A cache system exception detection method and model training method and device

Abstract

The application discloses a cache system exception detection method and device and a model training method, and relates to the technical field of intelligent operation and maintenance. A specific embodiment of the application comprises: a plurality of intelligent agents can be used to detect node state exceptions, data consistency exceptions and performance index exceptions of a cache system respectively; and according to one or more of the node state exceptions, the data consistency exceptions and the performance index exceptions, in combination with a preset cache knowledge graph, the causes of the exceptions are analyzed and corresponding exception processing strategies are executed; through the combination of multi-dimensional exception detection and the cache knowledge graph, the real-time performance, flexibility, accuracy and detection efficiency of the cache system are improved, and the performance and stability of the cache system are improved to a great extent.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, and in particular to a method for detecting anomalies in a caching system, a model training method, and an apparatus. Background Technology

[0002] In the operation and maintenance of caching systems, it is necessary to detect anomalies in the caching system in real time in order to maintain the stability of the system.

[0003] Existing methods for detecting system anomalies mainly rely on static anomaly rules related to keys. They check whether various performance indicators related to keys during runtime match the static anomaly rules, and if they do, an anomaly is determined to exist. However, existing methods suffer from low detection flexibility and scalability due to the use of static anomaly rules, and also suffer from low real-time performance and high false positive rate due to the difficulty in detecting sudden anomaly types. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, model training method, and apparatus for detecting anomalies in a caching system. These methods utilize multiple intelligent agents to detect node state anomalies, data consistency anomalies, and performance indicator anomalies in a caching system. Based on one or more of these anomalies, combined with a preset caching knowledge graph, the causes of the anomalies are analyzed, and corresponding anomaly handling strategies are executed. By combining multi-dimensional anomaly detection with a caching knowledge graph, embodiments of the present invention improve the real-time performance, flexibility, accuracy, and detection efficiency of caching system detection, significantly enhancing the performance and stability of the caching system.

[0005] To achieve the above objectives, according to one aspect of the present invention, a method for detecting anomalies in a caching system is provided, comprising: detecting node state anomalies in the caching system using a topology-aware agent; detecting cross-node data consistency anomalies in the caching system using a consistency agent; and detecting performance indicator anomalies in the caching system using a performance agent; analyzing the causes of the anomalies based on one or more of the node state anomalies, the data consistency anomalies, and the performance indicator anomalies, in conjunction with a preset caching knowledge graph; and executing corresponding anomaly handling strategies based on the causes of the anomalies.

[0006] Optionally, in the event of abnormal node status, the cause of the abnormality is analyzed based on the abnormal node status and in conjunction with a preset cache knowledge graph. This includes: obtaining a dynamic topology graph of the nodes in the cache system; using a preset propagation protocol to detect the running status and communication latency data of each node in real time; based on the running status and the communication latency data, and in conjunction with the node association relationships contained in the preset cache knowledge graph, inferring one or more first target nodes with abnormal communication connections, and analyzing the cause of the abnormality of the nodes associated with the first target nodes.

[0007] Optionally, in the event of data consistency anomalies, the cause of the anomaly is analyzed based on the data consistency anomaly and in conjunction with a preset cached knowledge graph. This includes: receiving transaction data from different nodes using a distributed transaction processing pipeline; verifying the consistency of transaction data from different nodes using a preset consistency detection model; and, if node splitting is identified based on the verification results, determining one or more second target nodes with node splitting based on the node association relationships contained in the preset cached knowledge graph, and analyzing the cause of data consistency anomalies associated with the second target nodes.

[0008] Optionally, in the event of performance anomalies, the causes of the anomalies are analyzed based on the performance metric anomalies and in conjunction with a preset cache knowledge graph. This includes: using one or more of the following strategies—key space analysis, memory diagnostics, time-series analysis, and rule-based reasoning—to analyze the anomaly risks corresponding to various performance metric anomalies; and based on the anomaly risk information and in conjunction with the preset cache knowledge graph, identifying the anomaly occurrence causes corresponding to the anomaly risk information.

[0009] Optionally, the step of using a key space analysis strategy to analyze the abnormal risks corresponding to various performance metric anomalies includes: statistically analyzing the distribution data of keys processed by different nodes in the cache system, calculating the key skew rate based on the key distribution data, and determining that the performance metric has an abnormal risk if the key skew rate exceeds a set skew rate threshold; and / or, the step of using a memory diagnostic strategy to analyze the abnormal risks corresponding to various performance metric anomalies includes: obtaining the occupied space of each key, filtering out multiple target keys whose occupied space exceeds a preset size, and assessing the memory fragmentation anomaly risk based on the multiple target keys; and / or, the step of using a time-series analysis strategy to analyze the abnormal risks corresponding to various performance metric anomalies includes: obtaining the cache The system uses a hybrid model that integrates temporal convolutional networks and long short-term memory networks to predict target traffic within a preset time range based on the traffic data, and predicts traffic anomaly risks based on the target traffic; and / or, the system uses rule-based reasoning strategies to analyze the anomaly risks corresponding to various performance index anomalies, including: acquiring avalanche rules, breakdown rules, and penetration rules included in the rule-based reasoning strategies; acquiring request data processed in the caching system, and inferring anomaly risk information about the request data when it is determined that the request data matches the avalanche rule or the penetration rule; acquiring access data of keys in the caching system, and inferring anomaly risks about the access data when it is determined that the growth state of the access data satisfies the breakdown rule.

[0010] To achieve the above objectives, according to a second aspect of the present invention, a model training method for the cache system anomaly detection method of the first aspect is provided, comprising: acquiring training data from the cache system, wherein the training data includes node state data, data consistency data, and performance index data of the cache system; training a topology-aware agent to detect node state anomalies using the node state data; training a consistency agent to detect data consistency anomalies using the data consistency data; training a performance agent to detect performance index anomalies using the performance index data; training a collaborative reasoning model based on one or more anomaly data among the node state anomalies, data consistency anomalies, and performance index anomalies, combined with a preset cache knowledge graph, to analyze the anomaly causes using the collaborative reasoning model; and updating the preset cache knowledge graph based on the analysis results.

[0011] Optionally, scenario data training samples corresponding to various abnormal scenarios are constructed; using the node status data, data consistency data, and performance index data of the caching system, combined with the scenario data training samples, the topology-aware agent, the consistency agent, and the performance agent are trained.

[0012] Optionally, for one or more of the trained collaborative reasoning model, topology-aware agent, consistency agent, and performance agent, a model compression operation is performed; the compressed model is deployed on an edge server to perform a real-time cache anomaly detection task on the edge server; and / or, a cross-scenario migration operation is performed on one or more of the compressed models to adapt to the operating environment of other caching systems.

[0013] To achieve the above objectives, according to a third aspect of the present invention, a cache system anomaly detection apparatus is provided, comprising: a detection module, an analysis module, and an execution module; wherein, The detection module is used to detect abnormal node states in the caching system using a topology-aware agent, to detect abnormal data consistency across nodes in the caching system using a consistency agent, and to detect abnormal performance indicators in the caching system using a performance agent. The analysis module is used to analyze the cause of the anomaly based on one or more of the following: node status anomaly, data consistency anomaly, and performance indicator anomaly, in conjunction with a preset cache knowledge graph. The execution module is used to execute the corresponding exception handling strategy according to the cause of the exception.

[0014] Optionally, the cache system anomaly detection device is used to analyze the cause of anomalies in the event of node anomalies, based on the node anomalies and a preset cache knowledge graph. This includes: acquiring a dynamic node topology graph of the cache system; using a preset propagation protocol to detect the running status and communication latency data of each node in real time; and based on the running status and communication latency data, combined with the node association relationships contained in the preset cache knowledge graph, inferring one or more first target nodes with communication connection anomalies, and analyzing the cause of node anomalies associated with the first target nodes.

[0015] Optionally, the cache system anomaly detection device is used to analyze the cause of the anomaly in the event of a data consistency anomaly, based on the data consistency anomaly and in conjunction with a preset cache knowledge graph. This includes: receiving transaction data from different nodes using a distributed transaction processing pipeline; verifying the consistency of transaction data from different nodes using a preset consistency detection model; and, if node splitting is identified based on the verification results, determining one or more second target nodes with node splitting based on the node association relationships contained in the preset cache knowledge graph, and analyzing the cause of the data consistency anomaly associated with the second target nodes.

[0016] Optionally, the cache system anomaly detection device is used to analyze the cause of anomalies in the event of performance anomalies, based on the performance indicator anomalies and in conjunction with a preset cache knowledge graph. This includes: using one or more strategies among key space analysis, memory diagnostics, time-series analysis, and rule-based reasoning to analyze the anomaly risks corresponding to various performance indicator anomalies; and identifying the cause of anomalies corresponding to the anomaly risk information based on the anomaly risk information and in conjunction with the preset cache knowledge graph.

[0017] Optionally, the cache system anomaly detection device is used to analyze the anomaly risks corresponding to various performance indicator anomalies using the key space analysis strategy, including: statistically analyzing the distribution data of keys processed by different nodes in the cache system, calculating the key skew rate based on the key distribution data, and determining that the performance indicator has an anomaly risk when the key skew rate exceeds a set skew rate threshold; and / or, the analysis of the anomaly risks corresponding to various performance indicator anomalies using the memory diagnostic strategy includes: obtaining the occupied space of each key, filtering out multiple target keys whose occupied space exceeds a preset size, and assessing the memory fragmentation anomaly risk based on the multiple target keys; and / or, the analysis of the anomaly risks corresponding to various performance indicator anomalies using the time-series analysis strategy includes: The process involves: acquiring traffic data from the caching system; using a hybrid model that integrates temporal convolutional networks and long short-term memory networks to predict target traffic within a preset time range; and predicting traffic anomaly risks based on the target traffic. Alternatively, the process may involve using rule-based reasoning strategies to analyze the anomaly risks corresponding to various performance metric anomalies, including: acquiring avalanche rules, breakdown rules, and penetration rules included in the rule-based reasoning strategies; acquiring request data processed in the caching system; and, if the request data matches the avalanche rule or penetration rule, inferring anomaly risk information about the request data; and acquiring access data for keys in the caching system; and, if the growth state of the access data satisfies the breakdown rule, inferring anomaly risks about the access data.

[0018] To achieve the above objectives, according to a fourth aspect of the present invention, a model training apparatus is provided, comprising: a data acquisition module, a training agent module, and a training inference module; wherein, The data acquisition module is used to acquire training data from the caching system, wherein the training data includes node status data, data consistency data, and performance index data of the caching system. The training agent module is used to train a topology-aware agent to detect node state anomalies using the node state data; to train a consistency agent to detect data consistency anomalies using the data consistency data; and to train a performance agent to detect performance indicator anomalies using the performance indicator data. The training and inference module is used to train a collaborative inference model based on one or more abnormal data, such as abnormal node status, abnormal data consistency, and abnormal performance indicators, combined with a preset cached knowledge graph, so as to analyze the abnormal causes of the abnormality using the collaborative inference model; and update the preset cached knowledge graph based on the analysis results.

[0019] Optionally, the model training device is used to construct scene data training samples corresponding to various abnormal scenarios; and to train the topology-aware agent, the consistency agent, and the performance agent by using the node state data, data consistency data, and performance index data of the caching system, combined with the scene data training samples.

[0020] Optionally, the model training device is used to perform a model compression operation on one or more of the trained collaborative reasoning model, topology-aware agent, consistency agent, and performance agent; deploy the compressed one or more models on an edge server to perform a real-time cache anomaly detection task on the edge server; and / or perform a cross-scenario migration operation on one or more of the compressed models to adapt to the operating environment of other caching systems.

[0021] To achieve the above objectives, according to a fifth aspect of the present invention, an electronic device for detecting anomalies in a cache system or training a model is provided, characterized in that it includes: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the methods described above for detecting anomalies in a cache system or training a model.

[0022] To achieve the above objectives, according to a sixth aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, characterized in that, when the program is executed by a processor, it implements any of the methods described above for cache system anomaly detection or model training.

[0023] To achieve the above objectives, according to a seventh aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that, when executed by a processor, the computer program implements any of the methods described above, such as the cache system anomaly detection or model training method.

[0024] One embodiment of the above invention has the following advantages or beneficial effects: it can utilize multiple intelligent agents to detect node state anomalies, data consistency anomalies, and performance index anomalies in the caching system; and based on one or more anomalies among node state anomalies, data consistency anomalies, and performance index anomalies, combined with a preset caching knowledge graph, it analyzes the causes of the anomalies and executes corresponding anomaly handling strategies; the embodiment of the present invention improves the real-time performance, flexibility, accuracy, and detection efficiency of the caching system by combining multi-dimensional anomaly detection and caching knowledge graph, thereby significantly improving the performance and stability of the caching system.

[0025] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0026] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein: Figure 1 This is a flowchart illustrating a cache system anomaly detection method provided in an embodiment of the present invention; Figure 2 is a flowchart illustrating a model training method provided in an embodiment of the present invention; Figure 3 This is a flowchart illustrating another model training method provided in an embodiment of the present invention; Figure 4A This is a schematic diagram of the structure of a cache system anomaly detection device provided in an embodiment of the present invention; Figure 4B This is a schematic diagram of the structure of a model training device provided in an embodiment of the present invention. Figure 5 is an exemplary system architecture diagram in which embodiments of the present invention can be applied; Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0027] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0028] It should be noted that the collection, use, storage, sharing and transfer of user personal information involved in the technical solution of the present invention all comply with the provisions of relevant laws and regulations, and require notification to users and obtaining their consent or authorization. When applicable, user personal information is subjected to de-identification and / or anonymization and / or encryption technical processing.

[0029] The existing detection methods for cache systems or components have the following problems: (1) Local feature limitations: Existing diagnostic methods focus too much on single-dimensional indicators such as memory usage and hit rate, and lack correlation analysis of global states such as cache cluster topology and data distribution patterns, resulting in about 40% of cache avalanche warnings being misjudged. (2) Data consistency blind spots: Traditional methods are difficult to effectively track cross-node transaction logs, and the diagnostic accuracy for complex scenarios such as cache and database double-write inconsistency and cluster split brain is less than 65%, with an average location time of more than 8 minutes. (3) Lagging hot spot dynamic perception: The key hotness detection mechanism based on fixed thresholds cannot adapt to sudden traffic patterns, and the recognition delay for instantaneous hot keys is generally more than 30 seconds, resulting in a cache breakdown accident prevention success rate of less than 50%. (4) Hybrid storage blind spots: Existing solutions have insufficient ability to analyze the abnormal propagation path of layered cache architecture (memory + SSD + disk), and the diagnosis time of chain reaction caused by multi-level cache failure accounts for more than 70% of the total abnormal time. (5) Elastic scaling bottleneck: In automatic scaling scenarios, traditional diagnostic models cannot dynamically adapt to node changes. The cache redistribution problem caused by the addition of new nodes takes an average of 15 minutes to complete the root cause localization. (6) Cross-domain synchronization dilemma: There is a lack of a unified framework for diagnosing cache synchronization anomalies in multi-cloud architectures. More than 60% of cross-regional data inconsistency problems require manual intervention for analysis, and the average MTTR (Mean Time To Repair) exceeds 30 minutes. The current cache anomaly diagnosis system has significant defects such as poor real-time performance, high false alarm rate, and coarse diagnostic granularity when dealing with dynamic topology, hybrid persistence strategies, and complex dependency scenarios in cloud-native environments.

[0030] In view of this, such as Figure 1 As shown, this embodiment of the invention provides a method for detecting anomalies in a caching system, which may include the following steps: Step S101: Detect node state anomalies in the caching system using a topology-aware agent, detect cross-node data consistency anomalies in the caching system using a consistency agent, and detect performance index anomalies in the caching system using a performance agent.

[0031] Specifically, embodiments of the present invention can utilize multiple independent intelligent agents to detect different types of anomalies in the caching system, and combine them with a preset caching knowledge graph to perform a collaborative and holistic analysis of multiple anomalies to obtain the cause of the anomalies.

[0032] Specifically, the topology-aware agent is used to detect node state anomalies in the caching system. This includes using an improved Gossip protocol (Gossip is a decentralized distributed communication protocol that mimics the spread of rumors, allowing information to reach consensus among all nodes through random and periodic interactions) to improve the convergence speed of node synchronization information in the caching system by 40%, thereby achieving millisecond-level node state detection (e.g., latency <10ms). Furthermore, the topology-aware agent can automatically discover newly added nodes and maintain the dynamic topology graph of the distributed caching cluster in real time. The topology-aware agent can also provide early warning of node disconnection risks 30 seconds in advance (accuracy rate reaches 92%) through a built-in topology anomaly prediction model, enabling a topology change event processing capacity of over 5000 events / second.

[0033] The system utilizes a consistent intelligent agent to detect cross-node data consistency anomalies in the caching system, including: constructing a distributed transaction log stream processing pipeline (e.g., communication latency <50ms) to verify cross-node data consistency; supporting multiple consistency models, such as CRDT (Conflict-free Replicated Data Type) and Paxos (consensus algorithm); automatically identifying cluster split scenarios (split-brain scenario), achieving a cross-node data consistency location accuracy of 89% and a false alarm rate of less than 5%; and providing a transaction traceability interface to support state replay at any point in time.

[0034] The performance intelligence agent is used to detect anomalies in the performance metrics of the caching system, including: analyzing memory fragmentation through an integrated memory fragmentation analysis module (supporting jemalloc / tcmalloc difference detection), performing network latency correlation analysis by analyzing network response data (distinguishing between intranet / cross-region traffic patterns), and generating performance optimization suggestions in real time through an eviction policy evaluation model (using algorithms such as LRU / LFU / ARC for effect analysis) (hit rate improvement of up to 20%). Here, LRU stands for Least Recently Used, LFU stands for Least Frequently Used, and ARC stands for Adaptive Replacement Cache.

[0035] Furthermore, the performance-based intelligent agent is also used for hotspot protection. Specifically, it can perform key-level access analysis based on sliding window statistics (window granularity can be 50ms-5s), and use a TCN-LSTM hybrid model to predict traffic in the next 30 seconds (error <8%). It can also achieve a burst traffic identification accuracy of 95% through a dynamic threshold adjustment mechanism, and a local cache preheating module (preheating hit rate >90%). Through these operations, it can identify bursty abnormal traffic. TCN-LSTM is a hybrid model of temporal convolutional network and long short-term memory network.

[0036] Preferably, in this embodiment of the invention, dynamic priority scheduling can be performed on different anomalies. Examples of anomaly alarm types (alarm judgment conditions) are as follows: hot spot alarm (response <100ms), consistency anomaly (response <200ms), performance degradation (response <500ms), capacity warning (response <1s), etc. Dynamic weight adjustment based on reinforcement learning is performed on the alarm conditions to improve resource utilization (by 40%).

[0037] Step S102: Based on one or more of the following anomalies—namely, node status anomaly, data consistency anomaly, and performance indicator anomaly—analyze the cause of the anomaly using a preset cache knowledge graph.

[0038] Step S103: Execute the corresponding exception handling strategy according to the cause of the exception.

[0039] Specifically, in this embodiment of the invention, for one or more of the following anomalies: abnormal node status, abnormal data consistency, and abnormal performance indicators, the causes of the anomalies are analyzed in conjunction with a preset cache knowledge graph.

[0040] In this embodiment of the invention, the preset cache knowledge graph includes node information, operational metric data, and topological relationships between nodes in the cache cluster.

[0041] Before utilizing the pre-defined cached knowledge graph, a pre-defined cached knowledge graph is constructed. Specific construction methods include: adopting a graph structure, using the JanusGraph distributed graph database for the storage engine to support real-time queries of hundreds of billions of edge relationships; considering node types, including physical nodes (servers, switches, etc.), logical entities (cached clusters, sharding, key mode), and anomaly modes (avalanche mode, breakdown mode, etc.); and considering node relationship types, including data dependencies (master-slave synchronization, sharding mapping), anomaly propagation (network jitter → synchronization latency → decreased hit rate), and optimized associations (memory parameter adjustments → performance improvement).

[0042] In response to the presence of abnormal node states, the causes of these abnormalities are analyzed based on the abnormal node states and a pre-defined cache knowledge graph. This includes: acquiring a dynamic node topology graph of the cache system; using a pre-defined propagation protocol to monitor the running status and communication latency data of each node in real time; and, based on the running status and communication latency data, and the node relationships contained in the pre-defined cache knowledge graph, inferring one or more first target nodes with abnormal communication connections, and analyzing the causes of abnormalities in nodes associated with these first target nodes. The pre-defined propagation protocol is an improved Gossip protocol. Based on the pre-defined propagation protocol, the running status and communication latency data of each node are monitored in real time to infer one or more first target nodes with abnormal communication connections, and the causes of abnormalities in nodes associated with these first target nodes are analyzed. The causes of abnormalities may include, for example, a network anomaly of a single node leading to a communication connection anomaly, or, based on the pre-defined cache knowledge graph, the anomaly of a dependent first target node caused by communication or performance issues of other nodes.

[0043] In cases of data consistency anomalies, the causes of the anomalies are analyzed based on the anomalies and a pre-defined cached knowledge graph. This includes: receiving transaction data from different nodes using a distributed transaction processing pipeline; verifying the consistency of transaction data across different nodes using a pre-defined consistency detection model; and, if node splits are identified based on the verification results, determining one or more second target nodes with split nodes by combining the node relationships contained in the pre-defined cached knowledge graph, and analyzing the causes of data consistency anomalies associated with these second target nodes. Specifically, the pre-defined consistency detection model may be, for example, CRDT (Conflict-free Replicated Data Type) or Paxos (consensus algorithm). When data inconsistency is determined, determining one or more second target nodes with split nodes by combining the node relationships contained in the pre-defined cached knowledge graph, and analyzing the causes of data consistency anomalies associated with these second target nodes. The causes of the anomalies may include, for example, network anomalies in one of the nodes (second target nodes) leading to communication connection anomalies, or, based on the pre-defined cached knowledge graph, data consistency anomalies caused by communication or performance issues of other nodes.

[0044] In the event of performance anomalies, the causes of the anomalies are analyzed based on the performance metric anomalies and a preset cache knowledge graph. This includes: using one or more strategies among key space analysis, memory diagnostics, time-series analysis, and rule-based reasoning to analyze the anomaly risks corresponding to various performance metric anomalies; and identifying the anomaly causes corresponding to the anomaly risk information based on the preset cache knowledge graph.

[0045] The following describes in detail several methods for analyzing the abnormal risks corresponding to various performance metric anomalies using one or more of the following strategies: key space analysis, memory diagnostics, timing analysis, and rule reasoning.

[0046] The first method involves using a key space analysis strategy to analyze the abnormal risks corresponding to various performance indicators; including: statistically analyzing the distribution data of keys processed by different nodes in the caching system, calculating the key skew rate based on the key distribution data, and determining that the performance indicator has an abnormal risk if the key skew rate exceeds a set skew rate threshold.

[0047] The distribution data of keys in the caching system can be statistically analyzed every 5 seconds. For example, monitoring data such as the distribution of the number of keys at the node level, the frequency of key accesses (within a sliding window), and the distribution of key memory usage can be performed. If the deviation from the mean in any dimension exceeds 30%, it is identified as key skew > 30% (i.e., the skewness threshold). Key skew measures the uneven distribution of keys across nodes / shards, indicating that some nodes handle a significantly higher number of keys or have a higher access volume than the average. There are several methods for calculating key skew, as described below: (1) Calculate skewness 1 based on the number of keys: Tilt 1 = (max(number of node keys) - avg(number of node keys)) / avg(number of node keys) × 100%; Alternatively, the slope 1 can be calculated based on the coefficient of variation (coefficient of variation): Tilt 1 = std(number of keys in each node) / avg(number of keys in each node) × 100% When the number of keys on a node is more than 30% higher than the average, it is considered an abnormal skew.

[0048] (2) Inclination 2 calculated based on visit volume: Tilt 2 = (Node QPS - Average QPS) / Average QPS × 100% QPS stands for Queries Per Second, representing the number of queries per second. An alarm is triggered if the access volume of a node exceeds 30% of the average.

[0049] (3) Inclination 3 calculated using the information entropy method: Tilt 3 = (H_max - H_actual) / H_max × 100%, where H is the information entropy of the Key distribution, H_max represents the maximum value, and H_actual represents the actual value. The closer the value is to 0, the more uniform it is, and the closer it is to 100%, the more skewed it is.

[0050] One example scenario is as follows: Suppose the cache cluster has 10 nodes and a total of 1 million keys. On average, each node should handle 100,000 keys. If a node has more than 130,000 keys (i.e., exceeding the average by 30%), or if the coefficient of variation of access volume exceeds 30%, it is judged as an "anomaly of 'slope > 30%'". This anomaly indicates that there are problems such as hash hotspots, large key concentration, or uneven distribution of business keys.

[0051] Preferably, a TTL (Time To Live) analyzer can also be used to detect the avalanche risk caused by the concentrated expiration of expiration time keys, thereby achieving an identification accuracy of 92% and a false alarm rate of less than 8%.

[0052] The second method utilizes memory diagnostic strategies to analyze the abnormal risks corresponding to various performance metric anomalies. This includes: identifying multiple target keys whose occupied space exceeds a preset size, and assessing the risk of memory fragmentation based on these target keys. Specifically, a large key detector can be used to identify multiple target keys whose occupied space exceeds a preset size (e.g., 10KB) to assess the impact of memory fragmentation. Preferably, fluctuation detection of memory fragmentation rate can also be performed (by dynamically adjusting the preset size). Furthermore, memory leak pattern recognition (92% accuracy), automatic log analysis (supporting online diagnostics), and memory optimization suggestions (which can save 20%-40% of memory) can also be performed.

[0053] The third method utilizes time-series analysis strategies to analyze the anomaly risks corresponding to various performance index anomalies. This includes: acquiring traffic data from the caching system, using a hybrid model combining temporal convolutional networks and long short-term memory networks to predict target traffic within a preset time range, and predicting traffic anomaly risks based on the target traffic. Specifically, a TCN-LSTM hybrid model (a hybrid model combining temporal convolutional networks and long short-term memory networks) can be used to process minute-level traffic granularity data to perform traffic prediction for the next 5 minutes (error <8%), achieving an anomaly detection sensitivity of 0.001% change rate and model inference latency <50ms.

[0054] The fourth method involves using rule-based reasoning strategies to analyze the abnormal risks corresponding to various performance metric anomalies. This includes: acquiring avalanche rules, breakdown rules, and penetration rules included in the rule-based reasoning strategies; acquiring request data processed in the caching system, and inferring abnormal risk information about the request data when the request data matches the avalanche rule or penetration rule; acquiring access data of keys in the caching system, and inferring abnormal risks about the access data when the growth state of the access data satisfies the breakdown rule.

[0055] Specifically, avalanche rules include, for example, a 30% drop in hit rate and a 50% increase in QPS; where cache hit rate (HitRate) refers to the proportion of requests that successfully retrieve data from the cache within a specific time window, out of the total number of requests, and its various calculation methods are as follows: First calculation method: Hit rate = Cache Hits / Total Requests × 100%, or: Hit Rate = Cache Hits / (Cache Hits + Cache Misses) × 100%; For example: In a certain minute, there are 10,000 total requests, 8,500 cache hits, and 1,500 cache misses, then the hit rate = 8,500 / 10,000 × 100% = 85%.

[0056] Furthermore, the calculation method for "hit rate decrease" is as follows: Hit rate decrease = (baseline hit rate - current hit rate) / baseline hit rate × 100%; This represents the absolute decrease in current hit rate calculated with reference to the baseline hit rate; For example: if the baseline hit rate (average over the last 5 minutes) is 85% and the current hit rate (over the last 1 minute) is 55%, then the decrease is (85% - 55%) / 85% × 100% = 35.3%. Since 35.3% > 30%, the condition of "hit rate drops by 30%" in the avalanche rule is triggered.

[0057] The second calculation method: for year-on-year comparison in sliding windows (real-time scenario): Hit rate decrease = (Previous window hit rate - Current window hit rate) / Previous window hit rate × 100%; where the window granularity includes: the baseline window corresponds to a 5-minute moving average (smoothing normal fluctuations); the current window corresponds to 1 minute of real-time data (rapidly detecting anomalies). The third calculation method: for the standard deviation method (statistical method): The drop in hit rate = (μ - current value) / σ; where μ is the historical average hit rate and σ is the standard deviation. A drop is considered to be sharp when the deviation exceeds 3σ (approximately 99.7% confidence interval).

[0058] The calculation method for "QPS increase of 50%" is as follows: The increase in Queries Per Second (QPS) is calculated as follows: QPS increase = (current QPS - baseline QPS) / baseline QPS × 100%; For example: if the baseline QPS (average over the last 5 minutes) is 10000 and the current QPS (over the last 1 minute) is 15500, then the increase is calculated as (15500 - 10000) / 10000 × 100% = 55%; Since 55% > 50%, the condition "QPS increases by 50%" in the avalanche rule is triggered.

[0059] Furthermore, the avalanche rule-based joint judgment logic triggers an alarm when the hit rate drops by 30% and the QPS increases by 50%, and also triggers an analysis of the cause of the anomaly. For example, the cause may be that a large number of keys expire at once, resulting in a surge in cache misses, which in turn leads to a sharp drop in the hit rate, causing requests to penetrate to the backend database, increasing the backend processing pressure, and causing an abnormal increase in QPS (or a large number of retries amplify the requests).

[0060] More preferably, the hit rate and QPS of minute-level data are calculated by using a time series analysis module in conjunction with a TCN-LSTM hybrid model: Input feature vector: "[Hit rate_t, QPS_t, Miss rate_t, Response time_t]", baseline calculation, including calculating the moving average of the past N time windows (e.g., N=5), sensitivity calculation, including calculating the anomaly detection sensitivity up to a change rate of 0.001%, which can capture a small change in hit rate from 85% to 84.915%, and can detect avalanche risk in advance by supporting traffic prediction in the next 5 minutes.

[0061] Furthermore, rule weights can be dynamically adjusted, for example: Avalanche rule confidence = w1 × hit rate decrease + w2 × QPS increase + w3 × response time increase; to achieve the goal of reducing the false positive rate by 35%, the weights of w1 / w2 / w3 can be dynamically adjusted through reinforcement learning; the rule matching speed exceeds 5000 rules / second, achieving the millisecond-level response required for real-time calculation of hit rate / QPS.

[0062] Furthermore, a penetration rule could be, for example, a sudden increase of 100 times in access to a single key. A penetration rule could be, for example, a null value hit rate consistently >80% within a preset time range. Specifically, the null value hit rate is calculated as follows: The null value hit rate = number of requests returning null results ÷ total number of requests × 100%. Specifically, the numerator represents the number of requests that missed the cache and returned null / empty values ​​in the database within a specified statistical period, and the denominator represents the total number of cache query requests within the same statistical period. For example, if there are 10,000 total requests in one minute, and 8,500 of them return null values, then the null value hit rate = 8,500 ÷ 10,000 = 85%. When this metric consistently exceeds 80%, a penetration rule is triggered.

[0063] The fifth method: a combination of one or more of the first to fourth methods.

[0064] More preferably, knowledge-enhanced reasoning is performed during anomaly detection. By maintaining a preset cached knowledge graph (an anomaly knowledge graph containing multiple entity relationships), semantic parsing from natural language to cached operations is achieved, supporting multi-turn conversational root cause analysis (response time <2s), and knowledge retrieval accuracy is 89%.

[0065] Furthermore, in this embodiment of the invention, a corresponding exception handling strategy is executed based on the cause of the exception. That is, for node state exceptions and data consistency exceptions, fault-tolerant exception handling strategies such as node reconnection and data rollback can be executed based on the cause of the exception.

[0066] The following anomaly handling strategies can be adopted for performance metric anomalies: 1) Hotspot Key Protection: Through millisecond-level detection (adjustable sliding window from 50ms to 5s), automatic local cache preheating (preheating hit rate >90%), and execution of a tiered circuit breaker strategy (dynamically adjusted based on QPS); protection success rate is 98.8%.

[0067] 2) Penetration Protection Engine: It monitors the status of Bloom filters (false positive rate <0.1%); performs intelligent filling of null value cache (TTL dynamically set); can also identify malicious requests (accuracy 95%), and run an automatic blacklist mechanism (interception efficiency 99%).

[0068] 3) Avalanche warning: By using the QPS-hit rate correlation model (R²>0.85) and TTL jitter algorithm (to avoid concentrated expiration), an automatic degradation strategy is determined (response time is reduced by 60%); the warning accuracy rate reaches 93%.

[0069] The embodiments of the present invention have one or more of the following beneficial effects in a production environment: average response time of 45ms (P99 < 90ms), accuracy of complex anomaly diagnosis of 93.2% (improved by 29%), cross-domain location time of 2.5 minutes (reduced by 89%), hotspot protection success rate of 99.1% (improved by 45%), automatic repair rate of 81% (reduced by 65% ​​of manual intervention), and improved resource utilization, such as a 25% increase in the overall throughput of the cache cluster; where P99 (99th Percentile) represents the value at the 99th percentile after sorting a set of latency data from smallest to largest, indicating that 99% of the response times are lower than a certain value.

[0070] This invention achieves full lifecycle management of cache anomalies through deep multi-agent collaboration and knowledge-enhanced reasoning mechanisms, providing a highly reliable and adaptive cache service guarantee system for the cache system.

[0071] like Figure 2 As shown in the diagram, this embodiment of the invention provides a flowchart of a model training method, which includes the following steps: Step S201: Obtain training data from the caching system; wherein the training data includes node status data, data consistency data, and performance index data of the caching system.

[0072] Specifically, training data can be obtained from cache operation logs, performance metrics, transaction tracing data, and anomaly case libraries.

[0073] Preferably, before performing model training, data preprocessing (data cleaning and augmentation) is performed on the training data, specifically including the following operations: 1) Log structuring processing, including parsing the Redis / Memcached protocol format (RESP / Memcached text protocol), filtering debug logs and heartbeat signals (noise filtering efficiency >95%), and extracting key operation events (GET / SET / DELETE, etc.); 2) Multidimensional feature extraction, including time-series features: QPS volatility, hit rate trend, key expiration distribution; topology features: node load balancing, data sharding status, replica synchronization latency; resource features: memory fragmentation rate, network bandwidth utilization, connection pool status; transaction features: read-write ratio, CAS (Compare And Swap) operation frequency, pipeline utilization, etc.

[0074] Furthermore, in this embodiment of the invention, scenario data training samples corresponding to various abnormal scenarios are constructed; using the node status data, data consistency data, and performance index data of the caching system, combined with the scenario data training samples, the topology-aware agent, the consistency agent, and the performance agent are trained.

[0075] Specifically, it can construct typical anomaly patterns (avalanche, breakdown, penetration, etc.), generate mixed anomaly scenarios (network partition + memory leak), and construct millions of training samples (e.g., positive to negative sample ratio of 1:3).

[0076] Step S202: Use the node state data to train a topology-aware agent to detect node state anomalies; use the data consistency data to train a consistency agent to detect data consistency anomalies; use the performance index data to train a performance agent to detect performance index anomalies.

[0077] Specifically, multi-agent joint training is performed using training data.

[0078] Specifically, regarding the training of a topology-aware agent to detect node state anomalies using the node state data, the model architecture of the topology-aware agent can employ a Graph Attention Network (GAT) to handle dynamic topologies. Its node feature dimension is, for example, 128 (including information such as load, version, and role), and its edge feature dimension is, for example, 64 (including latency, throughput, and error rate). Furthermore, the training objectives for detecting node state anomalies include, for example, a node failure prediction accuracy >92%, a topology anomaly detection latency <50ms, and support for real-time inference on a scale of over 1000 nodes.

[0079] To train a consistency agent using the aforementioned consistent data to detect data consistency anomalies, the model structure of the consistency agent can be based on Transformer-XL for long sequence modeling, handling transaction chains with more than 1000 operations. It supports multi-replica consistency verification through a CRDT state tracking module and utilizes an attention mechanism to focus on conflicting operation points to detect data consistency anomalies. Furthermore, the training objectives for detecting data consistency anomalies include: a split-brain scenario recognition accuracy >90%, data inconsistency location accuracy (key level), and support for transaction stream processing of 100,000 TPS (Transactions Per Second).

[0080] To train a performance agent to detect performance metric anomalies using the aforementioned performance metric data, the performance agent's model architecture can be a hybrid model architecture, including a Temporal Convolutional Network (TCN) for processing minute-level metric sequences, such as a 30-minute window; it can also include eXtreme Gradient Boosting (XGBoost, used to integrate key features for feature importance ranking) and a rule engine (embedding multiple cache-specific heuristic rules). Furthermore, the training objectives for detecting performance metric anomalies include: accuracy in root cause localization of decreased hit rate > 88%, recall rate for memory leak detection > 95%, and performance optimization suggestion adoption rate > 80%, etc.

[0081] Step S203: Based on one or more abnormal data among the node status abnormality, data consistency abnormality, and performance indicator abnormality, and in conjunction with the preset cached knowledge graph, train a collaborative reasoning model to analyze the cause of the abnormality using the collaborative reasoning model; and update the preset cached knowledge graph based on the analysis results.

[0082] Specifically, based on one or more abnormal data among the node state anomalies, data consistency anomalies, and performance metric anomalies, a collaborative reasoning model is trained in conjunction with a preset cached knowledge graph. The collaborative reasoning model includes a graph embedding algorithm, which performs reasoning in conjunction with the preset cached knowledge graph. Specifically, a GraphSAGE+RotatE hybrid model is adopted (GraphSAGE is an abbreviation for Graph Sample and Aggregation, representing a graph sampling and aggregation network; RotatE is an abbreviation for Rotation Embedding, representing a rotation embedding model), with an embedding dimension of 512 to preserve topological structure and semantic relationships; and it supports multi-hop reasoning (e.g., accuracy within 3 hops > 85%).

[0083] Furthermore, during the training iterations, the preset cached knowledge graph is dynamically updated, including real-time acquisition of operation and maintenance decision results, automatic identification of new abnormal patterns, and knowledge verification closed loop.

[0084] In this embodiment of the invention, for the trained model, a model compression operation is performed for scenarios such as deployment on edge servers (edge ​​servers are physical or virtual computing nodes deployed close to the data source or user side, used to reduce network latency, reduce bandwidth consumption, and alleviate the computing pressure on cloud data centers by processing data locally) or cross-scenario migration. That is, a model compression operation is performed on one or more of the trained collaborative inference model, topology-aware agent, consistency agent, and performance agent; the compressed one or more compressed models are deployed on the edge server to perform real-time cache anomaly detection tasks on the edge server; and / or, a cross-scenario migration operation is performed on one or more of the compressed models to adapt to the operating environment of other caching systems.

[0085] like Figure 3 As shown, this embodiment of the invention provides a flowchart of a model training method, which may include the following steps; Step S301: Obtain training data.

[0086] Step S302: Training data preprocessing. Specifically, this includes data cleaning and augmentation; data structuring; multi-dimensional feature extraction; and construction of scene data training samples.

[0087] Step S303: Multi-agent joint training. Specifically, training is performed on the topology-aware agent, consistency agent, and performance agent using a pre-set cached knowledge graph.

[0088] Step S304: Train the collaborative reasoning model so that it outputs the cause of the anomaly, and execute step S305 when new cached knowledge is obtained.

[0089] Step S305: Update the knowledge graph.

[0090] The specific descriptions of steps S301 to S305 are consistent with those of steps S201 to S203, and will not be repeated here.

[0091] Step S306: Verification and Deployment.

[0092] In this embodiment of the invention, verification and deployment can be performed on the model; wherein, verification includes offline verification and online verification; offline verification includes historical anomaly replay testing (covering 95% of known scenarios), stress testing (simulating millions of QPS traffic), adversarial sample testing (robustness verification), etc.; online verification includes shadow mode operation (traffic replication ratio of 15%), A / B testing framework (multi-strategy comparison), gradual traffic switching (0.1%→100%), etc.

[0093] Preferably, embodiments of the present invention can utilize a simulation verification platform to perform verifications based on a policy sandbox, including simulation of the elimination algorithm effect (error <5%), traffic stress testing (supporting simulation of millions of QPS), and priority scenario reproduction (fidelity >95%). It can also perform benchmark testing, automatically generating performance baselines (error <3%), anomaly detection calibration (daily automatic tuning), and model performance visualization dashboards (real-time updates). The simulation verification platform can simulate complex anomalies and extreme traffic in a real production environment, resulting in more comprehensive testing; more accurate quantitative evaluation, reducing human bias; and continuous automatic optimization, shortening the adaptation cycle, among other beneficial effects.

[0094] Deployment includes service-oriented deployment, specifically employing Kubernetes elastic cluster auto-scaling and scaling strategies, hierarchical deployment architecture (real-time detection of edge node processing), and model sharding mechanism (partitioning by cache cluster). It also allows for performance monitoring during deployment, including: end-to-end tracing (e.g., 99% response latency <50ms), resource utilization dashboards (granular to the container level), and automatic alarms for anomaly detection (e.g., response time <10 seconds).

[0095] Step S307: Iteratively update and optimize the model through incremental learning, compression, transfer, and other operations, such as iteratively executing steps S303 and S305.

[0096] Specifically, incremental learning includes real-time feature extraction using data pipelines (latency <100ms), automatic labeling pipelines (accuracy >92%), and dynamic adjustment of sample weights; for model updates, hourly incremental training (e.g., a sliding window of 24 hours), model version management (retaining the most recent 30 versions), and canary release mechanisms (5%→50%→100%) can be adopted.

[0097] For model compression, distillation from large models to edge models (accuracy loss <2%), parameter compression to 1 / 10 (suitable for resource-constrained environments), and dynamic quantization techniques (INT8 precision, i.e., 8-bit integer precision) can be used. For cross-scenario migration, knowledge sharing in multi-cloud environments, architecture difference adaptation modules (e.g., Redis→Memcached) and zero-shot learning capabilities (supported by new caching engines) can be used.

[0098] Through model training, the embodiments of this invention enable the system including the model to achieve one or more of the following test data in the test environment: 94.5% accuracy in complex priority diagnosis, 38ms average response time (P99 < 80ms), recognition time for new anomaly patterns < 2 hours, 83% success rate in automatic repair, and 30% improvement in resource utilization. This realizes a complete intelligent closed loop for cache anomaly diagnosis from feature extraction to decision generation, thereby improving the stability and operational efficiency of the cache system.

[0099] The embodiments of the present invention have the following beneficial effects: 1. Multi-agent collaborative architecture: Construct a matrix of multiple agents (topology-aware agent, consistency agent, performance agent) to achieve millisecond-level task scheduling (e.g., P99 latency <15ms), support real-time analysis of clusters with thousands of nodes, and achieve an event-driven architecture processing capacity of 100,000 events / second, which is 5 times more efficient than traditional methods.

[0100] 2. Employ a temporal-spatial hybrid inference model: Integrate TCN and GAT networks to process spatiotemporal features, resulting in a hit rate prediction error of <8%. By embedding more than 20 cache-specific rule engines, the accuracy of pattern recognition such as avalanche / breakdown is >92%.

[0101] 3. Through model parameter compression technology, the migration from large models to edge models is achieved (accuracy loss <2%). Through dynamic quantization technology (INT8 accuracy), memory usage is reduced by 60%. Through hierarchical feature extraction architecture, computational overhead is reduced by 30%.

[0102] 4. By constructing a cache knowledge graph, it contains more than 3,000 cache entity relationships (physical nodes, logical shards, exception patterns, etc.) and supports five-layer association analysis (hardware layer, network layer, cache layer, application layer, and business layer).

[0103] 5. Employing a dynamic update mechanism and incremental learning, dynamic updates enable real-time absorption of operational decision-making results (update latency <1 minute), automatic identification of new anomaly patterns (identification cycle <2 hours), a cross-cluster knowledge transfer framework (improving multi-cloud environment adaptation efficiency by 70%), and elastic adaptive continuous learning. Incremental learning enables hourly model updates (sliding window 24 hours), automatic annotation pipelines (accuracy >90%), and zero-shot learning capabilities to support rapid adaptation to new caching engines.

[0104] This invention constructs an intelligent diagnostic system covering the entire lifecycle of a caching system. Through multi-agent collaboration, hybrid model optimization, knowledge enhancement, and continuous learning, it achieves beneficial effects such as improving the accuracy of complex anomaly diagnosis to 94.5%, reducing the average response time to 38ms, and reducing the identification cycle of novel anomaly patterns to less than 2 hours. This effectively solves problems faced by caching systems such as dynamic topology adaptation, multi-level cache collaboration, and real-time protection, providing a reliable guarantee for the high availability of distributed caching.

[0105] like Figure 4A As shown, this embodiment of the invention provides a cache system anomaly detection device 400A, including: a detection module 401A, an analysis module 402A, and an execution module 403A; wherein, The detection module 401A is used to detect abnormal node states of the cache system using a topology-aware agent, to detect abnormal data consistency across nodes in the cache system using a consistency agent, and to detect abnormal performance indicators of the cache system using a performance agent. The analysis module 402A is used to analyze the cause of the abnormality based on one or more of the following: abnormal node status, abnormal data consistency, abnormal performance indicators, and a preset cache knowledge graph. The execution module 403A is used to execute the corresponding exception handling strategy according to the cause of the exception.

[0106] like Figure 4B As shown, this embodiment of the invention provides a model training device 400B, including: a data acquisition module 401B, a training agent module 402B, and a training inference module 403B; wherein, The data acquisition module 401B is used to acquire training data from the caching system, wherein the training data includes node status data, data consistency data, and performance index data of the caching system. The training agent module 402B is used to train a topology-aware agent to detect abnormal node states using the node state data; to train a consistency agent to detect abnormal data consistency using the data consistency data; and to train a performance agent to detect abnormal performance metrics using the performance metric data. The training and inference module 403B is used to train a collaborative inference model based on one or more abnormal data, such as abnormal node status, abnormal data consistency, and abnormal performance indicators, combined with a preset cached knowledge graph, so as to analyze the abnormal causes of the abnormality using the collaborative inference model; and update the preset cached knowledge graph based on the analysis results.

[0107] This invention also provides an electronic device for detecting anomalies in a caching system, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in any of the above embodiments.

[0108] This invention also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method provided in any of the above embodiments.

[0109] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the methods described above for detecting cache system anomalies.

[0110] Figure 5An exemplary system architecture 500 is shown that can be applied to the cache system anomaly detection method, model training method, cache system anomaly detection device, or model training device according to embodiments of the present invention.

[0111] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, and 503, a network 504, and a server 505. Network 504 serves as the medium for providing communication links between terminal devices 501, 502, and 503 and server 505. Network 504 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0112] Users can use terminal devices 501, 502, and 503 to interact with server 505 via network 504 to receive or send messages, etc. Various client applications can be installed on terminal devices 501, 502, and 503, such as e-commerce client applications, web browser applications, search applications, instant messaging tools, and email clients.

[0113] Terminal devices 501, 502, and 503 can be various electronic devices with displays and supporting various client applications, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0114] Server 505 can be a server that provides various services, such as a backend management server that supports client applications used by users through terminal devices 501, 502, and 503. The backend management server can process received cache system anomaly detection requests and feed back the cause of the cache system anomaly and the handling strategy to the terminal devices.

[0115] It should be noted that the cache system anomaly detection method or model training method provided in the embodiments of the present invention is generally executed by the server 505, and correspondingly, the cache system anomaly detection device or model training device is generally set in the server 505.

[0116] It should be understood that Figure 5 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0117] The following is for reference. Figure 6 It shows a schematic diagram of the structure of a computer system 600 suitable for implementing a terminal device of the present invention. Figure 6 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0118] like Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the system 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0119] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed into storage section 608 as needed.

[0120] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined above in the system of this invention.

[0121] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0123] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor can be described as including a detection module, an analysis module, and an execution module. The names of these modules do not necessarily limit the module itself; for example, a detection module can also be described as "a module that uses multiple intelligent agents to detect different types of anomalies in a cache system."

[0124] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to: utilize multiple intelligent agents to detect node state anomalies, data consistency anomalies, and performance indicator anomalies in the caching system; and, based on one or more of the node state anomalies, data consistency anomalies, and performance indicator anomalies, combine a preset caching knowledge graph to analyze the causes of the anomalies and execute corresponding anomaly handling strategies. The embodiments of the present invention, through the combination of multi-dimensional anomaly detection and caching knowledge graphs, improve the real-time performance, flexibility, accuracy, and detection efficiency of the caching system, significantly enhancing the performance and stability of the caching system.

[0125] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting anomalies in a caching system, characterized in that, include: The system utilizes a topology-aware agent to detect abnormal node states in the caching system, a consistency agent to detect abnormal data consistency across nodes in the caching system, and a performance agent to detect abnormal performance metrics in the caching system. Based on one or more of the following anomalies: abnormal node status, abnormal data consistency, and abnormal performance indicators, the causes of the anomalies are analyzed in conjunction with a preset cache knowledge graph. Based on the cause of the anomaly, execute the corresponding anomaly handling strategy.

2. The method according to claim 1, characterized in that, In the event of an abnormal node state, the step of analyzing the cause of the abnormality based on the abnormal node state and a preset cached knowledge graph includes: Obtain the dynamic topology of the nodes in the caching system, and use a preset propagation protocol to detect the running status and communication latency data of each node in real time; Based on the operating status and the communication delay data, combined with the node association relationships contained in the preset cached knowledge graph, one or more first target nodes with communication connection abnormalities are inferred, and the reasons for the abnormality of the nodes associated with the first target nodes are analyzed.

3. The method according to claim 1, characterized in that, In response to data consistency anomalies, the step of analyzing the causes of the anomalies based on the data consistency anomalies and a preset cached knowledge graph includes: Utilize a distributed transaction processing pipeline to receive transaction data from different nodes; Using a preset consistency detection model, the consistency of transaction data across different nodes is verified. If node splits are identified based on the verification results, one or more second target nodes with node splits are determined by combining the node association relationships contained in the preset cache knowledge graph, and the reasons for data consistency anomalies associated with the second target nodes are analyzed.

4. The method according to claim 1, characterized in that, In response to performance anomalies, the method involves analyzing the causes of the anomalies based on the performance metrics and a pre-defined cache knowledge graph, including: Using one or more of the key space analysis strategy, memory diagnosis strategy, timing analysis strategy and rule reasoning strategy, analyze the abnormal risks corresponding to various performance index anomalies; Based on the abnormal risk information and combined with a preset cached knowledge graph, the cause of the abnormality corresponding to the abnormal risk information is identified.

5. The method according to claim 4, characterized in that, The key space analysis strategy is used to analyze the abnormal risks corresponding to various performance indicators, including: statistically analyzing the distribution data of keys processed by different nodes in the caching system, calculating the key skew rate based on the key distribution data, and determining that the performance indicator has an abnormal risk when the key skew rate exceeds a set skew rate threshold. And / or, The memory diagnostic strategy is used to analyze the abnormal risks corresponding to various performance indicators, including: obtaining the occupied space of each key, filtering out multiple target keys whose occupied space exceeds a preset size, and assessing the abnormal risk of memory fragmentation based on multiple target keys; And / or, The method of using time-series analysis to analyze the abnormal risks corresponding to various performance index anomalies includes: obtaining traffic data in the caching system, using a hybrid model that integrates temporal convolutional networks and long short-term memory networks to predict target traffic within a preset time range in the future, and predicting traffic anomaly risks based on the target traffic. And / or, The method of using rule-based reasoning to analyze the abnormal risks corresponding to various performance metric anomalies includes: obtaining avalanche rules, breakdown rules, and penetration rules included in the rule-based reasoning strategy; obtaining request data processed in the caching system, and inferring abnormal risk information about the request data when it is determined that the request data matches the avalanche rule or the penetration rule; obtaining access data of keys in the caching system, and inferring abnormal risks about the access data when it is determined that the growth state of the access data satisfies the breakdown rule.

6. A model training method applied to the anomaly detection method of the caching system according to any one of claims 1 to 5, characterized in that, include: Training data is obtained from the caching system, wherein the training data includes node status data, data consistency data, and performance metric data of the caching system. The node state data is used to train a topology-aware agent to detect abnormal node states. The data consistency data is used to train a consistent agent to detect data consistency anomalies; The performance index data is used to train a performance agent to detect performance index anomalies; Based on one or more of the abnormal data, such as abnormal node status, abnormal data consistency, and abnormal performance indicators, a collaborative reasoning model is trained in conjunction with a preset cached knowledge graph to analyze the causes of the abnormalities; and the preset cached knowledge graph is updated based on the analysis results.

7. The method according to claim 6, characterized in that, Further includes: Construct training samples of scene data corresponding to various abnormal scenarios; Using the node status data, data consistency data, and performance index data of the caching system, combined with the scenario data training samples, the topology-aware agent, the consistency agent, and the performance agent are trained.

8. The method according to claim 6, characterized in that, Further includes: For one or more of the trained collaborative reasoning models, topology-aware agents, consistency agents, and performance agents, perform model compression operations. One or more compression models obtained after compression are deployed on an edge server to perform real-time cache anomaly detection tasks on the edge server; And / or, Perform cross-scenario migration operations for one or more of the compression models described above to adapt to the operating environment of other caching systems.

9. A cache system anomaly detection device, characterized in that, include: The module consists of a detection module, an analysis module, and an execution module; among which, The detection module is used to detect abnormal node states in the caching system using a topology-aware agent, to detect abnormal data consistency across nodes in the caching system using a consistency agent, and to detect abnormal performance indicators in the caching system using a performance agent. The analysis module is used to analyze the cause of the anomaly based on one or more of the following: node status anomaly, data consistency anomaly, and performance indicator anomaly, in conjunction with a preset cache knowledge graph. The execution module is used to execute the corresponding exception handling strategy according to the cause of the exception.

10. A model training device, characterized in that, include: The system comprises a data acquisition module, an agent training module, and an inference training module; among which, The data acquisition module is used to acquire training data from the caching system, wherein the training data includes node status data, data consistency data, and performance index data of the caching system. The training agent module is used to train a topology-aware agent to detect node state anomalies using the node state data; to train a consistency agent to detect data consistency anomalies using the data consistency data; and to train a performance agent to detect performance indicator anomalies using the performance indicator data. The training and inference module is used to train a collaborative inference model based on one or more abnormal data, such as abnormal node status, abnormal data consistency, and abnormal performance indicators, combined with a preset cached knowledge graph, so as to analyze the abnormal causes of the abnormality using the collaborative inference model; and update the preset cached knowledge graph based on the analysis results.

11. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-8.

12. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.

13. A computer program product, comprising a computer program, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.

Images