Intelligent monitoring method and device for network anomaly and storage medium

Abstract

The application discloses an intelligent network anomaly monitoring method and device and a storage medium, relates to the field of communication, and is used for improving the efficiency of intelligent network anomaly monitoring, and comprises the following steps: acquiring time series data corresponding to key performance indicators of physical computing nodes and virtual computing instances; performing window slicing on the time series data in the time dimension, extracting multi-dimensional time series features from each data window to obtain a feature vector; determining a target prediction model from a plurality of prediction models according to the time characteristics of the abnormal mode corresponding to the time series data; analyzing the feature vector based on the target prediction model, determining a performance indicator prediction sequence of a target time window, and determining an abnormal probability score according to the deviation degree of the performance indicator prediction sequence and a preset normal baseline. The application is applied to the process of intelligent network anomaly monitoring.

Description

Technical Field

[0001] This application relates to the field of communications, and in particular to an intelligent monitoring method, device, and storage medium for network anomalies. Background Technology

[0002] With the rapid development of cloud computing and virtualization technologies, network architectures are becoming increasingly complex, and the collaborative operation of physical computing nodes and virtual computing instances is becoming more and more common, which greatly increases the difficulty of network anomaly monitoring.

[0003] In related technologies, network performance parameters are acquired, and then network alarm information is generated based on these parameters and thresholds. This alarm information is then used to monitor abnormal network conditions. However, different network performance parameters correspond to different thresholds. Accurately acquiring these thresholds is crucial for monitoring network anomalies. This requires technicians to acquire and record the threshold for each network performance parameter, significantly reducing the efficiency of network anomaly monitoring. Therefore, improving the efficiency of network anomaly monitoring remains a technical challenge. Summary of the Invention

[0004] This application provides an intelligent monitoring method, device, and storage medium for network anomalies, which can improve the prediction efficiency of network resource demand.

[0005] In a first aspect, this application provides an intelligent monitoring method for network anomalies, comprising: an intelligent monitoring device for network anomalies acquiring time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances; the intelligent monitoring device for network anomalies performing windowed slicing of the time-series data in the time dimension, and extracting multi-dimensional time-series features from each data window to obtain a feature vector; the multi-dimensional time-series features include statistical features, trend features, and periodic features; the intelligent monitoring device for network anomalies determining a target prediction model from multiple prediction models based on the temporal characteristics of the anomaly patterns corresponding to the time-series data; the temporal characteristics of the anomaly patterns being used to characterize the temporal dependencies between the time-series data; the intelligent monitoring device for network anomalies analyzing the feature vectors based on the target prediction model to determine the performance indicator prediction sequence for the target time window, and determining an anomaly probability score based on the degree of deviation of the performance indicator prediction sequence from a preset normal baseline.

[0006] In one possible implementation, the multiple prediction models include at least a first prediction model and a second prediction model; when the time characteristics of the anomalous pattern are characterized as a short-term, sharp fluctuation correlation pattern, the first prediction model is determined as the target prediction model; the first prediction model is used to capture the nonlinear abrupt dependence between time series data; when the time characteristics of the anomalous pattern are characterized as a long-term, slow, cumulative change pattern, the second prediction model is determined as the target prediction model; the second prediction model is used to capture the long-term time series dependence between time series data.

[0007] In one possible implementation, the time-series data is cleaned and standardized to obtain standard time-series data.

[0008] In one possible implementation, first time-series data of the physical computing node is obtained; the first time-series data includes: CPU utilization, available memory capacity, and available disk space capacity; second time-series data of the virtual computing instance is obtained; the second time-series data includes the cumulative CPU usage time and memory usage; missing values ​​in the first and second time-series data are filled in, and noise points in the first and second time-series data are smoothed to obtain third time-series data; the third time-series data is processed according to a preset standardization algorithm to generate standard time-series data.

[0009] In one possible implementation, the standard time-series data is segmented by a sliding window of a preset time length to obtain continuous data windows. Within each data window, the statistical characteristics of the standard time-series data are determined. The statistical characteristics include at least one of the following: mean, standard deviation, maximum value, and minimum value. Within each data window, the intensity of the changing trend of the standard time-series data is calculated according to a preset trend analysis algorithm to determine the trend characteristics. The periodic characteristics of the standard time-series data are determined based on whether the current data window belongs to a peak business period. Based on the statistical characteristics, trend characteristics, and periodic characteristics, a feature vector is determined.

[0010] In one possible implementation, when the anomaly probability score is greater than a preset dynamic confidence threshold, the pre-configured avoidance strategy library is queried to obtain the corresponding avoidance instruction based on the anomaly probability score, the predicted anomaly type, and the target computing object information; the avoidance instruction is converted into a native control instruction executable by the target cloud platform; and the application programming interface of the target cloud platform is called to execute the native control instruction to perform avoidance operations on the target computing object.

[0011] In one possible implementation, the circumvention operations include at least one of the following: live migration of virtual computing instances, cold migration of virtual computing instances, restart of service instances, expansion of storage space, and disabling of computing nodes.

[0012] Secondly, this application provides an intelligent monitoring device for network anomalies, comprising: an acquisition unit for acquiring time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances; a processing unit for windowing the time-series data in the time dimension and extracting multi-dimensional time-series features from each data window to obtain a feature vector; the multi-dimensional time-series features include statistical features, trend features, and periodic features; a processing unit for determining a target prediction model from multiple prediction models based on the temporal characteristics of the anomaly patterns corresponding to the time-series data; the temporal characteristics of the anomaly patterns are used to characterize the temporal dependencies between the time-series data; and a processing unit for analyzing the feature vectors based on the target prediction model, determining the performance indicator prediction sequence for the target time window, and determining an anomaly probability score based on the degree of deviation of the performance indicator prediction sequence from a preset normal baseline.

[0013] In one possible implementation, the multiple prediction models include at least a first prediction model and a second prediction model; a processing unit is used to determine the first prediction model as the target prediction model when the time characteristics of the anomalous pattern are characterized as a short-term drastic fluctuation correlation pattern; the first prediction model is used to capture the nonlinear abrupt dependency between time series data; and a processing unit is used to determine the second prediction model as the target prediction model when the time characteristics of the anomalous pattern are characterized as a long-term slow cumulative change pattern; the second prediction model is used to capture the long-term time series dependency between time series data.

[0014] In one possible implementation, a processing unit is used to clean and standardize the time-series data to obtain standard time-series data.

[0015] In one possible implementation, an acquisition unit is used to acquire first time-series data of a physical computing node; the first time-series data includes: CPU utilization, available memory capacity, and available disk space capacity; an acquisition unit is used to acquire second time-series data of a virtual computing instance; the second time-series data includes cumulative CPU usage time and memory usage; a processing unit is used to fill in missing values ​​in the first and second time-series data, and to smooth noise points in the first and second time-series data to obtain third time-series data; a processing unit is used to process the third time-series data according to a preset standardization algorithm to generate standard time-series data.

[0016] In one possible implementation, a processing unit is used to segment the standard time-series data through a sliding window of a preset time length to obtain continuous data windows; a processing unit is used to determine the statistical characteristics of the standard time-series data within each data window; the statistical characteristics include at least one of the following: mean, standard deviation, maximum value, and minimum value; a processing unit is used to calculate the trend intensity of the standard time-series data within each data window according to a preset trend analysis algorithm to determine the trend characteristics; a processing unit is used to determine the periodic characteristics of the standard time-series data based on whether the current data window belongs to a peak business period; and a processing unit is used to determine a feature vector based on the statistical characteristics, trend characteristics, and periodic characteristics.

[0017] In one possible implementation, a processing unit is used to query a pre-configured avoidance strategy library to obtain a corresponding avoidance instruction based on the anomaly probability score, the predicted anomaly type, and the target computing object information when the anomaly probability score is greater than a preset dynamic confidence threshold; a processing unit is used to convert the avoidance instruction into a native control instruction executable by the target cloud platform; and a processing unit is used to call the application programming interface of the target cloud platform to execute the native control instruction in order to perform an avoidance operation on the target computing object.

[0018] In one possible implementation, the circumvention operations include at least one of the following: live migration of virtual computing instances, cold migration of virtual computing instances, restart of service instances, expansion of storage space, and disabling of computing nodes.

[0019] Thirdly, this application provides a computer-readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by an electronic device of this application, cause the electronic device to perform the intelligent monitoring method for network anomalies as described in the first aspect and any possible implementation thereof.

[0020] Fourthly, this application provides an electronic device, including: a processor and a memory; wherein the memory is used to store one or more programs, the one or more programs including computer-executable instructions, and when the electronic device is running, the processor executes the computer-executable instructions stored in the memory to cause the electronic device to perform the intelligent network anomaly monitoring method as described in the first aspect and any possible implementation of the first aspect.

[0021] Fifthly, this application provides a computer program product containing instructions that, when executed on a computer, cause the electronic device of this application to perform the intelligent monitoring method for network anomalies as described in the first aspect and any possible implementation thereof.

[0022] Sixthly, this application provides a chip system applied to an intelligent network anomaly monitoring device; the chip system includes one or more interface circuits and one or more processors. The interface circuits and processors are interconnected via lines; the interface circuits are used to receive signals from the memory of the intelligent network anomaly monitoring device and send signals to the processors, the signals including computer instructions stored in the memory. When the processor executes the computer instructions, the intelligent network anomaly monitoring device performs an intelligent network anomaly monitoring method as described in the first aspect and any of its possible design embodiments.

[0023] In this application, the name of the aforementioned intelligent network anomaly monitoring device does not limit the device or functional unit itself. In actual implementation, these devices or functional units may appear under other names. As long as the function of each device or functional unit is similar to that of this application, they all fall within the scope of the claims of this application and their equivalents.

[0024] Based on the above technical solution, in this embodiment, the intelligent network anomaly monitoring device acquires time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances. Considering the timestamps within the time-series data, the device performs windowing slices on the time-series data and extracts multi-dimensional time-series features from each data window to obtain feature vectors. This ensures that the feature vector data corresponds to the same duration. The multi-dimensional time-series features include statistical features, trend features, and periodic features. Considering that the temporal characteristics of anomaly patterns are used to characterize the temporal dependencies between time-series data, the device determines a target prediction model from multiple prediction models based on the temporal characteristics of the anomaly patterns corresponding to the time-series data. The device analyzes the feature vectors with the same duration based on the target prediction model to determine the performance indicator prediction sequence for the target time window, and determines the anomaly probability score based on the degree of deviation between the performance indicator prediction sequence and a preset normal baseline. Compared with existing technologies that generate network alarm information based on network performance parameters and thresholds, this application analyzes feature vectors with the same duration based on a target prediction model, which can accurately determine the anomaly probability score and thus improve the efficiency of network anomaly monitoring. Attached Figure Description

[0025] Figure 1 A schematic diagram of the architecture of an intelligent network anomaly monitoring system provided in this application embodiment; Figure 2 A schematic diagram of the structure of an intelligent network anomaly monitoring device provided in an embodiment of this application; Figure 3 A flowchart illustrating an intelligent network anomaly monitoring method provided in this application embodiment; Figure 4A flowchart illustrating another intelligent network anomaly monitoring method provided in this application embodiment; Figure 5 A flowchart illustrating another intelligent network anomaly monitoring method provided in this application embodiment; Figure 6 A flowchart illustrating another intelligent network anomaly monitoring method provided in this application embodiment; Figure 7 A flowchart illustrating another intelligent network anomaly monitoring method provided in this application embodiment; Figure 8 A flowchart illustrating another intelligent network anomaly monitoring method provided in this application embodiment; Figure 9 This is a schematic diagram of another intelligent network anomaly monitoring device provided in an embodiment of this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] In this article, the character " / " generally indicates that the objects before and after it are in an "or" relationship. For example, A / B can be understood as A or B.

[0028] The terms "first" and "second" in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects. For example, "first edge service node" and "second edge service node" are used to distinguish different edge service nodes, not to describe a characteristic order of edge service nodes.

[0029] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0030] Furthermore, in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplarily" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the words "exemplarily" or "for example" is intended to present concepts in a concrete manner.

[0031] With the rapid development of cloud computing and virtualization technologies, network architectures are becoming increasingly complex, and the collaborative operation of physical computing nodes and virtual computing instances is becoming more and more common, which greatly increases the difficulty of network anomaly monitoring.

[0032] In related technologies, network performance parameters are acquired, and then network alarm information is generated based on these parameters and thresholds. This alarm information is then used to monitor abnormal network conditions. However, different network performance parameters correspond to different thresholds. Accurately acquiring these thresholds is crucial for monitoring network anomalies. This requires technicians to acquire and record the threshold for each network performance parameter, significantly reducing the efficiency of network anomaly monitoring. Therefore, improving the efficiency of network anomaly monitoring remains a technical challenge.

[0033] Based on the above technical solution, in this embodiment, the intelligent network anomaly monitoring device acquires time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances. Considering the timestamps within the time-series data, the device performs windowing slices on the time-series data and extracts multi-dimensional time-series features from each data window to obtain feature vectors. This ensures that the feature vector data corresponds to the same duration. The multi-dimensional time-series features include statistical features, trend features, and periodic features. Considering that the temporal characteristics of anomaly patterns are used to characterize the temporal dependencies between time-series data, the device determines a target prediction model from multiple prediction models based on the temporal characteristics of the anomaly patterns corresponding to the time-series data. The device analyzes the feature vectors with the same duration based on the target prediction model to determine the performance indicator prediction sequence for the target time window, and determines the anomaly probability score based on the degree of deviation between the performance indicator prediction sequence and a preset normal baseline. Compared with existing technologies that generate network alarm information based on network performance parameters and thresholds, this application analyzes feature vectors with the same duration based on a target prediction model, which can accurately determine the anomaly probability score and thus improve the efficiency of network anomaly monitoring.

[0034] For example, such as Figure 1 As shown, Figure 1This application provides an architectural diagram of an intelligent network anomaly monitoring system 10, which includes: a data acquisition device 101 and an intelligent network anomaly monitoring device 102.

[0035] The data acquisition device 101 acquires and sends prediction request information to the intelligent monitoring device 102 for network anomalies; the prediction request information includes the prediction time and information on popular events.

[0036] The intelligent network anomaly monitoring device 102 determines the baseline predicted value of network resources based on the prediction time and time series prediction model; determines the influence factors of network resources based on hot event information and large language model; and determines the network resource demand at the prediction time based on the baseline predicted value and influence factors.

[0037] Optionally, the impact factor is used to adjust the baseline forecast.

[0038] Optionally, the physical device of the data acquisition device 101 is a terminal, and the physical device of the intelligent network anomaly monitoring device 102 is a server.

[0039] Optionally, the aforementioned terminal may be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connectivity, or other processing device connected to a wireless modem. The wireless terminal may communicate with one or more core networks via a radio access network (RAN). The wireless terminal may be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, or a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device that exchanges voice and / or data with the radio access network, such as a mobile phone, tablet computer, laptop computer, netbook, or personal digital assistant (PDA).

[0040] Optionally, the server mentioned above can be one of the servers in a server cluster (composed of multiple servers), a chip in the server, a system-on-a-chip in the server, or a virtual machine (VM) deployed on a physical machine. This application embodiment does not limit this.

[0041] This application provides an intelligent network anomaly monitoring device for executing the intelligent network anomaly monitoring system provided in this application. Figure 2 This is a schematic diagram of the structure of an intelligent network anomaly monitoring device provided in an embodiment of this application. Figure 2As shown, the intelligent network anomaly monitoring device 200 includes at least one processor 201, a communication line 202, and at least one communication interface 204, and may also include a memory 203. The processor 201, memory 203, and communication interface 204 can be connected via the communication line 202.

[0042] The processor 201 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0043] Communication line 202 may include a path for transmitting information between the aforementioned components.

[0044] The communication interface 204 is used to communicate with other devices or communication networks and can use any transceiver-like device, such as Ethernet, radio access network (RAN), WLAN, etc.

[0045] The memory 203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of including or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0046] In one possible design, the memory 203 can exist independently of the processor 201, meaning the memory 203 can be an external memory of the processor 201. In this case, the memory 203 can be connected to the processor 201 via the communication line 202 to store execution instructions or application code, and its execution is controlled by the processor 201 to implement the intelligent network anomaly monitoring method provided in the following embodiments of this application. In another possible design, the memory 203 can also be integrated with the processor 201, meaning the memory 203 can be an internal memory of the processor 201. For example, the memory 203 can be a cache, which can be used to temporarily store some data and instruction information.

[0047] As one possible implementation, processor 201 may include one or more CPUs, for example Figure 2 CPU0 and CPU1 in the example. Alternatively, the intelligent network anomaly monitoring device 200 may include multiple processors, such as... Figure 2 The processors 201 and 207 are included. Alternatively, the intelligent network anomaly monitoring device 200 may also include an output device 205 and an input device 206.

[0048] The following, in conjunction with the appendix Figure 3 The intelligent network anomaly monitoring method provided in the embodiments of this application will be described in detail, such as... Figure 3 As shown, the intelligent monitoring method for network anomalies includes S301-S304.

[0049] S301, The intelligent monitoring device for network anomalies acquires time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances.

[0050] Optionally, the key performance indicators for physical computing nodes include any of the following: CPU utilization, available memory, and available disk space; the key performance indicators for virtual computing instances include CPU usage time and memory usage.

[0051] S302, The intelligent monitoring device for network anomalies performs windowed slicing of time-series data in the time dimension, and extracts multi-dimensional time-series features from each data window to obtain a feature vector.

[0052] Among them, multi-dimensional time series characteristics include statistical characteristics, trend characteristics, and periodic characteristics.

[0053] Optionally, the window size is 60, representing data from the past 30 minutes.

[0054] It should be explained that the feature vector is a feature vector that the machine learning model can understand.

[0055] S303, The intelligent monitoring device for network anomalies determines the target prediction model from multiple prediction models based on the time characteristics of the anomaly patterns corresponding to the time series data.

[0056] Among them, the temporal characteristics of abnormal patterns are used to characterize the temporal dependencies between time-series data.

[0057] Optional, several prediction models include the Transformer model and the Long Short-Term Memory (LSTM) model.

[0058] It should be explained that the intelligent network anomaly monitoring device receives feature vectors from the feature engineering module and selects an appropriate model for prediction according to preset rules.

[0059] For example, the default rule is to prioritize the use of the Transformer model when monitoring CPU metrics and the LSTM model when monitoring long-term memory trends.

[0060] S304. The intelligent monitoring device for network anomalies analyzes feature vectors based on the target prediction model, determines the performance index prediction sequence for the target time window, and determines the anomaly probability score based on the degree of deviation between the performance index prediction sequence and the preset normal baseline.

[0061] In one possible implementation, the intelligent monitoring device for network anomalies analyzes the feature vectors based on the target prediction model, and the intelligent monitoring device for network anomalies trains the target prediction model.

[0062] Optionally, the intelligent network anomaly monitoring device trains a target prediction model offline and predicts anomaly probability scores online.

[0063] Understandably, during the offline training phase, the intelligent network anomaly monitoring device uses a large amount of historical monitoring time-series data as its training set. This historical data undergoes the same data preprocessing and feature engineering steps as the real-time process. The intelligent network anomaly monitoring device selects a model based on the anomaly characteristics to be predicted. For scenarios requiring the capture of sudden correlations (such as CPU spikes), the Transformer model is selected; for scenarios requiring the understanding of long-term, slow trends (such as memory leaks), the LSTM model is selected. The selected model undergoes a model training and validation process, ultimately generating a pre-trained model that meets performance standards and can be used at any time.

[0064] The above scheme brings at least the following beneficial effects: The intelligent network anomaly monitoring device acquires time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances. Considering that the time-series data contains timestamps, the intelligent network anomaly monitoring device slices the time-series data into windows along the time dimension and extracts multi-dimensional time-series features from each data window to obtain feature vectors. In this way, the feature vector data corresponds to the same duration. The multi-dimensional time-series features include statistical features, trend features, and periodic features; considering that the temporal characteristics of anomaly patterns are used to characterize the temporal dependencies between time-series data, the intelligent network anomaly monitoring device determines the target prediction model from multiple prediction models based on the temporal characteristics of the anomaly patterns corresponding to the time-series data. Based on the target prediction model, the intelligent network anomaly monitoring device analyzes the feature vectors with the same duration to determine the performance indicator prediction sequence of the target time window, and determines the anomaly probability score based on the degree of deviation of the performance indicator prediction sequence from the preset normal baseline. Compared with existing technologies that generate network alarm information based on network performance parameters and thresholds, this application analyzes feature vectors with the same duration based on a target prediction model, which can accurately determine the anomaly probability score and thus improve the efficiency of network anomaly monitoring.

[0065] In one possible implementation, combining Figure 3 ,like Figure 4 As shown, in S302, the process by which the intelligent monitoring device for network anomalies determines the target prediction model from multiple prediction models based on the time characteristics of the anomaly pattern corresponding to the time series data can be specifically implemented through the following S401-S402.

[0066] S401. When the time characteristics of the abnormal pattern are characterized as a short-term drastic fluctuation correlation pattern, the intelligent monitoring device for network anomalies determines the first prediction model as the target prediction model.

[0067] Among them, multiple prediction models include at least a first prediction model and a second prediction model. The first prediction model is used to capture nonlinear mutation dependencies between time series data.

[0068] Optionally, the first prediction model is the Transformer model.

[0069] It should be explained that for scenarios that require capturing sudden correlations, intelligent network anomaly monitoring devices choose the Transformer model.

[0070] An example of a sudden correlation is a peak in CPU usage.

[0071] S402. When the time characteristics of the abnormal pattern are characterized as a long-term, slow, cumulative change pattern, the intelligent monitoring device for network anomalies determines the second prediction model as the target prediction model.

[0072] The second prediction model is used to capture long-range temporal dependencies between time series data.

[0073] Optionally, the second prediction model is an LSTM model.

[0074] It should be explained that for scenarios that require understanding long-term, slow trends, the intelligent monitoring device for network anomalies chooses the LSTM model.

[0075] Optional, long-term, slow-trend scenarios include memory leak scenarios.

[0076] The above solution brings at least the following beneficial effects: In the embodiments of this application, when the time characteristics of the abnormal mode are characterized as a short-term violent fluctuation correlation mode, the intelligent monitoring device for network anomalies determines the first prediction model as the target prediction model; when the time characteristics of the abnormal mode are characterized as a long-term slow cumulative change mode, the intelligent monitoring device for network anomalies determines the second prediction model as the target prediction model. In this way, an accurate target prediction model can be selected to predict network anomalies.

[0077] In one possible implementation, combining Figure 3 ,like Figure 5 As shown, after the intelligent network anomaly monitoring device in S301 acquires the time-series data corresponding to the key performance indicators of physical computing nodes and virtual computing instances, the intelligent network anomaly monitoring device determines the standard time-series data. The process of the intelligent network anomaly monitoring device determining the standard time-series data can be specifically implemented through the following S501.

[0078] S501, the intelligent monitoring device for network anomalies cleans and standardizes time-series data to obtain standard time-series data.

[0079] It should be explained that the intelligent network anomaly monitoring device cleans time-series data by: using linear interpolation to fill missing values, using moving average to smooth out spikes (outliers), and using the Z-score method for normalization to unify the data scale and facilitate model processing.

[0080] The above solution brings at least the following benefits: the intelligent monitoring device for network anomalies cleans and standardizes the time series data to obtain standard time series data, which makes the standard time series data more readily available for use by the model.

[0081] In one possible implementation, combining Figure 5 ,like Figure 6 As shown, in S501, the intelligent monitoring device for network anomalies cleans and standardizes the time-series data to obtain standard time-series data. This process can be specifically implemented through the following S601-S604.

[0082] S601, The intelligent monitoring device for network anomalies acquires the first time-series data of the physical computing nodes.

[0083] The first time-series data includes: CPU utilization, available memory capacity, and available disk space capacity.

[0084] S602, The intelligent monitoring device for network anomalies acquires the second time-series data of the virtual computing instance.

[0085] The second time-series data includes: the cumulative usage time of the central processing unit and the amount of memory used.

[0086] S603 The intelligent monitoring device for network anomalies fills in the missing values ​​in the first time series data and the second time series data, and smooths the noise points in the first time series data and the second time series data to obtain the third time series data.

[0087] It should be explained that the intelligent monitoring device for network anomalies prioritizes the temporal correlation of time-series data (such as the regularity of data before and after), and then combines the inherent correlation between two time-series data (if there is a correlation), to avoid blindly filling in data and causing data distortion, and finally ensures that the filled data conforms to the original time-series trend and does not introduce false correlations.

[0088] Understandably, the intelligent network anomaly monitoring device first identifies noise points using either the 3σ criterion or the rolling window interquartile range method to avoid mistakenly deleting valid data. Then, it independently selects a smoothing method, prioritizing a median moving average with a window size of 3-5 (strong anti-interference) or an EMA with α=0.1-0.3 (preserving trend). If the correlation between two data points is ≥0.7, joint smoothing can be performed by adjusting the ratio to retain the inherent correlation. A simple verification after smoothing ensures that the data trend is free of distortion and abrupt changes, completing the processing and seamlessly connecting to the missing value imputation process described earlier, thus meeting the need for rapid noise reduction.

[0089] S604 The intelligent monitoring device for network anomalies processes the third time series data according to a preset standardized algorithm to generate standard time series data.

[0090] Optionally, standard time-series data includes a JSON object of the operation type and a JSON object of the target object's UUID information.

[0091] The above solution brings at least the following beneficial effects: In this embodiment of the application, considering that the first time series data includes: CPU utilization, available memory capacity and available disk space capacity, and the second time series data includes: CPU cumulative usage time and memory usage, the intelligent network anomaly monitoring device fills in the missing values ​​in the first and second time series data and smooths the noise points in the first and second time series data, thereby obtaining accurate third time series data and improving the efficiency of network prediction.

[0092] In one possible implementation, combining Figure 3 ,like Figure 7 As shown, the process of the intelligent monitoring device for network anomalies in S302 performing windowed slicing of time-series data in the time dimension and extracting multi-dimensional time-series features from each data window to obtain feature vectors can be specifically implemented through the following steps S701-S705.

[0093] S701, the intelligent monitoring device for network anomalies divides standard time-series data into continuous data windows by using a sliding window of preset time length.

[0094] For example, the intelligent monitoring device for network anomalies uses a window size of 60 to slice time-series data.

[0095] Optionally, a window size of 60 is used to represent data from the past 30 minutes, with a sampling period of 30 seconds.

[0096] S702, The intelligent monitoring device for network anomalies determines the statistical characteristics of standard time-series data within each data window.

[0097] Among them, statistical characteristics include at least one of the following: mean, standard deviation, maximum value, and minimum value.

[0098] S703, the intelligent monitoring device for network anomalies calculates the intensity of the changing trend of standard time series data in each data window according to a preset trend analysis algorithm, and determines the trend characteristics.

[0099] It should be explained that the trend characteristic is calculated by linear regression to determine the slope of the data within the window, reflecting the trend of indicator changes.

[0100] S704 The intelligent monitoring device for network anomalies determines the periodicity of standard time-series data based on whether the current data window belongs to a peak business period.

[0101] Optionally, the periodicity feature is whether the current time point belongs to the peak business period.

[0102] Understandably, peak business hours can be the opening and closing times of trading.

[0103] S705, the intelligent monitoring device for network anomalies determines feature vectors based on statistical characteristics, trend characteristics, and periodic characteristics.

[0104] In one possible implementation, the Transformer model is used to predict CPU overload scenarios. For example, at 9:00 AM, the market opens, and the surge in market data leads to a sharp increase in CPU demand on the market-data-processor-vm-B, causing a rapid increase in the overall CPU load of Hypervisor-01. Due to its self-attention mechanism, the Transformer model can effectively capture the complex correlations and abrupt trends among multiple indicators (VM B's CPU, total physical machine CPU) triggered by external events (market opening). The model receives the feature vector at 09:00:30 and predicts the CPU utilization for the next 10 time points (5 minutes).

[0105] Optional, Input: CPU usage sequence and related features of Hypervisor-01 from 08:30:30 to 09:00:30. Predicted sequence: [81.5, 88.2, 93.1, 96.5, 98.9, 99.5, 100, 100, 100, 100]. Estimated probability of anomaly: 0.97 (above confidence threshold 0.95). In another possible implementation, an LSTM model is used to predict memory leak scenarios, considering that risk-audit-vm-C's memory usage has been growing slowly and non-linearly over the past 48 hours due to a code defect. The LSTM model excels at learning dependencies over such long periods. It can identify a slow but consistent pattern of memory growth, significantly different from normal business fluctuations (which may increase or decrease). The model predicts that the VM's memory will exhaust the physical machine's available memory within the next 6 hours.

[0106] Optional input: risk-audit-vm-C memory usage sequence and related features over the past 48 hours. Memory usage is predicted to reach 95% in 3 hours. Estimated probability of anomaly: 0.92 (higher than the confidence threshold of 0.90 for memory leak scenarios).

[0107] The above solution brings at least the following beneficial effects: In this embodiment of the application, the intelligent monitoring device for network anomalies determines the feature vector based on statistical features, trend features, and periodic features. In this way, by using the feature vector, statistical features, trend features, and periodic features can be accurately represented, reducing the memory space occupied by the data and improving the efficiency of network prediction.

[0108] In one possible implementation, combining Figure 3 ,like Figure 8 As shown, in S304, the intelligent network anomaly monitoring device analyzes the feature vector based on the target prediction model, determines the performance index prediction sequence for the target time window, and determines the anomaly probability score based on the deviation of the performance index prediction sequence from the preset normal baseline. Then, the intelligent network anomaly monitoring device implements avoidance operations. The process of the intelligent network anomaly monitoring device implementing avoidance operations can be specifically implemented through the following steps S801-S803.

[0109] S801. When the anomaly probability score is greater than the preset dynamic confidence threshold, the intelligent network anomaly monitoring device queries the pre-configured avoidance strategy library to match and obtain the corresponding avoidance instruction based on the anomaly probability score, the predicted anomaly type, and the target calculation object information.

[0110] For example, as shown in Table 1, the anomaly type predicted in the avoidance strategy library is CPU overload, the condition is probability > 0.95 AND there is a high-priority VM on the physical machine, the decision basis is that the physical machine where the transaction gateway VM is located is about to be overloaded, the avoidance action is to migrate the high-priority VM in real time, the OpenStack API is nova live-migration, and the priority is very high.

[0111] The predicted anomaly type is CPU overload, the condition is probability > 0.95 AND there are no high-priority VMs on the physical machine, the decision basis is that the physical machine where the ordinary business VM is located will be overloaded, the avoidance action is cold migration of low-priority VMs, the OpenStack API is novamigrate, and the priority is medium.

[0112] The predicted anomaly type is memory leak, the condition is probability > 0.90 AND service can be restarted, the decision basis is that the risk control audit service is slowly consuming memory, the avoidance action is graceful service restart, the OpenStack API is nova stop / start, and the priority is medium.

[0113] The predicted anomaly type is memory exhaustion, the condition is probability > 0.98, the decision basis is that the physical machine's memory is about to be exhausted, the avoidance action is to migrate some VMs, the OpenStack API is nova live-migration, and the priority is high.

[0114] The predicted anomaly type is disk exhaustion, the condition is predicted available space <5GB, the decision is based on the log partition being full, the avoidance action is to perform log rotation and cleanup, the OpenStack API is cinder extend (alternative), and the priority is normal.

[0115] The predicted anomaly type is a sudden increase in network packet loss rate, the condition is a predicted packet loss rate >1%, the decision basis is a physical network card or vSwitch failure, the avoidance action is to disable the physical machine and migrate all VMs, the OpenStack API is nova host-disable, nova evacuate, and the priority is very high.

[0116] The predicted anomaly type is API service unresponsive, the condition is predicted controller node CPU > 90%, the decision basis is OpenStack control service overload, the avoidance action is to scale up the controller or restart the service, the OpenStack API is an Ansible playbook, and the priority is medium.

[0117] Table 1. Strategy Library

[0118] S802, the intelligent network anomaly monitoring device converts evasion commands into native control commands that can be executed by the target cloud platform.

[0119] Optionally, native control instructions can be in JSON format. Native control instructions include CPU evasion native control instructions.

[0120] For example, the CPU avoids native control instructions as follows: { "action": "live_migrate_vm", "target_vm_uuid": "uuid-of-trading-gateway-vm-A", "destination_host": "auto_select" } It's important to explain that the execution of the intelligent network anomaly monitoring device begins with receiving the results from the prediction module. These results clearly indicate the anomaly type (e.g., CPU overload), its probability of occurrence (e.g., 0.97), and the associated object (e.g., the physical machine Hypervisor-01). Next, the intelligent network anomaly monitoring device immediately queries a pre-set avoidance strategy library, primarily determining if a matching handling plan exists. If not, a general alarm is generated and handed over to manual processing; if a plan exists, the process proceeds to the next step. The intelligent network anomaly monitoring device evaluates the priority of all matching strategies. For example, for the same CPU overload, a strategy handling core transaction-related devices has a higher priority than a strategy handling ordinary log devices. The intelligent network anomaly monitoring device selects the highest-priority avoidance action as the final decision, then converts this action into a standardized execution instruction that the machine can recognize (e.g., a JSON object containing the operation type and target object UUID), and finally sends the instruction to the executor module for execution.

[0121] The S803 network anomaly intelligent monitoring device calls the target cloud platform's application programming interface to execute native control commands in order to perform evasion operations on the target computing object.

[0122] For example, the intelligent monitoring device executor for CPU overload and network anomalies queries the Nova API to find the physical machine with the lowest current load (Hypervisor-03) and then executes the migration instruction; for memory leaks and network anomalies, the intelligent monitoring device executor adds the restart task to the scheduled task system and executes it at the specified time.

[0123] The above solution brings at least the following beneficial effects: In this embodiment of the application, the intelligent monitoring device for network anomalies calls the application programming interface of the target cloud platform to execute native control instructions in order to perform evasion operations on the target computing object. In this way, it can not only monitor network anomalies but also handle network anomalies in a timely manner, thereby improving network stability.

[0124] This application embodiment can divide the intelligent network anomaly monitoring device into functional modules or functional units according to the above method example. For example, each function can be divided into a separate functional module or functional unit, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or in software functional modules or functional units. The module or unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0125] For example, such as Figure 9The diagram shown is a structural schematic of another intelligent network anomaly monitoring device according to an embodiment of this application. The intelligent network anomaly monitoring device 90 includes an acquisition unit 901 and a processing unit 902.

[0126] The acquisition unit 901 is used to acquire time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances; the processing unit 902 is used to slice the time-series data into windows along the time dimension and extract multi-dimensional time-series features from each data window to obtain feature vectors; the multi-dimensional time-series features include statistical features, trend features, and periodic features; the processing unit 902 is used to determine the target prediction model from multiple prediction models based on the temporal characteristics of the abnormal patterns corresponding to the time-series data; the temporal characteristics of the abnormal patterns are used to characterize the temporal dependencies between time-series data; the processing unit 902 is used to analyze the feature vectors based on the target prediction model, determine the performance indicator prediction sequence of the target time window, and determine the anomaly probability score based on the degree of deviation of the performance indicator prediction sequence from the preset normal baseline.

[0127] Optionally, the multiple prediction models include at least a first prediction model and a second prediction model; the processing unit 902 is used to determine the first prediction model as the target prediction model when the time characteristics of the anomalous pattern are characterized as a short-term violent fluctuation correlation pattern; the first prediction model is used to capture the nonlinear abrupt dependence between time series data; the processing unit 902 is used to determine the second prediction model as the target prediction model when the time characteristics of the anomalous pattern are characterized as a long-term slow cumulative change pattern; the second prediction model is used to capture the long-term time series dependence between time series data.

[0128] Optionally, the processing unit 902 is used to clean and standardize the time series data to obtain standard time series data.

[0129] Optionally, the acquisition unit 901 is used to acquire the first time-series data of the physical computing node; the first time-series data includes: CPU utilization, available memory capacity, and available disk space capacity; the acquisition unit 901 is used to acquire the second time-series data of the virtual computing instance; the second time-series data includes the cumulative CPU usage time and memory usage; the processing unit 902 is used to fill in the missing values ​​in the first time-series data and the second time-series data, and to smooth the noise points in the first time-series data and the second time-series data to obtain the third time-series data; the processing unit 902 is used to process the third time-series data according to a preset standardization algorithm to generate standard time-series data.

[0130] Optionally, processing unit 902 is used to segment the standard time series data through a sliding window of preset time length to obtain continuous data windows; processing unit 902 is used to determine the statistical characteristics of the standard time series data within each data window; the statistical characteristics include at least one of the following: mean, standard deviation, maximum value, and minimum value; processing unit 902 is used to calculate the trend intensity of the standard time series data according to a preset trend analysis algorithm within each data window to determine the trend characteristics; processing unit 902 is used to determine the periodic characteristics of the standard time series data based on whether the time to which the current data window belongs belongs to a peak business period; processing unit 902 is used to determine the feature vector based on the statistical characteristics, trend characteristics, and periodic characteristics.

[0131] Optionally, processing unit 902 is used to query a pre-configured avoidance strategy library to obtain a corresponding avoidance instruction based on the anomaly probability score, the predicted anomaly type, and the target computing object information when the anomaly probability score is greater than a preset dynamic confidence threshold; processing unit 902 is used to convert the avoidance instruction into a native control instruction executable by the target cloud platform; processing unit 902 is used to call the application programming interface of the target cloud platform to execute the native control instruction in order to perform an avoidance operation on the target computing object.

[0132] Optionally, avoidance operations include at least one of the following: live migration of virtual computing instances, cold migration of virtual computing instances, restart of service instances, expansion of storage space, and disabling of computing nodes.

[0133] This application also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run computer programs or instructions to implement the intelligent network anomaly monitoring method in the above method embodiments.

[0134] Embodiments of this application provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform the industrial terminal switching method described in the above method embodiments.

[0135] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, or any other form of computer-readable storage medium in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In embodiments of the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0136] Since the apparatus, device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above methods, the technical effects that can be obtained can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0137] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for intelligent monitoring of network anomalies, characterized in that, include: Obtain time-series data corresponding to key performance indicators of physical computing nodes and virtual computing instances; The time-series data is sliced ​​into windows along the time dimension, and multi-dimensional time-series features are extracted from each data window to obtain a feature vector; The multidimensional time-series features include statistical features, trend features, and periodic features; Based on the temporal characteristics of the anomaly patterns corresponding to the time series data, a target prediction model is determined from multiple prediction models; the temporal characteristics of the anomaly patterns are used to characterize the temporal dependencies between the time series data. The feature vector is analyzed based on the target prediction model to determine the performance index prediction sequence for the target time window, and the anomaly probability score is determined based on the degree of deviation between the performance index prediction sequence and the preset normal baseline.

2. The method as described in claim 1, characterized in that, The plurality of prediction models includes at least a first prediction model and a second prediction model; the step of determining the target prediction model from the plurality of prediction models based on the temporal characteristics of the anomaly pattern corresponding to the time series data includes: When the time characteristics of the abnormal pattern are characterized as a short-term, drastic fluctuation correlation pattern, the first prediction model is determined to be the target prediction model; the first prediction model is used to capture the nonlinear abrupt dependency between time series data. When the time characteristics of the abnormal pattern are characterized as a long-term, slow, cumulative change pattern, the second prediction model is determined as the target prediction model; the second prediction model is used to capture long-term temporal dependencies between time series data.

3. The method as described in claim 1, characterized in that, After obtaining the time-series data corresponding to the key performance indicators of physical computing nodes and virtual computing instances, the method further includes: The time series data is cleaned and standardized to obtain standard time series data.

4. The method as described in claim 3, characterized in that, The step of cleaning and standardizing the time-series data to obtain standard time-series data includes: Acquire the first time-series data of the physical computing node; the first time-series data includes: CPU utilization, available memory capacity, and available disk space capacity; Acquire second time-series data of the virtual computing instance; the second time-series data includes the cumulative CPU usage time and memory usage. Missing values ​​in the first and second time series data are filled in, and noise points in the first and second time series data are smoothed to obtain the third time series data. The third time series data is processed according to a preset standardization algorithm to generate the standard time series data.

5. The method as described in claim 4, characterized in that, The step of windowing the time-series data along the time dimension and extracting multi-dimensional time-series features from each data window to obtain a feature vector includes: The standard time-series data is segmented by a sliding window of preset time length to obtain a continuous data window; Within each data window, the statistical characteristics of the standard time series data are determined; the statistical characteristics include at least one of the following: mean, standard deviation, maximum value, and minimum value; Within each data window, the intensity of the changing trend of the standard time series data is calculated according to a preset trend analysis algorithm to determine the trend characteristics; The periodicity of the standard time series data is determined based on whether the current data window belongs to a peak business period. The feature vector is determined based on the statistical characteristics, the trend characteristics, and the periodic characteristics.

6. The method as described in claim 5, characterized in that, After determining the anomaly probability score, the method further includes: When the anomaly probability score is greater than the preset dynamic confidence threshold, the pre-configured avoidance strategy library is queried to match and obtain the corresponding avoidance instruction based on the anomaly probability score, the predicted anomaly type and the target calculation object information. The evasion instructions are converted into native control instructions executable by the target cloud platform; The native control instructions are executed by calling the application programming interface of the target cloud platform to perform evasion operations on the target computing object.

7. The method as described in claim 6, characterized in that, The avoidance operations include at least one of the following: real-time migration of virtual computing instances, cold migration of virtual computing instances, restart of service instances, expansion of storage space, and disabling of computing nodes.

8. An intelligent monitoring device for network anomalies, characterized in that, The device includes an acquisition unit and a processing unit: The acquisition unit is used to acquire time-series data corresponding to the key performance indicators of physical computing nodes and virtual computing instances; The processing unit is used to perform windowed slicing of the time series data in the time dimension, and extract multi-dimensional time series features from each data window to obtain a feature vector; The multidimensional time-series features include statistical features, trend features, and periodic features; The processing unit is configured to determine a target prediction model from multiple prediction models based on the temporal characteristics of the abnormal patterns corresponding to the time series data; the temporal characteristics of the abnormal patterns are used to characterize the temporal dependencies between the time series data. The processing unit is used to analyze the feature vector based on the target prediction model, determine the performance index prediction sequence for the target time window, and determine the anomaly probability score based on the degree of deviation between the performance index prediction sequence and the preset normal baseline.

9. An intelligent monitoring device for network anomalies, characterized in that, include: A processor and a memory; wherein the memory is used to store computer execution instructions, and when the intelligent network anomaly monitoring device is running, the processor executes the computer execution instructions stored in the memory to cause the intelligent network anomaly monitoring device to perform the intelligent network anomaly monitoring method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed by the intelligent network anomaly monitoring device, cause the computer to perform the intelligent network anomaly monitoring method as described in any one of claims 1-7.

Images