A cluster server intelligent operation and maintenance method based on causal unsupervised anomaly detection

Abstract

The application discloses a kind of cluster server intelligent operation and maintenance method based on causal unsupervised anomaly detection, belong to the technical field of intelligent operation and maintenance and cluster server system state health management, including collecting the real-time state monitoring data of cluster server system and carrying out pre-processing to it;Block causal matrix of cluster server system is constructed;Multi-dimensional feature embedding and causal representation fusion are carried out based on block causal matrix;The probability density distribution of multi-dimensional fusion feature is calculated using kernel density estimation, and adaptive abnormal threshold setting is carried out;Abnormal propagation link is constructed according to block causal matrix, and the abnormal variable without incoming edge in abnormal propagation link is determined as abnormal root cause.The application realizes efficient and reliable cluster server system anomaly state detection, abnormal propagation link construction and abnormal root cause analysis under the scene of uneven sample distribution, to effectively carry out system overall operation state monitoring and health management.

Description

Technical Field

[0001] This invention belongs to the technical field of intelligent operation and maintenance and cluster server system status health management, specifically involving an intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection. Background Technology

[0002] Traditional methods for detecting anomalies in cluster server systems rely on expert experience to set fixed or dynamic thresholds for system variables, triggering alarms when observed data exceeds these thresholds. However, this method cannot adapt to complex, nonlinear, dynamic changes in system conditions and requires frequent threshold setting and adjustment by experts, resulting in high maintenance costs. With the rapid iteration of IoT and sensor technologies, massive amounts of high-dimensional, nonlinear time-series data have shifted from being "difficult to collect" to being "acquired on a large scale," driving the development of deep learning in the field of cluster server system status monitoring. Currently, existing deep learning-based anomaly detection methods are mainly divided into supervised and unsupervised anomaly detection. Supervised anomaly detection methods effectively identify abnormal system states by training models using a large amount of labeled data. However, this method is severely limited by the quantity and quality of labeled data. In actual server operation and maintenance scenarios, abnormal events are scarce and varied, making it extremely difficult and costly to obtain sufficient and balanced abnormal samples, leading to insufficient model generalization ability. Unsupervised anomaly detection methods only use "normal" data for modeling, achieving anomaly identification by calculating the deviation of new data from normal patterns. While this method reduces the reliance on labels, it is limited to the level of anomaly identification and cannot explain the root cause of anomalies or the anomaly propagation path.

[0003] To address the aforementioned issues, Chinese invention patent CN120277571A proposes a method for constructing a multidimensional time series anomaly detection system. This method includes the following steps: Step 1, acquiring multidimensional time series data containing device status detection information; Step 2, encoding and preprocessing the multidimensional time series data; Step 3, constructing and optimizing a feature association graph of the multidimensional time series data variables based on cosine similarity and TopK strategies, then using an improved graph attention network to learn data features and combining it with a fully connected layer to achieve time series prediction and calculate anomaly scores; In the time dimension, establishing local and global connections through two independent model branches, training based on branch similarity, and identifying anomalies through differences.

[0004] Another Chinese invention patent, CN120633707A, proposes a graph neural network anomaly detection method based on high-order topology and personalized PageRank. The method includes the following steps: Step 1, inputting graph data, node feature matrices, and adjacency matrices, extracting all simplexes, and constructing high-order simplex complexes; Step 2, for each node, calculating a high-order PageRank matrix based on the proposed HiPwrPushSOR algorithm; Step 3, using the personalized PageRank matrix calculated through each order of topology as a high-order Laplacian matrix, designing a multinomial filter, and fusing the convolution results of each order to generate a node embedding representation; Step 4, based on the generated node embeddings, using a classifier or anomaly scoring function to determine whether a node is anomaly.

[0005] While the aforementioned inventions, by constructing correlation or dependency graphs, have enabled the discovery of potential relationships between variables and the analysis of anomaly propagation, they still have some limitations. First, the correlation between variables may originate from confounding factors or shared influencing factors, easily leading to biases in the construction of variable relationships. For example, if one variable has a significant impact on two other variables, correlation analysis may easily misjudge a high correlation between those two variables. Second, correlation graphs can only characterize the existence of associations between variables and cannot uncover causal relationships. When tracing the root causes of anomalies, they are prone to pointing to incorrect variable nodes. Summary of the Invention

[0006] The purpose of this invention is to address the above-mentioned shortcomings in the prior art by providing a cluster server intelligent operation and maintenance method based on causal unsupervised anomaly detection. This method solves the problems in the prior art where the correlation between variables may originate from confounding factors or common influencing factors, which can easily lead to deviations in the construction of variable relationships; and the correlation graph can only represent the existence of associations between variables and cannot realize the mining of causal relationships between variables, which can easily point to the wrong variable nodes when tracing the root cause of anomalies.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A cluster server intelligent operation and maintenance method based on causal unsupervised anomaly detection includes the following steps: S1. Collect real-time status monitoring data of the cluster server system, clean the data to obtain a high-dimensional multivariate time series dataset, and then perform block processing on the high-dimensional multivariate time series dataset according to the function positioning of variables. S2. Based on the data after being divided in S1, construct the intra-block causal matrix and the inter-block causal matrix respectively, and integrate them to obtain the block causal matrix of the cluster server system; S3. Using a dual-branch structure of long short-term memory network and convolutional neural network, global and local features of high-dimensional multivariate time series data in S1 are extracted and fused to obtain global-local fusion features. Then, using the block causal matrix as a constraint, causal relationship features between variables are obtained through multi-head graph attention network. The global-local fusion features and causal relationship features are dimensionality reduced and residual connected to obtain multi-dimensional fusion features of variables. Finally, a total loss function is constructed based on reconstruction loss and single classification loss to complete model training. S4. Adaptively adjust the bandwidth of the Gaussian kernel function using an empirical strategy. Based on the obtained bandwidth of the Gaussian kernel function, calculate the probability density distribution of the multi-dimensional fusion features using kernel density estimation. Select the quantile specified in the probability density distribution as the anomaly detection threshold for the variable. S5. Based on multi-dimensional fusion features and anomaly judgment threshold, anomaly identification is performed to obtain an anomaly variable set. Then, anomaly propagation links are constructed according to the block causal matrix, and the anomaly variables without incoming edges in the anomaly propagation links are identified as the root causes of the anomalies.

[0008] Furthermore, S1 specifically includes: Real-time status monitoring data of the cluster server system is collected. The real-time status monitoring data includes sensor reading variables and system performance index variables. A cleaning operation is performed on the collected sensor reading variables and system performance index variables to remove invalid variables with values ​​of zero or NaN, resulting in a unified high-dimensional multivariate time series dataset. Each variable in the high-dimensional multivariate time series dataset is processed in blocks according to its functional positioning.

[0009] Furthermore, in S2, the process of constructing the causal matrix within the sub-block is as follows: For each sub-block, an initial empty graph is constructed and a score is calculated based on the Bayesian information criterion. All potential edges in the initial empty graph are traversed, and the graph structure is optimized through successive edge addition and deletion operations, while maintaining the graph structure as acyclic and retaining the V-shaped structure. The direction of undirected edges is determined using the Meek criterion. For edges with undetermined directions, causal direction inference is completed based on nonlinear function fitting and noise independence test.

[0010] Furthermore, in S2, the process of constructing the causal matrix between sub-blocks is as follows: First, the data within each sub-block is divided into samples. Then, incremental principal component analysis is used to perform iterative dimensionality reduction to obtain the dimensionality reduction vector of each sub-block. For the data within each sub-block after dimensionality reduction, the information transmission intensity between sub-blocks is calculated based on the information transmission entropy. The causal dependency between sub-blocks is determined according to the magnitude of the transmission entropy, thereby forming a causal matrix between sub-blocks.

[0011] Furthermore, in S3, the process of obtaining global-local fusion features includes: Global feature extraction: A unidirectional long short-term memory network is used to extract the hidden state sequence at each time step in the variable, and the hidden state sequence is averaged at each time step to obtain the global features; Local feature extraction: A two-layer one-dimensional convolutional neural network is used to process the variables. After each convolutional layer, a normalization layer, a ReLU activation function and a Dropout layer are set in sequence, and the output features are averaged by the number of channels to obtain local features. Feature fusion: Global and local features are concatenated and input into a fully connected layer for feature dimensionality reduction to obtain global-local fused features.

[0012] Furthermore, in S3, the process of obtaining multi-dimensional fusion features includes: The variables in the global-local fusion features are used as graph structure nodes and the variable features are used as node features to construct graph data. The graph data is then input into the graph attention network, and the block causal matrix in S2 is used as the adjacency matrix of the graph attention network. A multi-head attention mechanism is adopted to replace the single-head attention mechanism in the graph attention network. In each attention head, linear transformation and attention score calculation are performed on the node features in sequence. Attention allocation between variables is constrained by a block causal matrix. Then, the attention weights are normalized by the Softmax function. Based on the normalized attention weights, the node features of each attention head are weighted and output. The outputs of all attention heads are concatenated to obtain the causal association features. Fully connected layers are used to process the global-local fusion features and causal correlation features respectively, and reduce them to the same dimension. Then, through residual connections, multi-dimensional fusion features are obtained.

[0013] Furthermore, in S3, the process of constructing the reconstruction loss is as follows: Three fully connected layer operations are performed on the multi-dimensional fused features, and the ReLU function is used for activation to obtain reconstructed data. The mean squared error loss between the reconstructed data and the original data is calculated, and the logarithm of the mean squared error loss is performed to obtain the reconstruction loss.

[0014] Furthermore, S4 specifically includes: The probability density distribution of multidimensional fusion features is calculated using kernel density estimation. A Gaussian kernel function is introduced to calculate the local density contribution of the multidimensional fusion features of each variable sample point in the feature space. The density contributions of all variable sample points are superimposed and normalized to obtain the overall probability density estimation result of the variables. The kernel function bandwidth is adaptively determined based on the standard deviation, interquartile range, and number of variable samples. The 0.9999th quantile of the probability density distribution is selected as the anomaly detection threshold for the corresponding variable, thus completing the setting of anomaly thresholds for all variables.

[0015] Furthermore, S5 specifically includes: Multi-dimensional fusion features are extracted from the data to be detected and the corresponding probability density values ​​are calculated. The probability density values ​​are compared with the anomaly judgment threshold. Data that is higher than the threshold is judged as normal data, and data that is lower than the threshold is judged as abnormal data and included in the abnormal variable set. Based on the block causal matrix, a directed anomaly propagation link is constructed for the anomaly variables. The propagation path of the anomaly across sub-blocks is determined according to the causal relationship between sub-blocks. The anomaly variables without any input directed edges in the anomaly propagation link are identified as the root cause of the anomaly.

[0016] The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection provided by this invention has the following beneficial effects: This invention enables efficient and reliable detection of abnormal states, construction of abnormal propagation links, and analysis of abnormal root causes in cluster server systems under scenarios with uneven sample distribution. It provides effective support for monitoring and health management of the overall system operation status, thereby narrowing the scope of troubleshooting when a fault occurs and helping maintenance personnel to find the cause of the fault more quickly. Attached Figure Description

[0017] Figure 1 This is a flowchart of the intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection in the embodiment. Detailed Implementation

[0018] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0019] This embodiment provides an intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection. It can achieve efficient and reliable identification of abnormal system states in scenarios with uneven sample distribution, construct anomaly propagation links, and locate the root cause of anomalies. This embodiment constructs a block-based causal topology graph of the cluster server (system) and uses it as a structural prior constraint in the feature extraction stage, guiding the unsupervised deep learning model to mine multi-dimensional fusion representations of variables. Based on these representations, anomaly discrimination is performed, achieving reliable identification of abnormal system states and abnormal components under conditions of uneven sample class distribution. Furthermore, based on the causal topology graph, a fault propagation link is constructed in reverse, outputting root cause location results, achieving end-to-end fault root cause tracing, thereby narrowing the scope of fault investigation and shortening the anomaly reset cycle. (Reference) Figure 1 Specifically, it includes the following: S1. Collect real-time status monitoring data of the cluster server system, clean the data to obtain a high-dimensional multivariate time series dataset, and then perform block processing on the high-dimensional multivariate time series dataset according to the function positioning of variables. In some embodiments, real-time status monitoring data of the cluster server system is collected. The real-time status monitoring data includes sensor reading variables (such as physical parameters such as temperature and voltage) and system performance index variables (such as operating status parameters such as CPU utilization and memory utilization). A cleaning operation is performed on the collected sensor reading variables and system performance index variables to remove invalid variables with values ​​of zero or NaN (non-numerical) to obtain a unified high-dimensional multivariate time series dataset. Each variable in the high-dimensional multivariate time series dataset is divided into blocks according to its functional positioning (such as CPU operation related, NPU processing related, power consumption related, etc.).

[0020] S2. Based on the data after being divided in S1, construct the intra-block causal matrix and the inter-block causal matrix respectively, and integrate them to obtain the block causal matrix of the cluster server system; In some embodiments, the process of constructing the causal matrix within a sub-block is as follows: For each sub-block, an initial empty graph G (matrix representation) is constructed, and a score is calculated based on the Bayesian Information Criterion (BIC). : In the formula, For sample size, For the sum of squared residuals, The number of parameters to be estimated. Indicates the first Individual blocks.

[0021] Then, all potential edges in graph G are traversed and edge addition operations are performed successively. The resulting new graph structures are quantitatively scored, and graph structures with lower scores are retained. During the process, a topological sorting test (by comparing the length of the topological list of nodes with zero input with the total number of nodes; if they are the same, there is no cycle) is used to simultaneously check the graph structure to ensure the graph's acyclicity, and the triples in the graph structure are checked to retain V-shaped structures. After the edge addition operation is completed, the Meek criterion is applied to determine the direction of some undirected edges. Then, based on the graph structure optimized by edge addition, edge deletion operations are performed successively, and the resulting new graph structures are quantitatively scored, retaining graph structures with lower scores. During the process, the graph structure is still checked to ensure the graph's acyclicity and retain V-shaped structures, and the Meek criterion is applied to determine the direction of some undirected edges. For edges in the graph with uncertain directions, their causal direction is inferred by analyzing the functional relationship between the corresponding two variables and the independence of noise. The functional relationship is as follows: , in, For any nonlinear function, It is additive noise, and Independent of .

[0022] Assuming a causal relationship exists between variables X and Y, to confirm the directionality of this causal relationship, we first introduce K-nearest neighbors to select variable induction points to reduce the amount of subsequent matrix operations. Then, we fit a Gaussian kernel function relationship between the variables, i.e., fit the Gaussian kernel function relationship from variable X to variable Y, to obtain the predicted value Y' of Y. We calculate the deviation between the predicted value and the actual value (i.e., additive noise), and verify the independence of the noise term from variable X through a kernel conditional independence test. The result is denoted as P. X→Y Repeat the above operation in the direction of displacement to obtain P. Y→X Compare the values ​​of P; if P... X→Y >P Y→X If X→Y, then there exists a causal direction X→Y; conversely, if Y→X, then there exists a causal direction Y→X.

[0023] In some embodiments, the process of constructing the causal matrix between sub-blocks is as follows: For the initial data (variables) within the sub-block First of all The sample was partitioned using a modular strategy. First, variables were initially partitioned based on system functional attributes. Then, for variables with unclear functional positioning, statistical correlation coefficients were used for further partitioning, ultimately dividing the data into multiple relatively independent sub-blocks. Incremental principal component analysis was then used to perform iterative dimensionality reduction on the partitioned sample data, yielding the dimensionality-reduced vector for each sub-block. : , in, For the first The original input samples, For the front The mean vector of each sample. for The principal component matrix obtained after the nth iteration To reduce the dimensionality of the target, For orthogonalization operation, This is a matrix concatenation operation.

[0024] For the data within the reduced-dimensionality sub-blocks, the information transfer strength between sub-blocks is quantified based on information transfer entropy. The causal relationships between sub-blocks are determined based on the magnitude of the entropy intensity, thus realizing the construction of a complete causal matrix between sub-blocks. Specifically, it is expressed as follows: , in, For variables exist The state at any given moment, For variables exist Moment Historical state, For variables exist Moment Historical state, Let be the joint probability distribution of the combination of variables.

[0025] Finally, the intra-block causality matrix and the inter-block causality matrix are integrated to obtain the block causality matrix.

[0026] S3. Using a dual-branch structure of long short-term memory network and convolutional neural network, global and local features of high-dimensional multivariate time series data (variables) in S1 are extracted and fused to obtain global-local fused features. Then, using the block causal matrix as a constraint, causal relationship features between variables are obtained through multi-head graph attention network. The global-local fused features and causal relationship features are dimensionality reduced and residual connected to obtain multi-dimensional fused features of variables. The total loss function is constructed based on reconstruction loss and single classification loss to complete model training. In some embodiments, the process of obtaining global-local fusion features includes: Global feature extraction; First, a dual-branch structure using a Long Short-Term Memory (LSTM) network and a Convolutional Neural Network (CNN) is employed to extract global and local features from the data, respectively. During global feature extraction, for each data point, a unidirectional LSTM network is used to process it, resulting in a sequence containing the hidden states at all time steps. ; for The hidden state at a given time is specifically represented as follows: , in, For the output of the output gate, For the output of the forget gate, for Cellular state at any given moment The output of the input gate, for The state of candidate cells at any given time.

[0027] Then the sequence of hidden states at time steps Perform time step averaging to obtain As a global feature of the data; Local feature extraction; A two-layer one-dimensional convolutional neural network (1D-CNN) is used to process the data. For each data point, the first 1D-CNN layer is used to reduce its dimensionality, and then the second 1D-CNN layer is used to perform deep feature mining on the dimensionality-reduced data to obtain the local features of the initial data. .

[0028] The convolutional layer is specifically represented as follows: , in, Indicates the first Local features of the layer; Indicates the first The convolutional kernel weights of the layer, For the first Local features of the layer , For bias terms, This is the initial input data.

[0029] To improve the model's stability and expressive power, a normalization layer, a ReLU activation function, and a Dropout layer are added after each 1D-CNN layer. After feature extraction is completed, the local features of the obtained initial data are processed. Average the number of channels to obtain As a local feature of the data.

[0030] Feature fusion; Global and local features are concatenated and then fed into a fully connected layer for feature dimensionality reduction, resulting in a fused global-local feature. : , in, This is the weight matrix. This indicates a matrix concatenation operation.

[0031] In some embodiments, the process of obtaining multi-dimensional fusion features includes: Will The variables in the graph are used as nodes, and the variable features are used as node features to construct graph data, which is then used as input to a Graph Attention Network (GAT). The block causal matrix obtained in step S2 is used as the adjacency matrix of the GAT to mine causal relationship features between variables. To more effectively capture the relationships between variables, a multi-head attention mechanism is used instead of the single-head attention mechanism in the original GAT network framework. In each attention head, the node features are first linearly transformed, and then the attention scores between nodes are calculated. , Specifically, it is expressed as follows: , in, Indicates the first Attention parameters for each attention head. and Representing nodes respectively and nodes After the first Features after linear transformation of the size This represents a matrix concatenation operation; exist After computation, attention allocation among variables is constrained using a block causal matrix, and the attention weights are normalized using the Softmax function. Then, the node features of each head are weighted and output, and the outputs of all heads are concatenated to obtain the causal association features of the data. : , in, For the first Each attention node The output features are specifically represented as follows: , in, , For elements of the causal matrix, For nodes Features of the first The result after linear transformation of the attention head For nodes The set of neighboring nodes.

[0032] Employing a fully connected layer for global-local feature fusion and characteristics of causal relationship The data is processed to reduce it to a single dimension, and then subjected to residual joins to obtain multi-dimensional fused features of the data. This fusion feature provides a deep representation of the data, effectively reflecting its state, and will be used for subsequent anomaly detection and processing.

[0033] In some embodiments, the loss function is constructed as follows: To enable the model to effectively learn the deep features of the data, multi-dimensional feature fusion is necessary. Perform three fully connected layer operations and use the ReLU function for activation to achieve data reconstruction. The specific implementation is as follows: , in, To reconstruct the data, This is for fully connected layer operations.

[0034] Computational reconstruction of data Compared with the original data The mean squared error loss is calculated, and the logarithm of this mean squared error loss is taken to obtain the model reconstruction loss. This is used as a constraint term for model training, specifically implemented as follows: Since the model is trained using only normal state data, a single-classification loss is used to enhance the ability to distinguish between normal and abnormal samples. As a constraint for model training, the specific implementation is as follows: in, For the number of variables, For the variable, the number of samples, For the first The first variable The feature vector of each sample For the first The feature centers of each variable.

[0035] During model training, to ensure the effectiveness of the feature centers, after a certain number of training epochs, the feature centers are recalculated based on the acquired multi-dimensional fused features, and the feature centers are updated. The overall loss function of the model... Represented as: in, and These are the weighting coefficients.

[0036] S4. Adaptively adjust the bandwidth of the Gaussian kernel function using an empirical strategy. Based on the obtained bandwidth of the Gaussian kernel function, calculate the probability density distribution of the multi-dimensional fusion features using kernel density estimation. Select the quantile specified in the probability density distribution as the anomaly detection threshold for the variable. In some embodiments, when multidimensional fusion features of variables are considered... After effective extraction, kernel density estimation (KDE) is used to evaluate the probability density distribution of the fused feature. For each sample point of the variable, a Gaussian kernel function is introduced to calculate the local density contribution of the multi-dimensional fused feature in the latent space. Then, the density contributions of the kernel functions corresponding to all multi-dimensional fused features are summed and normalized to obtain the overall probability density estimate of the variable. Specifically, it is expressed as: , in, To observe the number of samples, For bandwidth, For Gaussian kernel function, For sample dimensions, For the multi-dimensional fusion features of the samples whose density is to be estimated, For the first Multi-dimensional fusion features of observation samples.

[0037] bandwidth The choice of bandwidth has a significant impact on the evaluation results: too small a bandwidth will cause spurious fluctuations in the density curve, while too large a bandwidth will obscure the true distribution structure of the data. To obtain effective estimation results, this method adopts an empirical strategy to achieve the bandwidth of the univariate kernel density function. The adaptive determination is specifically expressed as: , in, The standard deviation of the variable sample. The interquartile range of the variable samples. The number of samples is a variable.

[0038] After obtaining the overall probability density estimation result of the variable, the 0.9999th quantile of the probability density distribution of the variable (corresponding to the very low end of the density distribution) is selected, and this quantile is determined as the anomaly detection threshold for the variable. Specifically, it is expressed as: , in, It is a quantile function. The probability density estimate of the multi-dimensional fused features of all samples for the variable is given. Repeating the above process, the anomaly detection thresholds for all system variables are finally obtained.

[0039] S5. Based on multi-dimensional fusion features and anomaly judgment threshold, anomaly identification is performed to obtain an anomaly variable set. Then, anomaly propagation links are constructed according to the block causal matrix. Anomaly variables without incoming edges in the anomaly propagation links are identified as the root cause of the anomaly. In some embodiments, during the anomaly detection process, firstly, multi-dimensional fusion feature extraction of variables is performed on the new system state data. Then, the probability density value corresponding to the multi-dimensional fusion feature of the variable is calculated, and anomaly detection is performed based on the anomaly determination threshold obtained in step S4. If the probability density value is higher than the anomaly determination threshold, the new data is determined to be normal data; if the probability density value is lower than the anomaly determination threshold, the new data is determined to be anomalous data. In this case, the variable state is further determined to be anomalous, and the variable is included in the anomalous variable set. .

[0040] After the state detection of all system variables is completed, an anomaly propagation path is constructed based on the block causal matrix obtained in step S2. Specifically, first, an initial empty graph of the anomaly variables is constructed, and then causal relationships (represented by directed edges) between the anomaly variables are added based on the block causal matrix. If the anomaly propagates between different sub-blocks, a sub-block anomaly propagation path is constructed based on the causal relationships between the sub-blocks, ultimately realizing the construction of a complete system anomaly propagation path. In the anomaly propagation path, if an anomaly variable has no incoming edges, it is determined that the variable is the root cause of the anomaly, specifically expressed as follows: , in, For pointing to variables The set of source variables corresponding to the input directed edges. When this set is empty, the variable is determined. This is the root cause of the abnormality.

[0041] In the process of identifying abnormal root causes, abnormal sub-blocks are first identified based on their in-degree and out-degree, and then the root cause score of each sub-block is determined. for: in, The causal input degree of the sub-block. The causal output degree of the sub-block. The larger the value, the closer the sub-block is to the source location in the propagation path, and the higher the probability that it is an abnormal root factor block.

[0042] Perform variable outlier root cause localization within the root factor block. For all identified outlier variables in the sub-block, calculate their root cause scores. , Calculation formula and The calculation formula is consistent. Variables with higher root cause scores are more likely to be the starting point of anomalous propagation. Variables with the highest scores are selected based on their scores and added to the root cause variable set as the most likely root cause variable.

[0043] Although specific embodiments of the invention have been described in detail with reference to the accompanying drawings, this should not be construed as limiting the scope of protection of this patent. Various modifications and variations that can be made by a person skilled in the art without inventive effort within the scope described in the claims still fall within the scope of protection of this patent.

Claims

1. A cluster server intelligent operation and maintenance method based on causal unsupervised anomaly detection, characterized in that, Includes the following steps: S1. Collect real-time status monitoring data of the cluster server system, clean the data to obtain a high-dimensional multivariate time series dataset, and then perform block processing on the high-dimensional multivariate time series dataset according to the function positioning of variables. S2. Based on the data after being divided in S1, construct the intra-block causal matrix and the inter-block causal matrix respectively, and integrate them to obtain the block causal matrix of the cluster server system; S3. Using a dual-branch structure of long short-term memory network and convolutional neural network, global and local features of high-dimensional multivariate time series data in S1 are extracted and fused to obtain global-local fusion features. Then, using the block causal matrix as a constraint, causal relationship features between variables are obtained through multi-head graph attention network. The global-local fusion features and causal relationship features are dimensionality reduced and residual connected to obtain multi-dimensional fusion features of variables. Finally, a total loss function is constructed based on reconstruction loss and single classification loss to complete model training. S4. Adaptively adjust the bandwidth of the Gaussian kernel function using an empirical strategy. Based on the obtained bandwidth of the Gaussian kernel function, calculate the probability density distribution of the multi-dimensional fusion features using kernel density estimation. Select the quantile specified in the probability density distribution as the anomaly detection threshold for the variable. S5. Based on multi-dimensional fusion features and anomaly judgment threshold, anomaly identification is performed to obtain an anomaly variable set. Then, anomaly propagation links are constructed according to the block causal matrix, and the anomaly variables without incoming edges in the anomaly propagation links are identified as the root causes of the anomalies.

2. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, S1 specifically includes: Real-time status monitoring data of the cluster server system is collected. The real-time status monitoring data includes sensor reading variables and system performance index variables. A cleaning operation is performed on the collected sensor reading variables and system performance index variables to remove invalid variables with values ​​of zero or NaN, resulting in a unified high-dimensional multivariate time series dataset. Each variable in the high-dimensional multivariate time series dataset is processed in blocks according to its functional positioning.

3. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, In S2, the process of constructing the causal matrix within the sub-block is as follows: For each sub-block, an initial empty graph is constructed and a score is calculated based on the Bayesian information criterion. All potential edges in the initial empty graph are traversed, and the graph structure is optimized through successive edge addition and deletion operations, while maintaining the graph structure as acyclic and retaining the V-shaped structure. The direction of undirected edges is determined using the Meek criterion. For edges with undetermined directions, causal direction inference is completed based on nonlinear function fitting and noise independence test.

4. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, In S2, the process of constructing the causal matrix between sub-blocks is as follows: First, the data within each sub-block is divided into samples. Then, incremental principal component analysis is used to perform iterative dimensionality reduction to obtain the dimensionality reduction vector of each sub-block. For the data within each sub-block after dimensionality reduction, the information transmission intensity between sub-blocks is calculated based on the information transmission entropy. The causal dependency between sub-blocks is determined according to the magnitude of the transmission entropy, thereby forming a causal matrix between sub-blocks.

5. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, In S3, the process of obtaining global-local fusion features include: Global feature extraction; A unidirectional long short-term memory network is used to extract the hidden state sequence at each time step from the variables, and the hidden state sequence is averaged at each time step to obtain the global features; Local feature extraction: A two-layer one-dimensional convolutional neural network is used to process the variables. After each convolutional layer, a normalization layer, a ReLU activation function and a Dropout layer are set in sequence, and the output features are averaged by the number of channels to obtain local features. Feature fusion: Global and local features are concatenated and input into a fully connected layer for feature dimensionality reduction to obtain global-local fused features.

6. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, In S3, the process of obtaining multi-dimensional fusion features includes: The variables in the global-local fusion features are used as graph structure nodes and the variable features are used as node features to construct graph data. The graph data is then input into the graph attention network, and the block causal matrix in S2 is used as the adjacency matrix of the graph attention network. A multi-head attention mechanism is adopted to replace the single-head attention mechanism in the graph attention network. In each attention head, linear transformation and attention score calculation are performed on the node features in sequence. Attention allocation between variables is constrained by a block causal matrix. Then, the attention weights are normalized by the Softmax function. Based on the normalized attention weights, the node features of each attention head are weighted and output. The outputs of all attention heads are concatenated to obtain the causal association features. Fully connected layers are used to process the global-local fusion features and causal correlation features respectively, and reduce them to the same dimension. Then, through residual connections, multi-dimensional fusion features are obtained.

7. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, In S3, the process of constructing the reconstruction loss is as follows: Three fully connected layer operations are performed on the multi-dimensional fused features, and the ReLU function is used for activation to obtain reconstructed data. The mean squared error loss between the reconstructed data and the original data is calculated, and the logarithm of the mean squared error loss is performed to obtain the reconstruction loss.

8. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, S4 specifically includes: The probability density distribution of multidimensional fusion features is calculated using kernel density estimation. A Gaussian kernel function is introduced to calculate the local density contribution of the multidimensional fusion features of each variable sample point in the feature space. The density contributions of all variable sample points are superimposed and normalized to obtain the overall probability density estimation result of the variables. The kernel function bandwidth is adaptively determined based on the standard deviation, interquartile range, and number of variable samples. The 0.9999th quantile of the probability density distribution is selected as the anomaly detection threshold for the corresponding variable, thus completing the setting of anomaly thresholds for all variables.

9. The intelligent operation and maintenance method for cluster servers based on causal unsupervised anomaly detection according to claim 1, characterized in that, S5 specifically includes: Multi-dimensional fusion features are extracted from the data to be detected and the corresponding probability density values ​​are calculated. The probability density values ​​are compared with the anomaly judgment threshold. Data that is higher than the threshold is judged as normal data, and data that is lower than the threshold is judged as abnormal data and included in the abnormal variable set. Based on the block causal matrix, a directed anomaly propagation link is constructed for the anomaly variables. The propagation path of the anomaly across sub-blocks is determined according to the causal relationship between sub-blocks. The anomaly variables without any input directed edges in the anomaly propagation link are identified as the root cause of the anomaly.

Images