CN107066365B - System abnormity monitoring method and device - Google Patents
System abnormity monitoring method and device Download PDFInfo
- Publication number
- CN107066365B CN107066365B CN201710089648.4A CN201710089648A CN107066365B CN 107066365 B CN107066365 B CN 107066365B CN 201710089648 A CN201710089648 A CN 201710089648A CN 107066365 B CN107066365 B CN 107066365B
- Authority
- CN
- China
- Prior art keywords
- dimension
- abnormal
- judgment
- model
- target system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 54
- 238000012544 monitoring process Methods 0.000 title claims abstract description 43
- 230000002159 abnormal effect Effects 0.000 claims description 129
- 230000005856 abnormality Effects 0.000 claims description 96
- 238000012549 training Methods 0.000 claims description 42
- 239000000203 mixture Substances 0.000 claims description 17
- 238000012806 monitoring device Methods 0.000 claims description 17
- 238000004364 calculation method Methods 0.000 claims description 15
- 238000004422 calculation algorithm Methods 0.000 claims description 7
- 238000012545 processing Methods 0.000 abstract description 9
- 230000008569 process Effects 0.000 description 12
- 238000003860 storage Methods 0.000 description 12
- 238000010586 diagram Methods 0.000 description 11
- 238000004590 computer program Methods 0.000 description 9
- 230000006870 function Effects 0.000 description 9
- 230000006872 improvement Effects 0.000 description 9
- 238000009826 distribution Methods 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000007476 Maximum Likelihood Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 229920001296 polysiloxane Polymers 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The application discloses a method and a device for monitoring system abnormity. Therefore, by the method, the operation condition of the target system is determined according to the trained abnormity judgment model, corresponding processing can be performed according to the actual operation condition of the target system, the probability of false alarm and false alarm of the abnormity of the target system is reduced compared with the prior art, and the monitoring accuracy and the monitoring efficiency are improved.
Description
Technical Field
The present application relates to the field of information technologies, and in particular, to a method and an apparatus for monitoring system anomalies.
Background
With the development of information technology, service providers provide more and more kinds of services for users, which results in more and more bulky and widespread systems for providing services for users.
Generally, when a system runs, due to various reasons such as network delay, equipment downtime, timeout of a third party and the like, the phenomenon of system abnormity occurs to cause system blocking, the system running efficiency is influenced slightly, and the service in the system cannot be normally carried out seriously, so that on one hand, people are dedicated to ensuring smooth running of the system to reduce the phenomenon of system abnormity, on the other hand, how to early warn the system abnormity is carried out, and when the system is blocked, people find the system as early as possible and take corresponding measures as soon as possible, which also becomes a problem of important attention of people.
In the prior art, a method adopted by a person when judging that a system is abnormal is to set a warning threshold corresponding to normal operation of each device in the system, monitor operation conditions of each device in the system, judge that the device is abnormal and possibly cause system abnormality if it is monitored that data corresponding to the operation of a certain device exceeds the warning threshold corresponding to the device, send an alarm signal for the device at the moment, and prompt a worker that the device is abnormal, so that the worker can manually troubleshoot the device. The devices in the system include, but are not limited to, a Central Processing Unit (CPU), a memory, a database, and other devices, and the data corresponding to the monitoring of the running of each device includes, but is not limited to, a data call amount, a device error reporting amount, a working state, and the like.
However, a normal system jitter phenomenon may occur occasionally during the system operation process, that is, when the instantaneous data of the device in the system is abnormal, the system operation state is jittered, but the phenomenon belongs to a normal phenomenon during the system operation, and is different from the abnormal phenomenon of the system, the time for the system to jitter is short, which may not cause the system to be stuck and affect the normal operation of the system, however, when the system jitter occurs, the data generated during the system operation may exceed the warning threshold preset by the operator, which may cause the situation of false alarm in the monitoring method for the system abnormality in the prior art.
Further, since each device may not operate exactly at the same time during the day, for example, the device serving the user is typically less stressed to operate in the early morning hours and more stressed to operate during the daytime hours. Meanwhile, the operation conditions of different devices in the same time period may not be completely consistent, for example, after the settlement device ends every day, data generated in one day may be summarized and sorted, so that the operation pressure may be higher in the early morning and be idle in the daytime, in the prior art, a warning threshold needs to be set for each device in a targeted manner, and a worker may need to adjust the warning threshold in different application scenarios, so as to avoid missing or misinformation, which may cause difficulty in accurately monitoring system abnormality.
Therefore, in the conventional monitoring method for system abnormity, due to the fact that workers need to set warning thresholds corresponding to different devices and adjust the warning thresholds corresponding to the devices according to different application scenarios, the monitoring method for system abnormity is easy to fail to report and report by mistake, and the conventional monitoring method for system abnormity is low in accuracy.
Disclosure of Invention
The embodiment of the application provides a method for monitoring system abnormity, which is used for solving the problem that in the prior art, in the process of monitoring the system abnormity, warning threshold values need to be manually set for all devices, so that the accuracy rate of monitoring the system abnormity is low.
The embodiment of the application provides a monitoring device for system abnormity, which is used for solving the problem that in the prior art, in the monitoring process of the system abnormity, warning threshold values need to be manually set for all equipment, so that the accuracy rate of monitoring the system abnormity is low.
The embodiment of the application adopts the following technical scheme:
a method for monitoring system abnormity comprises the following steps:
collecting characteristic values of at least one dimension generated by a target system;
determining the probability of the target system with abnormality according to the characteristic value of each dimension and an abnormality judgment model obtained through training;
and when the probability is between the small probability intervals corresponding to the abnormity judgment model, determining that the target system is abnormal.
A system anomaly monitoring device comprising:
the determining module is used for acquiring the characteristic value of at least one dimension generated by the target system;
the calculation module is used for determining the probability of the target system being abnormal according to the characteristic values of all dimensions and an abnormal judgment model obtained through training;
and the judging module is used for determining that the target system is abnormal when the probability is between the small probability intervals corresponding to the abnormal judging model.
The embodiment of the application adopts at least one technical scheme which can achieve the following beneficial effects:
firstly, determining characteristic values of all dimensions generated by a target system, then determining the probability of the target system being abnormal according to an abnormal judgment model obtained by pre-training, and determining the target system being abnormal when the probability is in a small probability interval corresponding to the abnormal judgment model. Therefore, by the method, the operation condition of the system is determined according to the trained abnormity judgment model, corresponding processing can be performed according to the actual condition of the system, the probability of false alarm and missed alarm of the system abnormity is reduced compared with the prior art, and the monitoring accuracy is improved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:
fig. 1 is a monitoring process of system anomaly according to an embodiment of the present application;
fig. 2 is a schematic structural diagram of a system anomaly monitoring device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions of the present application will be described in detail and completely with reference to the following specific embodiments of the present application and the accompanying drawings. It should be apparent that the described embodiments are only some of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The technical solutions provided by the embodiments of the present application are described in detail below with reference to the accompanying drawings.
Fig. 1 is a process for monitoring system anomaly according to an embodiment of the present application, which may specifically include the following steps:
s101: feature values of at least one dimension generated by the target system are collected.
In the embodiment of the present application, the monitoring device for monitoring the abnormal condition occurring in the target system may be a monitoring device in the target system, or may be a monitoring server independent of the target system. Of course, in order to avoid that the target system is stuck to cause the device to monitor the abnormal condition of the target system, the monitoring device is usually a monitoring server independent from the target system, in this embodiment of the present application, the monitoring device may also be a server, and the server monitors the abnormal condition of the target system, and the present application does not limit whether the server is located in the target system, and may be configured according to the needs of the actual application.
And in the embodiments of the present application, the dimensions recited include, but are not limited to: one of the system calling quantity dimension, the system called quantity dimension, the system calling duration dimension, the error quantity dimension in the system and the calling quantity dimension of the system to the database; the feature value of each dimension may be a numerical value of data of different dimensions generated by the target system, wherein the feature value of each dimension may include, but is not limited to: at least one of a value of the calling quantity of the target system, a value of the called quantity of the target system, a value of the calling duration of the target system, a value of the error quantity in the target system and a value of the calling quantity of the target system to the database. That is, the magnitudes of the eigenvalues of the different dimensions may correspondingly represent the operating condition of the target system.
Further, the feature values of different dimensions of the target system collected by the server, that is, the values corresponding to the different dimensions, for example, when the dimensions are called quantities, the feature values of the dimensions may reflect the operation load of the target system caused by external access to the target system, and the specific values of the called quantities may be used to subsequently determine whether the target system is abnormal.
In addition, how to monitor the abnormal situation of the target system is described in the embodiment of the present application by taking the monitoring server as an example. When monitoring the abnormal condition of the target system, the server may monitor the characteristic value of each dimension generated by the target system with a preset time period (i.e., unit time) as a monitoring period, where the monitoring of the target system may be continuous (for example, when the monitoring of the previous time period ends, the monitoring of the next time period starts immediately), or discontinuous (for example, a fixed time period of each day is monitored as a time period).
Specifically, the server determines the feature value of each dimension generated by the target system in the last unit time according to a time period which is divided by a time length of each minute in each natural day in advance as a unit time, that is, the feature value of each dimension generated by the target system in one minute is collected every time one minute passes.
For example, if each natural day has 24 hours, i.e., 1440 minutes, one natural day is divided into 1440 units of time per minute, and each time one minute passes, the feature value of each dimension generated by the target system in the last minute (i.e., in the last unit of time) is determined. If the current time is 23 o 'clock 58 min 59 sec, the server can determine the feature values of each dimension generated by the target system within 23 o' clock 58 min 0 sec to 23 o 'clock 58 min 60 sec when the next second is 23 o' clock 59 min 0 sec.
The call volume of the target system is then the volume of data that the target system calls from an external (e.g., third party device) device. The target system is not independent in operation, and data transmission and calling with an external device are required, so that the operating pressure of the target system can be determined through the calling amount of the target system;
the called amount of the target system is the amount of the target system responding to the request of an external (such as a third-party device) device and sending data to the external device, and the called amount of the target system can also represent the operating pressure of the target system;
the calling duration of the target system is the time consumed by the target system for calling data of external equipment (such as third-party equipment), and whether a problem occurs in a third party or whether delay occurs in a network can be determined;
the error amount in the target system is the number of call failures occurring when the target system calls data or responds to a request of an external device, and may be used to determine the situation of the error occurring inside the target system, where the server may specifically obtain the number of error reporting information sent when the target system fails to call, as the number of call failures occurring in the target system, or the server may also obtain the number of execution failure services, as the number of call failures occurring in the target system, and specifically what method is specifically adopted may be set by a worker according to the needs of actual applications, which is not limited in the present application;
the calling amount of the target system to the database is the amount of the target system calling data from the database corresponding to the target system. Since the data that needs to be used during the execution of the service is not completely stored in the target system, the target system usually needs to call the data in the database during the operation, for example, the personal information of the user may be stored in the database corresponding to the target system, so when the target system executes the service that needs to use the personal information of the user, the target system needs to call the personal information of the user from the database, and the call volume of the target system to the database may also determine the operation state of the target system.
Further, the server can acquire the corresponding feature values of different dimensions in each unit time by taking the unit time as the time length, so that the server can determine the operation conditions of the target system in different unit times through the feature values of the dimensions, and the operation conditions of the target can be embodied through the feature values of multiple dimensions.
The server may be a single device, or may be a target system including a plurality of devices. The calling volume of the target system, the called volume of the target system, the calling duration of the target system, the error volume in the target system, and the calling volume of the target system to the database may all be regarded as data with different dimensions. Besides the different dimensions listed in the embodiment of the present application, other dimensions may also be included (for example, the occupancy rate of the target system to the network bandwidth, the waiting time of the target system for response, and the like), and specific contents of the other dimensions may be determined according to actual needs, and are not described here any more.
S102: and determining the probability of the target system with abnormality according to the characteristic values of the dimensions and the abnormality judgment model obtained through training.
In this embodiment, when the server obtains the feature values of each dimension generated by the target system in the last unit time, the probability that the target system is abnormal in the last unit time may be determined according to the abnormal determination model corresponding to the unit time after the pre-training is completed, so as to determine whether the target system is abnormal in the last unit time in the following.
Specifically, the abnormality determination model may be a gaussian mixture model or other models, and is not limited in this respect. In the embodiment of the present application, a gaussian mixture model is taken as an example of an abnormality determination model.
Therefore, the server may determine, in advance, a gaussian mixture model corresponding to the unit time of the monitoring of the abnormality of the target system this time according to each divided unit time, input the feature value of each dimension determined in step S101 into the gaussian mixture model, and calculate to obtain the probability of the abnormality of the target system, where each gaussian mixture model is an abnormality judgment sub-model of different time periods.
In this embodiment, the server may specifically calculate the probability of the target system having an abnormality in the time period (i.e., the unit time) by using the following formula:
wherein, the Gaussian formula is
Wherein, P (x)t) Representing the probability of the target system being abnormal in the t unit time; t represents the t-th unit time; k represents the kth dimension; l represents the total number of dimensions; w is aktRepresenting the weight value corresponding to the characteristic value of the kth dimension in the t unit time; gkt(xkt，ukt，σkt) An abnormality judgment submodel corresponding to the characteristic value of the kth dimension in the t unit time; x is the number ofktA numerical value corresponding to the characteristic value of the kth dimension generated by the target system in the t unit time and determined by the server; u. ofktRepresenting the average value of sample data of a kth dimension generated by the target system in the tth unit time historically; sigmaktRepresenting the variance of sample data of the kth dimension historically generated by the target system during the t unit time.
Wherein,
the weighted values corresponding to the dimensions are normalized, and it can be seen that the abnormality judgment model can be obtained through fitting by the weighted sum of the abnormal judgment submodels, and the probability of abnormality occurrence of the target system is obtained through calculation by the abnormality judgment model.
In this embodiment, a plurality of sample data in a unit time may be provided, where the sample data may belong to different dimensions or may belong to the same dimension, each sample data corresponds to a feature value, for example, the invocation amount of the target system, one feature value may be a value of the invocation amount of the target system generated in the unit period, and the sample data may be a value of at least one invocation amount of the target system historically generated by the target system in the same time period as the unit period.
The anomaly determination submodel may be expressed by using the above gaussian formula, where the gaussian formula corresponds to the unit time and corresponds to a feature value of a dimension, that is, in the embodiment of the present application, the same dimension of different time periods may correspond to gaussian formulas that are not completely consistent, and different dimensions of the same time period may also correspond to gaussian formulas that are not completely consistent. Since the gaussian mixture model can be obtained by fitting a plurality of abnormal judgment submodels corresponding to different dimensions, and each abnormal judgment submodel corresponds to the same time period (i.e., unit time), the gaussian mixture model (i.e., the abnormal judgment model) used by the server for calculating the abnormal probability of the target system can not be completely consistent when the abnormal judgment submodels are in different time periods. For example, the abnormality determination model corresponding to a time period of 2016, 12/1/12: 00 to 2016, 12/1/12: 01 may not completely match the abnormality determination model corresponding to a time period of 2016, 12/1/12: 01 to 2016, 12/1/12/02.
Of course, since the abnormality judgment model may be obtained by fitting the abnormality judgment submodels corresponding to the feature values of multiple dimensions, each of the abnormality judgment models corresponding to different time periods may be obtained by calculating the feature values of different dimensions. For example, continuing with the two anomaly determination models in the above example, both anomaly determination models may be formed by: the values of the calling quantity of the target system, the value of the called quantity of the target system, the value of the calling duration of the target system, the value of the error quantity in the target system and the value of the calling quantity of the target system to the database are obtained by fitting the abnormal judgment submodels corresponding to the characteristic values of the five dimensions respectively.
Correspondingly, in this embodiment of the present application, the characteristic values of the dimensions determined by the server may include: the value of the calling quantity of the target system, the value of the called quantity of the target system, the value of the calling duration of the target system, the value of the error quantity in the target system and the value of the calling quantity of the target system to the database, so that L can be 5, and then
In addition, u isktAnd the sigmaktWhen the gaussian mixture model is trained, the server determines the k-dimensional characteristic value generated by the target system in the t unit time on each of the preset number of days, that is, a value determined according to sample data used in training the gaussian mixture model. The preset number of days may be set by the staff according to the actual application, for example, 90 days (i.e., data generated by the target system in a quarter as a sample), 180 days (i.e., the target system in a half year)Data generated by the system as a sample), or 360 days (i.e., data generated by the target system in one year as a sample), etc.
In particular, u isktMay be the average of the sample data of the kth dimension generated by the target system during the t unit time of each day over the past 180 days, σktIt may be the variance corresponding to the sample data of the kth dimension generated in the t unit time of each day in the past 180 days by the target system, that is, the average value used in the variance calculation is uktSince the mean and variance are definite mathematical concepts, the corresponding formulas are not listed in the present application.
It can be seen that the probability of the abnormality of the target system can be calculated and obtained through the weighted sum of the abnormal judgment submodels.
Furthermore, the weight value w corresponding to each abnormal judgment sub-modelktIn order to improve the accuracy of the abnormality determination model, in the embodiment of the present application, the server may further determine whether the initial weight values of the abnormality determination submodels corresponding to the respective dimensions converge, respectively, for the initial weight values of the abnormality determination submodels corresponding to the respective dimensions, and when the determination result for the initial weight values of the abnormality determination submodels corresponding to the respective dimensions satisfies the convergence condition, fit the abnormal determination model according to the initial weight values of the converged abnormal determination submodels, or when the determination result for the initial weight values of the abnormal determination submodels corresponding to the respective dimensions does not satisfy the convergence condition, adjust the initial weight values that do not satisfy the convergence condition.
Specifically, the server may adopt an Expectation Maximization (EM) Algorithm to apply an initial weight value (i.e., w) corresponding to each dimension feature value in the gaussian mixture modelkt) And E, calculating to obtain an updated weight value of each initial weight value, and judging whether the initial weight value is converged or not according to the updated weight value and the initial weight value.
And when the judgment result of the initial weight value of the abnormal judgment submodel corresponding to each dimension meets the convergence condition, fitting to obtain the abnormal judgment model according to the initial weight value of each abnormal judgment submodel which converges. In the embodiment of the present application, since the weight values corresponding to the abnormal judgment submodels are normalized, when the weight value of the abnormal judgment submodel corresponding to a certain dimension is converged and the weight values of the abnormal judgment submodels corresponding to other dimensions are not converged, the server may continue to train the weight values until the weight values are converged, and judge the weight values by using the converged weight values as the convergence condition;
alternatively, the convergence condition may be that the server may train only the non-converged weight values until each weight value converges;
alternatively, the convergence condition may be that, as long as one weight value converges, each weight value is determined to satisfy the convergence condition, and the training process for each weight value is stopped, and so on. Of course, the specific manner in which the present application can be set by the worker is not limited.
If the initial weight value does not meet the preset threshold value, the initial weight value of the abnormality judgment submodel corresponding to at least one dimension is adjusted (namely, the initial weight value of the abnormality judgment submodel corresponding to the dimension is trained).
Specifically, the server may continue to cyclically adopt the step M and the step E of the EM algorithm, train an initial weight value of the abnormality judgment submodel corresponding to the dimension, and judge again whether the weight value obtained by the training of the abnormality judgment submodel corresponding to the dimension converges, if so, use the trained weight value as a weight value of the abnormality judgment submodel corresponding to the dimension for fitting the abnormality judgment model, and if not, continue to train the weight value obtained by the training of the abnormality judgment submodel corresponding to the dimension again until the weight value obtained by the training of the abnormality judgment submodel corresponding to the dimension converges.
It should be noted that the training process of the weight values is performed in advanceTraining object may be said to be x 'of the previous day'ktAnd corresponding abnormal judgment submodels.
Specifically, the server may adopt an initialized random number as each w during the trainingktThe initial corresponding values, of course, are normalized by the weight values corresponding to the eigenvalues of each dimension, so each wktThe initial corresponding values are also normalized.
First, in step E of the EM algorithm, the x 'is calculated'ktThe probability generated by the Gaussian model corresponding to the characteristic value of the k-th dimension can adopt a formula
And calculating, namely calculating to obtain the maximum likelihood estimation value corresponding to the characteristic value of each dimension. The w obtained at this timektIs the updated weight value of the initial weight value, the server can be based on the wktAnd judging whether the initial weight value is converged, judging whether the weight value corresponding to each dimension meets a convergence condition, if so, directly adopting the initial weight value to fit the abnormal judgment model (namely, the Gaussian mixture model), and if not, continuing to execute the subsequent M steps by the server.
In the M step of the EM algorithm, recalculating the abnormality judgment submodel corresponding to the characteristic value of the kth dimension and recalculating the corresponding w of the abnormality judgment submodelktThe parameters of (2) can be specifically expressed by formulas
And formulas
Wherein, the xiktAnd the sample data corresponding to the ith training sample of the characteristic value of the kth dimension in the tth unit time. Then, at this time, the parameters u of the abnormal judgment submodelsktAnd σktAfter updating the parameters, the server can continue the calculation in step E according to the updated parameters, continue to update the weight value of the abnormality judgment submodel of the kth dimension, judge whether to converge, and judge whether to judge again whether to convergeThe convergence condition is satisfied.
The server may then cycle through E and M steps (i.e., training each weight value) until wktUntil the convergence condition is satisfied (i.e., training is complete). Wherein, the server determines whether the weighted value converges, which may be w obtained in the previous stepktWith w obtained in the next stepktIs less than a preset value, or the number of repeated iterations reaches a preset number, and so on. The specific manner to determine whether to converge or not, or how to set the convergence value, may be set by the operator according to the needs of the practical application, and the present application does not limit this.
S103: and when the probability is between the small probability intervals corresponding to the abnormity judgment model, determining that the target system is abnormal.
In the embodiment of the present application, after the server determines the probability that the target system is abnormal in the unit time, it may determine whether the probability corresponds to a small probability event according to gaussian theorem, that is, determine whether the probability is within a small probability interval corresponding to the abnormality determination model, and determine that the target system is abnormal when the probability is determined to be within the small probability interval.
Specifically, a method of determining 3 times variance in gaussian theorem, that is, determining whether P (x) is present or not, may be adoptedt)≤P(ut±3σt) If so, determining that the target system is abnormal in the unit time and giving an alarm, otherwise determining that the target system is not abnormal in the unit time. That is to say, the server may determine, according to the trained anomaly determination model, a distribution of the anomaly probability corresponding to the target system in the unit time, specifically, a number of dimensions of the feature values used, for example, if only feature values of 2 dimensions are used, the server may determine, in a two-dimensional space, a distribution of the anomaly probability corresponding to the target system in the unit time, and if feature dimensions of 5 dimensions are used, the server may determine, in a 5-dimensional vector space, a distribution of the anomaly probability corresponding to the target system in the unit time, and then the server may determine that the target system is in the unit timeAnd if the probability of the corresponding abnormality in the unit time is in the interval of the small probability event in the spatial distribution, determining that the target system is abnormal if the probability is in the interval of the small probability event in the spatial distribution, and otherwise, determining that the target system is normal.
Further, after the server determines that the target system is abnormal, in the embodiment of the present application, the server may further send an alarm message to prompt the worker that the target system is abnormal, so that the worker may start processing in time, and of course, how to send the alarm message is not specifically limited.
Through the method for monitoring the target system abnormality shown in fig. 1, the server may determine, based on feature values of multiple dimensions and according to a pre-trained abnormality determination model, a probability that the target system is abnormal, and determine that the target system is abnormal when the probability is in a small probability interval corresponding to the abnormality determination model. The abnormality judgment model can be a Gaussian mixture model and can correspond to one of the pre-divided unit times, namely each different unit time can correspond to an incompletely consistent Gaussian mixture model, so that the method provided by the application can give consideration to the running conditions of the target system corresponding to different time periods in one day, and the abnormality of the target system can be accurately monitored. Meanwhile, different from the prior art, the method for setting the warning threshold value for each device is characterized in that the abnormal probability distribution corresponding to the whole target system in different unit time is determined according to the historical records, namely the characteristic value of each dimensionality generated by the target system is not the data of a single device but the characteristic value corresponds to the data of the whole target system, so that the abnormity of the target system is judged more accurately, the missing report and the false report of the abnormity of the target system can be effectively avoided, and the abnormity monitoring efficiency of the target system is improved.
In addition, in this embodiment of the application, in order to reduce negative effects caused by target system jitter, the server may determine, according to a preset number, an average value of sample data of the dimension in a plurality of time periods adjacent to the time period, as the feature value of the dimension generated by the target system in the time period, for the feature value of each dimension. The preset number can be set by a worker according to the requirements in actual application.
For example, if the currently determined unit time is one minute corresponding to 23:58 to 23:59, and the preset number is 5, the server may determine feature values of the dimensions generated by the target system in 5 minutes before 23:58, and determine an average value of the feature values of the dimensions according to different dimensions, as the feature values of the dimensions corresponding to 23:58 to 23: 59.
Further, when the mixed feature model is trained, since the target system may be abnormal in history, and then there may be an abnormal feature value in the history, the server may determine, according to the feature value marked as abnormal, a dimension corresponding to the feature value marked as abnormal, determine a plurality of sample data of the dimension generated by the target system in the same time period of the time period, and replace the feature value marked as abnormal by using a sum of a mean value and a random multiple of a variance of the plurality of feature values, as a sample for training the abnormality determination model (i.e., a mixed gaussian model).
Specifically, the server may calculate, instead of the sample data marked as abnormal, a plurality of sample data which are not marked as abnormal in the dimension and are generated by the target system in the same time period as the time period, and then the server may use a formula xkt anomaly＝uNot abnormal kt+α·σNot abnormal ktRecalculating the eigenvalues that determined the flag to be abnormal, where xkt anomalyA recalculated value, u, representing the characteristic value of the flag as abnormalNot abnormal ktRepresenting the mean, σ, of a number of eigenvalues corresponding to this dimension that are not marked as anomaliesNot abnormal ktAnd a is a random number between zero and one, and represents the variance of a plurality of characteristic values which are not marked as anomalies and correspond to the dimension.
For example, for 12: in the sample data of the corresponding k dimension in the time period of 01 to 12 points 02, one is marked as abnormalSample data, assuming the current date is 2016, 12 and 31 days, the server can collect 12 of the target system at 2016, 12 and 20 days, 2016, 12 and 19 days, 2016, 12 and 4 days, 2016, 12 and 1 day: 01 to 12 points 02 generate 4 sample data of the k dimension which are not marked as abnormal and adopt a formula, xkt anomaly＝uNot abnormal kt+α·σNot abnormal ktAnd calculating to obtain the numerical value of the sample data marked as abnormal in the sample data replacing the k dimension.
The server may randomly select a plurality of sample data which are not marked as abnormal from all the sample data of the dimension generated by the target system in the same time period, and the number of the sample data which are not marked as abnormal may be set by a worker.
Further, in order to reduce the operating pressure of the server, the server may randomly select a plurality of sample data of the dimension generated by the target system in the same time period of the time period, rather than being limited to performing calculation by acquiring sample data that is not marked as an exception, and replace the sample data marked as an exception with a calculation result.
Of course, for the sample data of a plurality of dimensions selected by the server, more restrictions, such as temporal restrictions, may also be added, which is not limited in this application.
By replacing the sample data marked as abnormal by the substitute numerical value obtained by calculating the plurality of sample data, the influence of the sample data marked as abnormal on the abnormal judgment model can be effectively reduced, the small probability interval corresponding to the abnormal judgment model can be more accurate, and the accuracy of the system abnormal monitoring method is increased.
Based on the method for monitoring system abnormality shown in fig. 1, the embodiment of the present application further provides a schematic structural diagram of a device for monitoring system abnormality, as shown in fig. 2.
Fig. 2 is a schematic structural diagram of a system anomaly monitoring device according to an embodiment of the present application, including:
a determining module 201, which collects at least one dimension characteristic value generated by the target system;
the calculation module 202 determines the probability of the target system being abnormal according to the feature values of the dimensions and the abnormal judgment model obtained through training;
the judging module 203 determines that the target system is abnormal when the probability is between the small probability intervals corresponding to the abnormal judgment models.
The judging module 203 sends out an alarm message when determining that the target system is abnormal.
The calculation module 202 acquires sample data of at least one dimension generated by the target system history, executes the following operation for the sample data of each dimension, trains and obtains an abnormality judgment submodel corresponding to the sample data of the dimension according to the sample data of the dimension, and fits and obtains the abnormality judgment model according to the obtained abnormality judgment submodel when obtaining the abnormality judgment submodel corresponding to the sample data of each dimension.
The calculation module 202 determines a time period, acquires sample data of the dimension generated in the time period, and trains to obtain an abnormal judgment sub-model corresponding to the dimension in the time period according to the sample data.
The calculation module 202 searches sample data of the dimension generated in the same time period as the time period from sample data generated in history of the target system, and uses the found sample data as a training sample of the abnormal judgment submodel corresponding to the time period.
The calculating module 202, when obtaining the abnormality judgment submodel corresponding to each dimension, assigns an initial weight value to the abnormality judgment submodel corresponding to each dimension, and performs the following operations for the initial weight values of the abnormality judgment submodels corresponding to each dimension, respectively: judging whether the initial weight value of the abnormal judgment submodel corresponding to the dimension converges or not, fitting to obtain an abnormal judgment model according to the initial weight value of each converged abnormal judgment submodel when the judgment result of the initial weight value of the abnormal judgment submodel corresponding to each dimension meets the convergence condition, and otherwise, adjusting the initial weight value of the abnormal judgment submodel corresponding to at least one dimension.
The calculating module 202 trains an initial weight value of the abnormal judgment sub-model corresponding to the dimension by using a maximum expectation algorithm, judges whether the weight value obtained by training the abnormal judgment sub-model corresponding to the dimension is converged, if so, takes the trained weight value as the weight value of the abnormal judgment sub-model corresponding to the dimension for fitting the abnormal judgment model, and if not, continues to train the weight value obtained by training the abnormal judgment sub-model corresponding to the dimension again until the weight value obtained by training the abnormal judgment sub-model corresponding to the dimension is converged.
Before the anomaly judgment submodel corresponding to the dimension in the time period is obtained through training, when sample data marked as anomaly exists in the obtained sample data of the dimension generated in the time period, the calculation module 202 obtains a plurality of sample data of the dimension generated by the target system in other time periods same as the time period, calculates the sum of the mean value and the variance of the obtained sample data of the dimension, and adjusts the sample data marked as anomaly in the dimension by using the sum, wherein the sum is used for training the anomaly judgment submodel corresponding to the dimension.
The determining module 201 determines, for the feature value of each dimension, an average value of sample data of the dimension in a plurality of time periods adjacent to the time period as the feature value of the dimension generated by the target system in the time period.
When the abnormal judgment model is a gaussian mixture model, the calculation module 202 determines a small probability interval corresponding to the abnormal judgment model according to a gaussian principle.
The dimensions include: the system calling quantity dimension, the system called quantity dimension, the system calling duration dimension, the error quantity dimension in the system and the calling quantity dimension of the system to the database.
Specifically, the system abnormality monitoring device shown in fig. 2 may be located in a server, and the server may be a single device or a system composed of multiple devices.
In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Hardware Description Language), traffic, pl (core universal Programming Language), HDCal (jhdware Description Language), lang, Lola, HDL, laspam, hardward Description Language (vhr Description Language), vhal (Hardware Description Language), and vhigh-Language, which are currently used in most common. It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.
The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic for the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may thus be considered a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims (16)
1. A method for monitoring system anomaly, comprising:
collecting at least one dimension characteristic value generated by a target system, wherein each dimension characteristic value corresponds to an abnormal judgment sub-model; the dimensions include: one or more of a call volume dimension of the system, a called volume dimension of the system, a call duration dimension of the system, an error volume dimension in the system, and a call volume dimension of the system to a database;
determining the probability of the target system having abnormality according to the characteristic values of the dimensions and an abnormality judgment model obtained through training, wherein the abnormality judgment model is obtained by fitting abnormality judgment sub-models corresponding to the characteristic values of the dimensions; calculating different abnormal judgment models corresponding to different time periods according to characteristic values of different dimensions; one time period corresponds to one abnormity judgment model; the abnormality judgment model is a Gaussian mixture model;
when the probability is between the small probability intervals corresponding to the abnormity judgment model, determining that the target system is abnormal;
the training to obtain the abnormal judgment model specifically comprises:
determining a time period, and acquiring sample data of each dimension generated in the time period;
training to obtain an abnormal judgment sub-model corresponding to each dimension in the time period according to the sample data;
and when the abnormality judgment submodel corresponding to each dimension is obtained, fitting to obtain an abnormality judgment model corresponding to the target system according to the obtained abnormality judgment submodel.
2. The method of monitoring of claim 1, further comprising:
and sending out a warning message when the target system is determined to be abnormal.
3. The method of claim 1, wherein obtaining sample data for the dimension generated during the time period comprises:
searching sample data of the dimension generated in the time period same as the time period from the sample data generated by the target system history;
and taking the searched sample data as a training sample of the abnormal judgment sub-model corresponding to the time period.
4. The monitoring method according to claim 1, wherein when obtaining the abnormality judgment submodel corresponding to each dimension, fitting the abnormality judgment submodel according to the obtained abnormality judgment submodel, specifically comprising:
when the abnormality judgment submodels corresponding to the dimensions are obtained, distributing initial weight values for the abnormality judgment submodels corresponding to the dimensions;
aiming at the initial weight value of the abnormality judgment submodel corresponding to each dimension, the following operations are respectively executed:
judging whether the initial weight value of the abnormal judgment submodel corresponding to the dimension is converged;
when the judgment result of the initial weight value of the abnormal judgment submodel corresponding to each dimension meets the convergence condition, fitting to obtain the abnormal judgment model according to the initial weight value of each abnormal judgment submodel which converges;
otherwise, adjusting the initial weight value of the abnormality judgment submodel corresponding to at least one dimension.
5. The monitoring method according to claim 4, wherein adjusting an initial weight value of the abnormality judgment submodel corresponding to at least one dimension specifically includes:
training the initial weight value of the abnormality judgment sub-model corresponding to the dimension by adopting a maximum expectation algorithm;
judging whether the weight value obtained by the abnormal judgment submodel corresponding to the dimension is converged or not;
if so, taking the weight value obtained by training as the weight value of the abnormality judgment sub-model corresponding to the dimension for fitting the abnormality judgment model;
if not, continuing to train the weight value obtained by the training of the abnormal judgment sub-model corresponding to the dimension again until the weight value after the training of the abnormal sub-model corresponding to the dimension is converged.
6. The method of monitoring of claim 1, further comprising:
before the corresponding abnormality judgment submodel of the dimension in the time period is obtained through training, when sample data marked as abnormality exists in the obtained sample data of the dimension generated in the time period, obtaining a plurality of sample data of the dimension in the sample data which are generated by the target system in history and in the same time period as the time period;
and calculating the sum of the mean value and the variance of the obtained sample data of the plurality of dimensions, and adjusting the sample data marked as abnormal in the dimension by using the sum, wherein the sum is used for training an abnormal judgment sub-model corresponding to the dimension.
7. The monitoring method according to claim 1, wherein the collecting of the characteristic values of at least one dimension generated by the target system comprises:
and determining the average value of the sample data of the dimension of a plurality of time periods adjacent to the time period as the characteristic value of the dimension generated by the target system in the time period aiming at the characteristic value of each dimension.
8. The method of monitoring of claim 1, further comprising:
and when the abnormal judgment model is a mixed Gaussian model, determining a small probability interval corresponding to the abnormal judgment model according to a Gaussian principle.
9. A system anomaly monitoring device, comprising:
the determining module is used for acquiring at least one dimension characteristic value generated by the target system, and each dimension characteristic value corresponds to an abnormal judgment sub-model; the dimensions include: one or more of a call volume dimension of the system, a called volume dimension of the system, a call duration dimension of the system, an error volume dimension in the system, and a call volume dimension of the system to a database;
the calculation module is used for determining the probability of the target system with abnormality according to the characteristic values of all dimensions and an abnormality judgment model obtained through training, and the abnormality judgment model is obtained by fitting abnormality judgment submodels corresponding to the characteristic values of multiple dimensions; calculating different abnormal judgment models corresponding to different time periods according to characteristic values of different dimensions; one time period corresponds to one abnormity judgment model; the abnormality judgment model is a Gaussian mixture model;
the training to obtain the abnormal judgment model specifically comprises:
determining a time period, and acquiring sample data of each dimension generated in the time period;
training to obtain an abnormal judgment sub-model corresponding to each dimension in the time period according to the sample data;
when an abnormality judgment sub-model corresponding to each dimension is obtained, fitting to obtain an abnormality judgment model corresponding to the target system according to the obtained abnormality judgment sub-model;
and the judging module is used for determining that the target system is abnormal when the probability is between the small probability intervals corresponding to the abnormal judging model.
10. The monitoring device of claim 9, wherein the determination module issues an alert message upon determining that the target system is abnormal.
11. The monitoring device according to claim 9, wherein the computing module searches sample data of the dimension generated in a time period that is the same as the time period from sample data generated in history of the target system, and uses the found sample data as a training sample of an anomaly determination sub-model corresponding to the time period.
12. The monitoring device of claim 9, wherein the calculating module, when obtaining the abnormality judgment submodel corresponding to each dimension, assigns an initial weight value to the abnormality judgment submodel corresponding to each dimension, and performs the following operations for the initial weight values of the abnormality judgment submodels corresponding to each dimension, respectively: judging whether the initial weight value of the abnormal judgment submodel corresponding to the dimension converges or not, fitting to obtain an abnormal judgment model according to the initial weight value of each converged abnormal judgment submodel when the judgment result of the initial weight value of the abnormal judgment submodel corresponding to each dimension meets the convergence condition, and otherwise, adjusting the initial weight value of the abnormal judgment submodel corresponding to at least one dimension.
13. The monitoring device according to claim 12, wherein the calculating module trains an initial weight value of the abnormality judgment submodel corresponding to the dimension by using a maximum expectation algorithm, judges whether the weight value obtained by training the abnormality judgment submodel corresponding to the dimension converges, if so, uses the trained weight value as a weight value of the abnormality judgment submodel corresponding to the dimension for fitting the abnormality judgment model, and if not, continues to train the weight value obtained by training the abnormality judgment submodel corresponding to the dimension again until the weight value obtained by training the abnormality judgment submodel corresponding to the dimension converges.
14. The monitoring device according to claim 9, wherein before the anomaly determination submodel corresponding to the dimension in the time period is obtained through training, when sample data marked as anomaly exists in the obtained sample data of the dimension generated in the time period, the calculation module obtains sample data of a plurality of dimensions in the sample data historically generated by the target system within a time period same as the time period, calculates a sum of a mean value and a variance of the obtained sample data of the plurality of dimensions, and adjusts the sample data marked as anomaly in the dimension by using the sum, where the sum is used for training the anomaly determination submodel corresponding to the dimension.
15. The monitoring device of claim 9, wherein the determining module determines, for the feature value of each dimension, an average of the sample data of the dimension for a plurality of time periods adjacent to the time period as the feature value of the dimension generated by the target system during the time period.
16. The monitoring device according to claim 9, wherein when the abnormality determination model is a gaussian mixture model, the calculation module determines a small probability interval corresponding to the abnormality determination model according to a gaussian principle.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710089648.4A CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710089648.4A CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107066365A CN107066365A (en) | 2017-08-18 |
| CN107066365B true CN107066365B (en) | 2021-01-01 |
Family
ID=59622603
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710089648.4A Active CN107066365B (en) | 2017-02-20 | 2017-02-20 | System abnormity monitoring method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107066365B (en) |
Families Citing this family (35)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107392401A (en) * | 2017-09-08 | 2017-11-24 | 上海理工大学 | Heavy-duty mill roll loads the failure prediction method of intelligent robot |
| CN109976986B (en) * | 2017-12-28 | 2023-12-19 | 阿里巴巴集团控股有限公司 | Abnormal equipment detection method and device |
| CN108063699B (en) * | 2017-12-28 | 2020-08-28 | 携程旅游信息技术（上海）有限公司 | Network performance monitoring method and device, electronic equipment and storage medium |
| CN108111359A (en) * | 2018-01-19 | 2018-06-01 | 北京奇艺世纪科技有限公司 | A kind of monitor processing method, device and monitoring processing system |
| CN108449313B (en) * | 2018-02-01 | 2021-02-19 | 平安科技（深圳）有限公司 | Electronic device, Internet service system risk early warning method and storage medium |
| CN108376553B (en) * | 2018-02-28 | 2020-11-03 | 北京奇艺世纪科技有限公司 | Monitoring method and system for magnetic disk of video server |
| CN108764290B (en) * | 2018-04-26 | 2021-07-30 | 创新先进技术有限公司 | Method and device for determining cause of model transaction and electronic equipment |
| CN108984376B (en) * | 2018-05-31 | 2021-11-19 | 创新先进技术有限公司 | System anomaly detection method, device and equipment |
| CN108920326B (en) * | 2018-06-14 | 2022-04-29 | 创新先进技术有限公司 | Method and device for determining time-consuming abnormity of system and electronic equipment |
| CN110635962B (en) * | 2018-06-25 | 2022-12-16 | 阿里巴巴集团控股有限公司 | Abnormity analysis method and device for distributed system |
| CN108647942B (en) * | 2018-07-27 | 2024-03-15 | 重庆爱鸽者智能科技有限公司 | Distributed racing pigeon cutting system based on universal mobile terminal |
| CN109325061A (en) * | 2018-08-24 | 2019-02-12 | 北京天元创新科技有限公司 | A kind of method for processing abnormal data and device based on probability distribution |
| CN109144820A (en) * | 2018-08-31 | 2019-01-04 | 新华三信息安全技术有限公司 | A kind of detection method and device of abnormal host |
| CN109376381B (en) * | 2018-09-10 | 2024-09-17 | 平安科技（深圳）有限公司 | Medical insurance reimbursement abnormality detection method, medical insurance reimbursement abnormality detection device, computer equipment and storage medium |
| CN111078488B (en) * | 2018-10-18 | 2021-11-09 | 杭州海康威视数字技术股份有限公司 | Data acquisition method, device, storage medium and system |
| CN109558295B (en) * | 2018-11-15 | 2022-05-24 | 新华三信息安全技术有限公司 | Performance index abnormality detection method and device |
| CN109857618B (en) * | 2019-02-02 | 2022-07-08 | 中国银行股份有限公司 | Monitoring method, device and system |
| CN110008082B (en) * | 2019-03-16 | 2022-06-17 | 平安科技（深圳）有限公司 | Abnormal task intelligent monitoring method, device, equipment and storage medium |
| CN109947625A (en) * | 2019-03-27 | 2019-06-28 | 阿里巴巴集团控股有限公司 | The recognition methods of abnormal single machine and device in a kind of cluster |
| CN110399268B (en) * | 2019-07-26 | 2023-09-26 | 创新先进技术有限公司 | Abnormal data detection method, device and equipment |
| CN110661818B (en) * | 2019-10-30 | 2022-07-08 | 腾讯云计算（北京）有限责任公司 | Event anomaly detection method and device, readable storage medium and computer equipment |
| CN111126813B (en) * | 2019-12-16 | 2023-10-31 | 东软集团股份有限公司 | Method and device for determining equipment state, storage medium and electronic equipment |
| CN112988501B (en) * | 2019-12-17 | 2023-02-03 | 深信服科技股份有限公司 | Alarm information generation method and device, electronic equipment and storage medium |
| CN111260133A (en) * | 2020-01-16 | 2020-06-09 | 支付宝(杭州)信息技术有限公司 | Optimization method and device of quality monitoring model for monitoring research and development quality |
| CN111598661B (en) * | 2020-05-14 | 2023-09-22 | 拉扎斯网络科技（上海）有限公司 | Exception report processing method and device, platform server and storage medium |
| CN111708687B (en) * | 2020-06-15 | 2021-07-27 | 北京优特捷信息技术有限公司 | Equipment abnormality index determination method, device, equipment and storage medium |
| CN111738463A (en) * | 2020-06-17 | 2020-10-02 | 深圳华远云联数据科技有限公司 | Operation and maintenance method, device, system, electronic equipment and storage medium |
| CN111880990B (en) * | 2020-07-20 | 2023-10-27 | 北京三快在线科技有限公司 | Exception handling method and device |
| CN113297307B (en) * | 2020-08-15 | 2024-03-05 | 阿里巴巴集团控股有限公司 | Database request identification and anomaly detection methods, devices, equipment and media |
| CN112182508A (en) * | 2020-09-16 | 2021-01-05 | 支付宝(杭州)信息技术有限公司 | Abnormity monitoring method and device for compliance business indexes |
| CN112511372B (en) * | 2020-11-06 | 2022-03-01 | 新华三技术有限公司 | Anomaly detection method, device and equipment |
| CN112799898B (en) * | 2021-01-08 | 2023-03-24 | 北京科技大学 | Interconnection system fault node positioning method and system based on distributed fault detection |
| CN112905419B (en) * | 2021-03-02 | 2022-11-15 | 广州虎牙科技有限公司 | Index data monitoring threshold range determining method and device and readable storage medium |
| CN114419679B (en) * | 2022-04-01 | 2022-07-08 | 广东省通信产业服务有限公司 | Data analysis method, device and system based on wearable device data |
| CN115238831B (en) * | 2022-09-21 | 2023-04-14 | 中国南方电网有限责任公司超高压输电公司广州局 | Fault prediction method, device, computer equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20120085144A (en) * | 2011-10-05 | 2012-07-31 | 주식회사 켐에쎈 | Multiple linear regression-artificial neural network hybrid model predicting water solubility of pure organic compound |
| CN103065466A (en) * | 2012-11-19 | 2013-04-24 | 北京世纪高通科技有限公司 | Detection method of and detection device for abnormal traffic conditions |
| CN103971521A (en) * | 2014-05-19 | 2014-08-06 | 清华大学 | Method and device for detecting road traffic abnormal events in real time |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110137656A1 (en) * | 2009-09-11 | 2011-06-09 | Starkey Laboratories, Inc. | Sound classification system for hearing aids |
| CN102361014B (en) * | 2011-10-20 | 2013-08-28 | 上海大学 | State monitoring and fault diagnosis method for large-scale semiconductor manufacture process |
| CN104184819B (en) * | 2014-08-29 | 2017-12-05 | 城云科技（中国）有限公司 | Multi-layer load balancing cloud resource monitoring method |
| CN104595170B (en) * | 2014-12-18 | 2016-08-17 | 中国矿业大学 | A kind of air compressor machine monitoring and diagnosis system and method for self-adaptive kernel gauss hybrid models |
| CN104976139B (en) * | 2015-06-08 | 2017-04-05 | 北京化工大学 | A kind of mechanical equipment state diagnostic method based on Gauss model |
| CN105099759A (en) * | 2015-06-23 | 2015-11-25 | 上海华为技术有限公司 | Detection method and device |
| CN105893256B (en) * | 2016-03-30 | 2018-06-08 | 西北工业大学 | software fault positioning method based on machine learning algorithm |
-
2017
- 2017-02-20 CN CN201710089648.4A patent/CN107066365B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20120085144A (en) * | 2011-10-05 | 2012-07-31 | 주식회사 켐에쎈 | Multiple linear regression-artificial neural network hybrid model predicting water solubility of pure organic compound |
| CN103065466A (en) * | 2012-11-19 | 2013-04-24 | 北京世纪高通科技有限公司 | Detection method of and detection device for abnormal traffic conditions |
| CN103971521A (en) * | 2014-05-19 | 2014-08-06 | 清华大学 | Method and device for detecting road traffic abnormal events in real time |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107066365A (en) | 2017-08-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107066365B (en) | System abnormity monitoring method and device | |
| US10558545B2 (en) | Multiple modeling paradigm for predictive analytics | |
| CN108920336B (en) | Service abnormity prompting method and device based on time sequence | |
| CN110888788A (en) | Anomaly detection method and device, computer equipment and storage medium | |
| CN108984376B (en) | System anomaly detection method, device and equipment | |
| CN109634819B (en) | Alarm root cause positioning method and device and electronic equipment | |
| US20180039895A1 (en) | Data predicting method and apparatus | |
| US8949676B2 (en) | Real-time event storm detection in a cloud environment | |
| CN104778111A (en) | Alarm method and alarm device | |
| CN110287229B (en) | Data statistical processing method and device | |
| US11736363B2 (en) | Techniques for analyzing a network and increasing network availability | |
| WO2020173136A1 (en) | Method and apparatus for monitoring application system, device, and storage medium | |
| US10019309B2 (en) | Analytics-based dynamic adaptation of client-server mobile applications | |
| CN113986595A (en) | Abnormity positioning method and device | |
| CN113992525A (en) | Method and device for adjusting number of applied containers | |
| CN115964211A (en) | Root cause positioning method, device, equipment and readable medium | |
| CN116560794A (en) | Exception handling method and device for virtual machine, medium and computer equipment | |
| CN112526905B (en) | Processing method and system for index abnormity | |
| CN114024831A (en) | Abnormal event early warning method, device and system | |
| CN110855484B (en) | Method, system, electronic device and storage medium for automatically detecting traffic change | |
| CN109039695B (en) | Service fault processing method, device and equipment | |
| CN112685390B (en) | Database instance management method and device and computing equipment | |
| CN111523826A (en) | Data acquisition method, device and equipment | |
| CN108470242B (en) | Risk management and control method, device and server | |
| WO2018201864A1 (en) | Method, device, and equipment for database performance diagnosis, and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |