Cloud computing service anomaly detection method and device, storage medium, program product and computer equipment

Abstract

The application discloses a cloud computing service anomaly detection method and device, a storage medium, a program product and computer equipment. The method comprises the following steps: in the embodiment of the application, index data of a cloud computing server is acquired, the index data is converted into time sequence data, and graph model structure information is determined according to the relationship between the cloud computing servers; based on the graph model structure information and the latest preset time length data in the time sequence data, an encoder in a graph autoencoder is called to determine time information; based on the time information, a decoder in the graph autoencoder is called to determine anomaly detection prediction information; and based on the anomaly detection prediction information, an anomaly detection result of the cloud computing server is determined. In this way, the accuracy of cloud computing service anomaly detection can be improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, apparatus, storage medium, program product, and computer equipment for detecting anomalies in cloud computing services. Background Technology

[0002] Cloud computing, a service model that can be elastically scaled and allocated on demand, has become an important platform supporting many critical business operations and data processing. However, the complexity and dynamism of cloud computing services often lead to various anomalies during operation. These anomalies can cause service interruptions, data loss, and even security risks, severely impacting business operations and user experience.

[0003] In related technologies, anomaly detection in cloud computing services can be achieved through log analysis of cloud service data, issuing warnings when a certain log metric is abnormal, such as abnormal access frequency, erroneous login attempts, or network request latency. However, this method is prone to generating a large number of false positives, resulting in low accuracy in anomaly detection. Summary of the Invention

[0004] To address the aforementioned technical problems, this application proposes a method, apparatus, storage medium, program product, and computer equipment for detecting anomalies in cloud computing services, which can improve the accuracy of cloud computing service anomaly detection.

[0005] In a first aspect, embodiments of this application provide a method for detecting anomalies in cloud computing services, including: Obtain the indicator data of the cloud computing server, convert the indicator data into time series data, and determine the graph model structure information based on the relationship between the cloud computing servers; Based on the graph model structure information and the most recent preset duration data in the time series data, the encoder in the graph autoencoder is called to determine the time information; Based on the time information, the decoder in the graph autoencoder is invoked to determine the anomaly detection prediction information; Based on the anomaly detection prediction information, the anomaly detection result of the cloud computing server is determined.

[0006] Optionally, the graph model structure information includes an adjacency matrix, and the encoder includes a graph convolutional neural network (GCN) and a gated recurrent unit (GRU). The step of determining time information by calling the encoder in the graph autoencoder based on the graph model structure information and the most recent preset duration data in the time series data includes: Based on the most recent preset duration data, determine the hidden state of the previous moment; Based on the adjacency matrix and the hidden state of the previous time step, the GCN is invoked to determine the first spatial variable; Based on the adjacency matrix and the current time data in the most recent preset duration data, the GCN is invoked to determine the second spatial variable; Based on the first spatial variable and the second spatial variable, the GRU is invoked to determine the hidden state at the current moment; The time information is determined based on the hidden state at the current moment.

[0007] Optionally, the GRU includes a reset gate and an update gate; The step of determining the hidden state at the current moment by calling the GRU based on the first spatial variable and the second spatial variable includes: Based on the first spatial variable and the second spatial variable, the reset gate is invoked to determine the reset information; Based on the reset information, the first spatial variable, and the second spatial variable, an activation function is used to determine the candidate hidden state at the current moment; Based on the first spatial variable and the second spatial variable, the update gate is invoked to determine the update information; Based on the updated information, the first spatial variable, and the candidate hidden state at the current moment, the hidden state at the current moment is determined.

[0008] Optionally, the decoder includes a fully connected layer and a nonlinear mapping layer that are electrically connected in sequence, and the anomaly detection prediction information includes a prediction score; The step of calling the decoder in the graph autoencoder based on the time information to determine the anomaly detection prediction information includes: The time information is input into the fully connected layer of the decoder to obtain the embedding features generated by the nonlinear mapping layer output by the decoder. The predicted score is determined based on the embedded features.

[0009] Optionally, determining the anomaly detection result of the cloud computing server based on the anomaly detection prediction information includes: The anomaly detection result of the cloud computing server is determined based on the comparison between the preset state score threshold and the prediction score contained in the anomaly detection prediction information.

[0010] Optionally, obtaining the indicator data of the cloud computing server includes: In response to a request sent by a data acquisition node, a data receiving node corresponding to the data acquisition node is determined according to a load balancing strategy, wherein the data acquisition node is used to collect the indicator data of the cloud computing server; The data receiving node is used to obtain the indicator data of the cloud computing server collected and sent by the data collection node.

[0011] Secondly, embodiments of this application provide a cloud computing service anomaly detection device, comprising: The data acquisition module is used to acquire indicator data of cloud computing servers, convert the indicator data into time series data, and determine the graph model structure information based on the relationship between the cloud computing servers. The time information determination module is used to determine time information by calling the encoder in the graph autoencoder based on the graph model structure information and the latest preset duration data in the time series data. The prediction module is used to call the decoder in the graph autoencoder based on the time information to determine anomaly detection prediction information; The result determination module is used to determine the anomaly detection result of the cloud computing server based on the anomaly detection prediction information.

[0012] Thirdly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the above-mentioned embodiments.

[0013] Fourthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the above-described embodiments.

[0014] Fifthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0015] In summary, the embodiments of this application have at least the following beneficial effects: By employing the embodiments of this application, indicator data of cloud computing servers is acquired and converted into time-series data. Graph model structure information is determined based on the relationships between the cloud computing servers. Based on the graph model structure information and the most recent preset duration data in the time-series data, the encoder in the graph autoencoder is invoked to determine time information. Based on the time information, the decoder in the graph autoencoder is invoked to determine anomaly detection prediction information. Based on the anomaly detection prediction information, the anomaly detection result of the cloud computing server is determined. Thus, after acquiring the indicator data of the cloud computing server, it can be converted into time-series data. This allows the graph autoencoder to use the graph model structure information as an aid to extract time information from the data corresponding to the most recent preset duration in the time-series data. This time information can then be used to help predict whether the cloud computing server has anomalies, thereby improving the accuracy of cloud service anomaly detection. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the cloud computing service anomaly detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of cloud computing service anomaly detection provided in an embodiment of this application; Figure 3 This is a schematic diagram of the graph autoencoder provided in the embodiments of this application; Figure 4 This is a schematic diagram of the training of the graph autoencoder provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of the cloud computing service anomaly detection device provided in the embodiments of this application; Figure 6 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments / examples are only a part of the embodiments / examples of this application, and not all of the embodiments / examples. Based on the embodiments / examples in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0018] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "multiple" means two or more. In the description of this application, the term "comprising" and its variations are open-ended, meaning "including but not limited to." The term "based on" means "at least partially based on." The term "according to" means "at least partially according to." The term "one embodiment / example" means "at least one embodiment / example"; the term "another embodiment / example" means "at least one additional embodiment / example"; the term "some embodiments / examples" means "at least some embodiments / examples."

[0019] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0020] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the application. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0021] Firstly, see [the following] Figure 1 The diagram shows a flowchart of a cloud computing service anomaly detection method provided in an embodiment of this application. This cloud computing service anomaly detection method can be applied to a computer device with data processing capabilities. The method includes S101-S104, as detailed below.

[0022] S101, acquire the performance metrics of the cloud computing servers, convert the performance metrics into time-series data, and determine the graph model structure information based on the relationships between the cloud computing servers. The performance metrics can be used to indicate the performance indicators of the cloud computing servers. The time-series data can refer to data converted into a data format that matches the graph model (graph structure) corresponding to the cloud computing servers. This graph model can be generated by mapping each server in the cloud computing server to different nodes. The graph model structure information can be used to indicate the positional relationships between different nodes, and thus also to indicate the positional relationships (e.g., relative positions and / or actual distances) between the servers in the cloud computing server.

[0023] In some examples, this metric data may include at least one of the following: CPU (Central Processing Unit) utilization, I / O requests per second, and throughput.

[0024] In some examples, this metric data can be obtained by collecting computing resources, storage resources, disk I / O resources, process resources, and / or network resources of a cloud computing server.

[0025] In some examples, data acquisition modules deployed on cloud computing servers can collect metric data. These modules can execute Linux commands using Java's ProcessBuilder or Runtime.exec() method to obtain the cloud computing server's metric data, and can also display this data using front-end tools such as bizcharts and g2.

[0026] In some examples, see Figure 2 Cloud computing servers can include servers at different tiers (e.g. Figure 2 The cloud computing server consists of a master service (0), slave services (1), slave services (2), slave services (3), and slave services (4). These servers interact via network connections, and their operational status and performance metrics change over time. To facilitate anomaly detection using a graph autoencoder, the servers within the cloud computing server can be abstracted into a graph model. The time-series data, which is associated with nodes in this graph model and possesses temporal characteristics, is used as the time-series data. Thus, in this graph model, each server can be represented as a node, and the connections between servers can be abstracted as edges. The feature vector of each node can be represented by the metric data (e.g., the server's internal status and performance information) of the server corresponding to that node.

[0027] S102, based on the graph model structure information and the most recent preset duration data in the time series data, call the encoder in the graph autoencoder to determine the time information.

[0028] In some examples, data corresponding to the most recent preset duration can be selected from the time-series data as the most recent preset duration data. This most recent preset duration can be... The most recently preset duration data can be represented as .

[0029] In some examples, the most recent preset duration data can be input into the encoder for encoding to obtain the time information output by the encoder.

[0030] In some examples, a graph autoencoder can be a neural network model capable of encoding and decoding time-series data. The encoder in a graph autoencoder can be used to encode nodes and edges in time-series data, thereby enabling more efficient data representation.

[0031] In some examples, a graph autoencoder can refer to the application of a graph convolutional neural network in an autoencoder. A graph autoencoder can include an encoder and a decoder. The encoder can be used to map the input temporal data to a lower-dimensional embedding representation, and the decoder can be used to reconstruct the input temporal data based on the lower-dimensional embedding representation.

[0032] Understandably, this time information can be used to indicate abnormal conditions of cloud computing servers within the most recent preset time period.

[0033] S103, based on the time information, call the decoder in the graph autoencoder to determine the anomaly detection prediction information.

[0034] In some examples, this time information can be input into the decoder for decoding processing to obtain the anomaly detection prediction information output by the decoder.

[0035] In some examples, the anomaly detection prediction information may include a prediction score, which can be used to indicate the probability of an anomaly existing in the cloud computing server. The prediction score may correspond to the aforementioned recent preset time or to the current time. This application embodiment does not specifically limit this.

[0036] In some cases, related technologies may use cloud server anomaly detection algorithms based on generative adversarial networks to build models. However, such models are relatively complex, resulting in poor robustness. In addition, their prediction accuracy depends on the amount of training data; only with a sufficiently large amount of data can good prediction results be achieved.

[0037] In this embodiment, the intrinsic features of cloud computing services can be extracted directly through the reconstruction process between the encoder and decoder. The process is relatively stable and less susceptible to the influence of randomness during training, thus making the final prediction results more accurate and requiring no large amount of training data.

[0038] S104, Based on the anomaly detection prediction information, determine the anomaly detection result of the cloud computing server.

[0039] In some examples, the anomaly detection prediction information may include a prediction score, which can be used to indicate the probability of an anomaly existing in the cloud computing server. Thus, whether the cloud computing server is abnormal can be determined by judging whether the probability reaches a corresponding probability threshold, thereby obtaining an anomaly detection result (used to indicate whether the cloud computing server is abnormal). Alternatively, the probability itself can be used as the anomaly detection result, in which case the anomaly detection result can be represented as an anomaly probability.

[0040] In one optional implementation, the graph model structure information includes an adjacency matrix, and the encoder includes a GCN (Graph Convolutional Network) and a GRU (Gated Recurrent Unit). The step of determining time information by calling the encoder in the graph autoencoder based on the graph model structure information and the most recent preset duration data in the time series data includes: Based on the most recent preset duration data, determine the hidden state of the previous moment; Based on the adjacency matrix and the hidden state of the previous time step, the GCN is invoked to determine the first spatial variable; Based on the adjacency matrix and the current time data in the most recent preset duration data, the GCN is invoked to determine the second spatial variable; Based on the first spatial variable and the second spatial variable, the GRU is invoked to determine the hidden state at the current moment; The time information is determined based on the hidden state at the current moment.

[0041] In some examples, the encoder may include a GCN and a GRU, wherein the GCN can be used to capture the relationship information between the nodes corresponding to the time series data, and the GRU can be used to process the time series data corresponding to the time series data.

[0042] In some examples, the most recent preset duration data may also include data for the current time t. .

[0043] In some examples, the adjacency matrix can be determined based on the relationships between the cloud computing servers. This allows the adjacency matrix to be... The hidden state of the previous moment The input is fed into the GCN, and the hidden state output by the GCN and the state at the previous time step are obtained. Corresponding first space variable Similarly, this adjacency matrix can be... Compared with the current time data The data is input into the GCN, and the output of the GCN is obtained, along with the data at the current time. Corresponding second space variable In practice, the processing procedure of this GCN can be represented by the following formula.

[0044]

[0045]

[0046] in, The hop count can be used to influence the spatial range of neighboring nodes in the aggregation of time-series data. It can represent an adjacency matrix with self-loops (e.g.) ,in, (the identity matrix) It can represent The degree matrix (diagonal matrix, diagonal elements are) (Sum of corresponding rows) Indicates and The corresponding GCN learnable weight matrix, Indicates and The corresponding GCN learnable weight matrix, This represents the Sigmoid activation function.

[0047] In some examples, the first and second space variables can be input into the GRU to obtain the hidden state at the current time step output by the GRU. At this point, the hidden state at the current moment can be... It can be directly used as the time information.

[0048] In some examples, the hidden state of the previous time step The method for determining this can refer to the hidden state at the current moment mentioned above. The method for determining this will not be elaborated here.

[0049] In this embodiment, a graph autoencoder is used to extract not only the spatial information between cloud computing servers, but also to fuse the most recent preset duration data through the GCN-GRU model to obtain the time information corresponding to the cloud computing servers. This allows for more accurate prediction of whether the cloud computing servers will experience anomalies in the next moment. Furthermore, the gating mechanism in the GRU can control the flow of information, enabling the network to focus on the correlation between the current time step and past time steps, thereby better capturing the characteristics of time-series data.

[0050] In one alternative implementation, the GRU includes a reset gate and an update gate; The step of determining the hidden state at the current moment by calling the GRU based on the first spatial variable and the second spatial variable includes: Based on the first spatial variable and the second spatial variable, the reset gate is invoked to determine the reset information; Based on the reset information, the first spatial variable, and the second spatial variable, an activation function is used to determine the candidate hidden state at the current moment; Based on the first spatial variable and the second spatial variable, the update gate is invoked to determine the update information; Based on the updated information, the first spatial variable, and the candidate hidden state at the current moment, the hidden state at the current moment is determined.

[0051] In some examples, the reset gate can be used to discard any irrelevant information from the previous hidden state, and the update gate can be used to control the amount of information in the hidden state from the previous hidden state to the current hidden state. Therefore, Stored All useful information prior to the time point, and can be transmitted along the entire network.

[0052] See below for further details Figure 3 .

[0053] In some examples, reset information Can be based on first space variables and second space variables Calculated using the following formula.

[0054]

[0055] in, express Convolution operations, such as Indicates to conduct Convolution operation, express The corresponding reset gate weight matrix, express The corresponding reset gate weight matrix, This indicates the option to reset the door's bias.

[0056] In some examples, update information Can be based on first space variables and second space variables Calculated using the following formula.

[0057]

[0058] in, express The corresponding updated gate weight matrix, express The corresponding updated gate weight matrix, This indicates that the bias term of the updated gate is being updated.

[0059] In some examples, the candidate hidden state at the current time step Can be based on reset information First-space variables and second space variables Calculated using the following formula.

[0060]

[0061] in, Hadamard product (element-wise multiplication). This represents the tanh activation function. express The weight matrix corresponding to the candidate state, express The weight matrix corresponding to the candidate state, The bias term represents the candidate hidden state.

