Equipment anomaly detection method and electronic equipment

Abstract

The invention provides an equipment anomaly detection method and electronic equipment. The method comprises the steps that if it is detected that performance index data of to-be-tested equipment is abnormal, correlation weights are obtained according to correlation analysis of the performance index data; determining a time decay weight of an abnormal event corresponding to the performance index data; performing self-attention analysis on the performance index data and the historical index data of the abnormal event by using a self-attention mechanism based on the related weight and the time attenuation weight to obtain an attention weight; determining a convergence index of the expert model according to performance evaluation data of the expert model corresponding to the performance index data; and if the expert model is determined to be qualified according to the attention weight and the convergence index, based on the time domain and frequency domain features corresponding to the performance index data and the normalized performance index data, using the expert model to obtain an anomaly detection result of the to-be-detected device. By utilizing the method, whether the equipment is abnormal or not can be accurately detected.

Description

Technical Field

[0001] This application relates to the field of equipment testing technology, specifically to a method and electronic device for detecting equipment anomalies. Background Technology

[0002] To perform timely equipment maintenance, it is necessary to detect whether the equipment is malfunctioning. Related technologies often directly determine whether the equipment's performance data is abnormal based on thresholds or threshold ranges, and output alarm prompts when abnormal performance data is confirmed. However, this anomaly detection method is difficult to adapt to complex and changing operating environments and equipment states, and is prone to false alarms or missed alarms.

[0003] If equipment malfunctions cannot be accurately detected, it will affect the stable operation of the equipment and maintenance efficiency. Summary of the Invention

[0004] This application discloses a method and electronic device for detecting equipment anomalies, which can solve the technical problem that the operation and maintenance of equipment are affected due to the difficulty in detecting equipment anomalies.

[0005] On one hand, this application provides a method for detecting equipment anomalies. The method includes: if an anomaly is detected in the performance index data of the device under test, performing correlation analysis on the performance index data to obtain relevant weights, determining the frequency of occurrence of the abnormal event corresponding to the performance index data within a preset historical time period, and determining a target time point from the occurrence time points of the abnormal events occurring in the historical time period based on a preset time point, determining the time decay weight of the abnormal event based on the preset time point, the target time point, and the occurrence frequency, performing self-attention analysis on the performance index data and the historical index data of the abnormal event using a self-attention mechanism based on the relevant weights and the time decay weights to obtain the attention weight of the performance index data, determining the convergence index of the expert model based on the performance evaluation data of the expert model corresponding to the performance index data, and if the expert model is determined to be qualified based on the attention weights and the convergence index, obtaining the anomaly detection result of the device under test using the expert model based on the time domain features, frequency domain features, and normalized performance index data corresponding to the performance index data.

[0006] In some embodiments of this application, the performance index data corresponds to multiple index types, and the correlation weights include autocorrelation weights and cross-correlation weights. The step of performing correlation analysis on the performance index data to obtain the correlation weights includes: performing correlation analysis on performance index data with the same index type to obtain the autocorrelation weight corresponding to each index type; obtaining a preset matrix, where elements in the preset matrix are used to indicate the correlation between index types; generating an index data matrix based on the performance index data of the multiple index types, where each column / row of index data in the index data matrix corresponds to one index type; and performing correlation analysis on the multiple index types based on the preset matrix and the index data matrix to obtain the cross-correlation weights between correlated index types.

[0007] In some embodiments of this application, the step of performing correlation analysis on the multiple indicator types based on the preset matrix and the indicator data matrix to obtain the cross-correlation weights between the correlated indicator types includes: performing a matrix filling process, including: generating an empty matrix according to the dimensions of the preset matrix; selecting a target indicator type from the multiple indicator types; filling the empty matrix with the performance indicator data corresponding to the target indicator type in the indicator data matrix to obtain an initial matrix; keeping the performance indicator data corresponding to the target indicator type unchanged in the initial matrix; cyclically selecting the performance indicator data corresponding to the indicator type with the number of rows or columns to be filled in the initial matrix from the indicator data matrix; and... The selected performance metric data is filled into the initial matrix until all performance metric data corresponding to all metric types in the metric data matrix are selected, thereby obtaining multiple target matrices corresponding to the target metric type. The matrix filling process is repeated until all multiple metric types are selected as target metric types, thereby obtaining multiple target matrices corresponding to each metric type, wherein each target matrix has multiple corresponding metric types. Based on the preset matrix and each target matrix, the cross-correlation weights between the multiple metric types corresponding to each target matrix are determined. If the cross-correlation weight corresponding to any target matrix is ​​greater than a preset threshold, it is determined that the multiple metric types corresponding to any target matrix are correlated.

[0008] In some embodiments of this application, the performance index data of each index type has a corresponding expert model. The method further includes: if the convergence index of the expert model corresponding to any index type is greater than or equal to a first preset value, and the attention weight corresponding to the performance index data of any index type is greater than or equal to a second preset value, the expert model corresponding to any index type is determined to be qualified; if the convergence index of the expert model corresponding to any index type is less than the first preset value, the expert model corresponding to any index type is determined to be unqualified, and an alarm message is generated.

[0009] In some embodiments of this application, each indicator type has corresponding time-domain features, frequency-domain features, and normalized performance indicator data, and each indicator type has corresponding abnormal events. The step of obtaining the anomaly detection result of the device under test (DUT) based on the time-domain features, frequency-domain features, and normalized performance indicator data corresponding to the performance indicator data, using the expert model, includes: based on the time-domain features, frequency-domain features, and normalized performance indicator data corresponding to any one indicator type, using the expert model corresponding to that one indicator type, predicting the probability of the DUT experiencing an abnormal event corresponding to that one indicator type; if the probability is greater than or equal to a third preset value, determining that the anomaly detection result indicates that the DUT has an abnormal event corresponding to that one indicator type; if the probability is less than the third preset value, determining that the DUT does not have an abnormal event corresponding to that one indicator type.

[0010] In some embodiments of this application, if it is determined that the device under test has any abnormal event, the method further includes: generating a repair script for the abnormal event according to the repair strategy for the abnormal event; determining a target confidence score for the repair script according to a preset initial confidence score and the attention weight; and repairing the device under test by executing the repair script if the target confidence score is greater than or equal to a fourth preset value.

[0011] In some embodiments of this application, determining the time decay weight of the abnormal event based on the preset time point, the target time point, and the occurrence frequency includes: determining the time interval between the preset time point and the target time point; using a first preset function to calculate the preset decay coefficient and the time interval to obtain the time decay factor of the abnormal event; and determining the time decay weight of the abnormal event based on the occurrence frequency and the time decay factor.

[0012] In some embodiments of this application, the step of performing self-attention analysis on the performance index data and the historical index data of the abnormal event based on the correlation weight and the time decay weight, and obtaining the attention weight of the performance index data, includes: converting the performance index data into a query vector using the self-attention mechanism, and converting the historical index data into a key vector using the self-attention mechanism, and determining the attention weight based on the query vector, the key vector, the correlation weight and the time decay weight.

[0013] In some embodiments of this application, the performance evaluation data includes precision data and recall data. Determining the convergence index of the expert model based on the performance evaluation data of the expert model corresponding to the performance index data includes: determining the harmonic mean of the expert model based on the precision data and recall data; determining a target value based on a first preset value and the harmonic mean; and performing calculations on the second preset value and the target value using a second preset function to obtain the convergence index. On the other hand, this application provides an electronic device, the electronic device including: a processor, a memory; and an application program, wherein the application program is stored in the memory and configured to be executed by the processor to implement the device anomaly detection method.

[0014] In the device anomaly detection method of this embodiment, the correlation weight reflects the correlation between performance index data, and the time decay weight reflects the impact of abnormal events occurring at different time points on the current state of the device under test. Therefore, by using the correlation weight and time decay weight, the attention weight of the performance index data is calculated using a self-attention mechanism, so that the attention weight can comprehensively reflect the importance, timeliness, and contribution of the performance index data to the current state of the device under test. Since the convergence index of the expert model is calculated through the corresponding performance evaluation data, each convergence index can reflect the performance and convergence degree of the corresponding expert model. Because each convergence index can reflect the performance and convergence degree of the corresponding expert model, and the attention weight can comprehensively reflect the importance, timeliness, and contribution of the performance index data to the current state of the device under test, the qualification of the corresponding expert model can be determined by using the attention weight of the performance index data and the convergence index of each expert model. This not only determines the expert model corresponding to each type of performance index data but also accurately and comprehensively evaluates the reliability and applicability of the expert model. Time-domain features reflect the statistical characteristics and trends of corresponding performance index data over time, while frequency-domain features reflect the composition and distribution of these data over frequency, ensuring that normalized performance index data are on a comparable scale. Therefore, when determining the competence of an expert model, based on time-domain features, frequency-domain features, and normalized performance index data, a qualified expert model can accurately determine the risk of abnormal events corresponding to the performance index data in the device under test, thereby enabling accurate detection of equipment anomalies. Attached Figure Description

[0015] Figure 1 This is a flowchart of a device anomaly detection method provided in an embodiment of this application.

[0016] Figure 2This is a flowchart of a method for generating relevant weights provided in an embodiment of this application.

[0017] Figure 3 This is a flowchart of a repair method for a device under test provided in an embodiment of this application.

[0018] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the application will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] It should be noted that in this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and drawings of this application are used to distinguish similar objects, not to describe a specific order or sequence.

[0021] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0022] This application provides a method for detecting equipment malfunctions, which can accurately detect whether equipment is malfunctioning.

[0023] The device anomaly detection method provided in this application can be applied to one or more electronic devices. The electronic devices can be servers, industrial control computers, computers, mobile phones, laptops, vehicle-mounted devices, etc. The server can be a cloud server or a server cluster; this application does not limit the type of electronic device.

[0024] like Figure 1 The diagram shown is a flowchart of a device anomaly detection method according to an embodiment of this application. The order of the steps in this flowchart can be adjusted according to different needs, and some steps can be omitted. The method is applied to electronic devices.

[0025] S11. If an anomaly is detected in the performance index data of the device under test, a correlation analysis is performed on the performance index data to obtain the relevant weights.

[0026] In some embodiments of this application, performance indicator data can correspond to multiple indicator types. Each indicator type's performance indicator data can be in vector form, with a corresponding time period, such as 60 seconds. This application does not limit the type of device under test. For example, the device under test can be a computer or a server. The number of devices under test can be one or more.

[0027] This application does not limit the number of indicator types. For example, performance indicator data may include data for indicating the performance of a central processing unit (CPU), data for indicating the performance of random access memory (RAM), where RAM may be referred to as memory, data for indicating the performance of disk input / output (Disk I / O), data for indicating the performance of dual in-line memory modules (DIMMs), and data for indicating the performance of network traffic.

[0028] For example, CPU performance metrics may include CPU utilization, CPU temperature, and CPU error count; memory performance metrics may include memory utilization, available memory, and memory error count; disk performance metrics may include read latency, write latency, total error count, and error rate per second; DIMM performance metrics may include error rate per second; and network traffic performance metrics may include network latency and packet loss rate.

[0029] In some embodiments of this application, electronic devices can use various methods to determine whether the performance index data of each index type is abnormal, and this application does not limit this.

[0030] For example, the electronic device can calculate the mean and standard deviation of performance index data for any index type. Based on any performance index data of any index type and the mean and standard deviation, it calculates the standard score (referred to as "Z-score") of the performance index data. The electronic device can determine that the performance index data corresponding to the standard score greater than a preset score is abnormal data. If there is a first preset number of abnormal data in the performance index data of any index type, the electronic device can determine that the performance index data of any index type is abnormal. The preset score and the first preset number can be customized, and this embodiment does not impose any restrictions on them.

[0031] In some embodiments of this application, when the performance index data corresponds to multiple index types, the correlation weights may include autocorrelation weights and cross-correlation weights. If the performance index data corresponds to a single index type, the electronic device may only include autocorrelation weights. Each index type may have multiple cross-correlation weights.

[0032] Among them, the autocorrelation weight can be obtained by performing correlation analysis on performance index data with the same index type, and the cross-correlation weight can be obtained by performing correlation analysis on performance index data of multiple index types.

[0033] In this embodiment, the correlation between performance indicator data can be reflected. For example, autocorrelation weight can reflect the correlation between performance indicator data with the same indicator type, while cross-correlation weight can reflect the correlation between performance indicator data with different indicator types.

[0034] S12, determine the frequency of occurrence of abnormal events corresponding to performance index data within a preset historical time period, and determine the target time point from the occurrence time points of abnormal events that occurred in the historical time period based on the preset time point.

[0035] In some embodiments of this application, each metric type has a corresponding abnormal event. For example, the abnormal event corresponding to CPU may be abnormal CPU utilization, the abnormal event corresponding to RAM may be abnormal memory utilization, the abnormal event corresponding to disk may be abnormal disk read / write speed, the abnormal event corresponding to DIMM may be DIMM failure, and the abnormal event corresponding to network traffic may be network latency, etc.

[0036] The historical time period can be customized, and this application does not impose any restrictions on it. For example, the historical time period can be the past 7 days. The electronic device can count the number of times each abnormal event occurs within the historical time period, and calculate the occurrence frequency of each abnormal event based on the number of occurrences. For example, if the historical time period is the past 7 days, and if the abnormal event of excessive CPU load occurred 10 times within the past 7 days, the occurrence frequency of the abnormal event of excessive CPU load can be determined to be 10.

[0037] In other embodiments of this application, the electronic device can normalize the number of occurrences of abnormal events within a historical time period, and determine the frequency of occurrence of the abnormal event by using the normalized value or a weighted average of the normalized value. The above examples of methods for determining the frequency of occurrence of abnormal events are merely illustrative and are not limited to practical applications.

[0038] In some embodiments of this application, the preset time point can be customized. For example, the electronic device can use the current time point as the preset time point. Exemplarily, the electronic device can determine the closest occurrence time point to the current time point as the target time point.

[0039] S13. Determine the time decay weight of abnormal events based on preset time points, target time points, and occurrence frequencies.

[0040] In some embodiments of this application, determining the time decay weight of an abnormal event based on a preset time point, a target time point, and an occurrence frequency includes: determining the time interval between the preset time point and the target time point; using a first preset function to calculate the preset decay coefficient and the time interval to obtain the time decay factor of the abnormal event; and determining the time decay weight of the abnormal event based on the occurrence frequency and the time decay factor.

[0041] Each type of abnormal event can have a corresponding time decay weight. This application does not restrict the type of the first preset function. For example, the first preset function can be an exponential function with the base e of the natural logarithm. The preset decay coefficient can be customized, and this application does not restrict it. For example, the preset decay coefficient can be 1.5.

[0042] For example, an electronic device can use the product of a preset attenuation coefficient and a time interval as the exponent of an exponential function with the base e of the natural logarithm to obtain a time attenuation factor. The above example of the first preset function is merely illustrative and is not limited to practical applications. For instance, the first preset function can also be a linear function.

[0043] In some embodiments of this application, each abnormal event may have a corresponding time decay weight. The electronic device can multiply the occurrence frequency of each abnormal event by the corresponding time decay factor to obtain the time decay weight corresponding to each abnormal event.

[0044] Considering that the impact of abnormal events changes over time, abnormal events closer to the current time are often more relevant to the current state of the device under test (DUT) than those farther away. Therefore, in order to quickly and accurately locate whether the DUT has experienced an anomaly and the abnormal event that occurred, in this embodiment, the occurrence time closest to the current time is determined as the target time. This allows the time decay weight of abnormal events corresponding to occurrence times closer to the current time to be greater, thereby reducing the interference of abnormal events corresponding to occurrence times farther away from the current time. S14. Based on the relevant weights and time decay weights, the self-attention mechanism is used to perform self-attention analysis on the performance index data and the historical index data of abnormal events to obtain the attention weights of the performance index data.

[0045] In some embodiments of this application, based on relevance weights and time decay weights, a self-attention mechanism is used to perform self-attention analysis on performance indicator data and historical indicator data of abnormal events to obtain the attention weight of performance indicator data. This includes: the electronic device uses a self-attention mechanism to convert performance indicator data into a query vector and uses a self-attention mechanism to convert historical indicator data into a key vector. The attention weight is determined based on the query vector, key vector, relevance weights, and time decay weights.

[0046] Each performance metric type has a corresponding attention weight. The method of converting performance metric data into query vectors and historical metric data into key vectors using a self-attention mechanism can be found in related technical documentation on data embedding and linear transformation of the embedded data.

[0047] For example, an electronic device can calculate the inner product between the query vector and the key vector, add the inner product, relevance weights, and time decay weights together or perform a weighted sum operation to obtain the weight sum value, determine the vector dimension of the query vector or key vector, and determine the attention weight as the ratio between the weight sum value and the square root of the vector dimension.

[0048] The weights in the weighted correlation calculation can be customized, and this application does not impose any restrictions on them.

[0049] In this embodiment, since the correlation weight reflects the correlation between performance index data and the time decay weight reflects the impact of abnormal events occurring at different time points on the current state of the device under test, the attention weight of the performance index data is calculated using a self-attention mechanism through the correlation weight and the time decay weight. This allows the attention weight to comprehensively reflect the importance, timeliness, and contribution of the performance index data to the current state of the device under test. For example, a larger attention weight corresponds to a higher level of importance and timeliness of the performance index data, and a greater contribution to the current state of the device under test.

[0050] S15. Based on the performance evaluation data of the expert model corresponding to the performance index data, determine the convergence index of the expert model.

[0051] In some embodiments of this application, the performance metric data corresponding to each metric type can have a corresponding expert model in the Mixture of Experts (MOE). For example, following the above embodiments, if the performance metric data can include data indicating the performance of the central processing unit (CPU), data indicating the performance of memory, data indicating the performance of disk input / output (DIMM), data indicating the performance of dual in-line memory (DIMM), and data indicating the performance of network traffic, the MOE can include expert models corresponding to the CPU performance metric data, the memory performance metric data, the disk performance metric data, the DIMM performance metric data, and the network traffic performance metric data.

[0052] The expert model corresponding to the performance metric data for each metric type can be obtained using the corresponding training data. For example, the expert model corresponding to CPU performance metric data can be obtained by training a neural network using CPU performance metric data as training data, and the expert model corresponding to memory performance metric data can be obtained by training a neural network using memory performance metric data as training data. The neural networks corresponding to the performance metric data for each metric type can be the same or different. For example, the hybrid expert model in this application can be obtained by training expert models from Mixtral-8x7B, DeepSeekMoE, Flan-MoE, and SmartMoE using corresponding training data. The expert model corresponding to the performance metric data for each metric type in the hybrid expert model can be obtained through independent training or through joint training.

[0053] In some embodiments of this application, the hybrid expert model includes a gating network. The electronic device can use the gating network to perform feature analysis on performance index data of any index type, so as to determine the expert model corresponding to the performance index data of any index type from multiple expert models of the hybrid expert model.

[0054] Among them, the method of using gating networks to perform feature analysis on performance index data of any index type can refer to the explanation of gating networks in related technologies on selecting expert models based on the characteristics of data such as type, range, and distribution.

[0055] In some embodiments of this application, the performance evaluation data includes precision data and recall data. The electronic device determines the convergence index of the expert model based on the performance evaluation data of the expert model corresponding to the performance index data, including: determining the harmonic mean of the expert model based on the precision data and recall data; determining the target value based on the first preset value and the harmonic mean; and using a second preset function to calculate the second preset value and the target value to obtain the convergence index.

[0056] Each expert model has a corresponding convergence metric. The target value can be the difference between the harmonic mean and a first preset value.

[0057] For example, an electronic device can input labeled sample data into each expert model, obtain the output data of each expert model, and calculate the precision and recall data of each expert model based on the output data and the labeling of the sample data.

[0058] The sample data can be the performance index data of the equipment, and the annotation of the sample data can be used to indicate whether the equipment is abnormal and the abnormal events that occur when the abnormality occurs.

[0059] The harmonic mean can be referred to as the F1 score. The calculation methods for precision and recall data for each expert model can be found in relevant techniques. The calculation method for the harmonic mean can refer to the formula for calculating the F1 score using precision and recall data in relevant techniques.

[0060] The second preset function can be customized, and this application does not impose any restrictions on it. For example, the second preset function can be the sigmoid function. The second preset value can also be customized, and this application does not impose any restrictions on it.

[0061] For example, the electronic device can use the product of the second preset value and the target value as the exponent of the sigmoid function to obtain a convergence index.

[0062] In this embodiment, since the convergence index of the expert model is calculated through the corresponding performance evaluation data, each convergence index can reflect the performance and convergence degree of the corresponding expert model.

[0063] S16. Determine whether the expert model is qualified based on the attention weight and convergence index.

[0064] In some embodiments of this application, the electronic device determines whether an expert model is qualified based on attention weights and convergence indices, including: if the convergence index of the expert model corresponding to any index type is greater than or equal to a first preset value, and the attention weight corresponding to the performance index data of the any index type is greater than or equal to a second preset value, the electronic device can determine that the expert model corresponding to the any index type is qualified; if the convergence index of the expert model corresponding to any index type is less than the first preset value, the electronic device can determine that the expert model corresponding to the any index type is unqualified.

[0065] The first and second preset values ​​can be customized, and this application does not impose any restrictions on them.

[0066] In some embodiments of this application, if the expert model corresponding to any indicator type is qualified, step S17 is executed; if the expert model corresponding to any indicator type is unqualified, step S18 is executed.

[0067] In this embodiment, since each convergence metric reflects the performance and convergence degree of the corresponding expert model, and the attention weight comprehensively reflects the importance, timeliness, and contribution of the performance metric data to the current state of the device under test, the qualification of the corresponding expert model can be determined by using the attention weight of the performance metric data and the convergence metric of each expert model. This not only identifies the expert model corresponding to the performance metric data of each metric type but also accurately and comprehensively evaluates the reliability and applicability of the expert model. The convergence metric also allows for the control of preventing the invocation / activation of expert models that have not yet converged or have poor performance, thereby ensuring the accuracy of the detection of the device under test.

[0068] In other embodiments of this application, the expert models in the hybrid expert model can be adjusted according to the type of performance metrics data. For example, if the temperature data of the device under test is added to the performance metrics data, an expert model corresponding to the temperature data of the device under test can be added to the hybrid expert model. If the CPU utilization rate is reduced in the performance metrics data, the expert model corresponding to the CPU utilization rate can be deleted from the hybrid expert model, or the expert model corresponding to the CPU utilization rate can be controlled not to be called / activated by setting convergence metrics and / or attention weights.

[0069] S17. Based on the time-domain characteristics, frequency-domain characteristics, and normalized performance index data corresponding to the performance index data, an expert model is used to obtain the anomaly detection results of the device under test.

[0070] In some embodiments of this application, the performance index data for each index type has corresponding time-domain characteristics. The electronic device can calculate the time-domain characteristics of the performance index data, including the mean, rate of change, variance, standard deviation, and root mean square value of the performance index data for each index type, as the time-domain characteristics corresponding to each index type.

[0071] In this embodiment, time-domain features can reflect the statistical characteristics and trends of the corresponding performance index data over time. By calculating the time-domain features such as the mean, rate of change, variance, standard deviation, and root mean square value of the performance index data for each index type, the distribution patterns and fluctuations of the performance index data at different times can be obtained.

[0072] In some embodiments of this application, the performance index data for each index type has corresponding frequency domain characteristics. Electronic devices can obtain spectrum data by performing frequency domain transformation on the performance index data for each index type, and extract the frequency domain characteristics corresponding to each index type from the spectrum data.

[0073] This application does not limit the method of frequency domain transformation. For example, the frequency domain transformation can be a Fourier transform. Frequency domain features can include multiple frequency domain components. For example, frequency domain features can include the DC component, fundamental frequency component, and highest frequency component in the spectrum data.

[0074] In this embodiment, frequency domain features can reflect the composition and distribution of the corresponding performance index data in the frequency dimension. By performing frequency domain transformation on the performance index data and extracting frequency domain features such as DC component, fundamental frequency component, and highest frequency component from the spectrum data, the energy distribution and periodicity characteristics of the performance index data at different frequencies can be analyzed.

[0075] In some embodiments of this application, the electronic device can preset a numerical range to normalize the performance index data for each index type, thereby obtaining normalized performance index data. The preset numerical range can be customized. For example, the preset numerical range can be 0 to 1.

[0076] In this embodiment, the performance index data of each index type is normalized to eliminate the influence of different dimensions and value ranges between different performance index data, so that the normalized performance index data are on the same comparable scale.

[0077] In some embodiments of this application, each indicator type has corresponding time-domain features, frequency-domain features, and normalized performance indicator data, and each indicator type has corresponding abnormal events. The electronic device obtains the anomaly detection result of the device under test based on the time-domain features, frequency-domain features, and normalized performance indicator data corresponding to the performance indicator data, using an expert model. This includes: based on the time-domain features, frequency-domain features, and normalized performance indicator data corresponding to any indicator type, using the expert model corresponding to the any indicator type, predicting the probability of the device under test experiencing the abnormal event corresponding to the any indicator type; if the probability is greater than or equal to a third preset value, determining the anomaly detection result as the device under test having the abnormal event corresponding to the any indicator type; if the probability is less than the third preset value, determining the anomaly detection result as the device under test not having the abnormal event corresponding to the any indicator type.

[0078] The third preset value can be customized, and this application does not impose any restrictions on it.

[0079] Based on the time-domain features, frequency-domain features, and normalized performance index data corresponding to any index type, and using the expert model corresponding to any index type, the method for predicting the probability of an abnormal event corresponding to any index type occurring in the device under test can refer to the data processing methods of expert models in related technologies.

[0080] In this embodiment, when it is determined that the expert model corresponding to the performance index data of any index type is reliable and adapted to the performance index data, since the time domain features can reflect the statistical characteristics and changing trends of the corresponding performance index data in the time dimension, the frequency domain features can reflect the components and distribution of the corresponding performance index data in the frequency dimension, and the normalized performance index data are on the same comparable scale, based on the time domain features, frequency domain features, and normalized performance index data corresponding to any index type, the probability of the device under test experiencing an abnormal event corresponding to any index type can be predicted using the expert model corresponding to any index type. This can accurately determine the risk of the device under test having an abnormal event corresponding to any index type, thereby enabling accurate detection of device anomalies.

[0081] S18, generate alarm information.

[0082] In some embodiments of this application, alarm information can be used to indicate that an expert model is unqualified, that the performance index data corresponding to an unqualified expert model cannot be analyzed, and to adjust the unqualified expert model. The content of the alarm information can be customized, and this application does not impose any restrictions on it.

[0083] In this embodiment, an alarm message is generated when the expert model is unqualified, so that the user can take effective measures in a timely manner to adjust and optimize the unqualified expert model, thereby ensuring accurate testing of the device under test.

[0084] In other embodiments of this application, when an expert model is determined to be unqualified, the electronic device can adjust the parameters of the expert model to optimize its parameters. The optimized expert model can be added as a new expert model in a hybrid expert model or can replace the corresponding original expert model in the hybrid expert model. For example, LoRA technology can be used to adjust the unqualified expert model by introducing a low-rank matrix into the weight matrix of the unqualified expert model.

[0085] In the device anomaly detection method of this embodiment, the correlation weight reflects the correlation between performance index data, and the time decay weight reflects the impact of abnormal events occurring at different time points on the current state of the device under test. Therefore, by using the correlation weight and time decay weight, the attention weight of the performance index data is calculated using a self-attention mechanism, so that the attention weight can comprehensively reflect the importance, timeliness, and contribution of the performance index data to the current state of the device under test. Since the convergence index of the expert model is calculated through the corresponding performance evaluation data, each convergence index can reflect the performance and convergence degree of the corresponding expert model. Because each convergence index can reflect the performance and convergence degree of the corresponding expert model, and the attention weight can comprehensively reflect the importance, timeliness, and contribution of the performance index data to the current state of the device under test, the qualification of the corresponding expert model can be determined by using the attention weight of the performance index data and the convergence index of each expert model. This not only determines the expert model corresponding to each type of performance index data but also accurately and comprehensively evaluates the reliability and applicability of the expert model. Time-domain features reflect the statistical characteristics and trends of corresponding performance index data over time, while frequency-domain features reflect the composition and distribution of these data over frequency, ensuring that normalized performance index data are on a comparable scale. Therefore, when determining the competence of an expert model, based on time-domain features, frequency-domain features, and normalized performance index data, a qualified expert model can accurately determine the risk of abnormal events corresponding to the performance index data in the device under test, thereby enabling accurate detection of equipment anomalies.

[0086] For example, such as Figure 2 The diagram shown is a flowchart of a method for generating relevant weights according to an embodiment of this application, including the following steps: S121, perform correlation analysis on performance index data with the same index type to obtain the autocorrelation weights corresponding to each index type.

[0087] In some embodiments of this application, the performance index data for each index type may have a corresponding autocorrelation weight. The electronic device can count the number of performance index data for each index type, select a second preset number of performance index data that are consecutive in time from the performance index data for each index type, obtain multiple sets of performance index data, wherein the performance index data between the multiple sets of performance index data may partially overlap, perform multiplication or weighted multiplication on the multiple performance index data in each set of performance index data to obtain a first product, and perform addition or weighted addition on the first products of the multiple sets of performance index data to obtain a first sum. The ratio between the first sum and the number of index data is determined as the autocorrelation weight corresponding to each index type.

[0088] The second preset number of selected performance index data can be customized, and this application does not impose any restrictions on this. For example, the second preset number can be two.

[0089] The weights for weighted multiplication and weighted addition operations can be customized, and this application does not impose any restrictions on them.

[0090] In this embodiment, since autocorrelation weights can reflect the degree of correlation between performance indicator data of the same type, performing correlation analysis on performance indicator data of the same type to obtain the autocorrelation weights corresponding to each indicator type can determine the stability of the performance indicator data of that type, thereby facilitating the determination of whether the device under test (DUT) is abnormal. For example, if the autocorrelation weight of a performance indicator data of a certain type is high, it may indicate that the performance indicator data is more stable, and the risk of abnormality in the structure (e.g., CPU or RAM) corresponding to that performance indicator data in the DUT is lower. Conversely, if the autocorrelation weight of a performance indicator data of a certain type is low, it may indicate that the performance indicator data has large fluctuations or abnormalities, and the risk of abnormality in the structure corresponding to that performance indicator data in the DUT is higher.

[0091] S122, obtain the preset matrix. The elements in the preset matrix are used to indicate the correlation between indicator types.

[0092] In some embodiments of this application, the preset matrix can be customized. For example, to determine if a positive correlation exists between the analytical indicators, the elements representing a positive correlation in the preset matrix can be set to 1, and the other elements in the preset matrix can be set to 0. Conversely, to determine if a negative correlation exists between the analytical indicators, the elements representing a negative correlation can be set to -1, and the other elements in the preset matrix can be set to 0. The non-zero elements in the preset matrix (e.g., 1 and -1) can be distributed diagonally.

[0093] S123 generates an indicator data matrix based on performance indicator data of multiple indicator types.

[0094] In some embodiments of this application, each column / row of indicator data in the indicator data matrix corresponds to an indicator type.

[0095] For example, electronic devices can use performance indicator data with the same indicator type as column data to construct an indicator data matrix, so that each column of indicator data in the indicator data matrix corresponds to an indicator type.

[0096] S124. Based on the preset matrix and the indicator data matrix, perform correlation analysis on the performance indicator data of the multiple indicator types to obtain the cross-correlation weights between the correlated indicator types.

[0097] For example, the electronic device performs correlation analysis on the multiple indicator types based on a preset matrix and an indicator data matrix to obtain the cross-correlation weights between correlated indicator types. This includes executing a matrix filling process, which includes: generating an empty matrix according to the dimensions of the preset matrix; selecting a target indicator type from the multiple indicator types; filling the empty matrix with the performance indicator data corresponding to the target indicator type in the indicator data matrix to obtain an initial matrix; keeping the performance indicator data corresponding to the target indicator type unchanged in the initial matrix; cyclically selecting the performance indicator data corresponding to the indicator type to be filled in the initial matrix according to the number of rows or columns to be filled in the indicator data matrix; and filling the selected performance indicator data with the specified number of rows or columns to be filled in the initial matrix. The target data is filled into the initial matrix until all the performance index data corresponding to all index types in the index data matrix are selected, resulting in multiple target matrices corresponding to the target index types. The matrix filling process is repeated until all the multiple index types are selected as target index types, and then it stops, resulting in multiple target matrices corresponding to each index type. Each target matrix has multiple corresponding index types. Based on the preset matrix and each target matrix, the cross-correlation weights between the multiple index types corresponding to each target matrix are determined. If the cross-correlation weight corresponding to any target matrix is ​​greater than a preset threshold, it is determined that the multiple index types corresponding to any target matrix are correlated.

[0098] The number of columns in an empty matrix can be the same as the number of rows in a preset matrix, or vice versa. For example, if the dimension of the preset matrix is... The dimension of an empty matrix can be , , .

[0099] One of the multiple indicator types can be rotated to become the target indicator type. The indicator type selected from the multiple indicator types is not repeated each time.

[0100] The number of rows / columns to be filled can be the number of empty rows / columns. The preset threshold can be customized, and this application does not impose any restrictions on it.

[0101] For example, taking the analysis of the correlation between CPU performance metrics and other types of performance metrics as an example, if the CPU performance metrics correspond to the first column of a metrics data matrix, the data from the first column can be selected from the metrics data matrix and filled into the first column of the initial matrix. If there are three columns to be filled in the initial matrix, the performance metrics data from the second, third, and fourth columns can be selected from the metrics data matrix and filled into the second, third, and fourth columns of the initial matrix, obtaining the first target matrix. The electronic device can keep the first column of the initial matrix unchanged and select the performance metrics data from the third, fourth, and fifth columns from the metrics data matrix to fill into the second, third, and fourth columns of the initial matrix, obtaining the second target matrix. The electronic device can keep the first column of the initial matrix unchanged and select the performance metrics data from the fourth, fifth, and sixth columns from the metrics data matrix to fill into the second, third, and fourth columns of the initial matrix, obtaining the third target matrix. This process continues until all types of performance metrics data in the metrics data matrix have been selected, resulting in multiple target matrices corresponding to the CPU performance metrics. Repeat the matrix filling process described above until all indicator types have been selected as target indicator types, and then stop. This will yield multiple target matrices corresponding to the performance indicator data for each indicator type.

[0102] Electronic devices can calculate the cross-correlation weights between multiple indicator types corresponding to a given target matrix using various methods, based on a preset matrix and any target matrix. For example, the electronic device can multiply the preset matrix with corresponding elements in the target matrix to obtain a second product, then add or weightedly add multiple second products to obtain a second sum, and determine the second sum as the cross-correlation weights between the multiple indicator types corresponding to the target matrix. In this embodiment, by generating multiple target matrices corresponding to each indicator type, and determining the cross-correlation weights between the multiple indicator types corresponding to each target matrix based on a preset matrix and each target matrix, the correlation and degree of correlation between performance indicator data of multiple indicator types can be comprehensively analyzed. This allows for the identification of performance indicator data where data changes mutually influence each other. Since cross-correlation weights can reflect the degree of correlation between performance indicator data of different indicator types, performing correlation analysis on the performance indicator data of multiple indicator types to obtain the cross-correlation weights between correlated indicator types can reveal the potential correlation and influence between performance indicator data of multiple indicator types. This facilitates the comprehensive identification of anomalies in the device under test and the accurate determination of the root cause of the anomalies.

[0103] In some embodiments of this application, if any abnormal event is determined in the device under test, the electronic device can repair the device under test. For example, Figure 3 The diagram shown is a flowchart of a repair method for a device under test provided in an embodiment of this application, including the following steps: S21, Based on the repair strategy for any one abnormal event, generate a repair script for the any one abnormal event.

[0104] In some embodiments of this application, the repair strategy may include repair operations, description information of the repair operations, and configuration parameters.

[0105] For example, an electronic device can use repair strategies and repair scripts for multiple abnormal events as training samples to train a model, and input the repair strategy for any one of the abnormal events into the trained model to obtain a repair script for the any one of the abnormal events.

[0106] This application does not restrict the type of model. For example, the model can be a sequence-to-sequence (Seq2Seq) model or a generative adversarial network (GAN). The trained model can convert the repair policy into instructions and operations, thereby obtaining the repair script.

[0107] S22, determine the target confidence score for the repair script based on the preset initial confidence score and attention weight.

[0108] In some embodiments of this application, the initial confidence score can be customized, and this application does not impose any restrictions on it. For example, the initial confidence score can be 0.5.

[0109] In some embodiments of this application, the electronic device can perform a multiplication or weighted multiplication operation on the attention weights of the initial confidence score and the performance index data corresponding to the abnormal event to obtain the target confidence score. The weights used for the weighted multiplication operation can be customized.

[0110] In this embodiment, since attention weight can comprehensively reflect the importance, timeliness, and contribution of performance index data to the current state of the device under test, the target confidence score of the repair script can be calculated based on the attention weight, which can accurately quantify the repair script's reliability in repairing abnormal events.

[0111] S23, determine whether the target confidence score is greater than or equal to the fourth preset value.

[0112] In some embodiments of this application, the fourth preset value can be customized, and this application does not impose any limitations on it. By comparing the target confidence score with the fourth preset value, the reliability of the repair script can be accurately assessed.

[0113] In this embodiment, if the target confidence score is greater than or equal to the fourth preset value, step S24 is executed; if the target confidence score is greater than or equal to the fourth preset value, the process returns to step S21.

[0114] S24, repairs the device under test by executing a repair script.

[0115] In this embodiment, when the target information score is greater than or equal to the fourth preset value, it indicates that the repair script has high reliability. By executing the repair script to repair the device under test, the success rate of the repair of the device under test can be ensured.

[0116] In other embodiments of this application, the repair script can be tested at least once before execution, and the decision to execute the repair script can be based on the test results. For example, if the test results indicate that the repair script can successfully repair the anomaly, the initial confidence score can be increased to improve the probability that the repair script can be executed.

[0117] In this process, electronic devices can utilize artificial intelligence (AI) technology to generate a chain of thought (CoT) by analyzing information such as the repair script and the current state of the device under test. The chain of thought can be a series of logical inferences and judgments performed on the repair script before its execution. Through this chain of thought, the electronic device can determine whether the repair script has logical problems, such as whether the order of steps is reasonable, whether there are contradictory operations, and whether the state or limitations of the device under test have been considered.

[0118] For example, if the repair script contains instructions to delete a file, the electronic device can determine whether the target file exists and whether the user has permission to delete it. If the target file exists and the user has the permission to delete it, the electronic device can determine that the instruction to delete the file is valid.

[0119] For example, for each program or instruction in the repair script that may affect the state or data of the device under test (e.g., deletion, modification, configuration, and restart instructions), the electronic device can perform a confirmation process before execution. This confirmation process may include using AI to determine whether the state of the device under test allows the execution of the instruction, and evaluating the consequences of executing the instruction. After all instructions have passed the above confirmation process and been confirmed by the user, the electronic device can determine that the instruction is reasonable. For instance, if the repair script includes a capacity expansion instruction, the electronic device can determine whether the device under test includes spare resources and whether the specifications (e.g., capacity) of the spare resources meet the requirements of the capacity expansion instruction. If the specifications of the spare resources meet the requirements of the capacity expansion instruction, the electronic device can determine that the state of the device under test allows the execution of the capacity expansion instruction.

[0120] For example, if a repair script includes a query command, and the query command is only for obtaining information and does not affect the status or data of the device under test, then the execution of the query command does not need to be confirmed through the above-mentioned confirmation process. However, if the result of the query command is referenced by subsequent programs or commands, then the execution of the query command can be confirmed through the above-mentioned confirmation process.

[0121] In this embodiment, by testing the repair script, the safety, rationality, accuracy and feasibility of the repair script can be ensured, thereby reducing the damage or data loss caused to the device under test by the execution of the repair script.

[0122] In other embodiments, the electronic device can determine whether it has permission to automatically execute a repair script based on the severity level of the abnormal event. The severity level of each abnormal event can be customized. For example, the severity level can be high, medium, or low; a CPU-related abnormal event can have a high severity level, while an abnormal event related to a sensor monitoring room temperature can have a low severity level.

[0123] Repair scripts for exceptions with lower importance levels can be executed after user confirmation, while repair scripts for exceptions with higher importance levels can be executed automatically. For example, electronic devices can automatically execute repair scripts for exceptions with low or low-to-medium importance levels, while repair scripts for exceptions with high importance levels can be executed after user confirmation.

[0124] In this embodiment, once the electronic device confirms it has the necessary permissions and determines the repair script to be accurate and feasible through a thought process, it can execute the repair script. During execution, the electronic device can adjust and optimize the repair script based on real-time feedback from the device under test and changes in the device's status to ensure the repair effect.

[0125] like Figure 4 The diagram shown is a structural diagram of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 10 may include a communication module 101, a memory 102, a processor 103, an input / output (I / O) interface 104, and a bus 105. The processor 103 is coupled to the communication module 101, the memory 102, and the input / output interface 104 via the bus 105.

[0126] Communication module 101 may include a wired communication module and / or a wireless communication module. The wired communication module may provide one or more wired communication solutions such as Universal Serial Bus (USB) and Controller Area Network (CAN). The wireless communication module may provide one or more wireless communication solutions such as Wireless Fidelity, Bluetooth, mobile communication networks, frequency modulation (FM), near field communication (NFC), and infrared (IR).

[0127] Memory 102 may include one or more random access memory (RAM) and one or more non-volatile memory (NVM). The RAM can be directly read and written by the processor 103, and can be used to store executable programs (e.g., machine instructions) of other running programs, as well as user and application data. The RAM may include static random-access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), etc.

[0128] Non-volatile memory can also store executable programs and user and application data, and can be pre-loaded into random access memory for direct reading and writing by the processor 103. Non-volatile memory can include disk storage devices and flash memory.

[0129] The memory 102 is used to store one or more computer programs. The one or more computer programs are configured to be executed by the processor 103. The one or more computer programs include multiple instructions that, when executed by the processor 103, can implement a device anomaly detection method executed on the electronic device 10.

[0130] In other embodiments, such as Figure 4 The electronic device 10 shown also includes an external memory interface for connecting to an external memory to expand the storage capacity of the electronic device 10.

[0131] Processor 103 may include one or more processing units, such as application processors (APs), modem processors, graphics processing units (GPUs), image signal processors (ISPs), controllers, video codecs, digital signal processors (DSPs), and / or neural network processing units (NPUs). These different processing units may be independent devices or integrated into one or more processors.

[0132] The processor 103 provides computing and control capabilities. For example, the processor 103 is used to execute computer programs stored in the memory 102 to implement the device anomaly detection method described above.

[0133] The input / output interface 104 is used to provide a channel for user input or output. For example, the input / output interface 104 can be used to connect various input / output devices, such as a mouse, keyboard, touch device, display screen, etc., so that users can enter information or visualize information.

[0134] Bus 105 is used at least to provide a channel for communication between communication modules 101, memory 102, processor 103, and input / output interface 104 in electronic device 10.

[0135] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 10. In other embodiments of this application, the electronic device 10 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0136] This application also provides a computer-readable storage medium storing a computer program, which includes program instructions. When the program instructions are executed, the method implemented can refer to the methods in the above embodiments of this application.

[0137] The computer-readable storage medium can be the internal memory of the electronic device described in the above embodiments, such as a hard disk or memory of the electronic device. Alternatively, the computer-readable storage medium can be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the electronic device.

[0138] In some embodiments, a computer-readable storage medium may include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function, etc.; and the stored data area may store data created based on the use of the electronic device, etc.

[0139] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0140] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0141] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting equipment malfunctions, characterized in that, The method includes: If an anomaly is detected in the performance index data of the device under test, a correlation analysis is performed on the performance index data to obtain the relevant weights; Determine the frequency of occurrence of abnormal events corresponding to the performance index data within a preset historical time period, and determine the target time point from the occurrence time points of abnormal events occurring within the historical time period based on the preset time point; The time decay weight of the abnormal event is determined based on the preset time point, the target time point, and the occurrence frequency; Based on the relevant weights and the time decay weights, a self-attention mechanism is used to perform self-attention analysis on the performance index data and the historical index data of the abnormal events to obtain the attention weights of the performance index data. Based on the performance evaluation data of the expert model corresponding to the performance index data, the convergence index of the expert model is determined; If the expert model is deemed qualified based on the attention weights and the convergence index, the abnormality detection result of the device under test is obtained using the expert model based on the time-domain features, frequency-domain features, and normalized performance index data corresponding to the performance index data.

2. The equipment anomaly detection method according to claim 1, characterized in that, The performance index data corresponds to multiple index types, and the correlation weights include autocorrelation weights and cross-correlation weights. The process of performing correlation analysis on the performance index data to obtain the correlation weights includes: Perform correlation analysis on performance index data with the same index type to obtain the autocorrelation weights corresponding to each index type; Obtain a preset matrix, the elements of which are used to indicate the correlation between indicator types; Based on the performance index data of the multiple index types, an index data matrix is ​​generated, wherein each column / row of index data in the index data matrix corresponds to an index type. Based on the preset matrix and the indicator data matrix, a correlation analysis is performed on the multiple indicator types to obtain the cross-correlation weights between the correlated indicator types.

3. The equipment anomaly detection method according to claim 2, characterized in that, The step of performing correlation analysis on the multiple indicator types based on the preset matrix and the indicator data matrix to obtain the cross-correlation weights between the correlated indicator types includes: The matrix filling process includes: Generate an empty matrix based on the dimensions of the preset matrix; Select a target indicator type from the plurality of indicator types, and fill the empty matrix with the performance indicator data corresponding to the target indicator type in the indicator data matrix to obtain an initial matrix; In the initial matrix, the performance index data corresponding to the target index type is kept unchanged. From the index data matrix, the performance index data corresponding to the index type with the number of rows or columns to be filled in the initial matrix is ​​selected in a loop, and the selected performance index data is filled into the initial matrix until the performance index data corresponding to all index types in the index data matrix has been selected, thereby obtaining multiple target matrices corresponding to the target index type. Repeat the matrix filling process until all of the multiple indicator types are selected as target indicator types, and then stop to obtain multiple target matrices corresponding to each indicator type, wherein each target matrix has multiple corresponding indicator types. Based on the preset matrix and each target matrix, determine the cross-correlation weights among multiple indicator types corresponding to each target matrix; If the cross-correlation weight corresponding to any target matrix is ​​greater than a preset threshold, it is determined that the multiple indicator types corresponding to the target matrix are correlated.

4. The equipment anomaly detection method according to claim 2, characterized in that, The performance metric data for each metric type has a corresponding expert model, and the method further includes: If the convergence index of the expert model corresponding to any index type is greater than or equal to the first preset value, and the attention weight corresponding to the performance index data of any index type is greater than or equal to the second preset value, the expert model corresponding to any index type is determined to be qualified. If the convergence index of the expert model corresponding to any of the index types is less than the first preset value, the expert model corresponding to any of the index types is determined to be unqualified, and an alarm message is generated.

5. The equipment anomaly detection method according to claim 2, characterized in that, Each indicator type has corresponding time-domain features, frequency-domain features, and normalized performance indicator data. Each indicator type also has corresponding abnormal events. The process of obtaining the anomaly detection results of the device under test using the expert model based on the time-domain features, frequency-domain features, and normalized performance indicator data includes: Based on the time-domain features, frequency-domain features, and normalized performance index data corresponding to any index type, the probability of the device under test experiencing an abnormal event corresponding to any index type is predicted using the expert model corresponding to that index type. If the probability is greater than or equal to the third preset value, the anomaly detection result is determined to be that the device under test has an anomaly event corresponding to any of the index types. If the probability is less than the third preset value, the anomaly detection result is determined to be that the device under test does not have an anomaly event corresponding to any of the indicator types.

6. The equipment anomaly detection method according to claim 5, characterized in that, If it is determined that any abnormal event exists in the device under test, the method further includes: Based on the repair strategy for any one of the abnormal events, generate a repair script for any one of the abnormal events; Based on the preset initial confidence score and the attention weight, the target confidence score for the repair script is determined; If the target confidence score is greater than or equal to the fourth preset value, the device under test is repaired by executing the repair script.

7. The equipment anomaly detection method according to claim 1, characterized in that, The determination of the time decay weight of the abnormal event based on the preset time point, the target time point, and the occurrence frequency includes: Determine the time interval between the preset time point and the target time point; The time decay factor of the abnormal event is obtained by calculating the preset decay coefficient and the time interval using the first preset function; The time decay weight of the abnormal event is determined based on the occurrence frequency and the time decay factor.

8. The equipment anomaly detection method according to claim 1 or 7, characterized in that, The step of performing self-attention analysis on the performance index data and the historical index data of the abnormal events based on the relevant weights and the time decay weights, and obtaining the attention weights of the performance index data, includes: The performance metric data is converted into a query vector using the self-attention mechanism, and the historical metric data is converted into a key vector using the self-attention mechanism. The attention weight is determined based on the query vector, the key vector, the relevance weight, and the time decay weight.

9. The equipment anomaly detection method according to claim 1, characterized in that, The performance evaluation data includes precision data and recall data. The process of determining the convergence metric of the expert model based on the performance evaluation data of the expert model corresponding to the performance metric data includes: Based on the precision and recall data, determine the harmonic mean of the expert model; The target value is determined based on the first preset value and the harmonic mean. The convergence index is obtained by performing calculations on the second preset value and the target value using the second preset function.

10. An electronic device, characterized in that, The electronic device includes: processor; The memory; and the application program, wherein the application program is stored in the memory and configured to be executed by the processor to implement the device anomaly detection method as described in any one of claims 1 to 9.

Images