Method and system for monitoring computing power risk based on cross-source fusion computing power data

Abstract

The application discloses a kind of based on cross source fusion computing power data computing power risk monitoring method and system, the method includes: obtaining multiple monitoring dimensions computing power running data sent by multiple computing power systems;Based on identification algorithm, identify the abnormal event data in the computing power running data;According to the event parameters corresponding to the abnormal event data and the system data of the computing power system, an abnormal prediction model is trained;The real-time computing power running data of any computing power system is input into the abnormal prediction model to obtain the output risk monitoring information.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for monitoring computing power risks based on cross-source fusion computing power data. Background Technology

[0002] With the rapid growth in the scale and complexity of distributed computing systems, enterprises and data centers are increasingly focusing on improving system reliability and fault early warning capabilities through accurate anomaly prediction. Among these challenges, how to achieve real-time risk monitoring to reduce the risk of system crashes has become a key technical issue. Existing technologies typically collect limited monitoring data from a single computing system and use fixed threshold analysis or simple statistical methods to identify abnormal events to support basic system maintenance. However, existing solutions lack comprehensive anomaly identification based on multi-dimensional data from multiple computing systems, fusion training of event parameters and system data, and dynamic model input and output of real-time operational data. This makes it difficult to build accurate anomaly prediction models and generate timely risk monitoring information, resulting in insufficient accuracy and real-time performance of fault warnings. Failure to identify anomalies in a timely manner can easily lead to system crashes or resource interruptions, limiting the stability and overall operational efficiency of the computing system. Therefore, existing technologies have shortcomings that urgently need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a computing power risk monitoring method and system based on cross-source fusion computing power data, which can realize the construction of accurate anomaly prediction model and risk monitoring based on multi-dimensional data anomaly identification, improve the accuracy and real-time performance of computing power system fault early warning, and reduce the risk of system collapse caused by the failure to identify abnormal events in time.

[0004] To address the aforementioned technical problems, the first aspect of this invention discloses a method for monitoring computing power risks based on cross-source fused computing power data, the method comprising: Acquire computing power operation data from multiple monitoring dimensions sent by multiple computing power systems; Based on the identification algorithm, abnormal event data in the computing power operation data is identified; An anomaly prediction model is trained based on the event parameters corresponding to the abnormal event data and the system data of the computing power system. Input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the output risk monitoring information.

[0005] As an optional implementation, in the first aspect of the present invention, the computing power system is a computing power server, a partition of the computing power server, a computing power allocation platform, a computing power provider platform, or a user terminal for computing power management personnel.

[0006] As an optional implementation, in the first aspect of the present invention, the computing power operation data of the multiple monitoring dimensions includes at least one of active monitoring data, passive rule-triggered data, software monitoring data, hardware sensing data, network monitoring data, or sensing data of the local area.

[0007] As an optional implementation, in the first aspect of the present invention, the step of identifying abnormal event data in the computing power operation data based on the identification algorithm includes: For each data segment in each of the aforementioned computing power operation data, the data segment is input into the anomaly keyword recognition model to obtain the anomaly keyword recognition result corresponding to the data segment; the anomaly keyword recognition model has multiple anomaly-related key character regular expressions built in; When the abnormal keyword identification result indicates the presence of abnormal keywords, the data portion is determined to be abnormal time data; When the abnormal keyword identification result is no abnormal keyword, the system determines whether the data part is abnormal event data based on multiple data parts associated with the data part.

[0008] As an optional implementation, in the first aspect of the invention, determining whether a data portion is abnormal event data based on multiple data portions associated with the data portion includes: Multiple associated data segments corresponding to the data segment are determined from the computing power operation data; the time difference between the data occurrence time of the associated data segment and the data occurrence time of the data segment is less than a time difference threshold; the data similarity between the associated data segment and the data segment is less than a preset first similarity threshold; Calculate the intersection of the abnormal keyword identification results corresponding to all the associated data parts to obtain the reference keyword set; From all the data in this data section, identify similar data that are similar to the reference keyword set; the average data similarity between the similar data and each keyword in the reference keyword set is greater than a preset second similarity threshold; When the sum of all the similar data exceeds a preset data volume threshold, the data portion is determined to be abnormal time data.

[0009] As an optional implementation, in the first aspect of the present invention, training an anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system includes: For each of the aforementioned abnormal event data, the abnormal event data is vectorized based on a preset vectorization rule to obtain an abnormal event vector; Obtain the event parameters corresponding to the abnormal event data; the event parameters include the event time and event-related data parameters. Determine the time period associated with the event time; Obtain the system operation data of the computing power system corresponding to the abnormal event data during the time period; The event parameters and the system operating data are determined as the basic event annotations corresponding to the abnormal event data; All the basic annotations of the events and the corresponding abnormal event vectors are input into the basic prediction model for training until convergence, so as to obtain the abnormal prediction model.

[0010] As an optional implementation, in the first aspect of the present invention, the step of vectorizing the abnormal event data based on a preset vectorization rule to obtain an abnormal event vector includes: The abnormal keyword identification results or all similar data corresponding to the abnormal event data are input into the trained dimension prediction model to obtain the vector dimension corresponding to the abnormal event data. Based on the vector dimension, determine the corresponding vectorized network; The abnormal event data is input into the vectorization network to obtain the abnormal event vector corresponding to the abnormal event data.

[0011] As an optional implementation, in the first aspect of the present invention, the step of inputting real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain output risk monitoring information includes: Input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the corresponding predicted anomaly events and anomaly probabilities. Based on the predicted abnormal events, all the computing power systems are clustered to obtain a set of similar systems; the event similarity between the predicted abnormal events of any two computing power systems in the set of similar systems is greater than a preset third similarity threshold. Calculate the average of the anomaly probabilities of all computing power systems in the set of similar systems to obtain the probability parameters; Calculate the average positional distance between each pair of computing power systems in the set of similar systems to obtain the proximity parameter; The product of the probability parameter and the proximity parameter is calculated to obtain the risk parameter; the risk parameter is used to characterize the probability that there are abnormal events in the computing power community where at least two of the computing power systems are located.

[0012] A second aspect of this invention discloses a computing power risk monitoring system based on cross-source fusion computing power data, the system comprising: The acquisition module is used to acquire computing power operation data from multiple monitoring dimensions sent by multiple computing power systems; The identification module is used to identify abnormal event data in the computing power operation data based on the identification algorithm; The training module is used to train an anomaly prediction model based on the event parameters corresponding to the abnormal event data and the system data of the computing power system. The monitoring module is used to input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the output risk monitoring information.

[0013] As an optional implementation, in the second aspect of the present invention, the computing power system is a computing power server, a partition of the computing power server, a computing power allocation platform, a computing power provider platform, or a user terminal for computing power management personnel.

[0014] As an optional implementation, in the second aspect of the present invention, the computing power operation data of the multiple monitoring dimensions includes at least one of active monitoring data, passive rule-triggered data, software monitoring data, hardware sensing data, network monitoring data, or sensing data of the local area.

[0015] As an optional implementation, in a second aspect of the present invention, the specific method by which the identification module identifies abnormal event data in the computing power operation data based on an identification algorithm includes: For each data segment in each of the aforementioned computing power operation data, the data segment is input into the anomaly keyword recognition model to obtain the anomaly keyword recognition result corresponding to the data segment; the anomaly keyword recognition model has multiple anomaly-related key character regular expressions built in; When the abnormal keyword identification result indicates the presence of abnormal keywords, the data portion is determined to be abnormal time data; When the abnormal keyword identification result is no abnormal keyword, the system determines whether the data part is abnormal event data based on multiple data parts associated with the data part.

[0016] As an optional implementation, in a second aspect of the invention, the specific method by which the identification module determines whether a data portion is abnormal event data based on multiple data portions associated with the data portion includes: Multiple associated data segments corresponding to the data segment are determined from the computing power operation data; the time difference between the data occurrence time of the associated data segment and the data occurrence time of the data segment is less than a time difference threshold; the data similarity between the associated data segment and the data segment is less than a preset first similarity threshold; Calculate the intersection of the abnormal keyword identification results corresponding to all the associated data parts to obtain the reference keyword set; From all the data in this data section, identify similar data that are similar to the reference keyword set; the average data similarity between the similar data and each keyword in the reference keyword set is greater than a preset second similarity threshold; When the sum of all the similar data exceeds a preset data volume threshold, the data portion is determined to be abnormal time data.

[0017] As an optional implementation, in the second aspect of the present invention, the specific method by which the training module trains the anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system includes: For each of the aforementioned abnormal event data, the abnormal event data is vectorized based on a preset vectorization rule to obtain an abnormal event vector; Obtain the event parameters corresponding to the abnormal event data; the event parameters include the event time and event-related data parameters. Determine the time period associated with the event time; Obtain the system operation data of the computing power system corresponding to the abnormal event data during the time period; The event parameters and the system operating data are determined as the basic event annotations corresponding to the abnormal event data; All the basic annotations of the events and the corresponding abnormal event vectors are input into the basic prediction model for training until convergence, so as to obtain the abnormal prediction model.

[0018] As an optional implementation, in a second aspect of the present invention, the specific method by which the training module vectorizes the abnormal event data based on a preset vectorization rule to obtain an abnormal event vector includes: The abnormal keyword identification results or all similar data corresponding to the abnormal event data are input into the trained dimension prediction model to obtain the vector dimension corresponding to the abnormal event data. Based on the vector dimension, determine the corresponding vectorized network; The abnormal event data is input into the vectorization network to obtain the abnormal event vector corresponding to the abnormal event data.

[0019] As an optional implementation, in a second aspect of the invention, the specific method by which the monitoring module inputs real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the output risk monitoring information includes: Input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the corresponding predicted anomaly events and anomaly probabilities. Based on the predicted abnormal events, all the computing power systems are clustered to obtain a set of similar systems; the event similarity between the predicted abnormal events of any two computing power systems in the set of similar systems is greater than a preset third similarity threshold. Calculate the average of the anomaly probabilities of all computing power systems in the set of similar systems to obtain the probability parameters; Calculate the average positional distance between each pair of computing power systems in the set of similar systems to obtain the proximity parameter; The product of the probability parameter and the proximity parameter is calculated to obtain the risk parameter; the risk parameter is used to characterize the probability that there are abnormal events in the computing power community where at least two of the computing power systems are located.

[0020] A third aspect of this invention discloses another computing power risk monitoring system based on cross-source fusion computing power data, the system comprising: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute some or all of the steps in the computing power risk monitoring method based on cross-source fused computing power data disclosed in the first aspect of the present invention.

[0021] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the computing power risk monitoring method based on cross-source fusion computing power data disclosed in the first aspect of the present invention.

[0022] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: This invention acquires computing power operation data from multiple monitoring dimensions of multiple computing power systems and identifies abnormal event data based on an identification algorithm. It then trains an anomaly prediction model by combining event parameters and system data. Real-time computing power operation data is input into the model to output risk monitoring information. This enables the construction of an accurate anomaly prediction model and risk monitoring based on multi-dimensional data anomaly identification, improving the accuracy and real-time performance of computing power system fault warnings and reducing the risk of system crashes caused by the failure to identify abnormal events in a timely manner. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1This is a flowchart illustrating a computing power risk monitoring method based on cross-source fusion computing power data disclosed in an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram of the structure of a computing power risk monitoring system based on cross-source fusion computing power data disclosed in an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of another computing power risk monitoring system based on cross-source fusion computing power data disclosed in an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0029] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0030] This invention discloses a computing power risk monitoring method and system based on cross-source fusion computing power data. It acquires computing power operation data from multiple monitoring dimensions of multiple computing power systems and identifies abnormal event data based on an identification algorithm. By combining event parameters and system data to train an anomaly prediction model, and inputting real-time computing power operation data into the model, it outputs risk monitoring information. This enables the construction of an accurate anomaly prediction model and risk monitoring based on multi-dimensional data anomaly identification, improving the accuracy and real-time performance of computing power system fault warnings and reducing the risk of system crashes due to untimely identification of abnormal events. Detailed explanations follow.

[0031] Example 1 Please see Figure 1 , Figure 1 This is a flowchart illustrating a computing power risk monitoring method based on cross-source fused computing power data, as disclosed in an embodiment of the present invention. Figure 1 The described computing power risk monitoring method based on cross-source fusion computing power data can be applied to data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 1 As shown, the computing power risk monitoring method based on cross-source fusion computing power data can include the following operations: 101. Obtain computing power operation data from multiple monitoring dimensions sent by multiple computing power systems.

[0032] Optionally, the computing power system may be a computing power server, a partition of the computing power server, a computing power allocation platform, a computing power provider platform, or a user terminal for computing power administrators.

[0033] Optionally, the computing power operation data from multiple monitoring dimensions may include at least one of the following: active monitoring data, passive rule-triggered data, software monitoring data, hardware sensor data, network monitoring data, or sensor data from the area in which the data is located.

[0034] Optionally, these multiple monitoring dimensions may include compute node load, CPU temperature, memory usage, network bandwidth usage, or power supply voltage fluctuations; this invention does not limit these dimensions.

[0035] 102. Based on the identification algorithm, identify abnormal event data in the computing power operation data.

[0036] Optionally, the abnormal event data can be a temperature exceeding the standard event, a network congestion event, or a calculation error event; this invention does not limit such events.

[0037] 103. Based on the event parameters corresponding to the abnormal event data and the system data of the computing power system, an anomaly prediction model is trained.

[0038] Optionally, the event parameters may include the event occurrence time, duration, and scope of impact. The system data may include system configuration and historical load averages, which are not limited in this invention.

[0039] 104. Input the real-time computing power operation data of any computing power system into the anomaly prediction model to obtain the output risk monitoring information.

[0040] Optionally, the risk monitoring information may include predicted anomaly probability, anomaly type, or impact assessment, which is not limited in this invention.

[0041] As can be seen, the above-mentioned embodiments of the invention acquire computing power operation data from multiple monitoring dimensions of multiple computing power systems and identify abnormal event data based on identification algorithms. By combining event parameters and system data to train an anomaly prediction model, and inputting real-time computing power operation data into the model to output risk monitoring information, it is possible to realize the construction of an accurate anomaly prediction model and risk monitoring based on multi-dimensional data anomaly identification, improve the accuracy and real-time performance of computing power system fault warning, and reduce the risk of system collapse caused by failure to identify abnormal events in a timely manner.

[0042] As an optional embodiment, the step above, identifying abnormal event data in the computing power operation data based on the identification algorithm, includes: For each data segment in the computing power operation data, the data segment is input into the abnormal keyword recognition model to obtain the abnormal keyword recognition result corresponding to the data segment; When the abnormal keyword identification result indicates the presence of abnormal keywords, the data portion is determined to be abnormal time data; When the abnormal keyword identification result is no abnormal keyword, it is determined whether the data part is abnormal event data based on multiple data parts associated with the data part.

[0043] Optionally, the anomaly keyword recognition model has several built-in regular expressions for key characters related to anomalies.

[0044] Optionally, the key character regular expression can match keywords such as "overload", "fault", "interruption" or corresponding event characters, which is not limited in this invention.

[0045] Optionally, the associated data portion can be log segments that are close in time or related in content; this invention does not impose any limitations.

[0046] As can be seen, through the above optional embodiments, by inputting the computing power operation data into the abnormal keyword recognition model to obtain abnormal keyword results, the abnormal event data is determined when the keyword exists, and the abnormal event is judged based on the associated data when the keyword is not present. This achieves accurate abnormal event recognition based on keyword regularization and association analysis, improves the comprehensiveness and reliability of data anomaly detection, and reduces the risk of anomaly omission due to missing keywords.

[0047] As an optional embodiment, the step described above, determining whether a data portion is abnormal event data based on multiple data portions associated with that data portion, includes: From the computing power operation data, identify multiple related data segments corresponding to this data segment; Calculate the intersection of the abnormal keyword identification results corresponding to all related data parts to obtain the reference keyword set; Identify similar data from all data in this data section that are similar to the reference keyword set; When the sum of all similar data exceeds a preset data volume threshold, that portion of data is identified as abnormal time data.

[0048] Optionally, the time difference between the occurrence time of the associated data portion and the occurrence time of the data portion is less than a time difference threshold.

[0049] Optionally, the data similarity between the associated data part and the data part is less than a preset first similarity threshold.

[0050] Optionally, the average data similarity of each keyword in the similar data and reference keyword set is greater than a preset second similarity threshold.

[0051] As can be seen, through the above optional embodiments, by filtering the associated data portion and calculating the intersection of abnormal keywords as a reference set, similar data is extracted from the data portion. When the sum of similar data exceeds the threshold, it is determined as abnormal event data, realizing accurate associated anomaly extraction based on time and similarity constraints, improving the accuracy and context relevance of anomaly event judgment, and reducing the risk of misjudgment of anomalies due to inaccurate association.

[0052] As an optional embodiment, the step above, training an anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system, includes: For each abnormal event data, the abnormal event data is vectorized based on a preset vectorization rule to obtain an abnormal event vector; Retrieve the event parameters corresponding to the abnormal event data; Determine the time period related to the event time; Obtain the system operation data of the computing power system corresponding to the abnormal event data within the time period; The event parameters and system operating data are determined as the basic event annotations corresponding to the abnormal event data; All event base labels and corresponding abnormal event vectors are input into the base prediction model for training until convergence, in order to obtain the abnormal prediction model.

[0053] Optionally, the vectorization rule can be a vector representation based on the inverse document frequency of the term frequency, which is not limited in this invention.

[0054] Optionally, event parameters include event time and event-related data parameters.

[0055] Optionally, the event-related data parameters can be the number of affected nodes or the amount of data loss; this invention does not impose any limitations.

[0056] Optionally, the time period can be one hour before or after the event; this invention does not limit this period.

[0057] Optionally, the system's operating data can be a load curve or temperature change; this invention does not limit the data.

[0058] Optionally, the basic prediction model can be a five-layer fully connected neural network, with 512 neurons in the first layer, 256 neurons in the second layer, 128 neurons in the third layer, 64 neurons in the fourth layer, and the fifth layer outputting the abnormal event and the abnormal probability. The mean squared error loss function is used, and it is trained on 150,000 labeled data for 120 training epochs. This invention does not limit the scope of the model.

[0059] As can be seen, through the above optional embodiments, abnormal event vectors are obtained by pre-vectorizing abnormal event data, and an abnormal prediction model is obtained by combining event parameters and time period system working data as the basic annotation input for the basic prediction model training. This achieves accurate abnormal model training based on vector and annotation fusion, improves the model's predictive ability and generalization of abnormal events, and reduces the risk of model training bias caused by incomplete annotation.

[0060] As an optional embodiment, the step above, vectorizing the abnormal event data based on a preset vectorization rule to obtain an abnormal event vector, includes: The abnormal keyword identification results or all similar data corresponding to the abnormal event data are input into the trained dimension prediction model to obtain the vector dimension corresponding to the abnormal event data. Determine the corresponding vectorized network based on the vector dimension; The abnormal event data is input into a vectorization network to obtain the abnormal event vector corresponding to the abnormal event data.

[0061] Optionally, the dimension prediction model can be a three-layer fully connected neural network, with 128 neurons in the first layer, 64 neurons in the second layer, and the third layer outputting the dimension value. This invention does not impose any limitations on this model.

[0062] Optionally, the vectorized network can be a dynamically dimensional embedding network, which is not limited in this invention.

[0063] As can be seen, through the above optional embodiments, by inputting the abnormal keywords or similar data of abnormal event data into the dimension prediction model to determine the vector dimension and selecting a vectorization network to vectorize to obtain the abnormal event vector, dynamic dimension adaptive vectorization based on abnormal keywords is achieved, which improves the accuracy and adaptability of vector representation and reduces the risk of vector distortion caused by fixed dimensions.

[0064] As an optional embodiment, the step described above, inputting real-time computing power operation data of any computing power system into the anomaly prediction model to obtain output risk monitoring information, includes: Input the real-time computing power operation data of any computing power system into the anomaly prediction model to obtain the corresponding predicted anomaly events and anomaly probabilities. Clustering of all computing power systems based on predicted abnormal events yields a set of similar systems. Calculate the average anomaly probability of all computing power systems in the similar system set to obtain the probability parameter; Calculate the average positional distance between each pair of computing power systems in a set of similar systems to obtain the proximity parameter; The product of the probability parameter and the proximity parameter is calculated to obtain the risk parameter; the risk parameter is used to characterize the probability of an abnormal event existing in the computing power community where at least two computing power systems are located.

[0065] Optionally, the event similarity between predicted anomalies of any two computing power systems in the similar system set is greater than a preset third similarity threshold.

[0066] Optionally, the clustering can be performed using the K-means algorithm, which is not limited in this invention.

[0067] Optionally, the location distance can be a physical distance or a network hop count; this invention does not limit this.

[0068] As can be seen, through the above optional embodiments, by inputting real-time computing power operation data into the anomaly prediction model to output predicted abnormal events and probabilities, and obtaining a set of similar systems based on event similarity clustering, the product of the probability average and the location distance average is calculated as a risk parameter, thereby achieving accurate risk quantification assessment based on clustering and multidimensional averaging, improving the early warning capability of the possibility of anomalies in the computing power community, and reducing the risk of underestimating the community risk caused by isolated system analysis.

[0069] Example 2 Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a computing power risk monitoring system based on cross-source fused computing power data, as disclosed in an embodiment of the present invention. Figure 2 The described computing power risk monitoring system based on cross-source fusion computing power data can be applied to data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 2 As shown, the computing power risk monitoring system based on cross-source fusion computing power data may include: The acquisition module 201 is used to acquire computing power operation data from multiple monitoring dimensions sent by multiple computing power systems.

[0070] The identification module 202 is used to identify abnormal event data in the computing power operation data based on the identification algorithm.

[0071] Training module 203 is used to train an anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system.

[0072] The monitoring module 204 is used to input the real-time computing power operation data of any computing power system into the anomaly prediction model in order to obtain the output risk monitoring information.

[0073] As can be seen, the above-mentioned embodiments of the invention acquire computing power operation data from multiple monitoring dimensions of multiple computing power systems and identify abnormal event data based on identification algorithms. By combining event parameters and system data to train an anomaly prediction model, and inputting real-time computing power operation data into the model to output risk monitoring information, it is possible to realize the construction of an accurate anomaly prediction model and risk monitoring based on multi-dimensional data anomaly identification, improve the accuracy and real-time performance of computing power system fault warning, and reduce the risk of system collapse caused by failure to identify abnormal events in a timely manner.

[0074] As an optional embodiment, the computing power system is a computing power server, a partition of the computing power server, a computing power allocation platform, a computing power provider platform, or a user terminal for computing power administrators.

[0075] As can be seen, the above optional embodiments limit the types of computing power systems, enabling this solution to be applied to risk monitoring of various computing power systems, helping to improve the accuracy and real-time performance of computing power system fault warnings, and reducing the risk of system crashes caused by failure to identify abnormal events in a timely manner.

[0076] As an optional embodiment, the computing power operation data of multiple monitoring dimensions includes at least one of active monitoring data, passive rule-triggered data, software monitoring data, hardware sensor data, network monitoring data, or sensor data of the local area.

[0077] As can be seen, the above optional embodiments limit the monitoring dimension types of computing power operation data, so as to comprehensively and accurately characterize the operation characteristics of the computing power system, help improve the accuracy and real-time performance of computing power system fault early warning, and reduce the risk of system crash due to failure to identify abnormal events in a timely manner.

[0078] As an optional embodiment, the identification module identifies the specific methods by which it identifies abnormal event data in the computing power operation data based on the identification algorithm, including: For each data segment in the computing power operation data, the data segment is input into the anomaly keyword recognition model to obtain the anomaly keyword recognition result corresponding to the data segment; optionally, the anomaly keyword recognition model has multiple anomaly-related key character regular expressions built in; When the abnormal keyword identification result indicates the presence of abnormal keywords, the data portion is determined to be abnormal time data; When the abnormal keyword identification result is no abnormal keyword, it is determined whether the data part is abnormal event data based on multiple data parts associated with the data part.

[0079] As can be seen, through the above optional embodiments, by inputting the computing power operation data into the abnormal keyword recognition model to obtain abnormal keyword results, the abnormal event data is determined when the keyword exists, and the abnormal event is judged based on the associated data when the keyword is not present. This achieves accurate abnormal event recognition based on keyword regularization and association analysis, improves the comprehensiveness and reliability of data anomaly detection, and reduces the risk of anomaly omission due to missing keywords.

[0080] As an optional embodiment, the identification module determines whether a data portion is abnormal event data based on multiple data portions associated with that data portion in a specific way, including: Multiple associated data segments corresponding to the data segment are determined from the computing power operation data; optionally, the time difference between the data occurrence time of the associated data segment and the data occurrence time of the data segment is less than a time difference threshold; the data similarity between the associated data segment and the data segment is less than a preset first similarity threshold; Calculate the intersection of the abnormal keyword identification results corresponding to all related data parts to obtain the reference keyword set; Identify similar data from all data in this data section that are similar to the reference keyword set; optionally, the average data similarity between the similar data and each keyword in the reference keyword set is greater than a preset second similarity threshold. When the sum of all similar data exceeds a preset data volume threshold, that portion of data is identified as abnormal time data.

[0081] As can be seen, through the above optional embodiments, by filtering the associated data portion and calculating the intersection of abnormal keywords as a reference set, similar data is extracted from the data portion. When the sum of similar data exceeds the threshold, it is determined as abnormal event data, realizing accurate associated anomaly extraction based on time and similarity constraints, improving the accuracy and context relevance of anomaly event judgment, and reducing the risk of misjudgment of anomalies due to inaccurate association.

[0082] As an optional implementation, the training module trains the anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system in the following specific ways: For each abnormal event data, the abnormal event data is vectorized based on a preset vectorization rule to obtain an abnormal event vector; Retrieve the event parameters corresponding to the abnormal event data; optionally, the event parameters include the event time and event-related data parameters. Determine the time period related to the event time; Obtain the system operation data of the computing power system corresponding to the abnormal event data within the time period; The event parameters and system operating data are determined as the basic event annotations corresponding to the abnormal event data; All event base labels and corresponding abnormal event vectors are input into the base prediction model for training until convergence, in order to obtain the abnormal prediction model.

[0083] As can be seen, through the above optional embodiments, abnormal event vectors are obtained by pre-vectorizing abnormal event data, and an abnormal prediction model is obtained by combining event parameters and time period system working data as the basic annotation input for the basic prediction model training. This achieves accurate abnormal model training based on vector and annotation fusion, improves the model's predictive ability and generalization of abnormal events, and reduces the risk of model training bias caused by incomplete annotation.

[0084] As an optional embodiment, the training module vectorizes the abnormal event data based on preset vectorization rules to obtain abnormal event vectors in the following specific ways: The abnormal keyword identification results or all similar data corresponding to the abnormal event data are input into the trained dimension prediction model to obtain the vector dimension corresponding to the abnormal event data. Determine the corresponding vectorized network based on the vector dimension; The abnormal event data is input into a vectorization network to obtain the abnormal event vector corresponding to the abnormal event data.

[0085] As can be seen, through the above optional embodiments, by inputting the abnormal keywords or similar data of abnormal event data into the dimension prediction model to determine the vector dimension and selecting a vectorization network to vectorize to obtain the abnormal event vector, dynamic dimension adaptive vectorization based on abnormal keywords is achieved, which improves the accuracy and adaptability of vector representation and reduces the risk of vector distortion caused by fixed dimensions.

[0086] As an optional embodiment, the monitoring module inputs real-time computing power operation data of any computing power system into the anomaly prediction model to obtain the output risk monitoring information in the following specific ways: Input the real-time computing power operation data of any computing power system into the anomaly prediction model to obtain the corresponding predicted anomaly events and anomaly probabilities. Cluster all computing power systems based on predicted abnormal events to obtain a set of similar systems; optionally, the event similarity between predicted abnormal events of any two computing power systems in the set of similar systems is greater than a preset third similarity threshold. Calculate the average anomaly probability of all computing power systems in the similar system set to obtain the probability parameter; Calculate the average positional distance between each pair of computing power systems in a set of similar systems to obtain the proximity parameter; The product of the probability parameter and the proximity parameter is calculated to obtain the risk parameter; the risk parameter is used to characterize the probability of an abnormal event existing in the computing power community where at least two computing power systems are located.

[0087] As can be seen, through the above optional embodiments, by inputting real-time computing power operation data into the anomaly prediction model to output predicted abnormal events and probabilities, and obtaining a set of similar systems based on event similarity clustering, the product of the probability average and the location distance average is calculated as a risk parameter, thereby achieving accurate risk quantification assessment based on clustering and multidimensional averaging, improving the early warning capability of the possibility of anomalies in the computing power community, and reducing the risk of underestimating the community risk caused by isolated system analysis.

[0088] Example 3 Please see Figure 3 , Figure 3 This is another computing power risk monitoring system based on cross-source fusion computing power data disclosed in the embodiments of the present invention. Figure 3 The described computing power risk monitoring system based on cross-source fusion computing power data is applied in data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 3 As shown, the computing power risk monitoring system based on cross-source fusion computing power data may include: Memory 301 storing executable program code; Processor 302 coupled to memory 301; The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the computing power risk monitoring method based on cross-source fused computing power data described in Embodiment 1.

[0089] Example 4 This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the computing power risk monitoring method based on cross-source fused computing power data described in Embodiment 1.

[0090] Example 5 This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the computing power risk monitoring method based on cross-source fused computing power data described in Embodiment 1.

[0091] The foregoing has described specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily have to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0092] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0093] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0094] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0096] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0100] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0102] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0103] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0104] Finally, it should be noted that the computing power risk monitoring method and system based on cross-source fusion computing power data disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring computing power risks based on cross-source fused computing power data, characterized in that, The method includes: Acquire computing power operation data from multiple monitoring dimensions sent by multiple computing power systems; Based on the identification algorithm, abnormal event data in the computing power operation data is identified; An anomaly prediction model is trained based on the event parameters corresponding to the abnormal event data and the system data of the computing power system. Inputting real-time computing power operation data of any of the aforementioned computing power systems into the anomaly prediction model yields output risk monitoring information, including: Input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the corresponding predicted anomaly events and anomaly probabilities. Based on the predicted abnormal events, all the computing power systems are clustered to obtain a set of similar systems; the event similarity between the predicted abnormal events of any two computing power systems in the set of similar systems is greater than a preset third similarity threshold. Calculate the average of the anomaly probabilities of all computing power systems in the set of similar systems to obtain the probability parameters; Calculate the average positional distance between each pair of computing power systems in the set of similar systems to obtain the proximity parameter; The product of the probability parameter and the proximity parameter is calculated to obtain the risk parameter; the risk parameter is used to characterize the probability that there are abnormal events in the computing power community where at least two of the computing power systems are located.

2. The computing power risk monitoring method based on cross-source fusion computing power data according to claim 1, characterized in that, The computing power system can be a computing power server, a partition of the computing power server, a computing power allocation platform, a computing power provider platform, or a user terminal for computing power management personnel.

3. The computing power risk monitoring method based on cross-source fusion computing power data according to claim 1, characterized in that, The computing power operation data of the multiple monitoring dimensions include at least one of the following: active monitoring data, passive rule-triggered data, software monitoring data, hardware sensor data, network monitoring data, or sensor data of the local area.

4. The computing power risk monitoring method based on cross-source fusion computing power data according to claim 1, characterized in that, The method of identifying abnormal event data in the computing power operation data based on the identification algorithm includes: For each data segment in each of the aforementioned computing power operation data, the data segment is input into the anomaly keyword recognition model to obtain the anomaly keyword recognition result corresponding to the data segment; the anomaly keyword recognition model has multiple anomaly-related key character regular expressions built in; When the abnormal keyword identification result indicates the presence of abnormal keywords, the data portion is determined to be abnormal time data; When the abnormal keyword identification result is no abnormal keyword, the system determines whether the data part is abnormal event data based on multiple data parts associated with the data part.

5. The computing power risk monitoring method based on cross-source fusion computing power data according to claim 4, characterized in that, The process of determining whether a data segment is abnormal event data based on multiple data segments associated with that data segment includes: Multiple associated data segments corresponding to the data segment are determined from the computing power operation data; the time difference between the data occurrence time of the associated data segment and the data occurrence time of the data segment is less than a time difference threshold; the data similarity between the associated data segment and the data segment is less than a preset first similarity threshold; Calculate the intersection of the abnormal keyword identification results corresponding to all the associated data parts to obtain the reference keyword set; From all the data in this data section, identify similar data that are similar to the reference keyword set; the average data similarity between the similar data and each keyword in the reference keyword set is greater than a preset second similarity threshold; When the sum of all the similar data exceeds a preset data volume threshold, the data portion is determined to be abnormal time data.

6. The computing power risk monitoring method based on cross-source fusion computing power data according to claim 5, characterized in that, The step of training an anomaly prediction model based on the event parameters corresponding to the anomaly event data and the system data of the computing power system includes: For each of the aforementioned abnormal event data, the abnormal event data is vectorized based on a preset vectorization rule to obtain an abnormal event vector; Obtain the event parameters corresponding to the abnormal event data; the event parameters include the event time and event-related data parameters. Determine the time period associated with the event time; Obtain the system operation data of the computing power system corresponding to the abnormal event data during the time period; The event parameters and the system operating data are determined as the basic event annotations corresponding to the abnormal event data; All the basic annotations of the events and the corresponding abnormal event vectors are input into the basic prediction model for training until convergence, so as to obtain the abnormal prediction model.

7. The computing power risk monitoring method based on cross-source fused computing power data according to claim 6, characterized in that, The process of vectorizing the abnormal event data based on preset vectorization rules to obtain an abnormal event vector includes: The abnormal keyword identification results or all similar data corresponding to the abnormal event data are input into the trained dimension prediction model to obtain the vector dimension corresponding to the abnormal event data. Based on the vector dimension, determine the corresponding vectorized network; The abnormal event data is input into the vectorization network to obtain the abnormal event vector corresponding to the abnormal event data.

8. A computing power risk monitoring system based on cross-source fusion computing power data, characterized in that, The system executes the computing power risk monitoring method based on cross-source fused computing power data as described in any one of claims 1-7, and the system includes: The acquisition module is used to acquire computing power operation data from multiple monitoring dimensions sent by multiple computing power systems; The identification module is used to identify abnormal event data in the computing power operation data based on the identification algorithm; The training module is used to train an anomaly prediction model based on the event parameters corresponding to the abnormal event data and the system data of the computing power system. The monitoring module is used to input the real-time computing power operation data of any of the computing power systems into the anomaly prediction model to obtain the output risk monitoring information.

9. A computing power risk monitoring system based on cross-source fusion computing power data, characterized in that, The system includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the computing power risk monitoring method based on cross-source fused computing power data as described in any one of claims 1-7.

Images