Server exception judgment method and electronic device

Abstract

This application discloses a server anomaly detection method and electronic device, relating to the field of computer application technology. The method includes acquiring various operating parameters from multiple servers, performing pre-processing on these parameters to obtain residual data characterizing unexpected fluctuations, calculating an initial anomaly score for each server based on the residual data corresponding to various types of operating parameters, and then collaboratively updating the initial anomaly scores of the servers based on the topological relationships between them to obtain a collaborative anomaly score for the target server that takes into account its upstream neighbor servers. By combining the interactions between servers with the initial anomaly scores obtained from the residual data, a collaborative anomaly score is obtained that deeply considers the server's own operating status and the operating status of surrounding servers, thereby more accurately determining whether the target server is abnormal.

Description

Technical Field

[0001] This application relates to the field of computer application technology, and in particular to a server anomaly detection method and electronic device. Background Technology

[0002] As server clusters become increasingly large and complex, the need to ensure stable server operation is becoming more urgent. Existing server anomaly detection solutions typically perform independent data analysis on the raw operational metrics of a single server. However, in complex cluster networks, servers often have inseparable dependencies and interactions. A failure in a single server can quickly propagate and spread to other servers through the call chain, triggering a cascading effect. Current technologies only use pre-set thresholds to determine if a single server is abnormal, lacking in-depth analysis of its operational status and ignoring the interactions between servers. This leads to missed or false alarms when analyzing server anomalies. Summary of the Invention

[0003] This application provides a server anomaly detection method and electronic device to at least solve the problem in the prior art where the lack of consideration for the interaction between servers leads to inaccurate results when determining whether a server is abnormal.

[0004] This application provides a method for server anomaly detection, including: Obtain the operating parameters of multiple servers, including the target server; The operating parameters are pre-processed to obtain residual data for each server. The residual data is used to characterize the unexpected fluctuations in the operating parameters of the corresponding server. Based on the residual data, the initial anomaly score for each server is obtained; Based on the topological relationship between servers, the initial anomaly score of the servers is updated to obtain the collaborative anomaly score of the target server. Based on collaborative anomaly scoring, determine whether the target server is abnormal.

[0005] This application also provides an electronic device, including: Memory, used to store computer programs; A processor is used to implement the steps of any of the above-mentioned server exception detection methods when executing computer programs.

[0006] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described server anomaly detection methods.

[0007] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described server exception judgment methods.

[0008] This application also provides a server anomaly detection device, including: The acquisition module is used to acquire the operating parameters of multiple servers, including the target server. The processing module is used to pre-process the operating parameters to obtain the residual data corresponding to each server. The residual data is used to characterize the unexpected fluctuations of the operating parameters of the corresponding server. Based on the residual data, the initial anomaly score of each server is obtained. Based on the topological relationship between the servers, the initial anomaly score of the servers is updated to obtain the collaborative anomaly score of the target server. The analysis module is used to determine whether the target server is abnormal based on collaborative anomaly scoring.

[0009] This application obtains and pre-processes the operating parameters of multiple servers to generate residual data that characterizes unexpected fluctuations in these parameters, thus eliminating the interference of expected fluctuations in anomaly detection. Based on this, the topological relationships between servers are introduced, combining the interactions between servers with the initial anomaly scores obtained from the residual data for each server. This results in a collaborative anomaly score that deeply considers both the server's own operating status and the operating status of surrounding servers, thereby more accurately determining whether a target server is abnormal. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A schematic flowchart illustrating the main steps of a server anomaly detection method provided in an embodiment of this application; Figure 2 A schematic flowchart illustrating the main steps of preset processing of operating parameters provided in an embodiment of this application; Figure 3 A schematic flowchart illustrating the main steps for updating the initial anomaly score of a server, provided in an embodiment of this application; Figure 4 This is a flowchart illustrating the main steps for determining whether a target server is abnormal, provided in an embodiment of this application. Figure 5 A schematic flowchart of a server anomaly detection method provided in an exemplary embodiment of this application; Figure 6 This is a schematic diagram of the main structure of a server anomaly detection device provided in an embodiment of this application; Figure 7 This is a schematic diagram of a server anomaly detection system provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0013] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0014] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] This application provides a method for determining server anomalies. This method can be executed by a server anomaly determination device provided in this application. The device can be implemented in software and / or hardware and can be integrated into an electronic device. The method is described in detail below with reference to the execution flow of the server anomaly determination method.

[0016] Figure 1 This is a schematic flowchart illustrating the main steps of a server anomaly detection method provided in an embodiment of this application, as follows: Figure 1 As shown, the server anomaly detection method may include the following steps: Step S100: Obtain the operating parameters of multiple servers, including the target server.

[0017] In this embodiment, the target server refers to any server to be detected that needs to be anomaly detected, and multiple servers refer to servers deployed in the same network cluster as the target server, and these servers have logical or physical interconnection with the target server. That is, multiple servers, including the target server, are in the same topology architecture.

[0018] In this embodiment, the operating parameters refer to various performance indicators that reflect the server's operation, and these parameters can change dynamically over time. Operating parameters may include multi-dimensional server operating indicator data, such as, but not limited to, CPU utilization, network packet rate, and disk utilization. These operating parameters can be categorized and organized into parameter time series based on their generation time. It should be understood that in subsequent processing of operating parameters, parameters of the same type should be processed separately, rather than mixing parameters of different types together. Operating parameters can be obtained directly from each server or retrieved from a centralized data storage medium; this application does not limit the method of acquisition.

[0019] Step S200: Preset the operating parameters to obtain the residual data corresponding to each server.

[0020] During server operation, operating parameters typically contain numerous regular fluctuations. These regular fluctuations are expected and normal, such as anticipated sudden changes or periodic peaks and troughs, and generally vary with actual dates and business cycles. In this embodiment, residual data refers to the remaining data extracted from the original operating parameters after pre-processing, which is used to characterize the unexpected fluctuations in the operating parameters reflected by the server's operating status.

[0021] In this embodiment, the methods for pre-processing the operating parameters may include, but are not limited to, time-series decomposition and decoupling, pre-predicted model output, historical data comparison, and filtering after time-frequency domain conversion. The purpose of processing the operating parameters is to eliminate expected normal fluctuations, thereby obtaining responses to unexpected abrupt changes.

[0022] In one embodiment, combined Figure 2 The flowchart shown illustrates the main steps for presetting operating parameters. Step S200 may further include the following steps S210-S220: Step S210: Based on the operating parameters, obtain a first component to characterize the long-term trend of the server's operating state and a second component to characterize the periodic pattern of the server's operating state.

[0023] In this embodiment, a first component representing the long-term trend of the server's operating status reflected in the operating parameters can be obtained by processing the original operating parameters using a moving average through time-series decoupling. Simultaneously, using phase alignment rules, the mean or median of the same phase within multiple historical periods is calculated as the expected value, thus obtaining a second component representing the periodic pattern of the server's operating status reflected in the operating parameters. Alternatively, a pre-trained model can be used, inputting similar types of operating parameters into the preset model, which then analyzes the data and outputs the first and second components. Alternatively, trend-time labels and period-time labels can be generated based on historical data, and the first and second components can be determined by comparing the time of the acquired operating parameters with the time in the labels.

[0024] Step S220: Remove the first and second components from the running parameters to obtain residual data.

[0025] In this embodiment, the operating parameters are the specific values ​​of various indicators of server operation. Therefore, by subtracting the first and second components obtained above from these values, the result is the residual data.

[0026] continue Figure 1 In the embodiment shown, the server anomaly judgment method of this application further includes step S300, which obtains the initial anomaly score of each server based on the residual data.

[0027] In this embodiment, the initial anomaly score refers to a reference value obtained based solely on the residual data of a single server, used to preliminarily assess whether the server itself has any anomalies.

[0028] In this embodiment, the initial anomaly score can be obtained through statistical methods such as probability distribution, extreme values ​​of residual data, Euclidean distance, and preset model prediction output.

[0029] By extracting and removing the first component, which represents the long-term trend of the server's operating status, and the second component, which represents the periodic pattern, the background noise interference caused by expected regular fluctuations is reduced, ensuring that the final residual data can correctly reflect unexpected fluctuations.

[0030] exist Figure 2 In the illustrated embodiment, operating parameters of the same type constitute an operating parameter time series in the order of their acquisition time. Therefore, after calculating the residual data for each parameter in the parameter time series, the resulting residual data should also be composed of a time series based on the acquisition time of the corresponding operating parameter, and the type of the residual time series should correspond one-to-one with the type of the operating parameter. Based on this, in one embodiment, step S300 may further include the following steps S310-S360: Step S310: For each type of residual time series, based on multiple preset time windows, select a corresponding number of residual data in the residual time series with the same time point as the reference.

[0031] In this embodiment, the lengths of the multiple time windows are different. It should be understood that if the system is powered on for the first time, it may not be able to obtain a residual time series that satisfies the longest time window. In this case, you can choose to temporarily suspend this step and continue to repeat the aforementioned steps until a residual time series of sufficient length can be obtained, and then continue to execute this step.

[0032] In this embodiment, using the same point in time as a baseline, a corresponding number of residual data points are extracted from the historical direction relative to that point in time. Correspondingly, the final calculated initial anomaly score and collaborative anomaly score are both the server's score at that specific point in time. For example, on the timeline, the current time is 0, and the historical times relative to the current time, from closest to furthest, are -1, -2, -3, -4, -5, -6, and so on. Assuming the lengths of the two time windows are 3 and 5 respectively, then a time window of length 3 can obtain the residual data for the current time 0, -1, and -2, and a time window of length 5 can obtain the residual data for the current time 0, -1, -2, -3, and -4. The final initial anomaly score and collaborative anomaly score are both the server's score at the current time 0.

[0033] Step S320: For each time window, based on the selected residual data, obtain the evaluation results of multiple dimensions corresponding to that time window.

[0034] In this embodiment, the evaluation results of multiple dimensions may include, but are not limited to, mean, median, kurtosis, etc. These evaluation results can be calculated by preset formulas, or the selected residual data can be input into a preset model, and the preset model will analyze and output the evaluation results.

[0035] By setting time windows of different lengths, it is possible to capture both sudden, instantaneous anomalies and gradual, slow-progressing anomalies, thus balancing sensitivity and robustness.

[0036] In one implementation, the mean, standard deviation, and maximum absolute deviation of the selected residual data can be calculated. The mean characterizes the average deviation of the selected residual data, the standard deviation characterizes the volatility of the selected residual data, and the maximum absolute deviation characterizes peak outliers in the selected residual data. By calculating the mean, standard deviation, and maximum absolute deviation, the residual distribution within the specified window can be comprehensively analyzed, thereby capturing various anomalies within that window.

[0037] Specifically, preset formulas can be used to calculate the above values ​​respectively, for example: The mean can be calculated using the following formula:

[0038] The standard deviation can be calculated using the following formula:

[0039] The maximum absolute deviation can be calculated using the following formula:

[0040] Where i represents the index of the type of running parameter, t represents the base time, and w represents the window length. This represents the k-th residual data. This represents the mean. Indicates standard deviation, This represents the maximum absolute deviation. The mean can be used to reflect the average deviation of the residual data within this time window, the standard deviation can be used to reflect the volatility of the residual data within this time window, and the maximum absolute deviation can be used to capture the peak-like anomalies of the residual data within this time window.

[0041] Step S330: Traverse all time windows to obtain the multi-dimensional evaluation results corresponding to each time window.

[0042] In this embodiment, the above steps are performed for each time window, so that multiple evaluation results for each time window are obtained.

[0043] Step S340: Based on the preset first weight distribution and the evaluation results of multiple dimensions corresponding to each time window, obtain the comprehensive evaluation result of this type of residual time series.

[0044] In this embodiment, the number of values ​​included in the first weight distribution corresponds to the number of time windows. The distribution of these values ​​can be preset based on historical experience or can be dynamically distributed based on a preset model.

[0045] In one implementation, three time windows of different lengths can be used to extract the corresponding residual data, and the first weight distribution contains 3 values. Assume the short window has a length of s, the medium window has a length of m, and the long window has a length of l. Within each time window, the mean, standard deviation, and maximum absolute deviation are obtained based on step S302. In this implementation, the nine evaluation results from the three time windows are concatenated in the order of short, medium, and long to form a vector of length 9, which can be represented as:

[0046] in, The concatenated vector is used to represent the time step (i.e., at time 10). Multi-scale residual characteristics Indicates a short window. Indicates the middle window, This represents a long window. The multi-scale residual features are input into a trainable single-layer linear transformation module, which outputs three raw attention scores. , , The importance of the three time windows, namely short, medium and long, is initially assessed.

[0047] The three raw scores are normalized using the Softmax function to obtain the specific values ​​in the first weight distribution. This process can be expressed by the following formula:

[0048] in, Indicates the window length. This indicates the degree of attention the model pays to a specific time scale in the current context, i.e. The weights of the length window, and, Each .

[0049] For each window The abnormal intensity index of this window It can be obtained through the following formula:

[0050] The above formula integrates the mean shift, fluctuation amplification, and extreme values ​​within the time window in the form of Euclidean norm, and modulates their contribution ratio by attention weight.

[0051] Since the number of time windows is 3 in this embodiment, the anomaly intensity index of this type of residual time series, that is, the comprehensive evaluation result of this type of residual time series, is... It can be obtained through the following formula:

[0052] in, This indicates the anomaly intensity index under a short window corresponding to this type of residual time series. This indicates the anomaly intensity index within the middle window corresponding to this type of residual time series. This indicates the anomaly intensity index under a long window corresponding to this type of residual time series.

[0053] Step S350: Traverse all types of residual time series to obtain the comprehensive evaluation results corresponding to each type of residual time series.

[0054] In this embodiment, the server's operating parameters are typically of various types, and therefore, the corresponding residual time series are also of various types. Only by traversing all types of residual time series can the comprehensive evaluation result corresponding to each type of residual time series contained in the server be obtained.

[0055] Step S360: Based on the preset second weight distribution and all comprehensive evaluation results, the initial anomaly score of the server is obtained.

[0056] In this embodiment, the server's operating parameters are typically of multiple types. The above steps only calculate the comprehensive evaluation result for each type of residual time series. To evaluate the server's initial anomaly score, the second weight distribution is needed to fuse all the comprehensive evaluation results. Therefore, the number of values ​​included in the second weight distribution in this embodiment corresponds to the number of types of the server's operating parameters.

[0057] In the above implementation, assuming there are three types of server operating parameters, correspondingly, there are three types of residual time series, and the second weight distribution also contains three values. The process of fusing all the comprehensive evaluation results using the second weight distribution can be achieved through the following formula:

[0058] in, This represents the server's initial anomaly score at time t. This score not only reflects the magnitude of the anomaly but also implies semantic information about the anomaly's form. This indicates the number of types of the server's runtime parameters. This represents the global importance weight at the indicator level, which can be dynamically generated using an attention mechanism to satisfy... ,and , This represents the comprehensive evaluation result of the residual time series of the i-th type.

[0059] continue Figure 1 In the embodiment shown, the server anomaly judgment method of this application further includes step S400, which updates the initial anomaly score of the server based on the topological relationship between the servers to obtain the collaborative anomaly score of the target server.

[0060] In this embodiment, topology refers to a structured logical network in which servers are interconnected, interdependent, or communicate with each other.

[0061] In this embodiment, the weights of other servers surrounding the target server can be determined based on the topological relationship. Then, based on these weights and the initial anomaly scores of each server, the collaborative anomaly score of the target server can be determined. Alternatively, a preset model can be used, where the server topological relationship and the initial anomaly scores of each server are input into the model, and the model analyzes the data and outputs the predicted collaborative anomaly score.

[0062] In one embodiment, combined Figure 3 The flowchart shown illustrates the main steps for updating the initial anomaly score of the server. Step S400 may further include the following steps S410-S430: Step S410: Based on the topological relationship between the servers, determine the number of upstream neighbor servers corresponding to each server.

[0063] In this embodiment, the upstream neighbor server refers to the initiator or caller of the business request. For the target server, its upstream neighbor refers to a server that directly or indirectly calls the target server. If the upstream server is abnormal, the server being called will generate a transmitted exception while waiting for its return result.

[0064] In this embodiment, a server can be taken as the center, and the proximity distance between it and the surrounding servers can be determined. Then, a corresponding number of upstream neighbor servers can be selected based on the distance.

[0065] Step S420: Based on the initial anomaly score of the server and the number of upstream neighbor servers corresponding to each server, the initial anomaly score of each server is iteratively updated.

[0066] In this embodiment, the number of upstream neighbors reflects the probability of the server generating a transmitted anomaly, as well as the severity of the transmitted anomaly. The number of servers and their upstream neighbors, along with their respective initial anomaly scores, can be input into the model, which then iteratively updates the initial anomaly scores for each server.

[0067] In one implementation, step S420 may specifically include the following steps S421-S422: Step S421: For each server, determine the first and second neighbors among the upstream neighbor servers of that server.

[0068] In this embodiment, the first neighbor is a server that has a direct calling relationship with the server, and the second neighbor is a server that has a direct calling relationship with the first neighbor.

[0069] Step S422: Based on the number of first neighbors and the initial anomaly score, and the number of second neighbors and the initial anomaly score, the initial anomaly score of the server is iteratively updated.

[0070] In one example of this implementation, the server is referred to as The upstream neighbor server with which it has a calling relationship is denoted as The set of all servers is the node set. All valid call relationships are edge sets. Constructing a dynamic directed graph The graph structure is dynamically updated as business traffic changes. Each server... At the present moment Single server anomaly score As the initial features of its graph nodes The diagram Input node features into the included A spatiotemporal graph neural network with layers. In the first... The layer performs the following spatial aggregation operations:

[0071] in, Indicates server The spatial aggregation result at this layer, Indicates server The spatial aggregation results in the upper layer Indicates pointing to the server The set of all upstream neighbors, For server The number of upstream neighbors, i.e. the number of first neighbors, and similarly, To indicate pointing to the server The set of all upstream neighbors, For server The number of upstream neighbors, i.e., the number of second neighbors. For nodes in the time dimension. past The spatial aggregation results at each time step are subjected to a one-dimensional convolution operation to extract the temporal evolution pattern and output the updated node representation. The spatial aggregation result can be expressed as:

[0072] through After spatiotemporal propagation, the final layer output is taken. As a server At any moment Collaborative anomaly scoring .

[0073] continue Figure 3 In the embodiment shown, updating the initial anomaly score of the server further includes step S430: when the number of iterations reaches a preset value, the result obtained by the target server in the last iteration is used as the collaborative anomaly score of the target server.

[0074] In this embodiment, the number of iterations can be set based on historical experience, or a reasonable number of iterations can be set based on the structural characteristics of a preset model or neural network. As in one example of the above implementation steps, the spatiotemporal graph neural network includes... The number of iterations for each layer is... Second-rate.

[0075] continue Figure 1 In the embodiment shown, the server anomaly judgment method of this application further includes step S500, which determines whether the target server is abnormal based on collaborative anomaly scoring.

[0076] In this embodiment, the abnormality of the target server can be determined by comparing the magnitude of the collaborative anomaly score and the score threshold. The threshold can be set based on historical experience, or a dynamic threshold can be obtained based on the attention mechanism. Alternatively, the abnormality of the target server can be determined based on the fluctuation range of the collaborative anomaly scores in recent times.

[0077] In one embodiment, combined Figure 4 , Figure 4 To illustrate the main steps in determining whether the target server is abnormal, step S500 may further include steps S510-S530: Step S510: Based on the collaborative anomaly scores obtained by the target server at historical moments, obtain the scoring threshold.

[0078] In this embodiment, the average score can be calculated based on historical collaborative anomaly scores to obtain the scoring threshold. Alternatively, the numerical range of normal collaborative anomaly scores can be obtained based on historical collaborative anomaly scores. Or, based on a preset model, the collaborative anomaly scores obtained at historical moments can be input into the model, which will then analyze and output the scoring threshold.

[0079] Step S520: Determine the relationship between the collaborative anomaly score obtained by the target server at the current moment and the score threshold.

[0080] Step S530: Based on the judgment result of the size relationship, determine whether the target server is abnormal.

[0081] In one implementation, step S510 may further include the following steps S511-S513: Step S511: Based on the previous time relative to the current time, select the collaborative anomaly scores of the target server at N consecutive historical times, where N is an integer greater than 1.

[0082] Step S512: Sort the N collaborative anomaly scores in order of numerical value.

[0083] Step S513: In the sorting results, select the collaborative anomaly score corresponding to the Pth quantile position as the scoring threshold.

[0084] In this embodiment, the Pth quantile is greater than 0 and less than 1. Its value is used to represent the sensitivity of judging whether the server is abnormal. The larger the value, the larger the selected scoring threshold and the lower the corresponding sensitivity, and vice versa.

[0085] In one example of this implementation, for each server Maintain a length of Collaborative anomaly scoring history queue This queue only retains the most recent ones. The score value at time 1. Sort the values ​​in the queue in ascending order, and select the score value at time 2. The value corresponding to the quantile position is used as the dynamic threshold. ,in The preset information level parameter has a range of values. In the next moment Computing server New Collaborative Anomaly Scoring If satisfied Then determine the server At any moment An anomaly exists.

[0086] The scoring threshold is determined based on the collaborative anomaly scoring of historical moments, and the threshold can be dynamically adjusted over time.

[0087] Figure 5 This is a schematic flowchart of a server anomaly detection method provided in an exemplary embodiment of this application, as shown below. Figure 5 As shown, the server anomaly detection method of this application can be described as follows: a. Collect time-series data of multi-dimensional operational metrics of the server cluster; For example, the first in the data acquisition server cluster The observations of each monitoring indicator at consecutive time points constitute the original time series. ,in Indicates the current time step. This indicates the index of the metric dimension.

[0088] b. Perform online seasonal-trend decoupling processing on each dimension of the multidimensional operational indicator time series data to obtain the residual sequence; For example, setting a smoothing coefficient and Both of them take values ​​within an open interval. This setting controls the update rate of trend and seasonal items; it also sets the period length. This value is pre-configured based on business load patterns and represents the number of time steps contained in a complete business cycle. Initialize trend components. Seasonal portion Before A preliminary estimate using the central moving average of the observations. At each newly arrived time step... Perform the following calculations in sequence:

[0089]

[0090]

[0091] in, Indicates the first Dimensional indicators at time The trend component reflects the baseline level, which changes slowly over a long period of time; Indicates the first Dimensional indicators at time The seasonal component is used to characterize cyclical fluctuation patterns; Indicates the first Dimensional indicators at time The residual sequence is the unexpected volatility component remaining after removing the influence of trends and seasons.

[0092] c. Extract statistical features from the residual sequence under multiple preset time windows to form multi-scale residual features.

[0093] For example, for each time window of each type of residual sequence, calculate the mean, standard deviation, and maximum absolute deviation of the selected residual data.

[0094] d. Attention-weighted fusion of multi-scale residual features to generate single-server anomaly scores.

[0095] For example, the first weight distribution is used to obtain the comprehensive evaluation results corresponding to the residual time series of the same type, and the second weight distribution is used to fuse all the comprehensive evaluation results to obtain the single server anomaly score.

[0096] e. Construct a dynamic directed graph based on the call dependencies between servers, and input the single-server anomaly score as the initial feature of the graph node into the spatiotemporal graph neural network to generate a collaborative anomaly score through spatiotemporal aggregation.

[0097] f. Compare the collaborative anomaly score with the dynamic threshold. When the score exceeds the dynamic threshold, it is determined that the corresponding server has abnormal behavior and an alarm is triggered.

[0098] For example, the server's unique identifier, the timestamp of the anomaly, the collaborative anomaly score, and the dynamic threshold are combined into an alarm signal and sent to operations and maintenance personnel. Simultaneously, the collaborative anomaly score for this anomaly is added to the end of the historical queue, and the oldest element is removed, enabling continuous adaptive updates to the threshold. When the collaborative anomaly score exceeds the dynamic threshold for multiple consecutive time points, the alarm level is increased, and the duration of the anomaly is appended; when the collaborative anomaly score falls below the dynamic threshold and remains stable for more than a preset recovery window length, the anomaly status is automatically removed.

[0099] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0100] Embodiments of this application also provide a server anomaly detection device, which can be implemented in software and / or hardware and can be integrated into an electronic device.

[0101] Figure 6 This is a schematic diagram of the structure of a server anomaly detection device provided in an embodiment of this application, as shown below. Figure 6 As shown, the server anomaly detection device includes: an acquisition module 610, a processing module 620, and an analysis module 630.

[0102] The acquisition module 610 is used to acquire the operating parameters of multiple servers, including the target server. The processing module 620 is used to perform preset processing on the operating parameters to obtain residual data corresponding to each server. The residual data is used to characterize the unexpected fluctuations of the operating parameters of the corresponding server. Based on the residual data, the initial anomaly score of each server is obtained. Based on the topological relationship between the servers, the initial anomaly score of the server is updated to obtain the collaborative anomaly score of the target server. Analysis module 630 is used to determine whether the target server is abnormal based on collaborative anomaly scoring.

[0103] Optionally, the processing module 620 is also used for: Based on the operating parameters, a first component is obtained to characterize the long-term trend of the server's operating state, and a second component is obtained to characterize the periodic pattern of the server's operating state. The first and second components are removed from the running parameters to obtain the residual data.

[0104] Optionally, the processing module 620 is also used for: For each operating parameter in the time series of operating parameters, remove the first and second components corresponding to the acquisition time to obtain the residual data at the corresponding acquisition time. Traverse the time series of the running parameters to obtain the residual time series composed of residual data, where the type of the residual time series corresponds one-to-one with the type of the running parameters.

[0105] Optionally, the processing module 620 is also used for: For each type of residual time series, based on multiple preset time windows, a corresponding number of residual data are selected in the residual time series with the same time point as the reference. The length of each time window is different. For each time window, based on the selected residual data, the evaluation results of multiple dimensions corresponding to that time window are obtained; Iterate through all time windows to obtain the evaluation results of multiple dimensions corresponding to each time window; Based on the preset first weight distribution and the evaluation results of multiple dimensions corresponding to each time window, a comprehensive evaluation result of this type of residual time series is obtained; Traverse all types of residual time series to obtain the comprehensive evaluation results corresponding to each type of residual time series; Based on the preset second weight distribution and all comprehensive evaluation results, the initial anomaly score of the server is obtained.

[0106] Optionally, the processing module 620 is also used for: For the selected residual data, calculate the mean, standard deviation, and maximum absolute deviation of the selected residual data. The mean is used to characterize the average deviation of the selected residual data, the standard deviation is used to characterize the volatility of the selected residual data, and the maximum absolute deviation is used to characterize the peak outlier values ​​in the selected residual data.

[0107] Optionally, the processing module 620 is also used for: Based on the topological relationships between servers, determine the number of upstream neighbor servers corresponding to each server; Based on the initial anomaly score of the server and the number of upstream neighbor servers corresponding to each server, the initial anomaly score of each server is iteratively updated. When the number of iterations reaches a preset value, the result obtained by the target server in the last iteration is used as the collaborative anomaly score of the target server.

[0108] Optionally, the processing module 620 is also used for: For each server, determine the first neighbor and the second neighbor among the upstream neighbor servers of that server. The first neighbor is the server that has a direct calling relationship with the server, and the second neighbor is the server that has a direct calling relationship with the first neighbor. The initial anomaly score of the server is iteratively updated based on the number of first neighbors and the initial anomaly score, as well as the number of second neighbors and the initial anomaly score.

[0109] Optionally, the analysis module 630 is also used for: The scoring threshold is obtained based on the collaborative anomaly scores obtained by the target server at historical moments; Determine the relationship between the collaborative anomaly score obtained by the target server at the current moment and the score threshold; Based on the judgment result of the size relationship, determine whether the target server is abnormal.

[0110] Optionally, the analysis module 630 is also used for: Based on the previous time relative to the current time, select the collaborative anomaly scores of the target server at N consecutive historical time points, where N is an integer greater than 1; Sort the N collaborative anomaly scores in order of numerical value; In the ranking results, the collaborative anomaly score corresponding to the Pth quantile position is selected as the scoring threshold.

[0111] In one implementation, combined Figure 7 The schematic diagram of the server anomaly detection system shown indicates that the acquisition module 610 includes at least a data acquisition unit, which is used to collect time-series data of multi-dimensional operational indicators of the server cluster. The processing module 620 includes at least a seasonal trend decoupling unit, a multi-scale feature extraction unit, an attention fusion scoring unit, and a graph collaborative anomaly detection unit, wherein: The seasonal trend decoupling unit is used to perform online seasonal-trend decoupling processing on each dimension of the multidimensional operational indicator time series data to obtain the residual sequence. The multi-scale feature extraction unit is used to extract statistical features based on the residual sequence under multiple preset time windows to form multi-scale residual features. The attention fusion scoring unit is used to perform attention-weighted fusion of multi-scale residual features to generate single-server anomaly scores. The graph collaborative anomaly detection unit is used to construct a dynamic directed graph based on the call dependencies between servers, and input the single-server anomaly score as the initial feature of the graph node into the spatiotemporal graph neural network to generate a collaborative anomaly score through spatiotemporal aggregation.

[0112] Optionally, the analysis module includes at least a dynamic alarm determination unit, wherein: The dynamic alarm determination unit is used to compare the collaborative anomaly score with a dynamic threshold. When the score exceeds the dynamic threshold, it determines that the corresponding server has abnormal behavior and triggers an alarm.

[0113] For a description of the features in the embodiment corresponding to the server anomaly detection device, please refer to the relevant description in the embodiment corresponding to the server anomaly detection method, which will not be repeated here.

[0114] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the server anomaly detection method.

[0115] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described server anomaly detection method embodiments when running.

[0116] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0117] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described server anomaly judgment method embodiments.

[0118] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described server anomaly judgment method embodiments.

[0119] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), application-specific standard parts (ASSP), a system-on-chip (SoC), a complex programmable logic device (CPLD), a microcontroller unit (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0120] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0121] The foregoing has provided a detailed description of the server anomaly detection method, electronic device, storage medium, and program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for determining server anomalies, characterized in that, include: Obtain the operating parameters of multiple servers, including the target server; The operating parameters are pre-processed to obtain residual data corresponding to each server, wherein the residual data is used to characterize the unexpected fluctuations of the operating parameters of the corresponding server; Based on the residual data, an initial anomaly score is obtained for each of the servers; Based on the topological relationship between the servers, the initial anomaly score of the servers is updated to obtain the collaborative anomaly score of the target server. Based on the collaborative anomaly score, it is determined whether the target server is abnormal.

2. The server anomaly detection method according to claim 1, characterized in that, The step of pre-processing the operating parameters to obtain the residual data corresponding to each server includes: Based on the operating parameters, a first component is obtained to characterize the long-term trend of the server's operating state, and a second component is obtained to characterize the periodic pattern of the server's operating state. The residual data is obtained by removing the first component and the second component from the operating parameters.

3. The server anomaly detection method according to claim 2, characterized in that, The operating parameters of the same type constitute an operating parameter time series in the order of acquisition time. The step of removing the first component and the second component from the operating parameters to obtain the residual data includes: For each of the operating parameters in the time series of operating parameters, the first component and the second component corresponding to the acquisition time are removed from the operating parameter to obtain the residual data at the corresponding acquisition time; By traversing the time series of the operating parameters, a residual time series composed of the residual data is obtained, wherein the type of the residual time series corresponds one-to-one with the type of the operating parameters.

4. The server anomaly detection method according to claim 3, characterized in that, The initial anomaly score for each server, based on the residual data, includes: For each type of residual time series, based on multiple preset time windows, a corresponding number of residual data are selected in the residual time series with the same time point as the reference, wherein the length of each time window is different; For each time window, based on the selected residual data, the evaluation results of multiple dimensions corresponding to that time window are obtained; Traverse all the time windows to obtain the multi-dimensional evaluation results corresponding to each time window; Based on the preset first weight distribution and the evaluation results of multiple dimensions corresponding to each time window, a comprehensive evaluation result of the residual time series of this type is obtained; By traversing all types of residual time series, the comprehensive evaluation results corresponding to each type of residual time series are obtained; Based on the preset second weight distribution and all the comprehensive evaluation results, the initial anomaly score of the server is obtained.

5. The server anomaly detection method according to claim 4, characterized in that, For each time window, based on the selected residual data, the evaluation results for that time window across multiple dimensions are obtained, including: For the selected residual data, the mean, standard deviation, and maximum absolute deviation of the selected residual data are calculated. The mean is used to characterize the average deviation of the selected residual data, the standard deviation is used to characterize the volatility of the selected residual data, and the maximum absolute deviation is used to characterize the peak outlier values ​​in the selected residual data.

6. The server anomaly detection method according to claim 1, characterized in that, The process of updating the initial anomaly score of the server based on the topological relationship between the servers to obtain the collaborative anomaly score of the target server includes: Based on the topological relationships between the servers, determine the number of upstream neighbor servers corresponding to each server; Based on the initial anomaly score of the server and the number of upstream neighbor servers corresponding to each server, the initial anomaly score of each server is iteratively updated. When the number of iterations reaches a preset value, the result obtained by the target server in the last iteration is used as the collaborative anomaly score of the target server.

7. The server anomaly detection method according to claim 6, characterized in that, The iterative update of the initial anomaly score of each server based on the initial anomaly score of the server and the number of upstream neighbor servers corresponding to each server includes: For each of the servers, a first neighbor and a second neighbor are determined from the upstream neighbor servers of that server, wherein the first neighbor is a server that has a direct calling relationship with the server, and the second neighbor is a server that has a direct calling relationship with the first neighbor. The initial anomaly score of the server is iteratively updated based on the number of the first neighbors and the initial anomaly score, as well as the number of the second neighbors and the initial anomaly score.

8. The server anomaly detection method according to claim 1, characterized in that, The step of determining whether the target server is abnormal based on the collaborative anomaly score includes: A scoring threshold is obtained based on the collaborative anomaly scores obtained by the target server at historical moments; Determine the relationship between the collaborative anomaly score obtained by the target server at the current moment and the score threshold; Based on the judgment result of the size relationship, it is determined whether the target server is abnormal.

9. The server anomaly detection method according to claim 8, characterized in that, The scoring threshold obtained based on the collaborative anomaly score of the target server at historical time includes: Based on the previous time relative to the current time, select the collaborative anomaly scores of the target server at N consecutive historical time points, where N is an integer greater than 1; Sort the N collaborative anomaly scores in order of numerical value; In the sorting results, the collaborative anomaly score corresponding to the Pth quantile position is selected as the score threshold.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the server anomaly detection method as described in any one of claims 1 to 9 when executing the computer program.

Images