CN108304315A - A kind of sorting technique and system of software aging abnormal behaviour - Google Patents
A kind of sorting technique and system of software aging abnormal behaviour Download PDFInfo
- Publication number
- CN108304315A CN108304315A CN201711347308.3A CN201711347308A CN108304315A CN 108304315 A CN108304315 A CN 108304315A CN 201711347308 A CN201711347308 A CN 201711347308A CN 108304315 A CN108304315 A CN 108304315A
- Authority
- CN
- China
- Prior art keywords
- window
- server
- node
- composite
- basic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000032683 aging Effects 0.000 title claims abstract description 52
- 238000000034 method Methods 0.000 title claims abstract description 40
- 206010000117 Abnormal behaviour Diseases 0.000 title claims abstract description 26
- 230000002159 abnormal effect Effects 0.000 claims abstract description 36
- 239000002131 composite material Substances 0.000 claims description 81
- 238000004422 calculation algorithm Methods 0.000 claims description 16
- 238000001514 detection method Methods 0.000 claims description 16
- 230000002085 persistent effect Effects 0.000 claims description 12
- 230000005856 abnormality Effects 0.000 claims description 10
- 230000001568 sexual effect Effects 0.000 claims description 10
- 239000006185 dispersion Substances 0.000 claims description 7
- 239000000203 mixture Substances 0.000 claims description 4
- 238000004364 calculation method Methods 0.000 claims description 3
- 150000001875 compounds Chemical class 0.000 claims description 3
- 239000011159 matrix material Substances 0.000 claims description 2
- 238000011160 research Methods 0.000 abstract description 9
- 230000006399 behavior Effects 0.000 description 12
- 230000008569 process Effects 0.000 description 9
- 238000004590 computer program Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 6
- 238000004458 analytical method Methods 0.000 description 5
- 238000012545 processing Methods 0.000 description 5
- 230000003712 anti-aging effect Effects 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 238000013459 approach Methods 0.000 description 3
- 230000007774 longterm Effects 0.000 description 3
- 241000209094 Oryza Species 0.000 description 2
- 235000007164 Oryza sativa Nutrition 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 235000009566 rice Nutrition 0.000 description 2
- 238000003860 storage Methods 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- XCWPUUGSGHNIDZ-UHFFFAOYSA-N Oxypertine Chemical compound C1=2C=C(OC)C(OC)=CC=2NC(C)=C1CCN(CC1)CCN1C1=CC=CC=C1 XCWPUUGSGHNIDZ-UHFFFAOYSA-N 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 230000015556 catabolic process Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 239000012141 concentrate Substances 0.000 description 1
- 230000001186 cumulative effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000006731 degradation reaction Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000018109 developmental process Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000013450 outlier detection Methods 0.000 description 1
- 238000012163 sequencing technique Methods 0.000 description 1
- 241000894007 species Species 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3604—Software analysis for verifying properties of programs
- G06F11/3612—Software analysis for verifying properties of programs by runtime analysis
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The present invention relates to a kind of sorting techniques and system of software aging abnormal behaviour, acquire the operating index of the server in the sliding window of definition；Determine the server operation exception node of the sliding window；Classify to the abnormal behaviour of the server operation exception node.The present invention is detected software aging with abnormal point detecting method using in conjunction with sliding window by portraying server run-time exception behavior the New Research of software aging behavior.
Description
Technical field
The present invention relates to a kind of detection methods of software aging, and in particular to a kind of classification side of software aging abnormal behaviour
Method and system.
Background technology
As software size is growing, on the server long-term running software aging phenomenon day increasingly complicated with framework
Benefit frequently shows, and software aging problem increasingly obtains the attention of people.Software aging is mainly due to hiding among software
Failure constantly accumulated as run time extends, the final performance that causes declines or the software anomaly behavior of thrashing etc..
Therefore, from emerging from software aging concept, the research of software aging or theory or experience is never interrupted, research contents is contained
It has covered and how to have eliminated the software fault, forecasting software aging and the anti-ageing behavior of reasonable arrangement that cause aging to reduce aging speed
Deng.
The research of software aging can be roughly divided into based on model and based on survey quantifier elimination.With software monitors technology
Continuous development with it is ripe, the software aging research based on measurement is adopted by more and more scholars.With grinding based on model
Study carefully unlike method, measuring study is mainly by directly acquiring the monitoring data with analysis system aging index of correlation, therefrom
It obtains system and the inducement of accident behavior or the time of origin etc. of forecasting system accident behavior occurs.Recently, with big data analysis
The rise of method, machine learning method is applied to more and more in software aging research, and achieves notable achievement.For example,
Aloson et al. carries out the Web under experimental situation using 29 achievement datas based on a kind of M5P (binary decision tree) algorithms
Analysis, to more accurately predict resource consumption.Dwyer et al. is existed using a variety of machine learning algorithms prediction multi-core processor
Performance degradation under HPC loads.
Existing research generally all follows following thinking：The prison obtained by experimental situation Variable Control and observation analysis
Measured data therefrom establishes various software aging models, and the model is applied to the ageing predetermination of on-line system.However, these
Work the premise Shortcomings carried out：The software aging process and software aging that can be fully observed in experimental situation
It can accurately be portrayed by quantitative manner.This is because with software technology research deepen continuously and it is ripe, through its summary
Such as periodically to restart, the anti-aging means such as load balancing, but software aging is the very long complex process of a complications repeatedly, it is difficult to
It is quantitatively portrayed with model.Meanwhile to be the state lived through before a cumulative effect and system have closely software aging
Contact, and the stateful reproduction of institute for undergoing on-line system is difficult in experimental situation, it is sufficient to be carried out to software aging process
Observation.Therefore, Current software ageing research also needs to introduce new approaches new method, to obtain the progress of bigger.
Invention content
To solve above-mentioned deficiency of the prior art, the object of the present invention is to provide a kind of points of software aging abnormal behaviour
Class method and system, the new think of for portraying the research software aging of software aging behavior by capturing server run-time exception behavior
Road is detected software aging with abnormal point detecting method using in conjunction with sliding window.
The purpose of the present invention is what is realized using following technical proposals：
The present invention provides a kind of sorting technique of software aging abnormal behaviour, thes improvement is that：
Acquire the operating index of the server in the sliding window of definition；
Determine the server operation exception node of the sliding window；
Classify to the abnormal behaviour of the server operation exception node.
Further：
The sliding window includes basic window, composite window and across composite window；
Time interval of the basic window between the adjacent value of acquisition index twice；
The composite window is the window being made of cl continuous basic windows；
The windows across composite window to be made of al continuous composite windows.
Further：The time interval is to be divided into unit, j-th of basic window formula of i-th of serverTable
Show；Wherein, bw indicates the number of basic window；
Form the jth of i-th of server in the basic window cl of the composite window ' a basic window start it is compound
Window cw formulasIt indicates；
Form the jth across i-th of server in the composite window al in composite window " a composite window start across multiple
Close window aw formulasIt indicates.
Further：The server operating index matrix of the basic window jIt is shown below：
In formula：N is the number of units of server, and M is the index number of every collection of server；Respectively
1 ..., N number of server operating index value.
Further：The server operation exception node that the basic window is calculated with local outlier factor algorithm includes：
Preset classification thresholds k is inputted into the basic window；
It is taken with w' times of classification thresholds k of the local outlier factor algorithm calculation server node in the basic window
Value；
According to described w' exploitation of value vector the basic window average vector；
The big server node of the average vector value is set as abnormal nodes.
Further：The value vector r of the abnormal nodes of the server node of the basic window of the i-th ' secondary valuei'Such as
Shown in following formula：
In the average vector r of the basic windowbwIt is shown below：
In formula：Server node for the i-th ' secondary value is the value vector element of abnormal nodes；Table
Show kth ' the abnormal probability that is obtained in the i-th ' secondary operation local outlier factor algorithm of a server node.
Further：The calculating of the server operation exception node of the composite window includes：
Determine the off-note of each basic window server node in each composite window, according to the following formula：
Wherein：It is basic in respectively i-th, i+1 ..., the i-th+cl composite windows
The off-note of window server node；
The exception of the composite window server node is calculated according to the off-note of basic window server node
Feature, according to the following formula：
Wherein：For the off-note of composite window server node； The abnormal nodes probability in composite window is indicated, by formulaMeter
It calculates；
Coefficient of dispersionBy formulaIt calculates；
Wherein：K' indicates individual server node.
Further：The determination across the server operation exception node in composite window, including：
Be calculated as follows respectively across the probability vector in composite windowWith very poor vectorIt obtains across composite window
awiMiddle server exception node set
Wherein：Al indicates the number of composite window,It indicates to chooseIt fallsInterior server
Node composition set,It indicates to chooseIt fallsInterior server node composition set.
Further：The abnormal behaviour that abnormal nodes are transported to each server is classified, including：
Severity by abnormal behaviour x includes：
Serious interval sexual abnormality x1, severe persistent exception x2, general persistent anomaly x3 and general interval sexual abnormality x4.
Further：The serious interval sexual abnormality x1, severe persistent exception x2, general persistent anomaly x3 and general interval
Sexual abnormality x4 is indicated with following formula respectively：
Or
Wherein：ForThe very poor vector of server node in setAverage value；ForIt is taken in set
The probability vector of business device nodeAverage value；
The severe persistent exception x2：
That is the average exceptional value of x3 is relatively high；With
That is the very poor vector of x4 is relatively high.
The present invention also provides a kind of categorizing systems of software aging abnormal behaviour, the improvement is that：
Acquisition module, the server operating index value for acquiring basic window in pre-defined sliding window；
Detection module, for detecting the basic window, composite window successively and across the server operation in composite window
Abnormal nodes；
Sort module, the abnormal behaviour for transporting abnormal nodes to each server are classified；
The pre-defined sliding window includes basic window, composite window and across composite window.
Compared with the immediate prior art, technical solution provided by the invention has an advantageous effect in that：
Technical solution provided by the invention portrays grinding for software aging behavior by capturing server run-time exception behavior
The new approaches for studying carefully software aging are detected software aging with abnormal point detecting method using in conjunction with sliding window.
By capturing and analyzing abnormal nodes in technical solution provided by the invention, can be captured in linear system in short period of time
A variety of aging rice seeds of system avoid the expense of long-term observation capture ageing process；
Technical solution provided by the invention, can be to intensity of anomaly, frequency to online by the modeling analysis of ageing process
A variety of ageing processes of system are classified, and have further deepened the analysis of ageing process, and the customization for anti-aging strategy provides
More accurate foundation.
Description of the drawings
Fig. 1 is the detail flowchart of the sorting technique of software aging abnormal behaviour provided by the invention；
Fig. 2 is the simple process figure of the sorting technique of software aging abnormal behaviour provided by the invention.
Specific implementation mode
The specific implementation mode of the present invention is described in further detail below in conjunction with the accompanying drawings.
The following description and drawings fully show specific embodiments of the present invention, to enable those skilled in the art to
Put into practice them.Other embodiments may include structure, logic, it is electrical, process and other change.Embodiment
Only represent possible variation.Unless explicitly requested, otherwise individual component and function are optional, and the sequence operated can be with
Variation.The part of some embodiments and feature can be included in or replace part and the feature of other embodiments.This hair
The range of bright embodiment includes equivalent obtained by the entire scope of claims and all of claims
Object.Herein, these embodiments of the invention can individually or generally be indicated that this is only with term " invention "
For convenience, it and if in fact disclosing the invention more than one, is not meant to automatically limit ranging from appointing for the application
What single invention or inventive concept.
Embodiment one,
The present invention proposes to portray the research software aging of software aging behavior by capturing server run-time exception behavior
New approaches, using being detected to software aging with abnormal point detecting method in conjunction with sliding window, to reach following purpose：
By capturing and analyzing abnormal nodes, a variety of aging rice seeds of on-line system can be captured in short period of time, are kept away
Long-term observation is exempted to capture the expense of ageing process；
It is polymerize by sliding window, can be effectively detected and is classified to a variety of ageing processes of on-line system, from
And provide foundation for anti-aging strategy customization.
The specific technical solution of the present invention is as shown in Figure 1：
Workflow of the present invention as shown in Fig. 2, mainly include 3 steps,
Acquire the operating index of the server in the sliding window of definition；
Determine the server operation exception node of the sliding window；
Classify to the abnormal behaviour of the server operation exception node, that is, is sequentially completed basic window, complex-aperture
Mouthful and across composite window off-note detection and classification.
Before formally introducing process step, each window is first defined：
Basic window bw refers to the time interval of the adjacent value twice of index of correlation in the present invention, is single with minute
Position has w basic window, j basic window of i-th of server to be expressed as within one day
Composite window cw refers to that the composite window being made of cl continuous basic windows, wherein cl indicate basic window
The number of mouth, composite window of i-th of server since j-th of basic window are expressed as
Across composite window aw, refer to by the continuous composite windows of al form across composite window, wherein al indicates multiple
The number of window is closed, i-th of server is expressed as since j-th of composite window across composite window
Other than above-mentioned window, also window sliding step number sl needs to define：Sl indicates front and back two neighboring composite window
Between differ the number of basic window, sl can take fixed value or random value rand (cl), the position that j-th of composite window starts
ByThe position of beginning and slj-1 are codetermined, wherein slj-1Indicate sl -1 value of jth (acquiescence first it is compound
Window is since the 1st basic window, therefore it is second composite window that sl1 is corresponding).
Equipped with N platform servers, M index of every collection of server, then the collection value in j-th of basic window can be as follows
It indicates：
It hereafter will gradually introduce workflow.
Step 1：Detect the off-note in basic window
Current there are many Outlier Detection Algorithms, such as the detection method based on distance or deviation, can be according to the practical shape of data
Formula is selected.The present invention with the detection method based on distance, local outlier factor algorithm (Local Outlier Factor,
LOF the abnormal conditions of each node are calculated).
LOF algorithms are to set classification thresholds k as parameter input pairIt is analyzed, it is assumed that all node values are obeyed
Normal distribution N (μ, σ2), the probability of value exception is 5%, then k will in [2.5%*N+1,5%*N+1] range value one by one.
Assuming that setting classification thresholds k has the secondary values of w ', then each value operation LOF algorithms obtain the value that each node is abnormal point and are
Vector1≤i≤w', final each node are the flat of all values in the LOF results of bw windows
Mean value, i.e.,1≤i≤w', 1≤n≤N, value is higher, shows that the probability of nodes ' behavior exception is bigger.
Based on the output of LOF algorithms, the output of LOF algorithms is analyzed and is counted to obtain the classification of node abnormal behaviour
And feature.Parameter k is the input of LOF algorithm requirements, it is the threshold value of a classification, it can be understood as the node of an infima species
Number does not just constitute a cluster less than this number.
Step 2：Detect the off-note in composite window；
If composite window cwi since i-th of basic window, terminates to the i-th+cl basic windows.The then composite window
The off-note of interior each basic window is represented byWhereinIt is every for single basic window
The exceptional value of a node.In composite window, further summarize off-note for each node.The off-note of each node passes through
Mean valueIt portrays, indicates with coefficient of dispersion vDistribution be concentrate or it is discrete, in statistics, standard deviation divided by average value are just
It is that can not be explained again for measuring dispersion degree
The abnormal mean and coefficient of dispersion of kth ' a server node can calculate by the following method：
By being calculated using the above method each node, the off-note of composite window has just been obtained
Wherein
Step 3：Detect across in composite window abnormal nodes and behavior
The sliding of composite window is completed using random manner, and sliding step number each time existsIt is taken at random in range
Value.If awi since i-th of composite window, is made of al continuous composite window features, is expressed as across composite windowAbnormal nodes are selected first, in accordance with following method：
(1) to each server node k ', abnormal mean is calculated in the mean value across composite windowStructure
At vector
(2) to each server node k ', coefficient of dispersion is calculated across very poor in composite window
Constitute vector
(3) right respectivelyWithIt sorts from big to small according to numerical value, selected value is fallenService
Device node separately constitutes setWith
(4) finally, awi across abnormal behavior in composite window node set
Abnormal behaviour is divided into two class of persistent anomaly and interval sexual abnormality by the present invention, and intensity of anomaly is divided into serious and one
As two grades, if nodeThen abnormal behaviour classification is carried out according to following order：
X isThat is the very poor of x is more thanIt is very poor in set
Average value,ForNodeAverage value.If simultaneously ForNodeAverage value, then ifX is serious interval sexual abnormality, and otherwise x is that severe persistent is abnormal.
X is
X isThat is the average exceptional value of x is relatively high.
X isThat is x's is very poor relatively high.
Embodiment two,
Based on same inventive concept, the present invention also provides a kind of categorizing systems of software aging abnormal behaviour, including：
Acquisition module, the server operating index value for acquiring basic window in pre-defined sliding window；
Detection module, for detecting the basic window, composite window successively and across the server operation in composite window
Abnormal nodes；
Sort module, the abnormal behaviour for transporting abnormal nodes to each server are classified；
The pre-defined sliding window includes basic window, composite window and across composite window.
Further：The detection module includes：
First detection sub-module, the server operation exception node for detecting the basic window,
First detection sub-module includes：
Input unit, in input parameter k to basic window；
First computing unit, for using local outlier factor algorithm w value of calculating parameter k in basic window
Server node is the value vector of abnormal nodes；
Second computing unit, for calculating w value basic according to the value vector that server node is abnormal nodes
The average vector of window.
Further：The detection module includes：Second detection sub-module, the server for detecting the composite window
Operation exception node, second detection sub-module, including：
Determination unit, the abnormal nodes feature vector for determining each basic window in each composite window；
Third computing unit is used to calculate the abnormal of composite window according to the feature vector of the abnormal nodes of basic window and save
Point feature vector.
Further：The detection module includes：Third detection sub-module, the server for detecting the composite window
Operation exception node, the third detection sub-module, including：
4th computing unit, for each server node k, calculating abnormal nodes probability in the mean value across composite windowConstitute vector
5th computing unit, for each server node k, calculating coefficient of dispersion across very poor in composite windowConstitute vector
Sequencing unit, for right respectivelyWithIt sorts from big to small according to numerical value, selected value is fallen in given threshold model
The server node for enclosing interior Top [5%*N+1] separately constitutes setWith
Obtaining unit, for obtaining in across composite window awiMiddle abnormal nodes set
It should be understood by those skilled in the art that, embodiments herein can be provided as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the application
Apply the form of example.Moreover, the application can be used in one or more wherein include computer usable program code computer
The computer program production implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
The form of product.
The application is with reference to method, the flow of equipment (system) and computer program product according to the embodiment of the present application
Figure and/or block diagram describe.It should be understood that can be realized by computer program instructions every first-class in flowchart and/or the block diagram
The combination of flow and/or box in journey and/or box and flowchart and/or the block diagram.These computer programs can be provided
Instruct the processor of all-purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine so that the instruction executed by computer or the processor of other programmable data processing devices is generated for real
The device for the function of being specified in present one flow of flow chart or one box of multiple flows and/or block diagram or multiple boxes.
These computer program instructions, which may also be stored in, can guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works so that instruction generation stored in the computer readable memory includes referring to
Enable the manufacture of device, the command device realize in one flow of flow chart or multiple flows and/or one box of block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device so that count
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, in computer or
The instruction executed on other programmable devices is provided for realizing in one flow of flow chart or multiple flows and/or block diagram one
The step of function of being specified in a box or multiple boxes.
The above embodiments are merely illustrative of the technical scheme of the present invention and are not intended to be limiting thereof, although with reference to above-described embodiment pair
The present invention is described in detail, those of ordinary skill in the art still can to the present invention specific implementation mode into
Row modification either equivalent replacement these without departing from any modification of spirit and scope of the invention or equivalent replacement, applying
Within the claims of the pending present invention.
Claims (11)
1. a kind of sorting technique of software aging abnormal behaviour, it is characterised in that：
Acquire the operating index of the server in the sliding window of definition；
Determine the server operation exception node of the sliding window；
Classify to the abnormal behaviour of the server operation exception node.
2. sorting technique as described in claim 1, it is characterised in that：
The sliding window includes basic window, composite window and across composite window；
Time interval of the basic window between the adjacent value of acquisition index twice；
The composite window is the window being made of cl continuous basic windows；
The windows across composite window to be made of al continuous composite windows.
3. sorting technique as claimed in claim 2, it is characterised in that：The time interval is to be divided into unit, i-th of server
J-th of basic window formulaIt indicates；Wherein, bw indicates the number of basic window；
Form the jth of i-th of server in the basic window cl of the composite window ' composite window that starts of a basic window
Cw formulasIt indicates；
Form the jth across i-th of server in the composite window al in composite window " a composite window start across complex-aperture
Mouth aw formulasIt indicates.
4. sorting technique as claimed in claim 3, it is characterised in that：The server operating index matrix of the basic window jIt is shown below：
In formula：N is the number of units of server, and M is the index number of every collection of server；Respectively the 1st ..., N
The operating index value of a server.
5. sorting technique as claimed in claim 4, it is characterised in that：The basic window is calculated with local outlier factor algorithm
Server operation exception node include：
Preset classification thresholds k is inputted into the basic window；
With the secondary values of w ' of classification thresholds k of the local outlier factor algorithm calculation server node in the basic window；
According to the secondary exploitations of the w ' the basic window average vector；
The big server node of the average vector value is set as abnormal nodes.
6. sorting technique as claimed in claim 5, it is characterised in that：The abnormal nodes of the server node of the basic window
Value vector ri'It is shown below：
Wherein, i ' is the i-th ' secondary value；
The average vector r of the basic windowbwIt is shown below：
In formula：For p1 i'pi 2 '...pi N 'Server node for the i-th ' secondary value is the value element vector of abnormal nodes
Element；Indicate the abnormal probability that kth ' a server node is obtained in the i-th ' secondary operation local outlier factor algorithm.
7. sorting technique as claimed in claim 3, it is characterised in that：The server operation exception node of the composite window
Calculating includes：
The off-note of each basic window server node in each of determining composite window, according to the following formula：
Wherein：Basic window in respectively i-th, i+1 ..., the i-th+cl composite windows
The off-note of server node；
The off-note of the composite window server node is calculated according to the off-note of basic window server nodeAccording to the following formula：
Wherein：It indicates compound
Abnormal nodes probability in window, by formulaIt calculates；
Coefficient of dispersionBy formulaIt calculates；
Wherein：K' indicates individual server node.
8. sorting technique as claimed in claim 3, it is characterised in that：The determination is different across the server operation in composite window
Chang Jiedian, including：
Be calculated as follows respectively across the probability vector in composite windowWith very poor vectorObtain across composite window awiIn
Server exception node set
Wherein：Al indicates the number of composite window,It indicates to chooseIt falls in TopInterior server node
Composition set,It indicates to chooseIt falls in TopInterior server node composition set.
9. sorting technique as claimed in claim 3, it is characterised in that：The abnormal behaviour of the operation exception node of the server
Type x include：
Serious interval sexual abnormality x1, severe persistent exception x2, general persistent anomaly x3 and general interval sexual abnormality x4.
10. sorting technique as claimed in claim 9, it is characterised in that：The serious interval sexual abnormality x1, severe persistent are abnormal
X2, general persistent anomaly x3 and general interval sexual abnormality x4 are indicated with following formula respectively：
Or
Wherein：ForThe very poor vector of server node in setAverage value；ForServer section in set
The probability vector of pointAverage value；
The severe persistent exception x2：
That is the average exceptional value of x3 is relatively high；With
That is the very poor vector of x4 is relatively high.
11. a kind of categorizing system of software aging abnormal behaviour, it is characterised in that：
Acquisition module, the server operating index value for acquiring basic window in pre-defined sliding window；
Detection module, for detecting the basic window, composite window successively and across the server operation exception in composite window
Node；
Sort module, the abnormal behaviour for transporting abnormal nodes to each server are classified；
The pre-defined sliding window includes basic window, composite window and across composite window.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711347308.3A CN108304315A (en) | 2017-12-14 | 2017-12-14 | A kind of sorting technique and system of software aging abnormal behaviour |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711347308.3A CN108304315A (en) | 2017-12-14 | 2017-12-14 | A kind of sorting technique and system of software aging abnormal behaviour |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108304315A true CN108304315A (en) | 2018-07-20 |
Family
ID=62870068
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711347308.3A Pending CN108304315A (en) | 2017-12-14 | 2017-12-14 | A kind of sorting technique and system of software aging abnormal behaviour |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108304315A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130085715A1 (en) * | 2011-09-29 | 2013-04-04 | Choudur Lakshminarayan | Anomaly detection in streaming data |
| CN103986625A (en) * | 2014-05-29 | 2014-08-13 | 中国科学院软件研究所 | Cloud application fault diagnosis system based on statistical monitoring |
| CN104794192A (en) * | 2015-04-17 | 2015-07-22 | 南京大学 | Multi-level anomaly detection method based on exponential smoothing and integrated learning model |
| CN105183659A (en) * | 2015-10-16 | 2015-12-23 | 上海通创信息技术有限公司 | Software system behavior anomaly detection method based on multi-level mode predication |
| CN106302487A (en) * | 2016-08-22 | 2017-01-04 | 中国农业大学 | Agricultural Internet of Things data flow anomaly detects processing method and processing device in real time |
| US20170277553A1 (en) * | 2016-03-22 | 2017-09-28 | Vmware, Inc. | Anomalous usage of resources by a process in a software defined data center |
-
2017
- 2017-12-14 CN CN201711347308.3A patent/CN108304315A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130085715A1 (en) * | 2011-09-29 | 2013-04-04 | Choudur Lakshminarayan | Anomaly detection in streaming data |
| CN103986625A (en) * | 2014-05-29 | 2014-08-13 | 中国科学院软件研究所 | Cloud application fault diagnosis system based on statistical monitoring |
| CN104794192A (en) * | 2015-04-17 | 2015-07-22 | 南京大学 | Multi-level anomaly detection method based on exponential smoothing and integrated learning model |
| CN105183659A (en) * | 2015-10-16 | 2015-12-23 | 上海通创信息技术有限公司 | Software system behavior anomaly detection method based on multi-level mode predication |
| US20170277553A1 (en) * | 2016-03-22 | 2017-09-28 | Vmware, Inc. | Anomalous usage of resources by a process in a software defined data center |
| CN106302487A (en) * | 2016-08-22 | 2017-01-04 | 中国农业大学 | Agricultural Internet of Things data flow anomaly detects processing method and processing device in real time |
Non-Patent Citations (4)
| Title |
|---|
| KARIMIAN, S. H等: "I-IncLOF: Improved incremental local outlier detection for data streams", 《2012 16TH CSI INTERNATIONAL SYMPOSIUM ON ARTIFICIAL INTELLIGENCE AND SIGNAL PROCESSING (AISP)》 * |
| LINGLING LI等: "Aberrant software-aging server detection and analysis using sliding window over LOF", 《2017 8TH IEEE INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING AND SERVICE SCIENCE (ICSESS)》 * |
| XIAO JIAN-QIONG: "Local outlier detection method towards data stream", 《2011 IEEE 3RD INTERNATIONAL CONFERENCE ON COMMUNICATION SOFTWARE AND NETWORKS (ICCSN 2011)》 * |
| 苏晓珂: "基于聚类的异常挖掘算法研究", 《中国博士学位论文全文数据库》 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106909933B (en) | A kind of stealing classification Forecasting Methodology of three stages various visual angles Fusion Features | |
| Zou et al. | Bearing fault diagnosis method based on EEMD and LSTM | |
| CN106656669B (en) | A kind of device parameter abnormality detection system and method based on threshold adaptive setting | |
| CN108830417B (en) | ARMA (autoregressive moving average) and regression analysis based life energy consumption prediction method and system | |
| CN104516808A (en) | Data preprocessing device and method thereof | |
| CN113837596B (en) | Fault determination method and device, electronic equipment and storage medium | |
| WO2017071369A1 (en) | Method and device for predicting user unsubscription | |
| CN108320112B (en) | Method and device for determining health state of equipment | |
| CN111680712B (en) | Method, device and system for predicting oil temperature of transformer based on similar time in day | |
| CN112463530A (en) | Anomaly detection method and device for micro-service system, electronic equipment and storage medium | |
| CN112613542A (en) | Bidirectional LSTM-based enterprise decontamination equipment load identification method | |
| Filz et al. | Data-driven analysis of product property propagation to support process-integrated quality management in manufacturing systems | |
| CN108304315A (en) | A kind of sorting technique and system of software aging abnormal behaviour | |
| CN110413482B (en) | Detection method and device | |
| CN115344495A (en) | Data analysis method and device for batch task test, computer equipment and medium | |
| CN114881324A (en) | Road transportation optimization method, device and equipment based on fuzzy double boundary model | |
| CN111221704B (en) | Method and system for determining running state of office management application system | |
| Qiao et al. | An application of systemic prediction evaluation parameters for neural network remaining useful life predictions models | |
| CN114254762A (en) | Interpretable machine learning model construction method and device and computer equipment | |
| CN104217093B (en) | Method and apparatus for identifying root cause of defect using composite defect map | |
| Azadeh et al. | A unique meta-heuristic algorithm for optimization of electricity consumption in energy-intensive industries with stochastic inputs | |
| Singh et al. | Predicting the remaining useful life of ball bearing under dynamic loading using supervised learning | |
| Zhuang et al. | An Optimal Maintenance Cycle Decision of Relay Protection Device Based on Weibull Distribution Model | |
| CN107967485B (en) | Fault analysis method and device for electricity metering equipment | |
| US20230119568A1 (en) | Pattern detection and prediction using time series data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180720 |