CN107066365A - The monitoring method and device of a kind of system exception - Google Patents
The monitoring method and device of a kind of system exception Download PDFInfo
- Publication number
- CN107066365A CN107066365A CN201710089648.4A CN201710089648A CN107066365A CN 107066365 A CN107066365 A CN 107066365A CN 201710089648 A CN201710089648 A CN 201710089648A CN 107066365 A CN107066365 A CN 107066365A
- Authority
- CN
- China
- Prior art keywords
- dimension
- abnormal
- submodel
- sample data
- goal systems
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
This application discloses a kind of monitoring method of system exception and device, first, determine the characteristic value for each dimension that goal systems is produced, the abnormal judgment models completed afterwards according to training in advance, determine that abnormal probability occurs in the goal systems, when the probability be in the corresponding small probability of the abnormal judgment models it is interval when, determine that the goal systems occurs abnormal.It can be seen that the method provided by the application, the abnormal judgment models completed according to training, determine the running situation of the goal systems, can be according to the practical operation situation of the goal systems, make respective handling, the probability for wrong report occur extremely to goal systems, failing to report is reduced relative to prior art, monitoring accuracy rate and monitoring efficiency is improved.
Description
Technical field
The application is related to areas of information technology, more particularly to a kind of system exception monitoring method and device.
Background technology
With the development of information technology, service provider provides the user the service of more and more species, this result in for
The system that user provides service is huge all the more, and involves very wide.
May be delayed many reasons such as machine, third party's time-out generally in system operation due to network delay, equipment, be occurred
The phenomenon of system exception causes system interim card, gently then influences running efficiency of system, heavy then cause the business in system can not be normal
Carry out, so one side people are directed to the phenomenon of the smooth operation reduction system exception of guarantee system, it is on the other hand how right
System exception carries out early warning, and when interim card occurs in system, finds as early as possible and to take counter-measure also to turn into people as early as possible
Issues that need special attention.
In the prior art, the method that people use when judging system exception is, for each equipment in the system,
Corresponding alarm threshold when setting the equipment normally to run, and monitor the system in each equipment running situation, if monitoring
Corresponding data exceed the corresponding alarm threshold of the equipment during a certain equipment operation, then judge that the equipment occurs abnormal, and may
The appearance led to system abnormity, then now send the alarm signal for the equipment, points out staff's equipment to occur abnormal,
To allow staff is artificial to carry out malfunction elimination to the equipment.Wherein, the equipment in the system includes but is not limited to, in
Central processor (Central Processing Unit, CPU), internal memory, database equipment, correspondence when monitoring each equipment operation
Data include but is not limited to, data call amount, equipment report an error quantity, working condition etc..
But, a kind of phenomenon of normal thrashing is generally there is also once in a while in system operation, that is,
When instantaneous data exception occurs in the equipment in system, the running status of system is caused to be shaken, but this phenomenon belongs to
Normal phenomenon during system operation, is different from the phenomenon of system exception, system occur time for shaking it is shorter can't cause be
Unite interim card, influence the normal operation of system, but, due to when there is thrashing, the number that devices in system is produced when running
According to the default alarm threshold of staff may also can be exceeded, prior art is caused to report the monitoring method of system exception by mistake
Situation.
Further, because for each equipment, different periods of the equipment in one day, its running situation may be endless
It is complete the same, for example, the equipment for providing the user service is generally smaller in morning operating pressure, and it is usual in the operating pressure on daytime
It is larger.Meanwhile, distinct device may also be not quite identical in the running situation of same period, for example, settlement device may be
After terminating daily, induction-arrangement is carried out to the data that are produced in one day, then operating pressure may be larger during morning, daytime then
It is more idle, so in the prior art, it is necessary to the setting alarm threshold of each equipment Selective, and the alarm threshold
Staff may be also needed under different application scene to be adjusted, to avoid failing to report or report by mistake, it is accurately right to cause to be difficult to
System exception is monitored.
It can be seen that, the existing monitoring method to system exception, due to needing staff to be set for distinct device is corresponding
Alarm threshold is put, and according to different application scenarios, adjusts the corresponding alarm threshold of each equipment, causes the monitoring to system exception
Easily occur failing to report and report by mistake, cause the monitoring method of existing system exception, accuracy rate is low.
The content of the invention
The embodiment of the present application provides a kind of monitoring method of system exception, for solving because prior art is different to system
, it is necessary to manually set alarm threshold for each equipment in normal monitoring process, the accuracy rate of the monitoring led to system abnormity is relatively low
Problem.
The embodiment of the present application provides a kind of monitoring device of system exception, for solving because prior art is different to system
, it is necessary to manually set alarm threshold for each equipment in normal monitoring process, the accuracy rate of the monitoring led to system abnormity is relatively low
Problem.
The embodiment of the present application uses following technical proposals：
A kind of monitoring method of system exception, including：
Gather the characteristic value at least one dimension that goal systems is produced；
According to the characteristic value of each dimension and by training obtained abnormal judgment models, determine that the goal systems occurs
Abnormal probability；
When the probability is interval between the corresponding small probability of the abnormal judgment models, determine that the goal systems occurs
It is abnormal.
A kind of monitoring device of system exception, including：
Determining module, the characteristic value at least one dimension that collection goal systems is produced；
Computing module, according to the characteristic value of each dimension and by training obtained abnormal judgment models, determines the mesh
There is abnormal probability in mark system；
Judge module, when the probability is interval between the corresponding small probability of the abnormal judgment models, determines the mesh
Mark system occurs abnormal.
At least one above-mentioned technical scheme that the embodiment of the present application is used can reach following beneficial effect：
First, the characteristic value for each dimension that goal systems is produced is determined, the abnormal judgement obtained afterwards according to training in advance
Model, determines that abnormal probability occurs in the goal systems, and when the probability, to be in the corresponding small probability of the abnormal judgment models interval
When, determine that the goal systems occurs abnormal.It can be seen that the method provided by the application, mould is judged according to the exception that training is completed
Type, determines the running situation of the system, respective handling can be made, relative to prior art according to the actual conditions of the system
The probability for wrong report occur to system exception, failing to report is reduced, monitoring accuracy rate is improved.
Brief description of the drawings
Accompanying drawing described herein is used for providing further understanding of the present application, constitutes the part of the application, this Shen
Schematic description and description please is used to explain the application, does not constitute the improper restriction to the application.In the accompanying drawings：
A kind of monitoring process for system exception that Fig. 1 provides for the embodiment of the present application；
A kind of structural representation of the monitoring device for system exception that Fig. 2 provides for the embodiment of the present application.
Embodiment
To make the purpose, technical scheme and advantage of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described corresponding accompanying drawing.Obviously, described embodiment is only the application one
Section Example, rather than whole embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Go out the every other embodiment obtained under the premise of creative work, belong to the scope of the application protection.
Below in conjunction with accompanying drawing, the technical scheme that each embodiment of the application is provided is described in detail.
A kind of process of the monitoring for system exception that Fig. 1 provides for the embodiment of the present application, specifically may include following steps：
S101：Gather the characteristic value at least one dimension that goal systems is produced.
In the embodiment of the present application, what is the abnormal conditions that goal systems occurs are monitored can be in the goal systems
Monitoring device or the monitoring server independently of the goal systems.Certainly due in order to avoid goal systems interim card
Monitoring of the equipment to the abnormal conditions of the goal systems is caused to be affected, the usual monitoring device is independently of the target system
The monitoring server of system, then in the embodiment of the present application, the monitoring device can also be server, and by the server to this
The monitoring that the abnormal conditions of goal systems are carried out, and the application does not limit whether the server is located in the goal systems,
It can specifically be configured according to the need for practical application.
And in the embodiment of the present application, described each dimension includes but is not limited to：The system amount of the calling dimension, institute
State the called amount dimension of system, the system and call in duration dimension, the system amount of error dimension, the system to database
The amount of calling dimension in one kind；The characteristic value of so described each dimension can be, the different dimensions that the goal systems is produced
The numerical value of data, wherein, the characteristic value of each dimension may include but be not limited to：The value of the amount of calling of the goal systems, the target system
Value, goal systems of the called amount of system call the value and the goal systems of amount of error in the value of duration, the goal systems
At least one of value for the amount of calling to database.That is, the size of the characteristic value of different dimensions can be with corresponding
Represent the operation conditions of the goal systems.
Further, the characteristic value of the different dimensions of the goal systems of the collection of server, that is, above-mentioned different dimensional
Corresponding numerical value is spent, for example, when dimension is called amount, the characteristic value of the dimension can be embodied due to the outside access target
The operating load of the goal systems caused by system, and the concrete numerical value of the called amount can be used for subsequently judging the target system
Whether system there is exception.
