CN110046054A - Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium - Google Patents
Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium Download PDFInfo
- Publication number
- CN110046054A CN110046054A CN201810048058.1A CN201810048058A CN110046054A CN 110046054 A CN110046054 A CN 110046054A CN 201810048058 A CN201810048058 A CN 201810048058A CN 110046054 A CN110046054 A CN 110046054A
- Authority
- CN
- China
- Prior art keywords
- statistic
- virtual machine
- virtual
- integrating
- control thresholding
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0712—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a virtual computing platform, e.g. logically partitioned systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
- G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45591—Monitoring or debugging support
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/81—Threshold
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/815—Virtual
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Quality & Reliability (AREA)
- Mathematical Physics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a kind of virtual machine method for detecting abnormality, device, equipment and computer readable storage mediums, method includes the following steps: determining the control thresholding for integrating statistic of virtual-machine data according to the training dataset got；When detecting the virtual-machine data of acquisition, the integration statistic of the virtual-machine data is determined；Statistic and the control thresholding are integrated according to described, determines whether virtual machine exception occurs.The present invention accurately can determine whether virtual machine exception occurs, and the effective accuracy for improving abnormality detection result reduces false alarm rate.
Description
Technical field
The present invention relates to the communications fields more particularly to a kind of virtual machine method for detecting abnormality, device, equipment and computer can
Read storage medium.
Background technique
With the fast development of communication, acquisition, transmission and the processing of data are had been to be concerned by more and more people, due to cloud ring
Border has the characteristics of ultra-large, virtualization, high reliability, versatility and high scalability, therefore people often utilize cloud environment pair
Data are acquired, transmit, store and process, and cloud environment is to utilize virtual machine progress data exchange, and the money of virtual machine
Source includes CPU (Central Processing Unit, central processing unit), memory, network and disk etc., and user passes through virtual
When machine accesses network, if access is more frequent, it is easy to appear network congestion, the read or write speed of disk accelerates and memory usage
The problem of rising sharply eventually leads to CPU oepration at full load.Therefore, in order to guarantee the safety of whole system, therefore, to assure that virtual machine
Each resource, which is in, works normally section.
Currently, traditional solution is to analyze the memory of virtual machine, current thread is captured, interior nucleus number is utilized
The process where current thread is obtained according to structure, when virtual machine is abnormal, is internally deposited and is zeroed out and then terminates to work as front
Process where journey can not effectively guarantee the accuracy of abnormality detection result, lead to false alarm rate abruptly increase.
Therefore, the accuracy of virtual machine abnormality detection result how is improved, reducing false alarm rate is urgently to be resolved at present ask
Topic.
Above content is only used to facilitate the understanding of the technical scheme, and is not represented and is recognized that above content is existing skill
Art.
Summary of the invention
The main purpose of the present invention is to provide a kind of virtual machine method for detecting abnormality, device, equipment and computer-readable
Storage medium, it is intended to how to improve the accuracy of virtual machine abnormality detection result, reduce false alarm rate.
To achieve the above object, the present invention provides a kind of virtual machine method for detecting abnormality, the virtual machine abnormality detection side
Method the following steps are included:
According to the training dataset got, the control thresholding for integrating statistic of virtual-machine data is determined；
When detecting the virtual-machine data of acquisition, the integration statistic of the virtual-machine data is determined；
Statistic and the control thresholding are integrated according to described, determines whether virtual machine exception occurs.
Optionally, the training dataset that the basis is got determines the control door for integrating statistic of virtual-machine data
Limit, comprising:
Training dataset is obtained, and the training dataset is normalized, obtains normalization data collection；
Independent component analysis processing is carried out to the normalization data collection, the independent entry for obtaining the normalization data collection is empty
Between and independent entry residual error space；
Principal component analysis processing is carried out to independent entry residual error space, obtains principal component space and pivot residual error space；
The independent entry space, the corresponding statistic of the principal component space and pivot residual error space are constructed and integrate,
Statistic is integrated in acquisition；
According to default Density Estimator algorithm and default confidence level, the control thresholding for integrating statistic is determined.
Optionally, independent component analysis processing is carried out to the normalization data collection, obtains the normalization data collection
Independent entry space and independent entry residual error space, comprising:
Independent component analysis processing is carried out to the normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic of each independent entry and described is calculated in several independent entries
The associated probability value of statistic；
The independent entry that the probability value together is higher than the first preset threshold is formed into independent entry space, and will be described general together
Rate value forms independent entry residual error space less than or equal to the independent entry of the first preset threshold.
Optionally, the basis presets Density Estimator algorithm and default confidence level, determines the control for integrating statistic
Thresholding processed, comprising:
When detecting the confidence level adjustment request of triggering, the default confidence level is replaced with into the confidence level adjustment and is asked
Confidence level in asking；
According to default Density Estimator algorithm and replaced default confidence level, the control door for integrating statistic is determined
Limit.
Optionally, statistic and the control thresholding are integrated according to described, determine whether virtual machine exception occurs, comprising:
It integrates statistic by described and is compared with the control thresholding；
If the statistic of integrating is higher than the control thresholding, it is determined that virtual machine occurs abnormal；
If the statistic of integrating integrates statistic and the control according to described less than or equal to the control thresholding
The difference of thresholding, determines whether virtual machine exception occurs.
Optionally, according to the difference for integrating statistic and the control thresholding, determine whether virtual machine exception occurs,
Include:
Judge it is described integrate statistic and it is described control thresholding difference whether be lower than the second preset threshold；
If the difference for integrating statistic and the control thresholding is lower than the second preset threshold, it is determined that virtual machine occurs
It is abnormal；
If the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that virtual
Machine does not occur exception.
Optionally, after there is abnormal step in the determining virtual machine, the virtual machine method for detecting abnormality further include:
It shows abnormality alarming information, and issues preset alarm sound.
In addition, to achieve the above object, the present invention also provides a kind of virtual machine abnormal detectors, comprising:
First determining module, for according to the training dataset that gets, determining the statistic of integrating of virtual-machine data
Control thresholding；
Determining module is detected, for determining the integration of the virtual-machine data when detecting the virtual-machine data of acquisition
Statistic；
Second determining module determines whether virtual machine occurs for integrating statistic and the control thresholding according to described
It is abnormal.
The present invention also provides a kind of virtual machine abnormality detecting apparatus, the virtual machine abnormality detecting apparatus include: memory,
Processor and it is stored in the virtual machine abnormality detecting program that can be run on the memory and on the processor, it is described virtual
Machine abnormality detecting program realizes the step of virtual machine method for detecting abnormality as described above when being executed by the processor.
The present invention also provides a kind of computer readable storage medium, it is stored on the computer readable storage medium virtual
Machine abnormality detecting program, the virtual machine abnormality detecting program realize that virtual machine as described above is examined extremely when being executed by processor
The step of survey method.
The present invention provides a kind of virtual machine method for detecting abnormality, equipment and computer readable storage medium, the present invention will be empty
The normal anomaly data of quasi- machine determine that the integration of virtual-machine data counts as training dataset, and based on multi-variate statistical analysis algorithm
Then the control thresholding of amount detects virtual-machine data using determining control thresholding, different compared to traditional virtual machine
Normal detection mode, i.e., only to memory analysis, without other resources of consideration virtual machine, between the resource for also not considering virtual machine
Relationship, this programme can utilize virtual-machine data since control thresholding is determined based on multi-variate statistical analysis algorithm
Entire variable carries out analysis detection to virtual-machine data, takes the relationship between each resource of virtual machine into consideration, thus accurately really
Determine whether virtual machine exception occurs, the effective accuracy for improving abnormality detection result reduces false alarm rate.
Detailed description of the invention
Fig. 1 is the device structure schematic diagram for the hardware running environment that the embodiment of the present invention is related to；
Fig. 2 is the flow diagram of virtual machine method for detecting abnormality first embodiment of the present invention；
Fig. 3 is the refinement flow diagram of step S101 in first embodiment of the invention；
The refinement flow diagram that Fig. 4 is step S103 in first embodiment of the invention
The refinement flow diagram that Fig. 5 is step S1015 in second embodiment of the invention；
Fig. 6 is the functional block diagram of virtual machine abnormal detector first embodiment of the present invention.
The embodiments will be further described with reference to the accompanying drawings for the realization, the function and the advantages of the object of the present invention.
Specific embodiment
It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.
The primary solutions of the embodiment of the present invention are: being primarily based on the off-line training collection got, determine virtual machine number
According to the control thresholding for integrating statistic determine the whole of the virtual-machine data then when detecting the virtual-machine data of acquisition
Statistic is closed, finally according to the control thresholding and statistic is integrated, determines whether virtual machine exception occurs.
Since the resource of virtual machine not only includes memory, also comprising CPU, network and disk etc., when virtual machine is abnormal
When, the relationship between the resource of virtual machine is not only considered yet, therefore without other resources of consideration virtual machine to memory analysis
The accuracy that not can guarantee abnormality detection result leads to false alarm rate abruptly increase.
The present invention provides a solution, using the normal anomaly data of virtual machine as training dataset, and based on polynary
Statistical analysis algorithms determine the control thresholding for integrating statistic of virtual-machine data, then using determining control thresholding to virtual
Machine data are detected, compared to traditional virtual machine abnormality detection mode, i.e., only to memory analysis, without considering virtual machine
Other resources, do not consider the relationship between the resource of virtual machine yet, and this programme is based on multi-variate statistical analysis due to control thresholding
What algorithm determined, therefore analysis detection can be carried out to virtual-machine data using the entire variable of virtual-machine data, take void into consideration
Relationship between each resource of quasi- machine, thus accurately determine whether virtual machine exception occurs, it is effective to improve abnormality detection knot
The accuracy of fruit reduces false alarm rate.
As shown in Figure 1, Fig. 1 is the device structure schematic diagram for the hardware running environment that the embodiment of the present invention is related to.
Virtual machine abnormality detecting apparatus of the embodiment of the present invention can be PC, be also possible to smart phone, tablet computer, portable
The packaged type terminal device having a display function such as computer.
As shown in Figure 1, the virtual machine abnormality detecting apparatus may include: processor 1001, such as CPU, communication bus
1002, user interface 1003, network interface 1004, memory 1005.Wherein, communication bus 1002 for realizing these components it
Between connection communication.User interface 1003 may include display screen (Display), input unit such as keyboard (Keyboard),
Optional user interface 1003 can also include standard wireline interface and wireless interface.Network interface 1004 optionally can wrap
Include standard wireline interface and wireless interface (such as WI-FI interface).Memory 1005 can be high speed RAM memory, be also possible to
Stable memory (non-volatile memory), such as magnetic disk storage.Memory 1005 optionally can also be independent
In the storage device of aforementioned processor 1001.
Optionally, which can also include camera, RF (Radio Frequency, radio frequency)
Circuit, sensor, voicefrequency circuit, WiFi module etc..
It will be understood by those skilled in the art that virtual machine abnormality detecting apparatus structure shown in Fig. 1 is not constituted to void
The restriction of quasi- machine abnormality detecting apparatus may include perhaps combining certain components or not than illustrating more or fewer components
Same component layout.
As shown in Figure 1, as may include that operating system, network are logical in a kind of memory 1005 of computer storage medium
Believe module, Subscriber Interface Module SIM and virtual machine abnormality detecting program.
In virtual machine abnormality detecting apparatus shown in Fig. 1, network interface 1004 is mainly used for connecting background server, with
Background server carries out data communication；User interface 1003 is mainly used for connecting client (user terminal), is counted with client
According to communication；And processor 1001 can be used for calling the virtual machine abnormality detecting program stored in memory 1005, and execute with
Lower step:
According to the training dataset got, the control thresholding for integrating statistic of virtual-machine data is determined；
When detecting the virtual-machine data of acquisition, the integration statistic of the virtual-machine data is determined；
Statistic and the control thresholding are integrated according to described, determines whether virtual machine exception occurs.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
Training dataset is obtained, and the training dataset is normalized, obtains normalization data collection；
Independent component analysis processing is carried out to the normalization data collection, the independent entry for obtaining the normalization data collection is empty
Between and independent entry residual error space；
Principal component analysis processing is carried out to independent entry residual error space, obtains principal component space and pivot residual error space；
The independent entry space, the corresponding statistic of the principal component space and pivot residual error space are constructed and integrate,
Statistic is integrated in acquisition；
According to default Density Estimator algorithm and default confidence level, the control thresholding for integrating statistic is determined.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
Independent component analysis processing is carried out to the normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic of each independent entry and described is calculated in several independent entries
The associated probability value of statistic；
The independent entry that the probability value together is higher than the first preset threshold is formed into independent entry space, and will be described general together
Rate value forms independent entry residual error space less than or equal to the independent entry of the first preset threshold.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
When detecting the confidence level adjustment request of triggering, the default confidence level is replaced with into the confidence level adjustment and is asked
Confidence level in asking；
According to default Density Estimator algorithm and replaced default confidence level, the control door for integrating statistic is determined
Limit.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
It integrates statistic by described and is compared with the control thresholding；
If the statistic of integrating is higher than the control thresholding, it is determined that virtual machine occurs abnormal；
If the statistic of integrating integrates statistic and the control according to described less than or equal to the control thresholding
The difference of thresholding, determines whether virtual machine exception occurs.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
Judge it is described integrate statistic and it is described control thresholding difference whether be lower than the second preset threshold；
If the difference for integrating statistic and the control thresholding is lower than the second preset threshold, it is determined that virtual machine occurs
It is abnormal；
If the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that virtual
Machine does not occur exception.
Further, processor 1001 can call the virtual machine abnormality detecting program stored in memory 1005, also hold
Row following steps:
It shows abnormality alarming information, and issues preset alarm sound.
The specific embodiment of virtual machine abnormality detecting apparatus of the present invention is each specific with following virtual machine method for detecting abnormality
Embodiment is essentially identical, and therefore not to repeat here.
The present invention also provides a kind of virtual machine method for detecting abnormality.
It is the flow diagram of virtual machine method for detecting abnormality first embodiment of the present invention referring to Fig. 2, Fig. 2.
In the present embodiment, which includes:
Step S101 determines the control thresholding for integrating statistic of virtual-machine data according to the training dataset got；
Wherein, training dataset includes virtual machine normal data and virtual machine abnormal data, and the number that training data is concentrated
According to different time ranges is in, the virtual machine normal data and virtual machine abnormal data include CPU usage, memory use
Rate, disk writing rate, disk reading rate, network egress bandwidth and Web portal bandwidth etc.；Integrating statistic is based on shellfish
This reasoning of leaf I2Statistic, T2The posterior probability of statistic and SPE statistic, be then based on for posterior probability integrate I2System
Metering, T2What statistic and SPE statistic obtained；Controlling thresholding is determined based on Density Estimator algorithm and confidence level, table
Show the normal range (NR) for integrating statistic.
It can be to realize the device detected to the exception of virtual machine or equipment for the executing subject of the present embodiment, it should
Device or equipment can when examining side to virtual-machine data, based on determining control thresholding detect automatically virtual machine whether occur it is different
Often.
In order to effectively improve the accuracy of virtual machine abnormality detection result, false alarm rate is reduced, is needed to virtual-machine data
Entire variable analysis is carried out, will include that CPU usage, memory usage, disk writing rate, disk read speed in the present embodiment
The virtual machine normal data and virtual machine abnormal data of rate, network egress bandwidth and Web portal bandwidth etc. are as training data
Collection, is then based on the control thresholding for integrating statistic that the training dataset determines virtual-machine data, i.e., based on multivariate statistics point
Analysis method handles each training data that training data is concentrated, and obtains the integration statistic of each training data, and benefit
With Density Estimator method, and the confidence level being arranged, determine the control thresholding for integrating statistic.
Specifically, it is specifically included referring to Fig. 3, step S101:
Step S1011 obtains training dataset, and training dataset is normalized, and obtains normalization data
Collection；
It obtains, and this is normalized, i.e., be 0 to the carry out mean value, variance is 1 standardization, and acquisition is returned
One changes data set, is set as X=[x1,x2,...,xn], normalization data integrates as X*, wherein X* meet mean value be 0, variance 1.
Step S1012 carries out independent component analysis processing to normalization data collection, obtains the independent entry of normalization data collection
Space and independent entry residual error space；
To the normalization data collection carry out independent component analysis processing, obtain normalization data collection independent entry space and solely
Vertical member residual error space, i.e., carry out ICA (Independent Component Correlation to normalization data collection X*
Algorithm, independent component analysis) processing, to obtain X*=AS-E, wherein A is hybrid matrix, and S is independent element square
Battle array, E is the residual error item of ICA algorithm, i.e., using whole independent elements in independent element matrix S as independent entry space, and will be residual
Whole independent elements in poor item E are as independent entry residual error space.
Specifically, in the present embodiment, step S1012 includes:
Independent component analysis processing is carried out to normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic and statistic of each independent entry in several independent entries are calculated
Probability value together；
The independent entry that associated probability value is higher than the first preset threshold is formed into independent entry space, and associated probability value is lower than
Or independent entry residual error space is formed equal to the independent entry of the first preset threshold.
Independent component analysis processing is carried out to normalization data collection, obtains several independent entries, and based on default normality inspection
Checking method calculates the associated probability value of the statistic and statistic of each independent entry in several independent entries, and then will accompany probability
The independent entry that value is higher than the first preset threshold forms independent entry space, and will be less than or equal to the first preset threshold by probability value together
Independent entry form independent entry residual error space, wherein the default test of normality algorithm is Jarque-Bera check algorithm, is
Whether there is the inspection of the goodness of fit for the skewness and kurtosis for meeting normal distribution to training dataset, JB statistic is defined as JB
=(n/6)+(S2+(K-3)2/ 4), wherein n is freedom degree, S is sample skewness coefficient, and K is sample kurtosis coefficient, to normal distribution
For, the progressive obedience freedom degree of JB statistic be 2 chi square distribution.If the associated probability value of JB statistic is less than setting
Probability level then refuses null hypothesis, is not considered as training dataset Normal Distribution；Conversely, then receiving null hypothesis.It needs to illustrate
, which is 0.8, and first preset threshold can also be carried out by those skilled in the art based on actual conditions
Setting, the present embodiment are not especially limited this.
Step S1013 carries out principal component analysis processing to independent entry residual error space, obtains principal component space and pivot is residual
Difference space；
Pair principal component analysis processing is carried out to the independent entry residual error space, obtains principal component space and pivot residual error space, i.e.,
Independent entry residual error space carries out PCA (Principal Component Analysis, principal component analysis) processing, calculates independent entry
The covariance matrix S in residual error space, and Eigenvalues Decomposition is carried out to covariance matrix S, obtain the non-negative reality successively decreased comprising amplitude
The diagonal matrix Λ of characteristic value, the sequence then successively decreased according to amplitude add up the characteristic value in diagonal matrix Λ, and divided by complete
The sum of portion's characteristic value obtains accumulative variance contribution degree, finally determines pivot number based on accumulative variance contribution degree, and according to characteristic value
The corresponding pivot of sequential selection successively decreased of amplitude, and the pivot of selection is formed into principal component space, remaining pivot forms pivot
Residual error space.
Step S1014 constructs and integrates independent entry space, the corresponding statistic of principal component space and pivot residual error space, obtains
It is rounded and closes statistic；
After determining independent entry space, principal component space and pivot residual error space, construction independent entry space, principal component space and
The corresponding statistic in pivot residual error space, and respectively I2Statistic, T2Statistic and SPE statistic, are then based on Bayes and push away
Reason obtains the posterior probability of each statistic, and integrates I according to the posterior probability of each statistic2Statistic, T2Statistic and
Statistic is integrated in SPE statistic, acquisition, wherein is set and is integrated statistic as Index, the posterior probability inferred is α1、α2And α3,
Then Index=α1I2+α2T2+α3SPE。
Step S1015 determines the control for integrating statistic according to default Density Estimator algorithm and default confidence level
Thresholding.
Wherein, the confidence interval that confidence level is training dataset in the present embodiment is preset, is to training number in the present embodiment
According to the interval estimation of some population parameter of collection, for showing the degree integrating statistic and falling in around measurement result；Default core
Density estimation algorithm is KDE (Kernel Density Estimation, Density Estimator).
Integrating I2Statistic, T2Statistic and SPE statistic, get after integrating statistic Index, according to default
Density Estimator algorithm and default confidence level determine the control thresholding of the integration statistic, if sample set is X={ xt, t=1,
2 ..., n }, probability density function is P (xt), then the KDE variance of cuclear density can indicate are as follows:
Wherein,It is the estimation of probability density function, n is sample number, and h is bandwidth, and k () is kernel function, is given
99.7% confidence level, so that it may which control thresholding is calculated by KDE.It should be noted that the default Density Estimator algorithm
It can be configured by those skilled in the art based on actual conditions with default confidence level, the present embodiment is not especially limited this.
Step S102 determines the integration statistic of virtual-machine data when detecting the virtual-machine data of acquisition；
In the virtual machine system operational process of cloud platform, virtual-machine data is acquired in real time, and in the void for detecting acquisition
When quasi- machine data, virtual-machine data is normalized, obtains master sample data, and master sample data are carried out only
Vertical constituent analysis processing, obtains the independent entry space and independent entry residual error space of master sample data, then to independent entry residual error
Space carries out principal component analysis processing, obtains principal component space and pivot residual error space, and construct and integrate independent entry space, pivot
The corresponding statistic in space and pivot residual error space, and respectively I2Statistic, T2Statistic and SPE statistic, are then based on shellfish
This reasoning of leaf obtains the posterior probability of each statistic, and integrates I according to the posterior probability of each statistic2Statistic, T2Statistics
Amount and SPE statistic, to determine the integration statistic of virtual-machine data.
Step S103 determines whether virtual machine exception occurs according to statistic and control thresholding is integrated.
After determining the integration statistic of virtual-machine data, according to statistic and control thresholding is integrated, virtual machine is determined
Whether exception is occurred.
Specifically, include: referring to Fig. 4, step S103
Step S1031 judges to integrate whether statistic is higher than control thresholding；
Step S1032, if integrating statistic is higher than control thresholding, it is determined that virtual machine occurs abnormal；
Step S1033, if integrating statistic less than or equal to control thresholding, according to integrating statistic and control thresholding
Difference, determines whether virtual machine exception occurs.
After determining the integration statistic of virtual-machine data, judge to integrate whether statistic is higher than the control thresholding,
If integrating statistic is higher than control thresholding, it is determined that exception occurs in virtual machine, if integrating statistic less than or equal to control
Thresholding determines whether virtual machine exception occurs then according to the difference for integrating statistic and the control thresholding.
Further, it shows abnormality alarming information, and issues preset alarm sound.
When determining that virtual machine occurs abnormal, abnormality alarming information can be shown, and issue preset alarm sound, be convenient for operator
It is abnormal that member knows that virtual machine occurs in time, and timely handles.
In the present embodiment, the present invention is using the normal anomaly data of virtual machine as training dataset, and is based on multivariate statistics
Parser determines the control thresholding for integrating statistic of virtual-machine data, then using determining control thresholding to virtual machine number
According to being detected, compared to traditional virtual machine abnormality detection mode, i.e., only to memory analysis, without considering the other of virtual machine
Resource, does not consider the relationship between the resource of virtual machine yet, and this programme is based on multi-variate statistical analysis algorithm due to control thresholding
Determining, therefore analysis detection can be carried out to virtual-machine data using the entire variable of virtual-machine data, take virtual machine into consideration
Each resource between relationship, to accurately determine whether virtual machine exception occurs, the effective abnormality detection result that improves
Accuracy reduces false alarm rate.
Further, referring to Fig. 5, it is based on above-mentioned first embodiment, proposes virtual machine method for detecting abnormality of the present invention
Second embodiment, the difference with previous embodiment are that step S1015 includes:
Step S10151 replaces with the default confidence level described when detecting the confidence level adjustment request of triggering
Confidence level in confidence level adjustment request；
Step S10152 determines the integration system according to default Density Estimator algorithm and replaced default confidence level
The control thresholding of metering.
It should be noted that the present invention is based on previous embodiments to propose a kind of specific adjustment mode of confidence level, below
Only it is explained.
When detecting the confidence level adjustment request of triggering, default confidence level is replaced in the confidence level adjustment request
Confidence level determine the control door for integrating statistic and according to default Density Estimator algorithm and replaced default confidence level
Limit.
In the present embodiment, the present invention can determine optimal control thresholding, further effectively by adjusting confidence level
The accuracy of abnormality detection result is improved, false alarm rate is reduced.
Further, above-mentioned first or second embodiments are based on, the of virtual machine method for detecting abnormality of the present invention is proposed
Three embodiments, the difference with previous embodiment are that step S1033 includes:
Step a judges whether integrate statistic and the difference of control thresholding is lower than the second preset threshold；
Step b, if integrating the difference of statistic and the control thresholding lower than the second preset threshold, it is determined that virtual machine goes out
It is now abnormal；
Step c, if the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that empty
Quasi- machine does not occur exception.
It should be noted that proposing one kind the present invention is based on previous embodiment and integrating statistic lower than control thresholding
In the case where, whether detection virtual machine there is abnormal concrete mode, is only explained below, other to can refer to aforementioned reality
Apply example.
After determining the integration statistic of virtual-machine data, judge to integrate whether statistic is higher than the control thresholding,
If integrating statistic less than or equal to the control thresholding, the difference for integrating statistic and the control thresholding is calculated, and
Statistic is integrated in judgement and whether the difference of control thresholding is lower than the second preset threshold, if integrating statistic and controlling thresholding
Difference is lower than the second preset threshold, it is determined that virtual machine occurs abnormal.
In the present embodiment, the present invention further calculates when integrating statistic lower than control thresholding and integrates statistic
It is abnormal to determine that virtual machine occurs with the difference of the control thresholding, further improves exception and when the difference is lower than certain value
The accuracy of testing result reduces false alarm rate.
The present invention also provides a kind of virtual machine abnormal detectors.
It is the functional block diagram of virtual machine abnormal detector first embodiment of the present invention referring to Fig. 6, Fig. 6.
In the present embodiment, which includes:
First determining module 101, for determining the integration statistic of virtual-machine data according to the training dataset got
Control thresholding；
Wherein, training dataset includes virtual machine normal data and virtual machine abnormal data, and the number that training data is concentrated
According to different time ranges is in, the virtual machine normal data and virtual machine abnormal data include CPU usage, memory use
Rate, disk writing rate, disk reading rate, network egress bandwidth and Web portal bandwidth etc.；Integrating statistic is based on shellfish
This reasoning of leaf I2Statistic, T2The posterior probability of statistic and SPE statistic, be then based on for posterior probability integrate I2System
Metering, T2What statistic and SPE statistic obtained；Controlling thresholding is determined based on Density Estimator algorithm and confidence level, table
Show the normal range (NR) for integrating statistic.
In order to effectively improve the accuracy of virtual machine abnormality detection result, false alarm rate is reduced, is needed to virtual-machine data
Entire variable analysis is carried out, in the present embodiment, which will be made by the first determining module 101 including CPU
It is virtual with rate, memory usage, disk writing rate, disk reading rate, network egress bandwidth and Web portal bandwidth etc.
Machine normal data and virtual machine abnormal data are then based on the training dataset and determine virtual-machine data as training dataset
Integrate the control thresholding of statistic, i.e., at each training data concentrated based on Multielement statistical analysis method to training data
Reason obtains the integration statistic of each training data, and the confidence level for utilizing Density Estimator method, and being arranged, determines integration
The control thresholding of statistic.
Specifically, the first determining module 101, is also used to:
Training dataset is obtained, and training dataset is normalized, obtains normalization data collection；
Independent component analysis processing is carried out to normalization data collection, obtains independent entry space and the independence of normalization data collection
First residual error space；
Principal component analysis processing is carried out to independent entry residual error space, obtains principal component space and pivot residual error space；
Independent entry space, the corresponding statistic of principal component space and pivot residual error space are constructed and integrated, integration statistics is obtained
Amount；
According to default Density Estimator algorithm and default confidence level, the control thresholding for integrating statistic is determined.
The virtual machine abnormal detector obtains training dataset first, and place is normalized to the training dataset
Reason, i.e., carrying out mean value to the training dataset is 0, and variance is 1 standardization, normalization data collection is obtained, if training data
Integrate as X=[x1,x2,...,xn], normalization data integrates as X*, wherein X* meet mean value be 0, variance 1.
Secondly, carrying out independent component analysis processing to the normalization data collection, the independent entry for obtaining normalization data collection is empty
Between and independent entry residual error space, i.e., to normalization data collection X* carry out ICA (Independent Component
Correlation Algorithm, independent component analysis) processing, to obtain X*=AS-E, wherein A is hybrid matrix, S
For independent element matrix, E is the residual error item of ICA algorithm, i.e., using whole independent elements in independent element matrix S as independent entry
Space, and using whole independent elements in residual error item E as independent entry residual error space.
Then, principal component analysis processing is carried out to the independent entry residual error space, obtains principal component space and pivot residual error space,
PCA (Principal Component Analysis, principal component analysis) processing is carried out to independent entry residual error space, is calculated only
The covariance matrix S in vertical member residual error space, and Eigenvalues Decomposition is carried out to covariance matrix S, acquisition is successively decreased non-comprising amplitude
The diagonal matrix Λ of negative factual investigation, the sequence then successively decreased according to amplitude adds up the characteristic value in diagonal matrix Λ, and removes
With the sum of All Eigenvalues, accumulative variance contribution degree is obtained, pivot number is finally determined based on accumulative variance contribution degree, and according to spy
The corresponding pivot of the sequential selection that the amplitude of value indicative is successively decreased, and the pivot of selection is formed into principal component space, remaining pivot composition
Pivot residual error space.
Subsequently, independent entry space, the corresponding statistic of principal component space and pivot residual error space, and respectively I are constructed2System
Metering, T2Statistic and SPE statistic are then based on Bayesian inference and obtain the posterior probability of each statistic, and according to every
The posterior probability of a statistic integrates I2Statistic, T2Statistic is integrated in statistic and SPE statistic, acquisition, wherein sets integration
Statistic is Index, and the posterior probability inferred is α1、α2And α3, then Index=α1I2+α2T2+α3SPE。
Finally, the control thresholding of the integration statistic is determined according to default Density Estimator algorithm and default confidence level, if
Sample set is X={ xt, t=1,2 ..., n }, probability density function is P (xt), then the KDE variance of cuclear density can indicate are as follows:
Wherein,It is the estimation of probability density function, n is sample number, and h is bandwidth, and k () is kernel function, is given
99.7% confidence level, so that it may which control thresholding is calculated by KDE.It should be noted that the default Density Estimator algorithm
It can be configured by those skilled in the art based on actual conditions with default confidence level, the present embodiment is not especially limited this.
Wherein, preset confidence level be the present embodiment in training dataset confidence interval, be to training dataset in the present embodiment certain
The interval estimation of a population parameter, for showing the degree integrating statistic and falling in around measurement result；Default Density Estimator
Algorithm is KDE (Kernel Density Estimation, Density Estimator).
Specifically, the first determining module 101, is also used to:
Independent component analysis processing is carried out to normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic and statistic of each independent entry in several independent entries are calculated
Probability value together；
The independent entry that associated probability value is higher than the first preset threshold is formed into independent entry space, and associated probability value is lower than
Or independent entry residual error space is formed equal to the independent entry of the first preset threshold.
The virtual machine abnormal detector carries out independent component analysis processing to normalization data collection, obtains several independences
Member, and accompanying for the statistic and statistic of each independent entry in several independent entries is calculated based on default test of normality algorithm
Then the independent entry that associated probability value is higher than the first preset threshold is formed independent entry space by probability value, and the probability value that will accompany
Independent entry less than or equal to the first preset threshold forms independent entry residual error space, wherein the default test of normality algorithm is
Jarque-Bera check algorithm is the goodness of fit for whether having the skewness and kurtosis for meeting normal distribution to training dataset
Inspection, JB statistic is defined as JB=(n/6)+(S2+(K-3)2/ 4), wherein n is freedom degree, S is sample skewness coefficient, and K is
Sample kurtosis coefficient, for normal distribution, the progressive obedience freedom degree of JB statistic be 2 chi square distribution.If JB is counted
The associated probability value of amount is less than the probability level of setting, then refuses null hypothesis, be not considered as training dataset Normal Distribution；Instead
It, then receive null hypothesis.It should be noted that first preset threshold is 0.8, and first preset threshold can also be by this field
Technical staff is configured based on actual conditions, and the present embodiment is not especially limited this.
Determining module 102 is detected, for determining the whole of the virtual-machine data when detecting the virtual-machine data of acquisition
Close statistic；
The virtual machine abnormal detector is by detecting determining module 102 in the virtual machine system operational process of cloud platform
In, virtual-machine data is acquired in real time, and in the virtual-machine data for detecting acquisition, place is normalized to virtual-machine data
Reason obtains master sample data, and carries out independent component analysis processing to master sample data, obtains the only of master sample data
Vertical member space and independent entry residual error space, then carry out principal component analysis processing to independent entry residual error space, obtain principal component space
With pivot residual error space, and constructs and integrate independent entry space, the corresponding statistic of principal component space and pivot residual error space, and point
It Wei not I2Statistic, T2Statistic and SPE statistic are then based on Bayesian inference and obtain the posterior probability of each statistic, and
I is integrated according to the posterior probability of each statistic2Statistic, T2Statistic and SPE statistic, to determine the whole of virtual-machine data
Close statistic.
Second determining module 103, for integrating statistic and the control thresholding judges whether virtual machine goes out according to described
It is now abnormal.
The virtual machine abnormal detector, according to statistic and control thresholding is integrated, is determined by the second determining module 103
Whether virtual machine there is exception.
Specifically, second determining module 103, is also used to:
Judgement integrates whether statistic is higher than control thresholding；
If integrating statistic is higher than control thresholding, it is determined that virtual machine occurs abnormal；
It is determined less than or equal to control thresholding according to integrating statistic and controlling the difference of thresholding if integrating statistic
Whether virtual machine there is exception.
The virtual machine abnormal detector judges that integrating statistic is after determining the integration statistic of virtual-machine data
It is no to be higher than the control thresholding, if integrating statistic is higher than control thresholding, it is determined that exception occurs in virtual machine, if integration system
Metering, then according to integrating statistic and controlling the difference of thresholding, it is different to determine whether virtual machine occurs less than or equal to control thresholding
Often.
Further, the virtual machine abnormal detector further include:
Display and alarm module, for showing abnormality alarming information, and issue preset alarm sound.
When determining that virtual machine occurs abnormal, abnormality alarming information can be shown, and issue preset alarm sound, be convenient for operator
It is abnormal that member knows that virtual machine occurs in time, and timely handles.
In the present embodiment, the present invention is using the normal anomaly data of virtual machine as training dataset, and is based on multivariate statistics
Parser determines the control thresholding for integrating statistic of virtual-machine data, then using determining control thresholding to virtual machine number
According to being detected, compared to traditional virtual machine abnormality detection mode, i.e., only to memory analysis, without considering the other of virtual machine
Resource, does not consider the relationship between the resource of virtual machine yet, and this programme is based on multi-variate statistical analysis algorithm due to control thresholding
Determining, therefore analysis detection can be carried out to virtual-machine data using the entire variable of virtual-machine data, take virtual machine into consideration
Each resource between relationship, to accurately determine whether virtual machine exception occurs, the effective abnormality detection result that improves
Accuracy reduces false alarm rate.
Further, first determining module 101, is also used to:
When detecting the confidence level adjustment request of triggering, the default confidence level is replaced with into the confidence level adjustment and is asked
Confidence level in asking；
According to default Density Estimator algorithm and replaced default confidence level, the control door for integrating statistic is determined
Limit.
Further, first determining module 101, is also used to:
Judge it is described integrate statistic and it is described control thresholding difference whether be lower than the second preset threshold；
If the difference for integrating statistic and the control thresholding is lower than the second preset threshold, it is determined that virtual machine occurs
It is abnormal；
If the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that virtual
Machine does not occur exception.
The specific embodiment of virtual machine abnormal detector of the present invention and above-mentioned each embodiment of virtual machine method for detecting abnormality
Essentially identical, therefore not to repeat here.
In addition, the embodiment of the present invention also proposes a kind of computer readable storage medium, the computer readable storage medium
On be stored with virtual machine abnormality detecting program, the virtual machine abnormality detecting program performs the steps of when being executed by processor
According to the training dataset got, the control thresholding for integrating statistic of virtual-machine data is determined；
When detecting the virtual-machine data of acquisition, the integration statistic of the virtual-machine data is determined；
Statistic and the control thresholding are integrated according to described, determines whether virtual machine exception occurs.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
Training dataset is obtained, and the training dataset is normalized, obtains normalization data collection；
Training dataset is obtained, and the training dataset is normalized, obtains normalization data collection；
Independent component analysis processing is carried out to the normalization data collection, the independent entry for obtaining the normalization data collection is empty
Between and independent entry residual error space；
Principal component analysis processing is carried out to independent entry residual error space, obtains principal component space and pivot residual error space；
The independent entry space, the corresponding statistic of the principal component space and pivot residual error space are constructed and integrate,
Statistic is integrated in acquisition；
According to default Density Estimator algorithm and default confidence level, the control thresholding for integrating statistic is determined.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
Independent component analysis processing is carried out to the normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic of each independent entry and described is calculated in several independent entries
The associated probability value of statistic；
The independent entry that the probability value together is higher than the first preset threshold is formed into independent entry space, and will be described general together
Rate value forms independent entry residual error space less than or equal to the independent entry of the first preset threshold.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
When detecting the confidence level adjustment request of triggering, the default confidence level is replaced with into the confidence level adjustment and is asked
Confidence level in asking；
According to default Density Estimator algorithm and replaced default confidence level, the control door for integrating statistic is determined
Limit.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
It integrates statistic by described and is compared with the control thresholding；
If the statistic of integrating is higher than the control thresholding, it is determined that virtual machine occurs abnormal；
If the statistic of integrating integrates statistic and the control according to described less than or equal to the control thresholding
The difference of thresholding, determines whether virtual machine exception occurs.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
Judge it is described integrate statistic and it is described control thresholding difference whether be lower than the second preset threshold；
If the difference for integrating statistic and the control thresholding is lower than the second preset threshold, it is determined that virtual machine occurs
It is abnormal；
If the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that virtual
Machine does not occur exception.
Further, it is also performed the steps of when the virtual machine abnormality detecting program is executed by processor
It shows abnormality alarming information, and issues preset alarm sound.
The specific embodiment of computer readable storage medium of the present invention and above-mentioned each embodiment of virtual machine method for detecting abnormality
Essentially identical, therefore not to repeat here.
It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row
His property includes, so that the process, method, article or the system that include a series of elements not only include those elements, and
And further include other elements that are not explicitly listed, or further include for this process, method, article or system institute it is intrinsic
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including being somebody's turn to do
There is also other identical elements in the process, method of element, article or system.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side
Method can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but in many cases
The former is more preferably embodiment.Based on this understanding, technical solution of the present invention substantially in other words does the prior art
The part contributed out can be embodied in the form of software products, which is stored in one as described above
In storage medium (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that terminal device (it can be mobile phone,
Computer, server, air conditioner or network equipment etc.) execute method described in each embodiment of the present invention.
The above is only a preferred embodiment of the present invention, is not intended to limit the scope of the invention, all to utilize this hair
Equivalent structure or equivalent flow shift made by bright specification and accompanying drawing content is applied directly or indirectly in other relevant skills
Art field, is included within the scope of the present invention.
Claims (10)
1. a kind of virtual machine method for detecting abnormality, which is characterized in that the described method includes:
According to the training dataset got, the control thresholding for integrating statistic of virtual-machine data is determined；
When detecting the virtual-machine data of acquisition, the integration statistic of the virtual-machine data is determined；
Statistic and the control thresholding are integrated according to described, determines whether virtual machine exception occurs.
2. virtual machine method for detecting abnormality as described in claim 1, which is characterized in that the training data that the basis is got
Collection, determines the control thresholding for integrating statistic of virtual-machine data, comprising:
Training dataset is obtained, and the training dataset is normalized, obtains normalization data collection；
To the normalization data collection carry out independent component analysis processing, obtain the normalization data collection independent entry space and
Independent entry residual error space；
Principal component analysis processing is carried out to independent entry residual error space, obtains principal component space and pivot residual error space；
The independent entry space, the corresponding statistic of the principal component space and pivot residual error space are constructed and integrated, is obtained
Integrate statistic；
According to default Density Estimator algorithm and default confidence level, the control thresholding for integrating statistic is determined.
3. virtual machine method for detecting abnormality as claimed in claim 2, which is characterized in that carried out to the normalization data collection only
Vertical constituent analysis processing, obtains the independent entry space and independent entry residual error space of the normalization data collection, comprising:
Independent component analysis processing is carried out to the normalization data collection, obtains several independent entries；
Based on default test of normality algorithm, the statistic and the statistics of each independent entry in several independent entries are calculated
The associated probability value of amount；
The independent entry that the probability value together is higher than the first preset threshold is formed into independent entry space, and will the associated probability value
Independent entry less than or equal to the first preset threshold forms independent entry residual error space.
4. virtual machine method for detecting abnormality as claimed in claim 2, which is characterized in that the basis is preset Density Estimator and calculated
Method and default confidence level determine the control thresholding for integrating statistic, comprising:
When detecting the confidence level adjustment request of triggering, the default confidence level is replaced in the confidence level adjustment request
Confidence level；
According to default Density Estimator algorithm and replaced default confidence level, the control thresholding for integrating statistic is determined.
5. such as virtual machine method for detecting abnormality of any of claims 1-4, which is characterized in that united according to the integration
Metering and the control thresholding, determine whether virtual machine exception occurs, comprising:
Judge described to integrate whether statistic is higher than the control thresholding；
If the statistic of integrating is higher than the control thresholding, it is determined that virtual machine occurs abnormal；
If the statistic of integrating integrates statistic and the control thresholding according to described less than or equal to the control thresholding
Difference, determine whether virtual machine exception occurs.
6. virtual machine method for detecting abnormality as claimed in claim 5, which is characterized in that according to it is described integrate statistic with it is described
The difference for controlling thresholding, determines whether virtual machine exception occurs, comprising:
Judge it is described integrate statistic and it is described control thresholding difference whether be lower than the second preset threshold；
If the difference for integrating statistic and the control thresholding is lower than the second preset threshold, it is determined that virtual machine occurs different
Often；
If the difference for integrating statistic and the control thresholding is greater than or equal to the second preset threshold, it is determined that virtual machine is not
There is exception.
7. virtual machine method for detecting abnormality as claimed in claim 5, which is characterized in that exception occurs in the determining virtual machine
Afterwards, the method also includes:
It shows abnormality alarming information, and issues preset alarm sound.
8. a kind of virtual machine abnormal detector characterized by comprising
First determining module, for determining the control for integrating statistic of virtual-machine data according to the training dataset got
Thresholding；
Determining module is detected, for when detecting the virtual-machine data of acquisition, determining that the integration of the virtual-machine data counts
Amount；
Second determining module determines whether virtual machine exception occurs for integrating statistic and the control thresholding according to described.
9. a kind of virtual machine abnormality detecting apparatus, which is characterized in that the virtual machine abnormality detecting apparatus includes: memory, place
It manages device and is stored in the virtual machine abnormality detecting program that can be run on the memory and on the processor, the virtual machine
The virtual machine abnormality detection as described in any one of claims 1 to 7 is realized when abnormality detecting program is executed by the processor
The step of method.
10. a kind of computer readable storage medium, which is characterized in that be stored with virtual machine on the computer readable storage medium
Abnormality detecting program is realized when the virtual machine abnormality detecting program is executed by processor such as any one of claims 1 to 7 institute
The step of virtual machine method for detecting abnormality stated.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810048058.1A CN110046054A (en) | 2018-01-17 | 2018-01-17 | Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810048058.1A CN110046054A (en) | 2018-01-17 | 2018-01-17 | Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110046054A true CN110046054A (en) | 2019-07-23 |
Family
ID=67273102
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810048058.1A Pending CN110046054A (en) | 2018-01-17 | 2018-01-17 | Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110046054A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111131304A (en) * | 2019-12-31 | 2020-05-08 | 嘉兴学院 | Cloud platform-oriented large-scale virtual machine fine-grained abnormal behavior detection method and system |
| CN112988732A (en) * | 2021-04-14 | 2021-06-18 | 湖南工程学院 | Method for processing abnormal value in observation data |
| CN113191432A (en) * | 2021-05-06 | 2021-07-30 | 中国联合网络通信集团有限公司 | Outlier factor-based virtual machine cluster anomaly detection method, device and medium |
| CN113726771A (en) * | 2021-08-30 | 2021-11-30 | 上海仪电（集团）有限公司中央研究院 | Cloud platform virus searching and killing method and system based on vaccine model |
| WO2022068645A1 (en) * | 2020-09-30 | 2022-04-07 | 深圳前海微众银行股份有限公司 | Database fault discovery method, apparatus, electronic device, and storage medium |
| CN114896024A (en) * | 2022-03-28 | 2022-08-12 | 同方威视技术股份有限公司 | Method and device for detecting running state of virtual machine based on kernel density estimation |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160041070A1 (en) * | 2014-08-05 | 2016-02-11 | 01dB-METRAVIB, Société par Actions Simplifiée | Automatic Rotating-Machine Fault Diagnosis With Confidence Level Indication |
| CN105425779A (en) * | 2015-12-24 | 2016-03-23 | 江南大学 | ICA-PCA multi-working condition fault diagnosis method based on local neighborhood standardization and Bayesian inference |
| CN106529079A (en) * | 2016-11-29 | 2017-03-22 | 上海电机学院 | Chemical process failure detection method based on failure-dependent principal component space |
| CN107357275A (en) * | 2017-07-27 | 2017-11-17 | 中南大学 | Non-gaussian industrial process fault detection method and system |
-
2018
- 2018-01-17 CN CN201810048058.1A patent/CN110046054A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160041070A1 (en) * | 2014-08-05 | 2016-02-11 | 01dB-METRAVIB, Société par Actions Simplifiée | Automatic Rotating-Machine Fault Diagnosis With Confidence Level Indication |
| CN105425779A (en) * | 2015-12-24 | 2016-03-23 | 江南大学 | ICA-PCA multi-working condition fault diagnosis method based on local neighborhood standardization and Bayesian inference |
| CN106529079A (en) * | 2016-11-29 | 2017-03-22 | 上海电机学院 | Chemical process failure detection method based on failure-dependent principal component space |
| CN107357275A (en) * | 2017-07-27 | 2017-11-17 | 中南大学 | Non-gaussian industrial process fault detection method and system |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111131304A (en) * | 2019-12-31 | 2020-05-08 | 嘉兴学院 | Cloud platform-oriented large-scale virtual machine fine-grained abnormal behavior detection method and system |
| CN111131304B (en) * | 2019-12-31 | 2022-01-11 | 嘉兴学院 | Cloud platform-oriented large-scale virtual machine fine-grained abnormal behavior detection method and system |
| WO2022068645A1 (en) * | 2020-09-30 | 2022-04-07 | 深圳前海微众银行股份有限公司 | Database fault discovery method, apparatus, electronic device, and storage medium |
| CN112988732A (en) * | 2021-04-14 | 2021-06-18 | 湖南工程学院 | Method for processing abnormal value in observation data |
| CN112988732B (en) * | 2021-04-14 | 2023-10-20 | 湖南工程学院 | Method for processing abnormal value in observed data |
| CN113191432A (en) * | 2021-05-06 | 2021-07-30 | 中国联合网络通信集团有限公司 | Outlier factor-based virtual machine cluster anomaly detection method, device and medium |
| CN113191432B (en) * | 2021-05-06 | 2023-07-07 | 中国联合网络通信集团有限公司 | Outlier factor-based virtual machine cluster abnormality detection method, device and medium |
| CN113726771A (en) * | 2021-08-30 | 2021-11-30 | 上海仪电（集团）有限公司中央研究院 | Cloud platform virus searching and killing method and system based on vaccine model |
| CN114896024A (en) * | 2022-03-28 | 2022-08-12 | 同方威视技术股份有限公司 | Method and device for detecting running state of virtual machine based on kernel density estimation |
| CN114896024B (en) * | 2022-03-28 | 2022-11-22 | 同方威视技术股份有限公司 | Method and device for detecting running state of virtual machine based on kernel density estimation |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110046054A (en) | Virtual machine method for detecting abnormality, device, equipment and computer readable storage medium | |
| CN106716382B (en) | The method and system of aggregation multiple utility program behavioural analysis for mobile device behavior | |
| CN106104555B (en) | For protecting the behavioural analysis of peripheral equipment | |
| US10922206B2 (en) | Systems and methods for determining performance metrics of remote relational databases | |
| US9037518B2 (en) | Classifying unclassified samples | |
| CN102231131B (en) | Testing software in electronic device | |
| CN104541293A (en) | Architecture for client-cloud behavior analyzer | |
| CN101751535A (en) | Data loss protection through application data access classification | |
| KR100966073B1 (en) | Apparatus and method for managing terminal users | |
| CN112884092A (en) | AI model generation method, electronic device, and storage medium | |
| JP2020501232A (en) | Risk control event automatic processing method and apparatus | |
| US11775412B2 (en) | Machine learning models applied to interaction data for facilitating modifications to online environments | |
| CN109412839A (en) | A kind of recognition methods, device, equipment and the storage medium of exception account | |
| CN106664218A (en) | Systems and methods for correlating derived metrics for system activity | |
| CN110008101A (en) | Client performance evaluation method, device, storage medium and electronic equipment | |
| KR20190136337A (en) | Social Media Contents Based Emotion Analysis Method, System and Computer-readable Medium | |
| CN114881711A (en) | Method for carrying out anomaly analysis based on request behavior and electronic equipment | |
| US10498806B2 (en) | Computer-executable server load monitoring method, apparatus performing the same and storage medium storing the same | |
| CN110245684A (en) | Data processing method, electronic equipment and medium | |
| CN112685799B (en) | Device fingerprint generation method and device, electronic device and computer readable medium | |
| CN108021998A (en) | The answer duration prediction method and device of network questionnaire | |
| CN109697155A (en) | IT system performance estimating method, device, equipment and readable storage medium storing program for executing | |
| CN109960905A (en) | Information processing method, system, medium and electronic equipment | |
| CN114281807A (en) | Data quality auditing method, device, equipment and storage medium | |
| US9942112B2 (en) | Information collection system, server apparatus, edge apparatus, control method, and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |