Anomaly detection method, device, storage medium, and program product

Abstract

Embodiments of the present application provide an anomaly detection method and device, a storage medium and a program product. In the method, a weight mechanism is introduced for a detection period, and the weight of a data sample decreases with the age of the sample, so that the contribution of the data sample of an earlier detection period to anomaly detection is smaller, and the contribution of the data sample of a detection period closer to the present is greater. The influence of the data sample of a historical detection period far from the present on the statistical result is reduced, the statistical result more truly reflects the latest state of the target object, quickly follows the dynamic change of the monitored object, and anomaly detection that adapts to the dynamic change of the monitored object is achieved, which can improve the accuracy of anomaly detection of the target object. On the other hand, in any detection period of online anomaly detection, the data sample newly collected in the present period is directly used to iteratively update the historical statistical feature, and the sample data of the historical detection period is not required to be used for calculation, which can improve the efficiency of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an anomaly detection method, device, storage medium, and program product. Background Technology

[0002] In online scenarios, time-series data is presented as streaming data. Anomaly detection for streaming data is widely used in various time-based data analysis applications, such as cloud computing services, cloud storage services, industrial IoT, and intelligent transportation. These service systems typically consist of tens of millions of hardware and software components. The system is designed to be highly resilient and fault-tolerant to cope with various possible failure scenarios. However, even so, any single point of failure or potential problem can lead to service performance degradation or even interruption, thus affecting all users who rely on these services. To effectively prevent and restore service, a comprehensive monitoring system must be established to continuously monitor the system's health, detect anomalies in the monitored objects, and promptly identify and locate the source of problems. However, existing anomaly detection methods cannot adapt to the dynamic changes of the monitored objects, resulting in low anomaly detection accuracy. Summary of the Invention

[0003] This application provides an anomaly detection method, apparatus, storage medium, and program product in several aspects to improve the accuracy and efficiency of anomaly detection.

[0004] This application provides an anomaly detection method, including:

[0005] Obtain the measurement value of the target object's metrics in the current detection period;

[0006] Obtain the historical weighted statistical features of indicators for at least one monitored object in the monitored object group over historical monitoring periods; the historical weighted statistical features are obtained by iterative calculation in the previous monitoring period of the current monitoring period; the at least one monitored object includes the target object; the earlier the monitoring period, the smaller the weight;

[0007] Based on the historical weighted statistical features, the metric value, and the weight of the current detection period, the target weighted statistical features of the target object's indicators from the historical detection period to the current detection period are determined;

[0008] Based on the target weighted statistical characteristics, the target weighted statistics of the target object's indicators are determined from the historical detection period to the current detection period; the target weighted statistical characteristics are intermediate values ​​used to determine the target weighted statistics.

[0009] Based on the metric and the target weighted statistic, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object.

[0010] This application also provides an anomaly detection method, including:

[0011] Obtain multiple measurement values ​​corresponding to multiple indicators for at least one monitored object in the monitored object group; the multiple measurement values ​​corresponding to any one indicator belong to multiple detection periods;

[0012] Based on the multiple metrics corresponding to each of the multiple indicators and the weights of the multiple detection periods, the target weighted mean vector and the target weighted covariance matrix of the multiple indicators are determined; the earlier the detection period, the smaller the weight.

[0013] From the multiple measurement values ​​corresponding to each of the multiple indicators, obtain the multiple measurement values ​​of the target object in the at least one monitoring object in the current detection period.

[0014] Based on the target weighted mean vector, the target weighted covariance matrix, and multiple metrics of the target object in the current detection period, determine the Mahalanobis distance of the multiple metrics of the target object in the current detection period;

[0015] Based on the Mahalanobis distance, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object.

[0016] This application also provides an electronic device, including: a memory and a processor; wherein the memory is used to store computer programs;

[0017] The processor is coupled to the memory and is used to execute the computer program to perform the steps in the aforementioned anomaly detection methods.

[0018] This application also provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps in the aforementioned anomaly detection method.

[0019] This application also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the aforementioned anomaly detection method.

[0020] In this embodiment, a weighting mechanism is introduced for the detection period. Historical detection periods closer to the current detection period have a higher weight; that is, the weight of data samples decays with the age of the samples. This results in earlier detection periods contributing less to anomaly detection and more recent detection periods contributing more. This reduces the impact of data samples from distant historical detection periods on the statistical results, helping to more accurately reflect the latest state of the target object and quickly keep up with the dynamic changes in the monitored object's system. This enables anomaly detection that adapts to the dynamic changes of the monitored object, thereby improving the accuracy of anomaly detection. Furthermore, in any detection period of online anomaly detection, newly collected data samples from the current detection period are directly used to iteratively update historical statistical features without using sample data from previous detection periods for calculation. Compared to batch calculations using a large number of historical samples, this speeds up anomaly detection and improves its efficiency. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1a and Figure 1b A flowchart illustrating the anomaly detection method provided in this application embodiment;

[0023] Figure 2 and Figure 3 A schematic diagram illustrating the distribution of the measurement values ​​of multiple indicators provided in the embodiments of this application;

[0024] Figure 4 A flowchart illustrating another anomaly detection method provided in an embodiment of this application;

[0025] Figure 5a A flowchart illustrating yet another anomaly detection method provided in an embodiment of this application;

[0026] Figure 5b This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0029] The terms or concepts involved in the embodiments of this application are explained below.

[0030] Online computation (online algorithms) is an iterative computation process that executes periodically to update certain statistical state variables. Within each period, the computation is only allowed to use the metrics collected in that period and the state variables updated in the previous period or the first few steps of the current period. Therefore, online computation is highly efficient in terms of time and space consumption, but requires a more complex design compared to batch computation. Batch computation is the opposite of online computation.

[0031] Batch computing: Batch computing is a computational process that is executed periodically over time, using large amounts of historical data to calculate the values ​​of certain statistical variables. Batch computing does not require strict computational rules, but it is much less efficient in terms of time and space consumption.

[0032] Online adaptive computation: Online adaptive computation is a computational process that enables statistical state variables to closely reflect or quickly keep up with the dynamic changes of the underlying system when the environment and system dynamics change.

[0033] Anomaly detection: Anomaly detection is a process used to identify metrics that do not follow similar patterns that occur in most of the historical metrics.

[0034] Streaming data: Streaming data refers to data that arrives at a data warehouse or monitoring system continuously over time, or data that arrives in small batches at each time period. Each row of data is timestamped, indicating the time of the event or a snapshot of the time period.

[0035] Multidimensional quantitative data: Multidimensional quantitative data is measurement data that can be organized into two-dimensional tabular data, including three types of columns: (1) at least one timestamp, indicating the time of the event or the snapshot time of the time period; (2) zero to more columns consisting of discrete values, which indicate the context of the event or snapshot, such as why, what, who / who was, where it happened, etc., which can identify a unique monitoring object; (3) one or more numerical columns, indicating the numerical values ​​of the indicators that measure the event or snapshot.

[0036] The following example illustrates traditional anomaly detection methods.

[0037] Traditional anomaly detection method 1: An anomaly detection method that uses control charts for various indicators for batch calculation.

[0038] Specifically, at each time point t, for n in the monitored object group t For each of the m indicators of a monitoring object, x is... i If each observation is obtained, then the index x i At time point t, n is used in total. t One observation value. A large amount of historical indicator data can also be obtained x. i,k (τ). Where x i,k (τ) represents the k-th observation of the i-th indicator at time point τ. Where τ = 1, 2, ..., t; i = 1, 2, ..., m; k = 1, 2, ..., n τ n τ This indicates that at time point τ, each indicator has n values. τ A batch anomaly detection method using control charts for each indicator may include the following steps: [Number of observations].

[0039] Step 1: Calculate the indicators x within time 1-t. i mean Accordingly, mean Represented as:

[0040]

[0041] Step 2: Calculate index x i Standard deviation Where i = 1, 2, ..., m. Correspondingly, the standard deviation... Represented as:

[0042]

[0043] Step 3: Choose the value of the scaling factor R. Usually, R ≥ 3, but in some cases, 3 ≤ R ≤ 10. R = 3 is usually chosen.

[0044] Step 4: Detection index x i The observed value x i,k (τ) and mean To determine whether the deviation between the observed values ​​is greater than R times the standard deviation, we need to check whether the following equation (3) holds true. i,k (τ) and mean The deviation between them can be expressed by the index x. i The observed value x i,k (τ) and mean The absolute value of the difference between them is used to express the result. Accordingly, equation (3) can be expressed as:

[0045]

[0046] If equation (3) holds, that is, if index x i If the deviation between the observed value and the mean is greater than R times the standard deviation, then the indicator x of the monitoring object is determined. i Anomaly. If equation (3) above does not hold, i.e., index x i If the deviation between the observed value and the mean is less than or equal to R times the standard deviation, then the indicator x of the monitored object is determined. i normal.

[0047] The index x is tested by checking whether the above formula (3) holds true. i Whether it is abnormal, this is mainly because the same indicator x i The deviation between the observed values ​​and the mean is less than or equal to the mean for the vast majority (generally over 99% of the data sample). Data that does not conform to the distribution pattern of the vast majority of data (e.g., over 99% of the data) can be considered outlier. For example, in a normal distribution... Approximately 99.73%, meaning that about 99.73% of the data deviates from the mean by less than or equal to... If a very small number of data points deviate from the mean by more than [a certain value] Then the data can be considered abnormal.

[0048] The above-mentioned anomaly detection methods have the following drawbacks:

[0049] (1) When using control charts for each indicator for batch calculations, all or a large number of historical data samples are used. Compared with online calculations, this method has lower computational efficiency. It also requires storing all historical data samples, thus consuming more storage resources.

[0050] (2) The environment or state of the monitored object may change over time. The control chart method for each indicator is used to assign the same weight to all historical data samples. When the monitored object has been running for a long time and the underlying system is dynamically changing, the dynamic information of the new system carried in the most recent data samples has a smaller impact on the statistical variables. Therefore, the speed of adapting to the dynamics of the new system is slower, resulting in lower accuracy of anomaly detection.

[0051] (3) The control chart method using each indicator does not take into account the interaction between different indicators, so it cannot detect anomalies that require comprehensive consideration of multiple indicators.

[0052] In order to detect anomalies that can only be found by combining multiple indicators, the method of batch calculation of Mahalanobis distance of multiple indicators can be used for anomaly detection, namely the traditional anomaly detection method 2 below.

[0053] Traditional anomaly detection method 2: An anomaly detection method that uses Mahalanobis distance with multiple metrics for batch calculation.

[0054] Specifically, at each time point t, for n in the monitoring cluster t For each of the m indicators of a monitoring object, x is... i If each observation is obtained, then the index x i At time point t, n is used in total. t One observation value. A large amount of historical indicator data can also be obtained x. i,k (τ). Where x i,k (τ) represents the k-th observation of the i-th indicator at time point τ. Where τ = 1, 2, ..., t; i = 1, 2, ..., m; k = 1, 2, ..., n τ n τ This indicates that at time point τ, each indicator has n values. τ A batch anomaly detection method using control charts with multiple indicators may include the following steps: [Number of observations].

[0055] Step 1: Calculate index x i mean Accordingly, mean Represented as:

[0056]

[0057] Step 2: Calculate any two indicators x i and x j Covariance between Where i = 1, 2, ..., m and j = 1, 2, ..., m. i and j can be equal. Covariance It can be represented as:

[0058]

[0059] Step 3: Through each indicator x i The mean at 1-t time points Construct the mean vector μ x (t). Where i = 1, 2, ..., m. Mean vector μ x (t) can be expressed as:

[0060]

[0061] In equation (6), [·]T This indicates the transpose of [·].

[0062] Step 4: Through indicator x i With x j covariance Construct the covariance matrix Σ(t). Where i = 1, 2, ..., m; j = 1, 2, ..., m. i and j can be equal. The covariance matrix Σ(t) can be expressed as:

[0063]

[0064] Step 5: For the k-th monitoring object, the Mahalanobis distance of the m indicators of that monitoring object at time point t can be expressed as:

[0065]

[0066] In equation (8), Σ -1 (t) denotes the inverse of the covariance matrix ∑(t), x k (t) represents the observed values ​​x of m indicators of the k-th monitored object at time point t. i,k The observation vector composed of (t), i.e., x k (t)=[x 1，k (t), x 2，k (t), ..., x m，k (t)] T k = 1, 2, ..., m.

[0067] Step 6: Choose a value for the scaling factor R. Usually, R ≥ 3, but in some cases, 3 ≤ R ≤ 10. R = 3 is typically chosen.

[0068] Step 7: Detect the Mahalanobis distance d of the m indicators of the k-th monitored object at time point t. M Is it greater than the scaling factor R? That is, check d. M > Is R true? If true, that is, the Mahalanobis distance d of the m indicators of the monitored object at time point t. M If d is greater than R, then the m indicators of the k-th monitoring object are determined to be abnormal; if d M >R is not true, meaning the Mahalanobis distance d of the m indicators of the monitored object at time point t is not true. M If R is less than or equal to R, then the m indicators of the kth monitored object are determined to be normal.

[0069] Mahalanobis distance essentially reflects the position of an observation within the probability density function of a given distribution. A larger Mahalanobis distance means that the observation is far from the core region where most data clusters, i.e., in a low-probability region, and is therefore considered anomaly (in this embodiment, the observed value of the indicator). Choosing a scaling factor R as the threshold for determining whether an indicator is anomaly ensures that only data significantly deviating from the normal range is marked as anomaly. For example, for a multivariate normal distribution probability density function, according to the theory of multivariate normal distribution, approximately 99.73% of the data should fall within the mean plus or minus three standard deviations. Therefore, when the Mahalanobis distance exceeds this limit, the observation can be considered anomaly.

[0070] In this anomaly detection scheme, Mahalanobis distance standardizes the data by dividing by the standard deviation of each dimension, allowing for fair comparison of data at different scales. This means that even if different indicators have different units or magnitudes, their impact on the distance will be appropriately adjusted. Besides adjusting the scale, Mahalanobis distance also utilizes the covariance matrix to capture the correlation between variables. Therefore, for multivariate systems, anomalies in individual indicators may not fully reflect the system's health, as some anomalies may be caused by the combined effects of multiple variables. Mahalanobis distance can comprehensively consider all related indicators, thus providing a more comprehensive and accurate assessment method. However, the aforementioned traditional anomaly detection method 2 has the following drawbacks:

[0071] 1. When performing batch calculations using Mahalanobis distance for multiple indicators, all or a large number of historical data samples are used. Compared to online calculations, this method is less computationally efficient. It also requires storing all historical data samples, thus incurring high storage requirements.

[0072] 2. The system environment may change over time. The Mahalanobis distance method, using multiple indicators, assigns equal weights to all historical data samples. When the system has been running for a long time and the underlying system dynamics change, the new system dynamic information carried in the most recent data samples has a smaller impact on statistical variables. Therefore, the system adapts to the new system dynamics more slowly, resulting in lower anomaly detection accuracy.

[0073] In some embodiments of this application, a weighting mechanism is introduced for the detection period. Historical detection periods closer to the current detection period have a higher weight; that is, the weight of a data sample decays with the age of the sample. This results in earlier detection periods contributing less to anomaly detection and more recent detection periods contributing more. This reduces the impact of data samples from distant historical detection periods on the statistical results, helping to make the statistical results more accurately reflect the latest state of the target object, quickly keeping up with the dynamic changes in the monitored object's system, and achieving anomaly detection that adapts to the dynamic changes of the monitored object, thereby improving the accuracy of anomaly detection. On the other hand, in any detection period of online anomaly detection, the newly collected data samples of the current detection period are directly used to iteratively update historical statistical features without using sample data from previous detection periods for calculation. Compared to batch calculations using a large number of historical samples to calculate statistical results, this speeds up anomaly detection and improves its efficiency.

[0074] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0075] It should be noted that the same reference numerals in the following figures and embodiments denote the same object or the same step. Therefore, once an object or step is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0076] Figure 1a This is a flowchart illustrating the anomaly detection method provided in an embodiment of this application. Figure 1a As shown, the anomaly detection method may include the following steps:

[0077] 11. Obtain the measurement value of the target object's index in the current detection period.

[0078] 12. Obtain the historical weighted statistical characteristics of the indicators of at least one monitoring object in the monitoring object group in the historical detection period; the historical weighted statistical characteristics are obtained by iterative calculation in the previous detection period of the current detection period; at least one monitoring object includes the target object; the earlier the detection period, the smaller the weight.

[0079] 13. Based on historical weighted statistical characteristics, measurement values, and the weight of the current detection period, determine the target weighted statistical characteristics of the target object's indicators from the historical detection period to the current detection period.

[0080] 14. Based on the target weighted statistical characteristics, determine the target weighted statistics of the target object's indicators from the historical detection period to the current detection period; the target weighted statistical characteristics are the intermediate quantities for determining the target weighted statistics.

[0081] 15. Based on the metric and target weighted statistics, perform anomaly detection on the target object to obtain the anomaly detection results.

[0082] The anomaly detection method provided in this embodiment mainly achieves online anomaly detection. It can employ statistical methods, utilizing statistical information of the monitored objects' indicators to detect their health status. Compared to anomaly detection using neural network models, this method eliminates the need for model training, thus reducing model training costs.

[0083] The inventors of this application have discovered that determining the statistical measure of a target object's indicator requires first determining some intermediate quantities, which are obtained through periodic accumulation. Therefore, to accelerate online anomaly detection and save storage space, the statistical measure of the indicator can be determined by updating these intermediate quantities. The statistical characteristics of the indicator serve as intermediate quantities for determining its statistical measure. Different anomaly detection methods require different statistical measures, and different statistical measures require different statistical characteristics. This will be described in the embodiments below and will not be elaborated upon here.

[0084] Therefore, to reduce the storage space occupied by historical metrics of each indicator in the historical detection period, the aforementioned intermediate features calculated in the historical detection period can be stored and updated periodically. This eliminates the need to store the historical metrics of all indicators, saving storage space occupied by historical data. During online anomaly detection, the historical intermediate features can be directly used for subsequent calculations instead of starting from scratch, which can also speed up anomaly detection and improve the timeliness and efficiency of anomaly detection.

[0085] In this embodiment, the aforementioned anomaly detection method using single-index and multi-index batch calculation methods cannot quickly adapt to the dynamic changes of the monitored object, resulting in low anomaly detection accuracy. To solve this technical problem, in this embodiment, a weight is introduced for the detection period. The earlier the detection period, the smaller the weight; that is, the earlier the detection period, the smaller the contribution of data samples in the anomaly detection process. The more recent the detection period, the greater the contribution of data samples in the anomaly detection process. This reduces the influence of historical detection periods far removed from the present on the statistical results, allowing the statistical results to truly reflect the latest state of the monitored object and quickly keep up with the system dynamic changes of the monitored object. The weight of the detection period is greater than 0 and less than or equal to 1.

[0086] In some embodiments, the weights of a detection period can be set to decay periodically over time, with the decay factor defined as α. 0 < α < 1. Before starting the iterative calculation, the aforementioned intermediate features can be initialized to 0. If the current detection period is the first detection period, the intermediate features are set to 0. A decay factor α also needs to be set for the iterative calculation. When α = 1, all historical data samples have equal weights, and the statistics become common values ​​such as the sample mean, sample variance, and sample standard deviation. The statistical properties of these statistics may change gradually. For example, cloud storage services may attract more and more users over time. The system load will increase accordingly, and the response time may also differ after the system load increases. When all historical data samples have equal weights, the statistical properties may lag behind the changing dynamics. Therefore, an appropriate decay factor α can be chosen to make the sample statistics reflect the true recent system dynamics.

[0087] The value of the attenuation factor α can be determined according to a pre-set weight attenuation rule. For example, the weight attenuation rule could be: when the sampling time period is backdated to n days, the sample weight attenuates to 1 / 2. For example, n=2 can be used to balance the dynamics of the rapid capture system and the stability of the statistics, which means that when the sampling time period is backdated to 2, 4, 6, 8, ... days, the sample weight attenuates to 1 / 2, 1 / 4, 1 / 8, 1 / 16, ... . Assuming the detection period is 1 minute, and there are 2880 detection periods in 2 days, then it can be achieved through... To solve for α, that is

[0088] The detection cycle is T p The weight decay rule can be: when the sampling time period is back to T a When the sample size decreases to 1 / d of its original value, and d ≥ 1, the weight decay factor can be expressed as: For any given detection period, the weight of that detection period decreases by α after each subsequent detection period.

[0089] Based on the aforementioned intermediate values, when performing anomaly detection on the target object, in step 11, the metric value of the target object in the current detection period t can be obtained. There can be one or more target objects. "Multiple" refers to two or more (including two). The number of target objects is defined as n. t Each indicator corresponds to n. t There are n metrics, each corresponding to one target object. t ≥1, and is an integer. For ease of description, the total number of indicators is defined as m, and each indicator is defined as x. i m ≥ 1 and is an integer. i = 1, 2, ..., m.

[0090] The target object can be any one or more monitoring objects in the monitoring object group. The monitoring objects in the monitoring object group include the target object. The monitoring objects in the monitoring object group can be the same as the target object; for example, the monitoring object group could be a computer room containing multiple servers. These servers might have the same model and specifications. Therefore, the indicator data of these servers would be the same or similar. Thus, based on the historical weighted statistical characteristics of m indicators of at least one monitoring object in the monitoring object group, the intermediate characteristics of the weighted statistics of the m indicators of the target object from the historical monitoring period to the current monitoring period t can be determined.

[0091] In this context, at least one monitored object in the monitored object group may include the target object. The monitored object group may include other monitored objects besides the target object. These other monitored objects may have the same model and specifications as the target object, such as servers of the same model and specifications. The granularity of the data used in the indicator pattern learning process is determined by the number of monitored objects in the monitored object group. The indicator pattern learning process refers to the process of determining the weighted mean vector and weighted covariance of m indicators of the target object from the historical detection period to the current detection period t.

[0092] The granularity of data used in the indicator pattern learning process can be greater than or equal to the granularity of data used in the online anomaly detection process. The online anomaly detection process refers to the process of determining whether multiple indicators of a target object are abnormal using the target object's metrics in the current detection period and the results of indicator pattern learning. For example, the data used in the indicator pattern learning process could be data from all or part of the servers in a data center; the anomaly detection process could be performing anomaly detection on a single server, using the server's metrics in the current detection period, and so on.

[0093] Based on the above analysis, in order to achieve anomaly detection of the target object, in step 12, the historical weighted statistical characteristics of m indicators of at least one monitored object in the monitored object group over the historical detection period can also be obtained. The historical weighted statistical characteristics include: intermediate characteristics used to determine the target object's m indicators from the historical detection period to the current detection period t.

[0094] It should be noted that if the current detection period is the first detection period, the historical weighted statistical features are set to 0. If the current detection period is any detection period other than the first detection period, the historical weighted statistical features are the weighted statistical features calculated from the previous detection period of the current detection period, which are updated period by period.

[0095] The historical weighted statistical features are updated periodically according to the detection cycle. Online anomaly detection equipment or devices only need to store the historical weighted statistical features calculated in the previous detection cycle, which can reduce the storage space occupied by historical data.

[0096] After obtaining the historical weighted statistical characteristics of m indicators of at least one monitoring object in the monitoring object group over the historical detection period, in step 13, the historical weighted statistical characteristics and the measurement value x of the target object's indicator in the current detection period can be used as a basis. i The target weighted statistical features of the target object are determined by using (t) and the weight of the current detection period. Generally, the weight of the current detection period is 1. The weights of other historical detection periods decrease as time progresses.

[0097] Furthermore, since the weighted statistical features are intermediate quantities (also known as intermediate features) for determining the weighted statistics, in step 14, the target weighted statistics of the target object's indicators from the historical detection period to the current detection period can be determined based on the target weighted statistical features.

[0098] Since the weighted statistics of the target object's indicators can reflect the distribution characteristics of the target object's indicators, the relationship between the target object's indicator measurement value in the current detection period and the target weighted statistics of that indicator can be used to determine whether the target object's indicators are abnormal. Based on this, in step 15, anomaly detection can be performed on the target object based on the target object's indicator measurement value in the current detection period and the target weighted statistics of that indicator to obtain the anomaly detection results for the target object.

[0099] In this embodiment, a weighting mechanism is introduced for the detection period. Historical detection periods closer to the current detection period have a higher weight; that is, the weight of a data sample decays with the age of the sample. This results in earlier detection periods contributing less to anomaly detection and more recent detection periods contributing more. This reduces the impact of data from distant historical detection periods on the statistical results, helping to more accurately reflect the latest state of the target object and quickly keep up with the dynamic changes in the monitored object's system. This enables anomaly detection that adapts to the dynamic changes of the monitored object, thereby improving the accuracy of anomaly detection. Furthermore, in any detection period of online anomaly detection, newly collected data samples from the current detection period are directly used to iteratively update historical statistical features without using sample data from previous detection periods for calculation. Compared to batch calculations that use a large number of historical samples to calculate statistical results, this speeds up anomaly detection and improves its efficiency.

[0100] It is worth noting that, in this embodiment, after obtaining the target weighted statistical features of the target object's indicators in the current detection period, these target weighted statistical features can also be stored. For example, the historical weighted statistical features corresponding to the previous detection period can be updated to the target weighted statistical features; or, additional storage space can be used to store the target weighted statistical features, etc. In this way, when performing anomaly detection on the target object in the next detection period, the stored target weighted statistical features can be directly read as historical weighted statistical features, and the aforementioned steps 11-15 can be executed to achieve online anomaly detection in the next detection period.

[0101] It is also worth noting that the anomaly detection method provided in the foregoing embodiments can use one or more indicators. The statistical measures used for single-indicator anomaly detection and multi-indicator anomaly detection are different, and correspondingly, the intermediate quantities required to determine the statistical measures are also different. The implementation methods of multi-indicator anomaly detection and single-indicator anomaly detection are described below by way of example. Figure 1b This is a flowchart illustrating the anomaly detection method provided in an embodiment of this application. This anomaly detection method is a multi-index anomaly detection method. Multiple indicators can form an index vector. For example... Figure 1b As shown, the anomaly detection method may include the following steps:

[0102] 101. Obtain multiple metrics of the target object's indicator vector in the current detection period.

[0103] 102. Obtain the historical weighted statistical characteristics of the indicator vector of at least one monitoring object in the monitoring object group over the historical monitoring period. At least one monitoring object includes the target object; the earlier the monitoring period, the smaller the weight.

[0104] 103. Based on historical weighted statistical characteristics, multiple metrics, and the weight of the current detection period, determine the target object's indicator vector and the target weighted statistical characteristics from the historical detection period to the current detection period.

[0105] 104. Based on the target weighted statistical characteristics, determine the target weighted mean vector of the indicator vector of the target object from the historical detection period to the current detection period, and the target weighted covariance matrix of the indicator vector of the target object from the historical detection period to the current detection period.

[0106] 105. Based on multiple metrics, the target weighted mean vector, and the target weighted covariance matrix, perform anomaly detection on the target object to obtain the anomaly detection results of the target object.

[0107] The anomaly detection method provided in this embodiment mainly realizes online anomaly detection. It can combine multiple indicators to perform online detection of the detection object and can be applied to the health status monitoring of the monitoring object in any monitoring subject. The data used by this anomaly detection method is multi-dimensional indicator data. The structure of the multi-dimensional indicator data is shown in Table 1 below:

[0108] Table 1. General Multidimensional Index Data Table Model

[0109]

[0110]

[0111] As shown in Table 1, multidimensional indicator data includes a time column, representing the time period for the aggregated indicator data; it may also include zero, one, or more dimension columns, with "two or more" referring to two or more dimensions. In Table 1, [Dimension 1], [Dimension 2], ..., [Dimension d] are dimension columns, which can uniquely identify the monitored object. For example, [Cluster] and [Server] are common dimension columns in online monitoring scenarios. Multidimensional indicator data also includes one or more indicator columns. In Table 1, [Indicator 1], [Indicator 2], ..., [Indicator m] are indicator columns, used to record the observed values ​​of the indicator, also known as metrics. For example, [Request Count], [Request Size], [Response Size], and [Latency] are common indicator columns.

[0112] The following example, using Table 2, illustrates the multidimensional indicator data.

[0113] Table 2 Example of Multidimensional Indicator Data

[0114]

[0115] In Table 2, the dimension columns [City], [Data Center], [Computer Room], and [Server] in each row identify a unique server.

[0116] This application's embodiments are merely illustrative examples of methods for detecting anomalies in a monitored object by comprehensively considering multiple indicators. Different monitored objects and different monitoring purposes will result in different indicators for the monitored object. For example, in some embodiments, the monitored object is a server, and the multiple indicators may include: the number of requests, the amount of data requested, response latency, the amount of data responded, network bandwidth, the number of idle processor cores, the amount of idle memory, the amount of idle disk space, and disk read / write speed, etc., but are not limited to these. As another example, if the monitored object is a website, the multiple indicators may include: user visits, the number of visits by the same user, the number of web pages visited by the same user, the loading time of each page on the website, the first screen rendering time, conversion rate, and click-through rate, etc.

[0117] Complex interdependencies may exist between multiple metrics. For example, regarding the number of server requests and response latency, generally, the more requests made simultaneously, the greater the response latency. Similarly, regarding the number of times a single user visits a website and the number of pages they access, generally, the more times a user visits the website, the more pages they likely access, and so on. Therefore, comprehensively using multiple metrics for health checks on monitored objects is beneficial for uncovering or detecting potential problems, reducing the probability of missed anomalies, and helping to identify anomalies that might have been missed when using a single metric.

[0118] In their research on an anomaly detection method using Mahalanobis distance for batch calculation of multiple indicators, the inventors of this application discovered that determining the Mahalanobis distance between multiple indicators requires first determining the covariance between any two indicators, the covariance of the same indicator, and the mean of each indicator. The inventors of this application, through their research on the aforementioned equations (4) and (5), found that the intermediate features for determining the covariance between any two indicators, the covariance between the same indicator, and the mean of each indicator are obtained through periodic accumulation. Therefore, in order to accelerate online anomaly detection and save storage space, the mean of each indicator and the covariance between multiple indicators can be determined by updating the intermediate features.

[0119] Through the study of equation (4), it was found that the same indicator x of the monitored object i The mean is obtained by analyzing the x-axis of the index. i The observed values ​​(also known as metrics) are accumulated periodically. Therefore, the x values ​​of each index are determined. i The intermediate characteristics of the mean may include: index x i The sum of metrics over historical detection periods and indicator x i The number of metrics n τ The sum of historical testing cycles

[0120] Through the study of equation (5), it was found that equation (5) can be transformed into the following formula:

[0121]

[0122] Through the study of equation (9), it was found that determining any two indicators x i and x j Intermediate characteristics of the covariance between them may include: index x i and x j The sum of the products of the metrics from the historical detection periods and the number of metrics n τ The sum of historical testing cycles

[0123] Therefore, to reduce the storage space occupied by historical metrics of each indicator in the historical detection period, the aforementioned intermediate features calculated in the historical detection period can be stored and updated periodically. This eliminates the need to store the historical metrics of all indicators, saving storage space occupied by historical data. During online anomaly detection, the historical intermediate features can be directly used for subsequent calculations instead of starting from scratch, which can also speed up anomaly detection and improve the timeliness and efficiency of anomaly detection.

[0124] The aforementioned anomaly detection method using Mahalanobis distance with multiple indicators for batch calculation cannot quickly adapt to the dynamic changes of the monitored object, resulting in low anomaly detection accuracy. To address this technical problem, in this embodiment, a weight is introduced for the detection period. Earlier detection periods have a smaller weight, meaning that data samples from earlier detection periods contribute less to the anomaly detection process, while data samples from more recent detection periods contribute more. This reduces the impact of distant historical detection periods on the statistical results, allowing the statistical results to truly reflect the latest state of the monitored object and quickly keep up with the system's dynamic changes. The weight of the detection period is greater than 0 and less than or equal to 1.

[0125] The calculation process of weighted sample mean, weighted sample variance, and weighted sample standard deviation is illustrated below.

[0126] Specifically, at each time point t, for n in the monitored object group t For each of the m indicators of a monitoring object, x is... i If each observation (i.e., metric) is obtained, then the index x i At time point t, n is used in total. t A metric value. Let x i,k (τ) represents the measurement value of the i-th indicator of the k-th detection object in the detection period t, where k = 1, 2, ..., n t .make Indicates the i-th index x i The weighted average over the detection period 1-t. Let... and Let x represent the i-th index respectively. i The weighted variance and weighted standard deviation are calculated over a detection period of 1-t. Let α represent the weight decay factor, where 0 < α ≤ 1. Furthermore, embodiments of this application define some additional notations for multi-index anomaly detection. Let x = [x1, x2, ..., x...]. m ] T This represents an index vector consisting of m indicators during the detection period t; and let... Let Σ(t) represent the weighted mean vector corresponding to the index vector in the detection period t. Let Σ(t) represent the weighted covariance matrix of the index vector composed of m indicators in the detection period t. Σ(t) can be expressed as:

[0127]

[0128] Diagonal elements in ∑(t) Indicator x i The weighted variance of the detection period t Same. Where i = 1, 2, ..., m.

[0129] Based on the above definition, we have: Indicator x i The weighted average value during the detection period 1-t It can be represented as:

[0130]

[0131] Indicator x i The weighted variance over the detection period 1-t can be expressed as:

[0132]

[0133] Any two indicators x i and x j Weighted covariance between It can be represented as:

[0134]

[0135] Where i = 1, 2, ..., m and j = 1, 2, ..., m. i and j can be equal.

[0136] The inventors of this application, through their research on the aforementioned formulas (11) and (13), discovered that the same indicator x of the monitored object... i The weighted mean is obtained by analyzing the index x. i The values ​​of the metrics are accumulated over several periods. Therefore, the values ​​of each metric x are determined. i The intermediate characteristics of the weighted mean may include: index x i The weighted sum of the measurement values ​​during the detection period 1-t and indicator x i The weights of the measurement values ​​are accumulated over a detection period of 1-t.

[0137] Furthermore, define the state variable s. i (t) The weighted sum of the measurement values ​​over the detection period 1-t is then:

[0138]

[0139] Define s w (t) represents the index x i The weighted sum of the metric values ​​over the detection period 1-t is then:

[0140]

[0141] The study of equation (13) according to the transformation process from equation (5) to equation (9) found that for any two indicators x i and x j The intermediate characteristics of the weighted covariance between them may include: index x i and x j The weighted sum of the products of the metrics during the detection period 1-t and indicator x i The weights of the measurement values ​​are weighted and accumulated over the detection period 1-t.

[0142] Therefore, the definition Indicator x i and x j The weighted sum of the products of the measurements over the detection period 1-t is:

[0143]

[0144] Based on the aforementioned intermediate features, in this embodiment of the application, when performing anomaly detection on a target object, in step 101, multiple metrics of the target object can be obtained within the current detection period t. The target object can be one or more. "Multiple" refers to two or more (including two). The number of target objects is defined as n. t Each indicator corresponds to n. t There are n metrics, each corresponding to one target object. t ≥1, and is an integer. For ease of description, the total number of indicators is defined as m, and each indicator is defined as x. i m ≥ 2 and is an integer. i = 1, 2, ..., m.

[0145] The target object can be any one or more monitoring objects in the monitoring object group. The monitoring objects in the monitoring object group include the target object. The monitoring objects in the monitoring object group can be the same as the target object; for example, the monitoring object group could be a computer room containing multiple servers. These servers might have the same model and specifications. Therefore, the indicator data of these servers would be the same or similar. Thus, based on the historical weighted statistical characteristics of m indicators of at least one monitoring object in the monitoring object group, the intermediate characteristics of the weighted mean vector and weighted covariance of the m indicators of the target object from the historical monitoring period to the current monitoring period t can be determined.

[0146] In this context, at least one monitored object in the monitored object group may include the target object. The monitored object group may include other monitored objects besides the target object. These other monitored objects may have the same model and specifications as the target object, such as servers of the same model and specifications. The granularity of the data used in the indicator pattern learning process is determined by the number of monitored objects in the monitored object group. The indicator pattern learning process refers to the process of determining the weighted mean vector and weighted covariance of m indicators of the target object from the historical detection period to the current detection period t.

[0147] The granularity of data used in the indicator pattern learning process can be greater than or equal to the granularity of data used in the online anomaly detection process. The online anomaly detection process refers to the process of determining whether multiple indicators of a target object are abnormal using the target object's metrics in the current detection period and the results of indicator pattern learning. For example, the data used in the indicator pattern learning process could be data from all or part of the servers in a data center; the anomaly detection process could be performing anomaly detection on a single server, using the server's metrics in the current detection period, and so on.

[0148] Based on the above analysis, in order to achieve anomaly detection of the target object, in step 102, the historical weighted statistical features of the indicator vector consisting of m indicators of at least one monitored object in the monitored object group can also be obtained over the historical detection period. The historical weighted statistical features include: intermediate features used to determine the weighted mean vector of the indicator vector of the target object from the historical detection period to the current detection period t. Correspondingly, the historical weighted statistical features may include: the historical weighted sum of the historical measurements of each indicator over the historical detection period. And, the historical cumulative sum of the weights of the historical measurements of each indicator over the historical monitoring period. w (t-1).

[0149] It should be noted that if the current detection period is the first detection period, the historical weighted statistical features are set to 0. If the current detection period is any detection period other than the first detection period, the historical weighted statistical features are the weighted statistical features calculated from the previous detection period of the current detection period, which are updated period by period.

[0150] In some embodiments, the historical weighted statistical features include: intermediate features for determining the weighted covariance of the indicator vector of the target object from the historical detection period to the current detection period t. Accordingly, the historical weighted statistical features may include: the historical weighted sum of the products of the historical measurements of two different indicators over the historical detection period. The historical weighted sum of the squares of the historical values ​​of the same indicator over the historical monitoring period.

[0151] The historical weighted statistical features are updated periodically according to the detection cycle. Online anomaly detection equipment or devices only need to store the historical weighted statistical features calculated in the previous detection cycle, which can reduce the storage space occupied by historical data.

[0152] In the multi-indicator anomaly detection embodiment, the target weighted statistic of the target object's indicator vector includes: the target weighted mean vector μ of the target object's indicator vector from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t). x (t) and the target object's index vector from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t) target weighted covariance matrix ∑(t). Therefore, the aforementioned steps 13 and 14 can be implemented as steps 103 and 104, respectively.

[0153] That is, after obtaining the historical weighted statistical characteristics of the indicator vector consisting of m indicators of at least one monitoring object in the monitoring object group in the historical detection period, in step 103, the m measurement values ​​x of the indicator vector of the target object in the current detection period can be used as a basis. i The target object's indicator vector is determined by assigning (t) and the weight of the current detection period to the indicator vector from the historical detection period to the current detection period t (i.e., from detection period 1 to the current detection period t). Generally, the weight of the current detection period is 1. The weights of other historical detection periods decrease as time progresses.

[0154] Furthermore, in step 104, the target weighted mean vector μ of the target object's indicator vector from the historical detection period to the current detection period t can be determined based on the target weighted statistical characteristics of the m indicators of the target object from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t). x (t), and the target weighted covariance of the indicator vector of the target object from the historical detection period to the current detection period t (i.e. from detection period 1 to the current detection period t), such as the target weighted covariance matrix ∑(t).

[0155] In some embodiments, historical weighted statistical features may include: the historical weighted sum of the historical values ​​of each indicator over a historical detection period. And, the historical cumulative sum of the weights of the historical measurements of each indicator over the historical monitoring period. w (t-1), then for any index x of the target object i It can be based on the indicator x i Historical weighted sum of historical metrics over historical detection periods Weights of the current detection period, and the target object's index x iThe metric x in the current detection cycle i (t) and the preset weight decay factor α are used to determine the target object's index x. i The target weighted sum of the metrics from the historical detection period to the current detection period As an indicator x i One of the corresponding weighted statistical features of the target. That is, the indicator x of the target object. i The target weighted sum of the metrics from the historical detection period to the current detection period for:

[0156]

[0157] In equation (17), x i,k (t) represents the index x i The k-th metric value in the current detection period t. k = 1, 2, ..., n t .

[0158] Correspondingly, the weights of the historical measurements of each indicator in the historical detection period can also be used as a basis for further analysis. w (t-1), the weight of the current detection period and the preset weight decay factor α, determine the target cumulative sum s of the weights of each indicator from the historical detection period to the current detection period. w (t), as one of the target weighted statistical features. Where, s w (t) can be expressed as:

[0159] s w (t)=αs w (t-1)+n t (18).

[0160] Using the same method, the target weighted sum of the measurement values ​​of each indicator in the indicator vector of the target object from the historical detection period to the current detection period can be determined.

[0161] Furthermore, it can be based on the target object's index x i The target weighted sum of the metrics from the historical detection period to the current detection period The target summation s of the weights of the measurement values ​​of each indicator from the historical detection period to the current detection period. w (t), determine the target object's index vector and the target weighted mean vector μ from the historical detection period to the current detection period t. x (t). One indicator in the indicator vector corresponds to an element in the target weighted mean vector.

[0162] Specifically, for any indicator x of the target object i Calculateable index x iThe target weighted sum of the metrics from the historical detection period to the current detection period The target summation s of the weights of the measures of each indicator from the historical detection period to the current detection period. w The ratio between (t) is used as the index x of the target object. i The target weighted average from the historical detection period to the current detection period t Then we have:

[0163]

[0164] Furthermore, a target weighted mean vector μ can be constructed using the target weighted mean values ​​corresponding to each of the m indicators of the target object. x (t), then we have:

[0165]

[0166] In some embodiments, the historical weighted statistical feature further includes: the historical weighted sum of the products of the historical measurements of two different indicators over a historical detection period. The historical weighted sum of the squares of the historical values ​​of the same indicator over the historical monitoring period. Then, it can be based on the historical weighted sum of the products of the historical values ​​of two different indicators over the historical detection period. The historical weighted sum of the squares of the historical values ​​of the same indicator over the historical monitoring period. Determine the product of the measurement values ​​of any two of the m indicators of the target object from the historical detection period to the current detection period. And, the product of the measurement values ​​of the same indicator from the historical detection period to the current detection period.

[0167] Specifically, for any two indicators x out of m indicators of the target object i and x j It can be based on the indicator x i and x j The historical weighted sum of the products of historical metrics over the historical detection period Weights and indicators x for the current detection cycle i and x j The metric x in the current detection cycle i (t) and x j (t) and the preset weight decay factor α, determine the index x i and x j The target weighted sum of the products of metrics from historical detection periods to the current detection period. As two indicators x i and x j One of the corresponding target weighted statistical features. That is:

[0168]

[0169] Based on any index x of the target object i The product of the metrics from the historical detection period to the current detection period Weights of the current detection period, and the target object's index x i The metric x in the current detection cycle i (t) and the preset weight decay factor α, determine the index x i The target weighted sum of the squares of the metrics from the historical detection period to the current detection period. Indicator x of the target object i One of the corresponding target weighted statistical features. That is:

[0170]

[0171] Correspondingly, the weights of the historical measurements of each indicator in the historical detection period can also be used as a basis for further analysis. w (t-1), the weight of the current detection period and the preset weight decay factor α, determine the target cumulative sum s of the weights of each indicator from the historical detection period to the current detection period. w (t), which is one of the target weighted statistical features. See equation (18) above for the specific formula.

[0172] Accordingly, when determining the target weighted covariance of multiple indicators of the target object from the historical detection period to the current detection period based on the target weighted statistical characteristics, it can be based on indicator x. i and x j The target weighted sum of the products of metrics from historical detection periods to the current detection period. The target cumulative sum of the weights of the measurement values ​​of each indicator from the historical detection period to the current detection period. w (t) and index x i and x j The corresponding target weighted average and Determine indicator x i and x j The target weighted covariance from the historical detection period to the current detection period As an indicator x i and x j The corresponding target weighted covariance.

[0173] Specifically, the calculable index x i and x j The target weighted sum of the products of metrics from historical detection periods to the current detection period. The target summation s of the weights of the measures of each indicator from the historical detection period to the current detection period. w The ratio between (t) and the index x; and subtract the index x from this ratio. i and x j The product of the respective target weighted means yields the index x. i and x j The target weighted covariance from the historical detection period to the current detection period That is:

[0174]

[0175] Similarly, it can be based on the indicator x i The target weighted sum of the squares of the metrics from the historical detection period to the current detection period. The target cumulative sum of the weights of the measurement values ​​of each indicator from the historical detection period to the current detection period. w (t) and index x i Corresponding target weighted mean Determine indicator x i With indicator x i The target weighted covariance from the historical detection period to the current detection period That is:

[0176]

[0177] Furthermore, the target weighted covariance can be calculated based on the different indicators among the multiple indicators of the target object. and the target weighted covariance corresponding to the same indicator Construct the target weighted covariance matrix ∑(t) of the m indicators of the target object from the historical detection period to the current detection period, as the target weighted covariance. The target weighted covariance matrix ∑(t) of the indicator vector of the target object from the historical detection period to the current detection period can be expressed as:

[0178]

[0179] In this embodiment, the target weighted statistics of the target object's indicators include: the target weighted mean vector of the target object's indicator vectors, and the target weighted covariance matrix Σ(t) of the target object's indicator vectors.

[0180] The above process is the indicator pattern learning process for anomaly detection. This indicator pattern learning process uses the measurement values ​​of m indicators of all target objects in the current detection period. Through the indicator pattern learning process, the target weighted mean vector μ of the m indicators of the target objects from the historical detection period to the current detection period is obtained. x(t), and, after the target weighted covariance matrix Σ(t) of the m indicators of the target object from the historical detection period to the current detection period, the anomaly detection of the target object can be achieved by step 105 provided in this embodiment. That is, the aforementioned step 15 can be implemented as step 105. Specifically, in step 105, the anomaly detection of the target object can be achieved based on the multiple measurement values ​​of the m indicators of the target object in the current detection period, the aforementioned target weighted mean vector μ x (t) and the target object's index vector in the target weighted covariance matrix from the historical detection period to the current detection period are used to perform anomaly detection on the target object, so as to obtain the anomaly detection result of the target object.

[0181] Specifically, it can be based on the m indicators of the target object in the current detection period, multiple measurement values, and the aforementioned target weighted mean vector μ. x (t) and the target object index vector from the historical detection period to the current detection period target weighted covariance matrix are used to determine the Mahalanobis distance of multiple indicators of the target object in the current detection period.

[0182] Specifically, for any target object A, the m indicators of the target object A in the current detection period and the target weighted mean vector μ can be used as the basis. x Given the target object's index vectors and the target weighted covariance matrix Σ(t) from the historical detection period to the current detection period, determine the Mahalanobis distances of the m indicators of the target object A in the current detection period. The Mahalanobis distance can be expressed as:

[0183]

[0184] Furthermore, anomaly detection can be performed on the target object based on the Mahalanobis distance of m indicators of the target object in the current detection period, so as to obtain the anomaly detection result of the target object.

[0185] Specifically, it can be determined whether the Mahalanobis distance of m indicators of the target object in the current detection period is greater than the set scaling factor R. If the Mahalanobis distance of the m indicators of the target object in the current detection period is greater than the scaling factor R, then it is determined that the target object has an anomaly in the m indicators. If the Mahalanobis distance of the m indicators of the target object in the current detection period is greater than the scaling factor R, then it is determined that the target object performs normally in the m indicators. The scaling factor R is generally greater than or equal to 3. For example, R = 4, R = 4.5, R = 5, or R = 6, etc., but is not limited to these. However, if the scaling factor R is too large, missed detections may occur; therefore, R should not be too large. Generally, 3 ≤ R ≤ 10.

[0186] Mahalanobis distance integrates multiple indicators to anomaly the target object. Data is standardized by dividing by the standard deviation of each dimension, allowing for fair comparison of data at different scales. This means that even if different indicators have different units or magnitudes, their impact on the distance will be appropriately adjusted. In addition to adjusting the scale, Mahalanobis distance also uses the covariance matrix to capture correlations between variables. Therefore, for multivariate systems, anomalies in individual indicators may not fully reflect the system's health, as some anomalies may be caused by the combined effects of multiple variables. Mahalanobis distance comprehensively considers all related indicators, thus providing a more comprehensive and accurate assessment method.

[0187] In this embodiment, a weighting mechanism is introduced for the detection period. Historical detection periods closer to the current detection period have a higher weight; that is, the weight of a data sample decays with the age of the sample. This results in earlier detection periods contributing less to anomaly detection and more recent detection periods contributing more. This reduces the impact of data from distant historical detection periods on the statistical results, helping to more accurately reflect the latest state of the target object and quickly keep up with the dynamic changes in the monitored object's system. This enables anomaly detection that adapts to the dynamic changes of the monitored object, thereby improving the accuracy of anomaly detection. Furthermore, storing the weighted statistical features calculated from historical detection periods and updating them periodically eliminates the need to store all historical metrics, saving storage space occupied by historical data. In any detection period of online anomaly detection, the historical statistical features are directly updated using newly collected data samples from the current detection period, without needing to use sample data from previous detection periods for calculation. Compared to batch calculations using a large number of historical samples, this speeds up anomaly detection and improves its efficiency.

[0188] The inventors of this application, through research on the aforementioned Mahalanobis distance calculation formula (26), discovered that if some indicators are a completely linear combination of other indicators, or if some indicators are constant values, the target weighted covariance matrix ∑(t) required to calculate the Mahalanobis distance is not invertible, and therefore the method cannot work in this case. To solve this technical problem, in some embodiments of this application, the diagonal elements of the target weighted covariance matrix ∑(t) shown in the aforementioned formula (25) are... Add a jitter factor.

[0189] In some embodiments, a jitter factor can be obtained. The mantissa of the jitter factor is the same as the dimension of the non-invertible diagonal elements of the target weighted covariance matrix ∑(t). For example, from the target weighted covariance matrix ∑(t) shown in equation (25) above, it can be seen that the diagonal elements of the target weighted covariance matrix ∑(t) are m-dimensional, therefore the jitter factor is also m-dimensional.

[0190] Furthermore, a jitter factor can be added to the diagonal elements of the target weighted covariance matrix ∑(t) to obtain the adjusted target covariance matrix. Specifically, a diagonal matrix Δ(t) can be constructed using a jitter factor. The diagonal elements of this matrix are the jitter factors. Adding the target weighted covariance matrix ∑(t) to the diagonal matrix Δ(t) adds the jitter factors to the diagonal elements of the target weighted covariance matrix ∑(t), resulting in an adjusted target covariance matrix. Accordingly, the adjusted target covariance matrix It can be represented as:

[0191]

[0192] In this application embodiment, for embodiments where some indicators are completely linear combinations of other indicators, adding a jitter factor to the diagonal elements of the target covariance matrix ∑(t) can break the linear relationship between certain rows and other rows or certain columns and other columns in the target covariance matrix ∑(t), thus making the adjusted target covariance matrix... The determinant is no longer equal to zero, thus making the adjusted target covariance matrix... Full rank, i.e., the integerized target covariance matrix Reversible. For implementations where certain indices are constant values, adding a jitter factor to the diagonal elements of the target covariance matrix ∑(t) can change an entire row and column of the target covariance matrix ∑(t) that were originally all zeros to no longer be zeros, thus making the adjusted target covariance matrix... Full rank, i.e., the adjusted target covariance matrix It is invertible, which can solve the problem that Mahalanobis distance is not usable for anomaly detection methods because the target covariance matrix is ​​not invertible.

[0193] In this application, the specific implementation method for obtaining the jitter factor is not limited. In some embodiments, the jitter factor can be preset. The jitter factor can be a constant vector with a dimension of m. Generally, the constant is very small, usually 1e-6, 1e-7, etc., but is not limited to this. In this way, a small constant value for the jitter factor can prevent the jitter factor from being too large, which would lead to the distortion of the original data features and affect the accuracy of subsequent anomaly detection results.

[0194] In other embodiments, the product of the diagonal elements of the target covariance matrix ∑(t) and a set constant ε can be determined, and the set constant ε is added to the product of the diagonal elements of the target covariance matrix ∑(t) and the set constant ε to obtain the jitter factor. This jitter factor determination method can be expressed as:

[0195]

[0196] In equation (28), 1 is a vector of length m, and each element of this vector is 1. Where 0 < ε < 1. Generally, ε is very small, usually 1e-6, 1e-7, etc. Thus, taking a small constant value for ε can prevent the jitter factor from being too large, causing distortion of the original data features and affecting the accuracy of subsequent anomaly detection results. Adding the set constant ε to the product of the diagonal elements of the target covariance matrix ∑(t) and the set constant ε can preserve the features of the original data as much as possible and reduce the impact of the jitter factor on subsequent anomaly detection results.

[0197] After obtaining the adjusted target covariance matrix Subsequently, based on the m indicators of the target object and multiple measurement values ​​in the current detection period, and the aforementioned target weighted mean vector μ, x (t) and the adjusted target covariance matrix Determine the Mahalanobis distance of multiple indicators of the target object in the current detection period.

[0198] Specifically, for any target object A, the m indicators of the target object A in the current detection period and the target weighted mean vector μ can be used as the basis. x (t) and the adjusted target covariance matrix of m indicators from the historical detection period to the current detection period. Determine the Mahalanobis distances of m indicators of the target object A in the current detection period. The Mahalanobis distance can be expressed as:

[0199]

[0200] Furthermore, anomaly detection can be performed on the target object based on the Mahalanobis distance of m indicators in the current detection period to obtain the anomaly detection result. Specific anomaly detection methods can be found in the relevant content of the foregoing embodiments, and will not be repeated here.

[0201] In this embodiment of the application, by adding a small jitter factor to the diagonal elements of the target covariance matrix, the problem that Mahalanobis distance is unusable for anomaly detection can be solved because the target covariance matrix is ​​not invertible.

[0202] It is worth noting that, in embodiments with multiple target objects, step 105 of the aforementioned anomaly detection method, which performs anomaly detection on multiple target objects, can be executed in parallel, thereby improving the speed of anomaly detection. In embodiments with multiple monitoring object groups, since each monitoring object group uses independent data for indicator pattern learning, the indicator pattern learning process for multiple monitoring object groups can be executed in parallel.

[0203] The inventors of this application used the aforementioned multi-index anomaly detection method to perform online anomaly detection on different monitoring objects, and obtained... Figure 2 and Figure 3 The abnormal detection results. Figure 2 In the diagram, the horizontal axis represents the measurement value of indicator 1, and the vertical axis represents the measurement value of indicator 2. Black dots represent the distribution of measurement values ​​for different monitored objects in indicators 1 and 2. Ellipses represent different scaling factors R, with larger ellipses corresponding to larger scaling factors R (i.e., scaling factor R1 is smaller than scaling factor R2). When the scaling factor is R1, according to... Figure 2 It can be seen that data points falling outside the ellipse corresponding to scaling factor R1 are abnormal data points; that is, indices 1 and 2 corresponding to data points falling outside the ellipse corresponding to scaling factor R1 are abnormal. If the scaling factor is R2, then... Figure 2 Both Indicator 1 and Indicator 2 shown are normal.

[0204] exist Figure 3 In the graph, the horizontal axis represents the number of requests per second (RPS) for the monitored object, and the vertical axis represents the average response time of the monitored object. The black dots represent the distribution of RPS and average response time metrics for different monitored objects; the straight line is a linear fit between the RPS and average response time metrics. In principle, the higher the RPS of a monitored object, i.e., the more requests it receives per second, the longer its average response time. Figure 3 The relationship between RPS and average response time shown can also be used to detect anomalies using the aforementioned multi-index anomaly detection method to determine whether the monitored object is abnormal.

[0205] In addition to supporting online anomaly detection, this application also provides a batch calculation anomaly detection method. Another anomaly detection method provided in this application is described below by way of example.

[0206] Figure 4 This is a flowchart illustrating another anomaly detection method provided in an embodiment of this application. Figure 4 As shown, the anomaly detection method may include the following steps:

[0207] 401. Obtain multiple measurement values ​​corresponding to multiple indicators of at least one monitoring object in the monitoring object group; multiple measurement values ​​corresponding to any indicator of any monitoring object belong to multiple detection cycles.

[0208] 402. Based on the multiple measurement values ​​corresponding to each of the multiple indicators and the weights of multiple detection periods, determine the target weighted mean vector and the target weighted covariance matrix of the multiple indicators; the earlier the detection period, the smaller the weight.

[0209] 403. From the multiple measurement values ​​corresponding to each of the multiple indicators, obtain the multiple measurement values ​​of the target object in at least one monitoring object in the current detection period.

[0210] 404. Based on the target weighted mean vector, the target weighted covariance matrix, and multiple metrics of the target object in the current detection period, determine the Mahalanobis distance of the multiple metrics of the target object in the current detection period.

[0211] 405. Based on Mahalanobis distance, perform anomaly detection on the target object to obtain the anomaly detection results.

[0212] In this embodiment, the description of the relationship and implementation of the monitoring object group and the target object can be found in the relevant content of the foregoing embodiments, and will not be repeated here.

[0213] In this embodiment, at least one monitoring object includes a target object. In this embodiment, one indicator of a monitoring object corresponds to one metric value in each detection cycle. The earlier the detection cycle, the smaller the weight. Regarding the specific determination method of the target weighted mean vector and the target weighted covariance in step 402, please refer to the relevant content of the aforementioned equations (11)-(13) and equations (20) and (25), which will not be repeated here. Regarding the specific implementation method of determining the Mahalanobis distance of multiple indicators of the target object in the current detection cycle in step 404, please refer to the relevant content of the aforementioned equations (26)-(28), which will not be repeated here.

[0214] In this embodiment, Mahalanobis distance is used to synthesize multiple indicators to anomaly the target object. Data is standardized by dividing by the standard deviation of each dimension, allowing for fair comparison of data at different scales. This means that even if different indicators have different units or magnitudes, their impact on the distance will be appropriately adjusted. In addition to adjusting the scale, Mahalanobis distance also utilizes the covariance matrix to capture the correlation between variables. Mahalanobis distance comprehensively considers all related indicators, thus providing a more comprehensive and accurate evaluation method.

[0215] On the other hand, this embodiment introduces a weighting mechanism for the detection cycle. The closer the historical detection cycle is to the current detection cycle, the greater its weight. This makes the contribution of data samples from earlier detection cycles smaller in the anomaly detection process, and the contribution of data samples from more recent detection cycles greater in the anomaly detection process. This can reduce the impact of data samples from more distant historical detection cycles on the statistical results, help the statistical results to more accurately reflect the latest state of the target object, quickly keep up with the dynamic changes of the monitored object's system, realize anomaly detection that adapts to the dynamic changes of the monitored object, and thus improve the accuracy of anomaly detection of the target object.

[0216] The ideas and principles of the aforementioned anomaly detection methods based on multiple indicators can also be applied to anomaly detection of a single indicator of a target object. The following is an illustrative example of an anomaly detection method based on a single indicator.

[0217] Figure 5a This is a flowchart illustrating another anomaly detection method provided in an embodiment of this application. Figure 5a As shown, this anomaly detection method mainly includes the following steps:

[0218] 501. Obtain the target metric value of the target object in the current detection period.

[0219] 502. Obtain the historical weighted statistical characteristics of the target indicator of at least one monitoring object in the monitoring object group over the historical monitoring period; at least one monitoring object includes the target object; the earlier the monitoring period, the smaller the weight.

[0220] 503. Based on historical weighted statistical characteristics, target metric values, and the weight of the current detection period, determine the target weighted statistical characteristics of the target object's target indicators from the historical detection period to the current detection period.

[0221] 504. Based on the target weighted statistical characteristics, determine the target weighted mean, and the target weighted variance of the target indicator of the target object from the historical detection period to the current detection period.

[0222] 505. Based on the target metric, target weighted mean, and target weighted variance, perform anomaly detection on the target object's target indicators to obtain the anomaly detection results for the target object.

[0223] For descriptions of the target object, monitoring object group, and monitoring object, please refer to the relevant content in the foregoing embodiments, which will not be repeated here. In this embodiment, the target index is any index of the target object. The target metric is the metric (also called the observation value) of the target object's target index in the current detection period.

[0224] Among them, indicator x i The weighted average value during the detection period 1-t and weighted variance These are represented by equations (11) and (12) above, respectively. Referring to the analysis of the aforementioned embodiments, the index x of the monitored object can be obtained. i The weighted mean is obtained by analyzing the index x. i The values ​​of the metrics are accumulated over several periods. Therefore, the values ​​of each metric x are determined. i The intermediate characteristics of the weighted mean may include: index x i The weighted sum of the metric values ​​during the detection period 1-t and indicator x i The weights of the measurement values ​​are accumulated over a detection period of 1-t. Indicator x i The intermediate characteristics of the weighted variance may include: index x i The weighted sum of the squares of the products of the measures during the detection period 1-t and indicator x i The weights of the measurement values ​​are weighted and accumulated over the detection period 1-t.

[0225] definition Indicator x i and x j The weighted sum of the products of the measurements over the detection period 1-t is:

[0226]

[0227] Based on the aforementioned intermediate features, in this embodiment of the application, when performing anomaly detection on a target object, in step 501, the target metric value of the target object's target indicator in the current detection period t can be obtained. There can be one or more target objects. "Multiple" refers to two or more (including two).

[0228] To achieve anomaly detection of target indicators for target objects, in step 502, the historical weighted statistical features of the target indicators of at least one monitored object in the monitored object group over the historical monitoring period can also be obtained. The historical weighted statistical features include: intermediate features used to determine the weighted mean vector of the target indicators of the target object from the historical monitoring period to the current monitoring period t. Accordingly, the historical weighted statistical features may include: the historical weighted sum of the historical measurements of the target indicator over the historical monitoring period. And, the historical cumulative sum of the weights of the historical measurements of each indicator over the historical monitoring period. w (t-1).

[0229] It should be noted that if the current detection period is the first detection period, the historical weighted statistical features are set to 0. If the current detection period is any detection period other than the first detection period, the historical weighted statistical features are the weighted statistical features calculated from the previous detection period of the current detection period, which are updated period by period.

[0230] In some embodiments, the historical weighted statistical features include: intermediate features for determining the weighted variance of the target metric from the historical detection period to the current detection period t. Accordingly, the historical weighted statistical features may include: the historical weighted sum of the squares of the historical measurements of the target metric over the historical detection period.

[0231] The historical weighted statistical features are updated periodically according to the detection cycle. Online anomaly detection equipment or devices only need to store the historical weighted statistical features calculated in the previous detection cycle, which can reduce the storage space occupied by historical data.

[0232] In the single-index anomaly detection implementation, the target weighted statistics of the target object's index include: the target weighted mean of the target object's index from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t). and the target weighted variance of the target indicator of the target object from the historical detection period to the current detection period t (i.e., from detection period 1 to the current detection period t). Therefore, steps 13 and 14 can be implemented as steps 503 and 504, respectively. That is, after obtaining the historical weighted statistical characteristics of the target indicator of at least one monitoring object in the monitoring object group in the historical detection period, in step 503, the target indicator of the target object in the current detection period can be determined based on the historical weighted statistical characteristics and the target measurement value x of the target object in the current detection period. i,k (t) and the weight of the current detection cycle are used to determine the target index of the target object from the historical detection cycle to the current detection cycle t (i.e. from inspection cycle 1 to the current detection cycle t).

[0233] The target weighted statistical characteristics of the target object's target indicators may include: the weighted sum of the target indicator's measurement values ​​from the historical detection period to the current detection period. The sum of the weights of each indicator's measurement values ​​from the historical detection period to the current detection period. w (t), and the historical weighted sum of the squares of the target indicator's values ​​from the historical detection period to the current detection period. Regarding the weighted sum of the measurement values ​​of the target indicator from the historical detection period to the current detection period. The sum of the weights of each indicator's measurement values ​​from the historical detection period to the current detection period. w(t), and the historical weighted sum of the squares of the target indicator's values ​​from the historical detection period to the current detection period. For specific implementation details, please refer to the relevant content of the foregoing embodiments, which will not be repeated here.

[0234] Furthermore, in step 504, the target weighted mean can be determined based on the target weighted statistical characteristics. and the target weighted variance of the target indicator of the target object from the historical detection period to the current detection period t (i.e., from detection period 1 to the current detection period t). The weight of the current detection period is generally 1. The weight of other historical detection periods decreases as time goes forward.

[0235] Among them, the target indicator for determining the target object is the weighted average of the target indicators from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t). and the target weighted variance of the target indicator of the target object from the historical detection period to the current detection period t (i.e., from inspection period 1 to the current detection period t). For details on the specific implementation method, please refer to the relevant content of the foregoing embodiments, which will not be repeated here.

[0236] Accordingly, step 15 can be implemented as step 505, which involves performing anomaly detection on the target indicator of the target object based on the target metric, the target weighted mean vector, and the target weighted variance, to obtain the anomaly detection result of the target object. Specifically, the target metric of the target object in the current detection period and the aforementioned target weighted mean can be determined. The distance between them. Specifically, it can be the target metric of the target object in the current detection period and the aforementioned target weighted average. The absolute value of the difference between them is determined as the target metric and the aforementioned target weighted average. The distance between them can be expressed as:

[0237] Furthermore, in step 505, the target metric of the target object can be compared with the target weighted average of the aforementioned target metrics. The distance between them and the target weighted variance of the aforementioned target indicators Anomaly detection is performed on the target metrics of the target object to obtain the anomaly detection results.

[0238] Specifically, it can be determined that the target metric of the target object is compared with the target weighted average of the aforementioned target metrics. Is the distance between them greater than the target weighted standard deviation of the set scaling factor R? Wherein, if the target metric of the target object is the target weighted average of the aforementioned target metrics The distance between them is greater than the target weighted standard deviation of the set scaling factor R. This indicates that the target object's target metric is abnormal. For information on the value of the scaling factor R, please refer to the relevant content in the foregoing embodiments; it will not be repeated here.

[0239] In this embodiment, a weighting mechanism is introduced for the detection period. Historical detection periods closer to the current detection period have a higher weight, resulting in earlier detection period data samples contributing less to anomaly detection and more recent data samples contributing more. This reduces the impact of data samples from distant historical detection periods on the statistical results, helping to more accurately reflect the latest state of the target object and quickly keep up with the dynamic changes in the monitored object's system. This enables anomaly detection that adapts to the dynamic changes of the monitored object, thereby improving the accuracy of anomaly detection. Furthermore, storing the weighted statistical features calculated from historical detection periods and updating them periodically eliminates the need to store all historical metrics, saving storage space occupied by historical data. In any detection period of online anomaly detection, the historical statistical features are directly updated using newly collected data samples from the current detection period, without needing to use sample data from previous detection periods for calculation. Compared to batch calculations using a large number of historical samples, this speeds up anomaly detection and improves its efficiency.

[0240] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 101 and 102 can be device A; or the execution subject of step 101 can be device A, and the execution subject of step 102 can be device B; and so on.

[0241] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0242] Accordingly, embodiments of this application also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the steps in the above-described anomaly detection method.

[0243] This application also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the above-described anomaly detection method. In this application, the specific implementation of the computer program product is not limited. In some embodiments, the computer program product may be implemented as an application (APP), a mini-program, a PC client, a program module, a plug-in, an installation package, a software development kit (SDK), an optical disc image file (such as an ISO file), a plug-in, or software in the form of Software as a Service (SaaS), etc., but is not limited thereto.

[0244] Figure 5b This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 5b As shown, the electronic device includes a memory 50a and a processor 50b. The memory 50a is used to store computer programs.

[0245] The processor 50b is coupled to the memory 50a and is used to execute a computer program to perform the steps in the anomaly detection methods provided in the foregoing embodiments. Specific implementation details of each step can be found in the relevant descriptions of the foregoing embodiments, and will not be repeated here.

[0246] In some alternative implementations, such as Figure 5b As shown, the electronic device may also include optional components such as a communication component 50c, a power supply component 50d, a display component 50e, and an audio component 50f. Figure 5b The diagram only shows some components and does not mean that the electronic device must contain them. Figure 5b The inclusion of all components does not imply that an electronic device can only include... Figure 5b The components shown.

[0247] in addition, Figure 5b The components within the dashed box are optional, not mandatory, and their specific requirements depend on the form factor of the electronic device. The electronic device in this embodiment can be a desktop computer, laptop computer, mobile phone, or IoT device; it can also be a traditional server, cloud server, or server cluster, or other server equipment.

[0248] In this embodiment, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Electrically Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0249] In the embodiments of this application, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a microcontroller unit (MCU); it can also be a field-programmable gate array (FPGA), a programmable array logic (PAL), a general array logic (GAL), a complex programmable logic device (CPLD), or other programmable devices; or it can be an advanced RISC machine (ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0250] In this embodiment, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device housing the communication component can access wireless networks based on communication standards, such as Wireless Fidelity (WiFi), 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component may also be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), or other technologies.

[0251] In embodiments of this application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0252] In this embodiment, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0253] In embodiments of this application, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), which is configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with the user can be achieved through the audio component.

[0254] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0255] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0256] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0257] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0258] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0259] In a typical configuration, a computing device includes one or more processors (CPU, etc.), input / output interfaces, network interfaces, and memory.

[0260] Memory may include non-persistent storage in computer-readable media, such as random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0261] Computer storage media are readable storage media, also known as removable media. Removable and non-removable media can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0262] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0263] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An anomaly detection method, characterized in that, include: Obtain the measurement value of the target object's metrics in the current detection period; Obtain the historical weighted statistical features of indicators for at least one monitored object in the monitored object group over historical monitoring periods; the historical weighted statistical features are obtained by iterative calculation in the previous monitoring period of the current monitoring period; the at least one monitored object includes the target object; the earlier the monitoring period, the smaller the weight; Based on the historical weighted statistical features, the metric value, and the weight of the current detection period, the target weighted statistical features of the target object's indicators from the historical detection period to the current detection period are determined; Based on the target weighted statistical characteristics, determine the target weighted statistical values ​​of the target object's indicators from the historical detection period to the current detection period; The target weighted statistical feature is an intermediate quantity used to determine the target weighted statistic; Based on the metric and the target weighted statistic, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object.

2. The method according to claim 1, characterized in that, The indicators are multiple, and the multiple indicators form an indicator vector; the measurement value of the target object's indicators in the current detection period includes: multiple measurement values ​​of the target object's indicator vector in the current detection period; The acquisition of the historical weighted statistical characteristics of the indicators of at least one monitoring object in the monitoring object group over the historical monitoring period includes: Obtain the historical weighted statistical characteristics of the indicator vector of at least one monitoring object in the monitoring object group during the historical monitoring period; The step of determining the target weighted statistics of the target object's indicators from the historical detection period to the current detection period based on the target weighted statistical characteristics includes: Based on the target weighted statistical characteristics, the target weighted mean vector of the indicator vector of the target object from the historical detection period to the current detection period is determined, and the target weighted covariance matrix of the indicator vector of the target object from the historical detection period to the current detection period is determined; the target weighted statistics include the target weighted mean vector and the target weighted covariance matrix.

3. The method according to claim 2, characterized in that, The historical weighted statistical features include: the first historical weighted sum of the historical measurement values ​​of multiple indicators in the historical detection period, and the historical cumulative sum of the weights of the historical measurement values ​​of each indicator in the historical detection period; The step of determining the target weighted statistical features of the target object's indicators from the historical detection period to the current detection period based on the historical weighted statistical features, the multiple metrics, and the weight of the current detection period includes: For any indicator in the indicator vector, based on the first historical weighted sum corresponding to the indicator, the weight of the current detection period, the measurement value of the indicator in the current detection period, and a preset weight decay factor, the first target weighted sum of the measurement values ​​of the indicator from the historical detection period to the current detection period is determined as one of the target weighted statistical features corresponding to the indicator. Based on the historical cumulative sum of the weights of any historical metric values ​​in the historical detection period, the weight of the current detection period, and a preset weight decay factor, the target cumulative sum of the weights of any indicator's metric values ​​from the historical detection period to the current detection period is determined, which serves as one of the target weighted statistical features corresponding to any indicator.

4. The method according to claim 3, characterized in that, Based on the target weighted statistical characteristics, the target object's index vector is determined as the target weighted mean vector from the historical detection period to the current detection period, including: Calculate the first ratio between the first target weighted sum corresponding to any one of the indicators and the target cumulative sum of the weights, and use it as the target weighted average of any one of the indicators from the historical detection period to the current detection period; The target weighted mean vector is constructed by using the target weighted mean values ​​corresponding to multiple indicators in the indicator vector of the target object.

5. The method according to claim 2, characterized in that, The historical weighted statistical features also include: the second historical weighted sum of the products of the historical measurements of any two different indicators in the historical detection period, the third historical weighted sum of the squares of the historical measurements of the same indicator in the historical detection period, and the historical cumulative sum of the weights of the historical measurements of each indicator in the historical detection period. The step of determining the target weighted statistical features of the target object's indicators from the historical detection period to the current detection period based on the historical weighted statistical features, the multiple metrics, and the weight of the current detection period further includes: For any two indicators in the indicator vector, based on the second historical weighted sum corresponding to the two indicators, the weight of the current detection period, the measurement value of the two indicators in the current detection period, and the preset weight decay factor, the second target weighted sum of the product of the measurement values ​​of the two indicators from the historical detection period to the current detection period is determined as one of the target weighted statistical features corresponding to the two indicators. For any indicator in the indicator vector, based on the third historical weighted sum corresponding to the indicator, the weight of the current detection period, the measurement value of the indicator in the current detection period, and the preset weight decay factor, the third target weighted sum of the square of the measurement value of the indicator from the historical detection period to the current detection period is determined as one of the target weighted statistical features corresponding to the indicator. Based on the historical cumulative sum of the weights of the historical measurement values ​​of any indicator in the historical detection period, the weight of the current detection period, and a preset weight decay factor, the target cumulative sum of the weights of the measurement values ​​of any indicator from the historical detection period to the current detection period is determined as one of the target weighted statistical features.

6. The method according to claim 5, characterized in that, The target weighted mean vector includes: the target weighted mean of each of the multiple indicators from the historical detection period to the current detection period; Based on the target weighted statistical characteristics, the target weighted covariance matrix of the indicator vector of the target object from the historical detection period to the current detection period is determined, including: Based on the second target weighted sum corresponding to any two indicators, the target cumulative sum of the weights, and the target weighted mean corresponding to each of the two indicators, the target weighted covariance of the two indicators from the historical detection period to the current detection period is determined as the target weighted covariance of the two indicators. Based on the third target weighted sum corresponding to any one of the indicators, the target cumulative sum of the weights, and the target weighted mean corresponding to any one of the indicators, the target weighted covariance between any one of the indicators from the historical detection period to the current detection period is determined, and is used as the target weighted covariance between any one of the indicators; The target weighted covariance matrix is ​​constructed based on the target weighted covariance of different indicators among the multiple indicators, and the target weighted covariance of the same indicator with the same indicator.

7. The method according to claim 6, characterized in that, The step of determining the target weighted covariance of any two indicators from the historical detection period to the current detection period based on the second target weighted sum corresponding to any two indicators, the target cumulative sum of the weights, and the target weighted mean corresponding to each of the two indicators includes: Calculate the second ratio between the second target weighted sum corresponding to any two indicators and the target cumulative sum of the weights; Subtract the product of the target weighted means corresponding to each of the two indicators from the second ratio to obtain the target weighted covariance corresponding to the two indicators.

8. The method according to any one of claims 2-7, characterized in that, The step of performing anomaly detection on the target object based on the metric value and the target weighted statistics to obtain the anomaly detection result of the target object includes: Based on the multiple metrics, the target weighted mean vector, and the target weighted covariance matrix, determine the Mahalanobis distance of multiple indicators of the target object in the current detection period; Based on the Mahalanobis distance, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object.

9. The method according to claim 8, characterized in that, The step of determining the Mahalanobis distance of multiple indicators of the target object in the current detection period based on the multiple metrics, the target weighted mean vector, and the target weighted covariance matrix includes: Obtain the jitter factor, the dimension of which is the same as the dimension of the diagonal elements of the target weighted covariance matrix; A jitter factor is added to the diagonal elements of the target weighted covariance matrix to obtain the adjusted target weighted covariance matrix; Based on multiple metrics of the target object, the target weighted mean vector, and the adjusted target weighted covariance, the Mahalanobis distance of multiple indicators of the target object in the current detection period is determined.

10. The method according to claim 9, characterized in that, The acquisition of the jitter factor includes: The product of the diagonal elements and a set constant is determined, and the set constant is added to the product of the diagonal elements and the set constant to obtain the jitter factor; the set constant is greater than 0 and less than 1.

11. The method according to claim 1, characterized in that, The indicator is a single target indicator; the measurement value of the target object's indicator in the current detection period includes: the target measurement value of the target object's indicator vector in the current detection period; The step of determining the target weighted statistics of the target object's indicators from the historical detection period to the current detection period based on the target weighted statistical characteristics includes: Based on the target weighted statistical characteristics, the target weighted mean of the target index of the target object from the historical detection period to the current detection period is determined, and the target weighted variance of the target index of the target object from the historical detection period to the current detection period is determined; the target weighted statistics include the target weighted mean vector and the target weighted variance.

12. The method according to claim 11, characterized in that, The step of performing anomaly detection on the target object based on the metric value and the target weighted statistics to obtain the anomaly detection result of the target object includes: Determine the target distance between the target metric and the target weighted mean; Based on the target distance and the target weighted variance, anomaly detection is performed on the target indicators of the target object to obtain the anomaly detection result of the target object.

13. The method according to any one of claims 1-7 and 11-12, characterized in that, Also includes: The stored historical weighted statistical features are updated to the target weighted statistical features, so that the target weighted statistical features can be read in the next detection cycle as the historical weighted statistical features corresponding to the historical detection cycle in the next detection cycle.

14. An anomaly detection method, characterized in that, include: Obtain multiple measurement values ​​corresponding to each of the multiple indicators of at least one monitored object in the monitored object group; Multiple measurement values ​​corresponding to any one indicator belong to multiple detection periods; Based on the multiple metrics corresponding to each of the multiple indicators and the weights of the multiple detection periods, the target weighted mean vector and the target weighted covariance matrix of the multiple indicators are determined; the earlier the detection period, the smaller the weight. From the multiple measurement values ​​corresponding to each of the multiple indicators, obtain the multiple measurement values ​​of the target object in the at least one monitoring object in the current detection period. Based on the target weighted mean vector, the target weighted covariance matrix, and multiple metrics of the target object in the current detection period, determine the Mahalanobis distance of the multiple metrics of the target object in the current detection period; Based on the Mahalanobis distance, anomaly detection is performed on the target object to obtain the anomaly detection result of the target object.

15. An electronic device, characterized in that, include: A memory and a processor; wherein the memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 1-14.

16. A computer-readable storage medium storing computer instructions, characterized in that, When the computer instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method according to any one of claims 1-14.

17. A computer program product, characterized in that, Includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps of the method according to any one of claims 1-14.

Images