System, multivariate time series data anomaly detection method and electronic equipment

Abstract

The application relates to a system operation multivariate time sequence data anomaly detection method and electronic equipment, and belongs to the technical field of computers.The method comprises the following steps: inputting multivariate feature vectors of multiple sampling periods into a multivariate time sequence data reconstruction model according to the time step number of a sliding time window, and outputting reconstructed feature vectors; calculating an anomaly score according to the multivariate feature vectors and the reconstructed feature vectors; if it is determined that system operation multivariate time sequence data is abnormal according to the anomaly score and an anomaly score threshold, determining a conflict set according to the contribution degrees of different feature dimensions to the system operation multivariate time sequence data anomaly; matching the conflict set with feature sets of multiple preset symptom modes, calculating matching scores of the preset symptom modes, and outputting a symptom label of a preset symptom mode with the highest matching score.The application realizes feature-level interpretation of system operation multivariate time sequence data anomaly, is beneficial to operation and maintenance personnel to quickly locate which aspect index leads to the anomaly, and shortens fault troubleshooting time.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and electronic device for detecting anomalies in multi-dimensional time-series data during system operation. Background Technology

[0002] With the rapid development of cloud computing, big data, and IoT technologies, the monitoring data generated by modern IT systems and industrial control systems is exploding. This data typically exists in the form of multivariate time series data, including metrics across multiple dimensions such as CPU utilization, memory usage, disk I / O, and network traffic. Timely and accurate detection of anomalies in multivariate time series data is crucial for ensuring system stability, preventing failures, and optimizing resource scheduling. However, existing methods for detecting anomalies in multivariate time series data only determine the presence of anomalies, lacking effective feature-level anomaly interpretation mechanisms. When an anomaly is identified, maintenance personnel struggle to quickly pinpoint the specific metric causing the anomaly, prolonging troubleshooting time. Summary of the Invention

[0003] Based on the above analysis, the embodiments of the present invention aim to provide a method and electronic device for detecting anomalies in multivariate time-series data during system operation, in order to solve the problem that existing methods lack an effective feature-level anomaly interpretation mechanism, and when an anomaly is determined to occur, it is difficult for operation and maintenance personnel to quickly locate which specific indicator caused the anomaly, thus prolonging the troubleshooting time.

[0004] On one hand, embodiments of the present invention provide a method for detecting anomalies in multivariate time-series data of system operation. The method includes: inputting multivariate feature vectors corresponding to multiple sampling periods obtained from multivariate time-series data of system operation into a multivariate time-series data reconstruction model according to the number of time steps in a sliding time window and in chronological order; outputting reconstructed feature vectors corresponding to the multivariate feature vectors of multiple sampling periods; wherein the number of time steps is the same as the number of multiple sampling periods, and the multivariate time-series data reconstruction model is trained based on normal training samples of the multivariate time-series data of system operation; calculating anomaly scores based on the multivariate feature vectors of the multiple sampling periods and the reconstructed feature vectors; determining whether the multivariate time-series data of system operation is normal based on the relationship between the anomaly scores and anomaly score thresholds; in response to determining that the multivariate time-series data of system operation is abnormal, determining a conflict set based on the contribution of features of different feature dimensions in the multivariate feature vectors to the anomaly of the multivariate time-series data of system operation; wherein the conflict set includes a preset first number of features; matching the conflict set with feature sets of multiple preset symptom patterns, calculating the matching score of each preset symptom pattern, and outputting a symptom label corresponding to the preset symptom pattern with the highest matching score; wherein the symptom label includes feature-level symptom cause description information.

[0005] Further, calculating the anomaly score based on the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods includes: calculating the mean square error of the corresponding feature values ​​in the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods, and using the mean square error as the anomaly score; wherein, the mean square error is calculated by taking the time step and feature dimension as a reference, calculating the square error between the original value in the multivariate feature vector and the reconstructed value in the reconstructed feature vector, and then taking the average of the square errors obtained at each time step and each feature dimension for the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods.

[0006] Further, determining the conflict set based on the contribution of features of different feature dimensions in the multivariate feature vector to the anomalies in the multivariate time-series data of the system operation includes: calculating the squared error between the multivariate feature vector and the corresponding feature value in the reconstructed feature vector corresponding to each feature dimension based on the multivariate feature vector and the reconstructed feature vector in the last sampling period of the multiple sampling periods; determining the contribution of the feature corresponding to the feature dimension to the anomalies in the multivariate time-series data of the system operation based on the magnitude of the squared error; wherein, the larger the squared error, the greater the contribution of the feature corresponding to the feature dimension to the anomalies in the multivariate time-series data of the system operation; and constructing the conflict set based on the preset first number of features with higher contributions.

[0007] Further, after calculating the squared error between the multivariate feature vector corresponding to each feature dimension and the corresponding feature value in the reconstructed feature vector, the method further includes: summing the squared errors corresponding to each feature dimension to obtain the total error; dividing the squared errors corresponding to each feature dimension by the total error to obtain the contribution ratio of the feature corresponding to the feature dimension to the multivariate time-series data anomaly of the system operation; matching the conflict set with feature sets of multiple preset symptom patterns and calculating the matching score of each preset symptom pattern includes: matching the conflict set with feature sets of multiple preset symptom patterns to determine the matching features and the number of matching features; obtaining the matching score based on the contribution ratio of the matching features, the number of matching features, and the number of features in the conflict set.

[0008] Furthermore, the matching score is expressed as:

[0009] in, This indicates the preset symptom pattern. This represents the matching score corresponding to the preset symptom pattern. This represents the set of conflicts. This refers to the matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the contribution percentage of the matching feature. This represents the number of matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the number of features in the conflict set.

[0010] Further, determining whether the system's multivariate time-series data is normal based on the relationship between the abnormal score and the abnormal score threshold includes: determining that the system's multivariate time-series data is abnormal in response to the abnormal score being greater than the abnormal score threshold; determining that the system's multivariate time-series data is normal in response to the abnormal score being less than or equal to the abnormal score threshold; wherein, when the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input to the multivariate time-series data reconstruction model is less than a preset second number, the abnormal score threshold is a static threshold obtained based on training data; when the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input to the multivariate time-series data reconstruction model is greater than or equal to a preset second number, the abnormal score threshold is a dynamic threshold dynamically calculated based on a recent preset third number of abnormal scores.

[0011] Furthermore, the multivariate time-series data reconstruction model employs an LSTM-VAE stochastic recurrent neural network model, which includes a sequentially connected LSTM encoder, a latent space sampling layer, and an LSTM decoder. Specifically: the LSTM encoder uses a multi-layer long short-term memory network to encode the multivariate feature vectors corresponding to multiple sampling periods into hidden states; the latent space sampling layer maps the hidden states to the mean and log-variance of latent variables through fully connected layers, forming a normal distribution of the latent space, and samples the latent variables from the normal distribution using a reparameterization technique; the LSTM decoder uses a multi-layer long short-term memory network to reconstruct the multivariate feature vectors corresponding to multiple sampling periods step-by-step, using the latent variables as the initial state and the latent variables as the input for each time step, and outputs a reconstructed feature vector corresponding to the multivariate feature vectors of multiple sampling periods.

[0012] Furthermore, before inputting the multivariate feature vectors corresponding to multiple sampling periods obtained from the multivariate time-series data of system operation into the multivariate time-series data reconstruction model according to the number of time steps of the sliding time window and in chronological order, the method further includes: performing multi-dimensional feature extraction on the collected multivariate time-series data of system operation to obtain an original feature vector containing multi-dimensional features corresponding to each sampling period; performing differential scaling according to the properties of different dimensional features in the original feature vector to transform each feature value in the original feature vector to a unified target interval to obtain the multivariate feature vector.

[0013] Furthermore, the multidimensional features are categorized according to resource type into CPU-related features, memory-related features, I / O-related features, network-related features, and time-related features.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the system operation multivariate time-series data anomaly detection method as described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system operation multivariate time-series data anomaly detection method as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the system operation multi-dimensional time-series data anomaly detection method as described above.

[0017] The present invention provides a method and electronic device for detecting anomalies in multivariate time-series data of system operation. This method calculates anomaly scores based on multivariate feature vectors and reconstructed feature vectors from multiple sampling periods. After determining anomalies in the multivariate time-series data of system operation based on the anomaly scores and anomaly score thresholds, it determines conflict sets based on the contribution of features of different feature dimensions in the multivariate feature vectors to the anomalies. The conflict sets are then matched with feature sets of multiple preset symptom patterns, and the matching scores for each preset symptom pattern are calculated. The symptom label corresponding to the preset symptom pattern with the highest matching score is output. This achieves feature-level interpretation of detected anomalies in multivariate time-series data of system operation, which helps maintenance personnel quickly locate which specific indicator caused the anomaly and shortens the troubleshooting time.

[0018] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0019] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 This is a flowchart illustrating the system operation multivariate time-series data anomaly detection method provided by the present invention.

[0020] Figure 2 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0021] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0022] Figure 1 This is a flowchart illustrating the system operation multivariate time-series data anomaly detection method provided by the present invention. For example... Figure 1 As shown, the method includes: Step S1: Based on the number of time steps in the sliding time window, and in chronological order, input the multivariate feature vectors corresponding to multiple sampling periods obtained from the multivariate time series data of the system operation into the multivariate time series data reconstruction model, and output the reconstructed feature vectors corresponding to the multivariate feature vectors of multiple sampling periods; wherein, the number of time steps is the same as the number of multiple sampling periods, and the multivariate time series data reconstruction model is trained based on the normal training samples of the multivariate time series data of the system operation.

[0023] The input to the multivariate time series data reconstruction model is time series data within a sliding time window. The number of time steps in the sliding time window can be considered as the window size. The number of time steps in the sliding time window corresponds to the sampling period, and the number of time steps in the sliding time window is the same as the number of sampling periods of the time series data received by the sliding time window. The multivariate feature vectors to be input into the multivariate time series data reconstruction model can be pre-stored in a buffer. After the number of multivariate feature vectors for the sampling period, which is consistent with the number of time steps in the sliding time window, is reached, these multivariate feature vectors for the sampling period are input into the multivariate time series data reconstruction model.

[0024] Multivariate time-series data reconstruction models are pre-trained using normal training samples of multivariate time-series data from system operation. A well-trained multivariate time-series data reconstruction model exhibits good reconstruction capability and small reconstruction error for normal system operation multivariate time-series data. However, since the training data is based on normal training samples, the reconstructive capability of a well-trained multivariate time-series data reconstruction model is poor for abnormal system operation multivariate time-series data. Therefore, the reconstruction error can naturally be used as an anomaly score for the system operation multivariate time-series data. The larger the reconstruction error, the higher the anomaly score, indicating a higher degree of anomaly in the system operation multivariate time-series data.

[0025] During training, multivariate feature vectors corresponding to multiple sampling periods are obtained from training samples based on multivariate time-series data from system operation. These multivariate feature vectors are then input into the multivariate time-series data reconstruction model, which outputs reconstructed feature vectors corresponding to the multivariate feature vectors from the multiple sampling periods. Based on the multivariate feature vectors corresponding to the multiple sampling periods and the reconstructed feature vectors, a preset loss function is used for training to obtain the multivariate time-series data reconstruction model.

[0026] During online detection, multivariate feature vectors corresponding to multiple sampling periods are obtained based on real-time acquired multivariate time-series data of the system operation. According to the number of time steps in the sliding time window, these multivariate feature vectors corresponding to multiple sampling periods are input into the multivariate time-series data reconstruction model in chronological order. The output is a reconstructed feature vector corresponding to the multivariate feature vectors of multiple sampling periods. Each sampling period corresponds to one multivariate feature vector and one reconstructed feature vector.

[0027] Step S2: Calculate the anomaly score based on the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods, and determine whether the multivariate time-series data of the system is normal based on the relationship between the anomaly score and the anomaly score threshold.

[0028] Anomaly scores are calculated based on multivariate feature vectors and reconstructed feature vectors from multiple sampling periods. The better the reconstruction effect of the multivariate time-series data reconstruction model on the multivariate feature vectors, the lower the anomaly score; conversely, the higher the anomaly score. The relationship between the anomaly score and anomaly score threshold is used to determine whether the system's multivariate time-series data is normal. If the anomaly score is greater than the anomaly score threshold, the system's multivariate time-series data is considered abnormal; if the anomaly score is less than or equal to the anomaly score threshold, the system's multivariate time-series data is considered normal. Normal multivariate time-series data indicates a normal system operation, while abnormal multivariate time-series data indicates an abnormal system operation.

[0029] Step S3: In response to determining that the system operation multivariate time series data is abnormal, a conflict set is determined based on the contribution of features of different feature dimensions in the multivariate feature vector to the system operation multivariate time series data abnormality; wherein, the conflict set includes a preset first number of features.

[0030] If an anomaly is determined in the system's multivariate time-series data, a conflict set is determined based on the contribution of different feature dimensions in the multivariate feature vector to the anomaly. The purpose of determining the conflict set is to identify the main features causing the anomaly. The feature dimensions of the multivariate feature vector are the same as those of the reconstructed feature vector. The contribution of different feature dimensions of the multivariate feature vector to the anomaly is related to the value of that feature dimension in both the multivariate and reconstructed feature vectors. Depending on the specific circumstances, the contribution of different feature dimensions of the multivariate feature vector to the anomaly can be determined based on the multivariate and reconstructed feature vectors for the entire sliding time window, or based on the multivariate and reconstructed feature vectors at a specific time step within the sliding time window. The number of features included in the conflict set is a preset first number.

[0031] Step S4: Match the conflict set with the feature sets of multiple preset symptom patterns, calculate the matching score of each preset symptom pattern, and output the symptom label corresponding to the preset symptom pattern with the highest matching score; wherein, the symptom label includes feature-level symptom cause description information.

[0032] After determining the conflict set, a predetermined first number of main characteristics causing anomalies in the system's multi-dimensional time-series data are identified. Multiple symptom patterns are pre-defined, each with a feature set including at least one feature, and each pattern is labeled with a symptom tag containing a description of the symptom's cause at the feature level. For example, the features in the feature set of pre-defined symptom pattern 1 include user-mode CPU usage, load saturation, and CPU first-order differential; the symptom tag is abnormal CPU load. The features in the feature set of pre-defined symptom pattern 2 include memory leak slope, number of primary page faults, and memory utilization; the symptom tag is abnormal memory leak / growth. The features in the feature set of pre-defined symptom pattern 3 include network packet density, TCP retransmission rate, and number of active connections; the symptom tag is abnormal network congestion / packet rate.

[0033] The system matches the conflict set with feature sets of multiple preset symptom patterns, calculating the matching score for each preset symptom pattern. For example, the matching score can be obtained by counting the number of matching features obtained from matching the conflict set with the feature sets of multiple preset symptom patterns. Each preset symptom pattern has a pre-set symptom label. The symptom label corresponding to the preset symptom pattern with the highest matching score is output as the symptom label for the current system's multivariate time-series data anomaly, thus helping operations and maintenance personnel quickly locate anomalies.

[0034] The present invention provides a method for detecting anomalies in multivariate time-series data during system operation. This method calculates anomaly scores based on multivariate feature vectors and reconstructed feature vectors from multiple sampling periods. After determining anomalies in the multivariate time-series data based on the anomaly scores and anomaly score thresholds, it determines conflict sets based on the contribution of different feature dimensions in the multivariate feature vectors to the anomalies. These conflict sets are then matched with feature sets of multiple preset symptom patterns, and matching scores for each preset symptom pattern are calculated. The symptom label corresponding to the preset symptom pattern with the highest matching score is output. This method achieves feature-level interpretation of detected anomalies in multivariate time-series data during system operation, enabling maintenance personnel to quickly pinpoint the specific indicator causing the anomaly and shortening troubleshooting time.

[0035] According to the present invention, a method for detecting anomalies in multivariate time-series data during system operation calculates anomaly scores based on the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods. The method includes: calculating the mean square error of the corresponding feature values ​​in the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods, and using the mean square error as the anomaly score; wherein the mean square error is calculated by taking the time step and feature dimension as a reference, calculating the squared error between the original value in the multivariate feature vector and the reconstructed value in the reconstructed feature vector, and then taking the average of the squared errors obtained at each time step and each feature dimension.

[0036] The mean squared error (MSE) of the corresponding eigenvalues ​​in the multivariate feature vectors and reconstructed feature vectors across multiple sampling periods is calculated, and this MSE is used as the outlier score. To calculate the MSE, the squared error between the original values ​​and the reconstructed values ​​in the multivariate feature vectors with the same sampling period and feature dimension is obtained. Then, the mean of the squared errors for each sampling period and feature dimension within the sliding time window is calculated to obtain the MSE.

[0037] The present invention provides a method for detecting anomalies in multivariate time-series data. By calculating the mean square error of the corresponding feature values ​​in the multivariate feature vectors of multiple sampling periods and the reconstructed feature vectors, the mean square error is used as the anomaly score, thereby improving the accuracy of the anomaly score.

[0038] According to the present invention, a method for detecting anomalies in multivariate time-series data of system operation is provided. The method determines a conflict set based on the contribution of features of different feature dimensions in the multivariate feature vector to the anomalies in the multivariate time-series data of system operation. The method includes: calculating the squared error between the multivariate feature vector and the corresponding feature value in the reconstructed feature vector corresponding to each feature dimension, based on the multivariate feature vector and the reconstructed feature vector in the last sampling period of the plurality of sampling periods; determining the contribution of the feature corresponding to the feature dimension to the anomalies in the multivariate time-series data of system operation based on the magnitude of the squared error; wherein, the larger the squared error, the greater the contribution of the feature corresponding to the feature dimension to the anomalies in the multivariate time-series data of system operation; and constructing the conflict set based on a preset first number of features with higher contributions.

[0039] When determining the conflict set based on the contribution of different feature dimensions in the multivariate feature vector to the anomalies in the multivariate time-series data of the system, the contribution of different feature dimensions in the multivariate feature vector to the anomalies in the multivariate time-series data of the system is first determined. Since the situation in the last sampling period among multiple sampling periods better reflects the real-time status of the system, in order to obtain symptom labels that better reflect the current system status, the squared error of the corresponding feature value in the multivariate feature vector and the reconstructed feature vector corresponding to each feature dimension can be calculated based on the multivariate feature vector and the reconstructed feature vector in the last sampling period among multiple sampling periods. The contribution of different feature dimensions to the anomalies in the multivariate time-series data of the system is determined based on the magnitude of the squared error. Specifically, the larger the squared error, the greater the contribution of the corresponding feature dimension; the smaller the squared error, the smaller the contribution of the corresponding feature dimension.

[0040] The number of features in the conflict set is pre-defined as a first preset number, which is less than or equal to the number of feature dimensions in the multivariate feature vector. Features are sorted from highest to lowest contribution based on their different feature dimensions in the multivariate feature vector, and the conflict set is constructed based on the first preset number of features with the highest contribution. In other words, the features in the conflict set are the first preset number of features with the highest contribution.

[0041] The present invention provides a method for detecting anomalies in multivariate time-series data during system operation. Based on the multivariate feature vector and reconstructed feature vector of the last sampling period in multiple sampling periods, the method determines the contribution of the feature corresponding to each feature dimension to the anomalies in the multivariate time-series data during system operation by considering the square error between the multivariate feature vector and the corresponding feature value in the reconstructed feature vector for each feature dimension. A conflict set is constructed based on a preset first number of features with higher contribution. The features in the conflict set better reflect the real-time status of the system operation, which is conducive to further improving the efficiency of anomaly localization.

[0042] According to the present invention, a method for detecting anomalies in multivariate time-series data of system operation, after calculating the squared error between the multivariate feature vector corresponding to each feature dimension and the corresponding feature value in the reconstructed feature vector, the method further includes: summing the squared errors corresponding to each feature dimension to obtain a total error; dividing the squared errors corresponding to each feature dimension by the total error to obtain the contribution ratio of the feature corresponding to the feature dimension to the anomalies in the multivariate time-series data of system operation; and matching the conflict set with feature sets of multiple preset symptom patterns to calculate the matching score of each preset symptom pattern, including: matching the conflict set with feature sets of multiple preset symptom patterns to determine the matching features and the number of matching features; and obtaining the matching score based on the contribution ratio of the matching features, the number of matching features, and the number of features in the conflict set.

[0043] Based on the multivariate feature vector and reconstructed feature vector of the last sampling period in multiple sampling periods, calculate the squared error of the corresponding feature value in the multivariate feature vector and reconstructed feature vector for each feature dimension. Sum the squared errors corresponding to each feature dimension to obtain the total error. Divide the squared error corresponding to each feature dimension by the total error to obtain the contribution ratio of the feature corresponding to the feature dimension to the anomaly of the multivariate time series data of the system operation.

[0044] Simply relying on the number of matching features obtained by matching the conflict set with feature sets of multiple preset symptom patterns to determine the matching score of preset feature patterns does not take into account the contribution of different features to the anomalies in the multivariate time series data of the system operation. For example, although a certain preset symptom pattern may match a lot of features, these features may all have a small contribution to the anomalies in the multivariate time series data of the system operation. If the matching score is determined directly based on the number of matching features, it cannot better reflect the degree of matching between the current abnormal state of the system operation and the preset symptom pattern.

[0045] In this embodiment, when determining the matching score of multiple preset symptom patterns, the conflict set is matched with the feature set of multiple preset symptom patterns to determine the matching features and the number of matching features; the matching score is obtained based on the contribution ratio of the matching features, the number of matching features, and the number of features in the conflict set.

[0046] The present invention provides a method for detecting anomalies in multivariate time-series data during system operation. By matching a conflict set with feature sets of multiple preset symptom patterns, matching features and the number of matching features are determined. A matching score is obtained based on the contribution ratio of the matching features, the number of matching features, and the number of features in the conflict set, thereby improving the accuracy of the matching score.

[0047] According to the present invention, a method for detecting anomalies in multivariate time-series data during system operation is provided, wherein the matching score is represented as:

[0048] in, This indicates the preset symptom pattern. This represents the matching score corresponding to the preset symptom pattern. This represents the set of conflicts. This refers to the matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the contribution percentage of the matching feature. This represents the number of matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the number of features in the conflict set.

[0049] The system operation multivariate time series data anomaly detection method provided by the present invention obtains the matching score by weighted summation of the feature contribution degree and the number of matching features of each matching feature. It can comprehensively consider the influence of the feature contribution degree and the number of matching features on the system operation multivariate time series data, and further improve the accuracy of the matching score.

[0050] According to the present invention, a method for detecting anomalies in multivariate time-series data of system operation is provided. The method determines whether the multivariate time-series data of system operation is normal based on the relationship between the anomaly score and the anomaly score threshold. The method includes: determining that the multivariate time-series data of system operation is abnormal in response to the anomaly score being greater than the anomaly score threshold; and determining that the multivariate time-series data of system operation is normal in response to the anomaly score being less than or equal to the anomaly score threshold. Specifically, when the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input to the multivariate time-series data reconstruction model is less than a preset second number, the anomaly score threshold is a static threshold obtained based on training data; when the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input to the multivariate time-series data reconstruction model is greater than or equal to a preset second number, the anomaly score threshold is a dynamic threshold dynamically calculated based on a recently preset third number of anomaly scores.

[0051] When determining whether the system's multivariate time-series data is normal based on the relationship between the anomaly score and the anomaly score threshold, if the anomaly score is greater than the threshold, the system's multivariate time-series data is considered abnormal; if the anomaly score is less than or equal to the threshold, the system's multivariate time-series data is considered normal. Specifically, when the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input multivariate time-series data reconstruction model is less than a preset second number, a static threshold obtained from the training data is used as the anomaly score threshold. When the number of sampling periods corresponding to the multivariate feature vectors of the cumulative input multivariate time-series data reconstruction model is greater than or equal to the preset second number, the system automatically switches to a dynamic threshold calculated based on a recently preset third number of anomaly scores. Anomaly scores can be stored in an anomaly score queue. Each time a new anomaly score is generated, the anomaly score queue is updated and the dynamic threshold is recalculated to ensure that the dynamic threshold reflects recent changes in the distribution of anomaly scores in real time. The static threshold is also retained as a fallback option.

[0052] If for each newly added sampling period corresponding to a multivariate feature vector, the multivariate feature vectors corresponding to multiple sampling periods in the multivariate time series data reconstruction model are updated accordingly, then the preset third quantity satisfies: The second preset quantity is greater than or equal to the number of time steps in the sliding time window.

[0053] Among them, the static threshold obtained based on the training data can be determined based on the distribution of abnormal scores in the training data, such as the 90th percentile.

[0054] The calculation of dynamic thresholds supports two RobustScaler statistical methods: (1) MAD (Median Absolute Deviation) method: based on the sequence of the third most recent outlier score. The dynamic threshold is calculated using the median and MAD, where N = a preset third quantity. The dynamic threshold is expressed as:

[0055] in, , The values ​​range from 1 to N. Indicates a dynamic threshold. This indicates that the median is being calculated. The parameter is a multiple. This method is insensitive to outliers and can effectively resist the interference of a few extreme scores on the threshold.

[0056] (2) Percentile method: directly take the specified high percentile of the third number of abnormal scores as the threshold.

[0057]

[0058] in The preset quantile can be adjusted according to the sensitivity requirements of the business.

[0059] In addition, the exponentially weighted moving average (EWMA) can be used to smooth the dynamic threshold, avoiding drastic fluctuations in the threshold due to a single outlier score.

[0060] The system operation multivariate time-series data anomaly detection method provided by the present invention takes into account both the stability of cold start and the adaptability of long-term operation by adopting a dual-layer anomaly score threshold mechanism of static threshold and dynamic threshold.

[0061] According to the present invention, a method for detecting anomalies in multivariate time-series data during system operation is provided. The multivariate time-series data reconstruction model adopts an LSTM-VAE stochastic recurrent neural network model, which includes a sequentially connected LSTM encoder, a latent space sampling layer, and an LSTM decoder. Specifically: the LSTM encoder employs a multilayer long short-term memory network to encode the multivariate feature vectors corresponding to multiple sampling periods into hidden states; the latent space sampling layer maps the hidden states to the mean and log-variance of latent variables through fully connected layers, forming a normal distribution of the latent space, and samples the latent variables from the normal distribution using a reparameterization technique; the LSTM decoder employs a multilayer long short-term memory network to reconstruct the multivariate feature vectors corresponding to multiple sampling periods step-by-step, using the latent variables as the initial state and the latent variables as the input for each time step, and outputs a reconstructed feature vector corresponding to the multivariate feature vectors of multiple sampling periods.

[0062] The multivariate time series data reconstruction model adopts the LSTM-VAE stochastic recurrent neural network model, which includes a sequentially connected LSTM encoder, latent space sampling layer and LSTM decoder.

[0063] The LSTM encoder employs a multi-layer Long Short-Term Memory (LSTM) network to capture the temporal dependencies between multivariate features within a sliding time window, encoding the multivariate feature vectors corresponding to multiple sampling periods throughout the sliding time window into fixed-dimensional hidden states. The input to the LSTM encoder is the multivariate feature vectors corresponding to multiple sampling periods. ,in, This indicates the number of time steps contained in the sliding time window. This represents the number of feature dimensions in a multivariate feature vector. The LSTM encoder encodes the input multivariate feature vector corresponding to multiple sampling periods and outputs the hidden state at the last time step. H is the dimension of the LSTM hidden layer.

[0064] The latent space sampling layer is used to sample the hidden states through two fully connected layers. Mapped to the mean of the latent variables Sum of logarithmic variance This forms a normal distribution in the latent space. Here, L is a model hyperparameter, predetermined through experiments; in this embodiment, it is set to 8. Low-dimensional latent variables are sampled from this normal distribution using a reparameterization technique. This achieves stochastic modeling. The dimensionality of the latent space is not set too high to avoid the model having excessive memory capacity, which would also reconstruct anomalies well, thus weakening the anomaly score. The sampling formula for the reparameterization technique is:

[0065] in, To achieve reparameterized sampling, the sample must conform to a standard normal distribution with zero mean.

[0066] The LSTM decoder employs a multi-layer long short-term memory network to handle latent variables. As the initial state, and with latent variables As the input for each time step, the multivariate feature vector corresponding to multiple sampling periods is reconstructed step by step. The output is a multivariate feature vector corresponding to multiple sampling periods. The reconstructed feature vector.

[0067] The LSTM-VAE stochastic recurrent neural network model employs a dual warm-up strategy during training: In the first warm-up phase, the first N samples are used only to fill the historical queue, ensuring that features dependent on historical data (such as differences and slopes) can be correctly calculated; in the second warm-up phase, the last M samples are used to acquire relevant parameters and train the model, including scaling parameters. During training, the model parameters are optimized by minimizing the weighted sum of reconstruction error and KL divergence. The training loss function is:

[0068] in, Represents the loss function. This indicates the number of samples, which is also the number of time steps in the sliding time window. This indicates that the input to the LSTM-VAE stochastic recurrent neural network model corresponds to the first... Multivariate feature vectors at each time step This indicates that the LSTM-VAE stochastic recurrent neural network model corresponds to the first... Reconstructed feature vectors at each time step. Represents the KL divergence weights. The KL divergence is used to measure the difference between the normal distribution and the standard normal distribution of a latent variable. Represents the identity matrix. It is the square of the L2 norm, which is the reconstruction error term.

[0069] Compared with traditional methods, the LSTM-VAE stochastic recurrent neural network model has the following advantages: First, through the encoder-decoder structure, the model can learn a compact representation of normal patterns, and the reconstruction error can naturally be used as anomaly score; second, the random sampling of the latent space makes the model robust to noise, avoiding the oversensitivity of deterministic models to small fluctuations; third, the temporal gating mechanism of LSTM effectively captures long-term dependencies, enabling the model to perceive trend anomalies and sudden anomalies. Experiments show that, while maintaining detection accuracy, a 2-layer LSTM and an 8-dimensional latent space can achieve excellent performance, significantly reducing computational overhead and avoiding overfitting.

[0070] The present invention provides a method for detecting anomalies in multivariate time-series data. By using multivariate time-series data from an LSTM encoder, a latent space sampling layer, and an LSTM decoder to reconstruct the model, and by making the latent variables serve as both the initial state of the LSTM decoder and the input for each time step, the LSTM decoder can continuously obtain global window information throughout the entire sequence reconstruction process, thereby improving the stability of the model reconstruction.

[0071] According to the present invention, a method for detecting anomalies in multivariate time-series data of system operation, before inputting multivariate feature vectors corresponding to multiple sampling periods obtained from multivariate time-series data of system operation into a multivariate time-series data reconstruction model according to the number of time steps of the sliding time window and in chronological order, the method further includes: extracting multidimensional features from the collected multivariate time-series data of system operation to obtain an original feature vector containing multidimensional features corresponding to each sampling period; performing differential scaling according to the properties of different dimensional features in the original feature vector to transform each feature value in the original feature vector to a unified target interval to obtain the multivariate feature vector.

[0072] Before inputting the multivariate feature vectors corresponding to multiple sampling periods obtained from the multivariate time series data of system operation into the multivariate time series data reconstruction model according to the number of time steps of the sliding time window and in chronological order, multidimensional feature extraction is performed on the collected multivariate time series data of system operation to obtain the original feature vector containing multidimensional features corresponding to each sampling period. Based on the properties of different dimensional features in the original feature vector, differential scaling is performed to transform each feature value in the original feature vector to a unified target interval, thus obtaining the multivariate feature vector.

[0073] For features with clear physical boundaries (such as 0~100%, 0~1), a linear bounded mapping formula is used to normalize them to the target interval (such as [-1,1]). The linear bounded mapping formula is expressed as:

[0074] in, and To remove outliers, the lower and upper bounds of the original eigenvalues ​​are used. and These are the upper and lower limits of the target interval. These are the original eigenvalues. These are the scaled, standardized feature values. Indicates will Crop to and Within the range formed.

[0075] For unbounded features, robust scaling is performed using the RobustScaler formula based on the median and interquartile range, expressed as:

[0076] in, This represents the features before scaling. This represents the scaled feature. The median of the training data. The interquartile range of the training data is used. Subsequently, the scaled values ​​are cropped: they are restricted to a preset global range (e.g., [-20, 20]) to prevent numerical overflow or model input malfunction due to extreme outliers. After cropping, the value range is unified to a target interval, such as [-1, 1], through linear mapping. This "cropping + remapping" step has several advantages: first, it eliminates the impact of extreme values ​​on subsequent model training; second, it ensures that all features ultimately fall within the same target interval, which is beneficial to the stability of neural network gradient propagation; third, it preserves the relative size relationship between features, enabling the model to fairly learn the importance of each dimension. During online detection, the scaling parameters obtained based on the training data are used. and .

[0077] Specifically, for time features, a weighting factor `time_scale` is applied. The purpose of this design is to ensure that time features serve only as auxiliary context during model training, rather than dominating the reconstruction error, thereby preventing the model from overfitting to the time period and ignoring changes in core resource metrics.

[0078] The system operation anomaly detection method for multivariate time series data provided by this invention obtains the original feature vector through multidimensional feature extraction and obtains the multivariate feature vector through differential scaling. This method not only preserves the physical meaning of the features but also ensures numerical stability and the balance of input distribution, providing high-quality standardized input for multivariate time series data reconstruction models.

[0079] According to the present invention, a method for detecting anomalies in multi-dimensional time-series data of system operation is provided, wherein the multi-dimensional features are classified into CPU-related features, memory-related features, I / O-related features, network-related features, and time-related features according to resource type.

[0080] Following the principle of combining domain knowledge-driven approaches with statistical characteristics, this embodiment transforms raw system metrics (such as CPU utilization, memory usage, disk I / O, and network traffic) into engineering features with clear physical meanings. This embodiment uses five categories of features as examples, but is not limited to this. Specifically, multidimensional features are categorized by resource type into five main types: CPU (Central Processing Unit), memory, I / O, network, and time. Each category can be further subdivided into static values, rates of change, statistics, and periodic codes, thereby comprehensively characterizing the system state. Specifically, CPU-related features can include user-mode CPU percentage, system-mode CPU percentage, load saturation, network CPU anchor value, and CPU first-order difference, used to capture anomalies in CPU load levels, system call overhead, and network linkage; memory-related features can cover memory utilization, memory leak slope, number of primary page faults, number of swap space usage, and file descriptor occupancy ratio, which can keenly reflect memory pressure, leak trends, and resource exhaustion risks; I / O-related features can include I / O wait percentage, number of disk queue depths, disk utilization, and I / O throughput efficiency, used to identify disk bottlenecks and insufficient space; network-related features can include network packet density, TCP (Transmission Control Protocol) retransmission rate, number of SYN (Synchronize) receptions, number of active connections, and network error packet loss rate, which can detect network congestion, attacks, and link quality issues; time-related features can use hourly sine / cosine coding to provide daily periodic context, helping the model distinguish normal patterns in different time periods.

[0081] Employing a scalable architecture, this invention provides standardized feature definitions and computation interfaces, allowing users to customize and extend feature sets according to specific application scenarios (such as different industries and system types). For example, for financial trading systems, business features such as transaction volume and response time can be added; for industrial control systems, physical features such as sensor readings and equipment status can be introduced. This flexibility enables the invention to quickly adapt to anomaly detection needs in various fields, exhibiting good versatility and portability.

[0082] The system operation multivariate time series data anomaly detection method provided by this invention, through multi-dimensional and multi-level feature design, enables the multivariate time series data reconstruction model to directly learn anomaly patterns that are strongly related to business, avoiding the interference of noise and redundancy in the original indicators, and providing high-quality input for the multivariate time series data reconstruction model.

[0083] Figure 2 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 2 As shown, the electronic device may include a processor 210, a communications interface 220, a memory 230, and a communication bus 240, wherein the processor 210, the communications interface 220, and the memory 230 communicate with each other via the communication bus 240. The processor 210 can call logical instructions in the memory 230 to execute the system operation multi-dimensional timing data anomaly detection method provided in the above embodiments.

[0084] Furthermore, the logical instructions in the aforementioned memory 230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the system operation multi-time series data anomaly detection method provided in the above embodiments.

[0086] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the system operation multi-time series data anomaly detection method provided in the above embodiments.

[0087] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0088] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0089] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0091] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in multi-dimensional time-series data during system operation, characterized in that, include: Based on the number of time steps in the sliding time window, and in chronological order, the multi-dimensional feature vectors corresponding to multiple sampling periods obtained from the multi-dimensional feature extraction of the collected system operation multi-dimensional time-series data are input into the multi-dimensional time-series data reconstruction model, and the reconstructed feature vectors corresponding to the multi-dimensional feature vectors of multiple sampling periods are output. The number of time steps is the same as the number of multiple sampling periods, and the multi-dimensional time-series data reconstruction model is trained based on normal training samples of the system operation multi-dimensional time-series data. The multi-dimensional features are categorized by resource type into CPU-related features, memory-related features, I / O-related features, network-related features, and time-related features. Anomaly scores are calculated based on the multivariate feature vectors and the reconstructed feature vectors of the multiple sampling periods. The relationship between the anomaly scores and the anomaly score threshold is used to determine whether the multivariate time-series data of the system operation is normal. In response to determining that the system's multivariate time-series data is abnormal, a conflict set is determined based on the contribution of features of different feature dimensions in the multivariate feature vector to the system's multivariate time-series data anomaly. This includes: calculating the squared error between the multivariate feature vector and the corresponding feature value in the reconstructed feature vector for each feature dimension, based on the multivariate feature vector and the reconstructed feature vector in the last sampling period of the plurality of sampling periods; determining the contribution of the feature corresponding to the feature dimension to the system's multivariate time-series data anomaly based on the magnitude of the squared error; wherein, the larger the squared error, the greater the contribution of the feature corresponding to the feature dimension to the system's multivariate time-series data anomaly; and constructing the conflict set based on a preset first number of features with higher contributions; wherein the conflict set includes the preset first number of features. The conflict set is matched with the feature sets of multiple preset symptom patterns, the matching score of each preset symptom pattern is calculated, and the symptom label corresponding to the preset symptom pattern with the highest matching score is output; wherein, the symptom label includes feature-level symptom cause description information, and the feature set of each preset symptom pattern includes at least one feature; After calculating the squared error between the multivariate feature vector corresponding to each feature dimension and the corresponding feature value in the reconstructed feature vector, the method further includes: summing the squared errors corresponding to each feature dimension to obtain the total error; dividing the squared errors corresponding to each feature dimension by the total error to obtain the contribution ratio of the feature corresponding to the feature dimension to the anomaly of the multivariate time series data of the system operation; The system operates a multivariate time-series data anomaly detection method to match the conflict set with feature sets of multiple preset symptom patterns and calculate the matching score for each preset symptom pattern. This includes: matching the conflict set with feature sets of multiple preset symptom patterns to determine matching features and the number of matching features; and obtaining the matching score based on the contribution ratio of the matching features, the number of matching features, and the number of features in the conflict set. The matching score is represented as: in, This indicates the preset symptom pattern. This represents the matching score corresponding to the preset symptom pattern. This represents the set of conflicts. This refers to the matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the contribution percentage of the matching feature. This represents the number of matching features obtained by matching the conflict set with the feature set of the preset symptom pattern. This indicates the number of features in the conflict set.

2. The method for detecting anomalies in multi-dimensional time-series data during system operation according to claim 1, characterized in that, Anomaly scores are calculated based on the multivariate feature vectors from the multiple sampling periods and the reconstructed feature vectors, including: The mean square error of the corresponding feature values ​​in the multivariate feature vector and the reconstructed feature vector for the multiple sampling periods is calculated, and the mean square error is used as the anomaly score; wherein, the mean square error is calculated by taking the time step and feature dimension as the basis for calculating the square error between the original value in the multivariate feature vector and the reconstructed value in the reconstructed feature vector for the multivariate feature vector and the reconstructed feature vector for the multiple sampling periods, and then taking the mean of the square errors obtained at each time step and each feature dimension.

3. The method for detecting anomalies in multi-dimensional time-series data during system operation according to claim 1, characterized in that, Determining whether the system's multivariate time-series data is normal based on the relationship between the anomaly score and the anomaly score threshold includes: In response to the anomaly score being greater than the anomaly score threshold, it is determined that the system's multivariate time-series data is abnormal; In response to the anomaly score being less than or equal to the anomaly score threshold, it is determined that the system's multivariate time-series data is normal. Wherein, when the number of sampling periods corresponding to the multivariate feature vectors of the multivariate time series data reconstruction model is less than a preset second number, the anomaly score threshold adopts a static threshold obtained based on training data; when the number of sampling periods corresponding to the multivariate feature vectors of the multivariate time series data reconstruction model is greater than or equal to a preset second number, the anomaly score threshold adopts a dynamic threshold dynamically calculated based on the recent preset third number of anomaly scores.

4. The method for detecting anomalies in multi-dimensional time-series data during system operation according to claim 1, characterized in that, The multivariate time-series data reconstruction model employs an LSTM-VAE stochastic recurrent neural network model, which includes a sequentially connected LSTM encoder, a latent spatial sampling layer, and an LSTM decoder; wherein: The LSTM encoder employs a multi-layer long short-term memory network to encode the multivariate feature vectors corresponding to multiple sampling periods into hidden states. The latent space sampling layer is used to map the hidden state to the mean and log-variance of the latent variables through a fully connected layer, forming a normal distribution of the latent space, and to sample the latent variables from the normal distribution through a reparameterization technique. The LSTM decoder employs a multi-layer long short-term memory network to reconstruct the multivariate feature vector corresponding to multiple sampling periods step by step, using the latent variables as the initial state and the latent variables as the input for each time step, and outputs the reconstructed feature vector corresponding to the multivariate feature vector of multiple sampling periods.

5. The method for detecting anomalies in multi-dimensional time-series data during system operation according to claim 1, characterized in that, Before inputting the multivariate feature vectors corresponding to multiple sampling periods obtained from the multivariate time-series data of the system operation into the multivariate time-series data reconstruction model according to the number of time steps of the sliding time window and in chronological order, the method further includes: Multidimensional feature extraction is performed on the collected multi-dimensional time-series data of system operation to obtain the original feature vector containing multidimensional features corresponding to each sampling period; Based on the properties of different dimensions of features in the original feature vector, differential scaling is performed to transform each feature value in the original feature vector to a unified target range, thus obtaining the multivariate feature vector.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the system operation multi-dimensional time-series data anomaly detection method as described in any one of claims 1 to 5.

Images