Server time sequence anomaly detection method based on abnormal attention and multi-domain feature fusion automatic encoder

Abstract

The invention discloses a server time sequence anomaly detection method based on an abnormal attention and multi-domain feature fusion autoencoder, and compared with an existing time sequence anomaly detection method, the server time sequence anomaly detection method based on the abnormal attention and multi-domain feature fusion autoencoder has the advantages that correlation structure changes between different moments in a time sequence can be described through an abnormal attention mechanism; therefore, the recognition capability on the structural exception of the server is improved; by introducing a multi-scale frequency domain feature extraction and multi-domain feature fusion mechanism, periodic change features of a time sequence under different time scales can be effectively captured, and the detection effect on a complex abnormal mode is improved; besides, training is carried out by adopting an unsupervised reconstruction learning mode, manual labeling of abnormal samples is not needed, learning can be carried out by utilizing a large amount of normal operation data, and the method has relatively good universality and practical application value.

Description

Technical Field

[0001] This invention relates to the field of server time series anomaly detection technology, and in particular to a server time series anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder. Background Technology

[0002] Time-series anomaly detection is a crucial technology for identifying and analyzing abnormal behaviors in time-series data that deviate from normal operating patterns. It has wide applications in areas such as server operation monitoring, industrial system maintenance, and information system security. Taking server operation monitoring as an example, servers continuously generate multi-dimensional time-series data during long-term operation, including processor utilization, memory usage, disk read / write speeds, and network throughput. This data reflects the server's operating status and load.

[0003] Existing time series anomaly detection methods mainly include statistical model-based methods, traditional machine learning-based methods, and deep learning-based methods. Among them, statistical model methods rely on manually set distribution assumptions, making it difficult to adapt to complex and ever-changing real-world operating environments; traditional machine learning methods usually require manually designed features and have limited generalization ability; although deep learning-based anomaly detection methods proposed in recent years have improved detection performance to some extent, most methods only focus on the numerical reconstruction error of the time series, ignoring the internal correlation structure changes and periodic frequency characteristics of the time series.

[0004] In real-world server operation scenarios, anomalies often manifest not only as sudden changes in the value of a single metric, but also as alterations in the correlation between different points in time, or disruption of periodic load patterns formed by business scheduling and access regularities. Existing methods fail to jointly model both the temporal correlation structure and frequency structure, resulting in insufficient detection capabilities for structural anomalies, periodic anomalies, and complex anomaly patterns, easily leading to missed or false detections. Therefore, there is an urgent need for a time-series anomaly detection method that can simultaneously characterize changes in the temporal correlation structure and multi-scale frequency domain features to improve the accuracy and robustness of detecting complex operational anomalies. Summary of the Invention

[0005] Based on this, it is necessary to propose a server timing anomaly detection method, device, computer equipment, and storage medium based on an autoencoder that integrates anomaly attention and multi-domain feature fusion to address the above problems.

[0006] A server temporal anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder, the method comprising:

[0007] S1: Collect multi-dimensional operating status parameters recorded by the monitoring system during the operation of the server; and standardize the multi-dimensional operating status parameters to obtain multi-dimensional operating status parameters; construct time window samples by dividing the multi-dimensional operating status parameters through a sliding window; the multi-dimensional operating status parameters include at least: processor utilization, memory utilization, disk read / write speed, network throughput, and system load indicators.

[0008] S2: Linearly map and superimpose position codes on the running state parameters composed of multiple time window samples to obtain an initial temporal feature representation, and use the initial temporal feature representation as the input of the anomaly attention module; in the current layer anomaly attention module, perform a linear transformation on the temporal feature representation of the previous layer to obtain a query matrix, a key matrix, and a value matrix; based on the query matrix, key matrix, and value matrix and combined with a normalization function, determine the sequence association matrix, weighted temporal feature representation, and temporal feature representation;

[0009] S3: Perform a Fourier transform on the operating state parameters to obtain a global frequency domain feature representation; divide the operating state parameters into several local sub-sequences, and perform a frequency domain transform on the local sub-sequences to obtain local features; determine a multi-scale frequency domain feature representation based on the global frequency domain feature representation and the local features;

[0010] S4: After performing a discrete cosine transform on the multi-scale frequency domain feature representation, and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights. The frequency domain enhanced features are obtained by enhancing the multi-scale frequency domain feature representation through the frequency domain channel attention weights.

[0011] S5: Combining the frequency domain enhancement features and the initial time domain feature representation, and learning through N layers of anomaly attention modules, the time domain anomaly feature representation of the server's running state is obtained, and the cross-domain fusion feature representation is determined.

[0012] S6: Input the cross-domain fusion feature representation into the TransformerDecoder model to perform temporal decoding on the server running state to obtain the reconstructed time series of the server running state; and calculate the reconstruction error of the server running state; construct the temporal correlation structure difference based on the sequence correlation matrix and the prior correlation matrix; determine the target anomaly score of the server running state based on the reconstruction error and the temporal correlation structure difference. If the target anomaly score is greater than the preset anomaly score, the server running state at time point t is temporally abnormal; otherwise, the server is running normally.

[0013] In one embodiment, the linear mapping of the running state parameters consisting of multiple time window samples and the superposition of position codes to obtain the initial temporal feature representation is achieved by the following expression:

[0014]

[0015] in, This represents the initial temporal feature representation for the anomaly attention module. For the input time window batch data, It is a linear mapping layer; For position encoding.

[0016] In one embodiment, the linear transformation of the temporal feature representation of the previous layer to obtain the query matrix, key matrix, and value matrix in the current layer anomaly attention module is achieved through the following expression:

[0017]

[0018]

[0019]

[0020] in, This is the query matrix in the current layer's anomaly attention. The key matrix, For value matrices, These are the output features of the previous layer's anomaly attention module. , , The weight matrix is ​​a learnable linear mapping. Index for the anomaly attention layer.

[0021] In one embodiment, the query matrix is ​​used as the basis for... Key matrix Sum matrix The sequence incidence matrix is ​​determined by combining the normalization function. Weighted temporal feature representation Time-domain feature representation This can be achieved using the following expression:

[0022] =

[0023] in, The sequence incidence matrix at time t; For normalization function, The dimension of the latent space is the feature.

[0024] =

[0025] in, This is a weighted temporal feature representation of the output of the anomaly attention module; These are the output features of the previous layer's anomaly attention module; It is a value matrix;

[0026]

[0027] in, This represents the temporal feature representation output by the current layer's anomaly attention module. This is a layer normalization operation.

[0028] In one embodiment, based on the output features of each layer of the anomaly attention module at each time location... Determine the scale parameters at the corresponding time location. ; and based on the scale parameter Determine the prior correlation matrix This can be achieved using the following expression:

[0029]

[0030] in, Let i be the scale parameter at time position i; The output feature of the previous layer's anomaly attention module at time position i; The learnable linear mapping weight matrix at time position i

[0031]

[0032] in, W represents the prior association matrix between time positions i and j in the current layer, where W represents the length of the time window; i and j are the time position indices within the time window. For standardized operation; It is a Gaussian function; Let be the scale parameter at time position i.

[0033] In one embodiment, the operation status parameters The global frequency domain feature representation is obtained by performing a Fourier transform. ; Regarding the operating status parameters Divided into several local subsequences and for the local subsequence Local features are obtained by performing frequency domain transformation. Based on the global frequency domain feature representation and the local features Determine the multi-scale frequency domain feature representation This can be achieved using the following expression:

[0034]

[0035] in, For Fast Fourier Transform, These are parameters for batch execution status; It represents the global frequency domain features;

[0036]

[0037] in, This is the m-th local subsequence; The local feature corresponding to the m-th local time segment;

[0038]

[0039] in, This represents the multi-scale frequency domain features after fusion. For multiple local features Local frequency domain features obtained after learning by the attention module; This is the feature splicing function.

[0040] In one embodiment, the representation of the multi-scale frequency domain features After performing a discrete cosine transform and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights. The multi-scale frequency domain feature representation is applied through the frequency domain channel attention weights. After enhancement, frequency domain enhancement features are obtained. This can be achieved using the following expression:

[0041]

[0042] in, The frequency components are represented as frequency domain characteristics. This is the discrete cosine transform;

[0043]

[0044] in, For frequency domain channel attention weights, , For the weights of the fully connected layer, It is a non-linear activation function. for function;

[0045]

[0046] in, Multi-scale frequency domain feature representation Frequency domain enhancement features after frequency domain channel attention enhancement.

[0047] In one embodiment, the combination of the frequency domain enhancement feature and initial temporal feature representation After learning through N layers of anomaly attention modules, a temporal anomaly feature representation of the server's running state is obtained. Determine the feature representation after cross-domain fusion This can be achieved using the following expression:

[0048]

[0049]

[0050]

[0051] in, This refers to the query matrix in the cross-domain attention module. The key matrix in the cross-domain attention module. This is the value matrix in the cross-domain attention module; For frequency domain enhancement features; Initial temporal feature representation After learning through N layers of anomaly attention modules, a temporal anomaly feature representation of the server's running state is obtained; , , It is a learnable linear mapping weight matrix;

[0052]

[0053] in, This is the cross-domain attention score matrix; This is the normalization function; The dimension of the latent space is the feature.

[0054]

[0055] in, This represents the feature representation after cross-domain fusion. These are temporal anomaly features after cross-domain attention weighting. For frequency domain enhancement features, This is a layer normalization operation.

[0056] In one embodiment,

[0057] The reconstruction error of the server running state This can be achieved using the following expression:

[0058]

[0059] in, The reconstruction error represents the server's operating state at time point t. The actual operating state vector of the server at time t To reconstruct time series The reconstructed data located at time point t, It is a 2-norm;

[0060] The time-related structural differences This can be achieved using the following expression:

[0061]

[0062] = (i=t)

[0063] in, For time point t, Let be the sequence incidence matrix at time t. This is the prior correlation matrix at time position t in the current layer. KL divergence is used to measure the degree of difference between two correlation distributions.

[0064] In one embodiment, the target anomaly score This can be achieved using the following expression:

[0065]

[0066] in, The target anomaly score for the server's operational status at time point t; The reconstruction error represents the server's operating state at time point t. These are the weighting coefficients.

[0067] Compared to existing time-series anomaly detection methods, the advantages of this invention are as follows: The anomaly attention mechanism can characterize the structural changes in the correlation between different moments in a time series, thereby improving the ability to identify structural anomalies in servers; by introducing multi-scale frequency domain feature extraction and multi-domain feature fusion mechanisms, it can effectively capture the periodic change features of the time series at different time scales, improving the detection effect on complex anomaly patterns; furthermore, this invention uses an unsupervised reconstruction learning method for training, eliminating the need for manually labeled anomaly samples, and can utilize a large amount of normal operation data for learning, thus possessing good versatility and practical application value. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] in:

[0070] Figure 1 This is an application environment diagram of a server temporal anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder in one embodiment;

[0071] Figure 2 This is a flowchart of a server temporal anomaly detection method based on an autoencoder that integrates anomaly attention and multi-domain feature fusion in one embodiment.

[0072] Figure 3 This is a structural block diagram of a computer device in one embodiment. Detailed Implementation

[0073] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] To address the technical problems in the background art, this application provides a server timing anomaly detection method based on an autoencoder that integrates anomaly attention and multi-domain feature fusion.

[0075] Figure 1 This is an application environment diagram of a server temporal anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder in one embodiment. (Refer to...) Figure 1This server temporal anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder is applied to a server temporal anomaly detection system based on anomaly attention and multi-domain feature fusion autoencoder. The system includes a terminal 110 and a server 120. The terminal 110 and server 120 are connected via a network. The terminal 110 can be a desktop terminal or a mobile terminal; a mobile terminal can be at least one of a mobile phone, tablet, or laptop. The server 120 can be a standalone server or a server cluster consisting of multiple servers. Terminal 110 is used to collect multi-dimensional operating status parameters recorded by the monitoring system during server operation; server 120 is used to standardize the multi-dimensional operating status parameters to obtain multi-dimensional operating status parameters; the multi-dimensional operating status parameters are divided into time window samples by a sliding window; the multi-dimensional operating status parameters include at least: processor utilization, memory utilization, disk read / write speed, network throughput, and system load indicators; the operating status parameters composed of multiple time window samples are linearly mapped and superimposed with position encoding to obtain an initial temporal feature representation, and the initial temporal feature representation is used as the input of the anomaly attention module; in the current In the layered anomaly attention module, a linear transformation is performed on the temporal feature representation of the previous layer to obtain a query matrix, a key matrix, and a value matrix; based on the query matrix, key matrix, and value matrix, and combined with a normalization function, a sequence association matrix, a weighted temporal feature representation, and a temporal feature representation are determined; a Fourier transform is performed on the running state parameters to obtain a global frequency domain feature representation; the running state parameters are divided into several local subsequences, and a frequency domain transformation is performed on the local subsequences to obtain local features; a multi-scale frequency domain feature representation is determined based on the global frequency domain feature representation and the local features; after performing a discrete cosine transform on the multi-scale frequency domain feature representation, and combining it with a nonlinear activation function and... The function obtains the frequency domain channel attention weights, and enhances the multi-scale frequency domain feature representation with these weights to obtain enhanced frequency domain features. Combining the enhanced frequency domain features and the initial time domain feature representation, and learning through N layers of anomaly attention modules, a time domain anomaly feature representation of the server's operating state is obtained, determining the cross-domain fused feature representation. The cross-domain fused feature representation is input into a Transformer Decoder model to perform temporal decoding of the server's operating state, obtaining a reconstructed time series of the server's operating state. The reconstruction error of the server's operating state is calculated. A temporal correlation structure difference is constructed based on the sequence correlation matrix and the prior correlation matrix. A target anomaly score for the server's operating state is determined based on the reconstruction error and the temporal correlation structure difference. If the target anomaly score is greater than a preset anomaly score, the server's operating state at time point t is considered temporally abnormal; otherwise, the server is operating normally.

[0076] like Figure 2 As shown, in one embodiment, a server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder is provided. This method can be applied to both terminals and servers; this embodiment illustrates its application to a terminal. The server timing anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder specifically includes the following steps:

[0077] S1: Collect multi-dimensional operating status parameters recorded by the monitoring system during the operation of the server; and standardize the multi-dimensional operating status parameters to obtain multi-dimensional operating status parameters; construct time window samples by dividing the multi-dimensional operating status parameters through a sliding window; the multi-dimensional operating status parameters include at least: processor utilization, memory utilization, disk read / write speed, network throughput, and system load indicators. ,in, For multidimensional running state parameters, vector This represents the multidimensional operating status parameters of the server at time t, where t is the time index, corresponding to the sampling time of the server monitoring system, T is the total length of the time series, and dimension d corresponds to the number of monitoring indicators, used to represent physical parameters such as processor utilization, memory utilization, disk I / O, and network throughput. This representation method can fully reflect the joint change characteristics of multiple resource dimensions of the server and is the foundation for server anomaly detection scenarios. ,in, To standardize multidimensional operating state parameters The time window sample under the k-th sliding window, where k is the window index number. Through the sliding window method, the model can simultaneously perceive the short-term continuity and local abnormal changes in the server's operating status. This is a sample of processor utilization in the k-th time window; This is a sample of memory usage in the k-th time window; This is a sample of network throughput in the k-th time window;

[0078] S2: Linearly map and superimpose position codes on the running state parameters composed of multiple time window samples to obtain an initial temporal feature representation, and use the initial temporal feature representation as the input of the anomaly attention module; in the current layer anomaly attention module, perform a linear transformation on the temporal feature representation of the previous layer to obtain a query matrix, a key matrix, and a value matrix; based on the query matrix, key matrix, and value matrix and combined with a normalization function, determine the sequence association matrix, weighted temporal feature representation, and temporal feature representation;

[0079] S3: Perform a Fourier transform on the operating state parameters to obtain a global frequency domain feature representation; divide the operating state parameters into several local sub-sequences, and perform a frequency domain transform on the local sub-sequences to obtain local features; determine a multi-scale frequency domain feature representation based on the global frequency domain feature representation and the local features;

[0080] S4: After performing a discrete cosine transform on the multi-scale frequency domain feature representation, and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights, and the frequency domain enhanced features are obtained by enhancing the multi-scale frequency domain feature representation with the frequency domain channel attention weights.

[0081] S5: Combining the frequency domain enhancement features and the initial time domain feature representation, and learning through N layers of anomaly attention modules, the time domain anomaly feature representation of the server's running state is obtained, and the cross-domain fusion feature representation is determined.

[0082] S6: Input the cross-domain fusion feature representation into the Transformer Decoder model to perform temporal decoding on the server running state to obtain the reconstructed time series of the server running state; and calculate the reconstruction error of the server running state; construct the temporal correlation structure difference based on the sequence correlation matrix and the prior correlation matrix; determine the target anomaly score of the server running state based on the reconstruction error and the temporal correlation structure difference. If the target anomaly score is greater than the preset anomaly score, the server running state at time point t is temporally abnormal; otherwise, the server is running normally.

[0083] In one embodiment, the linear mapping of the running state parameters consisting of multiple time window samples and the superposition of position codes to obtain the initial temporal feature representation is achieved by the following expression:

[0084]

[0085] in, This represents the initial temporal feature representation for the anomaly attention module. For the input time window batch data, This is a linear mapping layer used to map the original monitoring metrics to a unified feature space. Location encoding is used to introduce temporal location information. This step maps the original server monitoring data to a unified feature space while retaining the temporal location information, providing a foundation for subsequent attention modeling.

[0086] In one embodiment, the temporal feature representation of the previous layer is processed in the current layer anomaly attention module. Perform a linear transformation to obtain the query matrix Key matrix Sum matrix This can be achieved using the following expression:

[0087]

[0088]

[0089]

[0090] in, This is the query matrix in the current layer's anomaly attention. The key matrix, For value matrices, These are the output features of the previous layer's anomaly attention module. , , The weight matrix is ​​a learnable linear mapping. This is an index for the anomaly attention layer, and the mapping is used to characterize the interdependencies between server runtime states at different points in time.

[0091] In one embodiment, the query matrix is ​​used as the basis for... Key matrix Sum matrix The sequence incidence matrix is ​​determined by combining the normalization function. Weighted temporal feature representation Time-domain feature representation This can be achieved using the following expression:

[0092] =

[0093] in, The sequence incidence matrix at time t; For normalization function, As a feature latent space dimension, the sequence association matrix is ​​used to represent the degree of correlation between the server operating states at different time points;

[0094] =

[0095] in, This is a weighted temporal feature representation of the output of the anomaly attention module; These are the output features of the previous layer's anomaly attention module; The value matrix provides specific feature information about the server's operating status, and the output is obtained through residual connections and layer normalization.

[0096]

[0097] in, This represents the temporal feature representation output by the current layer's anomaly attention module. As a layer normalization operation, this process can highlight historical states that are highly relevant to the current point in time while preserving the original information.

[0098] In one embodiment, based on the output features of each layer of the anomaly attention module at each time location... Determine the scale parameters at the corresponding time location. ; and based on the scale parameter Determine the prior correlation matrix This can be achieved using the following expression:

[0099]

[0100] in, Let i be the scale parameter at time position i; The output feature of the previous layer's anomaly attention module at time position i; The learnable linear mapping weight matrix at time position i

[0101]

[0102] in, W represents the prior association matrix between time positions i and j in the current layer, where W represents the length of the time window; i and j are the time position indices within the time window. For standardized operation; It is a Gaussian function; The scale parameter at time position i controls the temporal spread of the prior association, which is used to explicitly express the engineering hypothesis that "temporally adjacent server states are more correlated".

[0103] In one embodiment, the operation status parameters The global frequency domain feature representation is obtained by performing a Fourier transform. ; Regarding the operating status parameters Divided into several local subsequences and for the local subsequence Local features are obtained by performing frequency domain transformation. Based on the global frequency domain feature representation and the local features Determine the multi-scale frequency domain feature representation This can be achieved using the following expression:

[0104]

[0105] in, For Fast Fourier Transform, These are parameters for batch execution status; It is a global frequency domain feature representation used to extract the server load cycle structure formed by business scheduling and user access patterns;

[0106]

[0107] in, This is the m-th local subsequence; This is the local feature corresponding to the m-th local time segment, used to capture the high-frequency change features of the server caused by abnormal requests or resource contention in a short period of time;

[0108]

[0109] in, This represents the multi-scale frequency domain features after fusion. For multiple local features Local frequency domain features obtained after learning by the attention module; This is a feature concatenation function that merges features to retain both long-term periodic information and short-term anomaly frequency information of the server's operating status.

[0110] In one embodiment, the representation of the multi-scale frequency domain features After performing a discrete cosine transform and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights. The multi-scale frequency domain feature representation is applied through the frequency domain channel attention weights. After enhancement, frequency domain enhancement features are obtained. This can be achieved using the following expression:

[0111]

[0112] in, The frequency components are represented as frequency domain characteristics. This is the discrete cosine transform;

[0113]

[0114] in, For frequency domain channel attention weights, , For the weights of the fully connected layer, It is a non-linear activation function. for function;

[0115]

[0116] in, Multi-scale frequency domain feature representation Frequency domain enhancement features after frequency domain channel attention enhancement.

[0117] In one embodiment, the combination of the frequency domain enhancement feature and initial temporal feature representation After learning through N layers of anomaly attention modules, a temporal anomaly feature representation of the server's running state is obtained. Determine the feature representation after cross-domain fusion This can be achieved using the following expression:

[0118]

[0119]

[0120]

[0121] in, The query matrix in the cross-domain attention module is obtained by linear mapping of the frequency domain enhancement features and is used to represent the attention requirements of the current frequency structure for time domain information. The key matrix in the cross-domain attention module. The value matrix in the cross-domain attention module is obtained by linear mapping from temporal anomaly features; For frequency domain enhancement features; Initial temporal feature representation After learning through N layers of anomaly attention modules, a temporal anomaly feature representation of the server's running state is obtained; , , It is a learnable linear mapping weight matrix;

[0122]

[0123] in, This is a cross-domain attention score matrix, used to represent the degree of correlation between frequency domain features and temporal domain anomaly features at different times. This is a normalization function used to map attention scores to a probability distribution. The dimension of the latent space is the feature.

[0124]

[0125] in, This represents the feature representation after cross-domain fusion. These are temporal anomaly features after cross-domain attention weighting. For frequency domain enhancement features, As a layer normalization operation, this fusion method performs weighted selection of time-domain anomaly features under the conditional constraints of frequency domain features, thereby enabling frequency domain structural information to guide the time-domain anomaly modeling process.

[0126] In one embodiment,

[0127] The reconstruction error of the server running state This can be achieved using the following expression:

[0128]

[0129] in, The reconstruction error represents the server's operating state at time point t. The actual operating state vector of the server at time t To reconstruct time series The reconstructed data located at time point t, It is the L2 norm, used to measure the numerical deviation between the true value and the reconstructed value;

[0130] The time-related structural differences This can be achieved using the following expression:

[0131]

[0132] = (i=t)

[0133] in, For time point t, Let be the sequence incidence matrix at time t. This is the prior correlation matrix at time position t in the current layer. KL divergence is used to measure the degree of difference between two correlation distributions.

[0134] In one embodiment, the target anomaly score This can be achieved using the following expression:

[0135]

[0136] in, The target anomaly score for the server's operational status at time point t; The reconstruction error represents the server's operating state at time point t. These are weighting coefficients used to balance the impact of reconstruction error and differences in associated structures on anomaly detection;

[0137] When the target abnormal score If the score exceeds the preset abnormality score, the server's operating status at time point t is considered to be a timing abnormality.

[0138] Compared to existing time-series anomaly detection methods, the advantages of this invention are as follows: The anomaly attention mechanism can characterize the structural changes in the correlation between different moments in a time series, thereby improving the ability to identify structural anomalies in servers; by introducing multi-scale frequency domain feature extraction and multi-domain feature fusion mechanisms, it can effectively capture the periodic change features of the time series at different time scales, improving the detection effect on complex anomaly patterns; furthermore, this invention uses an unsupervised reconstruction learning method for training, eliminating the need for manually labeled anomaly samples, and can utilize a large amount of normal operation data for learning, thus possessing good versatility and practical application value.

[0139] This invention can be applied to anomaly detection in server devices. This embodiment was tested on the publicly available server anomaly detection datasets SMD and PSM. The invention is compared with Isolation Forest, THOC, BeatGAN, OmniAnomaly, InterFusion, and Anomaly Transformer. The experimental results are shown in Table 1.

[0140] Table 1

[0141]

[0142] Compared with other methods, the present invention has achieved better results, and the final F1-score is higher than that of other methods.

[0143] Figure 3 An internal structural diagram of a computer device in one embodiment is shown. This computer device can specifically be a terminal or a server. Figure 3 As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and may also store a computer program. When executed by the processor, this computer program enables the processor to implement a server timing anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder. The internal memory may also store a computer program, which, when executed by the processor, enables the processor to implement the server timing anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder. Those skilled in the art will understand that... Figure 3The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0144] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0145] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A server temporal anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder, characterized in that, The method includes: S1: Collect multi-dimensional operating status parameters recorded by the monitoring system during the operation of the server; and standardize the multi-dimensional operating status parameters to obtain multi-dimensional operating status parameters; construct time window samples by dividing the multi-dimensional operating status parameters through a sliding window; the multi-dimensional operating status parameters include at least: processor utilization, memory utilization, disk read / write speed, network throughput, and system load indicators. S2: Linearly map and superimpose position codes on the running state parameters composed of multiple time window samples to obtain an initial temporal feature representation, and use the initial temporal feature representation as the input of the anomaly attention module; in the current layer anomaly attention module, perform a linear transformation on the temporal feature representation of the previous layer to obtain a query matrix, a key matrix, and a value matrix; based on the query matrix, key matrix, and value matrix and combined with a normalization function, determine the sequence association matrix, weighted temporal feature representation, and temporal feature representation; S3: Perform a Fourier transform on the operating state parameters to obtain a global frequency domain feature representation; divide the operating state parameters into several local sub-sequences, and perform a frequency domain transform on the local sub-sequences to obtain local features; determine a multi-scale frequency domain feature representation based on the global frequency domain feature representation and the local features; S4: After performing a discrete cosine transform on the multi-scale frequency domain feature representation, and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights, and the frequency domain enhanced features are obtained by enhancing the multi-scale frequency domain feature representation with the frequency domain channel attention weights. S5: Combining the frequency domain enhancement features and the initial time domain feature representation, the time domain anomaly feature representation of the server running state is obtained through learning by N layers of anomaly attention modules, and the feature representation after cross-domain fusion is determined. S6: Input the cross-domain fusion feature representation into the Transformer Decoder model to perform temporal decoding on the server running state to obtain the reconstructed time series of the server running state; and calculate the reconstruction error of the server running state; construct the temporal correlation structure difference based on the sequence correlation matrix and the prior correlation matrix; determine the target anomaly score of the server running state based on the reconstruction error and the temporal correlation structure difference. If the target anomaly score is greater than the preset anomaly score, the server running state at time point t is temporally abnormal; otherwise, the server is running normally.

2. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, The linear mapping and overlay of position codes on the running state parameters, which consist of multiple time window samples, to obtain the initial temporal feature representation is achieved through the following expression: in, This represents the initial temporal feature representation for the anomaly attention module. For the input time window batch data, It is a linear mapping layer; For position encoding.

3. The server timing anomaly detection method based on anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, In the current layer anomaly attention module, the query matrix, key matrix, and value matrix are obtained by performing a linear transformation on the temporal feature representation of the previous layer using the following expression: in, This is the query matrix in the current layer's anomaly attention. The key matrix, For value matrices, These are the output features of the previous layer's anomaly attention module. , , The weight matrix is ​​a learnable linear mapping. Index for the anomaly attention layer.

4. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, The determination of the sequence association matrix, weighted time-domain feature representation, and time-domain feature representation based on the query matrix, key matrix, and value matrix, combined with a normalization function, is achieved through the following expressions: = in, The sequence incidence matrix at time t; For normalization function, The dimension of the latent space is the feature. = in, This is a weighted temporal feature representation of the output of the anomaly attention module; These are the output features of the previous layer's anomaly attention module; It is a value matrix; in, This represents the temporal feature representation output by the current layer's anomaly attention module. This is a layer normalization operation.

5. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 4, characterized in that, The scale parameter at each time location is determined based on the output features of each layer of the anomaly attention module; and the prior association matrix is ​​determined based on the scale parameter using the following expression: in, Let i be the scale parameter at time position i; For the first time position i Output features of the layer anomaly attention module; The learnable linear mapping weight matrix at time position i in, For the first The prior association matrix between time positions i and j in the layer, where W represents the length of the time window; i and j are the time position indices within the time window. For standardized operation; It is a Gaussian function; Let be the scale parameter at time position i.

6. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, The process involves performing a Fourier transform on the operating state parameters to obtain a global frequency domain feature representation; dividing the operating state parameters into several local sub-sequences and performing a frequency domain transform on the local sub-sequences to obtain local features; and determining a multi-scale frequency domain feature representation based on the global frequency domain feature representation and the local features, achieved through the following expression: in, For Fast Fourier Transform, These are parameters for batch execution status; It represents the global frequency domain features; in, This is the m-th local subsequence; The local feature corresponding to the m-th local time segment; in, This represents the fused multi-scale frequency domain features. For multiple local features Local frequency domain features obtained after learning by the attention module; This is the feature splicing function.

7. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, After performing a discrete cosine transform on the multi-scale frequency domain feature representation, and combining it with a nonlinear activation function and The function obtains the frequency domain channel attention weights. The enhanced frequency domain features obtained by enhancing the multi-scale frequency domain feature representation through the frequency domain channel attention weights are achieved through the following expression: in, The frequency components are represented as frequency domain characteristics. This is the discrete cosine transform. in, For frequency domain channel attention weights, , For the weights of the fully connected layer, It is a non-linear activation function. for function; in, Multi-scale frequency domain feature representation Frequency domain enhancement features after frequency domain channel attention enhancement.

8. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, The combination of the frequency domain enhancement features and the initial temporal feature representation, after learning through N layers of anomaly attention modules, yields the temporal anomaly feature representation of the server's operating state. The cross-domain fused feature representation is determined by the following expression: in, This refers to the query matrix in the cross-domain attention module. This is the key matrix in the cross-domain attention module. This is the value matrix in the cross-domain attention module; For frequency domain enhancement features; Initial time-domain feature representation After learning through N layers of anomaly attention modules, a temporal anomaly feature representation of the server's running state is obtained; , , It is a learnable linear mapping weight matrix; in, This is the cross-domain attention score matrix; This is the normalization function; The dimension of the latent space is the feature. in, This represents the feature representation after cross-domain fusion. These are temporal anomaly features after cross-domain attention weighting. For frequency domain enhancement features, This is a layer normalization operation.

9. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 1, characterized in that, The reconstruction error of the server running state is realized by the following expression: in, The reconstruction error represents the server's operating state at time point t. The actual operating state vector of the server at time t To reconstruct time series The reconstructed data located at time point t, It is a 2-norm; The time-related structural differences are achieved through the following expression: = (i=t) in, For time point t, Let be the sequence incidence matrix at time t. For the first The prior correlation matrix at time position t in the layer. KL divergence is used to measure the degree of difference between two correlation distributions.

10. The server timing anomaly detection method based on an anomaly attention and multi-domain feature fusion autoencoder according to claim 9, characterized in that, The target anomaly score is achieved through the following expression: in, The target anomaly score for the server's operational status at time point t; The reconstruction error represents the server's operating state at time point t. These are the weighting coefficients.

Images