Anomaly detection method and system

Abstract

This invention discloses an anomaly detection method and system, relating to the field of cloud computing technology. The method includes processing collected time-series monitoring data into data processing objects with unique object identifiers according to data detection granularity; performing time-frequency analysis on the data processing objects to generate feature fingerprints with write-prohibited and modification-prohibited attributes based on the analysis results; using an anomaly recognition model to identify anomalies in the feature fingerprints, obtaining a first anomaly probability value and an uncertainty coefficient; if, based on the uncertainty coefficient and the first anomaly probability value, it is determined that the model identification result should not be adopted, a central controller determines a second anomaly probability value by retrieving and analyzing historical data, and combines this second anomaly probability value with the first anomaly probability value to determine the final anomaly detection result. This invention can solve the problem that related technologies cannot meet users' anomaly detection needs for cloud data centers, achieving a globally optimal balance between real-time anomaly detection, resource overhead, and diagnostic accuracy.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to an anomaly detection method and system. Background Technology

[0002] As cloud infrastructure continues to expand, the amount of monitoring metrics data for cloud systems is growing exponentially. Related technologies struggle to achieve a balance between real-time anomaly detection, resource overhead, and diagnostic accuracy in monitoring this massive volume of metrics.

[0003] Therefore, achieving a globally optimal balance between real-time anomaly detection, resource overhead, and diagnostic accuracy in cloud systems is a technical problem that needs to be solved by those skilled in the art.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This invention provides an anomaly detection method and system that achieves a globally optimal balance between real-time anomaly detection, resource overhead, and diagnostic accuracy in cloud systems, thereby improving fault diagnosis accuracy while ensuring real-time anomaly detection and low resource overhead.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides an anomaly detection method, comprising: The collected time-series monitoring data is processed into data processing objects with unique object identifiers according to the data detection granularity. Perform time-frequency analysis on the data processing object, and generate a feature fingerprint with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results; The trained anomaly detection model is used to perform anomaly detection on the feature fingerprint to obtain a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model's detection result. When it is determined, based on the uncertainty coefficient and the first anomaly probability value, that the anomaly detection result should not be the model recognition result, then the anomaly detection result fed back by the central controller should be used. The central controller determines a second anomaly probability value based on the feature fingerprint by retrieving and analyzing historical data, and combines the first anomaly probability value and the second anomaly probability value as an anomaly detection result according to the uncertainty coefficient and the consistency of the retrieval results.

[0007] Another aspect of the present invention provides an anomaly detection method, comprising: Receive an anomaly identification request sent by the edge controller; the anomaly identification request includes at least the feature fingerprint of the data processing object corresponding to the suspected abnormal data, the model identification result of the data processing object, and the uncertainty coefficient that quantifies the uncertainty of the model identification result; Based on the aforementioned characteristic fingerprint, a second anomaly probability value is determined by retrieving and analyzing historical data; Based on the uncertainty coefficient and the consistency of the search results, the first anomaly probability value and the second anomaly probability value are fused together as the anomaly detection result, and the anomaly detection result is sent to the edge controller so that the edge controller can use it as the anomaly detection result of the data processing object. The edge controller processes the collected time-series monitoring data into data processing objects with unique object identifiers according to the data detection granularity; performs time-frequency analysis on the data processing objects, and generates feature fingerprints with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results; uses a trained anomaly recognition model to perform anomaly recognition on the feature fingerprints, and obtains a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model recognition result; when it is determined, based on the uncertainty coefficient and the first anomaly probability value, that the anomaly detection result does not adopt the model recognition result, an anomaly recognition request is sent to the central controller.

[0008] Finally, the present invention also provides an anomaly detection system, including an edge controller and a central controller. The edge controller is deployed on the monitored device of the cloud system, and the central controller is deployed on the management device of the cloud system. The monitored device is a computing device or a virtual machine host of the cloud system. The edge controller is used to implement the above-mentioned steps of the corresponding anomaly detection method when executing a computer program; the central controller is used to implement the above-mentioned steps of the corresponding anomaly detection method when executing a computer program.

[0009] The advantages of the technical solution provided by this invention are as follows: by converting the collected time-series monitoring data into feature fingerprints with unique identifiers and write-prohibited and modification-prohibited attributes, the consistency and immutability of the data during edge-side processing are guaranteed, providing reliable input for subsequent analysis; most routine detections are completed at the edge using a lightweight signal processing and anomaly recognition model, that is, when the anomaly recognition model has a high confidence level in the current input data, the local result is directly adopted, achieving millisecond-level response and significantly reducing invalid data transmission; only in gray-area scenarios where the anomaly recognition model at the edge has insufficient confidence, that is, when the uncertainty coefficient and the first anomaly probability value indicate that the model cannot reliably detect the anomaly, is the solution provided. During the judgment process, the central controller is invoked to retrieve historical data based on feature fingerprints and fuse a second anomaly probability value. This limits high-cost deep analysis to a limited number of gray-area scenarios, avoiding network congestion and wasted computing power caused by uploading all data to the cloud. Furthermore, it improves the diagnostic accuracy of complex faults by comparing historical cases with large models. Simultaneously, the central controller dynamically fuses the two probability values ​​based on the uncertainty coefficient and retrieval consistency, achieving a globally optimal balance between edge real-time performance and central accuracy in the final detection result. This significantly reduces false alarm and false negative rates and enhances the system's adaptability to unknown fault modes, achieving a globally optimal balance between detection real-time performance, resource overhead, and diagnostic accuracy. In addition, this invention provides a corresponding implementation system for the anomaly detection method, which has corresponding advantages. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the present invention or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating an anomaly detection method provided by the present invention; Figure 2 A flowchart illustrating another anomaly detection method provided by the present invention; Figure 3 This is a schematic diagram of the data windowing and feature processing flow in an exemplary application scenario provided by the present invention; Figure 4 This is a schematic diagram of the anomaly identification and gray area processing flow in an exemplary application scenario provided by the present invention. Figure 5 This is a flowchart illustrating the third anomaly detection method provided by the present invention; Figure 6 This is a structural framework diagram of an exemplary embodiment of the anomaly detection device provided by the present invention; Figure 7 This is a structural diagram of an exemplary embodiment of the anomaly detection system provided by the present invention; Figure 8 A schematic diagram of the hardware framework applicable to the anomaly detection method provided by the present invention. Detailed Implementation

[0012] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. In this specification and the aforementioned drawings, the terms "first," "second," "third," "fourth," etc., are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. The term "exemplary" means "serving as an example, embodiment, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as superior to or better than other embodiments.

[0013] With the rapid development of cloud computing technology, the number of computing nodes in cloud systems can reach tens of thousands, and the number of virtual machines and container instances can reach hundreds of thousands, resulting in millions of performance metric sampling points per second. A cloud system includes a cloud management platform, a cloud virtualization environment, and a cloud data center. The cloud management platform runs on top of the cloud virtualization environment, which is built on the physical infrastructure of the cloud data center. The time-series data generated by cloud systems is characterized by high dimensionality, strong burstiness, and non-stationarity, placing high demands on the overall anomaly detection capabilities and real-time performance of the cloud system.

[0014] Traditional operation and maintenance monitoring methods use static threshold alarms, such as setting a CPU utilization rate exceeding 80% as an anomaly. While this method is simple to implement, the distribution of metrics varies significantly under different business loads, and static thresholds cannot adapt to the dynamic changes in cloud load. For example, during peak business periods, high utilization may be normal behavior, leading to a large number of invalid alarms; while during off-peak periods, early faults such as memory leaks or deadlocks only cause minor fluctuations in metrics, easily overlooked by thresholds, resulting in missed alarms.

[0015] To address the lack of adaptability to indicator trends and context in traditional methods, leading to false positives and false negatives, a related technology aggregates raw monitoring data from all edge nodes to a central analysis cluster in real time, utilizing deep neural networks (such as LSTM and VAE) for unified inference. However, uploading massive amounts of raw data consumes east-west network bandwidth, easily causing network congestion, especially when thousands of nodes are transmitting concurrently. The central cluster requires enormous storage and computing resources to process the continuously flowing high-dimensional data, resulting in detection and processing latency typically reaching minutes, failing to meet the second-level detection requirements of core businesses. Furthermore, the centralized architecture relies too heavily on the reliability of the central node; a single point of failure can cause global monitoring to fail.

[0016] Another related technology deploys lightweight models on edge nodes (such as host machines or containers) to perform anomaly detection locally, thus avoiding data uploads. However, edge nodes have limited computing resources, typically allocating only a small number of CPU cores and memory to the monitoring process. The model must use simple decision trees or linear classifiers, making it difficult to fit complex, nonlinear fault modes. Furthermore, each edge node operates independently, unable to share fault case knowledge accumulated from other nodes or historical periods, creating data silos. When encountering unseen or problematic samples near the decision boundary—i.e., gray-zone samples—the recognition rate of the edge model drops significantly, while the false positive rate remains high.

[0017] It is evident that related technologies each have significant shortcomings in real-time performance, resource overhead, or diagnostic accuracy. Especially when the model's confidence in judging the data processing object is insufficient—for example, when the probability score is close to a threshold, the internal decision tree has significant divergence, or the sample features deviate from the training distribution—related technologies either directly output unreliable results or unconditionally send data to the center, leading to resource waste. They cannot achieve collaborative anomaly detection that dynamically distributes data based on sample uncertainty, performs low-cost initial screening at the edge, and then uses a deep knowledge base for comparison and verification with a large model on demand at the center. Therefore, this invention utilizes a lightweight signal processing and anomaly recognition model at the edge to complete most routine detections. Only in gray-area scenarios where the anomaly recognition model's confidence is insufficient does the central controller call upon large-scale resources for deep comparative diagnosis, thus achieving a globally optimal balance between detection real-time performance, resource overhead, and diagnostic accuracy. The various non-limiting embodiments of this invention are described in detail below with reference to the accompanying drawings and specific implementation details. Please refer to [link to relevant documentation] first. Figure 1 and Figure 2 According to an anomaly detection method provided by the present invention, in some embodiments of the method, the method includes the following steps: S101: The collected time-series monitoring data is processed into data processing objects with unique object identifiers according to the data detection granularity.

[0018] Time-series monitoring data consists of continuously collected performance metrics in chronological order, such as CPU utilization recorded every 15 seconds or IO wait time per second. Each data point can include a timestamp and a metric value. Data detection granularity refers to the length of time a continuous time series is divided into data processing units, such as a 60-second window, which constitutes one data processing unit. A data processing object is a structure that encapsulates the time-series data within a specified data processing unit, carrying a unique identifier for easy system tracking and management. The object identifier is a globally unique identifier (such as a UUID) used to uniquely distinguish data processing objects in different data processing units within a distributed system, ensuring end-to-end data consistency.

[0019] This step involves the edge controller collecting time-series monitoring data (such as CPU utilization sequences) from its subordinate computing devices, virtual machines, etc., and processing it into a data processing object with a unique object identifier (such as UUID-001) according to the data detection granularity (e.g., one window every 60 seconds). This data processing object encapsulates all the time-series data within the 60-second window.

[0020] S102: Perform time-frequency analysis on the data processing object, and generate a feature fingerprint with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results.

[0021] Time-frequency analysis is an analytical method that transforms time-domain signals (values ​​that change over time) into the frequency domain (energy distributed according to frequency). Feature fingerprints are a set of vector data or matrices extracted from the raw data to characterize its features, serving as input for the S103 anomaly detection model and for the central controller's retrieval and analysis. Write-prohibited attributes prevent any new data write operations after feature fingerprint generation, ensuring data accuracy. Modification-prohibited attributes prevent modifications to existing data after feature fingerprint generation, ensuring data consistency during analysis.

[0022] In this step, any time-frequency analysis method can be used to perform time-frequency analysis on the data processing object to obtain the multi-band energy characteristics of the data processing object. Based on the multi-band energy characteristics, a corresponding feature fingerprint is generated, and the attributes of the feature fingerprint are configured as write-prohibited and modification-prohibited. Once the feature fingerprint is generated, no new data can be written or existing data can be modified to ensure the data consistency of subsequent analysis.

[0023] S103: Use the trained anomaly recognition model to perform anomaly recognition on the feature fingerprint, and obtain the first anomaly probability value and the uncertainty coefficient used to quantify the uncertainty of the model recognition result.

[0024] The anomaly detection model is a pre-trained machine learning model used to output anomaly probability values ​​based on input features. The first anomaly probability value is the numerical probability of an anomaly output by the anomaly detection model, representing the probability that the current sample belongs to the anomaly category; its value typically ranges from 0 to 1. The uncertainty coefficient is a comprehensive indicator that quantifies the model's confidence in its own judgment results; a higher value indicates greater uncertainty from the model.

[0025] S104: If, based on the uncertainty coefficient and the first anomaly probability value, it is determined that the anomaly detection result should not be the model identification result, then the anomaly detection result fed back by the central controller should be used.

[0026] The central controller, a processor deployed in the management cluster, is responsible for receiving data from the edge that cannot be accurately identified as anomalies—data from gray-zone scenarios. It performs deep diagnostics by retrieving historical knowledge and invoking deployed neural network models. The second anomaly probability value is the anomaly probability value output by the central controller after analyzing historical data and the neural network model. Fusion is the process of directly summing the first and second anomaly probability values ​​or performing a weighted sum according to their respective weights to obtain the final anomaly detection result.

[0027] The previous step used a trained anomaly detection model to identify anomalies in the feature fingerprint of S102. The model outputs a first anomaly probability value (e.g., 0.58) and an uncertainty coefficient (e.g., 0.85). If the model's identification result is adopted based on the uncertainty coefficient and the first anomaly probability value, then the first anomaly probability value is directly output as the anomaly detection result for this time. If the model's identification result is not adopted, for example, if the uncertainty coefficient is too high or the probability value is close to the decision boundary of 0.5, then an anomaly identification request is sent to the central controller, along with all relevant data. Based on the feature fingerprint, the central controller determines a second anomaly probability value by retrieving and analyzing historical data. Based on the uncertainty coefficient and the consistency of the retrieval results, the central controller merges the first and second anomaly probability values ​​as the anomaly detection result and feeds it back to the corresponding edge side. The edge side will use the anomaly detection result fed back by the central controller as the anomaly detection result for this time. By adopting a diversion method of initial screening at the edge side and in-depth analysis at the central side, routine anomalies are processed at the edge side in milliseconds, while difficult gray area data is sent to the center. This achieves a balance between real-time detection and accuracy, significantly reducing the false alarm rate and the false negative rate.

[0028] In the technical solution provided in this embodiment, by converting the collected time-series monitoring data into feature fingerprints with unique identifiers and write-prohibited and modification-prohibited attributes, the consistency and immutability of the data during edge-side processing are guaranteed, providing reliable input for subsequent analysis. Lightweight signal processing and anomaly detection models are used at the edge to complete most routine detections; that is, when the anomaly detection model has a high confidence level in judging the current input data, the local result is directly adopted, achieving millisecond-level response and significantly reducing invalid data transmission. Only in gray-area scenarios where the anomaly detection model at the edge has insufficient confidence, i.e., when the uncertainty coefficient and the first anomaly probability value indicate that the model cannot reliably judge... The system periodically invokes the central controller to retrieve historical data based on feature fingerprints and fuse a second anomaly probability value. This limits high-cost deep analysis to a limited number of gray-area scenarios, avoiding network congestion and wasted computing power caused by uploading all data to the cloud. It also improves the diagnostic accuracy of difficult faults by comparing historical cases with large models. At the same time, the central controller dynamically fuses the two probability values ​​based on the uncertainty coefficient and the degree of retrieval consistency, so that the final detection result achieves a globally optimal balance between edge real-time performance and central accuracy. This significantly reduces the false alarm rate and false negative rate, and enhances the system's adaptability to unknown fault modes, achieving a globally optimal balance between detection real-time performance, resource consumption, and diagnostic accuracy.

[0029] In the above embodiments, there is no limitation on how time series monitoring data is processed into data processing objects. This embodiment provides an exemplary implementation method, which may include the following: The collected time-series monitoring data is sequentially written to the corresponding buffers in chronological order, and a corresponding missing bitmap is generated during the writing process. When the length of the data written to the buffer reaches the preset window length, or when an external trigger event signal is received during the writing process, the data in the current window is used as the data processing object. The data gaps in the data processing object are filled according to the missing bitmap, and abnormal data caused by acquisition jitter are removed to obtain a smooth data sequence. The digest fingerprint of the smooth data sequence is calculated, a globally unique and immutable window identifier is assigned to the smooth data sequence, and the window state of the smooth data sequence is changed to the sealed state. The sealed state is used to indicate that the window corresponding to the smooth data sequence is prohibited from writing and modification operations.

[0030] The data detection granularity is defined by a preset window length, the object identifier is the window identifier, and the buffer is a contiguous storage area maintained in memory for each monitoring indicator stream, used to temporarily store written data points. A missing bitmap records binary markers indicating which time points in the buffer are missing data; each bit corresponds to a sampling time, with 1 indicating a missing data point and 0 indicating a normal data point. The preset window length is the system-configured time window size, such as 60 seconds; window sealing is triggered when data is written to the buffer for this duration. External trigger event signals are non-timed external events, such as the start of virtual machine hot migration or application deployment instructions, which can force the creation of a window. Data gaps are the locations of missing data points in a time series due to acquisition jitter or network latency. Gap filling can be achieved using methods such as linear interpolation, for example, filling missing points with the average of two consecutive sampling points. Acquisition jitter refers to small fluctuations in the acquisition time interval, which may lead to uneven temporal distribution of data points. Abnormal data are non-substantial spikes caused by acquisition jitter, such as instantaneous abnormal peaks caused by acquisition latency. A smoothed data sequence is a data sequence that has undergone patching and denoising to remove holes and jitter noise. A digest fingerprint is a hash value (e.g., SHA-256) of the data content, used to verify data integrity; the hash value changes if the data is tampered with. A window identifier is a globally unique identifier corresponding to a preset window length in the data detection granularity, used to distinguish data from different time windows. The sealed state refers to the state in which the window data is frozen, prohibiting any write or modification operations to ensure data consistency in subsequent analysis.

[0031] In this embodiment, as Figure 3 As shown, the edge controller sequentially writes the collected time-series monitoring data (such as CPU utilization values) into corresponding buffers, such as a pre-built circular buffer in memory, in chronological order. During the writing process, a missing bitmap is generated to represent missing data during the chronological writing process. When the length of data written to the buffer reaches a preset window length (e.g., 60 seconds), or an external trigger event signal is received during the writing process (e.g., virtual machine hot migration begins), the data within the current window is treated as the data processing object. Then, based on the missing bitmap, gaps in the data processing object are filled (e.g., using linear interpolation to fill missing points), and abnormal data caused by acquisition jitter is removed (e.g., smoothing spikes using moving average filtering), resulting in a smoothed data sequence. A digest fingerprint of this smoothed data sequence can be calculated using any hash algorithm, assigned a globally unique and immutable window identifier, and the window state is changed to a sealed state. The sealed state indicates that write and modification operations are prohibited for the data corresponding to this window; any subsequent data will be discarded or written to the next window, ensuring that subsequent analysis is based on the same data copy.

[0032] As can be seen from the above, this embodiment solves the problems of voids and noise interference during data acquisition, ensures the consistency and reproducibility of data, and provides reliable input for subsequent feature extraction and model inference.

[0033] Furthermore, this embodiment divides and processes data at the window level. Correspondingly, the data processing object can be defined as a diagnostic window object. When time series monitoring data enters the preset time window end point, or when an external trigger event signal is received, a window object is created. The window object is initialized, and the smoothed data sequence is associated with the initialized window object to serve as the diagnostic window object. The initialized window object includes at least the data start time and data end time, an indicator signature identifying the data source, and a digest fingerprint. A globally unique and immutable window identifier is assigned to the diagnostic window object, and the original data pointer is set to point to the current data in the buffer. The physical address of the window data is determined and a sealed version number is assigned. The original data pointer is locked in the sealed state, and the sealed version number is incremented when the window data corresponding to the diagnostic window object is corrected. The window state of the diagnostic window object is updated from the write state to the sealed state, and the diagnostic window object is sent to the pre-built feature queue. In the feature queue, based on the rule that the higher the service level of the business, the higher the processing priority of the diagnostic window object, the corresponding processing priority is determined for each diagnostic window object. At the same time, based on the rule that the longer the waiting time of the diagnostic window object, the lower the processing weight, the processing weight of each diagnostic window object in the feature queue is adjusted.

[0034] The diagnostic window object is a structure that encapsulates window data and its metadata (such as time boundaries, indicator signatures, summary fingerprints, raw data pointers, and archived version numbers), and is the implementation of the data processing object. The time window end point is the time when the preset time window length is reached; for example, starting at 14:00:00, 14:01:00 60 seconds later is the time window end point. The window object is a temporary object that is not fully initialized and contains basic window information. Initialization processing fills the window object with basic fields such as start time, end time, indicator signature, and summary fingerprint. The data start time and data end time are the timestamps of the first and last data points within the window, defining the time domain range of the data. The indicator signature is a string identifying the data source, used to distinguish different monitored objects. The raw data pointer is a memory pointer pointing to the physical address of the current window data in the buffer; it is only valid and locked in the archived state. The archived version number increments with window data corrections (such as interpolation strategy adjustments during playback recalculation) to ensure input consistency. The feature queue stores diagnostic window objects awaiting time-frequency analysis and features priority scheduling. Service level represents the importance of the business; core businesses (such as transaction payments) have a high service level, while testing businesses have a low service level. Processing priority determines the order in which diagnostic window objects are extracted from the feature queue; higher priority objects are processed first. Processing weight affects the coefficient used to calculate the priority score; longer waiting times result in lower weights, leading to a lower priority score.

[0035] like Figure 3 As shown, when time series monitoring data enters the preset time window end point (e.g., every 60 seconds), or receives an external trigger event signal (e.g., virtual machine hot migration), the system creates an empty window object. This window object is initialized by filling in the data start time, data end time, indicator signature identifying the data source, and digest fingerprint (hash value). The smoothed data sequence is associated with this initialized window object to form a diagnostic window object. Then, a globally unique and immutable window identifier (UUID) is assigned to the diagnostic window object, the raw data pointer is set to point to the physical address of the current window data in the buffer, and a sealed version number (initially 0) is assigned. In the sealed state, the raw data pointer is locked, prohibiting writing; the sealed version number increments when the window data is corrected (e.g., offline recalculation). The window state of the diagnostic window object is updated from the write state to the sealed state and sent to a pre-built characteristic queue. In this queue, the system adjusts the processing weight of each object based on the rule that the higher the service level of the business, the higher the processing priority of the diagnostic window object (the core database window is processed first), and the rule that the longer the waiting time of the diagnostic window object, the lower the processing weight (old data that has been stuck in the queue for too long is automatically downgraded).

[0036] As can be seen from the above, this embodiment ensures that core business data is processed first by encapsulating window objects and scheduling priority queues, avoiding resource contention during congestion, and ensuring data traceability by sealing version numbers.

[0037] Furthermore, in this embodiment, after sending the diagnostic window object to the pre-built feature queue, the basic priority score of the service level of the monitoring service corresponding to the diagnostic window object is obtained; the waiting time of the diagnostic window object from the time it enters the feature queue to the current time is calculated; according to the preset time decay coefficient, the product of the waiting time and the time decay coefficient is calculated as the decay deduction value, where the time decay coefficient represents the score deducted per unit waiting time; the priority score of the diagnostic window object is determined based on the basic priority score and the decay deduction value; the diagnostic window objects are extracted from the feature queue in descending order of priority score for time-frequency analysis; when a target diagnostic window object with a priority score less than or equal to a preset discard threshold is detected, the target diagnostic window object is removed from the feature queue.

[0038] The base priority score is a preset score based on the service level. Higher service levels result in higher scores, meaning the base priority score increases with the service level. For example, the core transaction database score is set to 100, and the test environment virtual machine score is set to 30. The waiting time is the physical time (in seconds) from when the diagnostic window object enters the feature queue to the current time. The time decay coefficient is the score deducted per unit of waiting time, for example, 2 points per second, and can grow linearly or exponentially. The decay deduction value represents the score deducted due to waiting and can be the product of the waiting time and the time decay coefficient. The priority score determines the dequeue order; higher scores result in higher priority processing. Its value is the base priority score minus the decay deduction value. The discard threshold is a preset lower limit for the score (e.g., 0 points). When the priority score is less than or equal to this threshold, the window object is discarded.

[0039] In this embodiment, the basic priority score of the service level of the monitoring service corresponding to the diagnostic window object is obtained. For example, the service level of the core transaction database is set to 100, ordinary applications to 50, and the test environment to 30. Then, the waiting time (in seconds) of the diagnostic window object from the time it enters the feature queue to the current time is calculated. According to the preset time decay coefficient (e.g., deducting 2 points per second), the product of the waiting time and the time decay coefficient is calculated as the decay deduction value. The priority score of the diagnostic window object is obtained by subtracting the decay deduction value from the basic priority score, for example, 100-2×20=60 points. Diagnostic window objects are extracted from the feature queue in descending order of priority score for time-frequency analysis. When a target diagnostic window object with a priority score less than or equal to the preset discard threshold (e.g., 0 points) is detected, it is removed from the queue and no longer subjected to feature processing.

[0040] As can be seen from the above, this embodiment solves the problem of queue congestion under sudden traffic, realizes intelligent scheduling of prioritizing high-priority services and automatically downgrading and discarding old data, and prevents the avalanche effect.

[0041] In conjunction with the above embodiments, this invention, taking a window as the data processing granularity, a circular buffer as the buffer, and the data processing object as the window diagnostic object, provides an exemplary implementation method from triggering to object creation, which may include the following: The edge controller maintains a circular buffer and a corresponding missing bitmap for each monitoring metric stream. Time-series data is written to the buffer in chronological order. When a preset time window (e.g., 60 seconds) is detected to have ended, or when an external trigger event signal is received (e.g., virtual machine hot migration begins or application deployment instructions are received), the system uses the current write position as the end position of the window data. The storage interval from the start write position to the end position constitutes a complete data window. At this time, the edge controller performs a snapshot sealing operation: First, it interpolates and fills the data holes in the window according to the missing bitmap, and uses a moving average algorithm to remove non-substantial spikes caused by acquisition jitter, generating a smoothed data sequence; second, it calculates the digest fingerprint (e.g., hash value) of the window data and assigns a globally unique and immutable window identifier; finally, it marks the window state as frozen and seals it, prohibiting any subsequent write or modification operations, ensuring that all subsequent processing steps are based on the same strictly consistent data snapshot.

[0042] Subsequently, a diagnostic window object is instantiated. This object, upon initialization, contains at least the start and end timestamps of the current window (defining the time domain range), a unique signature of the monitored object (e.g., Host-001:CPU_Usage), and a digest fingerprint of the current window data. Next, the window object's state is forcibly transitioned from write state to archived state. In the archived state, the raw data pointer is locked, and any late data points are discarded or written to the next new window; modification of the current window's content is strictly prohibited. The core fields of the diagnostic window object also include: a globally unique window identifier (used for the entire chain of in-series acquisition, characterization, retrieval, and fusion), a raw data pointer pointing to the physical address of the window data in the circular buffer (valid only in the archived state), and an archived version number. The archived version number is incremented each time the window data is corrected to ensure input consistency. The created diagnostic window object is then pushed into the characterization queue.

[0043] To prevent monitoring of high-priority services from being delayed during sudden traffic surges, the characteristic queue employs a hybrid scheduling method based on service level and time decay. The comprehensive priority score is dynamically calculated for each diagnostic window object based on the formula: a base service level score minus a time decay coefficient multiplied by the waiting time in the queue. The base service level score is preset according to the importance of the monitored object; for example, 100 for the core transaction database and 30 for a normal test environment virtual machine. The time decay coefficient is a preset penalty factor (e.g., deducting 2 points per second). The waiting time in the queue is the number of physical seconds the window object remains in the queue after its creation and sealing. Objects with higher scores are extracted first for subsequent time-frequency analysis. For example, when sudden traffic causes queue congestion, three diagnostic window objects enter the queue sequentially: Window A (core database, waiting 20 seconds) has a score of 100 - 2 × 20 = 60; Window B (test virtual machine, waiting 0 seconds) has a score of 30 - 0 = 30; and Window C (core database, waiting 0 seconds) has a score of 100 - 0 = 100. The scheduling system prioritizes window C, which has the highest score, ensuring that the latest status of core business operations is analyzed first. Window A, due to prolonged waiting, has reduced value and scores only 60. If window A continues to linger, its score will drop to 0 after 50 seconds, at which point the system will directly discard it from the queue (or transfer it to offline storage), thereby quickly relieving queue pressure and preventing a cascading failure. Through the aforementioned window sealing and priority scheduling mechanism, this embodiment provides a deterministic and consistent data foundation for subsequent feature extraction and comparative diagnosis by the central controller, and ensures real-time monitoring capabilities for critical business operations.

[0044] The above embodiments do not limit how to perform time-frequency analysis on the data processing object and generate the corresponding feature fingerprint. Based on the above embodiments, the present invention also provides an exemplary implementation method, which may include the following: The data processing object is decomposed into multiple wavelet packets based on the selected mother wavelet function. During the recursive decomposition process, the data processing object is projected from the full frequency band to multiple independent frequency band subspaces through low-pass and high-pass filters. The energy value of each frequency band is calculated, and the energy vector is determined based on the energy values ​​of all frequency bands. The energy entropy of each frequency band is determined based on the relative weight of the energy value of each frequency band to the sum of the energy values ​​of all frequency bands. The time series monitoring data corresponding to the data processing object is divided into multiple sub-data, and the sub-energy of each sub-data is calculated. Each sub-energy is mapped to a finite discrete interval, and the mapped sub-energy forms a corresponding sub-energy vector. Based on the sub-data partitioning rules, the sub-energy vectors are arranged and integrated to form a two-dimensional energy matrix. The two-dimensional energy matrix is ​​then visualized to obtain an energy map. Based on the energy vector, energy entropy, and energy map, the feature fingerprint of the data processing object is determined.

[0045] Among them, the mother wavelet function, used as the basis function for wavelet packet decomposition, such as the Daubechies series, possesses orthogonality and compact support, making it suitable for detecting abrupt changes in monitoring data. Multi-level wavelet packet decomposition is the process of recursively passing a signal through low-pass and high-pass filters to decompose it into multiple frequency band subspaces. The number of decomposition levels N yields 22 N Each frequency band is a subspace of a signal. A low-pass filter allows low-frequency components to pass through, extracting the trend of the signal. A high-pass filter allows high-frequency components to pass through, extracting the details of the signal. The frequency band subspace is the frequency range corresponding to each leaf node after decomposition; the frequency bands are mutually orthogonal and have no redundancy. The energy value reflects the signal strength within that frequency band and can be expressed as the sum of the squares of the wavelet packet coefficients within each frequency band. The energy vector is a vector composed of the energy values ​​of all frequency bands, with a dimension of 2. N Energy entropy is the Shannon entropy of the proportion of energy in each frequency band to the total energy, measuring the uniformity of energy distribution; a higher entropy indicates more dispersed energy. Subdata refers to time slices obtained by further dividing a time window, for example, a 60-second window divided into 10 6-second slices. Subenergy refers to the instantaneous energy value of each frequency band within each time slice. Finite discrete intervals map continuous energy values ​​to discrete integer intervals (e.g., 0-255) for easier visualization. A subenergy vector is a vector composed of all frequency band subenergy values ​​within each time slice. A two-dimensional energy matrix is ​​a matrix with frequency bands as rows and time as columns, with a dimension of 2. N ×T, where T is the number of time slices. An energy map visualizes a two-dimensional energy matrix as a heatmap, with the horizontal axis representing time, the vertical axis representing frequency bands, and the color intensity representing energy strength.

[0046] In this embodiment, as Figure 3As shown, the edge controller retrieves either the sealed diagnostic window object from the feature queue or a diagnostic window object obtained directly without going through the queue, and begins time-frequency analysis to generate feature fingerprints. Considering that cloud platform monitoring metrics (such as CPU utilization and IO wait time) typically exhibit non-stationary characteristics, multi-level wavelet packet decomposition technology can be used instead of the traditional Fourier transform. First, a specific mother wavelet function (e.g., the Daubechies series) is selected to decompose the time-series data in the diagnostic window object into N levels (N being the preset number of decomposition levels, e.g., 3 levels). The signal is recursively passed through a high-pass filter and a low-pass orthogonal mirror filter, thereby projecting the signal onto 2^N independent frequency band subspaces across the entire frequency band using a binary tree structure. For each leaf node (i.e., each frequency band), its energy value (sum of squared coefficients) is calculated, and the energy values ​​of all frequency bands are combined into an energy vector, which forms the mathematical basis for subsequent retrieval and classification algorithms. Simultaneously, the energy entropy of the window is calculated: the total energy is obtained by summing the energy of all frequency bands within the current time window; the relative weight of each frequency band is obtained by dividing the energy of each frequency band by the total energy; the resulting weight sequence is substituted into the Shannon entropy formula to obtain the energy entropy characterizing the degree of disorder in energy distribution, serving as an auxiliary indicator for evaluating system stability. To preserve time-varying details, the system further divides the time window into multiple consecutive time slices (e.g., a 60-second window is divided into 10 6-second slices). Wavelet packet decomposition and frequency band energy calculation are recursively performed on each time slice to obtain the frequency band energy vector corresponding to each time slice. These vectors are arranged in chronological order to form a two-dimensional energy matrix with a frequency band-time dimension. This matrix is ​​then visualized (e.g., heatmap coloring) to obtain the energy map. After generating the energy map, the system performs block quantization on the energy values ​​in each grid cell: mapping continuous high-precision floating-point energy values ​​to a finite discrete interval (e.g., integers from 0 to 255), thereby significantly reducing storage and transmission costs while preserving the time-frequency texture features of anomalies (e.g., the location and shape of high-energy patches). Subsequently, the system executes image processing algorithms on the energy map to extract connected regions whose energy values ​​exceed a preset energy threshold. It then obtains the energy peak coordinates and connected domain boundaries for each region, using these as hotspot anchors. Each hotspot anchor is a set of coordinates that marks significant peaks or abrupt changes in the energy map. At this point, the energy vector, energy entropy, energy map, and extracted hotspot anchors are written into the diagnostic window object and sealed along with the window identifier, forming the object's feature fingerprint. Subsequent processing steps that access this data will always obtain the same set of features, providing deterministic input for subsequent evidence alignment and similarity retrieval.

[0047] As can be seen from the above, this embodiment compresses the original time-series data into a compact feature representation through time-frequency analysis, retains key time-frequency information, and compresses the data volume by more than 95%, significantly reducing transmission and storage overhead.

[0048] Furthermore, this embodiment also provides how to combine sliding window multiplexing to achieve multi-level wavelet packet decomposition of data processing objects, which may include the following: Based on the characteristics of the time-series monitoring data corresponding to the data processing object, a mother wavelet function is selected, and a pair of orthogonal mirror filters matching the mother wavelet function are obtained as low-pass and high-pass filters. The preset decomposition level is obtained, and the tree structure used in the decomposition process is determined. The time-series monitoring data corresponding to the data processing object is used as the node coefficients of the 0th level of the tree structure, and it is checked whether the cache contains the node coefficients of each level that have been calculated and saved during the decomposition process of the previous adjacent data processing object. If the cache contains the node coefficients of each level, then based on the data increment of the current data processing object relative to the previous adjacent data processing object, the nodes in the tree structure affected by the data increment are identified. For point paths, convolution and downsampling calculations are performed only on the node paths, while the corresponding node coefficients in the cache are directly reused for the remaining nodes. If the node coefficients for each layer are not in the cache, the complete recursive decomposition process is entered: for each node in each layer, the node coefficients are convolved with the low-pass filter and the high-pass filter respectively, and the convolution result is downsampled by a factor of 2 to obtain the low-frequency sub-node coefficients and high-frequency sub-node coefficients of the next layer. After the calculation of each node is completed, the corresponding node coefficients are stored in the cache for reuse by subsequent adjacent data processing objects. When the current decomposition layer reaches the preset decomposition layer, the decomposition operation stops, and the coefficients of each leaf node are used as the sub-band signal of the corresponding frequency band.

[0049] The orthogonal mirror filter is a pair of filters (low-pass and high-pass) that satisfy the orthogonality condition, ensuring complete signal reconstruction and redundancy-free decomposition. The preset decomposition level is a pre-configured number of wavelet packet decomposition levels; for example, 3 levels will result in 2n 3 =8 frequency bands. The tree structure is the data structure used in wavelet packet decomposition, such as a binary tree, where each node represents a frequency band subspace. Node coefficients are the coefficient sequence of each node in the tree structure; the coefficients of the 0th level node are the original signal. The buffer is the area in memory that stores the node coefficients of each level during the decomposition of the previous adjacent data processing object. Data increment is the increase or decrease of data points in the current data processing object relative to the previous adjacent object. Convolution is the operation of convolving the node coefficient sequence with filter coefficients to achieve filtering. Downsampling is taking a value at every other point in the convolution result to remove redundancy and halve the data volume. Low-frequency sub-node coefficients are the next level node coefficients obtained after low-pass filtering and downsampling, representing the low-frequency components of the signal. High-frequency sub-node coefficients are the next level node coefficients obtained after high-pass filtering and downsampling, representing the high-frequency components of the signal. Leaf node coefficients are the lowest level node coefficients after reaching the preset decomposition level; each leaf corresponds to a sub-band signal of one frequency band.

[0050] In this embodiment, a mother wavelet function (e.g., Daubechies 4) is selected based on the characteristics of the time-series monitoring data corresponding to the diagnostic window object, and a pair of orthogonal mirror filters matching the mother wavelet function are obtained as a low-pass filter and a high-pass filter. A preset decomposition level (e.g., 3 levels) is obtained, and the tree structure used in the decomposition process, such as a binary tree, is determined. The time-series data corresponding to the diagnostic window object is used as the coefficients of the 0th level node in the tree structure. The cache is checked to see if the node coefficients of each level of the previous adjacent diagnostic window object, which were calculated and saved during the decomposition process, exist. If they exist in the cache, the node paths in the tree structure affected by the data increment are identified based on the data increment of the current diagnostic window object relative to the previous adjacent object (e.g., the new window has one more data point than the old window, or one less data point). Convolution and downsampling calculations are performed only on these paths, while the corresponding node coefficients in the cache are directly reused for the remaining nodes, thus avoiding redundant calculations. If the node coefficients for each layer are not present in the cache, the complete recursive decomposition process begins: For each node in each layer, the node coefficient sequence is convolved with both a low-pass filter and a high-pass filter, and the convolution result is downsampled by a factor of two (taking a value every other point) to eliminate redundancy, thus obtaining the low-frequency and high-frequency sub-node coefficients for the next layer. After calculating each node, its coefficients are stored in the cache for reuse by subsequent adjacent diagnostic window objects. The decomposition operation stops when the preset number of decomposition layers is reached, resulting in 2^N leaf node coefficient sequences, each sequence corresponding to a sub-band signal of a specific frequency band.

[0051] As can be seen from the above, this embodiment uses cache reuse technology, which requires adjacent windows to calculate only the data increment, significantly improving the computational efficiency in continuous sliding window scenarios and reducing CPU overhead.

[0052] Furthermore, the present invention also defines a method for extracting hot zone anchor points in feature fingerprints and a method for fusing feature fingerprints, which may include the following: In the process of image processing of the two-dimensional energy matrix, connected regions with energy values ​​exceeding a preset energy threshold are extracted; the energy peak coordinates and connected domain boundaries of each connected region are obtained as hot zone anchor points; and the energy vector, energy entropy, energy map and hot zone anchor points are fused to obtain the feature fingerprint of the data processing object.

[0053] The energy threshold is a preset energy value limit; connected regions with energy exceeding this value are considered hot zones. A connected region is a region in the two-dimensional energy matrix composed of adjacent pixels (top, bottom, left, right, or diagonally) whose energy values ​​all exceed the threshold. The energy peak coordinates are the coordinates (time slice index, frequency band index) of the point with the highest energy value within the connected region. The connected region boundary is the smallest bounding rectangle of the connected region, which can be defined by the coordinates of its top-left and bottom-right corners. Hot zone anchor points are markers indicating the spatiotemporal location of an abnormal energy burst in the energy map, such as a red hot zone appearing in the high-frequency band at 30-40 seconds; these anchor points can include the energy peak coordinates and the connected region boundary.

[0054] In this embodiment, during the image processing of the two-dimensional energy matrix to generate an energy map, connected regions with energy values ​​exceeding a preset energy threshold are extracted, i.e., continuous high-energy pixel blocks. For each connected region, its energy peak coordinates (the location of the point with the maximum energy value within the region) and the boundary of the connected domain (the coordinate range of the minimum bounding rectangle) are obtained, and these coordinates and boundaries are used as hot zone anchors. Hot zone anchors mark significant peaks or abrupt changes in the energy map and are a set of coordinates. Subsequently, the system fuses the energy vector (normalized wavelet packet frequency band energy array), energy entropy (scalar value), energy map (a two-dimensional matrix with frequency band-time dimension, already block-quantized), and hot zone anchors. For example, these data can be combined into a structured object or spliced ​​into a multi-dimensional feature vector as the feature fingerprint of the diagnostic window object. This feature fingerprint not only retains the time-frequency texture features (energy map), frequency domain energy distribution (energy vector), and energy distribution complexity (energy entropy) of the anomaly occurrence, but also achieves accurate indexing of the spatiotemporal location of the anomaly through hot zone anchors, providing multi-level input basis for subsequent similarity retrieval and comparative diagnosis.

[0055] As can be seen from the above, this embodiment solves the problem of how to extract representative feature points from the energy map, improves the accuracy and efficiency of subsequent retrieval, and enables the system to quickly locate the specific time and frequency band of the anomaly.

[0056] Based on the above embodiments, the present invention further specifies how to calculate the uncertainty coefficient, which may include the following: Calculate the absolute difference between the first anomaly probability value and the decision boundary value as the score boundary distance; statistically analyze the difference in the proportion of decision trees with positive anomaly identification results and decision trees with negative anomaly identification results in the anomaly identification model as the tree path divergence degree; calculate the distance between the feature fingerprint and the center distribution of the training dataset as the feature distribution distance; determine the uncertainty coefficient based on the fusion result of the score boundary distance, tree path divergence degree and feature distribution distance.

[0057] For example, one weighted fusion calculation method for the uncertainty coefficient is as follows: normalize the score boundary distance, tree path divergence degree, and feature distribution distance respectively; obtain the first weight value, second weight value, and third weight value corresponding to the score boundary distance, tree path divergence degree, and feature distribution distance respectively; add the product of the normalized score boundary distance and the first weight value, the product of the normalized tree path divergence degree and the second weight value, and the product of the normalized feature distribution distance and the third weight value to obtain the uncertainty coefficient.

[0058] The decision boundary value is the threshold for the anomaly detection model to classify data as positive or negative, for example, 0.5. The score boundary distance is the absolute difference between the first anomaly probability value and the decision boundary value; a larger distance indicates a more confident model, while a smaller distance indicates a more hesitant model. The anomaly detection model is a tree-based ensemble model, which can be built based on any tree model such as XGBoost, LightGBM, CatBoost, or Random Forest, without affecting the implementation of this invention. The decision tree is the basic learner in the tree model, and each tree performs a binary classification of the input data. The tree path divergence is the difference in the proportion of trees that classify data as positive to those that classify data as negative; a larger divergence indicates a larger internal variance and higher uncertainty. The training dataset center distribution is the mean and covariance matrix of all sample feature vectors during the training of the anomaly detection model, representing the normal data distribution. The Mahalanobis distance is the distance between the current input feature vector and the training set center distribution, considering the correlation of various dimensions; a large distance indicates that the sample belongs to out-of-distribution (OOD) data. The feature distribution distance is the numerical value of the Mahalanobis distance, used to quantify the degree to which the sample deviates from the training distribution. Normalization maps numerical values ​​with different dimensions to a unified interval (e.g., 0 to 1), such as using Min-Max (algorithm name) normalization or Z-Score (algorithm name) normalization. The first weight value is a preset weight of the score boundary distance in the uncertainty coefficient calculation, for example, 0.4. The second weight value is a preset weight of the tree path divergence degree in the uncertainty coefficient calculation, for example, 0.3. The third weight value is a preset weight of the feature distribution distance in the uncertainty coefficient calculation, for example, 0.3.

[0059] like Figure 4As shown, the edge controller calculates the absolute difference between the first anomaly probability value and the decision boundary value (usually 0.5), as the score boundary distance. The closer this distance, the more hesitant the model. For example, when the first anomaly probability value is 0.58, the score boundary distance is |0.58-0.5|=0.08. Secondly, the difference in the proportion of trees that correctly identify positive examples versus those that correctly identify negative examples in all decision trees (e.g., 100 trees) of the anomaly detection model (e.g., gradient boosting decision trees) is calculated, as the tree path divergence. For example, if 55 trees identify positive examples and 45 identify negative examples, the difference in the positive-to-negative ratio is 0.1. The larger the divergence, the greater the internal variance of the model. Thirdly, the Mahalanobis distance between the feature fingerprint of the current diagnostic window object and the central distribution of the training dataset is calculated, as the feature distribution distance. A distance that is too large means the current sample belongs to out-of-distribution data, and the model may lack processing experience; for example, a large Mahalanobis distance may trigger an out-of-distribution alarm.

[0060] To more accurately quantify the uncertainty coefficient, the three dimensions mentioned above can be normalized, mapping the score boundary distance, tree path divergence, and feature distribution distance to a range of 0 to 1. Normalization can be achieved using the minimax method or by converting standard scores based on historical statistics. Subsequently, the system obtains three preset weight coefficients, corresponding to the weights of the score boundary distance, tree path divergence, and feature distribution distance, respectively, with the sum of the three weights being 1. The uncertainty coefficient is obtained by adding the products of the normalized score boundary distance and the first weight, the normalized tree path divergence and the second weight, and the normalized feature distribution distance and the third weight. This coefficient comprehensively reflects the model's confidence in the current sample's judgment result; a larger value indicates greater model uncertainty. For example, if we obtain the first, second, and third weight values ​​corresponding to the three components, such as 0.4, 0.3, and 0.3 respectively, and the normalized values ​​of the three components are 0.2, 0.8, and 0.6 respectively, then the uncertainty coefficient = 0.2 × 0.4 + 0.8 × 0.3 + 0.6 × 0.3 = 0.08 + 0.24 + 0.18 = 0.5.

[0061] As shown above, this embodiment quantifies the uncertainty of the model through multiple dimensions, not only based on probability scores but also combining internal consistency and distribution matching degree, providing a quantitative basis for subsequent triage decisions and effectively distinguishing between data identification scenarios where the model is certain and those where it is uncertain. Furthermore, through configurable weighted fusion, the system can adjust the sensitivity of uncertainty assessment according to different operational scenarios. For example, in scenarios with high security requirements, increasing the weight of feature distribution distance makes it easier to identify unknown patterns as gray areas.

[0062] Furthermore, this embodiment also defines a triage decision process based on uncertainty coefficients, which may include the following: the feature fingerprint includes at least the energy vector of the data processing object, including: inputting the energy vector into the anomaly recognition model to obtain the probability value of the data processing object belonging to the anomaly category, as the first anomaly probability value; if the score boundary distance is greater than or equal to a preset distance threshold and the uncertainty coefficient is less than a preset coefficient threshold, the anomaly detection result of the data processing object is directly output based on the first anomaly probability value; otherwise, the data processing object is sent as suspected anomaly data to a pre-constructed gray zone queue; in the gray zone queue, the data processing objects corresponding to multiple suspected anomaly data that belong to the same monitoring indicator source and arrive consecutively are merged and deduplicated to generate a sequence object containing a longer temporal context, and the sequence object is sent to the central controller.

[0063] The preset distance threshold is a preset score boundary distance threshold, for example, 0.3, meaning that a probability deviation of more than 0.3 from 0.5 is considered high confidence. The preset coefficient threshold is a preset uncertainty coefficient threshold, for example, 0.4, where values ​​below this are considered low uncertainty. Suspected anomalous data refers to data with high uncertainty or a probability close to the boundary, requiring further identification of anomalous data through the central controller. The gray zone queue stores the data processing objects corresponding to suspected anomalous data and has time-series aggregation capabilities. The monitoring indicator source is a unique string identifying the data source, used to determine whether it belongs to the same indicator. The sequence object is an aggregated object containing a longer time-series context, generated by merging multiple consecutive gray zone windows of the same indicator.

[0064] In this embodiment, the edge controller inputs the normalized energy vector into the anomaly detection model, which outputs a first anomaly probability value, defined as p_xgb. Simultaneously, the uncertainty gate reads the online calibration table and, combined with the current input tree path divergence, calculates the uncertainty coefficient u. If the first anomaly probability value p_xgb is far from the decision boundary (e.g., the decision boundary can be set to 0.5), for example, p_xgb is greater than 0.8 or less than 0.2, and the uncertainty coefficient u is lower than a preset threshold (e.g., 0.4), then the input is determined to be a high-confidence sample, meaning the confidence in the output anomaly detection result is high. In this case, the output result of the anomaly detection model is directly used to generate an alarm or normal log, and the processing flow of this window ends. Otherwise, if the first anomaly probability value p_xgb is near the decision boundary, for example, between 0.4 and 0.6; or if p_xgb is far from the decision boundary but the uncertainty coefficient u is abnormally high, for example, due to significant divergence between trees within the model or the sample being out-of-distribution data, the input is determined to be a gray area sample requiring further anomaly detection by the central controller. Gray zone samples are not immediately flagged as errors; instead, they are sent to a pre-built gray zone observation queue. This queue features time-series aggregation capabilities, temporarily caching diagnostic window objects corresponding to multiple consecutively arriving gray zone samples from the same monitoring metric source. It then performs merging and deduplication operations to generate a gray zone sequence object containing a longer time-series context—for example, merging three consecutive gray zone windows into a single sequence object. This mechanism effectively reduces the waste of downstream expensive diagnostic resources caused by single-window noise and can capture progressive failure modes across windows. Finally, the generated gray zone sequence object is sent to the central controller for anomaly identification and processing.

[0065] As can be seen from the above, this embodiment reduces the waste of diagnostic resources by single window noise through temporal aggregation of gray area queues, and can capture progressive fault modes across windows. At the same time, it clarifies the diversion boundary between high-confidence local processing and gray area uploading to the center.

[0066] The above embodiments illustrate the implementation process of an anomaly detection method executed on the edge side. This embodiment also provides an implementation process of an anomaly detection method executed by the central controller, such as... Figure 5 As shown, it may include the following: S501: Receives an anomaly identification request sent by the edge controller.

[0067] The edge controller processes the collected time-series monitoring data into data processing objects with unique object identifiers according to the data detection granularity; it performs time-frequency analysis on the data processing objects, and generates feature fingerprints with write-prohibited and modification-prohibited attributes based on the analysis results; it uses a trained anomaly detection model to identify anomalies in the feature fingerprints, obtaining a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model's identification result; if, based on the uncertainty coefficient and the first anomaly probability value, it determines that the anomaly detection result should not be adopted by the model's identification result, it sends an anomaly identification request to the central controller. The anomaly identification request includes at least the feature fingerprint of the data processing object corresponding to the suspected anomaly data, the model identification result of the data processing object, and the uncertainty coefficient quantifying the uncertainty of the model's identification result.

[0068] S502: Based on feature fingerprints, determine the second anomaly probability value by retrieving and analyzing historical data.

[0069] S503: Based on the uncertainty coefficient and the consistency of the retrieval results, the first anomaly probability value and the second anomaly probability value are merged as the anomaly detection result, and the anomaly detection result is sent to the edge controller so that the edge controller can use it as the anomaly detection result of the data processing object.

[0070] In this system, the edge controller refers to the processor deployed on the monitored devices (compute nodes or virtual machine hosts) of the cloud system, used for data acquisition, feature extraction, and preliminary anomaly identification. The central controller is a processor deployed on the cloud system management device, used for deep diagnostics and knowledge base management. An anomaly identification request is a request message sent by the edge controller to the central controller, containing information such as feature fingerprints, the first anomaly probability value, and uncertainty coefficients. The model identification result refers to the first anomaly probability value output by the anomaly identification model. Historical data consists of historical cases stored in the knowledge base; each case includes feature fingerprints, status labels (anomaly type or normal), and processing results. The consistency of the retrieval results refers to the consistency of the status labels among the top-K recalled historical cases, quantified by a label consistency score (highest frequency divided by K). The anomaly detection result is the final output judgment, such as abnormal or normal, and may also include a severity level. This embodiment enables joint identification of system anomalies on both the edge and center sides. Regular data is processed in a closed loop at the edge side in milliseconds, while only difficult data is sent to the center. This approach leverages the real-time capabilities of the edge side while utilizing the knowledge base and large model capabilities of the center side, achieving a globally optimal balance between detection real-time performance, resource overhead, and accuracy.

[0071] Furthermore, this embodiment also defines the historical data retrieval process, which may include the following: the feature fingerprint includes at least an energy vector; using the energy vector in the feature fingerprint as the query vector, similar historical cases are queried in the historical database to obtain a candidate historical dataset; using an inverted index, historical case data whose physical scene does not match the monitoring object scene corresponding to the data processing object are removed from the candidate historical dataset; based on the contribution of the energy value of each frequency band output by the anomaly recognition model to the model recognition result, the target frequency band affecting the model recognition result is determined; based on assigning greater weight values ​​to historical case data with high similarity to the data processing object in the target frequency band, corresponding ranking weights are set for the historical case data in the filtered candidate historical dataset; according to the ranking weight from large to small, a preset number of historical case data are selected from the filtered candidate historical dataset as the historical dataset.

[0072] The historical database is a vector database storing historical cases, with each case indexed by an energy vector. The candidate historical dataset is a set of similar historical cases initially recalled through vector retrieval. The inverted index is an index structure using physical scene labels (such as database nodes or computing nodes) as keys and case IDs as values, used for fast filtering. The monitored object scene is the physical environment label corresponding to the current data processing object, such as a database node or computing node. The energy value of each frequency band is each component of the energy vector in the feature fingerprint, representing the energy of the corresponding frequency band. Contribution is the degree of influence of each frequency band energy value on the model's recognition result, which can be quantified by feature importance (such as SHAP value). The target frequency band is one or more frequency bands with the highest contribution, i.e., the key frequency band that causes the model to make abnormal judgments. The ranking weight is the score of the candidate historical case in the reweighted ranking, which is positively correlated with the similarity to the current sample in the target frequency band. The historical dataset consists of the Top-K historical cases selected after scene filtering and reweighted ranking.

[0073] Furthermore, this embodiment also defines the historical data analysis process, which may include the following: the feature fingerprint also includes an energy map and hotspot anchor points; the status labels of each historical case data in the historical dataset are obtained, and historical case data with the same status label are clustered to obtain multiple groups of historical case data; for each group of historical case data, the energy map of the data processing object is aligned with the energy maps of each current historical case data in the current group on the time axis; based on the matching results of the hotspot anchor points of the data processing object with the hotspot anchor points of each current historical case data, the data processing object is covered by the current historical case data. The number of hot zone units and the total number of hot zone units are used to determine the similar segment coverage rate. Based on the matching results, anchor points of the data processing object that are not matched by each current historical case data are identified, and each unmatched anchor point is regarded as a differential hot zone. The spatiotemporal coordinates and energy intensity of each differential hot zone are recorded to generate a differential hot zone list. The frequency of each state label is counted to determine the target state label with the highest frequency. Based on the frequency of the target state label and the total number of historical case data contained in the historical dataset, the label consistency score is determined. Based on the similar segment coverage rate, the differential hot zone list and the label consistency score, the historical data analysis results of the data processing object are generated.

[0074] In this system, status labels are the conclusion labels carried by historical case data, such as memory leak, IO saturation, and normal fluctuations. Clustering groups historical case data with the same status labels together for batch processing. Time axis alignment aligns the energy map of the current sample with the energy maps of historical cases in the time dimension, making the same time positions comparable. A hot zone unit is a pixel in the energy map (corresponding to a time slice and a frequency band). Similarity segment coverage is the proportion of hot zone units in the current input that are covered by historical cases to the total number of hot zone units; a higher value indicates stronger case explanatory power. Unmatched anchors are the parts of the current input's hot zone anchors that do not match the anchors of cases. Disparate hot zones are the spatiotemporal regions represented by unmatched anchors, recording their time slice index, frequency band index, and energy intensity. Label consistency score refers to the proportion of the dominant label in the recalled cases (highest frequency divided by the total number of cases), used to quantify the consistency of the search results.

[0075] like Figure 4As shown, the process of the central controller retrieving historical data is as follows: The central controller uses the energy vector in the feature fingerprint of the current input as the query vector, performs an approximate nearest neighbor search in the vector database, and recalls a batch of candidate historical cases as the coarse ranking stage. In the fine ranking stage, the system introduces scene constraints and weight adjustments: It uses an inverted index to filter out historical cases whose physical scene does not match the current input monitoring object scene, such as not using disk failure cases of storage servers to diagnose CPU anomalies of computing nodes. Secondly, it uses an anomaly recognition model, such as XGBoost (eXtreme Gradient Boosting), to extract the contribution of the energy values ​​of each frequency band to the model's recognition results, for example, by using path contribution values ​​or feature importance, to extract the key frequency bands (i.e., suspicious frequency bands) in the current input that lead to anomaly judgment. Based on these frequency bands, the vector similarity of the filtered candidate cases is weighted and re-ranked, so that cases with high similarity to the current input features in the key frequency bands receive higher ranking weights, thereby eliminating noise cases that are only accidentally similar in irrelevant frequency bands. Based on the ranking weight from largest to smallest, a predetermined number (e.g., Top-3) of historical case data are selected as the final historical dataset for subsequent evidence alignment and comparative analysis. Once the historical dataset is determined, the historical data within it is analyzed: the central controller acquires the state labels (e.g., memory leak, IO saturation, normal fluctuation) carried by each historical case data point in the historical dataset, and clusters historical case data with the same state label to obtain multiple groups of historical case data. For each group, the energy map of the current input is aligned with the energy maps of each historical case within the group on the time axis. Hot zone anchor points (including energy peak coordinates and connected component boundaries) are extracted from the current input energy map and matched with the hot zone anchor points of each historical case. Based on the matching results, the similarity segment coverage rate is calculated based on the fact that the similarity segment coverage rate equals the number of hot zone units covered by historical cases in the current input divided by the total number of hot zone units in the current input. Simultaneously, anchor points in the current input that are not matched by any case are identified based on the matching results. Each unmatched anchor point is treated as a differential hot zone, and its spatiotemporal coordinates (which time slice, which frequency band) and energy intensity (normalized energy value) are recorded, summarizing to generate a list of differential hot zones. Furthermore, the frequency of each state label in the historical dataset is statistically analyzed to determine the target state label with the highest frequency. The label consistency score is then calculated by dividing the frequency of this target state label by the total number of historical cases in the historical dataset; this score is a floating-point number between 0 and 1, for example, 3 / 5 = 0.6. Finally, the similar segment coverage, the list of difference hotspots, and the label consistency score are combined to generate the historical data analysis results of the current input, serving as a structured evidence package for subsequent large language model comparative diagnosis.

[0076] As shown above, this embodiment, through scene filtering and key frequency band weighting, eliminates noisy cases with mismatched physical scenes and highlights similarities in key frequency bands, significantly improving the relevance and accuracy of search results. Using a structured evidence package containing coverage, difference hotspots, and consistency scores as input for large language model comparative diagnosis achieves the transformation from numerical features to interpretable evidence.

[0077] Furthermore, this application also defines the process of obtaining a second anomaly probability value by retrieving and analyzing historical data, which may include the following: generating a prompt word that includes at least comparative analysis and anomaly probability output based on the historical data analysis results, the feature fingerprint of the data processing object, and the monitoring object and scene information; calling a target language model that has comparative analysis capabilities and can output anomaly probabilities, and inputting the prompt word into the target language model; and obtaining the second anomaly probability value based on the output of the target language model.

[0078] The monitored object refers to the entity being monitored, such as a physical host, virtual machine, container, or service. Context information refers to the environment type of the currently monitored object, such as a database node, compute node, or network device. The cue words are structured text input to the large language model, containing task instructions such as comparing the current sample with historical cases, determining whether the difference hotspots conform to variants of known failure modes, contextual evidence, outputting corrected anomaly probability values, and output format requirements, used to guide the model in completing the comparative analysis task. The target language model is any large language model capable of processing according to the cue words; that is, the target language model has the ability to receive structured cue words and output anomaly probabilities and evidence citations.

[0079] like Figure 4As shown, the central controller constructs a structured cue word based on historical data analysis results (including similar segment coverage, a list of differential hot zones, and label consistency scores), the feature fingerprint of the current input (including normalized energy vector, energy entropy, energy map, and a set of hot zone anchor point coordinates), and monitoring object and scene information (e.g., database nodes). This cue word contains instructions for comparative analysis and anomaly probability output, requiring the target language model to reason based on evidence boundaries. The cue word not only describes the time-frequency texture differences between the current input and the recalled cases but also explicitly requires the model to output a single anomaly probability value, the case number on which it is based, and a summary of the counter-evidence. For example, the prompt message might be: "You are an operations and maintenance expert. The current input has a high-frequency hotspot between seconds 30 and 40, with a normalized energy vector of [0.1, 0.05, ..., 0.15], an energy entropy of 0.85, and hotspot anchor point coordinates of (5, 7). Please compare it with cases A, B, and C to determine which fault mode it best matches, and output the anomaly probability, the cited case number, and a summary of counter-evidence." The central controller calls a target language model with comparative analysis capabilities and the ability to output anomaly probabilities. The prompt message is input into the model, and the second anomaly probability value is obtained by parsing the results returned by the model. This embodiment utilizes the semantic understanding capabilities of a large language model to achieve comparative diagnosis of data that cannot be accurately identified as anomalies on the edge side. This compensates for the shortcomings of the local model on the edge side in understanding log semantics and texture patterns, thereby improving the overall anomaly identification accuracy.

[0080] Furthermore, the target language model can also verify whether the difference hotspots of the data processing object are variants of the known failure modes corresponding to the historical case data, and output the verification results; if the similarity segment coverage between the data processing object and each historical case data is less than the preset coverage threshold, the historical data retrieval results are output as invalid; based on the verification results and the validity judgment results of the retrieval results, the target language model outputs a second anomaly probability value, and simultaneously outputs at least one target historical case data on which the second anomaly probability value is based and a counter-evidence summary that does not support the second anomaly probability value, as evidence citation information for the second anomaly probability value.

[0081] Among them, known failure modes are failure types confirmed in historical cases, such as memory leaks; variants refer to variations in details of the same failure mode, such as differences in performance under different hardware environments. The preset coverage threshold is a preset lower limit for similar segment coverage, for example, 0.3; results below this value are considered invalid. Target historical case data consists of one or more historical cases cited by the target language model as evidence in its reasoning. The counter-evidence summary is a list of evidence that does not support the current judgment; for example, the low-frequency energy of the current input is slightly higher than that of case B, possibly due to higher concurrency, but this does not affect the qualitative assessment.

[0082] In this embodiment, as Figure 4As shown, after inputting the prompt words, the target language model first verifies whether the current input's difference hotspot is a variant of a known fault mode corresponding to historical case data. For example, if the current input has an additional high-frequency energy spike compared to historical cases, the model needs to determine whether this spike is a reasonable evolution of the same type of fault (such as caused by sudden traffic). Secondly, the model uses similar segment coverage to exclude accidental overlap: if the similar segment coverage is lower than a preset coverage threshold (e.g., 0.3), the model should tend to consider the retrieval result invalid and output that the historical data retrieval result is invalid. Finally, based on the verification results and the validity judgment of the retrieval results, the model outputs a corrected second anomaly probability value, and simultaneously forces the output of at least one target historical case number (e.g., case B) on which this value is based, as well as a counter-evidence summary that does not support the judgment (e.g., the current input's low-frequency energy is slightly higher than case B, possibly due to higher concurrency). This embodiment effectively suppresses the illusion problem of large language models by forcing the model to output evidence citations and counter-evidence, improving the credibility and traceability of diagnostic results.

[0083] Furthermore, the present invention also specifies the implementation method for secondary verification and weight adjustment of the target language model output, which may include the following: Determine whether the overlap between the target historical case data and the data processing object in the hot zone is consistent with the description of the target language model; if it is determined that the overlap between the target historical case data and the data processing object in the hot zone is inconsistent with the description of the target language model, then reduce the fusion weight of the second anomaly probability value and simultaneously assign an insufficient evidence diagnostic label; if the rebuttal summary indicates that the rebuttal evidence is dominant, then reduce the fusion weight of the second anomaly probability value and simultaneously assign an insufficient evidence diagnostic label.

[0084] Among them, hotspot overlap refers to the degree of spatiotemporal overlap between the hotspots of the data processing object and the hotspots of historical cases, which can be quantified by intersection-union ratio or anchor matching ratio. Description consistency refers to the degree of overlap between the hotspots of the referenced cases claimed by the target language model in the output and the current input. Fusion weight is the weight coefficient of the second anomaly probability value in weighted fusion. Insufficient evidence diagnostic label is a label that marks the diagnostic conclusion as lacking sufficient evidence support, used to downgrade the output. Dominant evidence means that the number or importance of unsupportive evidence listed in the doomed evidence summary exceeds the supporting evidence.

[0085] In this embodiment, as Figure 4As shown, after obtaining the second anomaly probability value, it is determined whether the overlap of the target historical case data and the data processing object in terms of hot zones is consistent with the description of the target language model. For example, it checks whether the hot zone overlap of case B is really as high as the model output, such as reaching 92%. If they are inconsistent, for example, the actual overlap is only 60%, then the fusion weight of the second anomaly probability value is reduced, for example, from 0.8 to 0.4, and a "insufficient evidence" diagnostic label is assigned. If the counter-evidence summary indicates that the counter-evidence is dominant, for example, the counter-evidence lists 3 different hot zones while there is only 1 supporting evidence, the fusion weight of the second anomaly probability value is also reduced and a "insufficient evidence" label is assigned. This embodiment further ensures the reliability of the fusion result through a secondary verification mechanism, preventing the large language model from misquoting evidence or being misled by noise, and improving the accuracy of anomaly identification.

[0086] Furthermore, the present invention also defines a weighted fusion process for the first anomaly probability value and the second anomaly probability value, which may include the following: Obtain the online calibration table corresponding to the anomaly detection model. The online calibration table records the historical accuracy of the anomaly detection model in different score ranges. Query the corresponding historical accuracy in the online calibration table based on the first anomaly probability value, and use it as the first benchmark weight. Adjust the first benchmark weight according to the uncertainty coefficient to obtain the first fusion weight. The first fusion weight is inversely proportional to the uncertainty coefficient. Determine the second benchmark weight based on the label consistency score, and adjust the second benchmark weight according to the verification results output by the target language model to obtain the second fusion weight. Sum the product of the first anomaly probability value and the first fusion weight with the product of the second anomaly probability value and the second fusion weight, and use this sum as the anomaly detection result.

[0087] The online calibration table records the historical true accuracy of the anomaly detection model across different score ranges. For example, when the model outputs 0.5-0.6, the historical true accuracy is 55%; when it outputs 0.8-0.9, the accuracy is 90%. The first baseline weight is the historical accuracy obtained from the online calibration table based on the first anomaly probability value, reflecting the model's average reliability in that score range. The first fusion weight is the final weight of the first anomaly probability value obtained by adjusting the first baseline weight according to the uncertainty coefficient. The adjustment rule is: the larger the uncertainty coefficient, the more the first fusion weight is reduced relative to the first baseline weight, i.e., it is inversely proportional to the uncertainty coefficient. The second baseline weight is the basic weight of the second anomaly probability value directly determined by the label consistency score, usually equal to the label consistency score. The second fusion weight is the final weight of the second anomaly probability value obtained by adjusting the second baseline weight according to the verification results; it is reduced if verification is inconsistent or counter-evidence prevails. The anomaly detection result is the final output anomaly probability value.

[0088] In this embodiment, as Figure 4 As shown, the central controller obtains the online calibration table corresponding to the anomaly detection model, which records the model's historical true accuracy in different score ranges. Based on the first anomaly probability value (e.g., 0.58), the corresponding historical accuracy is retrieved from the table and used as the first baseline weight. Then, the first baseline weight is adjusted according to the uncertainty coefficient: the first fusion weight is inversely proportional to the uncertainty coefficient; for example, this can be expressed as: First fusion weight = First baseline weight × (1 - Uncertainty coefficient), e.g., 55% × (1 - 0.85) = 8.25%. Simultaneously, the central controller determines the second baseline weight based on the label consistency score (e.g., 0.6); for example, the label consistency score can be directly used as the value of the second baseline weight. The second baseline weight is then adjusted based on the target language model's output verification results (e.g., whether the secondary verification is consistent, whether the counter-evidence is dominant): if the secondary verification is inconsistent or the counter-evidence is dominant, it is reduced by a preset weighting factor (e.g., multiplied by 0.5) to obtain the second fusion weight. Finally, the product of the first anomaly probability value and the first fusion weight, plus the product of the second anomaly probability value and the second fusion weight, is used as the final anomaly detection result. The result is written into the fusion record. Furthermore, after the event is processed via the maintenance work order system or manually confirmed, the system performs knowledge feedback: if the judgment is correct, the system updates the correlation strength of related cases, strengthening their weight in future retrievals; if the judgment is incorrect, such as a false positive or false negative, the current input is added to the database as a new typical case, a new energy signature is generated, and the online calibration table of the anomaly identification model is corrected, reducing its confidence in similar modes. When the accumulated prediction bias exceeds a preset threshold, offline retraining or weight rule reassessment is automatically triggered to ensure that the gray zone gating threshold and fusion strategy can adaptively converge as the fault mode evolves.

[0089] This embodiment achieves adaptive decision-making by dynamically weighting and fusing the results, relying on local results when the confidence level of the edge model is high and relying on the central large model when the confidence level is low, so that the final output achieves the optimal balance between real-time performance and accuracy.

[0090] It should be noted that there is no strict order of execution between the steps in this invention. As long as they conform to the logical order, these steps can be executed simultaneously or in a certain preset order. Figure 1 This is just an illustrative example and does not mean that this is the only possible execution order.

[0091] This invention also provides a corresponding apparatus for the anomaly detection method, further enhancing the method's practicality. The apparatus can be described from both a functional module perspective and a hardware perspective. The anomaly detection apparatus provided by this invention is described below. This apparatus is used to implement the anomaly detection method provided by this invention. In this embodiment, the anomaly detection apparatus may include or be divided into one or more program modules. These program modules are stored in a storage medium and executed by one or more processors to complete the anomaly detection method disclosed in the embodiment. The program module referred to in this embodiment is a series of computer program instruction segments capable of performing a specific function. It is more suitable than the program itself for describing the execution process of the anomaly detection apparatus in the storage medium. The following description will specifically introduce the functions of each program module in this embodiment. The anomaly detection apparatus described below can be referred to in correspondence with the anomaly detection method described above.

[0092] From the perspective of functional modules, see Figure 6 , Figure 6 This is a structural diagram of the anomaly detection device provided in this embodiment under one specific implementation. The device deployed on the edge side may include: The data acquisition module 601 is used to process the acquired time-series monitoring data into data processing objects with unique object identifiers according to the data detection granularity.

[0093] The data analysis module 602 is used to perform time-frequency analysis on the data processing object and generate a feature fingerprint with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results.

[0094] The local identification module 603 is used to identify anomalies in the feature fingerprint using a trained anomaly identification model, and obtain a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model identification result.

[0095] The central reporting module 604 is used to determine, based on the uncertainty coefficient and the first anomaly probability value, that the anomaly detection result should not be the model recognition result, and instead adopt the anomaly detection result fed back by the central controller. The central controller determines the second anomaly probability value based on the feature fingerprint by retrieving and analyzing historical data, and merges the first anomaly probability value and the second anomaly probability value as the anomaly detection result based on the uncertainty coefficient and the consistency of the retrieval results.

[0096] From the perspective of functional modules, the devices deployed on the control side may include: The request receiving module 605 is used to receive anomaly identification requests sent by the edge controller. The anomaly identification request includes at least the feature fingerprint of the data processing object corresponding to the suspected abnormal data, the model identification result of the data processing object, and the uncertainty coefficient of the uncertainty of the model identification result. The edge controller processes the collected time-series monitoring data into data processing objects with unique object identifiers according to the data detection granularity. It performs time-frequency analysis on the data processing objects and generates feature fingerprints with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results. It uses the trained anomaly identification model to identify anomalies in the feature fingerprints and obtains a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model identification result. When it is determined that the anomaly detection result does not adopt the model identification result based on the uncertainty coefficient and the first anomaly probability value, an anomaly identification request is sent to the central controller.

[0097] The anomaly handling module 606 is used to determine a second anomaly probability value based on feature fingerprints by retrieving and analyzing historical data.

[0098] The result generation module 607 is used to fuse the first anomaly probability value and the second anomaly probability value as an anomaly detection result based on the uncertainty coefficient and the consistency of the retrieval results, and send the anomaly detection result to the edge controller so that the edge controller can use it as the anomaly detection result of the data processing object.

[0099] The anomaly detection device mentioned above is described from the perspective of functional modules. Furthermore, this invention also provides an electronic device, described from a hardware perspective. This electronic device includes a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the anomaly detection method embodiments described above.

[0100] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described anomaly detection method embodiments at runtime.

[0101] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0102] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described anomaly detection method embodiments.

[0103] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described anomaly detection method embodiments.

[0104] This invention also provides an anomaly detection system, see [link to relevant documentation]. Figure 7 The system includes an edge controller 701 and a central controller 702. The edge controller 701 is deployed on the monitored device of the cloud system, and the central controller 702 is deployed on the management device of the cloud system. The monitored device is a computing device or a virtual machine host of the cloud system. The edge controller 701 is used to implement the steps of the anomaly detection method executed on the edge side, i.e., the edge controller end, in any of the above embodiments when executing a computer program. The central controller 702 is used to implement the steps of the anomaly detection method executed on the central side, i.e., the central controller end, in any of the above embodiments when executing a computer program.

[0105] The edge side, or node side, can be each compute node or virtual machine host in the private cloud, where a lightweight data collection and feature generation agent can be deployed. This agent typically runs as a daemon set or sidecar mode, sharing host machine resources with business containers or virtualization processes. The edge side is fully responsible for the collection, cleaning, windowing, and initial feature engineering of raw indicator data. To reduce transmission bandwidth, wavelet packet energy feature extraction is performed entirely on-site at the edge side. Furthermore, the preliminary anomaly detection model based on Gradient Boosting Decision Tree (XGBoost) can be deployed on the edge side to achieve millisecond-level closed-loop processing, or deployed on demand in a regional centralized service, dynamically adjusted according to the computing power surplus of the edge nodes. The central side, or control side, deploys centralized control services in the management cluster of the cloud management platform. This layer includes uncertainty gating logic, vector retrieval services, LLM (Large Language Model) inference services, and the final fusion decision engine. The central side only processes gray-zone events reported by the edge side, i.e., difficult samples for which the local model on the edge side cannot provide high-confidence judgments. Non-gray-zone events are processed by the local model on the edge side and the processing flow terminates immediately, directly outputting the results, greatly reducing the load on the central link. This design strictly limits the high cost of vector retrieval and large model inference to a small number of difficult windows (usually less than 5% of the total traffic), avoiding network congestion and wasted computing power caused by uploading all data to the cloud. In the control path, the central side does not directly intervene in single inferences, but instead distributes model files and policy configurations by broadcasting version numbers. Knowledge base updates (such as adding new cases) and weight rule adjustments are performed through an asynchronous backfeed mechanism, without blocking the real-time detection process. Simultaneously, the event reporting on the edge side adopts an idempotent design, using window identifiers (such as window IDs) as deduplication keys to ensure that retrying due to network jitter does not cause duplicate alarms in the upper-layer system.

[0106] In an exemplary hardware deployment scenario, the anomaly detection system of this invention is integrated into a private cloud environment containing hundreds of compute nodes (physical servers and virtual machine hosts) and an independent management cluster. Edge controllers are deployed non-intrusively on each compute node: for containerized environments, the edge controllers run in sidecar mode or as a set of daemons, sharing the network namespace with business containers without requiring modification of the business image; for virtualized environments, the edge controllers are installed directly in the host operating system as lightweight agents. The central controller is deployed on multiple servers in the management cluster, forming a highly available service. The system can be designed with a standardized data adaptation layer, seamlessly integrating the metric streams of mainstream open-source monitoring systems such as Prometheus and Telegraf without replacing existing data collection facilities. Regarding feature activation strategies, the system supports canary releases at the tenant level: administrators can enable gray-zone retrieval and large language model diagnostics for core transaction business tenants, while only retaining gradient boosting decision tree detection on the edge side for ordinary test tenants. Once a problem is found in the new version model, a millisecond-level rollback can be achieved through differential configurations issued by the central controller, restoring to the previous stable version.

[0107] To objectively evaluate system performance, a set of metrics can be defined during deployment: end-to-end latency (the total time from metric generation to final alarm issuance), gray zone percentage (the percentage of samples identified as gray zones and sent to the center out of the total sample size), rollback rate (the proportion of large language model diagnostic results that are downweighted or marked as insufficient evidence during the fusion phase), calibration error convergence (the rate at which the deviation between the predicted probability and the actual probability of occurrence in the online calibration table decreases over time), retrieval consistency distribution (the statistical distribution of the consistency of recalled case labels), relative improvement in false positives and false negatives after fusion (the percentage decrease in false positive and false negative rates after introducing the gray zone mechanism compared to using the edge model alone), and the number of large language model calls and resource limits per unit time. These metrics are collected in real time and displayed on the operations dashboard for capacity planning and cost control.

[0108] For example, the edge controller 701 and the central controller 702 can interact with each other via a message queue. The edge controller 701 puts the data processing objects corresponding to the anomaly identification requests into the message queue in chronological order. The central controller 702 reads the corresponding data processing objects from the message queue through the object identifier to be processed. The edge controller 701 obtains the differential configuration information issued by the central controller 702 by listening to the configuration information change channel. The internal functional modules of the edge controller 701 transmit data through object identifiers. Each functional module acts as a consumer of the object identifier and performs operations on the data processing objects corresponding to the same object identifier in sequence through a subscription relationship.

[0109] Among them, the object to be processed identifier is a unique identifier (window ID) for the data processing object, used to accurately retrieve the corresponding object from the message queue. The configuration information change channel is the system's configuration center's change notification channel; the edge controller 701 obtains configuration updates by listening to this channel. Differential configuration information is configuration content issued by the central controller 702 that only includes the changed parts, such as upgrading the XGBoost model from v1.2 to v1.3 or adjusting the gray zone gating threshold from 0.4 to 0.45. Functional modules are the computer program encapsulation modules that execute anomaly recognition methods on the edge controller 701, such as the indicator windowing and snapshot archiving module, the wavelet energy map generation module, and the XGBoost confidence output and gating module. Similarly, the central controller's functional modules may include a gray zone retrieval module, an evidence package generation and large language model diagnosis module, and a fusion adjudication engine, such as... Figure 8 As shown, a consumer is a module that subscribes to a specific object identifier and processes the data of that object. The subscription relationship is where functional modules declare which object identifiers' data they will process, forming a processing pipeline.

[0110] In this embodiment, the edge controller 701 and the central controller 702 adopt an append-based asynchronous event stream mode, interacting with each other through a message queue. The edge controller 701 sequentially places the diagnostic window objects corresponding to the anomaly identification requests into the end of the message queue in chronological order. The central controller 702 reads the corresponding objects from the queue through the window identifier for consumption. The consumption process must satisfy idempotency: for multiple processing requests with the same window identifier, as long as the sealed version number of the window object is consistent, the output result must be strictly consistent to avoid duplicate calculations due to network retries. At the same time, the edge controller 701 adopts a versioned incremental subscription mode, not actively polling the configuration, but obtaining the differential configurations (e.g., upgrading the anomaly identification model from version 1 to version 2, or adjusting the gray zone gating threshold from 0.4 to 0.45) and weight rules issued by the central controller 702 by listening to the configuration information change channel. The central controller 702 only issues the changed parts instead of the full configuration, avoiding network storms caused by full synchronization and system jitter caused by frequent configuration changes. The various functional modules within the edge controller 701 (such as the window sealing module, feature extraction module, and anomaly recognition module) transmit data through window identifiers. Each module acts as a consumer of this identifier and performs window sealing, feature extraction, anomaly recognition, and traffic splitting operations sequentially on the diagnostic window object corresponding to the same window identifier through subscription relationships, forming a standardized processing pipeline. This achieves decoupling and efficient collaboration between modules, avoids redundant calculations, and ensures the timeliness and low overhead of configuration updates through incremental configuration subscription.

[0111] For example, when the network connection between the edge controller 701 and the central controller 702 is interrupted, the edge controller 701 is configured to: switch to degraded autonomous mode, stop sending anomaly identification requests to the central controller 702, cache the data corresponding to the anomaly identification requests in local storage, and use the preset coefficient threshold obtained most recently from the central controller 702 to perform anomaly identification on the data processing object. For the data processing object to be verified that is determined to have anomaly detection results that do not adopt the model identification results, a local pending confirmation label is assigned, and alarm information is output. When the network connection is restored, the anomaly identification requests in the cache are deduplicated according to the object identifier, and the deduplicated requests are... The processed anomaly identification request is retransmitted to the central controller 702. When the central controller 702 is received to suspend the transmission of anomaly identification requests, the anomaly identification requests in the cache are merged in local time order and sent to the target client. The central controller 702 is configured to monitor the rate at which it receives anomaly identification requests retransmitted by the edge controller 701 and the tag consistency score. When the number of anomaly identification requests received per unit time exceeds the preset rate threshold, or the tag consistency score is lower than the preset lower limit threshold multiple times in a row, the call to the target language model is stopped, and the edge controller 701 is notified to suspend the transmission of anomaly identification requests.

[0112] The degraded autonomous mode refers to the local independent operation mode that the edge controller 701 automatically switches to when the network is interrupted. It stops reporting gray zone samples and uses a local caching strategy for degradation judgment. Local storage refers to local disks or persistent storage on the edge nodes, used to cache gray zone sample snapshots. The preset coefficient threshold is the uncertainty coefficient threshold (e.g., 0.4) most recently obtained from the central controller 702, used to judge gray zones in degraded mode. The data to be verified is the sample whose uncertainty coefficient exceeds the threshold in degraded mode, i.e., samples that should have been reported but could not. The local pending confirmation label marks these samples as local pending confirmation and outputs a prompt alarm to ensure that basic detection capabilities are not interrupted. Deduplication can remove duplicates by window ID to avoid resending data from the same window after network recovery. The instruction to pause sending anomaly identification requests refers to the notification issued by the central controller 702 during circuit breaker, requiring the edge controller 701 to pause sending gray zone samples. The target client is the operation and maintenance platform or client that receives alarm information. The preset rate threshold is the upper limit of the number of anomaly identification requests received by the central controller 702 per unit time; exceeding this limit triggers circuit breaker. The preset lower threshold is the lower limit of the tag consistency score. If the score is lower than this value multiple times in a row, it means that the current fault mode is completely unknown and forced retrieval is meaningless.

[0113] In this embodiment, when the network connection between the edge controller 701 and the central controller 702 is interrupted (split-brain scenario), the edge controller 701 automatically switches to degraded autonomous mode, stops sending anomaly identification requests to the central controller, and caches all gray area samples (i.e., data processing objects whose uncertainty coefficient exceeds a preset threshold) on the local disk as snapshots. The system uses the most recently successfully acquired traffic splitting strategy (including the preset coefficient threshold, such as 0.4) for local anomaly identification. For gray area samples that cannot be determined, they are directly marked as pending local confirmation and an alert is output to ensure that basic detection capabilities are not interrupted. When the network connection is restored, the edge controller 701 performs deduplication processing on the cached anomaly identification requests according to the window identifier to avoid duplicate analysis, and retransmits the deduplicated requests to the central controller 702. After receiving the requests, the central controller 702 performs asynchronous backtracking analysis and updates the fusion record, but no longer triggers real-time alarms to avoid alarm storms. At the same time, the central controller 702 sets up a strict quota management and circuit breaker mechanism to monitor the rate of receiving anomaly identification requests retransmitted by the edge controller 701 and the label consistency score. When the number of requests received per unit time exceeds a preset rate threshold (e.g., 1000 times / second), or the tag consistency score falls below a preset lower limit threshold multiple times consecutively (e.g., 0.3, meaning the current fault mode is completely unknown and forced retrieval is meaningless), the system automatically triggers a circuit breaker. After the circuit breaker is triggered, the system degrades to an edge model-only observation queue mode, no longer calling the large language model, but simply relying on the temporal aggregation capability of the observation queue to wait for manual intervention, effectively avoiding the amplification of system load and secondary faults caused by large model calls during fault outbreaks. If the edge controller 701 receives a pause transmission instruction from the central controller 702, it merges the various anomaly identification requests in the cache according to the local time order and sends them to the target client (e.g., the alarm platform), while continuing to use the degradation strategy for local judgment. This embodiment realizes degradation autonomy and avalanche protection under network partitions, ensuring the availability of the system under extreme conditions, while avoiding resource waste and secondary faults through deduplication and circuit breaker mechanisms.

[0114] Finally, based on some possible application environments for the anomaly detection method, this invention also provides an exemplary application scenario embodiment to describe the entire process, which may include the following: This invention is deployed on a private cloud platform hosting a transaction database cluster. The underlying layer comprises 500 high-performance computing nodes. One physical host machine running the core Oracle database is designated Node-DB-007. During periods of surging network traffic, monitoring probes deployed as a daemon set collect data on Node-DB-007 at a frequency of once per second, including hundreds of metrics such as CPU utilization, IO wait time, and memory page swapping rate. The system's configured time window is 60 seconds. At 8:01 PM, a circular buffer is filled, and the average CPU utilization of Node-DB-007 reaches 85%. This CPU utilization is normal under surging traffic conditions. However, the underlying metric, IO wait time, exhibits high-frequency, slight fluctuations, accompanied by a minor surge in context switching.

[0115] The edge controller immediately performs a window sealing operation: It checks for a data gap at the 45th second in the bitmap (due to data loss caused by a sudden high load), and fills the gap using linear interpolation between the two preceding and following points; it calculates the SHA-256 hash value of the 60-second data as a digest fingerprint; it instantiates a diagnostic window object, assigns it a globally unique window identifier UUID-DB-007-2001, and marks the window state as sealed. This diagnostic window object enters the feature extraction queue, and because Node-DB-007 is marked as high priority, it is processed first. The feature extraction module uses Daubechies 4 mother wavelet to perform three-level wavelet packet decomposition on the IO wait index sequence, projecting the original signal onto eight frequency bands (Node0 to Node7). Node0 (low frequency) represents a macroscopic trend with high energy values; Node7 (high frequency) represents extremely short instantaneous spikes. The system calculations found that the energy proportion of the Node7 frequency band abnormally increased to 15% (normally only 1%), indicating the presence of severe microscopic spikes. The system divides the 60-second interval into ten 6-second time slices, generating an 8x10 two-dimensional energy map. It then extracts significant hot zones in the high-frequency band between the 30th and 40th seconds, obtaining hot zone anchor points (energy peak coordinates and connected domain boundaries). All these features (eight-dimensional energy vector, 8x10 energy map, hot zone anchor points) are written into the diagnostic window object, and the original data is then released, compressing the data volume by more than 95%.

[0116] The anomaly detection model (gradient boosting decision tree) running on the edge reads feature data for inference and outputs a first anomaly probability value of 0.58 (leaning towards an anomaly but with a low score). Uncertainty coefficient calculation: the score boundary distance |0.58-0.5| = 0.08, extremely close; the tree path divergence is extremely high, with 55 trees classifying it as positive and 45 as negative out of 100 trees; the feature distribution has a moderate Mahalanobis distance. The fusion yields an uncertainty coefficient of 0.85, exceeding the preset threshold of 0.4. This diagnostic window object is marked as a gray zone sample, neither directly alarmed nor ignored, but instead sent to the gray zone queue. The gray zone queue merges multiple consecutively arriving gray zone windows into a single sequence object and sends it to the central controller.

[0117] The central controller uses the energy vector as the query key to perform an approximate nearest neighbor search in the historical knowledge base. It then uses an inverted index to search only within the database node category, recalling fifty candidate cases. Based on the contribution of each frequency band (SHAP value) output by the anomaly detection model, the key frequency band causing hesitation in the judgment is identified as the conflict between the high-frequency band Node7 and the mid-frequency band Node3. Based on this, the candidate cases are re-weighted and sorted, ultimately identifying the three most similar cases: Case A (similarity 0.88) is CPU jitter caused by a Redis cache penetration incident; Case B (similarity 0.85) is waiting caused by log writer process write latency; and Case C (similarity 0.82) is a normal full database table scan.

[0118] The central controller constructs an evidence package containing the energy map of the current diagnostic window object and the energy maps of three cases, and labels the differences in hot zones. The constructed structured cue words require the target language model to compare time-frequency textures: the current sample has a high-frequency hot zone between the 30th and 40th seconds; the hot zone in case A is continuous; the hot zone in case B is pulsed and accompanied by low-frequency energy decay; the hot zone in case C is uniformly distributed. Please determine the most consistent pattern and provide a confidence level. The target language model outputs a diagnostic result favoring case B, because the high-frequency hot zone of the current sample exhibits obvious periodic pulse characteristics, with a texture overlap of 92% with case B, unlike the continuous noise of case A; the counter-evidence is that the low-frequency energy of the current sample is slightly higher than that of case B, possibly due to a higher concurrency in the current scene, but this does not affect the qualitative analysis; the corrected second anomaly probability value is 0.95.

[0119] The fusion engine received a first anomaly probability value of 0.58 (low confidence) and a second anomaly probability value of 0.95 (high confidence). Given the high uncertainty coefficient of 0.85, the weight of the second anomaly probability value was significantly increased, resulting in a final anomaly probability of 0.91 after weighted summation. The system issued a critical alert: Node-DB-007 is suspected of experiencing LGWR (LogWriter) latency, with a confidence level of 91%. Upon receiving the alert, the database administrator checked the logs and confirmed that the log synchronization delay was caused by storage array write latency. Due to timely detection, the archive storage path was switched before the business experienced significant slowdown, thus mitigating the fault. After the fault was resolved, the administrator marked the alert as valid, and the system stored the feature data corresponding to UUID-DB-007-2001 as a new typical case in the knowledge base, enhancing the ability to identify similar LGWR latency under high load in the future.

[0120] It should be noted that the above application scenarios are shown only to facilitate understanding of the ideas and principles of the present invention, and the embodiments of the present invention are not limited in any way. On the contrary, the embodiments of the present invention can be applied to any applicable scenario.

[0121] As shown above, this embodiment achieves millisecond-level closed-loop processing of most routine states at the edge through lightweight feature generation and tree model initial judgment, eliminating the need for network transmission and ensuring ultra-low latency monitoring. Only a small number of gray-zone samples with insufficient confidence are analyzed using the central side's large language model and historical knowledge base for in-depth comparative diagnosis. This leverages the intelligent analysis capabilities of the central side while avoiding network congestion and wasted computing power caused by uploading all data to the cloud. Simultaneously, by introducing an uncertainty profiling mechanism, it abandons single-threshold judgment and avoids blind guessing for samples where the model is uncertain. Instead, it uses a large language model for texture comparison and case investigation, effectively reducing false positive and false negative rates. Utilizing vector retrieval and the small-sample learning capability of the large language model, even if a fault occurs for the first time at the current node, as long as similar cases exist in the knowledge base for other nodes, the system can perform correlation diagnosis through feature similarity, breaking the data silo effect of edge nodes and solving the problems of small samples and cold start. The system forms a closed loop by integrating adjudication, human feedback, and knowledge reinjection, transforming each fault handling into experience accumulation. The knowledge base and model calibration table are continuously optimized, resulting in a spiral increase in overall diagnostic capabilities. Furthermore, by employing wavelet packet energy maps and fingerprints as transmission carriers, the characteristic data is compressed by one to two orders of magnitude compared to the original time-series data. Combined with a window freezing mechanism, this ensures data consistency in a distributed environment and eliminates attribution problems caused by unstructured data.

[0122] The above provides a detailed description of the anomaly detection method and system provided by this invention. The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Whether the units and algorithm steps of the various examples described in the disclosed embodiments are executed in electronic hardware or computer software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, and such implementations should not be considered beyond the scope of this invention. Several improvements and modifications can be made to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of this invention.

Claims

1. An anomaly detection method, characterized in that, include: The collected time-series monitoring data is processed into data processing objects with unique object identifiers according to the data detection granularity. Perform time-frequency analysis on the data processing object, and generate a feature fingerprint with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results; The trained anomaly detection model is used to perform anomaly detection on the feature fingerprint to obtain a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model's detection result. When it is determined, based on the uncertainty coefficient and the first anomaly probability value, that the anomaly detection result should not be the model recognition result, then the anomaly detection result fed back by the central controller should be used. The central controller determines a second anomaly probability value based on the feature fingerprint by retrieving and analyzing historical data, and combines the first anomaly probability value and the second anomaly probability value as an anomaly detection result according to the uncertainty coefficient and the consistency of the retrieval results.

2. The anomaly detection method according to claim 1, characterized in that, The data detection granularity is a preset window length, and the object identifier is a window identifier. The collected time-series monitoring data is processed into data processing objects with unique object identifiers according to the data detection granularity, including: The collected time-series monitoring data is written to the corresponding buffers in chronological order, and a corresponding missing bitmap is generated during the writing process. When the length of the data written to the buffer is detected to reach the preset window length, or when an external trigger event signal is received during the writing process, the data in the current window is used as the data processing object. The missing bitmap is used to fill in the data gaps in the data processing object and remove abnormal data caused by acquisition jitter to obtain a smooth data sequence. Calculate the digest fingerprint of the smoothed data sequence, assign a globally unique and immutable window identifier to the smoothed data sequence, and change the window state of the smoothed data sequence to a sealed state. The sealed state is used to indicate that the window corresponding to the smoothed data sequence is prohibited from write and modification operations.

3. The anomaly detection method according to claim 2, characterized in that, The data processing object is a diagnostic window object, processed according to the data detection granularity into data processing objects with unique object identifiers, including: When the time series monitoring data enters the preset time window end point, or when an external trigger event signal is received, a window object is created; The window object is initialized, and the smoothed data sequence is associated with the initialized window object to serve as a diagnostic window object; wherein, the initialized window object includes at least the data start time and data end time, an indicator signature identifying the data source, and a digest fingerprint; Assign a globally unique and immutable window identifier to the diagnostic window object, set the original data pointer to point to the physical address of the current window data in the buffer, and assign a sealed version number; the original data pointer is locked in the sealed state, and the sealed version number is incremented when the window data corresponding to the diagnostic window object is modified; Update the window state of the diagnostic window object from the write state to the sealed state, and send the diagnostic window object to the pre-built feature queue; In the feature queue, based on the rule that the higher the service level of the service, the higher the processing priority of the diagnostic window object, the corresponding processing priority is determined for each diagnostic window object. At the same time, based on the rule that the longer the waiting time of the diagnostic window object, the lower the processing weight, the processing weight of each diagnostic window object in the feature queue is adjusted.

4. The anomaly detection method according to claim 3, characterized in that, After sending the diagnostic window object to the pre-built feature queue, the process includes: Obtain the base priority score for the service level of the monitoring service corresponding to the diagnostic window object; the base priority score increases as the service level increases; The waiting time of the diagnostic window object from the moment it entered the feature queue to the current moment is calculated. According to the preset time decay coefficient, the product of the waiting time and the time decay coefficient is calculated as the decay deduction value, where the time decay coefficient represents the points deducted per unit waiting time. The priority score of the diagnostic window object is determined based on the base priority score and the attenuation deduction value; Diagnostic window objects are extracted from the feature queue in descending order of priority scores for time-frequency analysis. When a target diagnostic window object with a priority score less than or equal to a preset discard threshold is detected, the target diagnostic window object is removed from the feature queue.

5. The anomaly detection method according to any one of claims 1 to 4, characterized in that, The process of generating the feature fingerprint of the data processing object includes: The data processing object is decomposed into multiple wavelet packets based on the selected mother wavelet function. During the recursive decomposition process, the data processing object is projected from the full frequency band to multiple independent frequency band subspaces through low-pass and high-pass filters. Calculate the energy value of each frequency band, determine the energy vector based on the energy values ​​of all frequency bands, and determine the energy entropy of each frequency band based on the relative weight of the energy value of each frequency band to the sum of the energy of all frequency bands. The time series monitoring data corresponding to the data processing object is divided into multiple sub-data, the sub-energy of each sub-data is calculated, and each sub-energy is mapped to a finite discrete interval. The mapped sub-energy is then formed into a corresponding sub-energy vector. Based on the sub-data partitioning rules, the sub-energy vectors are arranged and integrated to form a two-dimensional energy matrix. The two-dimensional energy matrix is ​​then visualized to obtain an energy map. The feature fingerprint of the data processing object is determined based on the energy vector, the energy entropy, and the energy map.

6. The anomaly detection method according to claim 5, characterized in that, The multi-layer wavelet packet decomposition process of the data processing object includes: Select a mother wavelet function based on the characteristics of the time series monitoring data corresponding to the data processing object, and obtain a pair of orthogonal mirror filters that match the mother wavelet function as low-pass and high-pass filters. Obtain the preset decomposition level and determine the tree structure used in the decomposition process; The time series monitoring data corresponding to the data processing object is used as the node coefficient of the 0th layer of the tree structure, and it is checked whether there are node coefficients of each layer that have been calculated and saved in the decomposition process of the previous adjacent data processing object in the cache. If the node coefficients of each layer exist in the cache, then based on the data increment of the current data processing object relative to the previous adjacent data processing object, the node path in the tree structure affected by the data increment is identified, and only the node path is subjected to convolution and downsampling calculations, while the other nodes directly reuse the corresponding node coefficients in the cache. If the node coefficients of each layer are not present in the cache, the complete recursive decomposition process is entered: for each node of each layer, the node coefficients are convolved with the low-pass filter and the high-pass filter respectively, and the convolution result is downsampled by a factor of 2 to obtain the low-frequency sub-node coefficients and high-frequency sub-node coefficients of the next layer; after the calculation of each node is completed, the corresponding node coefficients are stored in the cache for reuse by subsequent adjacent data processing objects. The decomposition operation stops when the current decomposition level reaches the preset decomposition level, and the coefficients of each leaf node are used as sub-band signals of the corresponding frequency band.

7. The anomaly detection method according to claim 5, characterized in that, Based on the energy vector, the energy entropy, and the energy map, the feature fingerprint of the data processing object is determined, including: During the image processing of the two-dimensional energy matrix, connected regions with energy values ​​exceeding a preset energy threshold are extracted; Obtain the energy peak coordinates and the boundary of each connected region as anchor points for the thermal zone; The energy vector, the energy entropy, the energy map, and the hot zone anchor point are fused to obtain the feature fingerprint of the data processing object.

8. The anomaly detection method according to any one of claims 1 to 4, characterized in that, The calculation process of the uncertainty coefficient includes: Calculate the absolute difference between the first anomaly probability value and the decision boundary value, and use it as the score boundary distance; The difference in the proportion of decision trees with positive anomaly identification results to decision trees with negative anomaly identification results in the anomaly identification model is used as the tree path divergence degree. Calculate the distance between the feature fingerprint and the center distribution of the training dataset, and use it as the feature distribution distance; The uncertainty coefficient is determined based on the fusion result of the fraction boundary distance, the tree path divergence degree, and the feature distribution distance.

9. The anomaly detection method according to claim 8, characterized in that, The feature fingerprint includes at least the energy vector of the data processing object, including: The energy vector is input into the anomaly recognition model to obtain the probability value of the data processing object belonging to the anomaly category, which is used as the first anomaly probability value. If the distance to the score boundary is greater than or equal to a preset distance threshold and the uncertainty coefficient is less than a preset coefficient threshold, the anomaly detection result of the data processing object is directly output based on the first anomaly probability value; otherwise, the data processing object is sent as suspected anomalous data to a pre-built gray zone queue. In the gray zone queue, data processing objects corresponding to multiple suspected abnormal data that belong to the same monitoring indicator source and arrive consecutively are merged and deduplicated to generate a sequence object containing a longer time context, and the sequence object is sent to the central controller.

10. The anomaly detection method according to claim 8, characterized in that, The uncertainty coefficient is determined based on the fusion result of the fraction boundary distance, the tree path divergence degree, and the feature distribution distance, including: Normalize the fraction boundary distance, the tree path divergence degree, and the feature distribution distance respectively; Obtain the first weight value, the second weight value, and the third weight value corresponding to the score boundary distance, the tree path divergence degree, and the feature distribution distance, respectively; The uncertainty coefficient is obtained by adding the product of the normalized fractional boundary distance and the first weight value, the product of the normalized tree path divergence degree and the second weight value, and the product of the normalized feature distribution distance and the third weight value.

11. An anomaly detection method, characterized in that, include: Receive anomaly identification requests sent by the edge controller; The anomaly identification request includes at least the feature fingerprint of the data processing object corresponding to the suspected abnormal data, the model identification result of the data processing object, and the uncertainty coefficient that quantifies the uncertainty of the model identification result; Based on the aforementioned characteristic fingerprint, a second anomaly probability value is determined by retrieving and analyzing historical data; Based on the uncertainty coefficient and the consistency of the search results, the first anomaly probability value and the second anomaly probability value are fused together as the anomaly detection result, and the anomaly detection result is sent to the edge controller so that the edge controller can use it as the anomaly detection result of the data processing object. The edge controller processes the collected time-series monitoring data into data processing objects with unique object identifiers according to the data detection granularity; performs time-frequency analysis on the data processing objects, and generates feature fingerprints with write-prohibited and modification-prohibited attributes based on the time-frequency analysis results; uses a trained anomaly recognition model to perform anomaly recognition on the feature fingerprints, and obtains a first anomaly probability value and an uncertainty coefficient used to quantify the uncertainty of the model recognition result; when it is determined, based on the uncertainty coefficient and the first anomaly probability value, that the anomaly detection result does not adopt the model recognition result, an anomaly recognition request is sent to the central controller.

12. The anomaly detection method according to claim 11, characterized in that, The feature fingerprint includes at least an energy vector, and the historical data retrieval process includes: Using the energy vector in the feature fingerprint as the query vector, similar historical cases are queried in the historical database to obtain a candidate historical dataset; Using an inverted index, historical case data whose physical scene does not match the monitoring object scene corresponding to the data processing object are removed from the candidate historical dataset; Based on the contribution of the energy values ​​of each frequency band output by the anomaly identification model to the model identification results, the target frequency band that affects the model identification results is determined. Based on assigning greater weight values ​​to historical case data with high similarity to the data processing object in the target frequency band, corresponding sorting weights are set for historical case data in the filtered candidate historical dataset. Based on the sorting weight from largest to smallest, a preset number of historical case data are selected from the filtered candidate historical dataset to serve as the historical dataset.

13. The anomaly detection method according to claim 11, characterized in that, The feature fingerprint also includes an energy map and thermal anchor points, and the analysis process of the historical data includes: Obtain the status labels of each historical case in the historical dataset, and cluster the historical case data with the same status label to obtain multiple sets of historical case data; For each group of historical case data, align the energy map of the data processing object with the energy map of each current historical case data in the current group on the time axis; Based on the matching results between the hot zone anchor points of the data processing object and the hot zone anchor points of each current historical case data, the similar segment coverage rate is determined based on the number of hot zone units of the data processing object covered by the current historical case data and the total number of hot zone units. Based on the matching results, anchor points of the data processing object that are not matched by each current historical case data are identified, and each unmatched anchor point is taken as a differential hot zone. The spatiotemporal coordinates and energy intensity of each differential hot zone are recorded to generate a differential hot zone list. The frequency of each status label is counted to determine the target status label with the highest frequency. The label consistency score is determined based on the frequency of the target status label and the total number of historical case data contained in the historical dataset. Based on the similar segment coverage, the list of differential hot zones, and the label consistency score, the historical data analysis results of the data processing object are generated.

14. The anomaly detection method according to claim 11, characterized in that, The probability value of the second anomaly is determined by retrieving and analyzing historical data, including: Based on historical data analysis results, the characteristic fingerprint of the data processing object, the monitoring object and scene information, generate prompt words that include at least comparative analysis and anomaly probability output; Call the target language model that has comparative analysis capabilities and can output anomaly probabilities, and input the prompt words into the target language model; The second anomaly probability value is obtained based on the output of the target language model.

15. The anomaly detection method according to claim 14, characterized in that, After inputting the prompt words into the target language model, the process further includes: The target language model verifies whether the difference hotspot of the data processing object is a variant of the known fault mode corresponding to the historical case data, and outputs the verification result; if the similarity segment coverage between the data processing object and each historical case data is less than the preset coverage threshold, the output historical data retrieval result is invalid. The target language model outputs a second anomaly probability value based on the validity judgment results of the verification results and the retrieval results. At the same time, it outputs at least one target historical case data on which the second anomaly probability value is based and a reverse evidence summary that does not support the second anomaly probability value, as evidence citation information for the second anomaly probability value.

16. The anomaly detection method according to claim 15, characterized in that, After obtaining the second anomaly probability value, it also includes: Determine whether the target historical case data and the data processing object are consistent with the description of the target language model in terms of hot zone overlap; If it is determined that the target historical case data and the data processing object are inconsistent with the description of the target language model in terms of hot zone overlap, then the fusion weight of the second abnormal probability value is reduced, and a diagnostic label of insufficient evidence is assigned at the same time. If the summary of the evidence of contradiction indicates that the evidence of contradiction is dominant, then the fusion weight of the second abnormal probability value is reduced, and a diagnostic label of insufficient evidence is assigned at the same time.

17. The anomaly detection method according to any one of claims 11 to 16, characterized in that, The process of merging the first anomaly probability value and the second anomaly probability value includes: Obtain the online calibration table corresponding to the anomaly detection model, which records the historical accuracy of the anomaly detection model in different score ranges; Based on the first anomaly probability value, the corresponding historical accuracy is queried in the online calibration table and used as the first benchmark weight; The first benchmark weight is adjusted according to the uncertainty coefficient to obtain the first fusion weight; the first fusion weight is inversely proportional to the uncertainty coefficient. The second baseline weight is determined based on the label consistency score, and the second baseline weight is adjusted based on the verification results output by the target language model to obtain the second fusion weight. The sum of the product of the first anomaly probability value and the first fusion weight, and the product of the second anomaly probability value and the second fusion weight, is taken as the anomaly detection result.

18. An anomaly detection system, characterized in that, It includes an edge controller and a central controller. The edge controller is deployed on the monitored device of the cloud system, and the central controller is deployed on the management device of the cloud system. The monitored device is a computing device or a virtual machine host of the cloud system. Wherein, the edge controller is used to implement the steps of the anomaly detection method as described in any one of claims 1 to 10 when executing a computer program; the central controller is used to implement the steps of the anomaly detection method as described in any one of claims 11 to 17 when executing a computer program.

19. The anomaly detection system according to claim 18, characterized in that, The edge controller and the central controller interact with each other through a message queue. The edge controller puts the data processing objects corresponding to the anomaly identification requests into the message queue in chronological order. The central controller reads the corresponding data processing objects from the message queue through the object identifier to be processed. The edge controller obtains the differential configuration information issued by the central controller by listening to the configuration information change channel; The internal functional modules of the edge controller transmit data through object identifiers. Each functional module acts as a consumer of the object identifier and performs operations on the data processing object corresponding to the same object identifier in sequence through a subscription relationship.

20. The anomaly detection system according to claim 18, characterized in that, When the network connection between the edge controller and the central controller is interrupted; The edge controller is configured to: switch to degraded autonomous mode, stop sending anomaly identification requests to the central controller, cache the data corresponding to the anomaly identification requests in local storage, and use the preset coefficient threshold obtained from the central controller the most recent time to perform anomaly identification on the data processing object. For the data processing object to be verified that the model identification result is not adopted after the anomaly detection result is determined, a local pending confirmation label is assigned and an alarm message is output. Once the network connection is restored, the abnormal identification requests in the cache are deduplicated according to the object identifier, and the deduplicated abnormal identification requests are retransmitted to the central controller. When the central controller is received to pause sending anomaly identification requests, the cached anomaly identification requests are merged in local time order and sent to the target client. The central controller is configured to: monitor the rate of retransmission of anomaly identification requests and the label consistency score from the edge controller; when the number of anomaly identification requests received per unit time exceeds a preset rate threshold, or the label consistency score is lower than a preset lower limit threshold multiple times in a row, stop calling the target language model and notify the edge controller to suspend sending anomaly identification requests.

Images