[0062] In some examples, the hidden state at the current moment Based on updated information First-space variables and the candidate hidden state at the current moment Calculated using the following formula.

[0063]

[0064] Understandable, The convolution operation can be fundamentally understood as each unit applying a fully connected neural network as a fully connected layer. The fully connected layer can filter and integrate the features of previous messages. Even if the inputs of different message segments are the same, different, more complex and useful information can be obtained, thereby enriching the amount of information and improving the accuracy of anomaly detection.

[0065] In one optional implementation, the decoder includes a fully connected layer and a nonlinear mapping layer that are electrically connected in sequence, and the anomaly detection prediction information includes a prediction score; The step of calling the decoder in the graph autoencoder based on the time information to determine the anomaly detection prediction information includes: The time information is input into the fully connected layer of the decoder to obtain the embedding features generated by the nonlinear mapping layer output by the decoder. The predicted score is determined based on the embedded features.

[0066] In some examples, see Figure 2 The decoder can be implemented using a Multilayer Perceptron (MLP). For example, the decoder may contain two fully connected (FC) layers, and the nonlinear mapping layer may use a sigmoid function layer. The sigmoid function, as a classifier, can be used to map the MLP output to the range (0, 1). In specific implementation, the hidden state at the current time step is used... As time information The decoder's processing can be based on time information using the following formula. Obtaining embedded features .

[0067]

[0068] in, , These are the weight matrices corresponding to the first and second FC layers, respectively. , These are the bias terms corresponding to the first and second FC layers, respectively. This represents the sigmoid function.

[0069] In the embodiments of this application, The function can prevent output gradient explosion or vanishing, and can also map the output to between 0 and 1. The mapped value can be compared with the user-set threshold to determine whether the cloud computing service is abnormal.

[0070] In some examples, based on embedded features Determine the predicted score The process can be implemented using the sigmoid function, for example, it can be represented by the following formula.

[0071]

[0072] in, Represents the use of predictive scores to determine the predicted scores. The weight matrix corresponding to the FC layer connected to the input of the sigmoid function. Represents the use of predictive scores to determine the predicted scores. The input of the sigmoid function is connected to the corresponding bias term of the FC layer, i.e., the embedded feature. The input can be sent to the layer containing the sigmoid function via this FC layer. See also... Figure 4 The graph autoencoder can also include the FC layer and the layer containing the sigmoid function, so that the graph autoencoder can be optimized and trained end-to-end using the cross-entropy loss function. An example of the cross-entropy loss function is as follows.

[0073]

[0074] in, Represents cross-entropy loss, This indicates the number of samples in the training batch. This represents the true label corresponding to the sample in the training batch. It refers to the sample corresponding to each sample .

[0075] See Figure 4 When using the cross-entropy loss function for iterative training of a model, iterative training can be completed when the actual number of training rounds exceeds the preset number of training rounds.

[0076] In one optional implementation, determining the anomaly detection result of the cloud computing server based on the anomaly detection prediction information includes: The anomaly detection result of the cloud computing server is determined based on the comparison between the preset state score threshold and the prediction score contained in the anomaly detection prediction information.

[0077] In some examples, the preset state score threshold can be a threshold set by the user on the corresponding state threshold interface, allowing the user to adjust the sensitivity of anomaly detection by setting the threshold. For example, if the predicted score is greater than the preset state score threshold, it can be determined that the anomaly detection result indicates that the cloud computing server is in an abnormal state; if the predicted score is not greater than the preset state score threshold, it can be determined that the anomaly detection result indicates that the cloud computing server is in a normal state.

[0078] In one optional implementation, obtaining the metrics data of the cloud computing server includes: In response to a request sent by a data acquisition node, a data receiving node corresponding to the data acquisition node is determined according to a load balancing strategy, wherein the data acquisition node is used to collect the indicator data of the cloud computing server; The data receiving node is used to obtain the indicator data of the cloud computing server collected and sent by the data collection node.

[0079] In some examples, the data acquisition node may include the aforementioned data acquisition module.

[0080] In some examples, the data acquisition frequency of the data acquisition node for this indicator can be configured through a "transfer as much as possible" strategy. This strategy instructs the data acquisition node to perform the next data acquisition after completing each data acquisition and transmitting the acquired data to the data receiving node. This can automatically reduce the acquisition frequency in the event of network congestion and also allow the acquisition of as much indicator data from the server as possible.

[0081] In some examples, the data receiving node can be used to distribute the received metric data to the data storage module and to anomaly detection devices for implementing anomaly detection in cloud computing services.

[0082] In some examples, since cloud computing services may be deployed on different network nodes, corresponding data acquisition nodes can be deployed on each node. However, individual data receiving nodes are difficult to scale synchronously when faced with limitations in network bandwidth and computing power. Therefore, this embodiment employs a load balancing strategy to expand the receiving end service. In specific implementation, the data acquisition node can first send a request to the anomaly detection device. The anomaly detection device can select the data receiving node with the lowest load as the data receiving end for that data acquisition node based on the current load status of each data receiving node. When the processing capacity of the selected data receiving node corresponding to the data acquisition node approaches its upper limit (this upper limit can be a preset threshold, or it can be determined by the average and / or median of the current load status of each data receiving node), a new data receiving node can be started to handle the increased data receiving tasks. During the load balancing process, the number of data acquisition nodes corresponding to each data receiving node can be monitored to ensure the distribution is as balanced as possible. When a data acquisition node disconnects from data transmission, the number of data acquisition nodes it is responsible for decreases accordingly; conversely, when a new data acquisition node connects, the number of data acquisition nodes it is responsible for increases accordingly. This can improve the efficiency and stability of the system to meet the ever-increasing demand for data processing.

[0083] In some examples, the data receiving node can also communicate with an independent distributed cluster (e.g., Kafka), which acts as a message middleware. Its high throughput and data persistence help reduce data transmission latency, thus addressing the challenges of large data volumes and strict real-time requirements encountered in this embodiment. In this embodiment, the Kafka middleware consumer uses a pull-based data model, enabling the consumer module to stably process the data stream and effectively avoid overload of the processing module due to sudden surges in data traffic, thereby ensuring continuous service availability. Thus, the aforementioned method of using the data receiving node to obtain the metric data of the cloud computing server collected and sent by the data acquisition node can include: using the data receiving node to receive the metric data sent by the data acquisition node; and using the independent distributed cluster to obtain the metric data received by the data acquisition node from the data receiving node.

[0084] In some examples, the data receiving node can also store the received indicator data in a preset database (deployed in the data storage module). The anomaly detection device can retrieve the indicator data from this preset database to enable front-end visualization and / or post-anomaly tracing. This preset database can be a MySQL database. For example, post-anomaly tracing can also be performed, such as correlating the time of the anomaly with the corresponding log entries to quickly and accurately pinpoint the cause of the anomaly. Therefore, when collecting data, a corresponding index can be added to the log file based on time and stored in the database. When an anomaly is detected on the server, Java can quickly return the anomaly-related data to the front-end for display (in specific implementations, the anomaly-related data can be encapsulated and displayed using the Echarts visualization library).

[0085] Secondly, correspondingly, this application also provides a cloud computing service anomaly detection device, which can implement all the processes of the cloud computing service anomaly detection method provided in the above embodiments.

[0086] See Figure 5 This diagram illustrates the structure of a cloud computing service anomaly detection device provided in an embodiment of this application. The anomaly detection device 500 can be deployed in a computer device and includes: The data acquisition module 501 is used to acquire indicator data of cloud computing servers, convert the indicator data into time series data, and determine the graph model structure information according to the relationship between the cloud computing servers. The time information determination module 502 is used to determine time information by calling the encoder in the graph autoencoder based on the graph model structure information and the latest preset duration data in the time series data. Prediction module 503 is used to call the decoder in the graph autoencoder based on the time information to determine anomaly detection prediction information; The result determination module 504 is used to determine the anomaly detection result of the cloud computing server based on the anomaly detection prediction information.

[0087] In one optional implementation, the graph model structure information includes an adjacency matrix, and the encoder includes a graph convolutional neural network (GCN) and a gated recurrent unit (GRU). The step of determining time information by calling the encoder in the graph autoencoder based on the graph model structure information and the most recent preset duration data in the time series data includes: Based on the most recent preset duration data, determine the hidden state of the previous moment; Based on the adjacency matrix and the hidden state of the previous time step, the GCN is invoked to determine the first spatial variable; Based on the adjacency matrix and the current time data in the most recent preset duration data, the GCN is invoked to determine the second spatial variable; Based on the first spatial variable and the second spatial variable, the GRU is invoked to determine the hidden state at the current moment; The time information is determined based on the hidden state at the current moment.

[0088] In one alternative implementation, the GRU includes a reset gate and an update gate; The step of determining the hidden state at the current moment by calling the GRU based on the first spatial variable and the second spatial variable includes: Based on the first spatial variable and the second spatial variable, the reset gate is invoked to determine the reset information; Based on the reset information, the first spatial variable, and the second spatial variable, an activation function is used to determine the candidate hidden state at the current moment; Based on the first spatial variable and the second spatial variable, the update gate is invoked to determine the update information; Based on the updated information, the first spatial variable, and the candidate hidden state at the current moment, the hidden state at the current moment is determined.

[0089] In one optional implementation, the decoder includes a fully connected layer and a nonlinear mapping layer that are electrically connected in sequence, and the anomaly detection prediction information includes a prediction score; The step of calling the decoder in the graph autoencoder based on the time information to determine the anomaly detection prediction information includes: The time information is input into the fully connected layer of the decoder to obtain the embedding features generated by the nonlinear mapping layer and output by the decoder. The predicted score is determined based on the embedded features.

[0090] In one optional implementation, determining the anomaly detection result of the cloud computing server based on the anomaly detection prediction information includes: The anomaly detection result of the cloud computing server is determined based on the comparison between the preset state score threshold and the prediction score contained in the anomaly detection prediction information.

[0091] In one optional implementation, obtaining the metrics data of the cloud computing server includes: In response to a request sent by a data acquisition node, a data receiving node corresponding to the data acquisition node is determined according to a load balancing strategy, wherein the data acquisition node is used to collect the indicator data of the cloud computing server; The data receiving node is used to obtain the indicator data of the cloud computing server collected and sent by the data collection node.

[0092] Thirdly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described in any of the above-mentioned embodiments.

[0093] Fourthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the above-described embodiments.

[0094] Fifthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0095] See Figure 6 The computer device in this embodiment includes a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601, such as a cloud computing service anomaly detection program. When the processor 601 executes the computer program, it implements the steps in the various cloud computing service anomaly detection method embodiments described above, for example... Figure 1 The steps S101-S104 are shown.

[0096] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 602 and executed by the processor 601 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the computer device.

[0097] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor 601 and a memory 602. Those skilled in the art will understand that the schematic diagram is merely an example of a computer device and does not constitute a limitation on the computer device. It may include more or fewer components than shown, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0098] The processor 601 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or processor 601 can be any conventional processor. The processor 601 is the control center of the computer device, connecting various parts of the entire computer device through various interfaces and lines.

[0099] The memory 602 can be used to store the computer programs and / or modules. The processor 601 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 602 and calling the data stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 602 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0100] Wherein, if the modules / units integrated into the computer device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a non-transitory computer-readable storage medium. When the computer program is executed by the processor 601, it can implement the steps of the various method embodiments described above. Wherein, the computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0101] In summary, the embodiments of this application have at least the following beneficial effects: By employing the embodiments of this application, indicator data of cloud computing servers is acquired and converted into time-series data. Graph model structure information is determined based on the relationships between the cloud computing servers. Based on the graph model structure information and the most recent preset duration data in the time-series data, the encoder in the graph autoencoder is invoked to determine time information. Based on the time information, the decoder in the graph autoencoder is invoked to determine anomaly detection prediction information. Based on the anomaly detection prediction information, the anomaly detection result of the cloud computing server is determined. Thus, after acquiring the indicator data of the cloud computing server, it can be converted into time-series data. This allows the graph autoencoder to use the graph model structure information as an aid to extract time information from the data corresponding to the most recent preset duration in the time-series data. This time information can then be used to help predict whether the cloud computing server has anomalies, thereby improving the accuracy of cloud service anomaly detection.

[0102] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary hardware platforms, or it can be implemented entirely by hardware. Based on this understanding, all or part of the technical solutions of this application that contribute to the background technology can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0103] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. A method for detecting anomalies in cloud computing services, characterized in that, include: Obtain the indicator data of the cloud computing server, convert the indicator data into time series data, and determine the graph model structure information based on the relationship between the cloud computing servers; Based on the graph model structure information and the most recent preset duration data in the time series data, the encoder in the graph autoencoder is called to determine the time information; Based on the time information, the decoder in the graph autoencoder is invoked to determine the anomaly detection prediction information; Based on the anomaly detection prediction information, the anomaly detection result of the cloud computing server is determined.

2. The method according to claim 1, characterized in that, The graph model structure information includes an adjacency matrix, and the encoder includes a graph convolutional neural network (GCN) and a gated recurrent unit (GRU). The step of determining time information by calling the encoder in the graph autoencoder based on the graph model structure information and the most recent preset duration data in the time series data includes: Based on the most recent preset duration data, determine the hidden state of the previous moment; Based on the adjacency matrix and the hidden state at the previous time step, the GCN is invoked to determine the first spatial variable; Based on the adjacency matrix and the current time data in the most recent preset duration data, the GCN is invoked to determine the second spatial variable; Based on the first spatial variable and the second spatial variable, the GRU is invoked to determine the hidden state at the current moment; The time information is determined based on the hidden state at the current moment.

3. The method according to claim 2, characterized in that, The GRU includes a reset gate and an update gate; The step of determining the hidden state at the current moment by calling the GRU based on the first spatial variable and the second spatial variable includes: Based on the first spatial variable and the second spatial variable, the reset gate is invoked to determine the reset information; Based on the reset information, the first spatial variable, and the second spatial variable, an activation function is used to determine the candidate hidden state at the current moment; Based on the first spatial variable and the second spatial variable, the update gate is invoked to determine the update information; Based on the updated information, the first spatial variable, and the candidate hidden state at the current moment, the hidden state at the current moment is determined.

4. The method according to claim 1, characterized in that, The decoder includes a fully connected layer and a nonlinear mapping layer that are electrically connected in sequence, and the anomaly detection prediction information includes a prediction score. The step of calling the decoder in the graph autoencoder based on the time information to determine the anomaly detection prediction information includes: The time information is input into the fully connected layer of the decoder to obtain the embedding features generated by the nonlinear mapping layer output by the decoder. The predicted score is determined based on the embedded features.

5. The method according to claim 1, characterized in that, The step of determining the anomaly detection result of the cloud computing server based on the anomaly detection prediction information includes: The anomaly detection result of the cloud computing server is determined based on the comparison between the preset state score threshold and the prediction score contained in the anomaly detection prediction information.

6. The method according to claim 1, characterized in that, The acquisition of cloud computing server metrics data includes: In response to a request sent by a data acquisition node, a data receiving node corresponding to the data acquisition node is determined according to a load balancing strategy, wherein the data acquisition node is used to collect the indicator data of the cloud computing server; The data receiving node is used to obtain the indicator data of the cloud computing server collected and sent by the data collection node.

7. A cloud computing service anomaly detection device, characterized in that, include: The data acquisition module is used to acquire indicator data of cloud computing servers, convert the indicator data into time series data, and determine the graph model structure information based on the relationship between the cloud computing servers. The time information determination module is used to determine time information by calling the encoder in the graph autoencoder based on the graph model structure information and the latest preset duration data in the time series data. The prediction module is used to call the decoder in the graph autoencoder based on the time information to determine anomaly detection prediction information; The result determination module is used to determine the anomaly detection result of the cloud computing server based on the anomaly detection prediction information.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-6.

9. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method described in any one of claims 1-6.

10. A computer device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-6.

Images