CN114003422A - Host anomaly detection method, computer device, and storage medium - Google Patents

Host anomaly detection method, computer device, and storage medium Download PDF

Info

Publication number
CN114003422A
CN114003422A CN202111231272.9A CN202111231272A CN114003422A CN 114003422 A CN114003422 A CN 114003422A CN 202111231272 A CN202111231272 A CN 202111231272A CN 114003422 A CN114003422 A CN 114003422A
Authority
CN
China
Prior art keywords
host
data
lstm
performance index
model
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111231272.9A
Other languages
Chinese (zh)
Inventor
郭城阳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Jinan Inspur Data Technology Co Ltd
Original Assignee
Jinan Inspur Data Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Jinan Inspur Data Technology Co Ltd filed Critical Jinan Inspur Data Technology Co Ltd
Priority to CN202111231272.9A priority Critical patent/CN114003422A/en
Publication of CN114003422A publication Critical patent/CN114003422A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
    • G06F11/0721—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment within a central processing unit [CPU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/079—Root cause analysis, i.e. error or fault diagnosis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/22—Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
    • G06F11/26—Functional testing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Abstract

The application relates to a host anomaly detection method, a computer device and a storage medium. The method comprises the following steps: an OCSVM classification model is obtained by training an LSTM prediction model by using host historical data and a difference vector consisting of the difference between a predicted value and an actual value, and then whether the difference vector between the predicted value and the actual value is normal or not is predicted and detected on line by using a mode of combining the two models, so that whether the host is abnormal or not is judged. The method effectively improves the detection accuracy and avoids the problems of false alarm and missed alarm caused by fixed threshold values.

Description

Host anomaly detection method, computer device, and storage medium
Technical Field
The present application relates to the field of cloud host monitoring technologies, and in particular, to a host anomaly detection method, a computer device, and a storage medium.
Background
With the rapid development of big data and cloud computing, the construction of cloud platforms also caters for a phase of explosive development. The host server is one of the most basic and important resources in the cloud computing platform, the bottom layers of resources such as a memory and a CPU (central processing unit) on which virtual resources depend are provided by the host, and the host plays a significant role in the operation of the cloud platform. If the host is abnormal for various reasons, various resources in the cloud platform may be stuck, delayed, even the virtual machine is down, and the like. Therefore, the online anomaly detection method has very important significance for online anomaly detection of the host in the cloud platform. The method is mainly characterized in that various operation conditions of the host are detected by some fixed indexes, such as a resource utilization rate threshold value, the operation time of a certain process and the like, and the method is used for detecting, so that maintenance personnel can be informed by means of alarming, reminding and the like when the host is predictably abnormal, but the setting of the utilization rate, the time and other threshold values has subjectivity and fixity and cannot be adjusted in a self-adaptive manner according to the task role born by the host, and a large amount of false alarm and missing phenomenon can be generated.
Disclosure of Invention
In view of the foregoing, it is desirable to provide a host anomaly detection method, a computer device, and a storage medium, which can accurately detect an anomaly occurring in a host in a cloud platform.
In one aspect, a host anomaly detection method is provided, and the method includes:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]And training the original OCSVM model by the actual operation values of the M index categories at the first momentObtaining a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
In one embodiment, the step S5 includes:
according to the M predicted data values [ p ]1,p2,…,pM]And constructing a first difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the first time instant1,▽p2,…,▽pM]；
Utilizing the first difference vector [. v [1,▽p2,…,▽pM]And training the original OCSVM model to obtain the trained OCSVM model.
In one embodiment, the steps S1, S4, and S6 further include performing a maximum-minimum normalization process on the collected host performance index data, and performing a subsequent operation using the processed index data.
In one embodiment, the step S3 includes:
and training the first N-1 data of the LSTM training sequence data of the performance index as an input sequence and the Nth data as output data, wherein the LSTM training sequence data comprises N data elements.
In one embodiment, where N is 60.
In one embodiment, the step S6 includes:
collecting host performance index data in the third running time of the host, and respectively predicting M index type running data at the second moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1’,p2’,…,pM’]；
According to the M predicted data values [ p ]1’,p2’,…,pM’]And constructing a second difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the second time1’,▽p2’,…,▽pM’]；
Will be describedThe second difference vector [. v [.)1’,▽p2’,…,▽pM’]And inputting the trained OCSVM model for anomaly detection.
In one embodiment, if the output result of the trained OCSVM model is 0, it indicates that the current difference is within a reasonable range and the current running state of the host is normal; if the output result is 1, the performance index of the current host is abnormal.
In one embodiment, if the host performance index is not abnormal within the preset time, adding normal data within the preset time into the training of the LSTM model and the OCSVM model, repeating the steps S2 to S5 to obtain an updated OCSVM model, and performing online abnormality detection on the host by using the updated OCSVM model.
In another aspect, a computer device is provided, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements the following steps when executing the computer program:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
In yet another aspect, a computer-readable storage medium is provided, having stored thereon a computer program which, when executed by a processor, performs the steps of:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
According to the host anomaly detection method, the computer equipment and the storage medium, the anomaly condition of the host in the cloud platform can be accurately detected under the condition that only the normal operation data of the host exist, and the maintenance personnel of the cloud platform can be timely notified and reminded, so that the health and stability of the host in the cloud platform can be favorably provided, and certain practical significance and practical value are achieved.
Drawings
FIG. 1 is a diagram of an embodiment of an application environment based on a host anomaly detection method;
FIG. 2 is a flow chart illustrating a method for host anomaly detection according to an embodiment;
FIG. 3 is a diagram illustrating an internal structure of a computer device according to an embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
The host anomaly detection method provided by the application can be applied to the application environment shown in FIG. 1.
In one embodiment, as shown in fig. 2, a host anomaly detection method is provided, which is exemplified by the application environment in fig. 1, and includes the following steps:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
specifically, under the condition that a host in a cloud platform normally operates, monitoring data of performance indexes of the host are collected within a period of continuous time by taking 1min as a collection time point, and 5 individual performance index data of a CPU utilization rate, a memory utilization rate, a disk utilization rate, an IO read-write speed and a disk read-write speed are taken as examples for description (collection and processing modes of other related performance index data are the same as those of the other related performance index data). Then, a time window with the time length T being 60min is selected to intercept the data, and 5 time series data can be obtained, wherein each sequence has 60 elements.
In one embodiment, step S1 further includes performing a maximum-minimum normalization process on the collected host performance indicator data, and performing subsequent operations using the processed indicator data.
Specifically, in order to avoid the influence of dirty data, the method uses a mean filtering method to perform data preprocessing, and performs the maximum and minimum normalization processing on the data, as shown in formula (1),
x＝(x-xmin)/(xmax-xmin) (1)
where x denotes data at the current time, xminRepresenting the smallest data value, x, in the sequencemaxRepresenting the largest data value in the sequence.
Step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
specifically, the description is given taking 5 performance index data of CPU usage, memory usage, disk usage, IO read-write speed, and disk read-write speed as an example, so that M is 5.
And (3) sliding a time window by taking 1min as a step length each time to obtain a large amount of sequence data, and dividing the data into 5 groups according to the performance types. Taking the CPU usage data as an example, the sequence data obtained are as shown in formula (2) and formula (3).
Lcpu_use＝[l1,l2,……,ln] (2)
ln＝[c1,c2,……,c59,c60] (3)
Wherein ln[n＝1,2,…,n]Indicates the n-th sequence data acquired, ciRepresents the CPU usage data collected by the imin within a time window.
Step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
in one embodiment, the step S3 includes:
and training the first N-1 data of the LSTM training sequence data of the performance index as an input sequence and the Nth data as output data, wherein the LSTM training sequence data comprises N data elements.
In one embodiment, where N is 60.
Specifically, the LSTM model based on a neural network structure is adopted for predicting the performance data of the host, the LSTM comprises a unit consisting of an input valve, an output valve and a forgetting valve, and the input sequence data passes through a plurality of sigmod gate valves and then the forgetting valveAnd controlling the retention of the cell historical state information, and finally outputting the control information by an output gate. Sequence data l of various performance indexesnThe first 59 data in (c) as input sequence1,c2,……,c59]The 60 th data c60Training is performed as output data. The principle formula of LSTM is shown in formula (4).
Figure BDA0003316044170000061
Wherein o ist＝σ(Wo·[ht-1,xt]+bo),
Figure BDA0003316044170000062
And it＝σ(Wi·[ht-1,xt]+bi),ft＝σ(Wf·[ht-1,xt]+bf) Wherein W isi，Wf，WoWeight coefficients representing input gate, output gate, forgetting gate, bi，bo，bfFor the bias vector, σ (-) is a sigmod activation function, so that inputting sequence data to LSTM, the output R at the current time can be obtainedt。
After training, various performance indexes can obtain an LSTM model which can be used for index prediction, five performance index data are trained by using the same method, and finally 5 LSTM prediction models can be obtained.
Step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Specifically, after the prediction model is obtained through training, data under the normal operation condition of the host is collected as in the process S1, and the sequence data is obtained in the same processing manner. Inputting the input data in 5 groups of sequence data into 5 LSTM prediction models to obtain 5 predicted values p1,p2,p3,p4,p5。
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
in one embodiment, the step S5 includes:
according to the M predicted data values [ p ]1,p2,…,pM]And constructing a first difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the first time instant1,▽p2,…,▽pM]；
Utilizing the first difference vector [. v [1,▽p2,…,▽pM]And training the original OCSVM model to obtain the trained OCSVM model.
Specifically, following the previous example, the difference of these 5 values from the 5 actual values at that time is calculated and constitutes a difference vector [. lam [. sub. ] p1,▽p2,▽p3,▽p4,▽p5]. With the sliding of the time window, a large number of difference vectors can be obtained by using the prediction model, and the vectors can form training data of the anomaly detection model.
The OCSVM is a single-classification unsupervised training model which can be trained only by using normal data, and can be well applied to the field of anomaly detection. The core idea is that a low-dimensional sample is converted into a high-dimensional feature space by using a kernel function, an optimal hyperplane is determined in the high-dimensional feature space, normal data and abnormal data can be distinguished to the greatest extent, and therefore a classification model is determined. By maximizing the Euclidean distance δ/| ω | of origin and positive sample data, where ω represents the normal vector that classifies the hyperplane and δ is the hyperplane intercept. Let T ═ x be the training sampleiI | ═ 1,2, …, n }, n denotes the number of training samples, x denotes the number of training samplesiRepresenting each difference vector, the problem in the invention can be finally transformed into the following problems according to the basic solving problem of the OCSVM:
min1/2∑i,jαiαjK(xi,xj) (5)
s.t.0≤αi≤1/vi,∑iαi＝1，i＝1,2,…,n
wherein v isiTaking a value between (0, 1); alpha is alphai,αjThe lagrange multiplier is represented by a number of lagrange multipliers,
Figure BDA0003316044170000081
Figure BDA0003316044170000082
is a kernel function, i.e. xi，xjIn the dot product operation of the high-dimensional feature space, the penalty uses a gaussian kernel function, as shown in formula (6).
K(xi,xj)＝exp(-‖xi-xj‖2/σ2) (6)
In the scheme, the offset calculation formula is a formula (7), the offset calculation formula can be obtained according to a formula (6) and a formula (7), and the final decision function is a formula (8);
ρ＝∑n i＝1αiK(xi,xj) (7)
f(x)＝sgn(∑iαiK(xi,xj)-ρ) (8)
where sgn () represents the sign function and p represents the compensation value of the final decision function of the support vector machine.
And (4) putting all the normal samples in the decision flat boundary, substituting the samples into a formula for training to obtain a support vector, and finally obtaining a training model.
And step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
In one embodiment, the step S6 includes:
collecting host performance index data in the third running time of the host, and respectively predicting M index type running data at the second moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1’,p2’,…,pM’]；
According to the M predicted data values [ p ]1’,p2’,…,pM’]And constructing a second difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the second time1’,▽p2’,…,▽pM’]；
(iv) vector [ # p1’,▽p2’,…,▽pM’]And inputting the trained OCSVM model for anomaly detection.
Specifically, in the case of abnormality detection, the manner of acquiring the detection data is still the same as that in step S1, so the variables used in this step are the same as those in step S1;
retention of Performance indicator data [ c ] for the past 59 minutes of running the host online1’,c2’,……,c59’]Then, inputting various data into different LSTM prediction models respectively to predict the performance data p of the current minutei；
Using predicted data piAnd current actual data tiMaking difference to obtain difference value of current host machine performance index
Figure BDA0003316044170000091
The five indexes are processed in the same way to form a vector
Figure BDA0003316044170000092
Figure BDA0003316044170000093
And inputting the difference vector into the trained OCSVM model for recognition, namely, substituting the difference vector into the formula (8).
In one embodiment, if the output result of the trained OCSVM model is 0, it indicates that the current difference is within a reasonable range and the current running state of the host is normal; if the output result is 1, the performance index of the current host is abnormal.
Specifically, if the output result is 0, it is proved that the current difference is within a reasonable range, and the host is in a normal operation state; if the output result is 1, the performance index of the current host is proved to be abnormal, and the host is further judged to be abnormal.
If the performance index data of the host at the current moment is normal, continuously using the past 59 minutes of data containing the current data, predicting the performance data of the next minute, and continuously carrying out online anomaly detection; if the performance index of the host computer at the current moment is abnormal, before the fault is not solved, 59 sequence data which are formed by data of the past 58 minutes and values predicted by the LSTM model at the moment are used for predicting data at the next moment, and online abnormality detection is continued.
In one embodiment, if the host performance index is not abnormal within the preset time, adding normal data within the preset time into the training of the LSTM model and the OCSVM model, repeating the steps S2 to S5 to obtain an updated OCSVM model, and performing online abnormality detection on the host by using the updated OCSVM model.
Specifically, if the host is not detected to be abnormal in one continuous week, an offline data training process is automatically triggered, normal data of the week is added into training data, a new LSTM prediction model and an OCSVM detection model are continuously trained by using the same method, and then the new model is used for replacing the original model to continuously perform online abnormality detection.
The method mainly aims to detect the hosts with abnormal phenomena in the cloud platform, firstly, historical performance monitoring data of each host is used, a model for prediction is trained by using LSTM, and the method is determined to cause a large amount of false reports and false report omission due to the fact that certain deviation exists between the data predicted by a prediction algorithm and actual data and the reasonable error range is difficult to determine. Meanwhile, the instant numerical value change of a single index may be caused by the conditions of environment and the like, and the direct application range judgment can cause the generation of false alarm. The invention provides a prediction performance difference vector formed by the difference value of each index prediction data and the actual data, and the difference vector is commonly used for the abnormality detection of the host at the current moment. Meanwhile, because the abnormal condition of the host computer has uncertainty and diversity, and the performance data under the abnormal condition of the host computer is often difficult to collect or not complete, the OCSVM algorithm is introduced in the invention, the OCSVM algorithm can train a normal detection model by using only the state difference data when the host computer normally operates, and when the host computer is abnormal, the model can detect the abnormality in real time.
Firstly, the average value of each performance index of the host is collected and calculated by using each performance index data of the host in normal operation and taking 1 hour as a unit, so that a sequence of a plurality of performance indexes of the host is obtained. Then, a sliding time window with fixed duration is selected, and a prediction model of each performance index is trained by using the LSTM. Meanwhile, predicting each index by using the trained LSTM model of each performance index, calculating the difference between the prediction result and the actual value to form a performance difference vector, training an OCSVM model by using the normal performance difference vectors, and finally performing online anomaly detection on the host by using the obtained plurality of LSTM models and OCSVM together. When the host is detected to be abnormal, the alarm notification is effectively carried out in time.
The method includes the steps that based on historical data of various performance indexes of a host, data of various indexes at the current moment are predicted through an LSTM, a difference combination of the predicted data and actual data is calculated, then an OCSVM model is trained through the historical normal difference combination, the difference combination is detected, whether various data of the current host are normal or not is finally determined, and the method can timely and effectively find abnormal conditions of the host in a cloud platform.
The method is based on the historical data of the host, utilizes the LSTM prediction model and the OCSVM abnormity detection model to detect the abnormity of the host, has the detection precision of over 98 percent, can effectively avoid a large amount of false reports and missed reports in the traditional detection mode, can be well applied to the host which undertakes different tasks, and has good applicability. The method has extremely important significance for the anomaly detection of the host in the cloud platform.
It should be understood that, although the steps in the flowchart of fig. 1 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 1 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.
In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 3. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a host anomaly detection method. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.
Those skilled in the art will appreciate that the architecture shown in fig. 3 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
according to the M predicted data values [ p ]1,p2,…,pM]And constructing a first difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the first time instant1,▽p2,…,▽pM]；
Utilizing the first difference vector [. v [1,▽p2,…,▽pM]And training the original OCSVM model to obtain the trained OCSVM model.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
and carrying out maximum and minimum normalization processing on the collected host performance index data, and carrying out subsequent operation by using the processed index data.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
and training the first N-1 data of the LSTM training sequence data of the performance index as an input sequence and the Nth data as output data, wherein the LSTM training sequence data comprises N data elements.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
wherein N is 60.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
collecting host performance index data in the third running time of the host, and respectively predicting M index type running data at the second moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1’,p2’,…,pM’]；
According to the M predicted data values [ p ]1’,p2’,…,pM’]And constructing a second difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the second time1’,▽p2’,…,▽pM’]；
(iv) vector [ # p1’,▽p2’,…,▽pM’]And inputting the trained OCSVM model for anomaly detection.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
if the output result of the trained OCSVM model is 0, indicating that the current difference value is within a reasonable range and the current running state of the host is normal; if the output result is 1, the performance index of the current host is abnormal.
In one embodiment, the processor, when executing the computer program, further performs the steps of:
if the host performance index is not abnormal within the preset time, adding normal data within the preset time into the training of the LSTM model and the OCSVM model, repeating the steps S2-S5 to obtain an updated OCSVM model, and performing online abnormality detection on the host by using the updated OCSVM model.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
In one embodiment, the computer program when executed by the processor further performs the steps of:
according to the M predicted data values [ p ]1,p2,…,pM]And constructing a first difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the first time instant1,▽p2,…,▽pM]；
By using the saidFirst difference vector [. v [. ]1,▽p2,…,▽pM]And training the original OCSVM model to obtain the trained OCSVM model.
In one embodiment, the computer program when executed by the processor further performs the steps of:
and carrying out maximum and minimum normalization processing on the collected host performance index data, and carrying out subsequent operation by using the processed index data.
In one embodiment, the computer program when executed by the processor further performs the steps of:
and training the first N-1 data of the LSTM training sequence data of the performance index as an input sequence and the Nth data as output data, wherein the LSTM training sequence data comprises N data elements.
In one embodiment, the computer program when executed by the processor further performs the steps of:
wherein N is 60.
In one embodiment, the computer program when executed by the processor further performs the steps of:
collecting host performance index data in the third running time of the host, and respectively predicting M index type running data at the second moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1’,p2’,…,pM’]；
According to the M predicted data values [ p ]1’,p2’,…,pM’]And constructing a second difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the second time1’,▽p2’,…,▽pM’]；
(iv) vector [ # p1’,▽p2’,…,▽pM’]And inputting the trained OCSVM model for anomaly detection.
In one embodiment, the computer program when executed by the processor further performs the steps of:
if the output result of the trained OCSVM model is 0, indicating that the current difference value is within a reasonable range and the current running state of the host is normal; if the output result is 1, the performance index of the current host is abnormal.
In one embodiment, the computer program when executed by the processor further performs the steps of:
if the host performance index is not abnormal within the preset time, adding normal data within the preset time into the training of the LSTM model and the OCSVM model, repeating the steps S2-S5 to obtain an updated OCSVM model, and performing online abnormality detection on the host by using the updated OCSVM model.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (10)

1. A host anomaly detection method, the method comprising:
step S1, collecting host performance index data in a first operation time of the host, and classifying according to the host performance index class;
step S2, respectively constructing M LSTM training sequence data aiming at each category index according to the host performance index data of different category indexes, wherein M is more than or equal to 2;
step S3, training an original LSTM model by using the M LSTM training sequence data to obtain M trained LSTM prediction models;
step S4, collecting host performance index data in the second running time of the host, and respectively predicting the M index type running data at the first moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1,p2,…,pM]；
Step S5, using the M predicted data values [ p ]1,p2,…,pM]Training an original OCSVM model by the actual operation values of the M index categories at the first moment to obtain a trained OCSVM model;
and step S6, continuously acquiring the running performance index data of the host, and performing online anomaly detection on the host by using the trained OCSVM model.
2. The host abnormality detection method according to claim 1, characterized in that said step S5 includes:
according to the M predicted data values [ p ]1,p2,…,pM]And the difference of the actual operation values of the M index classes at the first timeValue construction A first difference vector [. v [1,▽p2,…,▽pM]；
Utilizing the first difference vector [. v [1,▽p2,…,▽pM]And training the original OCSVM model to obtain the trained OCSVM model.
3. The host computer anomaly detection method according to claim 1, wherein the steps S1, S4 and S6 further comprise performing maximum and minimum normalization processing on the collected host computer performance index data, and performing subsequent operations by using the processed index data.
4. The host abnormality detection method according to claim 1, characterized in that said step S3 includes:
and training the first N-1 data of the LSTM training sequence data of the performance index as an input sequence and the Nth data as output data, wherein the LSTM training sequence data comprises N data elements.
5. The host anomaly detection method of claim 4, wherein N-60.
6. The host abnormality detection method according to claim 2, characterized in that said step S6 includes:
collecting host performance index data in the third running time of the host, and respectively predicting M index type running data at the second moment by using the M LSTM prediction models to obtain M predicted data values [ p ]1’,p2’,…,pM’]；
According to the M predicted data values [ p ]1’,p2’,…,pM’]And constructing a second difference vector [. v.p ] by the difference of the actual operating values of the M index categories at the second time1’,▽p2’,…,▽pM’]；
(iv) vector [ # p1’,▽p2’,…,▽pM’]And inputting the trained OCSVM model for anomaly detection.
7. The method for detecting the host computer anomaly according to claim 6, wherein if the output result of the trained OCSVM model is 0, it indicates that the current difference is within a reasonable range and the current running state of the host computer is normal; if the output result is 1, the performance index of the current host is abnormal.
8. The method as claimed in claim 7, wherein if no abnormal performance index of the host occurs within the predetermined time, the normal data within the predetermined time is added to the training of the LSTM model and the OCSVM model, and the steps S2 to S5 are repeated to obtain the updated OCSVM model, and the updated OCSVM model is used to perform online abnormal detection on the host.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1 to 8 are implemented when the computer program is executed by the processor.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 8.
CN202111231272.9A 2021-10-22 2021-10-22 Host anomaly detection method, computer device, and storage medium Pending CN114003422A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111231272.9A CN114003422A (en) 2021-10-22 2021-10-22 Host anomaly detection method, computer device, and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111231272.9A CN114003422A (en) 2021-10-22 2021-10-22 Host anomaly detection method, computer device, and storage medium

Publications (1)

Publication Number Publication Date
CN114003422A true CN114003422A (en) 2022-02-01

Family

ID=79923634

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111231272.9A Pending CN114003422A (en) 2021-10-22 2021-10-22 Host anomaly detection method, computer device, and storage medium

Country Status (1)

Country Link
CN (1) CN114003422A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11513927B1 (en) * 2022-01-25 2022-11-29 Dell Products L.P. Method and system for performing testing operations for information handling systems
CN116661954A (en) * 2023-07-21 2023-08-29 苏州浪潮智能科技有限公司 Virtual machine abnormality prediction method, device, communication equipment and storage medium

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11513927B1 (en) * 2022-01-25 2022-11-29 Dell Products L.P. Method and system for performing testing operations for information handling systems
CN116661954A (en) * 2023-07-21 2023-08-29 苏州浪潮智能科技有限公司 Virtual machine abnormality prediction method, device, communication equipment and storage medium
CN116661954B (en) * 2023-07-21 2023-11-03 苏州浪潮智能科技有限公司 Virtual machine abnormality prediction method, device, communication equipment and storage medium

Similar Documents

Publication Publication Date Title
JP7223839B2 (en) Computer-implemented methods, computer program products and systems for anomaly detection and/or predictive maintenance
Iqbal et al. Fault detection and isolation in industrial processes using deep learning approaches
Harrou et al. Statistical process monitoring using advanced data-driven and deep learning approaches: theory and practical applications
El-Midany et al. A proposed framework for control chart pattern recognition in multivariate process using artificial neural networks
CN110909822B (en) Satellite anomaly detection method based on improved Gaussian process regression model
CN111709447A (en) Power grid abnormality detection method and device, computer equipment and storage medium
CN113391622B (en) Spacecraft attitude system anomaly detection method using multivariate multistep prediction technology
JP2004531815A (en) Diagnostic system and method for predictive condition monitoring
CN114003422A (en) Host anomaly detection method, computer device, and storage medium
US8560279B2 (en) Method of determining the influence of a variable in a phenomenon
CN111340110B (en) Fault early warning method based on industrial process running state trend analysis
CN111104736B (en) Abnormal data detection method, device, medium and equipment based on time sequence
US11640328B2 (en) Predicting equipment fail mode from process trace
Jiang et al. Independent component analysis-based non-Gaussian process monitoring with preselecting optimal components and support vector data description
CN110956331A (en) Method, system and device for predicting operation state of digital factory
CN117094184B (en) Modeling method, system and medium of risk prediction model based on intranet platform
US20210080924A1 (en) Diagnosis Method and Diagnosis System for a Processing Engineering Plant and Training Method
Guo et al. A data-driven soft sensing approach using modified subspace identification with limited iterative expectation-maximization
US20200133253A1 (en) Industrial asset temporal anomaly detection with fault variable ranking
CN115496384A (en) Monitoring management method and device for industrial equipment and computer equipment
Raza et al. Application of extreme learning machine algorithm for drought forecasting
CN114358172A (en) Nuclear reactor fault classification method, apparatus, computer device, and storage medium
CN113673600A (en) Industrial signal abnormity early warning method, system, storage medium and computing equipment
Georgoulopoulos et al. A survey on hardware failure prediction of servers using machine learning and deep learning
EP4206838A1 (en) Forecasting and anomaly detection method for low density polyethylene autoclave reactor

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination