Server anomaly detection method, electronic equipment and readable storage medium

Abstract

The invention provides a server anomaly detection method, electronic equipment and a readable storage medium, relates to the field of server health management, and can improve anomaly detection efficiency after a server is abnormal. Comprising the steps that abnormal operation data of at least one server is determined based on operation data of the at least one server, and the operation data comprises at least one of the resource utilization rate and the interface response duration; inputting the abnormal operation data of each server into a diagnosis model, determining a target anomaly detection tool corresponding to the abnormal operation data from a plurality of anomaly detection tools through a first network of the diagnosis model, and obtaining anomaly detection information corresponding to the abnormal operation data based on the target anomaly detection tool, inputting the abnormal detection information corresponding to the abnormal operation data into a second network of the diagnosis model, and obtaining a diagnosis report corresponding to the abnormal detection information.

Description

Technical Field

[0001] This application relates to the field of server health management, and in particular to a server anomaly detection method, electronic device, and readable storage medium. Background Technology

[0002] In the digital age, everything from user access on internet platforms and core data storage for enterprises to business processing in critical areas such as industrial control, medical AI, and telecommunications relies on the stable operation of servers. Server health directly impacts business operations, data storage, and user privacy and security. Therefore, server health monitoring has become a crucial means of ensuring reliable server operation.

[0003] However, existing technologies have low accuracy in diagnosing the cause of server anomalies. Summary of the Invention

[0004] This application provides a server anomaly detection method, electronic device, and readable storage medium, which can improve the efficiency of anomaly detection after a server anomaly occurs.

[0005] Firstly, this application provides a server anomaly detection method, comprising: determining at least one server's abnormal operating data based on the operating data of at least one server, wherein the operating data includes at least one of resource utilization and interface response time; inputting the abnormal operating data of each server into a diagnostic model; determining a target anomaly detection tool corresponding to the abnormal operating data from multiple anomaly detection tools through a first network of the diagnostic model; and obtaining anomaly detection information corresponding to the abnormal operating data based on the target anomaly detection tool; wherein the anomaly detection tool is related to the anomaly type of the abnormal operating data, and the anomaly type of the abnormal operating data includes abnormal resource utilization and / or abnormal interface response time; and inputting the anomaly detection information corresponding to each abnormal operating data into a second network of the diagnostic model to obtain a diagnostic report corresponding to the anomaly detection information.

[0006] Based on the first aspect, by combining the diagnostic model's calling capability with detection tools, different anomaly detection tools can be invoked based on the anomaly type of abnormal server operation data, and the anomaly inspection information returned by the anomaly detection tools can be obtained. This makes the diagnostic model more accurate in obtaining the diagnostic report corresponding to the abnormal operation data based on the anomaly detection information, and eliminates the need for manual server detection. The model directly calls the corresponding anomaly detection tools, which improves the efficiency of server anomaly detection.

[0007] In one feasible implementation, the diagnostic model described above establishes a correspondence between the anomaly types of abnormal operational data and anomaly detection tools.

[0008] The first network of the diagnostic model, as described above, identifies the target anomaly detection tool corresponding to the abnormal operational data from multiple anomaly detection tools, including: By using the first network of the diagnostic model and the corresponding relationships, the target anomaly detection tool corresponding to the abnormal operation data is determined from multiple anomaly detection tools.

[0009] In another feasible implementation, the aforementioned anomaly detection tools include a first detection tool, a second detection tool, and a third detection tool. The first detection tool is used to detect the server's liveness status; liveness status includes whether the server is alive or offline. The second detection tool is used to detect the server's login status; login status includes whether login was successful or failed. The third detection tool is used to detect the server's service and resource usage status; service and resource usage status includes whether usage is normal or abnormal.

[0010] The correspondence between the anomaly types of the above-mentioned abnormal operation data and the anomaly detection tools includes: The anomaly type of abnormal operation data is resource utilization anomaly, and the corresponding target anomaly detection tool for abnormal operation data includes the third detection tool; the anomaly type of abnormal operation data is interface response time anomaly, and the corresponding target anomaly detection tool for abnormal operation data includes the first detection tool and the second detection tool; the anomaly type of abnormal operation data is both resource utilization anomaly and interface response time anomaly, and the corresponding target anomaly detection tool for abnormal operation data includes the second detection tool and the third detection tool.

[0011] In another feasible implementation, the above-mentioned anomaly detection information obtained from the abnormal operation data based on the target anomaly detection tool includes: If the target anomaly detection tool includes a first detection tool, the server's liveness status is obtained through a first preset protocol indicated by the first detection tool. If the target anomaly detection tool includes a second detection tool, the server login operation is performed through a second preset protocol indicated by the second detection tool to obtain the server login status. If the target anomaly detection tool includes a third detection tool, the service and resource operation logs on the server are obtained through the third detection tool, and the usage status of the services and resources on the server is determined by traversing the service and resource operation logs.

[0012] In another feasible implementation, the aforementioned operational data includes resource utilization. Based on the operational data of at least one server, abnormal operational data of at least one server is determined, including: Obtain the server's resource utilization rate and its corresponding timestamp. Input the resource utilization rate and its timestamp into the prediction model to obtain the predicted value of the resource utilization rate. If the resource utilization rate is greater than the predicted value of the first multiplier, the resource utilization rate is determined to be abnormal operating data. The server's resource utilization rate exhibits a periodic variation pattern, and the predicted value output by the prediction model is related to this periodic variation pattern.

[0013] In another feasible implementation, the above method also includes: The process involves acquiring operational sample data from the server, including sample resource utilization and corresponding timestamps. Sample resource utilization includes both normal and abnormal utilization rates. Following a pre-defined periodic processing rule, feature transformation is performed on the timestamps corresponding to the sample resource utilization to obtain cyclical timestamp features. These operational sample data and corresponding cyclical timestamp features are then used as input to the initial prediction model. Based on reference operational sample data, the XGBoost algorithm (a gradient boosting decision tree framework) is employed to train the pre-defined prediction model. Reference operational sample data refers to operational sample data preceding the timestamps of the operational sample data. A prediction model is obtained when training conditions are met, including model convergence.

[0014] In another feasible implementation, the aforementioned preset periodic processing rules include a first processing rule and a second processing rule. The first processing rule includes a calculation rule for a periodic change pattern with a one-day cycle, and the second processing rule includes a calculation rule for a periodic change pattern with a one-week cycle. The timestamp cycle feature includes a first timestamp cycle feature and a second timestamp cycle feature.

[0015] The above-mentioned processing rules, based on preset cycle rules, perform feature transformation on the sample timestamps corresponding to the sample resource utilization rate to obtain the timestamp cycle features, including: According to the first processing rule and the first calculation method, the sample timestamps corresponding to the sample resource utilization rate are mapped to polar coordinates for feature transformation to obtain the first timestamp cyclic feature. According to the second processing rule and the second calculation method, the sample timestamps corresponding to the sample resource utilization rate are mapped to polar coordinates for feature transformation to obtain the second timestamp cyclic feature.

[0016] In another feasible implementation, the first calculation method mentioned above includes a calculation method using a cosine function; the second calculation method includes a calculation method using both cosine and sine functions.

[0017] In another feasible implementation, the anomaly detection information corresponding to each abnormal operation data is input into the second network of the diagnostic model to obtain a diagnostic report corresponding to the anomaly detection information, including: The anomaly detection information corresponding to each abnormal operation data is input into the second network of the diagnostic model. The anomaly detection information is semantically parsed based on the operation and maintenance knowledge base to obtain the semantic parsing results corresponding to the anomaly detection information. The operation and maintenance knowledge base includes historical anomaly information and anomaly information generated by a preset generation model. Based on the semantic parsing results and the preset diagnostic report template, the diagnostic report corresponding to the anomaly detection information is output.

[0018] Secondly, this application provides an electronic device comprising: a processor, a communication interface, and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the above-mentioned server anomaly detection method.

[0019] Thirdly, this application provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the above-described server anomaly detection method.

[0020] Fourthly, this application provides a computer program product, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, implements the above-mentioned server anomaly detection method. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram illustrating an application scenario of a server anomaly detection method provided in an embodiment of this application. Figure 2 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application; Figure 3 A flowchart illustrating a server anomaly detection method provided in an embodiment of this application; Figure 4 A flowchart illustrating a method for obtaining abnormal operation data of a server, provided in an embodiment of this application; Figure 5 This application provides a schematic diagram of a timestamp cyclic feature representation mapped to a polar coordinate system. Figure 6 A flowchart illustrating a method for training a prediction model provided in an embodiment of this application; Figure 7A complete flowchart of a server anomaly detection method provided in this application embodiment; Figure 8 This is a schematic diagram of a server anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0023] The following describes in detail, with reference to the accompanying drawings, a server anomaly detection method provided in the embodiments of this application.

[0024] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0025] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0026] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0027] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0028] The following explanations of some terms used in the embodiments of this disclosure are provided to facilitate understanding by those skilled in the art: (1) Server: A server is a high-performance computer or software system dedicated to providing data storage, request processing, resource sharing and other services to other devices (clients) in the network. It is the core infrastructure supporting digital scenarios such as the Internet and enterprise applications.

[0029] (2) Server Health Monitoring (SHM): Through hardware status collection, system resource monitoring, service availability verification and other technical means, the server's operating status is monitored in real time, and potential faults (such as hardware damage, resource exhaustion, service abnormality) are warned in advance to ensure stable server operation.

[0030] (3) Gradient Boosting Decision Tree Framework (eXtreme Gradient Boosting, XGBoost): It is an ensemble learning algorithm based on the gradient boosting framework. By constructing an ensemble model of multiple decision trees (CART trees, classification and regression trees), it takes "iteration of each tree and residual correction" as the core logic, and combines regularization constraints, gradient optimization and parallel computing technology to achieve efficient and accurate classification, regression or ranking tasks.

[0031] (4) Central Processing Unit (CPU): The CPU is the core computing and control unit of a computer system. It performs arithmetic operations, logical judgments, storage access, and device control by executing instruction sets. It is the core hardware component that coordinates hardware resources such as memory, hard disk, and peripherals to support the operation of the operating system and applications. The CPU utilization rate can reflect the health status of the server.

[0032] (5) Memory (Random Access Memory): Also known as random access memory, it is a core hardware component in a computer system used to temporarily store the currently running operating system, applications, and data to be processed, and it uses random access. The memory utilization rate can reflect the health status of the server.

[0033] (6) Intelligent Agent: An intelligent entity with autonomous perception, decision-making and execution capabilities. It can be implemented based on software, hardware or a combination of software and hardware. It can perceive the external environment through sensors or data interfaces, make autonomous decisions based on built-in goals, rules or machine learning models, and ultimately achieve the preset goals.

[0034] (7) Function Calling: This refers to a technology system in which the model can use natural language understanding and logical reasoning to parse the user's natural language requirements into executable functions (including function name, parameter list, and parameter values), trigger the function execution through a preset interface, and finally integrate the function return results (such as data query results and device control feedback) into natural language answers and feedback to the user.

[0035] In the digital age, everything from user access on internet platforms and core data storage for enterprises to business processing in critical areas such as industrial control, medical AI, and telecommunications relies on the stable operation of servers. Server health directly impacts business operations, data storage, and user privacy and security. Therefore, server health monitoring has become a crucial means of ensuring reliable server operation.

[0036] However, existing technologies have low accuracy in diagnosing the cause of server anomalies.

[0037] To address the aforementioned technical problems, this application provides a server anomaly detection method. Based on the operational data of at least one server, at least one server's abnormal operational data is determined. The abnormal operational data of each server is input into a diagnostic model. Through a first network of the diagnostic model, a target anomaly detection tool corresponding to the abnormal operational data is determined from multiple anomaly detection tools. Anomaly detection information corresponding to the abnormal operational data is obtained based on the target anomaly detection tool. The anomaly detection information corresponding to each abnormal operational data is input into a second network of the diagnostic model to obtain a diagnostic report corresponding to the anomaly detection information. This achieves real-time and efficient generation of diagnostic reports based on the causes of anomalies.

[0038] In this embodiment, the diagnostic model's calling capability is combined with the detection tools, enabling different anomaly detection tools to be invoked based on the anomaly type of abnormal server operation data, and obtaining the anomaly inspection information returned by the anomaly detection tools. This makes the diagnostic model more accurate in obtaining the diagnostic report corresponding to the abnormal operation data based on the anomaly detection information; and it eliminates the need for manual server detection, as the model directly calls the corresponding anomaly detection tools, improving the efficiency of server anomaly detection.

[0039] Figure 1 This is a schematic diagram illustrating an application scenario of a server anomaly detection method provided in an embodiment of this application, such as... Figure 1 As shown in the figure, the diagram includes electronic devices and different servers such as server A, server B, and server C.

[0040] The electronic device is the execution subject of the server anomaly detection method provided in this application embodiment.

[0041] Electronic devices, servers, and computing devices are used to implement the server anomaly detection method provided in this application embodiment. The terminal may be, but is not limited to, a smartphone, tablet computer, laptop computer, desktop computer, personal digital assistant (PDA), ultra-mobile personal computer (UMPC), all-in-one machine, or other terminal device with data processing capabilities.

[0042] In this embodiment, servers A, B, and C can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data. For example, servers can be web servers, database servers, game servers, and mail servers, etc.

[0043] Taking electronic devices as servers as an example, Figure 2 A schematic diagram of the hardware structure of an electronic device is provided.

[0044] See Figure 2 , Figure 2 The electronic device 200 shown may include a processor 201, a memory 202, a communication interface 203, and a bus 204. The processor 201, the memory 202, and the communication interface 203 can be connected via the bus 204.

[0045] The processor 201 is the control center of the electronic device. It can be a general-purpose central processing unit (CPU) or other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0046] As an example, processor 201 may include one or more CPUs, for example Figure 2 CPU 0 and CPU 1 are shown in the diagram.

[0047] The memory 202 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0048] In one possible implementation, the memory 202 may exist independently of the processor 201. The memory 202 can be connected to the processor 201 via a bus 204 and is used to store data, instructions, or program code. When the processor 201 calls and executes the instructions or program code stored in the memory 202, it can implement the service data acquisition method provided in the embodiments of this application.

[0049] In another possible implementation, the memory 202 can also be integrated with the processor 201.

[0050] The communication interface 203 is used for the first communication device to connect with other devices via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 203 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0051] Bus 204 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0052] It should be pointed out that, Figure 2 The structure shown does not constitute a limitation on the electronic device, except... Figure 2 In addition to the components shown, the electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0053] Figure 3 This is a flowchart illustrating a server anomaly detection method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method includes: S301. Based on the operating data of at least one server, determine the abnormal operating data of at least one server.

[0054] Operational data characterizes the data generated by the server during runtime, reflecting the server's status and performance. Operational data may include at least one of resource utilization and interface response time.

[0055] Resource utilization is the percentage of server hardware resources actually used during server runtime. It can be used to characterize the server's load or the pressure exerted on its hardware resources by business requests. For example, resource utilization can include CPU utilization, memory utilization, and disk space utilization.

[0056] The interface response time is the time it takes for the server to send the running data.

[0057] Abnormal operation data can indicate that the corresponding resource utilization is abnormal, the interface response time is abnormal, or both resource utilization and interface response time are abnormal.

[0058] For example, runtime data where resource utilization exceeds a resource utilization threshold can be identified as abnormal runtime data. Similarly, runtime data where API response time exceeds a preset duration (e.g., 5 seconds, 8 seconds) can be identified as abnormal runtime data, and the API can be an Agent API.

[0059] The following are several methods for identifying abnormal server operation data based on server operation data.

[0060] In one feasible implementation, based on server operating data, if a resource utilization condition is met (i.e., the server's resource utilization is greater than or equal to a resource utilization threshold), the server's operating data is determined to be abnormal operating data. Alternatively, if an interface response time condition is met (i.e., the interface response time corresponding to the server's operating data exceeds a response time threshold), the server's operating data is determined to be abnormal operating data. Or, if both the resource utilization condition and the interface response time condition are met simultaneously, the server's operating data is determined to be abnormal operating data. The resource utilization threshold and the response time threshold are preset empirical values.

[0061] Resource utilization includes one or more of CPU utilization, memory utilization, and disk space utilization. In this embodiment, the resource utilization thresholds corresponding to CPU utilization, memory utilization, and disk space utilization can be different.

[0062] In another feasible implementation, for server operation data, if the server's resource utilization rate is continuously higher than the upper limit threshold for a duration exceeding a preset first duration threshold, or if the server's resource utilization rate is continuously lower than the lower limit threshold for a duration exceeding a preset second duration threshold, the server's operation data is determined to be abnormal operation data. Alternatively, if the interface response time corresponding to the server's operation data continuously increases for a duration exceeding a preset third duration threshold, the server's operation data is determined to be abnormal operation data.

[0063] S302. Input the abnormal operation data of each server into the diagnostic model. Through the first network of the diagnostic model, determine the target anomaly detection tool corresponding to the abnormal operation data from multiple anomaly detection tools, and obtain the anomaly detection information corresponding to the abnormal operation data based on the target anomaly detection tool.

[0064] Among them, the anomaly detection tool is related to the anomaly type of abnormal operation data. The anomaly types of abnormal operation data include abnormal resource utilization, abnormal interface response time, or abnormal resource utilization and abnormal interface response time.

[0065] The first network of the diagnostic model is used to determine the target anomaly detection tool corresponding to the anomaly type of the abnormal operation data from multiple anomaly detection tools based on the anomaly type of the abnormal operation data.

[0066] Specifically, in one feasible implementation, the first network of the diagnostic model includes a pre-set tool library, which contains the correspondence between anomaly types of abnormal operational data and anomaly detection tools. Based on the pre-set tool library in the first network of the diagnostic model, the target detection tool corresponding to the anomaly type of the abnormal operational data is determined.

[0067] In another feasible implementation, the diagnostic model sets up a correspondence between the anomaly types of abnormal operating data and anomaly detection tools. Through the first network of the diagnostic model and the correspondence, the target anomaly detection tool corresponding to the abnormal operating data is determined from multiple anomaly detection tools.

[0068] Anomaly detection tools can be operation and maintenance detection tools, basic server diagnostic tools, operation and maintenance detection models, or custom scripts, etc.

[0069] In some embodiments, the anomaly detection tool includes a system detection tool corresponding to abnormal resource utilization and a port scanning tool corresponding to abnormal interface response time. If the abnormal operation data input to the diagnostic model is resource utilization, the first network of the diagnostic model determines the target diagnostic tool as the system detection tool; if the abnormal operation data input to the diagnostic model is interface response time, the first network of the diagnostic model determines the target diagnostic tool as the port scanning tool. If the abnormal operation data input to the diagnostic model is both resource utilization and interface response time, the first network of the diagnostic model determines the target diagnostic tool as both the system detection tool and the port scanning tool.

[0070] In other embodiments, the anomaly detection tool includes a first anomaly detection model corresponding to abnormal resource utilization and a second anomaly detection model corresponding to abnormal interface response time. If the abnormal operation data input to the diagnostic model is resource utilization, the first network of the diagnostic model determines the target diagnostic tool as the first anomaly detection model; if the abnormal operation data input to the diagnostic model is interface response time, the first network of the diagnostic model determines the target diagnostic tool as the second anomaly detection model.

[0071] The first and second anomaly detection models can be trained using either supervised or unsupervised methods. The first anomaly detection model can analyze the causes of abnormal resource utilization, while the second anomaly detection model can analyze the causes of abnormal interface response times.

[0072] In this embodiment, the diagnostic model can have function call capability. The diagnostic model determines the target detection tool by obtaining the anomaly type of the abnormal running data, and triggers the execution of the function through a preset interface, thereby realizing the invocation of the target anomaly detection tool and obtaining the anomaly detection information returned by the target anomaly detection tool.

[0073] Anomaly detection information characterizes the reasons for anomalies in runtime data obtained from target anomaly detection tools.

[0074] S303. Input the anomaly detection information corresponding to each abnormal operation data into the second network of the diagnostic model, and obtain the diagnostic report corresponding to the anomaly detection information.

[0075] The second network of the diagnostic model is used to output a diagnostic report on the cause analysis of abnormal operating data based on the abnormal detection information corresponding to the abnormal operating data.

[0076] Diagnostic reports are used to characterize the possible causes of abnormal operational data.

[0077] By combining the diagnostic model's calling capabilities with detection tools, different anomaly detection tools can be invoked based on the anomaly type of server-side abnormal operation data. The anomaly inspection information returned by the anomaly detection tools is then obtained, making the diagnostic report corresponding to the abnormal operation data obtained by the diagnostic model more accurate. Moreover, no manual server inspection is required; the model directly calls the corresponding anomaly detection tools, improving the efficiency of server anomaly detection.

[0078] The following provides a detailed description of a method for determining abnormal server operation data based on the base server's operating data in step S301 above.

[0079] In this embodiment of the application, the operational data includes resource utilization. Figure 4This application provides a flowchart illustrating a method for obtaining abnormal operation data of a server, as shown in the embodiments below. Figure 4 As shown, the method includes: S401. Obtain the server's resource utilization rate and the timestamp corresponding to the resource utilization rate.

[0080] Among them, the resource utilization rate of the server exhibits a periodic variation pattern.

[0081] It should be noted that server resource utilization is affected by factors such as the target user group and living environment. Server resource utilization may exhibit cyclical changes, such as on a daily, weekly, or monthly basis.

[0082] Specifically, server resource utilization is affected by factors such as work schedules and users' daily routines throughout the day. In other words, server resource utilization exhibits a cyclical pattern of change over a daily period. For example, for e-commerce platform servers, during the daytime (9:00-23:00), the number of users, page views, and orders increases, leading to a gradual increase in CPU and memory utilization. Conversely, at night (0:00-9:00), the number of users, page views, and orders decreases, resulting in a gradual decrease in CPU and memory utilization.

[0083] Server resource utilization is affected by factors such as user activity on weekdays and weekends, exhibiting a cyclical pattern. For example, on weekends, users are more likely to attend live classes, access recorded lectures, and submit assignments, leading to increased CPU and memory usage on the educational platform server. On weekdays, users spend less time on the platform, resulting in more stable CPU and memory usage.

[0084] Server resource utilization can also exhibit periodic variations over specific time periods. For example, agricultural IoT servers may show periodic variations based on the growth period of crops. Similarly, examination system servers may show periodic variations based on the user's examination time.

[0085] In this embodiment, the timestamp corresponding to the resource utilization rate can be converted into a timestamp cycle feature. For example, the timestamp cycle feature can have a period of one hour, one day, one week, one month, or one year.

[0086] S402. Input the resource utilization rate and the timestamp corresponding to the resource utilization rate into the prediction model to obtain the predicted value corresponding to the resource utilization rate.

[0087] The predicted values ​​output by the prediction model are related to the periodic changes in resource utilization.

[0088] The predicted value corresponding to the resource utilization rate represents the value obtained by predicting the resource utilization rate at this timestamp based on the periodic change pattern of the resource utilization rate.

[0089] In this embodiment of the application, the value is obtained by predicting the resource utilization rate at the specified timestamp based on the periodic variation pattern of resource utilization rate obtained by the prediction model.

[0090] The following are several methods for training prediction models.

[0091] In one feasible implementation, operational sample data of the server is obtained. This operational sample data includes sample resource utilization rates and corresponding sample timestamps. Sample resource utilization rates include normal resource utilization rates and abnormal resource utilization rates. According to a preset periodic processing rule, feature transformation is performed on the sample timestamps corresponding to the sample resource utilization rates to obtain timestamp cyclic features. The operational sample data and corresponding timestamp cyclic features are then used as input to the initial prediction model. Based on the reference operational sample data, the preset prediction model is trained using the XGBoost algorithm, a gradient boosting decision tree framework. When the training conditions are met, the prediction model is obtained.

[0092] Among them, meeting the training conditions includes the prediction model reaching convergence; or, meeting the training conditions may include the number of training iterations reaching a threshold, wherein the threshold is a preset fixed value; or, meeting the training conditions may also include the loss being less than a loss threshold, wherein the loss threshold can be determined according to the actual situation.

[0093] The reference running sample data refers to the running sample data prior to the timestamp of the running sample data. For example, the reference running sample data can be historical observations such as CPU usage sample data and memory usage sample data from 1 minute, 3 minutes, and 6 minutes ago, or running sample data prior to different timestamps can be selected based on different servers.

[0094] Understandably, predicting resource utilization based on the cyclical changes in resource utilization requires obtaining the corresponding resource utilization period. This period can be a day, a week, a month, or a preset time period. Therefore, it is necessary to process the timestamps using preset period processing rules, which are used to convert the timestamps into the cyclical characteristics of the timestamps corresponding to the required period.

[0095] Among them, the timestamp cycle feature characterizes linear time into periodic cyclic time.

[0096] In one scenario, the preset periodic processing rules include a first processing rule and a second processing rule.

[0097] Specifically, the first processing rule includes a calculation rule for the periodic variation pattern with a daily cycle. Following the first processing rule and using the first calculation method, the sample timestamps corresponding to the sample resource utilization rate are mapped to polar coordinates for feature transformation to obtain the first timestamp cyclic features.

[0098] The second processing rule includes a calculation rule for the periodic variation pattern with a weekly cycle. Following the second processing rule and using the second calculation method, the sample timestamps corresponding to the sample resource utilization rate are mapped to polar coordinates for feature transformation to obtain the second timestamp cyclical features.

[0099] At this point, the timestamp cycle feature includes a first timestamp cycle feature and a second timestamp cycle feature.

[0100] The first timestamp cycle feature represents the time information corresponding to the periodic change pattern with a one-day cycle.

[0101] The second timestamp cyclic feature represents the time information corresponding to the periodic change pattern with a week as the cycle.

[0102] In this embodiment, the first calculation method includes a calculation method using the cosine function, and the second calculation method includes a calculation method using both the cosine function and the sine function.

[0103] For example, using T1 to characterize the first timestamp cycle feature, the formula corresponding to the first calculation method can be: T1 = cos(2π × number of minutes / 1440); Using T2 to characterize the second timestamp cycle feature, the formula corresponding to the second calculation method can be: T2 = (e.g., sin(2π × week number / 7)).

[0104] Figure 5 This is a schematic diagram illustrating a timestamp cyclic feature representation mapped to a polar coordinate system, provided as an embodiment of this application. For example... Figure 5 As shown, the figure includes a polar coordinate system, a circle with a radius of 1, and the corresponding time information 0:00, 6:00, 12:00, and 18:00.

[0105] Taking the first calculation method as an example: At 6:00, the corresponding first timestamp cycle feature can be represented as: T16= cos(2π × 360 / 1440)=0; At this point, the first timestamp cycle feature corresponds to Figure 5 Point A in the middle; At 12:00, the corresponding first timestamp cycle feature can be represented as: T1 12 = cos(2π × 720 / 1440)=-1; At this point, the first timestamp cycle feature corresponds to Figure 5 Point B in the diagram.

[0106] In another case, the preset periodic processing rules may also include a third processing rule and a fourth processing rule.

[0107] Specifically, the third processing rule includes a calculation rule for the periodic variation pattern with a monthly cycle. Following this third processing rule, the sample timestamps corresponding to the sample resource utilization rate are mapped to polar coordinates for feature transformation, thus obtaining the third timestamp cyclical features.

[0108] The fourth processing rule includes the calculation rule for the periodic change pattern with a preset time period. According to the fourth processing rule, the sample timestamp corresponding to the sample resource utilization rate is mapped to the polar coordinate system for feature transformation to obtain the fourth timestamp cyclic feature.

[0109] At this point, the timestamp cycle feature includes the third timestamp cycle feature and the fourth timestamp cycle feature.

[0110] The third timestamp cyclic feature represents the time information corresponding to the periodic change pattern with a one-month cycle.

[0111] The fourth timestamp cycle feature represents the time information corresponding to the periodic change pattern with a preset time period.

[0112] Figure 6 This is a flowchart illustrating a method for training a prediction model, as provided in an embodiment of this application.

[0113] The system acquires operational data from multiple servers, including server A and server B. This operational data includes resource utilization and the corresponding timestamps. The data is then normalized. Operational data of different magnitudes and value ranges are mapped to the same data interval to obtain normalized operational data. For example, the numerical interval can be [0,1] or [-1,1].

[0114] Based on the preset periodic processing rules, the timestamps corresponding to the running data are converted into timestamp cycle features. The obtained multiple normalized running data and the timestamp cycle features corresponding to the normalized running data are used as sample data to train the initial prediction model, thereby obtaining a prediction model that meets the training conditions.

[0115] Transforming timestamps into periodic time-cycle features allows model training to learn the periodic changes in resource utilization based on these features, avoiding the limitations of prediction models that rely solely on linear timestamps and improving the accuracy of resource utilization predictions. Furthermore, by using resource utilization rates prior to the corresponding timestamp as features for resource utilization predictions, the model achieves even higher accuracy.

[0116] In another feasible implementation, the server's operational sample data is obtained. This operational sample data includes sample resource utilization, corresponding sample timestamps, and corresponding sample prediction values. Sample resource utilization includes normal resource utilization and abnormal resource utilization.

[0117] The electronic device uses the sample resource utilization rate and the corresponding sample timestamp as input to the initial prediction model, and obtains the initial predicted value corresponding to the resource utilization rate output by the initial prediction model. The electronic device compares the initial predicted value corresponding to the resource utilization rate with the sample predicted value corresponding to the resource utilization rate, calculates the loss, and completes model training by determining that the loss of the initial prediction model is less than a loss threshold, thus obtaining a trained prediction model. This application embodiment does not limit the training method of the judgment model.

[0118] S403. If the resource utilization rate is greater than the predicted value of the first multiplier, the resource utilization rate is determined to be abnormal operating data.

[0119] The first multiplier can be a threshold set based on the periodic changes in resource utilization during the training phase of the prediction model, or it can be a threshold set based on experience.

[0120] For example, the first multiplier can be 30%, or it can be 20%, 25%, 30%, 35%, etc.

[0121] The method for obtaining the first threshold is not specifically limited in the embodiments of this application.

[0122] The predicted value of resource utilization rate obtained from the prediction model is compared with the actual resource utilization rate to determine whether it is abnormal operation data, which improves the accuracy of abnormal operation data.

[0123] The following describes one scenario of the anomaly detection tool in step S302 above.

[0124] Anomaly detection tools include a first detection tool, a second detection tool, and a third detection tool.

[0125] The first detection tool is used to detect the server's liveness status, which includes whether the server is alive or offline.

[0126] In this embodiment, if the target anomaly detection tool includes a first detection tool, the server's liveness status is obtained through a first preset protocol indicated by the first detection tool. For example, the first preset protocol can be the Internet Control Message Protocol (ICMP) or the Secure Shell Protocol (SSH), where SSH can also be referred to as port 22. The first detection tool can obtain the server's liveness status within 10 seconds.

[0127] The second detection tool is used to detect the server's login status, which includes whether the server login was successful or failed.

[0128] In this embodiment, if the target anomaly detection tool includes a second detection tool, the login operation of the server is performed through the second preset protocol indicated by the second detection tool to obtain the server login status.

[0129] For example, the second preset protocol can be the SSH protocol. The diagnostic model uses a first network call to the SSH protocol to simulate an operations and maintenance personnel logging into the host corresponding to the server. If the host corresponding to the server returns a password input box, it verifies that the operating system responds to the SSH login attempt, meaning the server's login status is successful. If no password input box is returned by the host corresponding to the server, it verifies that the operating system does not respond to the SSH login attempt, meaning the server's login status is failed. The second detection tool can obtain the server's login status within 30 seconds.

[0130] The third detection tool is used to detect the service and resource usage status information of the server, including normal usage information or abnormal usage information.

[0131] In this embodiment, the third detection tool can automatically detect the service and resource usage status information of the server after logging into the host corresponding to the server. For example, it can detect memory usage based on `free -h |grep Mem` and `grep "Outof memory" / var / log / system.log`, or it can detect service status based on core service checks such as `systemctlstatus crond`.

[0132] When the anomaly detection tools include a first detection tool, a second detection tool, and a third detection tool, the correspondence between the anomaly types of abnormal runtime data and the anomaly detection tools includes: If the anomaly type of the abnormal operation data is resource utilization anomaly, the corresponding target anomaly detection tool for the abnormal operation data includes a third detection tool.

[0133] If the exception type of the abnormal operation data is an interface response time exception, the corresponding target exception detection tools for the abnormal operation data include a first detection tool and a second detection tool.

[0134] If the anomaly type of the abnormal operation data is abnormal resource utilization or abnormal interface response time, the corresponding target anomaly detection tools for the abnormal operation data include a second detection tool and a third detection tool.

[0135] Using different anomaly detection tools for different types of abnormal runtime data can improve the accuracy of anomaly detection information.

[0136] The following provides a detailed description of a method for obtaining a diagnostic report corresponding to the abnormal operation data in step S303 above, which involves inputting the abnormal detection information corresponding to each abnormal operation data into the second network of the diagnostic model.

[0137] The anomaly detection information corresponding to each abnormal operation data is input into the second network of the diagnostic model. Semantic parsing of the anomaly detection information, based on the operation and maintenance knowledge base, is performed to obtain the semantic parsing results. Based on the semantic parsing results and a preset diagnostic report template, a diagnostic report corresponding to the anomaly detection information is output.

[0138] The operations and maintenance knowledge base includes historical anomaly information and anomaly information generated by a pre-defined generation model. The knowledge base can also be updated and optimized based on diagnostic reports generated by the diagnostic model.

[0139] The second network of the diagnostic model is used to perform semantic parsing on anomaly detection information based on the operation and maintenance knowledge base, and to obtain the semantic parsing results corresponding to the anomaly detection information.

[0140] Semantic parsing is used to transform anomaly detection information into a structured semantic representation that the model can understand and compute; that is, the semantic parsing result corresponding to this embodiment.

[0141] The preset diagnostic report template can be a template obtained from historical diagnostic reports or a template set based on experience.

[0142] A diagnostic report is an analysis report used to characterize the causes of abnormal operating data. It may include multiple causes of the abnormal operating data, the probability of each cause, and solutions for the causes.

[0143] In this embodiment, the diagnostic report is also used as sample data for the detection model and the diagnostic model, thereby enabling the optimization of the detection model and the diagnostic model.

[0144] Figure 7 A complete flowchart of a server anomaly detection method provided in this application embodiment.

[0145] S701. Obtain the operating data of at least one server.

[0146] The operational data includes at least one of resource utilization and interface response time.

[0147] S702. Use the resource utilization rate of at least one server as input to the prediction model, and obtain the predicted value corresponding to the resource utilization rate output by the prediction model.

[0148] S703. If the resource utilization rate is greater than the predicted value of the first multiplier, determine that the resource utilization rate is abnormal operating data and execute S705. Otherwise, execute S709.

[0149] S704. If the interface response time exceeds the interface response time threshold, determine that the interface response time is abnormal and execute S705. Otherwise, execute S709.

[0150] S705. Input the abnormal operation data of each server into the diagnostic model.

[0151] S706, A target anomaly detection tool that uses the first network of the diagnostic model to determine the anomaly type based on the abnormal operation data and the corresponding target anomaly detection tool.

[0152] The anomaly detection tools include a first anomaly detection tool, a second anomaly detection tool, and a third anomaly detection tool. If the anomaly type of the abnormal operating data is resource utilization anomaly, the corresponding target anomaly detection tool includes the third detection tool; if the anomaly type of the abnormal operating data is interface response time anomaly, the corresponding target anomaly detection tool includes the first and second detection tools; if the anomaly type of the abnormal operating data is both resource utilization anomaly and interface response time anomaly, the corresponding target anomaly detection tool includes both the second and third detection tools. The anomaly types of the abnormal operating data include resource utilization anomaly and / or interface response time anomaly.

[0153] S707. Input the anomaly detection information corresponding to each abnormal operation data returned by the target anomaly detection tool into the second network of the diagnostic model.

[0154] S708, The diagnostic model outputs a diagnostic report corresponding to the abnormal detection information.

[0155] S709, Output running data.

[0156] The operational data includes resource utilization and / or interface response time.

[0157] Figure 8 This is a schematic diagram of a server anomaly detection device provided in an embodiment of this application. The server anomaly detection device 800 includes a processing module 801, a communication module 802, and a storage module 803.

[0158] The processing module 801 can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The processor can include an application processor and a baseband processor. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0159] For example, the processing module 801 can be as follows: Figure 2 The processor 201 shown; the communication module 802 can be as follows: Figure 2 The communication interface 203 shown; the storage module 803 can be as follows: Figure 2 The memory 202 shown.

[0160] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0161] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the server anomaly detection method described in the above method embodiments.

[0162] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the server anomaly detection method in the method flow shown in the above method embodiments.

[0163] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0164] Since the server anomaly detection device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of the present invention will not be repeated here.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0166] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0168] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting server anomalies, characterized in that, The method includes: Based on the operational data of at least one server, determine the abnormal operational data of the at least one server; the operational data includes at least one of resource utilization and interface response time; The abnormal operation data of each server is input into the diagnostic model. The first network of the diagnostic model determines the target anomaly detection tool corresponding to the abnormal operation data from multiple anomaly detection tools, and obtains the anomaly detection information corresponding to the abnormal operation data based on the target anomaly detection tool. The anomaly detection tool is related to the anomaly type of the abnormal operation data, and the anomaly type of the abnormal operation data includes abnormal resource utilization and / or abnormal interface response time. The anomaly detection information corresponding to each of the abnormal operation data is input into the second network of the diagnostic model to obtain the diagnostic report corresponding to the anomaly detection information.

2. The method according to claim 1, characterized in that, The diagnostic model includes a correspondence between the anomaly types of abnormal operating data and the anomaly detection tools. The step of determining the target anomaly detection tool corresponding to the abnormal operation data from multiple anomaly detection tools through the first network of the diagnostic model includes: Using the first network of the diagnostic model and the corresponding relationship, a target anomaly detection tool corresponding to the abnormal operation data is determined from the plurality of anomaly detection tools.

3. The method according to claim 2, characterized in that, The plurality of anomaly detection tools include a first detection tool, a second detection tool, and a third detection tool; The first detection tool is used to detect the server's liveness status; the liveness status includes whether the server is alive or offline; the second detection tool is used to detect the server's login status; the login status includes whether the server login was successful or failed; the third detection tool is used to detect the server's service and resource usage status; the service and resource usage status information includes normal usage information or abnormal usage information. The correspondence between the anomaly types of the abnormal operation data and the anomaly detection tools includes: The anomaly type of the abnormal operation data is resource utilization anomaly, and the target anomaly detection tool corresponding to the abnormal operation data includes the third detection tool. The anomaly type of the abnormal operation data is an interface response time anomaly, and the target anomaly detection tool corresponding to the abnormal operation data includes the first detection tool and the second detection tool; The abnormal types of the abnormal operation data are abnormal resource utilization and abnormal interface response time. The target anomaly detection tools corresponding to the abnormal operation data include the second detection tool and the third detection tool.

4. The method according to claim 3, characterized in that, The step of obtaining the anomaly detection information corresponding to the abnormal operation data based on the target anomaly detection tool includes: If the target anomaly detection tool includes the first detection tool, the liveness status of the server is obtained through the first preset protocol indicated by the first detection tool; If the target anomaly detection tool includes the second detection tool, the login operation to the server is performed through the second preset protocol indicated by the second detection tool to obtain the server login status; If the target anomaly detection tool includes the third detection tool, the third detection tool is used to obtain the operation logs of services and resources in the server, and the operation logs of services and resources are traversed to determine the usage status of services and resources in the server.

5. The method according to any one of claims 1-4, characterized in that, The operational data includes resource utilization. The determination of abnormal operating data of the at least one server based on the operating data of the at least one server includes: Obtain the resource utilization rate of the server and the timestamp corresponding to the resource utilization rate; Input the resource utilization rate and the timestamp corresponding to the resource utilization rate into the prediction model to obtain the predicted value corresponding to the resource utilization rate; If the resource utilization rate is greater than the predicted value of the first multiplier, the resource utilization rate is determined to be abnormal operation data; The resource utilization rate of the server exhibits a periodic variation pattern, and the predicted value output by the prediction model is related to this periodic variation pattern.

6. The method according to claim 5, characterized in that, The method further includes: Obtain the server's operational sample data; the operational sample data includes sample resource utilization rate and corresponding sample timestamp, the sample resource utilization rate includes normal resource utilization rate and abnormal resource utilization rate; According to the preset cycle processing rules, the timestamps corresponding to the sample resource utilization rate are transformed to obtain the timestamp cycle features. The running sample data and the corresponding timestamp cyclic features are used as inputs to the initial prediction model. Based on the reference running sample data, the XGBoost algorithm of the gradient boosting decision tree framework is used to train the preset prediction model. The reference running sample data is the running sample data before the timestamp of the running sample data. When the training conditions are met, the prediction model is obtained; wherein, meeting the training conditions includes the prediction model reaching convergence.

7. The method according to claim 6, characterized in that, The preset periodic processing rules include a first processing rule and a second processing rule. The first processing rule includes a calculation rule for a periodic change pattern with a one-day cycle, and the second processing rule includes a calculation rule for a periodic change pattern with a one-week cycle. The timestamp cycle feature includes the first timestamp cycle feature and the second timestamp cycle feature. The step of performing feature transformation on the sample timestamps corresponding to the sample resource utilization rate according to the preset periodic processing rules to obtain timestamp cycle features includes: According to the first processing rule, the first calculation method is used to map the sample timestamp corresponding to the sample resource utilization rate to the polar coordinate system for feature transformation, and obtain the first timestamp cyclic feature. According to the second processing rule, the second calculation method is used to map the sample timestamp corresponding to the sample resource utilization rate to the polar coordinate system for feature transformation, and obtain the second timestamp cyclic feature.

8. The method according to claim 7, characterized in that, The first calculation method includes the calculation method using the cosine function; the second calculation method includes the calculation method using both the cosine function and the sine function.

9. The method according to any one of claims 1-8, characterized in that, The step of inputting the anomaly detection information corresponding to each of the abnormal operation data into the second network of the diagnostic model, and obtaining the diagnostic report corresponding to the anomaly detection information, includes: The anomaly detection information corresponding to each of the abnormal operation data is input into the second network of the diagnostic model. The anomaly detection information is semantically parsed based on the operation and maintenance knowledge base to obtain the semantic parsing result corresponding to the anomaly detection information. The operation and maintenance knowledge base includes historical anomaly information and anomaly information generated by a preset generation model. Based on the semantic parsing results and the preset diagnostic report template, a diagnostic report corresponding to the anomaly detection information is output.

10. An electronic device, characterized in that, The electronic device includes a processor, a communication interface, and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the server anomaly detection method as described in any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the server anomaly detection method as described in any one of claims 1 to 9.

12. A computer program product, characterized in that, The computer program product includes a computer program or instructions that, when executed by a processor, implement the server anomaly detection method as described in any one of claims 1 to 9.

Images