Real-time data stream anomaly detection method and system for IT equipment running state

Abstract

The application discloses an IT equipment operation state-oriented real-time data stream anomaly detection method and system, relates to the technical field of data anomaly detection, and comprises the following steps: collecting real-time data streams of a plurality of IT equipment, and obtaining compressed real-time feature vectors; sequentially splicing to obtain a global cascading state matrix, and using a prior prediction model to forward inference to obtain a future state evolution hidden variable; when a spatial Euclidean distance is lower than a safety discrimination threshold, it is determined that the current is in an asynchronous sub-health conduction state; the source IT equipment leading to the asynchronous sub-health conduction is traced back reversely; and a sub-health physical link is located as an anomaly detection result. The application solves the technical problems that in the prior art, an asynchronous health conduction state in a multi-level heterogeneous IT topology is difficult to be perceived in real time, a cross-level causal chain cannot be effectively traced back, and a long-period hidden deterioration is not sensitive, and the technical effects that the detection sensitivity of the sub-health conduction state, the accuracy of abnormal source positioning and the analysis timeliness are improved are achieved.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection technology, specifically to a method and system for real-time data stream anomaly detection for the operating status of IT equipment. Background Technology

[0002] In complex enterprise-level IT infrastructures, business systems generally adopt a multi-layered redundant hardware topology architecture, which typically includes vertically cascaded multi-level network processing nodes, such as core switches, aggregation layer devices, and access layer servers. Redundant hardware nodes are deployed at the same level to serve as hot or cold backups for each other to ensure high availability and business continuity. However, with the continuous expansion of system scale and the widespread use of heterogeneous devices such as encryption machines, storage arrays, x86 servers, and dedicated network equipment, operation and maintenance face new challenges. Traditional fault detection relies on "hard fault" monitoring, such as detecting device downtime through heartbeat detection and capturing port down events through SNMP traps. However, it is almost impossible to effectively detect gradual, long-term performance degradation and asynchronous health propagation phenomena. In actual production environments, gradual asynchronous health propagation is difficult to diagnose. For example, due to an occasional firmware defect, when processing a certain type of message, the response latency of a device slowly drifts from the normal level of 2 milliseconds to 20 milliseconds, and this drift process may last for several hours. Although this latency degradation does not trigger the alarm threshold of a single device, it causes the buffer queue depth of its upstream Local switch to continue to increase, which in turn causes the I / O wait time of the backend application server to be asynchronously extended, causing data packets to time out and fail when writing to FC-SAN storage.

[0003] Therefore, current technologies suffer from several technical problems: the progressive asynchronous health transmission status in multi-level heterogeneous IT topologies is difficult to perceive in real time; cross-level causal chains cannot be effectively traced; and they are insensitive to long-term latent degradation. Summary of the Invention

[0004] This application provides a real-time data stream anomaly detection method and system for the operating status of IT equipment. It solves the technical problems in the prior art, such as the difficulty in real-time perception of the progressive asynchronous health transmission status in multi-level heterogeneous IT topologies, the inability to effectively trace cross-level causal chains, and the insensitivity to long-term hidden degradation. It achieves the technical effect of improving the detection sensitivity of sub-health transmission status, the accuracy of anomaly source location, and the timeliness of analysis.

[0005] This application provides a method for real-time data stream anomaly detection for IT equipment operating status. The method includes: collecting real-time data streams from multiple IT devices in a multi-level cascaded topology using a hierarchical circular queue architecture, performing edge processing and compression on the corresponding data streams to obtain multiple compressed real-time feature vectors; concatenating the multiple compressed real-time feature vectors according to the order of the multi-level cascaded topology to obtain a global cascaded state matrix, and using a priori prediction model to perform forward reasoning on the global cascaded state matrix to obtain future state evolution latent variables; determining that the multi-level cascaded topology is currently in an asynchronous sub-healthy transmission state when the spatial Euclidean distance between the future state evolution latent variables and a preset anomaly evolution matrix space is lower than a safety discrimination threshold; tracing back the source IT device causing the asynchronous sub-healthy transmission according to the chronological order of the physical timestamps contained in the multiple compressed real-time feature vectors; locating the sub-healthy physical links in the multi-level cascaded topology affected by the source IT device based on the source IT device, and using the source IT device and the sub-healthy physical links as anomaly detection results.

[0006] In possible implementations, the multi-level cascaded topology includes servers, aggregation switches, encryption machine master-slave pairs, and FC-SAN storage systems.

[0007] In possible implementations, when the IT device is the server, the I / O wait rate time-series data stream of the kernel scheduler is collected as the real-time data stream; when the IT device is the encryption machine master-slave pair, the single-processing delay time-series data stream of encrypted messages and the chip operating temperature time-series data stream are read as the real-time data stream; when the IT device is the aggregation switch, the port buffer queue backlog number time-series data stream is collected as the real-time data stream; when the IT device is the FC-SAN storage system, the Fibre Channel frame cell error count time-series data stream is read as the real-time data stream.

[0008] In a possible implementation, multiple compressed real-time feature vectors are obtained by collecting real-time data streams from multiple IT devices in a multi-level cascaded topology using a hierarchical circular queue architecture and performing edge processing compression on the corresponding data streams. This includes: dividing the hierarchical circular queue architecture into a high-frequency sliding window layer and a low-frequency attenuation layer; wherein the high-frequency sliding window layer retains uncompressed original hard indicator time-series data points within a preset first sliding window period at a first sampling rate; when the timestamp of the original hard indicator time-series data points exceeds the preset first sliding window period, the original hard indicator time-series data points are moved into the low-frequency attenuation layer; the trend slope of the original hard indicator time-series data points is calculated using a first-order difference operator, and the window mean and window variance are calculated using the first and second-order moment operators of the sliding window; the original hard indicator time-series data points are removed from the low-frequency attenuation layer, and the trend slope, the window mean, and the window variance are combined and encapsulated to generate multiple compressed real-time feature vectors.

[0009] One possible implementation involves using a prior prediction model to perform forward reasoning on the global cascaded state matrix to obtain latent variables for future state evolution. This includes: injecting a positional encoding with a one-dimensional temporal self-attention mechanism into the global cascaded state matrix; inputting the positionally encoded global cascaded state matrix into a multi-level time series feature extraction network in the prior prediction model to extract the dynamic evolution relationship of the multi-level cascaded topology in the time dimension; and using a prior prediction encoder included in the prior prediction model to perform probability space mapping on the dynamic evolution relationship and output the corresponding latent variables for future state evolution.

[0010] In a possible implementation, the prior predictive encoder included in the prior predictive model is used to perform probability space mapping on the dynamic evolution relationship and output the corresponding future state evolution latent variables. This includes: collecting long-term historical state flow data before hardware-level interruption events occur in the history of the multi-level cascaded topology as training samples; during the offline training phase, the posterior encoder is used to explicitly read the future determined control state sequence of the hardware-level interruption event, distill it, and quantize it into future fault latent variables; using a joint loss function, the prior predictive model is constrained to make the future state evolution latent variables predicted by the prior predictive encoder approach the future fault latent variables after inputting the compressed long-term historical state flow data, until training is completed, thus obtaining the prior predictive encoder.

[0011] In a possible implementation, the joint loss function includes a cross-entropy loss term, a Kolb-Leibler divergence loss term, and a commitment loss term; the cross-entropy loss term is used to constrain the accuracy of future system event sequence prediction; the Kolb-Leibler divergence loss term is used to constrain the consistency between the probability distribution of the posterior encoder output and the probability distribution of the prior predictive encoder output; and the commitment loss term is used to stabilize the encoding of this discrete quantization process.

[0012] In a possible implementation, the source IT device causing the asynchronous sub-health transmission is traced back in reverse order based on the physical timestamps contained in multiple compressed real-time feature vectors. This includes: calculating the attention weight score of the feature channel corresponding to each IT device in the global cascaded state matrix during the forward inference process of the prior prediction model; selecting a set of specific IT devices whose attention weight scores exceed a preset explicit contribution threshold; extracting the physical timestamps attached to the feature vectors encapsulated in the hierarchical circular queue architecture of the specific IT device set; sorting the physical timestamps in ascending order, and determining the specific IT device with the earliest time coordinate as the source IT device causing the sub-health transmission within the multi-layer cascaded topology.

[0013] In one possible implementation, specific ports in a multi-level cascaded topology that have a cascaded service bearing relationship with the source IT device are retrieved to obtain the sub-healthy physical link.

[0014] This application also provides a real-time data stream anomaly detection system for IT equipment operating status. The system includes: a data acquisition and processing module, used to acquire real-time data streams from multiple IT devices in a multi-level cascaded topology using a hierarchical circular queue architecture, performing edge processing and compression on the corresponding data streams to obtain multiple compressed real-time feature vectors; a future state evolution latent variable acquisition module, used to concatenate the multiple compressed real-time feature vectors according to the order of the multi-level cascaded topology to obtain a global cascaded state matrix, and use a prior prediction model to perform forward inference on the global cascaded state matrix to obtain future state evolution latent variables; asynchronous sub-health transmission status... The state determination module is used to determine that the multi-level cascaded topology is currently in an asynchronous sub-healthy transmission state when the spatial Euclidean distance between the latent variables of the future state evolution and the preset abnormal evolution matrix space is lower than the safety discrimination threshold; the device reverse tracing module is used to trace back the source IT device that caused the asynchronous sub-healthy transmission according to the order of the physical timestamps contained in multiple compressed real-time feature vectors; the anomaly detection result acquisition module is used to locate the sub-healthy physical links in the multi-level cascaded topology affected by the source IT device according to the source IT device, and take the source IT device and the sub-healthy physical links as anomaly detection results.

[0015] This application proposes a real-time data stream anomaly detection method and system for IT equipment operating status. The method collects real-time data streams from multiple IT devices to obtain compressed real-time feature vectors. These vectors are then sequentially concatenated to obtain a global cascaded state matrix. A priori prediction model is used for forward inference to obtain latent variables for future state evolution. When the spatial Euclidean distance is below a safety threshold, the system determines that the current state is in an asynchronous sub-health transmission state. The source IT device causing the asynchronous sub-health transmission is traced back in reverse. The sub-health physical link is located as the anomaly detection result. This method solves the technical problems in existing technologies, such as the difficulty in real-time perception of progressive asynchronous health transmission states in multi-level heterogeneous IT topologies, the inability to effectively trace cross-level causal chains, and the insensitivity to long-term latent degradation. It achieves the technical effects of improving the detection sensitivity of sub-health transmission states, the accuracy of anomaly source location, and the timeliness of analysis. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Flowcharts are used in this application to illustrate the operations performed by the system according to the embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0017] Figure 1 This is a schematic flowchart of a real-time data stream anomaly detection method for the operating status of IT equipment provided in an embodiment of this application.

[0018] Figure 2 This is a schematic diagram of the structure of a real-time data stream anomaly detection system for the operating status of IT equipment provided in an embodiment of this application.

[0019] Figure labeling: Data acquisition and processing module 10, future state evolution latent variable acquisition module 20, asynchronous sub-health transmission state determination module 30, equipment reverse tracing module 40, anomaly detection result acquisition module 50. Detailed Implementation

[0020] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on the specific implementation methods, structures, features and effects of the present invention.

[0021] This application provides a method for real-time data stream anomaly detection based on the operating status of IT equipment, such as... Figure 1 As shown, the method includes: Step S100: After collecting the real-time data streams from multiple IT devices in a multi-level cascaded topology through a hierarchical circular queue architecture, multiple compressed real-time feature vectors are obtained.

[0022] Preferably, the hierarchical circular queue architecture is an in-memory data structure deployed locally on each IT device or on the device's near-end edge gateway. It includes a high-frequency sliding window layer and a low-frequency attenuation layer. The high-frequency sliding window layer is a fixed-length circular buffer, for example, with a capacity of 600 data points. Newly collected raw data points are continuously written to the end of this layer. When the buffer is full, the earliest written data point is overwritten and discarded, always retaining the raw numerical sequence within the most recent time window (e.g., the most recent 10 minutes) without any statistical processing. The low-frequency attenuation layer refers to the data point that is squeezed out of the high-frequency sliding window layer, i.e., its timestamp exceeds the preset sliding window period, such as more than 10 minutes ago. The low-frequency attenuation layer no longer stores the raw numerical sequence, but uses the data point as input to perform compression calculations.

[0023] Furthermore, step S100 also includes the following: the multi-level cascaded topology includes a server, a convergence switch, a primary / backup encryption machine pair, and an FC-SAN storage system.

[0024] Step S100 further includes: when the IT device is the server, collecting the I / O wait rate timing data stream of the kernel scheduler as a real-time data stream; when the IT device is the encryption machine master-slave pair, reading the single-processing delay timing data stream of the encrypted message and the chip operating temperature timing data stream as real-time data streams; when the IT device is the aggregation switch, collecting the port buffer queue backlog timing data stream as a real-time data stream; when the IT device is the FC-SAN storage system, reading the Fibre Channel frame cell error count timing data stream as a real-time data stream.

[0025] Preferably, in a multi-level cascaded topology, multiple IT devices refer to each independent hardware node, including servers, aggregation switches, encryption machine master-slave pairs, and FC-SAN storage systems. For different device types, their unique, continuously generated raw numerical sequences of time-series performance indicators are collected to determine the corresponding real-time data streams. Specifically, for servers, the kernel scheduler's I / O wait rate time-series data stream is continuously collected at fixed sampling intervals (e.g., one value per second) as the real-time data stream. For encryption machine master-slave pairs, the single-processing delay time-series data stream of encrypted messages and the chip operating temperature time-series data stream are read, including the time difference between receiving and returning each encrypted message and the chip temperature sensor reading, to determine the real-time data stream. For aggregation switches, the port buffer queue backlog time-series data stream, i.e., the number of data packets currently queued for forwarding, is collected to determine the real-time data stream. For FC-SAN storage systems, the Fibre Channel frame cell error count time-series data stream, i.e., the cumulative count of frame cell errors detected by the Fibre Channel link layer, is read to determine the real-time data stream. Each data stream is a one-dimensional time series, containing a sampling timestamp and the corresponding measurement value.

[0026] Furthermore, step S100 also includes dividing the hierarchical circular queue architecture into a high-frequency sliding window layer and a low-frequency attenuation layer. The high-frequency sliding window layer retains uncompressed original hard indicator time-series data points within a preset first sliding window period at a first sampling rate. When the timestamp of the original hard indicator time-series data points exceeds the preset first sliding window period, the original hard indicator time-series data points are moved into the low-frequency attenuation layer. A first-order difference operator is called to calculate the trend slope of the original hard indicator time-series data points, and the window mean and window variance are calculated using the first and second moment operators of the sliding window. The original hard indicator time-series data points are removed from the low-frequency attenuation layer, and the trend slope, window mean, and window variance are combined and encapsulated to generate multiple compressed real-time feature vectors.

[0027] Preferably, the hierarchical circular queue architecture is divided into a high-frequency sliding window layer and a low-frequency attenuation layer. Specifically, the high-frequency sliding window layer continuously receives raw measurement readings from the device hardware or operating system interface according to the first sampling rate pre-configured by the device. The memory capacity of this layer is set to just accommodate all data points within the preset first sliding window period. The first sampling rate is a fixed acquisition interval, such as once every 1 second. For example, if the first sliding window period is set to 10 minutes and the sampling rate is 1 second / time, the capacity is 600 data points. When a new data point is written, if the buffer is not yet full, it is directly appended; if it is full, the data point with the earliest timestamp is overwritten. This layer always retains only the original numerical points whose timestamps fall within the fixed time window, without performing any compression or statistical transformation, thereby determining the original hard index time series data points, such as the I / O wait rate measured in a certain second being 3.2%.

[0028] Preferably, when a new data point is written, the high-frequency sliding window layer checks the timestamps of all data points in the current layer. If the difference between the timestamp of a data point and the current system time is greater than the preset first sliding window period, for example, if the timestamp of the data point is 10 minutes and 01 seconds ago and the sliding window period is 10 minutes, then the data point loses its eligibility to continue to be retained in the high-frequency sliding window layer. At this time, the data point is read from the buffer of the high-frequency sliding window layer and sent to the waiting queue of the low-frequency attenuation layer through a memory pointer or data copy. That is, the storage location of the original data point in the high-frequency sliding window layer is released for use by new data to overwrite. Once the original data point is moved into the low-frequency attenuation layer, mathematical operations are immediately performed on that data point and all the remaining data points in the high-frequency sliding window layer. Specifically, the first-order difference operator is called to take the value of the removed data point and the value at the previous sampling time, calculate the difference between the two, and divide it by the sampling time interval to determine the trend slope of the original hard index time series data point, representing the rate and direction of change of the index at that time. A positive value indicates an increase, and a negative value indicates a decrease. Then, all the data points that have not been removed in the high-frequency sliding window layer are taken, and their values ​​are added together and divided by the total number of data points to obtain the window mean, which represents the overall average level of the index in the current sliding window period. Then, based on the window mean, the square of the difference between the value of each data point in the high-frequency sliding window layer and the mean is calculated, and these squared values ​​are added together and divided by the total number of data points to obtain the window variance, which represents the degree of dispersion of the index around the average level in the current sliding window period.

[0029] Preferably, after calculating the trend slope, window mean, and window variance, the original data point no longer has any retention value. In this case, the memory record of the data point is permanently deleted from the waiting queue of the low-frequency attenuation layer to free up storage space. Then, the trend slope, window mean, and window variance are arranged in a fixed order and combined and encapsulated into a compressed real-time feature vector. At the same time, the physical timestamp attached to the original data point is added to the vector as metadata. Each time an original data point is processed from the high-frequency sliding window layer, a corresponding three-dimensional compressed feature vector is generated. As the system continues to run, original data points are continuously removed, and new three-dimensional feature vectors are continuously generated, forming a sequence of compressed feature vectors on the real-time data stream of the device, and finally obtaining multiple compressed real-time feature vectors.

[0030] Step S200: The multiple compressed real-time feature vectors are concatenated according to the order of the multi-level cascaded topology to obtain a global cascaded state matrix, and the global cascaded state matrix is ​​forward-inferred using a prior prediction model to obtain the latent variables of future state evolution.

[0031] Preferably, the timestamps are aligned before the splicing operation, and only feature vectors generated by all devices within the same physical time window are selected for splicing to ensure that the vectors are consistent in time. Specifically, the order of the multi-level cascaded topology refers to the actual physical path order of data packets transmitted between the vertically cascaded devices, i.e., server → aggregation switch → encryption machine master-slave pair → FC-SAN storage system. Then, the feature vectors from different devices are arranged in order in the horizontal direction to form a two-dimensional numerical matrix. Each row of the matrix represents the complete feature vector of a device within the time window, and each column of the matrix represents the value of all devices in the same feature dimension. For example, the first column is the trend slope of all IT devices. Then, the three-dimensional row vectors of multiple IT devices are stacked in order to form a global cascaded state matrix. The number of rows is equal to the number of IT devices that have been deployed and are reporting data, and the number of columns is fixed to the dimension of the compressed feature vector, 3. The row arrangement order of the matrix directly maps the transmission path of the data flow from top to bottom in the physical topology, so that the changes in the row direction of the matrix reflect the abnormal cascade propagation direction.

[0032] Furthermore, step S200 also includes injecting the global cascaded state matrix with a positional encoding mechanism with a one-dimensional temporal self-attention mechanism; inputting the global cascaded state matrix after injection of positional encoding into the multi-level time series feature extraction network in the prior prediction model to extract the dynamic evolution relationship of the multi-level cascaded topology in the time dimension; and using the prior prediction encoder contained in the prior prediction model to perform probability space mapping on the dynamic evolution relationship and output the corresponding future state evolution latent variables.

[0033] Preferably, a position encoding vector related to the time sequence is superimposed on the global cascaded state matrix. Specifically, a position encoding vector is generated for each time step. The dimension of this vector is consistent with the dimension of the global cascaded state matrix, and the specific value is calculated by sine / cosine functions at different frequencies, so that the position encoding of different time steps has a distinguishable and unique pattern. The position encoding vector is added element-wise to the value of the global cascaded state matrix to obtain a new matrix, which contains the spatial topology state information between devices and the relative position information of the state in the entire time sequence. The one-dimensional temporal self-attention mechanism refers to calculating the pairwise correlation between different time steps through the self-attention mechanism. Position encoding enables the correlation calculation to utilize the time sequence information. The globally cascaded state matrix after injection location encoding is input into a multi-level time series feature extraction network in the prior prediction model. This network performs comprehensive analysis of the state matrices across multiple consecutive time steps in the time dimension, extracting the patterns of change in each device's metrics over time and the temporal causal relationships between devices. The multi-level time series feature extraction network consists of multiple stacked time series processing units, such as Transformer encoder layers or LSTM stacked layers. Each layer performs the following operations: within each time step, it calculates the spatial dependencies between different device feature channels at the same moment using a self-attention mechanism, such as whether switch queue backlog is related to server I / O wait rate; in the time dimension, it calculates the continuation and change trends of the same device feature channel across different time steps using cross-step attention or cyclic connections, such as whether the trend slope of a certain device has been continuously positive and increasing in value over the past three time steps; and finally, it outputs the dynamic evolution relationship of the multi-level cascaded topology in the time dimension, such as the joint change patterns across devices and time, the rising / falling phase differences of each metric, and the characteristics of abnormal delay propagation paths.

[0034] Preferably, the dynamic evolution relationship representation is input into the prior predictive encoder included in the prior predictive model. This encoder maps the high-dimensional deterministic evolutionary features into low-dimensional latent variables in the probability distribution space, representing the model's prediction of the possible state evolution trend of the system within a certain number of future time steps. Specifically, the prior predictive encoder is a probabilistic coding network that reduces and compresses the input dynamic evolution relationship representation through multiple fully connected layers, outputting the mean and variance parameters of the Gaussian distribution to determine the probability distribution parameters. Then, specific latent variable vectors are sampled from the Gaussian distribution or the mean vector is directly taken as the deterministic output, ultimately obtaining the latent variables of future state evolution, which are used to abstractly represent the trend of the system state over a period of time, such as the exponential growth trend of queue backlog or the simultaneous amplification of variance of multiple devices.

[0035] Furthermore, step S200 also includes collecting long-term historical state flow data prior to the occurrence of hardware-level interruption events in the history of the multi-level cascaded topology as training samples; during the offline training phase, using a posterior encoder to explicitly read the future determined control state sequence of the hardware-level interruption event, distilling and quantizing it into future fault latent variables; using a joint loss function, constraining the prior prediction model to, after inputting the compressed long-term historical state flow data, make the future state evolution latent variables predicted by the prior prediction encoder approach the future fault latent variables, until training is completed, and obtaining the prior prediction encoder.

[0036] Preferably, all recorded hardware-level interruption events, such as server crashes, switch restarts, storage link disconnections, and encryption chip resets, are selected from the historical operation and maintenance database. A long period of continuous monitoring data prior to each interruption event is extracted as positive samples for model training. The long period refers to the time span of each extraction being several hours to tens of hours (e.g., 24 hours before the event), which is much longer than the short window analysis of conventional monitoring systems. Historical state stream data refers to the original real-time data stream records continuously reported by each device within the long period, including server I / O wait rate sequences, encryption machine processing latency sequences, switch queue backlog sequences, storage error count sequences, etc. All data are arranged in order of collection timestamp. Each training sample contains long-period state stream data and an additional label, indicating that the sample actually triggered a hardware-level interruption event and is a positive sample. Negative samples are extracted from the normal operation period in history where no interruption occurred, using data streams of the same long period.

[0037] Preferably, the posterior encoder is an independent encoder network with a structure similar to the prior predictive encoder. Its input is a continuous state sequence before and after the occurrence of the interruption event, such as 10 minutes before the event to 1 minute after the event, which includes the complete evolution process from the onset of sub-health to complete hardware failure. Then, in the offline training phase, the posterior encoder is used to explicitly read the future deterministic control state sequence of the hardware-level interruption event. Specifically, the posterior encoder directly obtains all data points of the future sequence, and then compresses the future state sequence through a multi-layer neural network to output a fixed-dimensional vector, such as a 32-dimensional floating-point number, to encode the complete evolution trajectory information from health to failure and determine the latent variables of future failure.

[0038] Preferably, long-term historical state flow data is input into the prior prediction model, which outputs predicted future state evolution latent variables. Simultaneously, the future determined control state sequence corresponding to the same sample is input into the posterior encoder, which outputs future fault latent variables. The difference between the two is calculated using a joint loss function, and the network parameters of the prior prediction encoder are iteratively adjusted with the goal of minimizing this difference. After training, the prior prediction encoder predicts future evolution latent variables close to the level of the posterior encoder based solely on historical data during the inference phase. Specifically, each training sample includes long-term historical state flow data before the occurrence of an interruption event, the complete control state sequence before and after the same interruption event, and the predicted interruption event latent variables corresponding to that sample. The event occurs, and then the long-term historical state stream data before the interruption event is fed into the prior prediction model for forward computation. After global state matrix construction and temporal feature extraction, the prior latent variables and posterior latent variables are output. Then, the cross-entropy loss, KL divergence loss and commitment loss are calculated simultaneously. The three losses are then weighted and summed to obtain the joint loss value. The weight parameters of the prior prediction encoder are updated through backpropagation using the gradient descent algorithm. This process is repeated for multiple rounds until the joint loss value converges to the preset stopping condition. Finally, the posterior encoder is stripped away, while the network structure of the prior prediction encoder and the trained weight parameters are retained. This allows the output of prediction results that are highly consistent with the latent variables output by the posterior encoder in terms of distribution.

[0039] Furthermore, step S200 also includes the following: the joint loss function includes a cross-entropy loss term, a Kolb-Leibler divergence loss term, and a commitment loss term; the cross-entropy loss term is used to constrain the accuracy of future system event sequence prediction; the Kolb-Leibler divergence loss term is used to constrain the consistency between the probability distribution of the posterior encoder output and the probability distribution of the prior predictive encoder output; and the commitment loss term is used to stabilize the encoding of this discrete quantization process.

[0040] Preferably, the joint loss function includes a cross-entropy loss term, a Kolb-Leibler divergence loss term, and a commitment loss term. Specifically, the prior latent variables are mapped to predicted probabilities of whether an interruption event has occurred via a classification head, and cross-entropy is calculated with the true labels to ensure the accuracy of the prediction at the event discrimination level. The prior and posterior latent variables are treated as sampling points of two Gaussian distributions, and the KL divergence between the two probability distributions is calculated to constrain the distribution of the prior encoder output to be as consistent as possible with the distribution of the posterior encoder output. If the prior encoder uses a vector quantization mechanism, the difference between the embedding vector in the encoding sample and the encoder output is calculated to ensure the stability of the quantization process.

[0041] Step S300: When the spatial Euclidean distance between the latent variables of the future state evolution and the preset abnormal evolution matrix space is lower than the safety discrimination threshold, it is determined that the multi-level cascaded topology is currently in an asynchronous sub-healthy transmission state.

[0042] Preferably, during the offline phase, confirmed asynchronous sub-health transmission events from history are collected, i.e., all events manually labeled as progressive asynchronous health transmission that ultimately trigger hardware interruption. Samples of latent variables representing the future state evolution of each event during the transmission process are extracted, and the covariance matrix is ​​calculated for the latent variables of all similar events. A multidimensional Gaussian distribution is defined in the latent variable space, and the latent variable space covered by this distribution / region constitutes the preset abnormal evolution matrix space, representing the common distribution range of all known sub-health transmission patterns in the latent space. The latent variables representing the future state evolution are compared with the preset abnormal evolution matrix space, and the shortest Euclidean distance between the vector point and the entire spatial region is calculated. For example, the Mahalanobis distance between the current latent variable vector and the distribution center vector is calculated by first subtracting the current vector from the center vector, then scaling it using the inverse of the covariance matrix, and calculating the L2 norm of the scaled vector. This distance considers the dispersion of the abnormal space in each dimension; a smaller value indicates that the current evolution trend is closer to the historical abnormal pattern, while a larger value indicates that it deviates further from the known abnormal pattern.

[0043] Preferably, during the offline verification phase, the Euclidean distance between the historical normal operation samples and the abnormal operation samples and the abnormal matrix space is calculated, and a distance distribution histogram is plotted. A distance value that balances the false alarm rate of normal samples and the false negative rate of abnormal samples is selected as the safety discrimination threshold, for example, a distance value of 2.5, which is used to define the decision boundary between "normal" and "sub-health transmission". Then, the Euclidean distance value calculated in real time is compared with the preset safety discrimination threshold. If the spatial Euclidean distance is lower than the safety discrimination threshold, it means that the current state is closer to the historical abnormal evolution mode, and the judgment result of the asynchronous sub-health transmission state is output. If the spatial Euclidean distance is equal to or higher than the safety discrimination threshold, the current state is judged as normal.

[0044] Step S400: Based on the chronological order of the physical timestamps contained in multiple compressed real-time feature vectors, trace back in reverse the source IT equipment that caused the asynchronous sub-health transmission.

[0045] Step S400 further includes: calculating the attention weight score of the feature channel corresponding to each IT device in the global cascaded state matrix during the forward inference process of the prior prediction model; filtering out a set of specific IT devices whose attention weight scores exceed a preset explicit contribution threshold; extracting the physical timestamp attached to the feature vector encapsulated in the local hierarchical circular queue architecture of the specific IT device set; sorting the physical timestamps in ascending order, and determining the specific IT device with the earliest time coordinate as the source IT device that triggers the transmission of sub-health state within the multi-layer cascaded topology.

[0046] Preferably, when the prior prediction model performs forward inference on the global cascaded state matrix, the internal multi-level time series feature extraction network includes a multi-head self-attention mechanism. This mechanism assigns attention weight values ​​to the feature vector corresponding to each device in the input matrix, reflecting the device's contribution to the latent variables of the future state evolution in the model's final output at the current moment. Specifically, in a certain layer of self-attention calculation, an attention score is calculated for each pair of devices, representing the dependence of one device on the other. After Softmax normalization of all device scores, the attention weight score of each IT device's feature channel during the forward inference process of the prior prediction model is obtained, typically ranging from 0 to 1. A preset explicit contribution threshold, such as 0.15, is determined through historical data statistics. The attention weight score of each device is compared with this preset explicit contribution threshold, and a set of specific IT devices whose attention weight scores exceed the preset explicit contribution threshold is selected.

[0047] Preferably, for each specific IT device in a specific set of IT devices, the physical timestamp that was saved when the compressed feature vector was encapsulated is extracted from the metadata field of the compressed feature vector used by the device in this inference; then all physical timestamp values ​​are arranged from smallest to largest, and the earliest timestamp of the time coordinate represents the earliest time when the corresponding original data point was collected. The device is then identified as the source IT device that causes the transmission of sub-health state within the multi-layer cascaded topology, that is, the device that first shows abnormal change characteristics.

[0048] Step S500: Based on the source IT device, locate the sub-healthy physical links in the multi-level cascaded topology affected by the source IT device, and take the source IT device and the sub-healthy physical links as anomaly detection results.

[0049] Step S500 further includes retrieving specific ports in the multi-level cascaded topology that have a cascaded service bearing relationship with the source IT device to obtain the sub-healthy physical link.

[0050] Preferably, in a pre-stored topology connection database, all physical ports that have direct or indirect business data carrying relationships with the source IT equipment are searched. Specific ports that the data flow depends on for continued downstream transmission after passing through the source equipment are selected. Specifically, cascading refers to the connection relationship where data packets are transmitted step-by-step in a fixed direction in a multi-level topology, flowing from upstream devices to midstream devices and then to downstream devices. Business carrying relationships refer to the actual data path established between two devices through specific physical ports, such as Ethernet ports on switches or Fibre Channel ports on storage. Business data packets are sent from the upper-level device to the lower-level device through this path, such as the port on the aggregation switch connecting to the encryption machine, the inbound port on the encryption machine connecting to the switch and the FC port connecting to the storage, and the controller port on the FC-SAN storage receiving data. Then, starting from the source I... Starting with device T, the system searches the topology table for all port connection records that originate from this device and point to the downstream receiver. If redundant pairs exist at the source device, the system also searches for the synchronization link between the primary and backup devices, as well as the spare connection ports between the backup device and the downstream device. Finally, all specific ports are arranged in the topology cascade order to form sub-health physical links, which are output as part of the anomaly detection results. Each sub-health physical link includes the device identifier, port number, connected object, and sequence number in the link for each port. Finally, the source IT device and the sub-health physical links are used as the anomaly detection results to determine the IT device from which the anomaly started and the propagation path. The source IT device is marked with a red fault indicator, and the sub-health physical links are connected by yellow or orange highlighted lines, with the sub-health propagation range indicated.

[0051] In the above text, refer to Figure 1 This paper describes in detail a real-time data stream anomaly detection method for IT equipment operating status according to an embodiment of the present invention. Next, we will refer to... Figure 2 This invention describes a real-time data stream anomaly detection system for the operational status of IT equipment according to an embodiment of the present invention.

[0052] The real-time data stream anomaly detection system for IT equipment operating status according to embodiments of the present invention addresses the technical problems in existing technologies, such as the difficulty in real-time perception of progressive asynchronous health transmission states in multi-level heterogeneous IT topologies, the inability to effectively trace cross-level causal chains, and insensitivity to long-term latent degradation. It achieves the technical effects of improving the detection sensitivity of sub-health transmission states, the accuracy of anomaly source location, and the timeliness of analysis. Figure 2 As shown, the real-time data stream anomaly detection system for IT equipment operation status includes: a data acquisition and processing module 10, a future state evolution latent variable acquisition module 20, an asynchronous sub-health transmission state determination module 30, an equipment reverse tracing module 40, and an anomaly detection result acquisition module 50.

[0053] The data acquisition and processing module 10 is used to acquire real-time data streams from multiple IT devices in a multi-level cascaded topology through a hierarchical circular queue architecture, perform edge processing and compression on the corresponding real-time data streams, and obtain multiple compressed real-time feature vectors. The future state evolution latent variable acquisition module 20 is used to concatenate the multiple compressed real-time feature vectors according to the order of the multi-level cascaded topology to obtain a global cascaded state matrix, and use a prior prediction model to perform forward inference on the global cascaded state matrix to obtain the future state evolution latent variables. The asynchronous sub-health transmission state determination module 30 is used to determine the future state evolution latent variables when the future state evolution latent variables are obtained. When the spatial Euclidean distance between the variable and the preset abnormal evolution matrix space is lower than the safety discrimination threshold, it is determined that the multi-level cascaded topology is currently in an asynchronous sub-healthy transmission state; the device reverse tracing module 40 is used to reverse trace the source IT device that caused the asynchronous sub-healthy transmission according to the order of the physical timestamps contained in multiple compressed real-time feature vectors; the abnormal detection result acquisition module 50 is used to locate the sub-healthy physical link in the multi-level cascaded topology affected by the source IT device according to the source IT device, and take the source IT device and the sub-healthy physical link as the abnormal detection result.

[0054] The specific configuration of the data acquisition and processing module 10 will be described in detail below. The data acquisition and processing module 10 further includes: the multi-level cascaded topology includes a server, a convergence switch, a primary / backup encryption machine pair, and an FC-SAN storage system.

[0055] The specific configuration of the data acquisition and processing module 10 will be described in detail below. The data acquisition and processing module 10 further includes: when the IT device is the server, acquiring the I / O wait rate time-series data stream of the kernel scheduler as a real-time data stream; when the IT device is the encryption machine master / backup pair, reading the single-processing delay time-series data stream of encrypted messages and the chip operating temperature time-series data stream as real-time data streams; when the IT device is the aggregation switch, acquiring the port buffer queue backlog time-series data stream as a real-time data stream; and when the IT device is the FC-SAN storage system, reading the Fibre Channel frame cell error count time-series data stream as a real-time data stream.

[0056] The specific configuration of the data acquisition and processing module 10 will be described in detail below. The data acquisition and processing module 10 further includes: dividing the hierarchical circular queue architecture into a high-frequency sliding window layer and a low-frequency attenuation layer, wherein the high-frequency sliding window layer retains uncompressed original hard index time-series data points within a preset first sliding window period at a first sampling rate; when the timestamp of the original hard index time-series data points exceeds the preset first sliding window period, the original hard index time-series data points are moved into the low-frequency attenuation layer; the trend slope of the original hard index time-series data points is calculated by calling a first-order difference operator, and the window mean and window variance are calculated by combining the first-order and second-order moment operators of the sliding window; the original hard index time-series data points are removed from the low-frequency attenuation layer, and the trend slope, the window mean, and the window variance are combined and encapsulated to generate multiple compressed real-time feature vectors.

[0057] The specific configuration of the future state evolution latent variable acquisition module 20 will be described in detail below. The future state evolution latent variable acquisition module 20 further includes: injecting the global cascaded state matrix with a positional encoding mechanism with a one-dimensional temporal self-attention mechanism; inputting the globally cascaded state matrix after injection of positional encoding into a multi-level time series feature extraction network in the prior prediction model to extract the dynamic evolution relationship of the multi-level cascaded topology in the time dimension; and using the prior predictive encoder included in the prior prediction model to perform probability space mapping on the dynamic evolution relationship and output the corresponding future state evolution latent variables.

[0058] The following will describe in detail the specific configuration of the future state evolution latent variable acquisition module 20. The future state evolution latent variable acquisition module 20 further includes: collecting long-term historical state flow data prior to hardware-level interruption events in the history of the multi-level cascaded topology as training samples; during the offline training phase, explicitly reading the future determined control state sequence of the hardware-level interruption event using a posterior encoder, distilling and quantizing it into future fault latent variables; using a joint loss function, constraining the prior prediction model, after inputting the compressed long-term historical state flow data, to make the future state evolution latent variables predicted by the prior prediction encoder approach the future fault latent variables, until training is completed, thus obtaining the prior prediction encoder.

[0059] The following will describe in detail the specific configuration of the future state evolution latent variable acquisition module 20. The future state evolution latent variable acquisition module 20 further includes: the joint loss function comprising a cross-entropy loss term, a Koolbek-Leibler divergence loss term, and a commitment loss term; the cross-entropy loss term is used to constrain the accuracy of future system event sequence prediction; the Koolbek-Leibler divergence loss term is used to constrain the consistency between the probability distribution output by the posterior encoder and the probability distribution output by the prior predictive encoder; the commitment loss term is used to stabilize the encoding of this discrete quantization process.

[0060] The specific configuration of the device reverse tracing module 40 will be described in detail below. The device reverse tracing module 40 further includes: calculating the attention weight score of the feature channel corresponding to each IT device in the global cascaded state matrix during the forward inference process of the prior prediction model; filtering out a set of specific IT devices whose attention weight scores exceed a preset explicit contribution threshold; extracting the physical timestamp attached to the feature vector encapsulated in the local hierarchical circular queue architecture within the set of specific IT devices; sorting the physical timestamps in ascending order, and determining the specific IT device with the earliest time coordinate as the source IT device triggering the transmission of sub-health states within the multi-layered cascaded topology.

[0061] The specific configuration of the anomaly detection result acquisition module 50 will be described in detail below. The anomaly detection result acquisition module 50 further includes: retrieving specific ports in the multi-level cascaded topology that have a cascaded service bearer relationship with the source IT device to obtain the sub-healthy physical links.

[0062] The real-time data stream anomaly detection system for IT equipment operating status provided in this embodiment of the invention can execute the real-time data stream anomaly detection method for IT equipment operating status provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0063] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for real-time data stream anomaly detection based on the operating status of IT equipment, characterized in that, The method includes: By collecting real-time data streams from multiple IT devices in a multi-level cascaded topology using a hierarchical circular queue architecture, edge processing and compression are performed on the corresponding data streams to obtain multiple compressed real-time feature vectors. The multiple compressed real-time feature vectors are concatenated in the order of the multi-level cascaded topology to obtain a global cascaded state matrix. The prior prediction model is then used to perform forward reasoning on the global cascaded state matrix to obtain the latent variables of future state evolution. When the spatial Euclidean distance between the latent variables of the future state evolution and the preset abnormal evolution matrix space is lower than the safety discrimination threshold, it is determined that the multi-level cascaded topology is currently in an asynchronous sub-healthy transmission state. Based on the chronological order of the physical timestamps contained in multiple compressed real-time feature vectors, the source IT equipment that caused the asynchronous sub-health transmission can be traced in reverse. Based on the source IT device, locate the sub-healthy physical links in the multi-level cascaded topology affected by the source IT device, and use the source IT device and the sub-healthy physical links as anomaly detection results.

2. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 1, characterized in that, The multi-level cascaded topology includes servers, aggregation switches, encryption machine master-slave pairs, and FC-SAN storage systems.

3. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 2, characterized in that, When the IT device is the server, the I / O wait rate time-series data stream of the kernel scheduler is collected as the real-time data stream; When the IT device is the master and backup pair of the encryption machine, it reads the single processing delay timing data stream of the encrypted message and the chip operating temperature timing data stream as real-time data streams. When the IT device is the aggregation switch, the time-series data stream of the backlog of the acquisition port buffer queue is used as the real-time data stream; When the IT device is the FC-SAN storage system, the Fibre Channel frame cell error count timing data stream is read as a real-time data stream.

4. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 1, characterized in that, By collecting real-time data streams from multiple IT devices in a multi-level cascaded topology using a hierarchical circular queue architecture, edge processing and compression are performed on each stream to obtain multiple compressed real-time feature vectors, including: The hierarchical circular queue architecture is divided into a high-frequency sliding window layer and a low-frequency attenuation layer. The high-frequency sliding window layer retains the uncompressed original hard index time series data points within a preset first sliding window period at a first sampling rate. When the timestamp of the original hard index time series data point exceeds the preset first sliding window period, the original hard index time series data point is moved into the low frequency attenuation layer. The first-order difference operator is called to calculate the trend slope of the original hard index time series data points, and the window mean and window variance are calculated by combining the first-order and second-order moment operators of the sliding window. Remove the original hard index time series data points from the low-frequency attenuation layer, and combine and encapsulate the trend slope, the window mean, and the window variance to generate multiple compressed real-time feature vectors.

5. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 1, characterized in that, The prior prediction model is then used to perform forward reasoning on the global cascaded state matrix to obtain latent variables for future state evolution, including: Inject the global cascaded state matrix into a positional encoding with a one-dimensional temporal self-attention mechanism; The global cascaded state matrix after injection position encoding is input into the multi-level time series feature extraction network in the prior prediction model to extract the dynamic evolution relationship of the multi-level cascaded topology in the time dimension. The prior predictive encoder contained in the prior predictive model is used to perform probability space mapping on the dynamic evolution relationship, and output the corresponding latent variables of future state evolution.

6. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 5, characterized in that, The prior predictive encoder included in the prior predictive model is used to perform probability space mapping on the dynamic evolution relationship, outputting the corresponding latent variables of future state evolution, including: Collect long-term historical state flow data prior to hardware-level interrupt events in the multi-level cascaded topology as training samples. During the offline training phase, the posterior encoder is used to explicitly read the future deterministic control state sequence of hardware-level interrupt events, and then distill and quantize it into future fault latent variables. Using a joint loss function, the prior prediction model is constrained to make the future state evolution latent variable predicted by the prior prediction encoder approach the future fault latent variable after inputting the compressed long-period historical state flow data, until training is completed, thus obtaining the prior prediction encoder.

7. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 6, characterized in that, The joint loss function includes a cross-entropy loss term, a Kolb-Leibler divergence loss term, and a commitment loss term. The cross-entropy loss term is used to constrain the accuracy of future system event sequence predictions; The Körbeck-Leibler divergence loss term is used to constrain the consistency between the probability distribution of the posterior encoder output and the probability distribution of the prior predictive encoder output. The commitment loss term is used to stabilize the encoding of this discrete quantization process.

8. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 1, characterized in that, Based on the chronological order of the physical timestamps contained in multiple compressed real-time feature vectors, the source IT equipment causing the asynchronous sub-health transmission is traced backward, including: Calculate the attention weight score of the feature channel corresponding to each IT device in the global cascaded state matrix during the forward inference process of the prior prediction model; Filter out the set of specific IT devices whose attention weight scores exceed a preset explicit contribution threshold; In the specific set of IT devices, extract the physical timestamp attached when the local hierarchical circular queue architecture encapsulation feature vector is extracted; The physical timestamps are sorted in ascending order, and the specific IT device with the earliest time coordinate is identified as the source IT device that triggers the transmission of sub-health conditions within the multi-layer cascaded topology.

9. The real-time data stream anomaly detection method for IT equipment operating status as described in claim 1, characterized in that, The sub-healthy physical links are obtained by retrieving specific ports in the multi-level cascaded topology that have cascaded service bearing relationships with the source IT equipment.

10. A real-time data stream anomaly detection system for the operating status of IT equipment, characterized in that, The system is used to implement the real-time data stream anomaly detection method for IT equipment operating status as described in any one of claims 1 to 9, and the system comprises: The data acquisition and processing module is used to acquire real-time data streams from multiple IT devices in a multi-level cascaded topology through a hierarchical circular queue architecture, and then perform edge processing and compression on the corresponding real-time data streams to obtain multiple compressed real-time feature vectors. The future state evolution latent variable acquisition module is used to concatenate the multiple compressed real-time feature vectors according to the order of the multi-level cascaded topology to obtain a global cascaded state matrix, and use a prior prediction model to perform forward reasoning on the global cascaded state matrix to obtain the future state evolution latent variables. The asynchronous sub-health transmission state determination module is used to determine that the multi-level cascaded topology is currently in an asynchronous sub-health transmission state when the spatial Euclidean distance between the latent variables of the future state evolution and the preset abnormal evolution matrix space is lower than the safety discrimination threshold. The device reverse tracing module is used to trace back the source IT device that caused the asynchronous sub-health transmission based on the order of the physical timestamps contained in multiple compressed real-time feature vectors. The anomaly detection result acquisition module is used to locate the sub-healthy physical links in the multi-level cascaded topology affected by the source IT device based on the source IT device, and to take the source IT device and the sub-healthy physical links as anomaly detection results.

Images