In addition, the abnormal conditions progress to goal systems is illustrated how by taking monitoring server as an example in the embodiment of the present application
Monitoring.Server, can be with preset time period (that is, unit interval) when the abnormal conditions to the goal systems are monitored
For monitoring period of time, the characteristic value of each dimension of goal systems generation is monitored, wherein, the monitoring to the goal systems can be connected
Continuous (for example, at the end of the monitoring of last time cycle, getting started the monitoring of next time cycle) or not
Continuously (for example, being monitored daily fixed time period as the time cycle).
Specifically, the server is according to the time marked off in advance with the time span of each minute in each consecutive days
Cycle as the unit interval, it is determined that in a upper unit interval each dimension that the goal systems is produced characteristic value, that is to say, that it is every
Through the characteristic value for after one minute, then gathering each dimension that the goal systems was produced in this minute.
For example, each possessing 24 hours consecutive days, i.e. 1440 minutes, then a consecutive days are divided according to per minute
For 1440 parts of unit interval, and it is every through after one minute when, determine in one minute (that is, in a upper unit interval) the target system
The characteristic value for each dimension produced of uniting.Such as, current time be 23 points 59 seconds 58 minutes, then when next second 0 second time 23 point 59 minute,
The server can determine the feature for each dimension that the goal systems is produced within 60 58: 0 second 58 minutes to 23: at 23 points
Value.
Then, the amount of calling of the goal systems be the goal systems from it is outside (for example：Third party device) equipment calls number
According to amount.Because the goal systems is not operationally independent, but need to carry out the hair of data between external equipment
Send and call, so the operating pressure of the goal systems can be determined by the amount of calling to the goal systems；
The called amount of the goal systems be the goal systems response external (for example：Third party device) equipment request simultaneously
The amount of data is sent to external equipment, the operating pressure of the goal systems is may also indicate that with the amount of calling of the goal systems；
The goal systems when calling a length of goal systems call external equipment (for example：Third party device) data consumed
The time taken, it may be determined that whether third party goes wrong or whether network is delayed；
Amount of error is that the goal systems is calling data or the goal systems in response external equipment in the goal systems
Request when, there is the quantity of malloc failure malloc, be determined for the situation for occurring mistake inside the goal systems, wherein, should
When service implement body can obtain the goal systems malloc failure malloc, the quantity of the error information sent is used as the goal systems
There is the quantity of malloc failure malloc, or, the server can also obtain the quantity for the business for performing failure, be used as the goal systems
There is the quantity of malloc failure malloc, specifically can be by staff according to being configured the need for practical application using which kind of method, this
Application is not limited this；
The goal systems is called to the amount of calling of database for the goal systems from the corresponding database of the goal systems
The amount of data.Because the data transformation needed to use when business is performed is stored in the goal systems, so the target system
System generally operationally also needs to call the data in database, for example, personal information of user etc. can be stored in the mesh
In the corresponding database of mark system, so when the goal systems performs and needs to use the business of personal information of user, should
Goal systems is needed to call the personal information of the user from the database, and the goal systems also may be used for the amount of calling of database
Determine the running status of the goal systems.
Further, because the server can gather corresponding in each unit interval using the unit interval as time span
The characteristic value of different dimensions, so the server can determine the target in the different unit interval by the characteristic value of each dimension
The running situation of system, and the running situation of the target can be by the characteristic value of multiple dimensions to embody.
It should be noted that the server can be a single equipment or the mesh being made up of multiple devices
Mark system.The amount of calling of the above-mentioned goal systems, the called amount of the goal systems, the goal systems call duration, the target
Amount of error and the goal systems can be considered as the data of different dimensions to the amount of calling of database in system.Except this
Apply outside different dimensions cited in embodiment, can also be comprising other dimensions (for example, the goal systems is to the network bandwidth
Occupancy, time of the goal systems wait-for-response etc.), can be according to actual needs as the particular content of other dimensions
It is determined that, no longer repeat one by one here.
S102：According to the characteristic value of each dimension and by training obtained abnormal judgment models, the target system is determined
There is abnormal probability in system.
In the embodiment of the present application, when the server is each get that the goal systems produced within a upper unit interval
During the characteristic value of dimension, the unit interval corresponding abnormal judgment models that just can be completed according to training in advance determine the target
There is abnormal probability within a upper unit interval in system, so as to subsequently determine the goal systems within a upper unit interval whether
Occur abnormal.
Specifically, the abnormal judgment models can be mixed Gauss model or other models, do not do specific here
Limit.Illustrated in the embodiment of the present application so that mixed Gauss model is abnormal judgment models as an example.
Then, the server can determine the abnormal prison of this goal systems previously according to the unit time marked off
Mixed Gauss model corresponding to the unit interval of survey, and the characteristic value of each dimension determined in step S101 is inputted this mixed
Gauss model is closed, calculates and obtains the probability that exception occurs in the goal systems, wherein constituting each Gaussian mode of the mixed Gauss model
Type judges submodel for the exception in different time cycle.
In the embodiment of the present application, the service implement body can calculate the goal systems in the time cycle using following equation
Occurs abnormal probability in (that is, the unit interval)：
Wherein, Gauss formula is
Wherein, P (xt) represent that abnormal probability occurs within t-th of unit interval in the goal systems；T represents t-th of list
The position time；K represents k-th of dimension；L represents the total quantity of dimension；wktRepresent that the characteristic value of k-th of dimension is single at this t-th
Corresponding weighted value in the time of position；gkt(xkt, ukt, σkt) represent that the characteristic value of k-th of dimension is corresponding t-th of unit interval
It is abnormal to judge submodel；xktRepresent k-th of dimension that the goal systems that the server is determined is produced within t-th of unit interval
The corresponding numerical value of characteristic value of degree；uktRepresent k-th of dimension that the goal systems is produced within t-th of unit interval in history
Sample data average value；σktRepresent k-th of dimension that the goal systems is produced within t-th of unit interval in history
The variance of sample data.
Wherein,The corresponding weighted value of i.e. each dimension is normalized, it is seen then that passes through and each abnormal judges son
The weighting sum of model, can be fitted and obtain the abnormal judgment models, and obtain the target system by the calculating of abnormal judgment models
There is abnormal probability in system.
In the embodiment of the present application, the sample data in a unit interval can be multiple, and these sample datas can be with
Belong to different dimensions, same dimension can also be belonged to, each sample data one characteristic value of correspondence, for example, the target system
The amount of calling of system, then a characteristic value can be the value of the amount of calling of the goal systems produced in the unit period,
The sample data can be the goal systems with the unit period identical period in, at least one produced in history should
The value of the amount of calling of goal systems.
Wherein, this judges submodel extremely, can correspond to the list using the expression of above-mentioned Gauss formula, the Gauss formula
The position time, and corresponding to a kind of characteristic value of dimension, that is to say, that in the embodiment of the present application, the different time cycles is same
Dimension can correspond to not quite identical Gauss formula, and not quite identical Gauss can be also corresponded to a period of time different dimensions
Formula.Because the mixed Gauss model can judge that submodel fitting is obtained by the exception of multiple correspondence different dimensions,
And it is each it is abnormal judge that submodel all corresponds to cycle (that is, unit interval) at the same time, so the server is based on
Calculate the goal systems and the mixed Gauss model (that is, abnormal judgment models) of abnormal probability occur at the different time cycle, can
With not quite identical.For example, the time cycle is 1 day 12 December in 2016:00 to 2016 on December 1,12:01 corresponding exception
Judgment models, are 1 day 12 December in 2016 with the time cycle:01 to 2016 on December 1,12:02 corresponding exception judges mould
Type, can be with not quite identical.
Certainly, because the abnormal judgment models can judge that submodel is intended by the corresponding exception of characteristic value of multiple dimensions
Close what is obtained, so each abnormal judgment models corresponding to the different time cycle, may each be the characteristic value meter by different dimensions
Obtain.For example, continue two in using the example above abnormal judgment models, the two abnormal judgment models, may each be by：
The value of the amount of calling of the goal systems, the value of the called amount of the goal systems, the goal systems call the value of duration, the target
The value of amount of error and the goal systems are to the value of the amount of calling of database in system, and the characteristic value of this five dimensions is corresponded to respectively
Exception judge that submodel is fitted and obtain.
Correspond in the embodiment of the present application, because the characteristic value of each dimension of server determination may include：The target system
Value, the value of the called amount of the goal systems, goal systems of the amount of calling of system are called wrong in the value of duration, the goal systems
The value of value and the goal systems to the amount of calling of database of amount is missed, so the L can be 5, then
In addition, the uktAnd the σkt, it is that the server is by determining the target system when training the mixed Gauss model
What the feature for the k dimensions produced within t-th of unit interval every day in preset number of days of uniting was worth to, that is, root
The numerical value determined according to the sample data used when training the mixed Gauss model.Wherein, the preset number of days can be by the people that works
Member is according to setting the need for practical application, for example, (that is, the data produced using the first quarter goal systems were used as sample in 90 days
This), 180 days (that is, using half a year the goal systems produce data are used as sample) or 360 days (that is, with 1 year target system
The data that system is produced are used as sample) etc..
Specifically, the uktCan be produced in t-th of unit interval of the goal systems in past 180 days in every day
The average value of the sample data of k-th raw of dimension, the σktCan be the goal systems in past 180 days in every day
The corresponding variance of sample data of k-th of the dimension produced in t-th of unit interval, i.e. used flat when variance is calculated
Average is ukt, because average value and variance are clear and definite mathematical concepts, so the application no longer enumerates corresponding formula.
It can be seen that, by each abnormal weighting sum for judging submodel, it can calculate and obtain goal systems appearance exception
Probability.
Further, because each exception judges the corresponding weighted value w of submodelkt, can be assigned at random by the server
One initial value, so when fitting obtains the abnormal judgment models, may be to the exception if each weighted value is diverging
The degree of accuracy of judgment models is impacted, so the degree of accuracy in order to improve the abnormal judgment models, in the embodiment of the present application,
The server can also judge that each dimension is corresponding respectively for the corresponding abnormal initial weight value for judging submodel of each dimension
It is abnormal to judge whether the initial weight value of submodel restrains, and for the corresponding abnormal initial power for judging submodel of each dimension
When the judged result of weight values meets the condition of convergence, according to convergent each abnormal initial weight value for judging submodel, fitting is obtained
The abnormal judgment models, or, when judging to be unsatisfactory for the condition of convergence, the initial weight value for being unsatisfactory for the condition of convergence is entered
Row adjustment.
Specifically, the server can use EM algorithm (Expectation Maximization
Algorithm, EM algorithm), corresponding initial weight value (that is, w is worth to each dimensional characteristics in the mixed Gauss modelkt) carry out
E steps are calculated, and obtain the renewal weighted value of each initial weight value, and according to the renewal weighted value and the initial weight value, judging should
Whether initial weight value restrains.
When the judged result for the corresponding abnormal initial weight value for judging submodel of each dimension meets the condition of convergence,
Then the abnormal judgment models can be obtained according to convergent each abnormal initial weight value for judging submodel, fitting.Wherein, in book
Apply in embodiment, because each exception judges that the corresponding each weighted value of submodel is normalized, occurring some so working as
The corresponding abnormal weighted value convergence for judging submodel of dimension, and the corresponding exception of other dimensions judges the weighted value of submodel not
During convergence, the server can continue to be trained each weighted value, untill each weighted value is restrained, and as the receipts
Condition is held back, each weighted value is judged；
Or, the condition of convergence can also be that the server can be also trained only for not convergent weighted value, until
Untill each weighted value is restrained；
Or, the condition of convergence can also be, as long as have a weighted value convergence, just determine that each weighted value meets convergence
Condition, and stop to training process of each weighted value, etc..Certainly, this specifically can be set by staff using which kind of mode
Application is not limited.
Further if it is not satisfied, then the abnormal initial weight value for judging submodel corresponding at least one dimension is carried out
Adjustment (that is, exception corresponding to the dimension judges that the initial weight value of submodel is trained).
Specifically, then the server can continue cycling through the M steps and E steps using the EM algorithms, exception corresponding to the dimension
Judge that the initial weight value of submodel is trained, and judge that the corresponding exception of the dimension judges what submodel training was obtained again
Whether weighted value restrains, if so, then obtained weighted value will be trained to be used as the dimension for being fitted the abnormal judgment models
Corresponding exception judges the weighted value of submodel, if it is not, then continuing exception corresponding to the dimension judges that submodel training is obtained
Weighted value be trained again, untill the weighted value convergence after the corresponding abnormal submodel training to the dimension.
It should be noted that the training process of the weighted value is carried out in advance, training object is for the x ' of the previous daykt
Corresponding each exception judges submodel.
Specifically, the server is when carrying out above-mentioned training, each w can be used as using the random number initializedktIt is initial right
The numerical value answered, it is certainly normalized during weighted value corresponding due to the characteristic value of each dimension, so each wktInitial corresponding numerical value
It is also normalized.
First, in the E steps of the EM algorithms, the x ' is calculatedktProduced by the corresponding Gauss model of the characteristic value of k-th of dimension
Probability, formula can be usedCalculating is obtained, i.e. calculate the spy for obtaining each dimension
The corresponding maximum likelihood estimator of value indicative.The w now obtainedktBe exactly the renewal weighted value of initial weight value, then the now clothes
Being engaged in device can be according to the wktJudge whether the initial weight value restrains, also, whether the corresponding weighted value of each dimension meets convergence
Condition, if so, then can directly use the initial weight value, is fitted the abnormal judgment models (that is, the mixed Gauss model), if
No, then the server can continue executing with follow-up M steps.
In the M steps of the EM algorithms, corresponding to the characteristic value of k-th of dimension abnormal to judge that submodel recalculates its right
The w answeredktParameter, can specifically use formulaAnd formula
Wherein, the xiktFor k-th of dimension characteristic value t-th of unit interval, i-th of training sample corresponding sample data.Then
Now, each abnormal parameter u for judging submodelktAnd σktParameter renewal is carried out, the server can be according to the ginseng of renewal
Count, continue the calculating of E steps, and continue to update the exception of k-th of dimension and judge the weighted value of submodel, and judge whether receipts
Hold back, and judge whether to meet the condition of convergence again.
Then, the server is recyclable repeats E steps and M steps (that is, training each weighted value), until the wktMeet convergence bar
Untill part (that is, training is completed).Wherein, the server judges whether the weighted value restrains, and can be w obtained in the previous stepktWith
The w that next step is obtainedktDifference be less than default numerical value, or the number of times of iteration reaches default number of times, etc..Specifically
Which kind of mode to judge whether how convergence, or the convergent numerical value of the judgement are set using, can be answered by staff according to actual
It is configured the need for, the application is not limited this.
S103：When the probability is interval between the corresponding small probability of the abnormal judgment models, the target system is determined
System occurs abnormal.
In the embodiment of the present application, occurs abnormal probability in the unit interval when the server determines the goal systems
Afterwards, just it can determine whether the probability corresponds to small probability event according to Gauss theorem, i.e. determine whether the probability is different in this
Often the corresponding small probability of judgment models is interval interior, and when it is determined that the probability is interval interior in the small probability, determines the target system
System occurs abnormal.
Specifically, the determination methods of 3 times of variances in Gauss theorem can be used, that is, judge whether P (xt)≤P(ut±3
σt), if, it is determined that there is exception and alarmed within the unit interval in the goal systems, if otherwise determining, the goal systems exists
It is without exception in the unit interval.That is, the abnormal judgment models that the server can be trained according to this, determine the mesh
The distribution of mark system corresponding abnormal probability on the unit interval, it is true with specific reference to the quantity of the dimension of the characteristic value of use
Fixed, such as only with the characteristic value of 2 kinds of dimensions, then the server can determine the goal systems in the unit in two-dimensional space
Between in corresponding abnormal probability distribution, according to the characteristic dimension of 5 kinds of dimensions, then the server can be in 5 gts
In, the distribution of the goal systems corresponding abnormal probability in the unit interval is determined, the server may determine that the mesh afterwards
Mark system is corresponding on the unit interval to there is abnormal probability, if the area of the small probability event in the spatial distribution
Between in, if it is abnormal then to determine that the goal systems occurs, if otherwise determining, the goal systems is normal.
Further, after the server determines that exception occurs in the goal systems, in the embodiment of the present application, the server
Alarm information is can be sent out, it is to point out the staff goal systems to occur abnormal so that staff can timely
Hand processing, certainly, the warning information sends the application and is not specifically limited in which way.
By the monitoring method that goal systems shown in Fig. 1 is abnormal, the server can the characteristic value based on multiple dimensions, and
According to the good abnormal judgment models of training in advance, determine that abnormal probability occurs in the goal systems, and when the probability is different in this
When often the corresponding small probability of judgment models is interval, determine that the goal systems occurs abnormal.Wherein, the abnormal judgment models can be
Mixed Gauss model, and can be corresponding with one in the unit time divided in advance, that is to say, that it is each different
Unit interval can all correspond to not quite identical mixed Gauss model so that the application provide method can take into account in one day
The corresponding goal systems running situation of different periods, is accurately monitored extremely to goal systems.Meanwhile, it is different from existing skill
Art, the method that alarm threshold is set to each equipment, the method that the application is provided, is the not commensurate determined according to historical record
The corresponding abnormal probability distribution of whole goal systems in time, that is, each dimension for producing of goal systems described herein
Characteristic value, this feature value is no longer the data of single equipment, but to tackling the data of whole goal systems so as to target system
The abnormal judgement of system is more accurate, can be effectively prevented from failing to report and reporting by mistake to goal systems exception, improve target system
The monitoring efficiency for exception of uniting.
In addition, in the embodiment of the present application, in order to reduce the negative effect that goal systems shake is brought, the server can be with
According to default quantity, for the characteristic value of each dimension, it is determined that the dimension of the multiple time cycles adjacent with the time cycle
Sample data average value, the characteristic value of the dimension produced as the goal systems in the time cycle.Wherein, this is preset
Quantity, can be configured by staff according to the need for during practical application.
For example, the unit interval currently determined is 23:58 to 23:59 corresponding one minute, and the default quantity is
5, then the server can determine 23:In 5 minutes before 58, the feature for each dimension that the goal systems of each minute is produced
Value, and according to different dimensions, the average value of the characteristic value of each dimension is determined, it is 23 as the unit interval:58 to 23:59 pairs
The characteristic value for each dimension answered.
Further, when training the composite character model, because the goal systems was likely to occur extremely in history,
Then there may be abnormal characteristic value in the historical record, then the server can according to labeled as abnormal characteristic value, it is determined that
This determines that the goal systems is produced within the time cycle identical period labeled as the abnormal corresponding dimension of characteristic value
Multiple dimensions sample data, and using multiple characteristic values average and variance random multiple sum, substitute the mark
Abnormal characteristic value is designated as, the sample for training the abnormal judgment models (that is, mixed Gauss model) is used as.
Specifically, the server can using the goal systems be produced within the time cycle identical period it is many
The unmarked sample data for exception of the individual dimension, calculating replacement, this is labeled as abnormal sample data, then the server can be adopted
Use formula xKt is abnormal=uKt is not abnormal+α·σKt is not abnormalRecalculate and determine this labeled as abnormal characteristic value, wherein, xKt is abnormalRepresent the mark
It is designated as the value after abnormal characteristic value is recalculated again, uKt is not abnormalRepresent corresponding multiple unmarked for abnormal spy in the dimension
The average value of value indicative, σKt is not abnormalRepresent the corresponding multiple unmarked variances for abnormal characteristic values of the dimension, α be zero to one it
Between random number.
For example, for 12：There is a mark in the time cycle of 01 to 12 point 02 in the sample data of corresponding k dimensions
For abnormal sample data, it is assumed that current date is on December 31st, 2016, then the server can gather the goal systems and exist
On December 20th, 2016, on December 19th, 2016, on December 4th, 2016, the 12 of on December 1st, 2016：01 to 12 point 02 is produced
Totally 4 k dimensions it is unmarked for abnormal sample data, and use formula, xKt is abnormal=uKt is not abnormal+α·σKt is not abnormal, calculate
Obtain that the numerical value of abnormal sample data should be labeled as in the sample data of replacement k dimensions.
Wherein, all dimensions that the server can be produced in the goal systems within the time cycle identical period
In the sample data of degree, multiple unmarked sample datas for exception are randomly choosed, the unmarked sample data for exception
Quantity can be configured by staff.
Further, in order to reduce the operating pressure of the server, the server can be to randomly choose the goal systems
The sample data of the multiple dimensions produced within the time cycle identical period, is not limited solely to not mark by obtaining
It is designated as abnormal sample data to be calculated, this is substituted using result of calculation labeled as abnormal sample data.
Certainly, the sample data of multiple dimensions is selected for the server, more restrictive conditions can also be added, such as
Temporal restrictive condition etc., the application is not limited this.
Pass through, multiple sample datas calculate obtained replacement numerical value, substitute this labeled as abnormal sample data, Ke Yiyou
Effect ground reduces the influence labeled as abnormal sample data to the abnormal judgment models, and the abnormal judgment models can be made corresponding
Small probability is interval more accurate, adds the accuracy rate of the monitoring method of the system exception.
Based on the monitoring method that system shown in Figure 1 is abnormal, the embodiment of the present application also corresponds to and provides a kind of prison of system exception
The structural representation of device is surveyed, as shown in Figure 2.
A kind of structural representation of the monitoring device for system exception that Fig. 2 provides for the embodiment of the present application, including：
Determining module 201, the characteristic value at least one dimension that collection goal systems is produced；
Computing module 202, according to the characteristic value of each dimension and by training obtained abnormal judgment models, it is determined that described
There is abnormal probability in goal systems；
Judge module 203, when the probability is interval between the corresponding small probability of the abnormal judgment models, it is determined that described
Goal systems occurs abnormal.
The judge module 203, when it is determined that the goal systems occurs abnormal, sends alarm information.
The computing module 202, gathers the sample data at least one dimension that the goal systems history is produced, for
The sample data of each dimension, performs following operation, and according to the sample data of the dimension, training obtains the sample data pair of the dimension
The exception answered judges submodel, when the corresponding exception of sample data for obtaining a dimension judges submodel, according to obtained institute
State exception and judge submodel, fitting obtains the abnormal judgment models.
The computing module 202, determines the time cycle, and obtain the sample of the dimension produced within the time cycle
Data, according to the sample data, training obtains the dimension corresponding exception within the time cycle and judges submodel.
In the computing module 202, the sample data produced from the goal systems history, search and the time cycle
The sample data of the dimension produced in the identical period, by the sample data found, is used as the time cycle
The corresponding abnormal training sample for judging submodel.
The computing module 202, obtain each dimension it is corresponding it is abnormal judge submodel when, be the corresponding exception of each dimension
Judge that submodel distributes initial weight value, for the corresponding abnormal initial weight value for judging submodel of each dimension, perform respectively
Operate below：Judge that the corresponding exception of the dimension judges whether the initial weight value of submodel restrains, for each dimension correspondence
Exception when judging that the judged result of initial weight value of submodel meets the condition of convergence, each judge submodule extremely according to convergent
The initial weight value of type, fitting obtains the abnormal judgment models, otherwise, and exception corresponding at least one dimension judges submodule
The initial weight value of type is adjusted.
The computing module 202, using EM algorithm, the abnormal initial power for judging submodel corresponding to the dimension
Weight values are trained, and judge whether the corresponding abnormal weighted value for judging that submodel training is obtained of the dimension restrains, if so, then will
Obtained weighted value is trained as the corresponding abnormal power for judging submodel of the dimension for being fitted the abnormal judgment models
Weight values, are trained again if it is not, then continuing the abnormal weighted value for judging that submodel training is obtained corresponding to the dimension, until
Untill weighted value convergence after abnormal submodel training corresponding to the dimension.
The computing module 202, obtains the dimension corresponding exception within the time cycle in training and judges submodel
Before, when existing in the sample data of the dimension produced within the time cycle got labeled as abnormal sample number
According to when, obtain the goal systems with the sample of multiple dimensions that produces in time cycle identical other times section
Data, calculate the sample data of the multiple dimensions obtained average and variance and value, and should using described and value adjustment
It is described and be worth for training the dimension is corresponding to judge submodel extremely labeled as abnormal sample data described in dimension.
The determining module 201, for the characteristic value of each dimension, it is determined that the multiple times week adjacent with the time cycle
The average value of the sample data of the dimension of phase, the feature of the dimension produced as the goal systems in the time cycle
Value.
When the abnormal judgment models are mixed Gauss model, the computing module 202, according to Gauss principle, it is determined that
The corresponding small probability of the abnormal judgment models is interval.
The dimension includes：The called amount dimension of the system amount of the calling dimension, the system, the system call duration
Amount of error dimension, the system are to the one or more in the amount of the calling dimension of database in dimension, the system.
Specifically, a kind of monitoring device of system exception as shown in Figure 2 can be located in server, the server can be with
A single equipment, or the system being made up of multiple devices.
In the 1990s, for a technology improvement can clearly distinguish be on hardware improvement (for example,
Improvement to circuit structures such as diode, transistor, switches) or software on improvement (for the improvement of method flow).So
And, with the development of technology, the improvement of current many method flows can be considered as directly improving for hardware circuit.
Designer nearly all obtains corresponding hardware circuit by the way that improved method flow is programmed into hardware circuit.Cause
This, it cannot be said that the improvement of a method flow cannot be realized with hardware entities module.For example, PLD
(Programmable Logic Device, PLD) (such as field programmable gate array (Field Programmable Gate
Array, FPGA)) it is exactly such a integrated circuit, its logic function is determined by user to device programming.By designer
Voluntarily programming comes a digital display circuit " integrated " on a piece of PLD, without asking chip maker to design and make
Special IC chip.Moreover, nowadays, substitution manually makes IC chip, and this programming is also used instead mostly " patrols
Volume compiler (logic compiler) " software realizes that software compiler used is similar when it writes with program development,
And the source code before compiling also write by handy specific programming language, this is referred to as hardware description language
(Hardware Description Language, HDL), and HDL is also not only a kind of, but have many kinds, such as ABEL
(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description
Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL
(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby
Hardware Description Language) etc., VHDL (Very-High-Speed are most generally used at present
Integrated Circuit Hardware Description Language) and Verilog.Those skilled in the art also should
This understands, it is only necessary to slightly programming in logic and be programmed into method flow in integrated circuit with above-mentioned several hardware description languages,
The hardware circuit for realizing the logical method flow can be just readily available.
Controller can be implemented in any suitable manner, for example, controller can take such as microprocessor or processing
Device and storage can by the computer of the computer readable program code (such as software or firmware) of (micro-) computing device
Read medium, gate, switch, application specific integrated circuit (Application Specific Integrated Circuit,
ASIC), the form of programmable logic controller (PLC) and embedded microcontroller, the example of controller includes but is not limited to following microcontroller
Device：ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, are deposited
Memory controller is also implemented as a part for the control logic of memory.It is also known in the art that except with
Pure computer readable program code mode is realized beyond controller, can be made completely by the way that method and step is carried out into programming in logic
Obtain controller and come real in the form of gate, switch, application specific integrated circuit, programmable logic controller (PLC) and embedded microcontroller etc.
Existing identical function.Therefore this controller is considered a kind of hardware component, and various for realizing to including in it
The device of function can also be considered as the structure in hardware component.Or even, can be by for realizing that the device of various functions is regarded
For that not only can be the software module of implementation method but also can be the structure in hardware component.
System, device, module or unit that above-described embodiment is illustrated, can specifically be realized by computer chip or entity,
Or realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used
Think personal computer, laptop computer, cell phone, camera phone, smart phone, personal digital assistant, media play
It is any in device, navigation equipment, electronic mail equipment, game console, tablet PC, wearable device or these equipment
The combination of equipment.
For convenience of description, it is divided into various units during description apparatus above with function to describe respectively.Certainly, this is being implemented
The function of each unit can be realized in same or multiple softwares and/or hardware during application.
It should be understood by those skilled in the art that, embodiments of the invention can be provided as method, system or computer program
Product.Therefore, the present invention can be using the reality in terms of complete hardware embodiment, complete software embodiment or combination software and hardware
Apply the form of example.Moreover, the present invention can be used in one or more computers for wherein including computer usable program code
The computer program production that usable storage medium is implemented on (including but is not limited to magnetic disk storage, CD-ROM, optical memory etc.)
The form of product.
The present invention is the flow with reference to method according to embodiments of the present invention, equipment (system) and computer program product
Figure and/or block diagram are described.It should be understood that can be by every first-class in computer program instructions implementation process figure and/or block diagram
Journey and/or the flow in square frame and flow chart and/or block diagram and/or the combination of square frame.These computer programs can be provided
The processor of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing devices is instructed to produce
A raw machine so that produced by the instruction of computer or the computing device of other programmable data processing devices for real
The device for the function of being specified in present one flow of flow chart or one square frame of multiple flows and/or block diagram or multiple square frames.
These computer program instructions, which may be alternatively stored in, can guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works so that the instruction being stored in the computer-readable memory, which is produced, to be included referring to
Make the manufacture of device, the command device realize in one flow of flow chart or multiple flows and/or one square frame of block diagram or
The function of being specified in multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices so that in meter
Series of operation steps is performed on calculation machine or other programmable devices to produce computer implemented processing, thus in computer or
The instruction performed on other programmable devices is provided for realizing in one flow of flow chart or multiple flows and/or block diagram one
The step of function of being specified in individual square frame or multiple square frames.
In a typical configuration, computing device includes one or more processors (CPU), input/output interface, net
Network interface and internal memory.
Internal memory potentially includes the volatile memory in computer-readable medium, random access memory (RAM) and/or
The forms such as Nonvolatile memory, such as read-only storage (ROM) or flash memory (flash RAM).Internal memory is computer-readable medium
Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer-readable instruction, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase transition internal memory (PRAM), static RAM (SRAM), moved
State random access memory (DRAM), other kinds of random access memory (RAM), read-only storage (ROM), electric erasable
Programmable read only memory (EEPROM), fast flash memory bank or other memory techniques, read-only optical disc read-only storage (CD-ROM),
Digital versatile disc (DVD) or other optical storages, magnetic cassette tape, the storage of tape magnetic rigid disk or other magnetic storage apparatus
Or any other non-transmission medium, the information that can be accessed by a computing device available for storage.Define, calculate according to herein
Machine computer-readable recording medium does not include temporary computer readable media (transitory media), such as data-signal and carrier wave of modulation.
It should also be noted that, term " comprising ", "comprising" or its any other variant are intended to nonexcludability
Comprising so that process, method, commodity or equipment including a series of key elements are not only including those key elements, but also wrap
Include other key elements being not expressly set out, or also include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the key element limited by sentence "including a ...", it is not excluded that wanted including described
Also there is other identical element in process, method, commodity or the equipment of element.
It will be understood by those skilled in the art that embodiments herein can be provided as method, system or computer program product.
Therefore, the application can be using the embodiment in terms of complete hardware embodiment, complete software embodiment or combination software and hardware
Form.Deposited moreover, the application can use to can use in one or more computers for wherein including computer usable program code
The shape for the computer program product that storage media is implemented on (including but is not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The application can be described in the general context of computer executable instructions, such as program
Module.Usually, program module includes performing particular task or realizes routine, program, object, the group of particular abstract data type
Part, data structure etc..The application can also be put into practice in a distributed computing environment, in these DCEs, by
Remote processing devices connected by communication network perform task.In a distributed computing environment, program module can be with
Positioned at including in the local and remote computer-readable storage medium including storage device.
Each embodiment in this specification is described by the way of progressive, identical similar portion between each embodiment
Divide mutually referring to what each embodiment was stressed is the difference with other embodiment.It is real especially for system
Apply for example, because it is substantially similar to embodiment of the method, so description is fairly simple, related part is referring to embodiment of the method
Part explanation.
Embodiments herein is the foregoing is only, the application is not limited to.For those skilled in the art
For, the application can have various modifications and variations.It is all any modifications made within spirit herein and principle, equivalent
Replace, improve etc., it should be included within the scope of claims hereof.
Claims (22)
1. a kind of monitoring method of system exception, it is characterised in that including：
Gather the characteristic value at least one dimension that goal systems is produced；
According to the characteristic value of each dimension and by training obtained abnormal judgment models, determine that the goal systems occurs abnormal
Probability；
When the probability is interval between the corresponding small probability of the abnormal judgment models, determine that the goal systems occurs different
Often.
2. monitoring method as claimed in claim 1, it is characterised in that methods described also includes：
When it is determined that the goal systems occurs abnormal, alarm information is sent.
3. monitoring method as claimed in claim 1, it is characterised in that training obtains described abnormal judging mould in the following manner
Type, including：
Gather the sample data at least one dimension that the goal systems history is produced；
For the sample data of each dimension, following operate is performed：
According to the sample data of the dimension, training obtains the corresponding exception of the dimension and judges submodel；
Obtain each dimension it is corresponding it is abnormal judge submodel when, according to obtain it is described judge submodel extremely, fitting is obtained
The corresponding abnormal judgment models of the goal systems.
4. monitoring method as claimed in claim 3, it is characterised in that according to the sample data of the dimension, training obtains the dimension
The corresponding exception of degree judges submodel, including：
The time cycle is determined, and obtains the sample data of the dimension produced within the time cycle；
According to the sample data, training obtains the dimension corresponding exception within the time cycle and judges submodel.
5. monitoring method as claimed in claim 4, it is characterised in that the dimension that acquisition is produced within the time cycle
Sample data, is specifically included：
In the sample data produced from the goal systems history, search and generation in the time cycle identical period
The sample data of the dimension；
By the sample data found, the time cycle corresponding abnormal training sample for judging submodel is used as.
6. monitoring method as claimed in claim 4, it is characterised in that judge submodel obtaining the corresponding exception of each dimension
When, submodel is judged according to the obtained exception, fitting obtains the abnormal judgment models, specifically included：
Obtain each dimension it is corresponding it is abnormal judge submodel when, being that each dimension is corresponding abnormal judges that submodel distribution is initially weighed
Weight values；
For the corresponding abnormal initial weight value for judging submodel of each dimension, following operate is performed respectively：
Judge that the corresponding exception of the dimension judges whether the initial weight value of submodel restrains；
When the judged result for the corresponding abnormal initial weight value for judging submodel of each dimension meets the condition of convergence, according to
Convergent each abnormal initial weight value for judging submodel, fitting obtains the abnormal judgment models；
Otherwise, exception corresponding at least one dimension judges that the initial weight value of submodel is adjusted.
7. monitoring method as claimed in claim 6, it is characterised in that exception corresponding at least one dimension judges submodel
Initial weight value be adjusted, specifically include：
Using EM algorithm, exception corresponding to the dimension judges that the initial weight value of submodel is trained；
Judge whether the corresponding abnormal weighted value for judging that submodel training is obtained of the dimension restrains；
If so, then obtained weighted value will be trained to sentence as the corresponding exception of the dimension for being fitted the abnormal judgment models
The weighted value of disconnected submodel；
It is trained again if it is not, then continuing the abnormal weighted value for judging that submodel training is obtained corresponding to the dimension, until
Untill weighted value convergence after abnormal submodel training corresponding to the dimension.
8. monitoring method as claimed in claim 4, it is characterised in that methods described also includes：
Training obtain the dimension within the time cycle it is corresponding it is abnormal judge submodel before, when getting described
When existing in the sample data of the dimension produced in the time cycle labeled as abnormal sample data, the goal systems is obtained
In the sample data that history is produced, the sample data with multiple dimensions in the time cycle identical period；
Calculate the sample data of the multiple dimensions obtained average and variance and value, and adjust the dimension using described and value
It is described and be worth for training the dimension is corresponding to judge submodel extremely labeled as abnormal sample data described in degree.
9. the monitoring method as described in right wants 4, it is characterised in that the feature at least one dimension that collection goal systems is produced
Value, is specifically included：
For the characteristic value of each dimension, it is determined that the sample data of the dimension of the multiple time cycles adjacent with the time cycle
Average value, the characteristic value of the dimension produced as the goal systems in the time cycle.
10. monitoring method as claimed in claim 1, it is characterised in that methods described also includes：
When the abnormal judgment models are mixed Gauss model, according to Gauss principle, the abnormal judgment models correspondence is determined
Small probability it is interval.
11. monitoring method as claimed in claim 1, it is characterised in that the dimension includes：The system amount of the calling dimension,
The called amount dimension of the system, the system call in duration dimension, the system amount of error dimension, the system to data
One or more in the amount of the calling dimension in storehouse.
12. a kind of monitoring device of system exception, it is characterised in that including：
Determining module, the characteristic value at least one dimension that collection goal systems is produced；
Computing module, according to the characteristic value of each dimension and by training obtained abnormal judgment models, determines the target system
There is abnormal probability in system；
Judge module, when the probability is interval between the corresponding small probability of the abnormal judgment models, determines the target system
System occurs abnormal.
13. monitoring device as claimed in claim 12, it is characterised in that the judge module, it is determined that the goal systems
When occurring abnormal, alarm information is sent.
14. monitoring device as claimed in claim 12, it is characterised in that the computing module, gathers the goal systems and goes through
The sample data at least one dimension that history is produced, for the sample data of each dimension, performs following operation, according to the dimension
Sample data, the corresponding exception of sample data that training obtains the dimension judges submodel, is obtaining the sample data of a dimension
When corresponding exception judges submodel, submodel is judged according to the obtained exception, fitting obtains the abnormal judgment models.
15. monitoring device as claimed in claim 14, it is characterised in that the computing module, determines the time cycle, and obtain
The sample data of the dimension produced within the time cycle, according to the sample data, training obtains the dimension described
Corresponding exception judges submodel in time cycle.
16. monitoring device as claimed in claim 15, it is characterised in that the computing module, from the goal systems history
In the sample data of generation, the sample data of the dimension with being produced in the time cycle identical period is searched, will be looked into
The sample data found, is used as the time cycle corresponding abnormal training sample for judging submodel.
17. monitoring device as claimed in claim 15, it is characterised in that the computing module, obtaining, each dimension is corresponding
It is that the corresponding exception of each dimension judges that submodel distributes initial weight value when exception judges submodel, it is corresponding for each dimension
The abnormal initial weight value for judging submodel, performs following operate respectively：Judge that the corresponding exception of the dimension judges submodel
Whether initial weight value restrains, and is met in the judged result for the corresponding abnormal initial weight value for judging submodel of each dimension
During the condition of convergence, according to convergent each abnormal initial weight value for judging submodel, fitting obtains the abnormal judgment models, no
Then, exception corresponding at least one dimension judges that the initial weight value of submodel is adjusted.
18. monitoring device as claimed in claim 17, it is characterised in that the computing module, right using EM algorithm
The corresponding exception of the dimension judges that the initial weight value of submodel is trained, and judges that the corresponding exception of the dimension judges submodel
Train whether obtained weighted value restrains, if so, will then train obtained weighted value as being fitted the exception judges mould
The corresponding exception of the dimension of type judges the weighted value of submodel, if it is not, then continuing exception corresponding to the dimension judges submodule
The weighted value that type training is obtained is trained again, until the weighted value convergence after abnormal submodel training corresponding to the dimension
Untill.
19. monitoring device as claimed in claim 15, it is characterised in that the computing module, obtains the dimension in training and exists
In the time cycle it is corresponding it is abnormal judge submodel before, when the dimension produced within the time cycle got
Sample data in when existing labeled as abnormal sample data, obtain in the sample data that the goal systems history is produced,
With the sample data of multiple dimensions in the time cycle identical period, the sample of the multiple dimensions obtained is calculated
The averages of data and variance and value, and adjusted using described and value labeled as abnormal sample data described in the dimension,
It is described be worth for training the dimension is corresponding abnormal to judge submodel.
20. monitoring device as claimed in claim 15, it is characterised in that the determining module, for the characteristic value of each dimension,
It is determined that the average value of the sample data of the dimension of the multiple time cycles adjacent with the time cycle, is used as the target system
The characteristic value for the dimension produced in the time cycle of uniting.
21. monitoring device as claimed in claim 12, it is characterised in that when the abnormal judgment models are mixed Gauss model
When, the computing module, according to Gauss principle, determines that the corresponding small probability of the abnormal judgment models is interval.
22. monitoring device as claimed in claim 12, it is characterised in that the dimension includes：The system amount of the calling dimension,
The called amount dimension of the system, the system call in duration dimension, the system amount of error dimension, the system to data
One or more in the amount of the calling dimension in storehouse.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710089648.4A CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710089648.4A CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107066365A true CN107066365A (en) | 2017-08-18 |
| CN107066365B CN107066365B (en) | 2021-01-01 |
Family
ID=59622603
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710089648.4A Active CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107066365B (en) |
Cited By (33)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107392401A (en) * | 2017-09-08 | 2017-11-24 | 上海理工大学 | Heavy-duty mill roll loads the failure prediction method of intelligent robot |
| CN108063699A (en) * | 2017-12-28 | 2018-05-22 | 携程旅游信息技术（上海）有限公司 | Network performance monitoring method, apparatus, electronic equipment, storage medium |
| CN108111359A (en) * | 2018-01-19 | 2018-06-01 | 北京奇艺世纪科技有限公司 | A kind of monitor processing method, device and monitoring processing system |
| CN108376553A (en) * | 2018-02-28 | 2018-08-07 | 北京奇艺世纪科技有限公司 | A kind of monitoring method and system of the disk of video server |
| CN108449313A (en) * | 2018-02-01 | 2018-08-24 | 平安科技（深圳）有限公司 | Electronic device, Internet service system method for prewarning risk and storage medium |
| CN108647942A (en) * | 2018-07-27 | 2018-10-12 | 重庆爱鸽者智能科技有限公司 | A kind of distributed pigeon racing based on general mobile terminal is judged system |
| CN108764290A (en) * | 2018-04-26 | 2018-11-06 | 阿里巴巴集团控股有限公司 | The reason of model unusual fluctuation, determines method and device and electronic equipment |
| CN108920326A (en) * | 2018-06-14 | 2018-11-30 | 阿里巴巴集团控股有限公司 | Determine system time-consuming abnormal method, apparatus and electronic equipment |
| CN108984376A (en) * | 2018-05-31 | 2018-12-11 | 阿里巴巴集团控股有限公司 | A kind of system anomaly detection method, device and equipment |
| CN109144820A (en) * | 2018-08-31 | 2019-01-04 | 新华三信息安全技术有限公司 | A kind of detection method and device of abnormal host |
| CN109325061A (en) * | 2018-08-24 | 2019-02-12 | 北京天元创新科技有限公司 | A kind of method for processing abnormal data and device based on probability distribution |
| CN109558295A (en) * | 2018-11-15 | 2019-04-02 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| CN109857618A (en) * | 2019-02-02 | 2019-06-07 | 中国银行股份有限公司 | A kind of monitoring method, apparatus and system |
| CN109947625A (en) * | 2019-03-27 | 2019-06-28 | 阿里巴巴集团控股有限公司 | The recognition methods of abnormal single machine and device in a kind of cluster |
| CN109976986A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | The detection method and device of warping apparatus |
| CN110008082A (en) * | 2019-03-16 | 2019-07-12 | 平安科技（深圳）有限公司 | Abnormal task intelligent monitoring method, device, equipment and storage medium |
| CN110399268A (en) * | 2019-07-26 | 2019-11-01 | 阿里巴巴集团控股有限公司 | A kind of method, device and equipment of anomaly data detection |
| CN110635962A (en) * | 2018-06-25 | 2019-12-31 | 阿里巴巴集团控股有限公司 | Abnormity analysis method and device for distributed system |
| CN110661818A (en) * | 2019-10-30 | 2020-01-07 | 腾讯云计算（北京）有限责任公司 | Event anomaly detection method and device, readable storage medium and computer equipment |
| CN111078488A (en) * | 2018-10-18 | 2020-04-28 | 杭州海康威视数字技术股份有限公司 | Data acquisition method, device, storage medium and system |
| CN111126813A (en) * | 2019-12-16 | 2020-05-08 | 东软集团股份有限公司 | Method and device for determining equipment state, storage medium and electronic equipment |
| CN111260133A (en) * | 2020-01-16 | 2020-06-09 | 支付宝(杭州)信息技术有限公司 | Optimization method and device of quality monitoring model for monitoring research and development quality |
| CN111598661A (en) * | 2020-05-14 | 2020-08-28 | 拉扎斯网络科技（上海）有限公司 | Abnormal report processing method and device, platform server and storage medium |
| CN111708687A (en) * | 2020-06-15 | 2020-09-25 | 北京优特捷信息技术有限公司 | Equipment abnormality index determination method, device, equipment and storage medium |
| CN111738463A (en) * | 2020-06-17 | 2020-10-02 | 深圳华远云联数据科技有限公司 | Operation and maintenance method, device, system, electronic equipment and storage medium |
| CN111880990A (en) * | 2020-07-20 | 2020-11-03 | 北京三快在线科技有限公司 | Exception handling method and device |
| CN112511372A (en) * | 2020-11-06 | 2021-03-16 | 新华三技术有限公司 | Anomaly detection method, device and equipment |
| CN112799898A (en) * | 2021-01-08 | 2021-05-14 | 北京科技大学 | Interconnection system fault node positioning method and system based on distributed fault detection |
| CN112905419A (en) * | 2021-03-02 | 2021-06-04 | 广州虎牙科技有限公司 | Index data monitoring threshold range determination method and device and readable storage medium |
| CN112988501A (en) * | 2019-12-17 | 2021-06-18 | 深信服科技股份有限公司 | Alarm information generation method and device, electronic equipment and storage medium |
| CN113297307A (en) * | 2020-08-15 | 2021-08-24 | 阿里巴巴集团控股有限公司 | Database request identification and anomaly detection method, device, equipment and medium |
| CN114419679A (en) * | 2022-04-01 | 2022-04-29 | 广东省通信产业服务有限公司 | Data analysis method, device and system based on wearable device data |
| CN115238831A (en) * | 2022-09-21 | 2022-10-25 | 中国南方电网有限责任公司超高压输电公司广州局 | Fault prediction method, apparatus, computer device, storage medium and program product |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2328363A1 (en) * | 2009-09-11 | 2011-06-01 | Starkey Laboratories, Inc. | Sound classification system for hearing aids |
| CN102361014A (en) * | 2011-10-20 | 2012-02-22 | 上海大学 | State monitoring and fault diagnosis method for large-scale semiconductor manufacture process |
| CN104184819A (en) * | 2014-08-29 | 2014-12-03 | 城云科技（杭州）有限公司 | Multi-hierarchy load balancing cloud resource monitoring method |
| CN104595170A (en) * | 2014-12-18 | 2015-05-06 | 中国矿业大学 | Air compressor monitoring diagnosis system and method adopting adaptive kernel Gaussian hybrid model |
| CN104976139A (en) * | 2015-06-08 | 2015-10-14 | 北京化工大学 | Mechanical equipment state diagnosis method based on Gaussian model |
| CN105099759A (en) * | 2015-06-23 | 2015-11-25 | 上海华为技术有限公司 | Detection method and device |
| CN105893256A (en) * | 2016-03-30 | 2016-08-24 | 西北工业大学 | Software failure positioning method based on machine learning algorithm |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101267372B1 (en) * | 2011-10-05 | 2013-05-24 | 주식회사 켐에쎈 | Multiple Linear Regression-Artificial Neural Network Hybrid Model Predicting Water Solubility of Pure Organic Compound |
| CN103065466B (en) * | 2012-11-19 | 2015-01-21 | 北京世纪高通科技有限公司 | Detection method of and detection device for abnormal traffic conditions |
| CN103971521B (en) * | 2014-05-19 | 2016-06-29 | 清华大学 | Road traffic anomalous event real-time detection method and device |
-
2017
- 2017-02-20 CN CN201710089648.4A patent/CN107066365B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP2328363A1 (en) * | 2009-09-11 | 2011-06-01 | Starkey Laboratories, Inc. | Sound classification system for hearing aids |
| CN102361014A (en) * | 2011-10-20 | 2012-02-22 | 上海大学 | State monitoring and fault diagnosis method for large-scale semiconductor manufacture process |
| CN104184819A (en) * | 2014-08-29 | 2014-12-03 | 城云科技（杭州）有限公司 | Multi-hierarchy load balancing cloud resource monitoring method |
| CN104595170A (en) * | 2014-12-18 | 2015-05-06 | 中国矿业大学 | Air compressor monitoring diagnosis system and method adopting adaptive kernel Gaussian hybrid model |
| CN104976139A (en) * | 2015-06-08 | 2015-10-14 | 北京化工大学 | Mechanical equipment state diagnosis method based on Gaussian model |
| CN105099759A (en) * | 2015-06-23 | 2015-11-25 | 上海华为技术有限公司 | Detection method and device |
| CN105893256A (en) * | 2016-03-30 | 2016-08-24 | 西北工业大学 | Software failure positioning method based on machine learning algorithm |
Non-Patent Citations (1)
| Title |
|---|
| ORANGE先生: "高斯混合模型的终极理解", 《HTTPS://BLOG.CSDN.NET/XMU_JUPITER/ARTICLE/DETAILS/50889023》 * |
Cited By (51)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107392401A (en) * | 2017-09-08 | 2017-11-24 | 上海理工大学 | Heavy-duty mill roll loads the failure prediction method of intelligent robot |
| CN108063699B (en) * | 2017-12-28 | 2020-08-28 | 携程旅游信息技术（上海）有限公司 | Network performance monitoring method and device, electronic equipment and storage medium |
| CN109976986B (en) * | 2017-12-28 | 2023-12-19 | 阿里巴巴集团控股有限公司 | Abnormal equipment detection method and device |
| CN109976986A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | The detection method and device of warping apparatus |
| CN108063699A (en) * | 2017-12-28 | 2018-05-22 | 携程旅游信息技术（上海）有限公司 | Network performance monitoring method, apparatus, electronic equipment, storage medium |
| CN108111359A (en) * | 2018-01-19 | 2018-06-01 | 北京奇艺世纪科技有限公司 | A kind of monitor processing method, device and monitoring processing system |
| CN108449313A (en) * | 2018-02-01 | 2018-08-24 | 平安科技（深圳）有限公司 | Electronic device, Internet service system method for prewarning risk and storage medium |
| CN108449313B (en) * | 2018-02-01 | 2021-02-19 | 平安科技（深圳）有限公司 | Electronic device, Internet service system risk early warning method and storage medium |
| CN108376553A (en) * | 2018-02-28 | 2018-08-07 | 北京奇艺世纪科技有限公司 | A kind of monitoring method and system of the disk of video server |
| CN108764290A (en) * | 2018-04-26 | 2018-11-06 | 阿里巴巴集团控股有限公司 | The reason of model unusual fluctuation, determines method and device and electronic equipment |
| CN108764290B (en) * | 2018-04-26 | 2021-07-30 | 创新先进技术有限公司 | Method and device for determining cause of model transaction and electronic equipment |
| CN108984376A (en) * | 2018-05-31 | 2018-12-11 | 阿里巴巴集团控股有限公司 | A kind of system anomaly detection method, device and equipment |
| CN108920326A (en) * | 2018-06-14 | 2018-11-30 | 阿里巴巴集团控股有限公司 | Determine system time-consuming abnormal method, apparatus and electronic equipment |
| CN110635962A (en) * | 2018-06-25 | 2019-12-31 | 阿里巴巴集团控股有限公司 | Abnormity analysis method and device for distributed system |
| CN110635962B (en) * | 2018-06-25 | 2022-12-16 | 阿里巴巴集团控股有限公司 | Abnormity analysis method and device for distributed system |
| CN108647942A (en) * | 2018-07-27 | 2018-10-12 | 重庆爱鸽者智能科技有限公司 | A kind of distributed pigeon racing based on general mobile terminal is judged system |
| CN108647942B (en) * | 2018-07-27 | 2024-03-15 | 重庆爱鸽者智能科技有限公司 | Distributed racing pigeon cutting system based on universal mobile terminal |
| CN109325061A (en) * | 2018-08-24 | 2019-02-12 | 北京天元创新科技有限公司 | A kind of method for processing abnormal data and device based on probability distribution |
| CN109144820A (en) * | 2018-08-31 | 2019-01-04 | 新华三信息安全技术有限公司 | A kind of detection method and device of abnormal host |
| CN111078488B (en) * | 2018-10-18 | 2021-11-09 | 杭州海康威视数字技术股份有限公司 | Data acquisition method, device, storage medium and system |
| CN111078488A (en) * | 2018-10-18 | 2020-04-28 | 杭州海康威视数字技术股份有限公司 | Data acquisition method, device, storage medium and system |
| CN109558295A (en) * | 2018-11-15 | 2019-04-02 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| CN109857618A (en) * | 2019-02-02 | 2019-06-07 | 中国银行股份有限公司 | A kind of monitoring method, apparatus and system |
| CN109857618B (en) * | 2019-02-02 | 2022-07-08 | 中国银行股份有限公司 | Monitoring method, device and system |
| CN110008082B (en) * | 2019-03-16 | 2022-06-17 | 平安科技（深圳）有限公司 | Abnormal task intelligent monitoring method, device, equipment and storage medium |
| CN110008082A (en) * | 2019-03-16 | 2019-07-12 | 平安科技（深圳）有限公司 | Abnormal task intelligent monitoring method, device, equipment and storage medium |
| CN109947625A (en) * | 2019-03-27 | 2019-06-28 | 阿里巴巴集团控股有限公司 | The recognition methods of abnormal single machine and device in a kind of cluster |
| CN110399268B (en) * | 2019-07-26 | 2023-09-26 | 创新先进技术有限公司 | Abnormal data detection method, device and equipment |
| CN110399268A (en) * | 2019-07-26 | 2019-11-01 | 阿里巴巴集团控股有限公司 | A kind of method, device and equipment of anomaly data detection |
| CN110661818A (en) * | 2019-10-30 | 2020-01-07 | 腾讯云计算（北京）有限责任公司 | Event anomaly detection method and device, readable storage medium and computer equipment |
| CN110661818B (en) * | 2019-10-30 | 2022-07-08 | 腾讯云计算（北京）有限责任公司 | Event anomaly detection method and device, readable storage medium and computer equipment |
| CN111126813A (en) * | 2019-12-16 | 2020-05-08 | 东软集团股份有限公司 | Method and device for determining equipment state, storage medium and electronic equipment |
| CN111126813B (en) * | 2019-12-16 | 2023-10-31 | 东软集团股份有限公司 | Method and device for determining equipment state, storage medium and electronic equipment |
| CN112988501A (en) * | 2019-12-17 | 2021-06-18 | 深信服科技股份有限公司 | Alarm information generation method and device, electronic equipment and storage medium |
| CN111260133A (en) * | 2020-01-16 | 2020-06-09 | 支付宝(杭州)信息技术有限公司 | Optimization method and device of quality monitoring model for monitoring research and development quality |
| CN111598661B (en) * | 2020-05-14 | 2023-09-22 | 拉扎斯网络科技（上海）有限公司 | Exception report processing method and device, platform server and storage medium |
| CN111598661A (en) * | 2020-05-14 | 2020-08-28 | 拉扎斯网络科技（上海）有限公司 | Abnormal report processing method and device, platform server and storage medium |
| CN111708687A (en) * | 2020-06-15 | 2020-09-25 | 北京优特捷信息技术有限公司 | Equipment abnormality index determination method, device, equipment and storage medium |
| CN111708687B (en) * | 2020-06-15 | 2021-07-27 | 北京优特捷信息技术有限公司 | Equipment abnormality index determination method, device, equipment and storage medium |
| CN111738463A (en) * | 2020-06-17 | 2020-10-02 | 深圳华远云联数据科技有限公司 | Operation and maintenance method, device, system, electronic equipment and storage medium |
| CN111880990B (en) * | 2020-07-20 | 2023-10-27 | 北京三快在线科技有限公司 | Exception handling method and device |
| CN111880990A (en) * | 2020-07-20 | 2020-11-03 | 北京三快在线科技有限公司 | Exception handling method and device |
| CN113297307A (en) * | 2020-08-15 | 2021-08-24 | 阿里巴巴集团控股有限公司 | Database request identification and anomaly detection method, device, equipment and medium |
| CN113297307B (en) * | 2020-08-15 | 2024-03-05 | 阿里巴巴集团控股有限公司 | Database request identification and anomaly detection methods, devices, equipment and media |
| CN112511372A (en) * | 2020-11-06 | 2021-03-16 | 新华三技术有限公司 | Anomaly detection method, device and equipment |
| CN112799898B (en) * | 2021-01-08 | 2023-03-24 | 北京科技大学 | Interconnection system fault node positioning method and system based on distributed fault detection |
| CN112799898A (en) * | 2021-01-08 | 2021-05-14 | 北京科技大学 | Interconnection system fault node positioning method and system based on distributed fault detection |
| CN112905419B (en) * | 2021-03-02 | 2022-11-15 | 广州虎牙科技有限公司 | Index data monitoring threshold range determining method and device and readable storage medium |
| CN112905419A (en) * | 2021-03-02 | 2021-06-04 | 广州虎牙科技有限公司 | Index data monitoring threshold range determination method and device and readable storage medium |
| CN114419679A (en) * | 2022-04-01 | 2022-04-29 | 广东省通信产业服务有限公司 | Data analysis method, device and system based on wearable device data |
| CN115238831A (en) * | 2022-09-21 | 2022-10-25 | 中国南方电网有限责任公司超高压输电公司广州局 | Fault prediction method, apparatus, computer device, storage medium and program product |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107066365B (en) | 2021-01-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107066365A (en) | The monitoring method and device of a kind of system exception | |
| CN109960395B (en) | Resource scheduling method and computer equipment | |
| TWI790726B (en) | Data real-time monitoring method, apparatus, electronic device, and non-transitory computer-readable storage medium stored with computer instructions based on machine learning | |
| TWI745623B (en) | Model integration method and device | |
| US10248561B2 (en) | Stateless detection of out-of-memory events in virtual machines | |
| CN108038040A (en) | Computer cluster performance indicator detection method, electronic equipment and storage medium | |
| ES2950039T3 (en) | Automated identification of a device's state and resulting dynamic modification of device operations | |
| CN107526666A (en) | Alarm method, system, device and electronic equipment based on deep learning | |
| CN109214436A (en) | A kind of prediction model training method and device for target scene | |
| CN109491850A (en) | A kind of disk failure prediction technique and device | |
| US8578023B2 (en) | Computer resource utilization modeling for multiple workloads | |
| CN109634819B (en) | Alarm root cause positioning method and device and electronic equipment | |
| JP6869347B2 (en) | Risk control event automatic processing method and equipment | |
| CN107526667A (en) | A kind of Indexes Abnormality detection method, device and electronic equipment | |
| CN107515663A (en) | The method and apparatus for adjusting central processor core running frequency | |
| CN110322349A (en) | A kind of processing method of data, device and equipment | |
| CN110198272A (en) | A kind of flow control methods and device, storage medium | |
| CN105447304A (en) | Self-learning algorithm based warning system and mobile terminal | |
| CN109711155A (en) | A kind of early warning determines method and apparatus | |
| CN108108866A (en) | A kind of method and device of risk control | |
| CN109426912A (en) | Air control system optimization method, system, device and electronic equipment | |
| CN109992473A (en) | Monitoring method, device, equipment and the storage medium of application system | |
| CN107402871A (en) | Terminal capabilities monitoring method and device, monitoring document handling method and device | |
| CN110021150A (en) | A kind of data processing method, device and equipment | |
| CN110351136A (en) | A kind of Fault Locating Method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |