CN111914873A - Two-stage cloud server unsupervised anomaly prediction method - Google Patents

Two-stage cloud server unsupervised anomaly prediction method Download PDF

Info

Publication number
CN111914873A
CN111914873A CN202010505118.5A CN202010505118A CN111914873A CN 111914873 A CN111914873 A CN 111914873A CN 202010505118 A CN202010505118 A CN 202010505118A CN 111914873 A CN111914873 A CN 111914873A
Authority
CN
China
Prior art keywords
data
cloud server
layer
abnormal
input
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010505118.5A
Other languages
Chinese (zh)
Inventor
刘发贵
蔡木庆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
South China University of Technology SCUT
Original Assignee
South China University of Technology SCUT
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by South China University of Technology SCUT filed Critical South China University of Technology SCUT
Priority to CN202010505118.5A priority Critical patent/CN111914873A/en
Publication of CN111914873A publication Critical patent/CN111914873A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/243—Classification techniques relating to the number of classes
    • G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G06F18/232—Non-hierarchical techniques
    • G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
    • G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Abstract

The invention discloses a two-stage cloud server unsupervised anomaly prediction method, which is used for solving the anomaly prediction problem of a cloud server environment. The method comprises a prediction stage and an anomaly detection stage, wherein the prediction stage trains a many-to-many time sequence prediction model according to preprocessed key performance index data of the historical cloud server, and predicts cloud server KPIs data at a future moment by using the model; and in the abnormal detection stage, training a multivariate abnormal detection model according to the preprocessed KPIs data of the historical cloud server, performing abnormal detection on the predicted KPIs data at the future time by using the model to obtain the abnormal probability of the data point at the future time, and finally setting an abnormal probability threshold, wherein the data point which is larger than the abnormal probability threshold is considered as an abnormal data point, otherwise, the data point is a normal data point, and an abnormal prediction result is obtained. The invention has the advantages of no dependence on label data, wider applicability and excellent performance.

Description

Two-stage cloud server unsupervised anomaly prediction method
Technical Field
The invention belongs to the technical field of computer application, and particularly relates to a two-stage cloud server unsupervised anomaly prediction method.
Background
The cloud server (ECS) is a simple, efficient, safe, reliable, and flexible computing Service, which enables developers to purchase hardware independently, but only hosts the Service on the cloud server. While cloud server hosting services have a very broad prospect, many challenges remain for cloud server providers, with the availability of cloud servers at the forefront. Software and hardware faults or misoperation can directly cause the cloud server to be down, and further cause the loss of users. Therefore, how to effectively monitor the cloud server and effectively predict the abnormality becomes an important research problem.
The monitoring data of the cloud server and the monitoring data generated by the hosted service form a monitoring data set with a large number and various monitoring index types. The traditional monitoring means which completely depends on operation and maintenance personnel for observation becomes unrealistic, then a means for assisting the operation and maintenance personnel to monitor is derived, some rules are summarized by screening Key Performance Indicators (KPIs) data of the cloud server, corresponding threshold values are set, and if the comparison result exceeds the threshold values, the condition that the anomaly exists is considered. However, these methods are not universal, still depend on operation and maintenance personnel strongly, and are often difficult to apply to complex business scenarios due to their simple logic, and these methods often only have monitoring capability but not prediction capability, and are unable to predict abnormalities in advance and warn operation and maintenance personnel. In recent years, intelligent operation and maintenance become an important means for promoting the operation and maintenance development of cloud servers, historical KPIs data of the cloud servers are analyzed through an artificial intelligence algorithm, the characteristics of the KPIs data are mined, abnormal types are automatically identified, future KPIs data are predicted through a prediction algorithm and diagnosed, the abnormality at the future moment is found, an alarm is given before the abnormality occurs, and the KPIs data are repaired in advance to avoid cloud server faults.
At present, researchers have proposed a plurality of anomaly prediction methods, and documents "anomaly prediction method, anomaly prediction system and anomaly prediction device (CN 106330852B)" propose to record and construct corresponding prediction rules according to system commands to perform anomaly prediction. The document "a method and apparatus for anomaly prediction of a drive system (CN 110426634A)" proposes to construct a state distribution map of a system according to current response parameters and historical states of the system, and quantify an anomaly risk of a system region, so as to predict system anomalies, however, there is a complex dependency relationship between cloud server KPIs data, and the data has unbalanced and unlabeled features, and the method is particularly difficult in constructing the state distribution map, so that an anomaly prediction model is difficult to construct. Therefore, how to construct a method suitable for cloud server anomaly prediction still remains a challenge of cloud server intelligent operation and maintenance.
Disclosure of Invention
The invention aims to overcome the defects of the prior art and provide a two-stage cloud server abnormity prediction method which is used for predicting future KPIs data according to historical KPIs data and detecting the future KPIs data so as to realize abnormity prediction, alarm before abnormity occurs and repair in advance to avoid cloud server faults.
The purpose of the invention is realized by at least one of the following technical solutions.
A two-stage cloud server unsupervised anomaly prediction method comprises the following steps:
s1, performing missing value processing, data formatting and data normalization processing on the collected historical KPIs data of the cloud server;
s2, training a many-to-many time sequence prediction model and a multivariate abnormality detection model according to the preprocessed historical KPIs time sequence data of the cloud server;
s3, predicting KPIs data of the cloud server at a future moment by using a trained many-to-many time sequence prediction model;
s4, carrying out anomaly detection on the KPIs data at the predicted future time by using the trained multivariate anomaly detection model to obtain the anomaly probability of each future time data point;
s5, setting an abnormal probability threshold, judging whether the data point is an abnormal data point according to the abnormal probability of the data point, wherein the data point which is larger than the abnormal probability threshold is considered to be an abnormal data point, otherwise, the data point is a normal data point, and obtaining the result of abnormal prediction.
Further, in step S1, the missing value processing means performing a completion repair by using the average value of the latest 24 non-missing values for the missing values of the interval, that is, no more than 5 consecutive missing values of a certain row or a certain column; directly removing missing values when the number of the continuous missing values, namely the number of the continuous missing values of a certain row or a certain column, exceeds 5;
the data formatting refers to converting a category time sequence into a numerical time sequence by adopting an enumeration mode for the category time sequence of a certain dimension;
and the data normalization processing refers to normalizing the KPIs data of the cloud server after missing value processing and data formatting, and distributing the KPIs data in [0,1 ].
Further, in step S2, the many-to-many time series prediction model includes an encoder and a decoder, the encoder is used for fully extracting the features of the KPIs time series data, and the decoder is used for decoding the extracted features and outputting the predicted value at the future time; the input time sequence is
Figure BDA0002526266680000021
Figure BDA0002526266680000022
Wherein Xi＝{x(1),x(2),…,x(m)Predicting P-step KPIs time sequence of future time
Figure BDA0002526266680000023
Figure BDA0002526266680000024
Wherein Xi＝{x(1),x(2),…,x(m)The input sequence X is a multivariate time sequence, T represents the length of X, and m represents the dimension of X; the predicted target time series Y is a multivariate time series, where P represents a pre-predictionMeasuring the number of steps;
the encoder is realized by adopting a multi-layer stacked LSTM neural network, aims to fully extract time sequence characteristics of time sequence data of KPIs (Key Performance indicators) of a plurality of cloud servers, and provides characteristic input with weight, namely an encoding vector, for training of a prediction model by adopting an attention mechanism, and specifically comprises the following steps:
the state of the LSTM unit of the encoder needs to be transferred while considering the hidden state of the previous LSTM unit and the hidden state of the next layer of LSTM unit, that is:
Figure BDA0002526266680000031
wherein
Figure BDA0002526266680000032
And
Figure BDA0002526266680000033
respectively represent the k-th layer, the state of the memory cell at time T and the state of the hidden layer, L represents the number of layers of the stacked LSTMs, and T represents the length of the input time sequence. Through the feature extraction of the multi-layer LSTM, the hidden layer vectors of each moment are finally obtained
Figure BDA0002526266680000034
For convenience of description, use h1,h2,…,hTInstead of this. Computing the hidden layer vector h of each LSTM unit of the encoder1,h2,…,hTD respectively with the state of the decodert＝Concatnate(St-1,Y′t-1) Of the degree of correlation, wherein St-1Indicating the hidden layer state, Y ', of the decoder at the time immediately before the LSTM cell't-1Representing the true value, D, of a time instant on the LSTM unit of the decodertFinger joint St-1And Y't-1The vectors connected by columns, will St-1And Y't-1The connection and re-correlation calculation is to guide the calculation of the correlation by the real value of the last moment, and finally the normalization weight a of each hidden layer vector is obtained by using softmax normalizationijThe calculation formula is as follows:
Figure BDA0002526266680000035
Figure BDA0002526266680000036
wherein eijState D representing the i-th moment of the decodertAnd the state h of the jth hidden layer of the encoderjCan learn e through a neural networkijIn which V isa、WaAnd UaThe method is a weight parameter needing to be learned, and in consideration of the effectiveness of historical time sequence information, a Soft Attention mechanism (Soft Attention) is adopted to distribute weights to the states of hidden layers of all encoders;
state h for hidden layer of encoder1,h2,…,hTCarrying out weighted summation to obtain a coding vector C corresponding to the ith moment of the decoderiThe calculation formula is as follows:
Figure BDA0002526266680000037
further, the decoder is realized by adopting a single-layer LSTM neural network, the features obtained by encoding are decoded based on the single-layer LSTM, real data are taken as input, values of KPIs data at future moments of a plurality of cloud servers are output, and the construction of a many-to-many time sequence prediction model is completed, specifically as follows:
the state update of the decoder's LSTM is as follows:
Figure BDA0002526266680000041
wherein St-1Represents the hidden layer state at the previous time, Y't-1Representing the true value, S, of the last instantt-1Is composed of (h)t-1,ct-1) C represents a coded vector output by the coder; the first moment of the decoder uses the coding vector C to initialize the state of the hidden layer and the state of the memory unit, and the input is 0; the state of the hidden layer at the later moment is updated as the state of the common LSTM, but the state of the hidden layer at the later moment comprises an encoding vector and a real value at the last moment when training is input, the predicted value at the last moment is not taken as the input to avoid accumulative errors, and the state of the hidden layer at the later moment comprises the encoding vector and the predicted value at the last moment when verifying and; according to the output h of the decoder at time ttA predicted value at time t can be obtained, and a linear layer is usually added to adjust the dimension of the target output sequence, as shown in formula (7):
Yt＝linear(ht)； (7)
finally obtaining the predicted value of the P step by outputting the predicted values one by one
Figure BDA0002526266680000042
Figure BDA0002526266680000043
Wherein Xi＝{x(1),x(2),…,x(m)}。
Further, a many-to-many time sequence prediction model is trained according to a Bagging integration algorithm based on sliding window subsequence random sampling, which specifically comprises the following steps:
the method comprises the steps of segmenting input multi-dimensional cloud server historical KPIs time sequence data in a sliding window mode to obtain a subsequence set, then sampling the subsequence set by a non-replaced random sampling method, in order to guarantee diversity of an individual predictor, randomly taking two thirds of the number of the subsequence set for each training sample to finally obtain M subsequence sets, training a constructed many-to-many time sequence prediction model by taking the subsequence sets as a training set to obtain the individual predictor, and finally integrating the individual predictors to obtain an integrated predictor, namely the trained many-to-many time sequence prediction model.
Further, in step S2, the multivariate abnormality detection model is an abnormality detection model generated based on abnormal values, and the generator and the discriminator are constructed by using a multilayer fully-connected neural network; the construction and training of a multivariate anomaly detection model are completed by adopting a pseudo label data generation method based on a stack automatic encoder and K-Means + + clustering and an unsupervised multivariate anomaly detection training method based on a multi-target generation countermeasure network, and the method specifically comprises the following steps:
reducing the dimension of time series data of KPIs (Key Performance indicators) of a cloud server comprising a plurality of variables by adopting a stacking automatic encoder, clustering the time series data after dimension reduction by adopting a K-Means + + algorithm to obtain K clusters, removing the cluster containing the least number of data points as a suspected abnormal data cluster, and marking a pseudo label representing normal data on the data of other clusters;
the method comprises the steps of generating potential abnormal data by adopting a plurality of sub-generators with differences, combining the obtained data with a pseudo label representing normal, inputting the data into a discriminator for training, generating abnormal data similar to real data as much as possible by a multi-target generator, discriminating the generated abnormal data and normal data as much as possible by the discriminator, and taking the finally obtained discriminator as an abnormality detection two-classifier, namely a trained multivariable abnormality detection model.
Further, dimension reduction is carried out on the complex time sequence by using a stacking automatic encoder, the stacking automatic encoder adopts a plurality of single-layer automatic encoders, the single-layer automatic encoders are realized through a fully-connected neural network and are unsupervised artificial neural networks, the output target of the single-layer automatic encoders is input, and the realization process of the automatic encoders comprises two stages:
the first stage is an encoding stage, in which the auto-encoder (AE) obtains the hidden state a (x) by encoding the input data, as shown in equation (8):
a(X)＝f(W1X+b1)； (8)
wherein X is the input, W1Is a weight vector, b1Is a bias unit, f is a nonlinear activation function;
the second stage is a decoding stage, in which the Automatic Encoder (AE) reconstructs a (X) obtained by encoding, and the decoding obtains X' close to the input, as shown in formula (9):
X′＝f(W2a(X)+b2)； (9)
wherein W2Is a weight vector, b2The offset unit is used for considering that the hidden layer state a (X) is abstract characteristic representation of input data when the output X' is equal to or close to the input X;
the method comprises the steps that a Stacking Automatic Encoder (SAEs) learns input data layer by simulating a multilayer expression mode of brain perception data, and extracts deeper and more abstract features; the Stacking Automatic Encoders (SAEs) comprise a plurality of single-layer automatic encoders, the single-layer Automatic Encoders (AE) map input to a hidden layer, after the first Automatic Encoder (AE) is trained, a reconstruction layer of the first Automatic Encoder (AE) is discarded, the hidden layer becomes an input layer of a second single-layer Automatic Encoder (AE), and subsequent layers are also the same, and the same objective function and optimization algorithm are adopted for training of each layer of Automatic Encoders (AE); and the complex time sequence is subjected to dimensionality reduction through a stacking automatic encoder to obtain a characteristic representation after dimensionality reduction.
Further, clustering the complex time sequence data after dimensionality reduction by using a K-Means + + clustering algorithm; K-Means is one of classic clustering algorithms, the core idea is that a first clustering center is selected randomly, when the ith clustering center is selected, the probability that a point which is farther away from the previous i-1 clustering centers is selected is higher, wherein i is greater than 1; the calculation of the distance between the sample and the clustering center point and the probability that the sample point X is selected as the clustering center in the K-Means + + clustering process are respectively shown as a formula (10) and a formula (11):
Figure BDA0002526266680000051
Figure BDA0002526266680000052
where m is the dimension of the data point, xiAnd ciRespectively, the ith dimension data point for sample point X and cluster center C.
Further, the generator and the discriminator both adopt a multilayer fully-connected neural network; generation of exception data G by using k generators1(z1),G2(z2),G3(z3),…,Gk(zk)},ziThe method comprises the steps that input random data are distributed, abnormal data generated by a plurality of sub-generators are integrated, finally the generated abnormal data and data with a marked false label representing normal are input into a discriminator for training, when training begins, the generator G cannot generate abnormal values with diversity, so that the discriminator D obtains a rough boundary, but through multiple iterations, the generator G gradually learns a normal data generation mechanism of a mini-max game between G and D, and generates abnormal data with diversity; when the mini-max game reaches Nash equilibrium, namely the discriminator can hardly distinguish normal data or generated abnormal data, the training of the generator is stopped, the discriminator is continuously trained, and the discrimination error of the discriminator is further reduced; finally, the discriminator is able to correctly describe the boundary of normal data and abnormal data, and for a given data point, the discriminator outputs the probability that the data point will become normal data.
Further, in step S5, according to the abnormal probability of the cloud server KPIs data point at the future time outputted by the trained multivariate abnormal detection model, the threshold of the abnormal probability is set to 0.5, and if the abnormal probability is greater than the threshold, it is determined as an abnormal data point, otherwise, it is a normal data point.
Compared with the prior art, the invention has the following advantages and technical effects:
1. the two-stage cloud server unsupervised anomaly prediction method is independent of tag data in a cloud server environment and can process unbalanced KPIs data. Conventional anomaly prediction methods are often supervised, require a large amount of label data, and are difficult to process unbalanced KPIs data.
2. According to the proposed attention-stacking LSTMs-based many-to-many integrated prediction model, the adopted stacking LSTMs and the attention mechanism can fully extract time sequence characteristics and capture the interdependence relation characteristics among a plurality of KPIs time sequences; the adopted integrated prediction can further improve the prediction accuracy.
3. According to the anomaly detection model based on the pre-labeling and multi-target generation antagonistic network, the adopted pre-labeling technology based on the stacking automatic encoder and the K-Means + + can provide more reasonable input for anomaly detection, and the training difficulty is reduced; the adopted multi-target generator can automatically generate the potential abnormal data with diversity; the anomaly detector with high detection precision, strong generalization capability and robustness can be obtained through the countermeasure game of the generator and the discriminator.
Drawings
Fig. 1 is a schematic diagram of a two-stage cloud server anomaly prediction method in an embodiment of the method of the present invention.
FIG. 2 is a schematic diagram of a many-to-many integrated prediction model based on attention-stacking LSTMs in an embodiment of the method of the present invention.
Fig. 3 is a schematic diagram of an integrated prediction process based on a Bagging algorithm in the embodiment of the method of the present invention.
Fig. 4 is a diagram illustrating a sliding window based sub-sequence random sampling in an embodiment of the method of the present invention.
FIG. 5 is a flow chart illustrating generation of a countermeasure network based on pre-labeling and multi-objective in an embodiment of the method of the present invention.
FIG. 6 is a schematic diagram of a stacked auto-encoder according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions and advantages of the present invention more apparent, the following detailed description is made with reference to the accompanying drawings, but the present invention is not limited thereto.
Example (b):
a two-stage cloud server unsupervised anomaly prediction method comprises the following steps:
s1, performing missing value processing, data formatting and data normalization processing on the collected historical KPIs data of the cloud server;
the missing value processing means that for the missing values of intervals, namely continuous missing values of a certain row or a certain column, not more than 5, the average value of the latest 24 non-missing values is adopted for completing and repairing; directly removing missing values when the number of the continuous missing values, namely the number of the continuous missing values of a certain row or a certain column, exceeds 5;
the data formatting refers to converting a category time sequence into a numerical time sequence by adopting an enumeration mode for the category time sequence of a certain dimension;
and the data normalization processing refers to normalizing the KPIs data of the cloud server after missing value processing and data formatting, and distributing the KPIs data in [0,1 ].
S2, training a many-to-many time sequence prediction model and a multivariate abnormality detection model according to the preprocessed historical KPIs time sequence data of the cloud server;
as shown in fig. 2, the many-to-many time series prediction model includes an encoder and a decoder, the encoder is used for fully extracting the features of the KPIs time series data, and the decoder is used for decoding the extracted features and outputting predicted values at future time; the input time sequence is
Figure BDA0002526266680000071
Wherein Xi＝{x(1),x(2),…,x(m)And predicting P-step KPIs time sequence Y of future time
Figure BDA0002526266680000072
Wherein Xi＝{x(1),x(2),…,x(m)The input sequence X is a multivariate time sequence, T represents the length of X, and m represents the dimension of X; the predicted target time series Y is a multivariate time series, where P represents the predicted number of steps;
the encoder is realized by adopting a multi-layer stacked LSTM neural network, aims to fully extract time sequence characteristics of time sequence data of KPIs (Key Performance indicators) of a plurality of cloud servers, and provides characteristic input with weight, namely an encoding vector, for training of a prediction model by adopting an attention mechanism, and specifically comprises the following steps:
the state of the LSTM unit of the encoder needs to be transferred while considering the hidden state of the previous LSTM unit and the hidden state of the next layer of LSTM unit, that is:
Figure BDA0002526266680000073
wherein
Figure BDA0002526266680000074
And
Figure BDA0002526266680000075
respectively represent the k-th layer, the state of the memory cell at time T and the state of the hidden layer, L represents the number of layers of the stacked LSTMs, and T represents the length of the input time sequence. Through the feature extraction of the multi-layer LSTM, the hidden layer vectors of each moment are finally obtained
Figure BDA0002526266680000076
For convenience of description, use h1,h2,…,hTInstead of this. Computing the hidden layer vector h of each LSTM unit of the encoder1,h2,…,hTD respectively with the state of the decodert＝Concatnate(St-1,Y′t-1) Of the degree of correlation, wherein St-1Indicating the hidden layer state, Y ', of the decoder at the time immediately before the LSTM cell't-1Representing the true value, D, of a time instant on the LSTM unit of the decodertFinger joint St-1And Y't-1The vectors connected by columns, will St-1And Y't-1The connection and re-correlation calculation is to guide the calculation of the correlation by the real value of the last moment, and finally the normalization weight a of each hidden layer vector is obtained by using softmax normalizationijThe calculation formula is as follows:
Figure BDA0002526266680000081
Figure BDA0002526266680000082
wherein eijState D representing the i-th moment of the decodertAnd the state h of the jth hidden layer of the encoderjCan learn e through a neural networkijIn which V isa、WaAnd UaThe method is a weight parameter needing to be learned, and in consideration of the effectiveness of historical time sequence information, a Soft Attention mechanism (Soft Attention) is adopted to distribute weights to the states of hidden layers of all encoders;
state h for hidden layer of encoder1,h2,…,hTCarrying out weighted summation to obtain a coding vector C corresponding to the ith moment of the decoderiThe calculation formula is as follows:
Figure BDA0002526266680000083
the decoder is realized by adopting a single-layer LSTM neural network, the features obtained by coding are decoded based on the single-layer LSTM, real data are taken as input, values of KPIs data at future moments of a plurality of cloud servers are output, and a many-to-many time sequence prediction model is constructed, specifically as follows:
the state update of the decoder's LSTM is as follows:
Figure BDA0002526266680000084
wherein St-1Represents the hidden layer state at the previous time, Y't-1Representing the true value, S, of the last instantt-1Is composed of (h)t-1,ct-1) C represents a coded vector output by the coder; the first moment of the decoder uses the coding vector C to initialize the state of the hidden layer and the state of the memory unit, and the input is 0; the state of the hidden layer at the later moment is updated as the state of the common LSTM, but the input of the training comprises a coding vector and a real value at the previous moment, the predicted value at the previous moment is not taken as the input to avoid accumulative error, and the input packet is input during verification and testIncluding the coding vector and the predicted value at the previous moment; according to the output h of the decoder at time ttA predicted value at time t can be obtained, and a linear layer is usually added to adjust the dimension of the target output sequence, as shown in formula (7):
Yt＝linear(ht)； (7)
finally obtaining the predicted value of the P step by outputting the predicted values one by one
Figure BDA0002526266680000091
Figure BDA0002526266680000092
Wherein Xi＝{x(1),x(2),…,x(m)}。
As shown in fig. 3, a many-to-many time sequence prediction model is trained according to a Bagging integration algorithm based on sliding window subsequence random sampling, which specifically includes the following steps:
the method comprises the steps of segmenting input multi-dimensional cloud server historical KPIs time sequence data in a sliding window mode to obtain a subsequence set, then sampling the subsequence set by a non-replaced random sampling method, in order to guarantee diversity of an individual predictor, randomly taking two thirds of the number of the subsequence set for each training sample to finally obtain M subsequence sets, training a constructed many-to-many time sequence prediction model by taking the subsequence sets as a training set to obtain the individual predictor, and finally integrating the individual predictors to obtain an integrated predictor, namely the trained many-to-many time sequence prediction model.
In this embodiment, the sliding window based subsequence random sampling is shown in fig. 4, where N is the length of the training set, T is the length of the time sequence of LSTM input, P is the predicted number of steps, in order to fully mine the subsequence pattern, the sliding window is set to 1, and the number of finally obtained subsequences is N- (T + P) + 1. After the subsequence sets are obtained, random sampling without returning is adopted, in order to ensure the diversity of the individual predictor, only two thirds of the number of the subsequence sets are randomly taken from samples trained each time, M small data sets are obtained in total, many-to-many individual predictors are trained by using the seq2seq model based on the attention stacking LSTMs based on each small data set to obtain M many-to-many individual predictors in total, and all the individual predictors are integrated to obtain an integrated predictor, namely a trained many-to-many time sequence prediction model.
The structure diagram of the multivariate abnormality detection model is shown in fig. 5, and the multivariate abnormality detection model is an abnormality detection model generated based on abnormal values, and a generator and a discriminator are constructed by using a multilayer fully-connected neural network. The construction and training of a multivariate anomaly detection model are completed by adopting a pseudo label data generation method based on a stacking automatic encoder and K-Means + + clustering and an unsupervised multivariate anomaly detection training method based on a multi-target generation countermeasure network, and the method specifically comprises the following steps:
reducing the dimension of time series data of KPIs (Key Performance indicators) of a cloud server comprising a plurality of variables by adopting a stacking automatic encoder, clustering the time series data after dimension reduction by adopting a K-Means + + algorithm to obtain K clusters, removing the cluster containing the least number of data points as a suspected abnormal data cluster, and marking a pseudo label representing normal data on the data of other clusters;
the method comprises the steps of generating potential abnormal data by adopting a plurality of sub-generators with differences, combining the obtained data with a pseudo label representing normal, inputting the data into a discriminator for training, generating abnormal data similar to real data as much as possible by a multi-target generator, discriminating the generated abnormal data and normal data as much as possible by the discriminator, and taking the finally obtained discriminator as an abnormality detection two-classifier, namely a trained multivariable abnormality detection model.
Further, dimension reduction is carried out on the complex time sequence by using a stacking automatic encoder, the stacking automatic encoder adopts a plurality of single-layer automatic encoders, the single-layer automatic encoders are realized through a fully-connected neural network and are unsupervised artificial neural networks, the output target of the single-layer automatic encoders is input, and the realization process of the automatic encoders comprises two stages:
the first stage is an encoding stage, in which the auto-encoder (AE) obtains the hidden state a (x) by encoding the input data, as shown in equation (8):
a(X)＝f(W1X+b1)； (8)
wherein X is the input, W1Is a weight vector, b1Is a bias unit, f is a nonlinear activation function;
the second stage is a decoding stage, in which the Automatic Encoder (AE) reconstructs a (X) obtained by encoding, and the decoding obtains X' close to the input, as shown in formula (9):
X′＝f(W2a(X)+b2)； (9)
wherein W2Is a weight vector, b2The offset unit is used for considering that the hidden layer state a (X) is abstract characteristic representation of input data when the output X' is equal to or close to the input X;
the Stack Automatic Encoders (SAEs) learn the input data layer by simulating a multilayer expression mode of brain perception data, and extract deeper and more abstract features. FIG. 6 illustrates a training process for Stacked Autoencoders (SAEs) comprising a plurality of single-layer autoencoders that map inputs to a hidden layer, wherein after a first Autoencoder (AE) is trained, a reconstructed layer of the first Autoencoder (AE) is discarded, the hidden layer becomes an input layer of a second single-layer Autoencoder (AE), and so are subsequent layers, and the same objective function and optimization algorithm are used for training each layer of Autoencoder (AE); and the complex time sequence is subjected to dimensionality reduction through a stacking automatic encoder to obtain a characteristic representation after dimensionality reduction.
Further, clustering the complex time sequence data after dimensionality reduction by using a K-Means + + clustering algorithm; K-Means is one of classic clustering algorithms, the core idea is that a first clustering center is selected randomly, when the ith clustering center is selected, the probability that a point which is farther away from the previous i-1 clustering centers is selected is higher, wherein i is greater than 1; the calculation of the distance between the sample and the clustering center point and the probability that the sample point X is selected as the clustering center in the K-Means + + clustering process are respectively shown as a formula (10) and a formula (11):
Figure BDA0002526266680000101
Figure BDA0002526266680000102
where m is the dimension of the data point, xiAnd ciRespectively, the ith dimension data point for sample point X and cluster center C.
As shown in fig. 5, the generator and the arbiter both use a multi-layer fully-connected neural network; generation of exception data G by using k generators1(z1),G2(z2),G3(z3),…,Gk(zk)},ziThe method comprises the steps that input random data are distributed, abnormal data generated by a plurality of sub-generators are integrated, finally the generated abnormal data and data with a marked false label representing normal are input into a discriminator for training, when training begins, the generator G cannot generate abnormal values with diversity, so that the discriminator D obtains a rough boundary, but through multiple iterations, the generator G gradually learns a normal data generation mechanism of a mini-max game between G and D, and generates abnormal data with diversity; when the mini-max game reaches Nash equilibrium, namely the discriminator can hardly distinguish normal data or generated abnormal data, the training of the generator is stopped, the discriminator is continuously trained, and the discrimination error of the discriminator is further reduced; finally, the discriminator is able to correctly describe the boundary of normal data and abnormal data, and for a given data point, the discriminator outputs the probability that the data point will become normal data.
S3, predicting KPIs data of the cloud server at a future moment by using a trained many-to-many time sequence prediction model;
s4, carrying out anomaly detection on the KPIs data at the predicted future time by using the trained multivariate anomaly detection model to obtain the anomaly probability of each future time data point;
and S5, using the abnormal probability of the KPIs data points at the future time of the cloud server output by the trained multivariate abnormal detection model, setting the threshold value of the abnormal probability to be 0.5, judging the data points to be abnormal if the threshold value is larger than the threshold value, and otherwise, judging the data points to be normal data points.

Claims (10)

1. A two-stage cloud server unsupervised anomaly prediction method is characterized by comprising the following steps:
s1, performing missing value processing, data formatting and data normalization processing on the collected historical KPIs data of the cloud server;
s2, training a many-to-many time sequence prediction model and a multivariate abnormality detection model according to the preprocessed historical KPIs time sequence data of the cloud server;
s3, predicting KPIs data of the cloud server at a future moment by using a trained many-to-many time sequence prediction model;
s4, carrying out anomaly detection on the KPIs data at the predicted future time by using the trained multivariate anomaly detection model to obtain the anomaly probability of each future time data point;
s5, setting an abnormal probability threshold, judging whether the data point is an abnormal data point according to the abnormal probability of the data point, wherein the data point which is larger than the abnormal probability threshold is considered to be an abnormal data point, otherwise, the data point is a normal data point, and obtaining the result of abnormal prediction.
2. The unsupervised anomaly prediction method for the two-phase cloud server according to claim 1, wherein in step S1, the missing value processing means that for every missing value, that is, no more than 5 consecutive missing values in a certain row or a certain column, the average value of the latest 24 non-missing values is used for completion and repair; directly removing missing values when the number of the continuous missing values, namely the number of the continuous missing values of a certain row or a certain column, exceeds 5;
the data formatting refers to converting a category time sequence into a numerical time sequence by adopting an enumeration mode for the category time sequence of a certain dimension;
and the data normalization processing refers to normalizing the KPIs data of the cloud server after missing value processing and data formatting, and distributing the KPIs data in [0,1 ].
3. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 1, wherein in step S2, the many-to-many time series prediction model comprises an encoder and a decoder, the encoder is configured to fully extract features of KPIs time series data, and the decoder is configured to decode the extracted features and output predicted values at future time; the input time sequence is
Figure FDA0002526266670000011
Wherein Xi＝{x(1),x(2),…,x(m)Predicting P-step KPIs time sequence of future time
Figure FDA0002526266670000012
Figure FDA0002526266670000013
Wherein Xi＝{x(1),x(2),…,x(m)The input sequence X is a multivariate time sequence, T represents the length of X, and m represents the dimension of X; the predicted target time series Y is a multivariate time series, where P represents the predicted number of steps;
the encoder is realized by adopting a multi-layer stacked LSTM neural network, aims to fully extract time sequence characteristics of time sequence data of KPIs (Key Performance indicators) of a plurality of cloud servers, and provides characteristic input with weight, namely an encoding vector, for training of a prediction model by adopting an attention mechanism, and specifically comprises the following steps:
the state of the LSTM unit of the encoder needs to be transferred while considering the hidden state of the previous LSTM unit and the hidden state of the next layer of LSTM unit, that is:
Figure FDA0002526266670000021
wherein
Figure FDA0002526266670000022
And
Figure FDA0002526266670000023
respectively representing a k layer, a memory unit state and a hidden layer state at the moment T, wherein L represents the number of stacked LSTMs, and T represents the length of an input time sequence; through the feature extraction of the multi-layer LSTM, the hidden layer vectors of each moment are finally obtained
Figure FDA0002526266670000024
For convenience of description, use h1,h2,…,hTInstead of this;
computing the hidden layer vector h of each LSTM unit of the encoder1,h2,…,hTD respectively with the state of the decodert＝Concatnate(St-1,Y′t-1) Of the degree of correlation, wherein St-1Indicating the hidden layer state, Y ', of the decoder at the time immediately before the LSTM cell't-1Representing the true value, D, of a time instant on the LSTM unit of the decodertFinger joint St-1And Y't-1The vectors connected by columns, will St-1And Y't-1The connection and re-correlation calculation is to guide the calculation of the correlation by the real value of the last moment, and finally the normalization weight a of each hidden layer vector is obtained by using softmax normalizationijThe calculation formula is as follows:
Figure FDA0002526266670000025
Figure FDA0002526266670000026
wherein eijState D representing the i-th moment of the decodertAnd the state h of the jth hidden layer of the encoderjCan learn e through a neural networkijIn which V isa、WaAnd UaIs a weight parameter to be learned, considering the historical time sequenceThe validity of column information adopts a Soft Attention mechanism (Soft Attention), and weights are distributed to the states of hidden layers of all encoders;
state h for hidden layer of encoder1,h2,…,hTCarrying out weighted summation to obtain a coding vector C corresponding to the ith moment of the decoderiThe calculation formula is as follows:
Figure FDA0002526266670000027
4. the unsupervised anomaly prediction method for the two-stage cloud server according to claim 3, wherein a decoder is implemented by using a single-layer LSTM neural network, the features obtained by encoding are decoded based on the single-layer LSTM, real data is used as input, values of KPIs (Key Performance indicators) data at future moments of a plurality of cloud servers are output, and a many-to-many time series prediction model is constructed, specifically as follows:
the state update of the decoder's LSTM is as follows:
Figure FDA0002526266670000028
wherein St-1Represents the hidden layer state at the previous time, Y't-1Representing the true value, S, of the last instantt-1Is composed of (h)t-1,ct-1) C represents a coded vector output by the coder; the first moment of the decoder uses the coding vector C to initialize the state of the hidden layer and the state of the memory unit, and the input is 0; the state of the hidden layer at the later moment is updated as the state of the common LSTM, but the state of the hidden layer at the later moment comprises an encoding vector and a real value at the previous moment when training, and the state of the hidden layer at the later moment comprises an encoding vector and a predicted value at the previous moment when verifying and testing; according to the output h of the decoder at time ttA predicted value at time t can be obtained, and a linear layer is usually added to adjust the dimension of the target output sequence, as shown in formula (7):
Yt＝linear(ht)； (7)
finally obtaining the predicted value of the P step by outputting the predicted values one by one
Figure FDA0002526266670000031
Figure FDA0002526266670000032
Wherein Xi＝{x(1),x(2),…,x(m)}。
5. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 1, wherein a many-to-many time sequence prediction model is trained according to a Bagging integration algorithm based on sliding window subsequence random sampling, which is specifically as follows:
the method comprises the steps of segmenting input multi-dimensional cloud server historical KPIs time sequence data in a sliding window mode to obtain a subsequence set, then sampling the subsequence set by a non-replaced random sampling method, in order to guarantee diversity of an individual predictor, randomly taking two thirds of the number of the subsequence set for each training sample to finally obtain M subsequence sets, training a constructed many-to-many time sequence prediction model by taking the subsequence sets as a training set to obtain the individual predictor, and finally integrating the individual predictors to obtain an integrated predictor, namely the trained many-to-many time sequence prediction model.
6. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 1, wherein in step S2, the multivariate anomaly detection model is an anomaly detection model generated based on an abnormal value, and a generator and a discriminator are constructed by using a multi-layer fully-connected neural network; the construction and training of a multivariate anomaly detection model are completed by adopting a pseudo label data generation method based on a stack automatic encoder and K-Means + + clustering and an unsupervised multivariate anomaly detection training method based on a multi-target generation countermeasure network, and the method specifically comprises the following steps:
reducing the dimension of time series data of KPIs (Key Performance indicators) of a cloud server comprising a plurality of variables by adopting a stacking automatic encoder, clustering the time series data after dimension reduction by adopting a K-Means + + algorithm to obtain K clusters, removing the cluster containing the least number of data points as a suspected abnormal data cluster, and marking a pseudo label representing normal data on the data of other clusters;
the method comprises the steps of generating potential abnormal data by adopting a plurality of sub-generators with differences, combining the obtained data with a pseudo label representing normal, inputting the data into a discriminator for training, generating abnormal data similar to real data as much as possible by a multi-target generator, discriminating the generated abnormal data and normal data as much as possible by the discriminator, and taking the finally obtained discriminator as an abnormality detection two-classifier, namely a trained multivariable abnormality detection model.
7. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 6, wherein dimension reduction is performed on the complex time sequence by using a stacked automatic encoder, the stacked automatic encoder adopts a plurality of single-layer automatic encoders, the single-layer automatic encoders are realized by a fully-connected neural network, the single-layer automatic encoders are unsupervised artificial neural networks, the output targets of the single-layer automatic encoders are input, and the realization process of the automatic encoders comprises two stages:
the first stage is an encoding stage, in which the auto-encoder (AE) obtains the hidden state a (x) by encoding the input data, as shown in equation (8):
a(X)＝f(W1X+b1)； (8)
wherein X is the input, W1Is a weight vector, b1Is a bias unit, f is a nonlinear activation function;
the second stage is a decoding stage, in which the Automatic Encoder (AE) reconstructs a (X) obtained by encoding, and the decoding obtains X' close to the input, as shown in formula (9):
X′＝f(W2a(X)+b2)； (9)
wherein W2Is a weight vector, b2The offset unit is used for considering that the hidden layer state a (X) is abstract characteristic representation of input data when the output X' is equal to or close to the input X;
the method comprises the steps that a Stacking Automatic Encoder (SAEs) learns input data layer by simulating a multilayer expression mode of brain perception data, and extracts deeper and more abstract features; the Stacking Automatic Encoders (SAEs) comprise a plurality of single-layer automatic encoders, the single-layer Automatic Encoders (AE) map input to a hidden layer, after the first Automatic Encoder (AE) is trained, a reconstruction layer of the first Automatic Encoder (AE) is discarded, the hidden layer becomes an input layer of a second single-layer Automatic Encoder (AE), and subsequent layers are also the same, and the same objective function and optimization algorithm are adopted for training of each layer of Automatic Encoders (AE); and the complex time sequence is subjected to dimensionality reduction through a stacking automatic encoder to obtain a characteristic representation after dimensionality reduction.
8. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 6, characterized in that the complex time series data after dimensionality reduction is clustered using a K-Means + + clustering algorithm; K-Means is one of classic clustering algorithms, the core idea is that a first clustering center is selected randomly, when the ith clustering center is selected, the probability that a point which is farther away from the previous i-1 clustering centers is selected is higher, wherein i is greater than 1; the calculation of the distance between the sample and the clustering center point and the probability that the sample point X is selected as the clustering center in the K-Means + + clustering process are respectively shown as a formula (10) and a formula (11):
Figure FDA0002526266670000041
Figure FDA0002526266670000042
where m is the dimension of the data point, xiAnd ciRespectively, the ith dimension data point for sample point X and cluster center C.
9. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 6, wherein the generator and the arbiter both adopt a multilayer fully-connected neural network; generation of exception data G by using k generators1(z1),G2(z2),G3(z3),…,Gk(zk)},ziThe method comprises the steps that input random data are distributed, abnormal data generated by a plurality of sub-generators are integrated, the generated abnormal data and data with a normal pseudo label are input into a discriminator to be trained, when the training is started, the generator G cannot generate abnormal values with diversity, so that the discriminator D obtains a rough boundary, the generator G gradually learns a normal data generation mechanism of a mini-max game between G and D through multiple iterations, and the abnormal data with diversity is generated; when the mini-max game reaches Nash equilibrium, namely the discriminator can hardly distinguish normal data or generated abnormal data, the training of the generator is stopped, the discriminator is continuously trained, and the discrimination error of the discriminator is further reduced; finally, the discriminator is able to correctly describe the boundary of normal data and abnormal data, and for a given data point, the discriminator outputs the probability that the data point will become normal data.
10. The unsupervised anomaly prediction method for the two-stage cloud server according to claim 1, wherein in step S5, the anomaly probability of the KPIs data points at the future time of the cloud server output by the trained multivariate anomaly detection model is set, and the threshold of the anomaly probability is set to 0.5, and if the threshold is greater than the threshold, the data points are determined to be abnormal data points, otherwise, the data points are normal data points.
CN202010505118.5A 2020-06-05 2020-06-05 Two-stage cloud server unsupervised anomaly prediction method Pending CN111914873A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010505118.5A CN111914873A (en) 2020-06-05 2020-06-05 Two-stage cloud server unsupervised anomaly prediction method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010505118.5A CN111914873A (en) 2020-06-05 2020-06-05 Two-stage cloud server unsupervised anomaly prediction method

Publications (1)

Publication Number Publication Date
CN111914873A true CN111914873A (en) 2020-11-10

Family

ID=73237438

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010505118.5A Pending CN111914873A (en) 2020-06-05 2020-06-05 Two-stage cloud server unsupervised anomaly prediction method

Country Status (1)

Country Link
CN (1) CN111914873A (en)

Cited By (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112416662A (en) * 2020-11-26 2021-02-26 清华大学 Multi-time series data anomaly detection method and device
CN112488235A (en) * 2020-12-11 2021-03-12 江苏省特种设备安全监督检验研究院 Elevator time sequence data abnormity diagnosis method based on deep learning
CN112487053A (en) * 2020-11-27 2021-03-12 重庆医药高等专科学校 Abnormal control extraction working method for mass financial data
CN112527860A (en) * 2020-12-05 2021-03-19 东南大学 Method for improving typhoon track prediction
CN112597704A (en) * 2020-12-24 2021-04-02 东北大学 Engine abnormity reason analysis method, system, equipment and medium
CN112654060A (en) * 2020-12-18 2021-04-13 中国计量大学 Device abnormality detection method and system
CN112671768A (en) * 2020-12-24 2021-04-16 四川虹微技术有限公司 Abnormal flow detection method and device, electronic equipment and storage medium
CN112685950A (en) * 2020-12-02 2021-04-20 山东省计算中心（国家超级计算济南中心） Method, system and equipment for detecting abnormality of ocean time sequence observation data
CN112783740A (en) * 2020-12-30 2021-05-11 科大国创云网科技有限公司 Server performance prediction method and system based on time series characteristics
CN112784965A (en) * 2021-01-28 2021-05-11 广西大学 Large-scale multi-element time series data abnormity detection method oriented to cloud environment
CN112800403A (en) * 2021-01-05 2021-05-14 北京小米松果电子有限公司 Method, apparatus and medium for generating prediction model and predicting fingerprint recognition abnormality
CN112991579A (en) * 2021-01-14 2021-06-18 北京航空航天大学 Helicopter mobile part abnormity detection method based on generation countermeasure network
CN112988550A (en) * 2021-05-21 2021-06-18 神威超算(北京)科技有限公司 Server failure prediction method, device and computer readable medium
CN113037783A (en) * 2021-05-24 2021-06-25 中南大学 Abnormal behavior detection method and system
CN113076215A (en) * 2021-04-08 2021-07-06 华南理工大学 Unsupervised anomaly detection method independent of data types
CN113127705A (en) * 2021-04-02 2021-07-16 西华大学 Heterogeneous bidirectional generation countermeasure network model and time sequence anomaly detection method
CN113242207A (en) * 2021-04-02 2021-08-10 河海大学 Iterative clustering network flow abnormity detection method
CN113255573A (en) * 2021-06-17 2021-08-13 成都东方天呈智能科技有限公司 Pedestrian re-identification method based on mixed cluster center label learning and storage medium
CN113298128A (en) * 2021-05-14 2021-08-24 西安理工大学 Cloud server anomaly detection method based on time series clustering
CN113435656A (en) * 2021-07-06 2021-09-24 郑州航空工业管理学院 Visual management method and system for project progress
CN113517046A (en) * 2021-04-15 2021-10-19 中南大学 Heterogeneous data feature fusion method in electronic medical record, prediction method and system based on fusion features and readable storage medium
CN113568774A (en) * 2021-07-27 2021-10-29 东华大学 Real-time anomaly detection method for multi-dimensional time sequence data by using unsupervised deep neural network
CN113705981A (en) * 2021-08-03 2021-11-26 彭亮 Big data based anomaly monitoring method and device
CN113962142A (en) * 2021-09-26 2022-01-21 西安交通大学 Data center temperature prediction method and system based on two-segment type LSTM
CN114090396A (en) * 2022-01-24 2022-02-25 华南理工大学 Cloud environment multi-index unsupervised anomaly detection and root cause analysis method
CN114240243A (en) * 2021-12-30 2022-03-25 无锡雪浪数制科技有限公司 Rectifying tower product quality prediction method and device based on dynamic system identification
CN114358422A (en) * 2022-01-04 2022-04-15 中国工商银行股份有限公司 Research and development progress abnormity prediction method and device, storage medium and electronic equipment
CN114615051A (en) * 2022-03-09 2022-06-10 黄河水利职业技术学院 Network security detection method and system
CN114925808A (en) * 2022-04-15 2022-08-19 北京理工大学 Abnormal detection method based on incomplete time sequence in cloud network terminal resource
CN115269357A (en) * 2022-09-23 2022-11-01 华南理工大学 Micro-service abnormity detection method based on call chain
CN115328062A (en) * 2022-08-31 2022-11-11 济南永信新材料科技有限公司 Intelligent control system for spunlace production line
WO2023045829A1 (en) * 2021-09-24 2023-03-30 中兴通讯股份有限公司 Service abnormality prediction method and device, storage medium, and electronic device
CN116108371A (en) * 2023-04-13 2023-05-12 西华大学 Cloud service abnormity diagnosis method and system based on cascade abnormity generation network
CN116361673A (en) * 2023-06-01 2023-06-30 西南石油大学 Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal
CN116383096A (en) * 2023-06-06 2023-07-04 安徽思高智能科技有限公司 Micro-service system anomaly detection method and device based on multi-index time sequence prediction
WO2024013597A1 (en) * 2022-07-14 2024-01-18 International Business Machines Corporation Fully unsupervised pipeline for clustering anomalies detected in computerized systems

Cited By (55)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112416662A (en) * 2020-11-26 2021-02-26 清华大学 Multi-time series data anomaly detection method and device
CN112487053A (en) * 2020-11-27 2021-03-12 重庆医药高等专科学校 Abnormal control extraction working method for mass financial data
CN112685950A (en) * 2020-12-02 2021-04-20 山东省计算中心（国家超级计算济南中心） Method, system and equipment for detecting abnormality of ocean time sequence observation data
CN112685950B (en) * 2020-12-02 2022-05-20 山东省计算中心（国家超级计算济南中心） Method, system and equipment for detecting abnormality of ocean time sequence observation data
CN112527860A (en) * 2020-12-05 2021-03-19 东南大学 Method for improving typhoon track prediction
CN112488235A (en) * 2020-12-11 2021-03-12 江苏省特种设备安全监督检验研究院 Elevator time sequence data abnormity diagnosis method based on deep learning
CN112654060A (en) * 2020-12-18 2021-04-13 中国计量大学 Device abnormality detection method and system
CN112597704A (en) * 2020-12-24 2021-04-02 东北大学 Engine abnormity reason analysis method, system, equipment and medium
CN112671768A (en) * 2020-12-24 2021-04-16 四川虹微技术有限公司 Abnormal flow detection method and device, electronic equipment and storage medium
CN112597704B (en) * 2020-12-24 2024-02-06 东北大学 Engine abnormality cause analysis method, system, equipment and medium
CN112783740A (en) * 2020-12-30 2021-05-11 科大国创云网科技有限公司 Server performance prediction method and system based on time series characteristics
CN112800403B (en) * 2021-01-05 2024-05-03 北京小米松果电子有限公司 Method, device and medium for generating prediction model and predicting fingerprint identification abnormality
CN112800403A (en) * 2021-01-05 2021-05-14 北京小米松果电子有限公司 Method, apparatus and medium for generating prediction model and predicting fingerprint recognition abnormality
CN112991579A (en) * 2021-01-14 2021-06-18 北京航空航天大学 Helicopter mobile part abnormity detection method based on generation countermeasure network
CN112784965A (en) * 2021-01-28 2021-05-11 广西大学 Large-scale multi-element time series data abnormity detection method oriented to cloud environment
CN112784965B (en) * 2021-01-28 2022-07-29 广西大学 Large-scale multi-element time series data anomaly detection method oriented to cloud environment
CN113127705A (en) * 2021-04-02 2021-07-16 西华大学 Heterogeneous bidirectional generation countermeasure network model and time sequence anomaly detection method
CN113242207A (en) * 2021-04-02 2021-08-10 河海大学 Iterative clustering network flow abnormity detection method
CN113242207B (en) * 2021-04-02 2022-06-17 河海大学 Iterative clustering network flow abnormity detection method
CN113076215A (en) * 2021-04-08 2021-07-06 华南理工大学 Unsupervised anomaly detection method independent of data types
CN113517046A (en) * 2021-04-15 2021-10-19 中南大学 Heterogeneous data feature fusion method in electronic medical record, prediction method and system based on fusion features and readable storage medium
CN113517046B (en) * 2021-04-15 2023-11-07 中南大学 Heterogeneous data feature fusion method in electronic medical record, fusion feature-based prediction method, fusion feature-based prediction system and readable storage medium
CN113298128A (en) * 2021-05-14 2021-08-24 西安理工大学 Cloud server anomaly detection method based on time series clustering
CN113298128B (en) * 2021-05-14 2024-04-02 西安理工大学 Cloud server anomaly detection method based on time sequence clustering
CN112988550A (en) * 2021-05-21 2021-06-18 神威超算(北京)科技有限公司 Server failure prediction method, device and computer readable medium
CN113037783B (en) * 2021-05-24 2021-08-06 中南大学 Abnormal behavior detection method and system
CN113037783A (en) * 2021-05-24 2021-06-25 中南大学 Abnormal behavior detection method and system
CN113255573A (en) * 2021-06-17 2021-08-13 成都东方天呈智能科技有限公司 Pedestrian re-identification method based on mixed cluster center label learning and storage medium
CN113435656B (en) * 2021-07-06 2023-05-30 郑州航空工业管理学院 Project progress visual management method and system
CN113435656A (en) * 2021-07-06 2021-09-24 郑州航空工业管理学院 Visual management method and system for project progress
CN113568774A (en) * 2021-07-27 2021-10-29 东华大学 Real-time anomaly detection method for multi-dimensional time sequence data by using unsupervised deep neural network
CN113568774B (en) * 2021-07-27 2024-01-16 东华大学 Multi-dimensional time sequence data real-time abnormality detection method using unsupervised deep neural network
CN113705981A (en) * 2021-08-03 2021-11-26 彭亮 Big data based anomaly monitoring method and device
CN113705981B (en) * 2021-08-03 2022-08-30 北京鼎信泰德科技有限公司 Big data based anomaly monitoring method and device
WO2023045829A1 (en) * 2021-09-24 2023-03-30 中兴通讯股份有限公司 Service abnormality prediction method and device, storage medium, and electronic device
CN113962142A (en) * 2021-09-26 2022-01-21 西安交通大学 Data center temperature prediction method and system based on two-segment type LSTM
CN113962142B (en) * 2021-09-26 2024-04-19 西安交通大学 Data center temperature prediction method and system based on two-section LSTM
CN114240243B (en) * 2021-12-30 2022-10-11 无锡雪浪数制科技有限公司 Rectifying tower product quality prediction method and device based on dynamic system identification
CN114240243A (en) * 2021-12-30 2022-03-25 无锡雪浪数制科技有限公司 Rectifying tower product quality prediction method and device based on dynamic system identification
WO2023123779A1 (en) * 2021-12-30 2023-07-06 无锡雪浪数制科技有限公司 Dynamic system identification-based product quality prediction method and device for rectification column
CN114358422A (en) * 2022-01-04 2022-04-15 中国工商银行股份有限公司 Research and development progress abnormity prediction method and device, storage medium and electronic equipment
CN114090396A (en) * 2022-01-24 2022-02-25 华南理工大学 Cloud environment multi-index unsupervised anomaly detection and root cause analysis method
CN114615051A (en) * 2022-03-09 2022-06-10 黄河水利职业技术学院 Network security detection method and system
CN114925808B (en) * 2022-04-15 2023-10-10 北京理工大学 Anomaly detection method based on incomplete time sequence in cloud network end resource
CN114925808A (en) * 2022-04-15 2022-08-19 北京理工大学 Abnormal detection method based on incomplete time sequence in cloud network terminal resource
WO2024013597A1 (en) * 2022-07-14 2024-01-18 International Business Machines Corporation Fully unsupervised pipeline for clustering anomalies detected in computerized systems
US11853019B1 (en) 2022-08-31 2023-12-26 Jinan Winson New Materials Technology Co., Ltd. Intelligent control of spunlace production line using classification of current production state of real-time production line data
CN115328062A (en) * 2022-08-31 2022-11-11 济南永信新材料科技有限公司 Intelligent control system for spunlace production line
CN115269357A (en) * 2022-09-23 2022-11-01 华南理工大学 Micro-service abnormity detection method based on call chain
CN115269357B (en) * 2022-09-23 2023-02-14 华南理工大学 Micro-service abnormity detection method based on call chain
CN116108371A (en) * 2023-04-13 2023-05-12 西华大学 Cloud service abnormity diagnosis method and system based on cascade abnormity generation network
CN116361673B (en) * 2023-06-01 2023-08-11 西南石油大学 Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal
CN116361673A (en) * 2023-06-01 2023-06-30 西南石油大学 Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal
CN116383096B (en) * 2023-06-06 2023-08-18 安徽思高智能科技有限公司 Micro-service system anomaly detection method and device based on multi-index time sequence prediction
CN116383096A (en) * 2023-06-06 2023-07-04 安徽思高智能科技有限公司 Micro-service system anomaly detection method and device based on multi-index time sequence prediction

Similar Documents

Publication Publication Date Title
CN111914873A (en) Two-stage cloud server unsupervised anomaly prediction method
CN112784965B (en) Large-scale multi-element time series data anomaly detection method oriented to cloud environment
CN111967571B (en) Abnormality detection method and device based on MHMA
CN113312447B (en) Semi-supervised log anomaly detection method based on probability label estimation
CN113673346B (en) Motor vibration data processing and state identification method based on multiscale SE-Resnet
CN113642754B (en) Complex industrial process fault prediction method based on RF noise reduction self-coding information reconstruction and time convolution network
CN114386521A (en) Method, system, device and storage medium for detecting abnormality of time-series data
CN112257263B (en) Equipment residual life prediction system based on self-attention mechanism
Gu et al. An improved sensor fault diagnosis scheme based on TA-LSSVM and ECOC-SVM
Silva et al. Assets predictive maintenance using convolutional neural networks
CN115587335A (en) Training method of abnormal value detection model, abnormal value detection method and system
CN116522265A (en) Industrial Internet time sequence data anomaly detection method and device
CN117034143A (en) Distributed system fault diagnosis method and device based on machine learning
CN115905959A (en) Method and device for analyzing relevance fault of power circuit breaker based on defect factor
Tang et al. Prediction of bearing performance degradation with bottleneck feature based on LSTM network
You et al. sBiLSAN: Stacked bidirectional self-attention lstm network for anomaly detection and diagnosis from system logs
Li et al. Source-free domain adaptation framework for fault diagnosis of rotation machinery under data privacy
CN114626426A (en) Industrial equipment behavior detection method based on K-means optimization algorithm
WO2023231374A1 (en) Semi-supervised fault detection and analysis method and apparatus for mechanical device, terminal, and medium
CN116628612A (en) Unsupervised anomaly detection method, device, medium and equipment
CN114580472B (en) Large-scale equipment fault prediction method with repeated cause and effect and attention in industrial internet
Chen et al. A two-stage approach based on Bayesian deep learning for predicting remaining useful life of rolling element bearings
Li et al. Knowledge enhanced ensemble method for remaining useful life prediction under variable working conditions
CN113821401A (en) WT-GA-GRU model-based cloud server fault diagnosis method
Lin Intelligent Fault Diagnosis of Consumer Electronics Sensor in IoE via Transformer

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination