performance detection refers to the effectiveness and accuracy of the container and its performance detection tools, such as Prometheus, Grafana, and the like. The container image size refers to the storage space size occupied by the container image, which affects the distribution and deployment of the container. The container lifecycle management refers to the efficiency of operations such as creation, startup, stop, and deletion of the container. The container orchestration performance refers to the performance of container deployment, expansion, and service in a container orchestration system (such as Kubernetes Docker Swarm). The security refers to the security performance of the container runtime, including the isolation between containers and the performance between the container and the host machine. The compatibility refers to the compatibility of the container runtime with system architecture and operating system.

[0086] After the index data sequence is acquired, the abnormality detection method provided in the embodiments of the present application can be used to perform standardization processing on the index data sequence to obtain a standardized index sequence; then a data reconstruction is performed on the standardized index sequence based on a self-attention mechanism to obtain reconstructed index data; based on the index data sequence and the reconstructed index data, a reconstruction error of the physical machine, the virtual machine or the container in a preset time window is determined; finally, the virtual machine is detected for abnormality based on the reconstruction error.

[0087] The abnormality detection method of the embodiments of the present application will be described below in combination with the above scenarios one to three.

[0088] Figure 4 is another optional flowchart of the abnormality detection method provided in the embodiments of the present application, as shown in Figure 4 The method includes the following steps S201 to S214:

[0089] Step S201, the terminal receives an abnormality detection operation input by a user.

[0090] The abnormality detection operation includes a selection operation for selecting a to-be-detected object or an input operation for inputting an object identifier of the to-be-detected object.

[0091] Step S202, the terminal encapsulates the object identifier of the to-be-detected object into an abnormality detection request.

[0092] The abnormality detection request is used to request the server to perform abnormality detection on the to-be-detected object.

[0093] Step S203, the terminal sends the abnormality detection request to the server.

[0094] In the embodiments of the present application, the terminal sends the abnormality detection request to the server to request the server to perform abnormality detection on the to-be-detected object. Of course, in some embodiments, the server can also actively perform abnormality detection on the to-be-detected object, that is, there can be a preset number of to-be-detected objects, and the server can periodically or non-periodically actively perform abnormality detection on these to-be-detected objects.

[0095] Step S204, the server collects an index data sequence of the to-be-detected object in a preset time window in response to the abnormality detection request.

[0096] In the embodiments of the present application, the index data sequence of the to-be-detected object in the preset time window can be acquired in the following manner: first, a preset time length before the current time is determined as the preset time window; then, the index data corresponding to each index in the first quantity of indexes in the preset time window is acquired; and finally, the index data corresponding to each index is aggregated to obtain the index data sequence of the to-be-detected object in the preset time window.

[0097] In the embodiments of the present application, since the index data sequence in the preset time window before the current time is acquired, the index abnormality at the current time is detected based on the index data sequence in the preset time window, and therefore, for any time, it can be regarded as the current time, so that the abnormality detection method provided in the embodiments of the present application is used for abnormality detection, that is, the abnormality detection method provided in the embodiments of the present application can realize real-time detection of the index abnormality of the to-be-detected object.

[0098] In some embodiments, the preset time length before the current time is determined as the preset time window, which can be realized in the following manner: first, a preset data acquisition interval and a preset window length value are acquired; then, the product of the data acquisition interval and the window length value is determined as the preset time length; and finally, the time interval before the current time and having the preset time length is determined as the preset time window with the current time as the time window cutoff point.

[0099] It should be noted that the data acquisition interval here is a data acquisition window, which can also be referred to as a time window or a window length, and can be regarded as a data acquisition window unit. In the case of presetting the data acquisition window, the window length value can be determined, which refers to the number of data acquisition windows corresponding to the time sequence data (i.e., the index data sequence) to be acquired. For example, the data acquisition interval is 15s and the window length value is 60, so the preset time length can be calculated as 15 minutes, and therefore, the 15 minutes before the current time can be determined as the preset time window.

[0100] In the embodiments of the present application, the data acquisition window is a common concept in the field of data processing, which refers to a time interval or data range defined in the data acquisition process, and is used to extract and analyze data from data streams. The most common understanding is that the time window refers to a time range, such as 1 minute, 1 hour, 1 day, or 1 week, etc. Within this time range, all data events or records occurring will be collected and processed. In addition to the time window, the data acquisition window can also be defined based on the number of data records or other logical conditions, such as collecting the last 1000 transaction records, and therefore, in this case, the data acquisition window can also be a data range window.

[0101] In the embodiments of the present application, the data collection window can be a fixed window, and the size of the fixed window is fixed, for example, data is collected every 5 minutes. The fixed window is convenient for management and analysis, because the amount of data in each window is the same. The data collection window can also be a sliding window, which means that the window moves forward in the data stream by a certain interval each time. In the sliding window, each window can contain data in different time periods, which helps to capture the trend of data changes. The size of the data collection window directly affects the granularity of data collection and the results of analysis. A smaller window can provide more granular data, but can increase the amount of calculation. A larger window can ignore some short-term fluctuations or abnormalities.

[0102] The first number of indicators can be preset indicators, and the first number is also a preset value, that is, which indicators to collect can be preset. For example, for the case where the to-be-detected object is a physical machine, the preset indicators can be determined in advance as the processor performance indicator, the memory performance indicator, the storage performance indicator, and the heat dissipation performance indicator of the physical machine. Therefore, the first number is 4. When collecting the indicator data corresponding to each indicator in the first number of indicators in the preset time window, the indicator data corresponding to each indicator in the preset time window can be extracted from the corresponding storage location according to the storage location of the indicator data corresponding to each indicator, or all indicator data of each indicator or all indicator data in a time period greater than the preset time window can be obtained from the storage location, and then the indicator data belonging to the preset time window can be extracted from the all indicator data according to the preset time window.

[0103] In the embodiments of the present application, the index data corresponding to all indexes can be sorted according to the time sequence in the preset time window to form an index data sequence. For example, the preset time window includes time T1, T2, T3 and T4, and the indexes include processor performance index, memory performance index and heat dissipation performance index. The index data of the processor performance index at time T1 is A1, the index data of the processor performance index at time T2 is A2, the index data of the processor performance index at time T3 is A3, and the index data of the processor performance index at time T4 is A4. The index data of the memory performance index at time T1 is B1, the index data of the memory performance index at time T2 is B2, the index data of the memory performance index at time T3 is B3, and the index data of the memory performance index at time T4 is B4. The index data of the heat dissipation performance index at time T1 is C1, the index data of the heat dissipation performance index at time T2 is C2, the index data of the heat dissipation performance index at time T3 is C3, and the index data of the heat dissipation performance index at time T4 is C4. Then, the index data sequence obtained after final aggregation is [(A1, B1, C1), (A2, B2, C2), (A3, B3, C3), (A4, B4, C4)].

[0104] In step S205, the server standardizes the index data sequence of the to-be-detected object in the preset time window to obtain a standardized index sequence.

[0105] In some embodiments, referring to Figure 5 , Figure 5 It is shown that step S205 can be implemented by the following steps S2051 to S2053:

[0106] In step S2051, the quantile of the index data in the index data sequence is determined.

[0107] Quantile is a concept in statistics. The quantile is a numerical point that divides the index data sequence into several equal parts. Each quantile corresponds to an index data in the index data sequence, which divides the index data sequence into two parts, one part of the data points is less than or equal to the index data, and the other part of the data points is greater than the index data.

[0108] It should be noted that in the embodiments of the present application, for the case that the index data sequence corresponds to multiple indexes, a quantile is determined for all indexes, which is used for subsequent processing of the index data of all indexes, thereby realizing the standardization processing of the index data sequence.

[0109] In step S2052, based on the quantile of the index data, the index data in the preset quantile interval is determined as the candidate index data.

[0110] Here, the preset quantile interval can be a preset quantile interval, and the preset quantile interval includes an upper limit value and a lower limit value of the interval. The index data corresponding to the quantile between the lower limit value and the upper limit value of the interval can be determined as the candidate index data. For example, the lower limit value can be 5%, and the upper limit value can be 95%. Then, the index data with the quantile between 5% and 95% can be determined as the candidate index data.

[0111] In step S2053, based on the candidate index data, each index data in the index data sequence is standardized to obtain a standardized index sequence.

[0112] The standardization processing refers to converting the index data before inputting the data into an algorithm or a model, so that the index data has the same scale, thereby eliminating the influence of the dimension and order of magnitude between different indexes. In the standardization processing, the variance and mean of the candidate index data can be determined, and then the variance and mean are used in the standardization processing of all index data. For example, the variance and mean can be used to standardize each index data in the index data sequence to obtain a standardized index sequence. That is, the Z-Score standardization method can be used to standardize each index data in the index data sequence.

[0113] In step S206, the server reconstructs the standardized index sequence based on the self-attention mechanism to obtain reconstructed index data.

[0114] In the embodiment of the application, the standardized index sequence can be reconstructed by an index reconstruction model, wherein the index reconstruction model includes a feature extraction module, an encoding module and a decoding module. The feature extraction module is composed of a full connection layer, an activation layer and a regularization processing layer. The regularization processing layer can be implemented as a DropOut layer.

[0115] In some embodiments, referring to Figure 6 , Figure 6 It is shown that step S206 can be implemented by the following steps S2061 to S2063:

[0116] In step S2061, the standardized index sequence is feature extracted to obtain an index feature matrix.

[0117] Here, the feature extraction on the standardized index sequence can be implemented in the following manner: first, the standardized index sequence is fully connected by a full connection layer in the feature extraction module to obtain a full connection matrix; then, the full connection matrix is activated by an activation layer in the feature extraction module to obtain an activation matrix; and finally, the activation matrix is regularized by a regularization processing layer in the feature extraction module to obtain an index feature matrix.

[0118] In step S2062, the index feature matrix is encoded based on a self-attention mechanism to obtain an encoded matrix.

[0119] Here, the index feature matrix can be encoded by an encoding module of the index reconstruction model. The encoding module implements the encoding of the index feature matrix through a self-attention mechanism.

[0120] In step S2063, the encoded matrix is fully connected to obtain reconstructed index data.

[0121] Here, the decoding module of the index reconstruction model can be implemented. The decoding module can be implemented as a full connection layer. The full connection layer fully connects the encoded matrix to implement the decoding process and obtain the reconstructed index data.

[0122] In step S207, the server determines a reconstruction error of the to-be-detected object in the preset time window based on the index data sequence and the reconstructed index data.

[0123] In some embodiments, referring to Figure 7 , Figure 7 It is shown that step S207 can be implemented by steps S2071 to S2072:

[0124] In step S2071, a mean square error between the index data sequence and the reconstructed index data is determined.

[0125] In step S2072, the mean square error is determined as the reconstruction error of the to-be-detected object in the preset time window.

[0126] In step S208, the server determines an anomaly score of the to-be-detected object in the preset time window based on the reconstruction error.

[0127] In the embodiments of the present application, the error value of the reconstruction error can be directly determined as the anomaly score, or a fixed weight can be set to weight the error value of the reconstruction error, and the weighted value obtained after the weighting is determined as the anomaly score. The anomaly score can be any value between 0 and 1, or any value between 0 and 100.

[0128] Step S209, the server determines whether the anomaly score is greater than the preset score threshold.

[0129] In the embodiments of the present application, the preset score threshold can be determined by the SPOT algorithm, which is a threshold selection method based on extreme value theory.

[0130] Here, the SPOT (Sequential Probability of Outlier Detection Technique) algorithm is an anomaly detection method based on extreme value theory (EVT, Extreme Value Theory), which determines the anomaly threshold by analyzing the extreme values in the data. The following are the steps of using SPOT algorithm to determine the anomaly threshold: (1) Data preprocessing: collect and clean time series data, handle missing values, noise and outliers; standardize the data to ensure uniform dimension and distribution. (2) Calculate anomaly score: according to the principle of SPOT algorithm, calculate the anomaly score of each data point. This usually involves sorting the data points and calculating the corresponding anomaly score according to their ranking. (3) Distribution fitting of anomaly score: assuming that the anomaly score follows a certain distribution, such as Pareto distribution (Pareto Distribution), use maximum likelihood estimation or other statistical methods to fit the distribution parameters of the data. (4) Determine quantile: according to the fitted distribution, determine the required quantile. For example, if you want to identify the most abnormal 5% of data points, you can choose the 95% quantile as the reference. (5) Calculate threshold: use a preset formula to calculate the anomaly threshold, or directly use the quantile of the anomaly score, for example, if the 95% quantile is 0.95, any data point with an anomaly score greater than 0.95 is considered abnormal. (6) Threshold verification and adjustment: verify the rationality of the threshold through actual data or expert knowledge; adjust the threshold according to the verification result, which may need to be iterated several times to achieve the best effect. (7) Dynamic update: as new data comes in, you may need to recalculate the distribution parameters and threshold to adapt to changes in data. (8) Apply threshold: apply the calculated preset score threshold to the original data set to identify and mark out the abnormal points. Through the above steps, the SPOT algorithm can adaptively determine the preset score threshold, so as to effectively identify abnormal points in time series data. This method is particularly suitable for detecting abnormal events that occur infrequently but have a large impact on data.

[0131] The server determines whether the anomaly score is greater than the preset score threshold. If the result is yes, step S210 is executed; if the result is no, step S211 is executed.

[0132] Step S210, the server determines that the anomaly detection result of the to-be-detected object is detection anomaly, generates alarm information, and sends the alarm information.

[0133] Here, the purpose of the abnormality alarm is to ensure that the system administrator or relevant personnel can respond and handle the performance index abnormality problem in time, wherein the alarm information can be realized in any of the following alarm modes: sound alarm, visual alarm, email alarm, SMS alarm, telephone alarm, instant messaging software alarm, log recording, application program alarm, voice synthesis alarm, and custom script alarm.

[0134] Sound alarm is to issue a sound signal through a computer or a dedicated alarm device to attract attention. This alarm mode is suitable for environments that require immediate attention. Visual alarm is to display warning information using a graphical interface, such as pop-up windows, alarm indicator lights, color changes, etc., for easy user viewing. Email alarm is to automatically send an email to the administrator or relevant personnel when the system detects a performance index abnormality. SMS alarm is to send alarm information to the administrator's mobile phone through an SMS service provider, ensuring that the alarm can be received even if the user is not in front of the computer. Telephone alarm is to automatically dial the administrator's or relevant personnel's phone and perform voice broadcasting. Instant messaging software alarm is to send alarm information through instant messaging software. Log recording is to record alarm information in system log files for subsequent problem positioning and analysis. Application program alarm is to display alarm information in the interface for systems with a management interface. Voice synthesis alarm is to use text-to-speech (TTS) technology to convert alarm information into voice and play it through a speaker. Custom script alarm is to trigger an alarm based on specific performance indicators by writing a custom script.

[0135] Step S211, the server collects a new index data sequence under a time window with the same length as the preset time window from the current time.

[0136] Step S212, the server performs abnormality detection on the to-be-detected object based on the new index data sequence.

[0137] Step S213, the server sends the abnormality detection result to the terminal after obtaining the abnormality detection result.

[0138] Step S214, the terminal outputs the abnormality detection result.

[0139] In the embodiment of the present application, the standardized index sequence is reconstructed by the index reconstruction model based on the Transformer. Since the self-attention mechanism in the Transformer can flexibly process input sequences of different lengths, and the representation of the input position of each input sequence is dynamically calculated according to the entire input sequence rather than a fixed window of fixed length, when the index corresponding to the index data in the index data sequence changes, for example, the index is increased or decreased, the abnormal detection method will not be unavailable, thereby improving the detection efficiency of the abnormal detection process and ensuring the detection quality of the abnormal detection process.

[0140] Figure 8 is another optional flowchart of the abnormal detection method provided by the embodiment of the present application, as shown in Figure 8 The method comprises the following steps S301 to S309.

[0141] In step S301, the terminal receives the abnormal detection operation input by the user.

[0142] In step S302, the terminal encapsulates the object identifier of the object to be detected into an abnormal detection request.

[0143] In step S303, the terminal sends the abnormal detection request to the server.

[0144] In step S304, the server collects the index data sequence of the object to be detected in the preset time window in response to the abnormal detection request.

[0145] It should be noted that steps S301 to S304 are the same as steps S201 to S204 described above, and the implementation details of steps S301 to S304 will not be described again in the embodiment of the present application.

[0146] In step S305, the server obtains the first index corresponding to the index data in the index data sequence.

[0147] Here, the first index refers to all the indexes corresponding to the index data in the index data sequence.

[0148] In step S306, the server obtains the historical index data sequence in the historical time window before the preset time window, and the second index corresponding to the historical index data.

[0149] Here, the historical index data sequence is time series data formed by the index data in the historical time window, and the second index is all the indexes corresponding to the index data in the historical index data sequence. The historical time window is continuous with the preset time window, that is, the window end time of the historical time window overlaps with the window start time of the preset time window.

[0150] Step S307, the server determines whether the second index is the same as the first index.

[0151] Here, in determining whether the second index is the same as the first index, the number of indexes of the second index and the number of indexes of the first index can be determined first. If the number of indexes of the second index and the number of indexes of the first index are different, it is determined that the second index is different from the first index. If the number of indexes of the second index and the number of indexes of the first index are the same, it can be further determined whether each index in the second index has the same index in the first index. If each index in the second index has the same index in the first index, i.e., each index in the second index is completely the same as each index in the first index, it is determined that the second index is the same as the first index, otherwise, it is determined that the second index is different from the first index.

[0152] Step S308, if the second index is different from the first index, the server collects a target index data sequence under a time window with the same length as the preset time window from the current time.

[0153] In the embodiments of the present application, if the second index is different from the first index, it indicates that the current index has changed, including index change, index increase, index reduction, therefore, the abnormality detection of the to-be-detected object needs to be performed based on the new index data after the index change, so as to ensure the accuracy of the abnormality detection result. At this time, the target index data sequence under the time window with the same length as the preset time window from the current time can be collected. The target index data sequence is a time data sequence composed of index data under the new index after the index change.

[0154] Step S309, the server performs abnormality detection on the to-be-detected object based on the target index data sequence.

[0155] In the embodiments of the present application, after the server collects the target indicator data sequence, the abnormality detection of the to-be-detected object based on the target indicator data sequence can be implemented in the following manner: first, the target indicator data sequence is standardized to obtain a standardized target indicator sequence; then, the standardized target indicator sequence is reconstructed based on a self-attention mechanism to obtain target reconstructed indicator data; based on the target indicator data sequence and the target reconstructed indicator data, a target reconstruction error of the to-be-detected object in a time window with the same length as the preset time window is determined; finally, based on the target reconstruction error, a target anomaly score of the to-be-detected object in the time window with the same length as the preset time window is determined, if the target anomaly score is greater than a preset score threshold, it is determined that the abnormality detection result of the to-be-detected object is detection anomaly, an alarm information is generated, and the alarm information is sent; if the target anomaly score is less than or equal to the preset score threshold, from the current time, new indicator data sequences in the time window with the same length as the preset time window are continuously collected, and the to-be-detected object is detected again based on the new indicator data sequences.

[0156] In some embodiments, if the second indicator is the same as the first indicator, the abnormality detection method in the above embodiments is used to detect the abnormality of the to-be-detected object, that is, the above steps S205 to S214 are continued to be executed. Figure 8 In some embodiments, the symbol A in steps S205 to S214 represents steps S205 to S214.

[0157] In some embodiments, the data reconstruction of the indicator data sequence of the to-be-detected object described above can be implemented by a pre-trained indicator reconstruction model, that is, the standardized indicator sequence can be input into the indicator reconstruction model, and the standardized indicator sequence is reconstructed based on the self-attention mechanism by the indicator reconstruction model to obtain the reconstructed indicator data. Based on this, the embodiments of the present application further provide a training method of an indicator reconstruction model, Figure 9 is a flowchart of the training method of the indicator reconstruction model provided by the embodiments of the present application. The training method of the indicator reconstruction model can be implemented by a model training module, which can be a module in an electronic device, that is, the execution subject of the training method of the indicator reconstruction model can be a server or a terminal. The embodiments of the present application take the execution subject of the training method of the indicator reconstruction model as a server as an example for description, as shown in Figure 9 The method includes the following steps S401 to S409:

[0158] Step S401, the sample indicator data sequence of the sample object in the sample time window is standardized to obtain a sample standardized indicator sequence.

[0159] Here, the sample object can be any entity capable of detecting whether the performance is abnormal, for example, the sample object can be a physical machine, a virtual machine, a container, or the like.

[0160] In the embodiment of the application, the index reconstruction model obtained by training the to-be-trained index reconstruction model through the sample index data sequence of the sample object can be applied to abnormal detection of entities of the same type, or can be applied to abnormal detection of entities of different types. For example, the index reconstruction model obtained by training the to-be-trained index reconstruction model through the sample index data sequence of the physical machine can be applied to abnormal detection of the physical machine, or can be applied to abnormal detection of the virtual machine or the container. Because the index reconstruction model of the embodiment of the application is based on the self-attention mechanism to reconstruct data, even if the index types of the physical machine and the virtual machine or the container are different, after training the to-be-trained index reconstruction model based on the sample index data sequence of the physical machine, the obtained index reconstruction model can be applied to abnormal detection of the virtual machine or the container after retraining the index reconstruction model based on a new index data sequence in a preset time window when the index type of the virtual machine or the container is detected to change. Therefore, the application range of abnormal detection is greatly expanded, the data calculation amount of model training is reduced, and the detection efficiency of abnormal detection is improved due to the applicability between different entities.

[0161] In step S402, the sample standardized index sequence is input into the to-be-trained index reconstruction model.

[0162] In step S403, the sample standardized index data sequence is reconstructed by the index reconstruction model to obtain sample reconstructed index data.

[0163] In the embodiment of the application, the index reconstruction model can include a feature extraction module, an encoding module, and a decoding module. The sample standardized index data sequence is reconstructed by the index reconstruction model, which can be realized in the following manner: first, the sample standardized index data sequence is extracted by the feature extraction module in the index reconstruction model to obtain a sample index feature matrix; then, the sample index feature matrix is encoded based on the self-attention mechanism by the encoding module in the index reconstruction model to obtain a sample encoding matrix; finally, the sample encoding matrix is fully connected by the decoding module in the index reconstruction model to obtain sample reconstructed index data.

[0164] In step S404, the sample reconstruction error of the sample object in the sample time window is determined based on the sample index data sequence and the sample reconstructed index data.

[0165] Step S405: Based on the sample reconstruction error, update the model parameters in the index reconstruction model to obtain the trained index reconstruction model.

[0166] The training method for the indicator reconstruction model provided in this application updates the model parameters in the indicator reconstruction model through sample reconstruction error, so that the trained indicator reconstruction model can perform accurate data reconstruction by standardizing the indicator sequence when reconstructing data, thereby improving the detection accuracy of anomaly detection.

[0167] In some embodiments, when the number of indicators corresponding to the sample indicator data in the collected sample indicator data sequence changes, a timestamp can be recorded. When the new data collection meets a certain duration (e.g., 1 to 7 days), the newly collected data can be used as a training set to incrementally train the indicator reconstruction model, thereby updating the model.

[0168] like Figure 9 As shown, the method may further include the following steps S406 to S409:

[0169] Step S406: Obtain the first sample indicator corresponding to the current sample indicator data in the sample indicator data sequence collected at the current moment.

[0170] Step S407: Obtain the second sample indicator corresponding to the sample indicator data sequence under the sample time window.

[0171] Step S408: If the second sample indicator is different from the first sample indicator, starting from the current moment, collect the target sample indicator data sequence under the time window with the same duration as the sample time window.

[0172] Step S409: Use the target sample index data sequence to incrementally train the trained index reconstruction model.

[0173] The training method for the indicator reconstruction model provided in this application embodiment can, after training the indicator reconstruction model, collect new target sample indicator data sequences to incrementally train the trained indicator reconstruction model once the number of indicators corresponding to the sample indicator data changes, without having to retrain the indicator reconstruction model to be trained. This greatly reduces the amount of data computation during the model training process, improves the model training efficiency, and saves computing resources during the model training process.

[0174] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario.

[0175] In an Internet company, a large number of businesses are deployed on physical machines, virtual machines and containers, which are collectively referred to as an entity. In order to ensure the running quality of the businesses on these entities, system indicators (such as cpu usage, disk usage, etc.) of these entities need to be collected for detection.

[0176] The embodiment of the present application provides an anomaly detection method for real-time detection of performance anomalies of individual objects such as physical machines, virtual machines and containers. The anomaly detection method corresponds to an anomaly detection product, which reflects the current business running condition through observation of system indicators. The anomaly detection product can analyze the collected indicator data sequence using the embodiment of the present application, and then perform anomaly detection to determine the running health degree of the current business. Specifically, the anomaly detection method of the embodiment of the present application trains the indicator reconstruction model based on the Transformer by inputting each indicator data sequence as a text unit (token), uses a new preprocessing method, and adopts the strategy of periodically updating the indicator reconstruction model, so that when a small amount of indicators are no longer collected or a small amount of new indicators are added, the indicator reconstruction model is still available.

[0177] The problems to be solved by the embodiment of the present application mainly include that in the daily development and use of the detection system, sometimes some collected indicators need to be deleted or some indicators need to be added. However, the number of indicators cannot be changed after the current deep learning anomaly detection algorithm model is trained. The change of the number of indicators will directly cause the model to be unavailable. The embodiment of the present application uses real-time data for data standardization, uses the indicator reconstruction model based on the Transformer for encoding, and incrementally updates the indicator reconstruction model after the indicators change, so that when the number of indicators changes, the trained indicator reconstruction model is still temporarily available.

[0178] Specifically, this embodiment uses a multi-layer Transformer to input the indicator data for each indicator over a period of time as tokens. Even when the number of indicators changes while the data is input to the Transformer in this way, the indicator reconstruction model can still function. Furthermore, to address the standardization issue of new indicators, this embodiment does not use a standardization scaler (used in machine learning to standardize data) fitted to the training set. Instead, it uses data with quantiles ranging from 5% to 95% within a preset time window to fit the standardization scaler. In addition, to enable the indicator reconstruction model to learn patterns in newly added indicators, a strategy of incrementally updating the model after indicator changes is adopted. That is, when the collected indicators change (added or removed), the moment is recorded, and the indicator reconstruction model is updated using data from 1 to 7 days after that moment.

[0179] The calculation process of the index reconstruction model in the anomaly detection method of this application embodiment will be described below.

[0180] First, for a given moment (i.e., the current moment), indicator data from several past moments are concatenated to form a data set for a preset time window (i.e., an indicator data sequence), which serves as the input to the indicator reconstruction model. For each preset time window's indicator data, data standardization is performed. Specifically, for each indicator data point, the data with quantiles between 5% and 95% are selected, and the variance and mean of the selected data are calculated. Then, using the variance and mean of each individual indicator data point, the standardization process is applied to each indicator data point in the indicator data sequence. In this embodiment, using 5% to 95% of the data to fit the variance and mean is to prevent the variance and mean from being affected by outliers when the data size is small. Traditional methods use the entire training set to fit the variance and mean, resulting in a large data volume; therefore, this embodiment does not use this operation.

[0181] Then, for the standardized window data (i.e., the standardized indicator sequence), this standardized indicator sequence is input into the embedding layer (i.e., the feature extraction module) of the indicator reconstruction model. For example... Figure 10 The diagram illustrates the processing flow of the feature extraction module in the indicator reconstruction model. Feature extraction module 1001 consists of a fully connected layer 1002, an activation layer 1003, and a DropOut layer 1004 (i.e., a regularization layer). The purpose of this step is to extract features from the standardized indicator sequence and match the dimension of the extracted indicator feature matrix with the hidden layer dimension of the subsequent Transformer layer. Figure 10As shown in FIG. 6, the calculation process is taken as an example with window length = 60, number of indicators = 50, and Transformer latent dimension = 128.

[0182] After that, the output result of the previous step is processed, as shown in FIG. 7. Figure 11 As shown in FIG. 8, the processing flow diagram of the encoding module of the indicator reconstruction model provided in the embodiment of the present application is shown. The output data of the previous step is input into the multi-layer Transformer module (i.e., the encoding module) for encoding to obtain an encoding matrix. When the data of a period of each indicator is taken as a token, the self-attention mechanism of the multi-layer Transformer module can flexibly process input token sequences of different lengths, because the representation of each input position is dynamically calculated according to the entire input sequence, rather than a fixed length of a fixed window, so that increasing or decreasing indicators will not cause the model to be unavailable.

[0183] Then, as shown in FIG. 9, the processing flow diagram of the decoding module of the indicator reconstruction model provided in the embodiment of the present application is shown. The encoding matrix is decoded using a fully connected layer to obtain the final reconstruction result (i.e., the reconstructed indicator data). Figure 12

[0184] Figure 13 As shown in FIG. 10, the overall calculation process diagram of the indicator reconstruction model provided in the embodiment of the present application is shown. After the reconstruction result is calculated through the indicator reconstruction model, as shown in FIG. 11, the MSE of the reconstruction result (i.e., the encoding result) and the original window data (i.e., the original indicator data sequence) is taken as the reconstruction error when performing anomaly detection. In the training phase, the reconstruction error will be used as a loss function to optimize the model parameters. In the testing phase, the reconstruction error will be used as an anomaly score to determine whether the point is abnormal. Figure 13

[0185] The training phase and the anomaly detection phase of the indicator reconstruction model provided in the embodiment of the present application are described below.

[0186] In the training phase, as shown in FIG. 12, the following steps S501 to S504 are included: Figure 14

[0187] Step S501, the server acquires the historical indicator data collected by the to-be-detected object for 1 to 2 weeks.

[0188] Step S502, the server processes the historical indicator data into an indicator data sequence under a preset time window, and performs standardization processing on the indicator data under each time window.

[0189] ​​​Step S503, the server uses the index reconstruction model to reconstruct data for each time window, and optimizes the model parameters of the index reconstruction model with the reconstruction error as the loss function.

[0190] Step S504, when the number of collected indexes changes, the server collects new index data for 1-7 days to incrementally train the index reconstruction model to update the index reconstruction model.

[0191] In the training phase, for the to-be-detected objects deploying the same service, 7-14 days of historical index data of the to-be-detected objects are collected as a training set to train the index reconstruction model. During training, a time window is generated for each time point as input data input to the index reconstruction model for training. The generation method of the time window can be, for example, window_size=60, so that the data of the time point and the past 59 time points are spliced together to form a time window with a time length of 60 points. Then the parameters of the index reconstruction model are trained by optimizing the reconstruction error of the time window.

[0192] When the number of indexes changes, the next timestamp can be recorded. When the newly collected index data meets a certain time length (such as 1-7 days), the newly collected index data is used as a training set to incrementally train the index reconstruction model to update the index reconstruction model. Compared with the traditional method, since the traditional method cannot solve the case of changing the number of training data indexes, the model structure of the traditional model depends on the number of indexes after the first training, and subsequent incremental training must ensure that the number of indexes does not change. For example, the number of indexes is 20 at the beginning of training, and now the number of indexes has changed to 19 or 21. Therefore, the model cannot input data with this dimension, so the traditional model can only train a new model from scratch. The method of the present application embodiment does not need to retrain from scratch, which can obviously greatly reduce the calculation amount of the model training phase, thereby saving the computing resources of the server.

[0193] In the abnormality detection phase, as shown in FIG. 6, the method comprises the following steps: Figure 15

[0194] Step S601, the server acquires real-time index data of the to-be-detected object.

[0195] Step S602, the server judges whether the indexes change (i.e., whether there are new or deleted indexes).

[0196] If the judgment result is yes, step S603 is executed; if the judgment result is no, step S604 is executed.

[0197] Step S603, the server judges whether the new collection tool has collected more than a preset time window. ​

[0198] The preset time window herein is equal to the time window multiplied by the window length value.

[0199] If the result of the judgment is yes, step S604 is executed; if the result of the judgment is no, the current detection is skipped.

[0200] In step S604, the server processes the collected real-time index data into a time sequence (i.e., an index data sequence), and performs standardization processing on the data of each time window.

[0201] In step S605, the server uses the index reconstruction model to perform data reconstruction on the input standardized index data sequence under the preset time window, and calculates the reconstruction error as an anomaly score.

[0202] In step S606, the server uses the SPOT algorithm to determine a preset score threshold, compares the anomaly score of the moment with the preset score threshold, and judges whether the moment is abnormal.

[0203] In step S607, if it is abnormal, an alarm is triggered, and further analysis is performed according to the anomaly score of each index.

[0204] In the anomaly detection stage in the embodiment of the application, for each moment, the index reconstruction model trained in the embodiment of the application is used to reconstruct the data of a time window. The reconstruction error of the time window is calculated as an anomaly score. If the to-be-detected object is running normally, the regularity of the index data will be similar to the pattern shown in the training set, and the reconstruction error of the index reconstruction model will be small. If the to-be-detected object is abnormal, the regularity of the index data will often be contrary to the data in the training stage, so that the index reconstruction model cannot well reconstruct it, thereby causing the reconstruction error of the time window to be large and the anomaly score to be large. For the selection of the preset score threshold, the SPOT algorithm is used to determine the preset score threshold. If the anomaly score of a moment exceeds the preset score threshold determined by the SPOT algorithm, it is determined to be abnormal, and an alarm is triggered.

[0205] The anomaly detection method provided in the embodiment of the application can perform automatic anomaly detection and alarm, thereby reducing the operation and maintenance labor cost and assisting the operation and maintenance personnel in decision-making. Meanwhile, since the traditional method cannot handle the index deletion, when the index is deleted, a week of complete data needs to be collected again, so that the traditional method has an unresponsive period of at least one week. However, the embodiment of the application only needs to collect data of a length of a time window to continue working when the index is deleted, so that the unresponsive period is only <window length value*data collection interval>. Taking the data collection interval of 15 seconds and the window length value of 60 as an example, the unresponsive period is 15 minutes. As can be seen, the method of the embodiment of the application greatly reduces the unusable time of the model after the number of indexes changes.

[0206] It should be noted that the number of layers N of the Transformer layer in the embodiments of the present application can be greater than 1, or can be equal to 1, that is, the multi-head attention mechanism can be replaced by a single-head attention mechanism. When performing the normalization processing, the value range of 5% to 95% for fitting the scaler in the preset time window is exemplary and not fixed, and can be adaptively adjusted, for example, can be modified to 10% to 90%. The embodiments of the present application do not limit the value.

[0207] It can be understood that in the embodiments of the present application, the content related to user information, for example, the index data sequence, if related to data related to user information or enterprise information, when the embodiments of the present application are applied to specific products or technologies, the user permission or consent needs to be obtained, or the information is blurred to eliminate the corresponding relationship between the information and the user; and the related data collection and processing should strictly comply with the requirements of relevant national laws and regulations, obtain the informed consent or separate consent of the personal information subject, and within the scope of authorization of laws and regulations and the personal information subject, carry out subsequent data use and processing behavior.

[0208] The following continues to illustrate an exemplary structure of the anomaly detection apparatus 354 implemented as a software module provided by the embodiments of the present application. In some embodiments, as shown in Figure 2 The anomaly detection apparatus 354 includes: a normalization processing module 3541 configured to perform normalization processing on an index data sequence of a to-be-detected object in a preset time window to obtain a normalized index sequence; a data reconstruction module 3542 configured to perform data reconstruction on the normalized index sequence to obtain reconstructed index data; a determination module 3543 configured to determine a reconstruction error of the to-be-detected object in the preset time window based on the index data sequence and the reconstructed index data; and an anomaly detection module 3544 configured to perform anomaly detection on the to-be-detected object based on the reconstruction error.

[0209] In some embodiments, the normalization processing module is further configured to: determine a quantile of the index data in the index data sequence; determine, as candidate index data, the index data within a preset quantile interval based on the quantile of the index data; and perform normalization processing on each index data in the index data sequence based on the candidate index data to obtain the normalized index sequence.

[0210] In some embodiments, the normalization processing module is further configured to: determine a variance and a mean of the candidate index data; and perform normalization processing on each index data in the index data sequence based on the variance and the mean, respectively, to obtain the normalized index sequence.

[0211] In some embodiments, the data reconstruction module is further configured to: perform feature extraction on the standardized index sequence to obtain an index feature matrix; encode the index feature matrix based on a self-attention mechanism to obtain an encoded matrix; and perform full connection processing on the encoded matrix to obtain the reconstructed index data.

[0212] In some embodiments, the data reconstruction module is further configured to: perform full connection processing on the standardized index sequence by a full connection layer to obtain a full connection matrix; perform activation processing on the full connection matrix by an activation layer to obtain an activation matrix; and perform regularization processing on the activation matrix by a regularization processing layer to obtain the index feature matrix.

[0213] In some embodiments, the determination module is further configured to: determine a mean square error between the index data sequence and the reconstructed index data; and determine the mean square error as a reconstruction error of the to-be-detected object in the preset time window.

[0214] In some embodiments, the anomaly detection module is further configured to: determine an anomaly score of the to-be-detected object in the preset time window based on the reconstruction error; and perform anomaly detection on the to-be-detected object based on the anomaly score and a preset score threshold.

[0215] In some embodiments, the apparatus further includes an anomaly detection result determination module configured to: if the anomaly score is greater than the preset score threshold, determine an anomaly detection result of the to-be-detected object as detecting an anomaly, generate an alarm information, and send the alarm information; and if the anomaly score is less than or equal to the preset score threshold, collect a new index data sequence in a time window having the same length as the preset time window from a current time; and the anomaly detection module is further configured to perform anomaly detection on the to-be-detected object based on the new index data sequence.

[0216] In some embodiments, the apparatus further includes a preset time window determination module configured to determine a preset time length before a current time as the preset time window; a data collection module configured to collect index data corresponding to each index in a first number of indexes in the preset time window; and a data aggregation module configured to aggregate the index data corresponding to each index to obtain the index data sequence.

[0217] In some embodiments, the preset time window determination module is further configured to: obtain a preset data collection interval and a preset window length value; determine a product of the data collection interval and the window length value as the preset time length; and determine a time interval before the current time and having the preset time length as the preset time window, with the current time as a time window cutoff point.

[0218] In some embodiments, the apparatus further comprises: an acquisition module configured to acquire a first index corresponding to the index data in the index data sequence; acquire a historical index data sequence in a historical time window before the preset time window, and a second index corresponding to the historical index data; a sequence acquisition module configured to, if the second index is different from the first index, acquire a target index data sequence in a time window with the same length as the preset time window from the current time; and the anomaly detection module is further configured to perform anomaly detection on the to-be-detected object based on the target index data sequence.

[0219] In some embodiments, the data reconstruction on the index data sequence of the to-be-detected object is implemented by a pre-trained index reconstruction model; the apparatus further comprises: a model training module configured to train the index reconstruction model by the following steps: performing standardization processing on a sample index data sequence of a sample object in a sample time window to obtain a sample standardized index sequence; inputting the sample standardized index sequence into the index reconstruction model to be trained; performing data reconstruction on the sample standardized index data sequence by the index reconstruction model to obtain sample reconstructed index data; determining a sample reconstruction error of the sample object in the sample time window based on the sample index data sequence and the sample reconstructed index data; updating model parameters in the index reconstruction model based on the sample reconstruction error to obtain a trained index reconstruction model.

[0220] In some embodiments, after obtaining the trained index reconstruction model, the model training module is further configured to: acquire a first sample index corresponding to current sample index data in a sample index data sequence collected at the current time; acquire a second sample index corresponding to the sample index data sequence in the sample time window; if the second sample index is different from the first sample index, acquire a target sample index data sequence in a time window with the same length as the sample time window from the current time; and perform incremental training on the trained index reconstruction model by using the target sample index data sequence.

[0221] It should be noted that the description of the apparatus embodiments of the present application is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments, and thus is not described herein. For technical details not disclosed in the present apparatus embodiments, please refer to the description of the method embodiments of the present application.

[0222] The embodiment of the present application provides a computer program product, which comprises executable instructions, the executable instructions being computer instructions; the executable instructions are stored in a computer readable storage medium. When the processor of an electronic device reads the executable instructions from the computer readable storage medium, the processor executes the executable instructions, so that the electronic device executes the method provided by the embodiment of the present application.

[0223] The embodiment of the present application provides a storage medium storing executable instructions, wherein the executable instructions are stored, and when the executable instructions are executed by a processor, the processor executes the method provided by the embodiment of the present application, for example, the method shown in the figure. Figure 3 In some embodiments, the storage medium can be a computer readable storage medium, for example, a ferroelectric memory (FRA M, Ferromagnetic Random Access Memory), a read-only memory (ROM, Read Only Memory), a programmable read-only memory (PROM, Programmable Read Only Memory), an erasable programmable read-only memory (EPROM, Erasable Programmable Read Only Memory), an electrically erasable programmable read-only memory (EEPROM, Electrically Erasable Programmable Read Only Memory), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM, Compact Disk-Read Only Memory) and the like memory; it can also be various devices comprising one or any combination of the above memories.

[0224] In some embodiments, the executable instructions can be in the form of programs, software, software modules, scripts or codes, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and can be deployed in any form, including being deployed as independent programs or being deployed as modules, components, subroutines or other units suitable for use in a computing environment.

[0225] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file containing other programs or data, for example, in one or more scripts within a Hypertext Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., files storing one or more modules, subroutines, or code sections). As an example, executable instructions may be deployed to execute on a single electronic device, or on multiple electronic devices located in one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0226] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. An anomaly detection method, characterized in that, The method includes: The index data sequence of the object to be tested within a preset time window is standardized to obtain a standardized index sequence. The standardized indicator sequence is reconstructed to obtain reconstructed indicator data; Based on the indicator data sequence and the reconstructed indicator data, the reconstruction error of the object to be detected under the preset time window is determined; Based on the reconstruction error, anomaly detection is performed on the object to be detected.

2. The method according to claim 1, characterized in that, The standardization process is performed on the indicator data sequence of the object to be detected within a preset time window to obtain a standardized indicator sequence, including: Determine the quantiles of the indicator data in the indicator data sequence; Based on the quantiles of the indicator data, indicator data that fall within a preset quantile interval are identified as candidate indicator data. Based on the candidate indicator data, each indicator data in the indicator data sequence is standardized to obtain the standardized indicator sequence.

3. The method according to claim 2, characterized in that, The step of standardizing each indicator data in the indicator data sequence based on the candidate indicator data to obtain the standardized indicator sequence includes: Determine the variance and mean of the candidate index data; The variance and mean are used to standardize each index data in the index data sequence to obtain the standardized index sequence.

4. The method according to claim 1, characterized in that, The step of reconstructing the standardized indicator sequence to obtain reconstructed indicator data includes: Feature extraction is performed on the standardized indicator sequence to obtain the indicator feature matrix; The indicator feature matrix is ​​encoded based on the self-attention mechanism to obtain the encoding matrix; The encoding matrix is ​​subjected to a fully connected process to obtain the reconstructed index data.

5. The method according to claim 4, characterized in that, The step of extracting features from the standardized index sequence to obtain an index feature matrix includes: The standardized index sequence is processed by a fully connected layer to obtain a fully connected matrix; The fully connected matrix is ​​activated by an activation layer to obtain an activation matrix; The activation matrix is ​​regularized using a regularization layer to obtain the index feature matrix.

6. The method according to claim 1, characterized in that, The step of determining the reconstruction error of the object to be detected within the preset time window based on the indicator data sequence and the reconstructed indicator data includes: Determine the mean square error between the indicator data sequence and the reconstructed indicator data; The mean square error is defined as the reconstruction error of the object to be detected within the preset time window.

7. The method according to claim 1, characterized in that, The step of performing anomaly detection on the object to be detected based on the reconstruction error includes: Based on the reconstruction error, the anomaly score of the object to be detected within the preset time window is determined; Based on the abnormal score and the preset score threshold, anomaly detection is performed on the object to be detected.

8. The method according to claim 7, characterized in that, The method further includes: If the abnormal score is greater than the preset score threshold, the abnormal detection result of the object to be detected is determined to be a detection abnormality, an alarm message is generated, and the alarm message is sent. If the abnormal score is less than or equal to the preset score threshold, a new sequence of indicator data is collected from the current moment within a time window of the same duration as the preset time window. Based on the new indicator data sequence, anomaly detection is performed on the object to be detected.

9. The method according to claim 1, characterized in that, The method further includes: The preset time window is defined as the preset time length preceding the current moment. Collect the indicator data corresponding to each indicator in the first number of indicators within the preset time window; The indicator data corresponding to each indicator is summarized to obtain the indicator data sequence.

10. The method according to claim 9, characterized in that, The step of determining the preset time window as the preset time length prior to the current moment includes: Obtain the preset data acquisition interval and preset window length value; The product of the data acquisition interval and the window length value is determined as the preset time length; Using the current moment as the end point of the time window, the time interval before the current moment that has the preset time length is determined as the preset time window.

11. The method according to claim 1, characterized in that, The method further includes: Obtain the first indicator corresponding to the indicator data in the indicator data sequence; Obtain the historical indicator data sequence under the historical time window before the preset time window, and the second indicator corresponding to the historical indicator data; If the second indicator is different from the first indicator, starting from the current moment, collect the target indicator data sequence under a time window with the same duration as the preset time window; Based on the target indicator data sequence, anomaly detection is performed on the object to be detected.

12. The method according to any one of claims 1 to 11, characterized in that, The data reconstruction of the indicator data sequence of the object to be detected is achieved through a pre-trained indicator reconstruction model; the method further includes: The index reconstruction model is trained using the following steps: The sample index data sequence of the sample object under the sample time window is standardized to obtain the sample standardized index sequence. The standardized index sequence of the samples is input into the index reconstruction model to be trained; The standardized indicator data sequence of the sample is reconstructed using the indicator reconstruction model to obtain the reconstructed indicator data of the sample. Based on the sample index data sequence and the sample reconstruction index data, determine the sample reconstruction error of the sample object within the sample time window; Based on the sample reconstruction error, the model parameters in the index reconstruction model are updated to obtain the trained index reconstruction model.

13. The method according to claim 12, characterized in that, After obtaining the trained metric reconstruction model, the method further includes: Obtain the first sample indicator corresponding to the current sample indicator data in the sample indicator data sequence collected at the current moment; Obtain the second sample indicator corresponding to the sample indicator data sequence under the sample time window; If the second sample indicator is different from the first sample indicator, starting from the current moment, collect the target sample indicator data sequence under a time window with the same duration as the sample time window; The target sample index data sequence is used to incrementally train the trained index reconstruction model.

14. An anomaly detection device, characterized in that, The device includes: The standardization processing module is used to standardize the index data sequence of the object to be tested within a preset time window to obtain a standardized index sequence. The data reconstruction module is used to reconstruct the standardized indicator sequence to obtain reconstructed indicator data. The determination module is used to determine the reconstruction error of the object to be detected within the preset time window based on the indicator data sequence and the reconstructed indicator data. An anomaly detection module is used to perform anomaly detection on the object to be detected based on the reconstruction error.

15. An electronic device, characterized in that, include: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the anomaly detection method according to any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions or computer programs, which, when executed by a processor, implement the anomaly detection method according to any one of claims 1 to 13.

17. A computer program product, characterized in that, It includes computer-executable instructions or computer programs that, when executed by a processor, implement the anomaly detection method according to any one of claims 1 to 13.

Images