CN117724935B - Multi-index abnormality detection method and system for software system - Google Patents
Multi-index abnormality detection method and system for software system Download PDFInfo
- Publication number
- CN117724935B CN117724935B CN202410166028.6A CN202410166028A CN117724935B CN 117724935 B CN117724935 B CN 117724935B CN 202410166028 A CN202410166028 A CN 202410166028A CN 117724935 B CN117724935 B CN 117724935B
- Authority
- CN
- China
- Prior art keywords
- data
- index
- reconstruction
- software system
- characteristic information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 35
- 230000005856 abnormality Effects 0.000 title claims abstract description 22
- 238000012544 monitoring process Methods 0.000 claims abstract description 42
- 230000007246 mechanism Effects 0.000 claims abstract description 22
- 238000000034 method Methods 0.000 claims description 38
- 230000008569 process Effects 0.000 claims description 17
- 238000009826 distribution Methods 0.000 claims description 15
- 238000012549 training Methods 0.000 claims description 8
- 230000004927 fusion Effects 0.000 claims description 7
- 238000010606 normalization Methods 0.000 claims description 7
- 230000002159 abnormal effect Effects 0.000 claims description 6
- 238000010276 construction Methods 0.000 claims description 6
- 230000006870 function Effects 0.000 claims description 6
- 238000007781 pre-processing Methods 0.000 claims description 6
- 238000012545 processing Methods 0.000 claims description 6
- 230000004044 response Effects 0.000 claims description 6
- 238000000605 extraction Methods 0.000 claims description 4
- 230000010365 information processing Effects 0.000 abstract description 2
- 238000012423 maintenance Methods 0.000 abstract description 2
- 239000013598 vector Substances 0.000 description 15
- 239000013604 expression vector Substances 0.000 description 4
- 239000011159 matrix material Substances 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 238000004590 computer program Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000003860 storage Methods 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013499 data model Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000005111 flow chemistry technique Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention belongs to the technical field of big data information processing and intelligent operation and maintenance, and provides a multi-index abnormality detection method and system for a software system, wherein the technical scheme is as follows: collecting multidimensional monitoring index data based on a software system; then, fully capturing time characteristic information of the multidimensional monitoring index data through attention weights by using an attention mechanism; learning spatial feature information of the multi-dimensional monitoring index data by using a graph annotation network; fusing the learned time characteristic information and the spatial characteristic information, constructing a reconstruction model based on a variation Transformer, obtaining hidden variables from an encoder through residual variation, and obtaining final reconstruction data representation by using a decoder; the problem that the abnormality detection performance is poor due to insufficient consideration of time characteristic information and space characteristic information in the prior art is solved by performing an abnormality detection task based on reconstruction loss of reconstruction data and original data.
Description
Technical Field
The invention belongs to the technical field of big data information processing and intelligent operation and maintenance, and particularly relates to a multi-index abnormality detection method and system for a software system.
Background
The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.
The software system becomes an important component in daily life of people due to convenience and high efficiency, and the software system not only can provide convenient life style and intelligent experience, but also can improve working efficiency. Along with the improvement of user demands, the stability requirement of the software system is also continuously improved, so that the abnormality detection of the software system is very important.
Because the monitoring indexes are numerous in the software system and complex dependency relationship exists among the indexes, the multi-index abnormality detection of the software system is challenged. In the task of abnormality detection of a software system, it is mainly classified into abnormality detection based on a single index and abnormality detection based on multiple indexes. The single-index-based anomaly detection method cannot fully consider the dependency relationship among indexes, and alarm storm is easy to generate when a large number of indexes are used for single-index anomaly detection, so that the effect of an anomaly detection model is affected. Currently, many studies have been made based on multi-index anomaly detection. However, the monitoring index data is multi-dimensional time series data, and the data has correlation in time dimension and dependency between indexes, and part of the work does not fully consider time characteristic information and space characteristic information, resulting in poor model performance.
Disclosure of Invention
In order to solve at least one technical problem in the background art, the invention provides a method and a system for detecting multi-index anomalies of a software system, which can fully learn characteristic information among multi-dimensional indexes and effectively detect anomalies, and are of great importance to the stable operation of the software system.
In order to achieve the above purpose, the present invention adopts the following technical scheme:
The first aspect of the present invention provides a method for detecting multi-index anomalies in a software system, comprising the steps of:
Acquiring multi-dimensional index time sequence data of a software system;
Respectively learning to obtain time characteristic information and space characteristic information of the multi-dimensional monitoring index time sequence data based on the multi-dimensional index time sequence data of the software system;
Combining time characteristic information and space characteristic information of multi-dimensional monitoring index time sequence data and combining a trained multi-index data reconstruction model to obtain a reconstruction data representation; the construction process of the multi-index data reconstruction model comprises the following steps: introducing a residual structure and an attention mechanism from an encoder part in a multi-index data reconstruction model, and inputting hidden variables obtained through the residual structure and the attention mechanism learning into a decoder to obtain a reconstruction data representation;
and comparing the reconstruction error with a set threshold value to obtain an abnormality detection result of the multi-index data.
Further, the multi-dimensional index time sequence data of the software system comprises system response time, CPU utilization rate, memory utilization rate, throughput, number of queries processed per second by the system, number of transactions processed per second by the system, error rate and network throughput.
Further, after the multi-dimensional index time sequence data of the software system is obtained, the data is preprocessed, which comprises the following steps: and carrying out normalization processing on the data and dividing the index data by adopting a time window.
Further, based on the multi-dimensional index time sequence data of the software system, learning to obtain the spatial feature information of the multi-dimensional index time sequence data comprises the following steps:
Calculating the dependency relationship among the multidimensional indexes;
Based on the dependency relationship among the multidimensional indexes, each index is taken as a node, and a relationship directed graph among the multidimensional indexes is constructed;
and inputting the relation directed graph among the multidimensional indexes and the characteristic representation of each index into a graph annotation force network, and continuously updating the characteristic representation of the current index through the characteristic information of the adjacent indexes to obtain spatial characteristic information.
Further, the posterior distribution of the residual structure is:
，
，
In the method, in the process of the invention, And/>Are respectively at/>Fusion feature representation and hidden variable of moment,/>Represent the mean value/>Representing the sum of the outputs of each layer of encoders,/>Represents variance and satisfies/>，/>Representing noise data sampled from a standard normal distribution.
Further, when the multi-index data reconstruction model is trained, normal data is used for model training, a loss function in the model training mainly comprises reconstruction errors and information divergences, wherein the reconstruction errors are errors between the reconstruction data and original data passing through a decoder, and the information divergences are KL divergences of posterior distribution and standard normal distribution in a hidden space.
Further, the comparing the combination reconstruction error with the set threshold value to obtain an abnormality detection result of the multi-index data includes:
Setting the upper threshold of the reconstruction error, wherein the characteristic difference between the fault data and the normal data is larger, and the reconstruction error of the fault point is increased; and judging whether the reconstruction error exceeds the upper limit of the set threshold value, and if the reconstruction error exceeds the set threshold value, judging that the corresponding index data is fault data and is abnormal.
The second aspect of the present invention provides a method for detecting multi-index anomalies in a software system, including:
The data acquisition module is used for acquiring multi-dimensional index time sequence data of the software system;
The feature extraction module is used for respectively learning and obtaining time feature information and space feature information of the multi-dimensional monitoring index time sequence data based on the multi-dimensional index time sequence data of the software system;
The data reconstruction module is used for combining time characteristic information and space characteristic information of the multi-dimensional monitoring index time sequence data and combining a trained multi-index data reconstruction model to obtain a reconstruction data representation; the construction process of the multi-index data reconstruction model comprises the following steps: introducing a residual structure and an attention mechanism from an encoder part in a multi-index data reconstruction model, and inputting hidden variables obtained through the residual structure and the attention mechanism learning into a decoder to obtain a reconstruction data representation;
And the abnormality detection module is used for comparing the reconstruction error with a set threshold value to obtain an abnormality detection result of the multi-index data.
Further, in the data acquisition module, the multi-dimensional index time sequence data of the software system comprises system response time, CPU utilization rate, memory utilization rate, throughput, number of times of inquiry processed by the system per second, number of transactions processed by the system per second, error rate and network throughput.
Further, the system also comprises a data preprocessing module, which is used for carrying out normalization processing on the data and dividing the index data by adopting a time window.
Compared with the prior art, the invention has the beneficial effects that:
1. the method fully considers the influence between the time sequence and the characteristics of the monitoring indexes, collects and processes the multidimensional monitoring indexes of the software system, introduces an attention mechanism to learn the time characteristic information of the monitoring indexes, and fully learns the space characteristic information among the multidimensional monitoring indexes based on the graph attention mechanism.
2. The invention provides a multi-index anomaly detection model of a software system, which fully learns characteristic information of monitoring index data through a residual variation self-encoder to generate hidden variables, introduces an attention mechanism into a self-encoder module, considers time sequence information of the characteristics, prevents information loss of the model through a residual structure of the self-encoder, and improves accuracy of the model.
Additional aspects of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention.
FIG. 1 is an overall flowchart of a multi-index anomaly detection method provided by an embodiment of the present invention;
FIG. 2 is a data flow processing diagram of a multi-index anomaly detection method according to an embodiment of the present invention;
Fig. 3 is a schematic structural diagram of a multi-index anomaly detection system according to an embodiment of the present invention.
Detailed Description
The invention will be further described with reference to the drawings and examples.
It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the invention. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the present invention. As used herein, the singular is also intended to include the plural unless the context clearly indicates otherwise, and furthermore, it is to be understood that the terms "comprises" and/or "comprising" when used in this specification are taken to specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof.
Example 1
As shown in fig. 1, the embodiment provides a method for detecting multi-index anomalies of a software system, which includes the following steps:
step 1: acquiring and processing multi-dimensional index time sequence data of a software system;
In this embodiment, the collection of the multidimensional monitoring index sequence data of the software system collects multidimensional monitoring index information in the running process of the system by means of a monitoring tool (Prometheus, skywalking, etc.), and performs data preprocessing on the multidimensional monitoring index data, including data cleaning, missing data complement, data definition and storage.
Of course, in other embodiments, the monitoring tool is not limited to the examples given above.
Likewise, in some embodiments, the monitoring index data may be obtained from other sources.
In this embodiment, the multi-dimensional index time series data of the software system includes, but is not limited to, system response time, CPU utilization, memory usage, throughput, number of queries processed per second by the system, number of transactions processed per second by the system, error rate, network throughput, etc.
Step 2: preprocessing multi-dimensional index time sequence data of a software system to obtain characteristic expression vectors of multi-dimensional monitoring index data;
in the step 2, preprocessing the multi-dimensional index time sequence data of the software system specifically includes:
Wherein, because of different dimensions and dimension units among the data indexes, the subsequent data analysis and model training can be influenced. Therefore, in order to unify the dimension influence among the multidimensional monitoring index data, the robustness of the model is improved, and the multidimensional index data is subjected to data normalization processing by applying a min-max normalization method, so that the monitoring index data is in the value range of [0,1 ]:
，
Wherein, Representing the minimum value of a certain index dataIndicating that the maximum value of a certain index data is taken. To prevent the denominator from being zero, add/>Is a very small constant.
At the position ofSetting the time window length at time/>And dividing the monitoring index data.
Each multi-dimensional index data containsSuccessive index data:
，
Wherein, For/>Set of data for time of day,/>To monitor the dimensionality of the index data.
Step 3: based on the feature representation vector, a soft attention mechanism (Soft Attention Mechanism) is introduced to fully learn the time feature information of the multidimensional monitoring index, so as to generate a time feature learning vector.
In this embodiment, other indicators are weighted by the attention mechanism under the current time windowPair/>Is the degree of influence of (a):
，
，
，
Wherein, And/>Is a weight parameter matrix,/>Representation/>And other indicators/>Is used for the concentration weight of the person,And/>For deviation,/>Is the k vector under the z time window.
Order theAnd (3) using a v vector weighted sum and adding the original information to finally obtain a time feature learning vector:
，
。
Step 4: based on the feature expression vector, carrying out relevance among multidimensional monitoring indexes by utilizing a dynamic graph attention network model to obtain a spatial feature learning vector;
In the step 4, the performing the association between the multidimensional monitoring indexes by using the dynamic graph attention network model based on the feature expression vector includes:
step 401: based on the dependency relationship among the multidimensional monitoring indexes, each index is taken as a node, and a relationship directed graph among the monitoring indexes is constructed;
in order to obtain the relation between indexes, the characteristic expression vector is converted into a dimension by a one-dimensional linear layer Is defined as the initial feature vector/>Learning embedded representations in data through feature embedding layers. The association relation between indexes is measured by adopting cosine similarity, and the relation distance expression formula is as follows:
，
In the method, in the process of the invention, For the association relation between multidimensional monitoring indexes,/>And/>Variable/>, respectivelyAnd variable/>Is embedded in the representation.
Step 402: using adjacency matrix to represent a directed graph of relationships between monitored metrics in conjunction with relationship distance between each pair of metricsWherein/>Representing nodes, i.e. monitoring indicators,/>The association relationship between the indexes is shown as a directed edge in the figure. Directed graph/>And a characteristic representation of each monitoring indicator/>Input to the schematic force network.
Step 403: updating the characteristic representation of the current monitoring index through the information of other adjacent monitoring indexes:
，
Wherein, Representing a weight matrix,/>To monitor index/>, after updateIs represented by eigenvectors of/>To monitor index/>For monitoring index/>The detailed attention score calculation formula is:
，
Wherein, after passing through Use after activation of function/>Operate and use the weight matrix/>, after stitchingLinear transformation is carried out, finally the process is carried outAn attention score is obtained.
Step 5: based on the time feature learning vector obtained by the learning in the step 3 and the space learning feature vector obtained by the learning in the step 4, a feature fusion module is introduced to splice the time feature learning vector and the space learning feature vector to obtain a final fusion feature representation vectorThe specific calculation mode is as follows:
in the above, the ratio of/> Representation layer normalization,/>Time representation vector obtained by representing time feature learning,/>Representing the spatial representation vector resulting from the spatial feature learning.
Step 6: based on the fusion characteristic information obtained in the step 5, performing characteristic learning based on a trained multi-index data reconstruction model based on a variation transducer to obtain a reconstruction data representation;
in step 6, the construction process of the multi-index data reconstruction model includes:
The feature information is fused, a multi-index data reconstruction model based on a variation Transformer is constructed, feature learning is carried out, and the obtained reconstruction data representation comprises the following steps:
firstly, performing feature learning based on a transducer module, fully learning time information based on an attention mechanism, and introducing a residual structure to enable a model to learn more robust feature representation to obtain hidden variable representation;
In order to prevent information loss in the model learning process, a residual structure is introduced into a multi-index data reconstruction model from an encoder part, a time attention mechanism is introduced and combined with a transducer, so that the encoder information is prevented from being excessively leaked into a decoder, the model is enabled to learn more robust characteristic representation, the encoder can fully learn the characteristic information in a monitoring index, and the posterior distribution of the residual structure is as follows:
，
，
In the method, in the process of the invention, And/>Are respectively at/>Fusion feature representation and hidden variable of moment,/>Represent the mean value/>Representing the sum of the outputs of each layer of encoders,/>Represents variance and satisfies/>，/>Representing noise data sampled from a standard normal distribution, the addition of the noise can effectively ensure the generation capability of the model.
Attention mechanisms are then added to the residual variation self-encoder in order to further enhance the feature extraction capabilities of the model. The vector obtained after the conversion is input to an attention mechanism module, the score of input data at each moment is calculated through an MLP network, then the weight of each moment is calculated based on the score through a Softmax function, and finally weight information is added to the input data to obtain attention data:
，
The network structure combining the transducer and the attention mechanism is adopted in the self-coding structure, so that the model can learn the distribution condition of the data in the hidden space better.
Finally, the final reconstruction data representation is obtained by adjusting the output data size of the model by using a convolution layer and a full connection layer。
In this embodiment, when the multi-index data reconstruction model is trained, normal data is used to perform model training, and the loss function of the variation self-encoder model mainly includes two parts, namely a reconstruction error and an information divergence.
The reconstruction error is the error between the reconstruction data and the original data passing through the decoder, and the information divergence is the KL divergence of posterior distribution and standard normal distribution in the hidden space. The specific calculation method of the loss function is as follows:
，
，
，
In the method, in the process of the invention, And/>Respectively expressed at/>Time of day raw data and reconstructed data,/>And/>Respectively expressed in time/>Mean and variance at.
In the training process of the model, normal data is used for model training, the model can learn the characteristics of the normal data, and the data is reconstructed according to the learned characteristics.
Step 7: and obtaining an abnormal detection result based on the reconstruction error and the set threshold value analysis.
In order to detect abnormality of the monitor index, an upper threshold of the reconstruction error is set. Since the feature difference between the fault data and the normal data is large, the reconstruction error of the fault point is increased. In order to determine whether the error is abnormal, it is determined whether the reconstruction error exceeds the upper limit of the middle set threshold, and if the reconstruction error exceeds the set threshold, the error is determined to be abnormal.
The method comprises the steps of performing anomaly detection on monitored index data to be tested, comparing the result with actual conditions, and taking accuracy (Precision), recall rate (Recall) and F1 score (F1-score) of the method and the existing method as evaluation indexes, wherein the comparison result is shown in Table 1:
Table 1 performance comparison of index anomaly detection
Through test verification, the accuracy, recall rate and F1 of the method are all larger than those of the existing method.
Example two
As shown in fig. 3, the present embodiment provides a system for detecting multi-index anomalies in a software system, including:
The data acquisition module is used for acquiring multi-dimensional index time sequence data of the software system;
The feature extraction module is used for respectively learning and obtaining time feature information and space feature information of the multi-dimensional monitoring index time sequence data based on the multi-dimensional index time sequence data of the software system;
The data reconstruction module is used for combining time characteristic information and space characteristic information of the multi-dimensional monitoring index time sequence data and combining a trained multi-index data reconstruction model to obtain a reconstruction data representation; the construction process of the multi-index data reconstruction model comprises the following steps: introducing a residual structure and an attention mechanism from an encoder part in a multi-index data reconstruction model, and inputting hidden variables obtained through the residual structure and the attention mechanism learning into a decoder to obtain a reconstruction data representation;
And the abnormality detection module is used for comparing the reconstruction error with a set threshold value to obtain an abnormality detection result of the multi-index data.
The multi-dimensional index time sequence data of the software system comprises system response time, CPU utilization rate, memory utilization rate, throughput, query number processed by the system per second, transaction number processed by the system per second, error rate and network throughput.
The system also comprises a data preprocessing module, which is used for carrying out normalization processing on the data and dividing the index data by adopting a time window.
Example III
The present embodiment provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of a software system multi-index anomaly detection method as described above.
Example IV
The embodiment provides a computer device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the steps in the multi-index abnormality detection method of the software system when executing the program.
The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (9)
1. A multi-index abnormality detection method of a software system is characterized by comprising the following steps:
Acquiring multi-dimensional index time sequence data of a software system;
Respectively learning to obtain time characteristic information and space characteristic information of the multi-dimensional monitoring index time sequence data based on the multi-dimensional index time sequence data of the software system;
Combining time characteristic information and space characteristic information of multi-dimensional monitoring index time sequence data and combining a trained multi-index data reconstruction model to obtain a reconstruction data representation; the construction process of the multi-index data reconstruction model comprises the following steps: introducing a residual structure and an attention mechanism from an encoder part in a multi-index data reconstruction model, and inputting hidden variables obtained through the residual structure and the attention mechanism learning into a decoder to obtain a reconstruction data representation;
comparing the reconstruction error with a set threshold value to obtain an abnormal detection result of the multi-index data;
the posterior distribution of the residual structure is:
，
，
In the method, in the process of the invention, And/>Are respectively at/>Fusion feature representation and hidden variable of moment,/>Represent the mean value/>Representing the sum of the outputs of each layer of encoders,/>Represents variance and satisfies/>，/>Representing noise data sampled from a standard normal distribution.
2. The method for detecting multi-index anomalies in a software system according to claim 1, wherein the multi-dimensional index timing data of the software system includes system response time, CPU utilization, memory usage, throughput, number of queries processed per second by the system, number of transactions processed per second by the system, error rate, and network throughput.
3. The method for detecting multi-index anomalies in a software system according to claim 1, wherein after multi-dimensional index time series data of the software system is acquired, the data is preprocessed, comprising: and carrying out normalization processing on the data and dividing the index data by adopting a time window.
4. The method for detecting multi-index anomalies in a software system according to claim 1, wherein learning spatial feature information of multi-index time series data based on the multi-index time series data of the software system includes:
Calculating the dependency relationship among the multidimensional indexes;
Based on the dependency relationship among the multidimensional indexes, each index is taken as a node, and a relationship directed graph among the multidimensional indexes is constructed;
and inputting the relation directed graph among the multidimensional indexes and the characteristic representation of each index into a graph annotation force network, and continuously updating the characteristic representation of the current index through the characteristic information of the adjacent indexes to obtain spatial characteristic information.
5. The method for detecting multi-index anomalies in a software system according to claim 1, wherein when the multi-index data reconstruction model is trained, normal data is used for model training, and a loss function in the model training mainly comprises reconstruction errors and information divergences, wherein the reconstruction errors are errors between the reconstructed data and original data passing through a decoder, and the information divergences are KL divergences of posterior distribution and standard normal distribution in a hidden space.
6. The method for detecting multi-index anomalies in a software system according to claim 1, wherein said combining the reconstruction errors with a set threshold value to obtain anomalies in the multi-index data includes:
Setting the upper threshold of the reconstruction error, wherein the characteristic difference between the fault data and the normal data is larger, and the reconstruction error of the fault point is increased; and judging whether the reconstruction error exceeds the upper limit of the set threshold value, and if the reconstruction error exceeds the set threshold value, judging that the corresponding index data is fault data and is abnormal.
7. A software system multi-index anomaly detection system, comprising:
The data acquisition module is used for acquiring multi-dimensional index time sequence data of the software system;
The feature extraction module is used for respectively learning and obtaining time feature information and space feature information of the multi-dimensional monitoring index time sequence data based on the multi-dimensional index time sequence data of the software system;
The data reconstruction module is used for combining time characteristic information and space characteristic information of the multi-dimensional monitoring index time sequence data and combining a trained multi-index data reconstruction model to obtain a reconstruction data representation; the construction process of the multi-index data reconstruction model comprises the following steps: introducing a residual structure and an attention mechanism from an encoder part in a multi-index data reconstruction model, and inputting hidden variables obtained through the residual structure and the attention mechanism learning into a decoder to obtain a reconstruction data representation;
the abnormality detection module is used for obtaining an abnormality detection result of the multi-index data by combining the reconstruction error with a set threshold value;
the posterior distribution of the residual structure is:
，
，
In the method, in the process of the invention, And/>Are respectively at/>Fusion feature representation and hidden variable of moment,/>Represent the mean value/>Representing the sum of the outputs of each layer of encoders,/>Represents variance and satisfies/>，/>Representing noise data sampled from a standard normal distribution.
8. The system of claim 7, wherein the multi-index timing data of the software system comprises system response time, CPU utilization, memory usage, throughput, number of queries processed per second by the system, number of transactions processed per second by the system, error rate, and network throughput.
9. The system of claim 7, further comprising a data preprocessing module for normalizing the data and dividing the index data using a time window.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410166028.6A CN117724935B (en) | 2024-02-06 | 2024-02-06 | Multi-index abnormality detection method and system for software system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410166028.6A CN117724935B (en) | 2024-02-06 | 2024-02-06 | Multi-index abnormality detection method and system for software system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117724935A CN117724935A (en) | 2024-03-19 |
| CN117724935B true CN117724935B (en) | 2024-06-07 |
Family
ID=90209156
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410166028.6A Active CN117724935B (en) | 2024-02-06 | 2024-02-06 | Multi-index abnormality detection method and system for software system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117724935B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118550757B (en) * | 2024-07-30 | 2024-10-15 | 安徽思高智能科技有限公司 | Missing data-oriented micro-service system root cause positioning method, medium and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022141871A1 (en) * | 2020-12-31 | 2022-07-07 | 平安科技（深圳）有限公司 | Time sequence data anomaly detection method, apparatus and device, and storage medium |
| CN115618296A (en) * | 2022-10-26 | 2023-01-17 | 河海大学 | Dam monitoring time sequence data anomaly detection method based on graph attention network |
| WO2023015843A1 (en) * | 2021-08-13 | 2023-02-16 | 上海商汤智能科技有限公司 | Anomaly detection method and apparatus, electronic device, computer readable storage medium, computer program, and computer program product |
| CN116069606A (en) * | 2023-01-10 | 2023-05-05 | 山东大学 | Software system performance fault prediction method and system |
| CN116361635A (en) * | 2023-06-02 | 2023-06-30 | 中国科学院成都文献情报中心 | Multidimensional time sequence data anomaly detection method |
| CN116611013A (en) * | 2023-04-14 | 2023-08-18 | 西安电子科技大学青岛计算技术研究院 | Anomaly detection and root cause analysis method and system for industrial time series data |
| CN117407816A (en) * | 2023-10-20 | 2024-01-16 | 吉林大学 | Multi-element time sequence anomaly detection method based on contrast learning |
-
2024
- 2024-02-06 CN CN202410166028.6A patent/CN117724935B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022141871A1 (en) * | 2020-12-31 | 2022-07-07 | 平安科技（深圳）有限公司 | Time sequence data anomaly detection method, apparatus and device, and storage medium |
| WO2023015843A1 (en) * | 2021-08-13 | 2023-02-16 | 上海商汤智能科技有限公司 | Anomaly detection method and apparatus, electronic device, computer readable storage medium, computer program, and computer program product |
| CN115618296A (en) * | 2022-10-26 | 2023-01-17 | 河海大学 | Dam monitoring time sequence data anomaly detection method based on graph attention network |
| CN116069606A (en) * | 2023-01-10 | 2023-05-05 | 山东大学 | Software system performance fault prediction method and system |
| CN116611013A (en) * | 2023-04-14 | 2023-08-18 | 西安电子科技大学青岛计算技术研究院 | Anomaly detection and root cause analysis method and system for industrial time series data |
| CN116361635A (en) * | 2023-06-02 | 2023-06-30 | 中国科学院成都文献情报中心 | Multidimensional time sequence data anomaly detection method |
| CN117407816A (en) * | 2023-10-20 | 2024-01-16 | 吉林大学 | Multi-element time sequence anomaly detection method based on contrast learning |
Non-Patent Citations (2)
| Title |
|---|
| Health Insurance Anomaly Detection Based on Dynamic Heterogeneous Information Network;Bei Zhao;《IEEE》;20200206;全文 * |
| 基于CNN-BiLSTM特征融合的异常检测算法;王晨辉;《计算机应用与软件》;20221231;第272-277页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117724935A (en) | 2024-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN117724935B (en) | Multi-index abnormality detection method and system for software system | |
| CN110570030A (en) | Wind power cluster power interval prediction method and system based on deep learning | |
| CN107133632A (en) | A kind of wind power equipment fault diagnosis method and system | |
| CN113919540B (en) | Method for monitoring operation state of production process and related equipment | |
| CN110879377A (en) | Metering device fault tracing method based on deep belief network | |
| CN116662771A (en) | Method and system for self-adaptive PCA error quantitative evaluation of capacitive voltage transformer | |
| CN116108371A (en) | Cloud service abnormity diagnosis method and system based on cascade abnormity generation network | |
| CN118174788A (en) | Fault detection method, device and equipment of optical fiber wiring cabinet and storage medium | |
| CN113611568A (en) | Vacuum circuit breaker based on genetic convolution depth network | |
| CN116259161B (en) | Power failure early warning system | |
| CN111475548A (en) | Power utilization abnormity analysis decision system based on big data mining technology | |
| CN116821828A (en) | Multi-dimensional time sequence prediction method based on industrial data | |
| CN114611606B (en) | Fault detection method based on nuclear hybrid space projection | |
| CN114046816B (en) | Sensor signal fault diagnosis method based on lightweight gradient lifting decision tree | |
| CN116151656A (en) | Power distribution network weakness evaluation method based on large-dimension matrix spectrum analysis | |
| CN114386311A (en) | Operation and maintenance abnormal data enhancement method and equipment based on key performance indexes | |
| Lin | Network intrusion detection based of semi-supervised ensemble learning algorithm for imbalanced data | |
| Chen et al. | A data mining method for extracting key factors of distribution network reliability | |
| CN117407824B (en) | Health detection method, equipment and medium of power time synchronization device | |
| Bhattacharyya et al. | Adaptive, online models to detect and estimate gross error in SPNDs | |
| CN118517383B (en) | Deep learning-based intelligent detection method and equipment for running risk of wind turbine generator | |
| CN118094259B (en) | Gas pipeline failure risk prediction method and system based on data analysis | |
| Zhu et al. | Research of system fault diagnosis method based on imbalanced data | |
| CN115556099B (en) | Sustainable learning industrial robot fault diagnosis system and method | |
| CN118465292B (en) | Periodic self-checking method and system for equipment dyeing stability |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |