TWI808762B - Event monitoring method - Google Patents

Abstract

An event monitoring method comprises performing, by a monitoring host: training a first learning model of the monitoring host with a plurality pieces of first data and a plurality of first commands of a remote host to generate a second learning model, detecting an operating state of the remote host to generate second state data, generating a second command corresponding to the second state data by the second learning model, and outputting the second command to the remote host.

Description

Abnormal event monitoring method

The invention relates to a method for monitoring abnormal events.

With the rapid development of information technology, most enterprises will use various systems, such as cloud systems, information security systems, etc., to make their internal operations more efficient. After the system is established, it is still necessary to monitor the system to ensure that the system can operate well. Said monitoring is usually still performed by the system manufacturer's engineers. Therefore, when there is an emergency or even a risk of interrupting the operation of the system, engineers often need to go to the fire line for emergency treatment. However, if the engineer is not focused or experienced enough to deal with it properly, the system may fail again after being temporarily fixed. In addition, under normal circumstances, when the system already has problems and cannot operate normally, the engineers will judge the problem points based on the relevant abnormal records and make repairs. Under such circumstances, it often leads to an increase in the maintenance time of the system.

In view of the above, the present invention provides a method for monitoring abnormal events to meet the above requirements.

An abnormal event monitoring method according to an embodiment of the present invention includes executing with a monitoring host: training a first learning model of the monitoring host with multiple first data and multiple first commands of a remote host to generate a second learning model; using the monitoring host to detect the operation status of the remote host to generate a second data; using the second learning model to generate a corresponding second command according to the second data; and using the monitoring host to output the second command to the remote host.

To sum up, according to the abnormal event monitoring method of one or more embodiments of the present invention, the abnormal events that may occur in the remote host can be predicted in advance at the monitoring host side, and the corresponding second command can be output to the remote host, so as to reduce the probability of abnormal conditions occurring in the remote host. Moreover, it is possible to prevent the maintenance process of the remote host from being affected by human negligence and causing the maintenance process to be unsmooth. In addition, the abnormal event monitoring method according to one or more embodiments of the present invention can more automatically and accurately determine the second command applicable to the remote host. According to the abnormal event monitoring method of one or more embodiments of the present invention, the first data set and the second data set are generated by pruning and condensing the data used for training the first learning model, which can further reduce the data calculation amount of the monitoring host in the process of generating the first learning model.

The above description of the disclosure and the following description of the implementation are used to demonstrate and explain the spirit and principle of the present invention, and provide a further explanation of the patent application scope of the present invention.

The detailed features and advantages of the present invention are described in detail below in the embodiments, the content of which is sufficient to enable any skilled person to understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of the patent application and the drawings, any skilled person can easily understand the related objectives and advantages of the present invention. The following examples are to further describe the concept of the present invention in detail, but not to limit the scope of the present invention in any way.

The abnormal event monitoring method shown in the present invention can be executed by a monitoring host, which is used to monitor the operation status of a remote host, and the monitoring host and the remote host are connected by communication. For example, the remote host can be a network core switch, and the monitoring host is a computing device for monitoring the operating status of the network core switch. Or, taking cloud computing or cloud database usage as an example, the remote host is the computing device of the client using the cloud platform, and the monitoring host can be the computing device of the manufacturer that provides the cloud platform, and the monitoring host can also be a computing device installed on the client for monitoring the cloud platform. The monitoring host can be a server, a general-purpose processor, a digital signal processor (DSP), a microprocessor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) circuit, or a complex programmable logic device (CPLD). The present invention does not limit the type of the monitoring host.

Please refer to FIG. 1 . FIG. 1 is a flowchart of a method for monitoring abnormal events according to an embodiment of the present invention. As shown in FIG. 1 , the abnormal event monitoring method includes: step S1: using a plurality of first data and a plurality of first commands to train a first learning model of a monitoring host to generate a second learning model; step S3: detecting the operation status of a remote host to generate second data; step S5: using the second learning model to generate a corresponding second command according to the second data; and step S7: outputting the second command to the remote host.

In step S1, the monitoring host inputs the first data and the first command into the untrained first learning model to generate a trained second learning model, wherein the monitoring host stores the learning model, and the learning model can use K-nearest neighbors (K-Nearest Neighbors, KNN) algorithm and other algorithms.

The above-mentioned first data is the data of abnormal events in the past operation of the remote host, wherein each piece of first data is generated based on a first state data, and the first state data is all raw data (raw data) of the remote host in the past operation. Specifically, the first status data can be taken from the system log file (Syslog) of the remote host, including the original data during normal operation and the original data during abnormal operation. The monitoring host can pre-store preset values corresponding to different components, wherein the preset value is used to determine whether the operation data of any component in the first status data exceeds its corresponding default value, and the operation data exceeding its corresponding default value is used as the first data, that is, the first data can be the original data when the remote host is abnormal. Taking the remote host as a network core switch as an example, the first data can be generated according to the first state data indicating that "the CPU, memory, input/output interface and/or network interface of the network core switch have a utilization rate of more than 85% within three minutes". In one example, the first data can be generated according to the first status data indicating that “the usage rates of components such as the central processing unit, memory, input/output interface, and/or network interface of the network core switch are rising faster than their respective preset speeds.” The first status data can also include past usage data and corresponding speed changes of the components during normal and abnormal operation, and the first data can include usage rates of components whose rising speeds are higher than their respective preset speeds, and usage data and corresponding speed changes when the components are not operating normally. In one example, the first data may be generated according to the first state data indicating that "the number of packets transmitted by the network interface is higher than the preset number" in the data content. The first state data may also include the number of packets transmitted by the network interface at various time points in the past, and the first data may include the number of packets higher than the preset number. In one example, the first status data may include all past messages in the system log file, and the first data may include error messages in the system log file. In addition, the first status data may also include the addresses of network devices at past points in time of the Media Access Control Address (MAC address), etc., and the first data may include the flapping of the media access control address; the first data may be generated according to the first status data indicating "database failure of the network core switch (or any information device)" according to the content of the data, and the first status data may also include the network core switch. put interface, I/O interface) are widely used, and the first data can be the operation data of the network core switch when the database fails, the number of connections of the network core switch or the utilization rate of the network input and output interface; the first data can be generated according to the first state data of "network loop (Loop)" according to the content of the data, the first state data can also include the load of the central processing unit of the network core switch, and the first data can be the operation data and the load of the network core switch when a network loop occurs. In addition, the first information may also be a combination of data of one or more of the above events.

The first commands are commands previously input by the monitoring host to the remote host, that is, the first commands are commands for resolving or alleviating the above-mentioned first data. For example, when the operation state corresponding to the first data is that the usage rate of the elements of the network core switch increases faster than a preset speed, the first instruction may include an instruction to instruct speed reduction. In addition, the implementation of step S1 may further include training the first learning model with multiple historical warning notifications, wherein the output form of the historical warning notifications may include text, voice or virtual reality. Specifically, after training the first learning model with the first data and first instructions (or even historical warning notifications), the machine learning model of the monitoring host can be the second learning model.

After the second learning model is generated, in step S3, the monitoring host can detect the operating status of the remote host to obtain the second data of the remote host in real time or periodically, wherein the second data mentioned here can also be the same type of original data as the first status data. The difference between the second data in step S3 and the first state data is that the first state data is used to generate historical data (i.e., the first data) for training the first learning model to generate the second learning model, and the second data in step S3 is raw data indicating the current operating status of the remote host, and the second data is used to input into the second learning model, so that the second learning model can predict abnormal events that may occur in the remote host after the second learning model, and execute the output corresponding second command.

Specifically, taking the usage rate of the central processing unit of the remote host as high as 85% as an example, since the usage rate is close to 100%, it is usually only transient, but in a non-transient situation, the service of the remote host may be completely interrupted. Therefore, by using the first data generated from the first state data to train the first learning model, the trained second learning model can pre-judge whether the abnormal state will indeed occur next before the abnormal state occurs.

In step S5, the monitoring host inputs the second data into the second learning model to generate a corresponding second instruction. Since the first data used for training is obtained from the corresponding first state data, the second learning model can determine the possible imminent abnormal event on the remote host according to the second data of the remote host. Therefore, the second learning model can further judge whether an abnormal event is about to occur according to the first data and the first instruction, and use the K-nearest neighbor algorithm to generate and output a second instruction corresponding to the second data when it is judged that an abnormal event is about to occur. The second instruction generated by the second learning model can be used to alleviate or resolve abnormal events that may occur on the remote host in advance. In addition, as mentioned above, in the training phase, the data used to train the first learning model may contain multiple historical warning notifications, so in step S5, the second learning model may generate corresponding warning notifications.

In step S7, the monitoring host outputs the second instruction generated by the second learning model to the remote host. That is, after the second learning model generates an instruction corresponding to the second data, the monitoring host can transmit the second instruction to the remote host. Therefore, the remote host can modify the current operating state based on the received second command. In addition, if the second learning model generates a warning notice in step S5, the monitoring host can output a warning notice to the remote host in step S7, and the output form of the warning notice can include text, voice, or other virtual reality forms, etc., to remind users who are using the remote host to pay attention to the operating status of the remote host.

Please refer to FIG. 2 , which is a detailed flowchart of step S1 in FIG. 1 . Steps S101 , S103 , S105 , S107 and S109 in FIG. 2 illustrate the method of obtaining the first data, while steps S111 , S113 , S115 , S117 and S119 illustrate the method of obtaining the first learning model. As shown in Figure 2, step S1 may include: step S101: obtain the first event of the remote host, wherein the first event occurred at the first time point; step S103: use a plurality of first state data of the time series including the first time point as the first data set; step S105: standardize the first data set and generate a second data set, wherein the second data set includes multiple variables of the remote host in the time series; step S107: perform correlation analysis on the second data set; One or more of these variables whose correlation degree is lower than the threshold value is used to update the second data set, and the updated second data set is used as one of the first data; step S111: using one of the first data as a training sample; step S113: judging whether the observed parameters and the training sample have a trend pattern based on the regression model; : using the other of the first data as a detection sample; step S117: performing time series verification on the detection sample according to the observation parameters and the regression model to determine whether the observation parameters and the regression model pass the time series verification; if the observation parameters and the regression model do not pass the time series verification, then perform step S114; if the observation parameters and the regression model pass the time series verification, then perform step S119: use the regression model as the first learning model.

Specifically, the first event described in step S101 is an abnormal event that occurred on the remote host in the past, and the first time point is the historical time point when the first event occurred. For example, the historical abnormal event is the failure of the remote host, and the first time point is the time point of the failure of the remote host. In short, the first event is a combination of the first data and the time point when the abnormal situation indicated by the first data occurs.

In step S103, the monitoring host uses a plurality of first state data including time series of the first time point as a first data set, wherein the first state data is all data (such as fan speed, component usage, etc.) during past operation of the remote host, and the first event and the first state data may be of the same type. In other words, the monitoring host pushes back the first time point for a preset period of time as a time series, or takes the first time point as a center point and combines preset periods before and after the first time point as a time series, and generates the first data set according to the time series and the first state data of the remote host in the time series. For example, assume that the monitoring host sends a signal to the remote host to receive acknowledgment information (acknowledge, ACK) from the remote end, and the first data is that the time between sending the signal and receiving the acknowledgment information (hereinafter referred to as the response time) from the remote host is 30 seconds, which exceeds the preset 0.1 second, and the occurrence time of the first data (i.e. the first time point) is 10 am on September 2, and the preset time period is 12 hours, then the first event is the combination of the response time of 30 seconds and 10 am on September 2. The sequence is from 10:00 pm on September 1st to 10:00 am on September 2nd, and the first data set is all response times of the remote host during the period from 10:00 pm on September 1st to 10:00 am on September 2nd. Or, taking the first data as an example of a network loop, since network loops are usually caused by humans (i.e., network cables are connected incorrectly), the occurrence of network loops may not have obvious periodicity, and by only retaining the first state data for a period of time before and after the occurrence of network loops, it is possible to find out the trend pattern that indicates that an abnormal situation may occur later, and the content of the trend pattern will be explained later.

In step S105, standardizing the first data set by the monitoring host refers to grading the first state data of the first data set, and then standardizing the classified first state data. Taking the above response time as an example, assuming that the response time in the time series includes 0.1 second, 30 seconds, 50 seconds and timeout, the monitoring host can standardize by marking 0.1 second, 30 seconds, 50 seconds and timeout as the first level, second level, third level and fourth level respectively, and then converting the first level to the fourth level into 0.25 step, 0.5 step, 0.75 step and 1 step respectively. Accordingly, the monitoring host can have a more consistent standard for judging whether the operating status of the remote host is normal.

For each response time, the monitoring host further collects a plurality of variables about the response time, wherein these variables may include the temperature of the processor of the remote host, the speed of the fan of the remote host, the storage status of the memory of the remote host, etc. in addition to the response time. Specifically, when an abnormal event occurs on the remote host, it may be caused by an abnormal state such as insufficient memory capacity of the remote host or excessive temperature of the processor. Then, the monitoring host can combine the first data set with the variables to generate a second data set. In other words, in addition to the first data set (time series and the first state data), the second data set further includes time series state data of other components of the remote host.

It should be noted that the above-mentioned levels from the first level to the fourth level are just examples, and the monitoring host may also divide the first state data into more or fewer levels, and the above-mentioned levels are also just examples. In addition, the first state data can be divided into a plurality of series in an equidistant or non-equidistant manner. For example, when dividing the response time in an equidistant manner, the monitoring host can use 20 seconds as a level interval; and when dividing the first state data in a non-equidistant manner, the monitoring host can mark 0.1 seconds to 1 second as the first level, and 40 seconds to 50 seconds as the fourth level. The present invention does not limit the way of dividing the first state data.

In step S107 and step S109, the monitoring host performs correlation analysis on the second data set to remove one or more of the variables in the second data set whose correlation degree is lower than a threshold value, and uses the updated second data set as one of the first data, wherein the correlation analysis can be a cross-correlation function (CCF), such as an autocorrelation function (autocorrelation function, ACF) or a partial autocorrelation function (partial autocorrelation) relation function, ACF).

Specifically, step S107 is for judging the degree of correlation between variables in the second data set. For example, the monitoring host can determine the correlation between the processor temperature of the remote host and the response time, the correlation between the fan speed of the remote host and the response time, the storage status of the memory of the remote host and the response time, etc., so as to determine which variables are related to the response time. Next, the monitoring host can remove variables whose correlation with the response time is lower than a threshold to update the second data set, and use the updated second data set as one of the first data in the aforementioned step S1.

In the original second data set, not all variables may be related to the first event, so by performing steps S107 and S109, the data of variables with low correlation with the first event can be filtered out to prevent the first event from being diluted by other data with low correlation. According to this, the amount of data calculation performed by the monitoring host in the process of generating the first learning model can be reduced.

For example, the first event is a database failure, because when the database fails, the CPU is usually in a low water level state, and the correlation degree with the database failure is low. Therefore, in this example, the autocorrelation function (ACF) can be used for correlation analysis. In other words, if you want to analyze the correlation between different systems, equipment, devices, etc., you can use the analysis method of autocorrelation function (ACF).

In step S111 and step S113, the monitoring host uses the first data to determine whether the observed parameters and the training samples have a trend pattern based on the regression model. The regression model is, for example, an autoregressive integrated moving average (ARIMA) model, and the observation parameter can be an observation period or an observation time point, which is used to judge whether a training sample has a specific trend in each observation period or observation time point based on the autoregressive integrated moving average model, but the present invention does not limit the specific content of the observation parameters.

After obtaining the training samples, the monitoring host can input the observation parameters and training samples into the regression model to determine whether the observation parameters and training samples have a trend pattern. Assuming that the observation period of the observed parameters is one hour, and the training samples are the usage rate of the processor of the remote host or the storage capacity of the memory of the remote host, then the trend state may be that the usage rate of the processor of the remote host increases gradually every hour, or the storage capacity of the memory of the remote host reaches a critical value every hour. Or, taking the first data as an example of a network loop, when the network loop does not occur, the CPU load of the network core switch is usually at a low level. When a network loop occurs, the CPU load of the network core switch will continue to increase until it is fully loaded, thereby causing the network to be paralyzed. Since the load scale of the network is fixed, the monitoring host can determine the similar pattern of the CPU load increase caused by the network loop through the self-regressive integrated moving average (ARIMA) model, and the similar pattern of the CPU load increase is the trend pattern.

When the monitoring host determines that the observed parameters and training samples do not have a trend pattern, the monitoring host can execute step S114. The way to adjust the observation parameters is to lengthen or shorten the observation cycle of the monitoring host, and the way to differentiate the training samples is to subtract the data before and after the training samples from the monitoring host to generate a series sequence. After the monitoring host executes step S114, step S113 can be executed again to determine whether the adjusted observation parameter or the differenced training sample has a trend pattern.

When the monitoring host determines in step S113 that the observed parameters and the training samples have a trend pattern, the monitoring host executes steps S115 and S117, using the other of the first data as a test sample to judge whether the observed parameters and the regression model pass the time series test, wherein the first data as the test sample is different from the first data as the training sample. The difference between step S111 and step S115 is that the training samples selected in step S111 are used to judge whether the regression model is an appropriate model (that is, to judge whether the regression model can determine the trend pattern), while the detection samples selected in step S115 are used to judge the accuracy of the regression model.

In step S117, the monitoring host inputs the observation parameters and detection samples into the regression model, so as to perform time series verification on the detection samples according to the observation parameters and regression model, wherein the time series verification can be Box-Pierce verification. Specifically, the time series verification is to test the residual sequence or significance to judge whether the output result of the regression model based on the observed parameters and the test samples is stable (stationary), that is, when the significance is greater than the preset value (for example, p-value greater than 0.05), it means that the observed parameters and the regression model pass the time series verification.

When the monitoring host determines that the observed parameters and the regression model do not pass the time series test, the monitoring host may execute step S114 again. When the monitoring host judges that the observed parameters and the regression model pass the time series test, the monitoring host may execute step S119 to use the regression model as the first learning model for generating the second learning model.

Please refer to FIG. 3 , which is a detailed flowchart of step S5 in FIG. 1 . In FIG. 3 , step S5 of FIG. 1 may include steps S51 , S53 and S55 , wherein steps S51 , S53 and S55 are used to illustrate the method for generating the second instruction.

After obtaining the second data, the monitoring host can perform step S51: receive the system record file from the remote host, wherein the system record file includes a plurality of current status data; step S53: use the second learning model to select at least one of the status data belonging to the highest abnormal level; and step S55: use the second learning model to generate a second instruction for at least one status data belonging to the highest abnormal level.

It should be noted that when the first learning model is trained to generate the second learning model, the first information may have different severity levels, so the monitoring host can classify each piece of first information into a corresponding severity level. Taking the utilization rate of the central processing unit of the remote host as an example, if the utilization rate falls between 85% and 90%, the first data can be classified as a moderate abnormal level; and if the utilization rate falls above 90%, the first state data can be classified as the highest abnormal level. Therefore, when training the first learning model, the monitoring host can further input the abnormal level, the first command and the corresponding first data into the first learning model. For example, for the first data classified as a moderate abnormal level, the corresponding first instruction may include observing CPU utilization for another minute; and for the first data classified as the highest abnormal level, the corresponding first instruction may include directly modifying the operation of the CPU. Accordingly, the trained machine learning model (second learning model) can predict possible abnormal events and their severity according to the real-time operating status of the remote host, and generate corresponding second instructions. Then, during actual operation, the monitoring host can execute step S3 in FIG. 1 to generate the second data.

Specifically, after the monitoring host receives the current state data in the system records, the second learning model trained on the abnormal level can determine the abnormal level to which each piece of state data belongs, and generate a second instruction corresponding to the abnormal level. Then, the monitoring host can execute step S7, outputting the second command matching the abnormal level to the remote host. As mentioned above, these abnormality levels include the highest abnormality level. Assuming that the CPU utilization rate of the remote host reaches 90%, it will be judged as the highest abnormality level. Then the monitoring host can use the second learning model to select the current status data of the remote host’s CPU utilization rate reaching 90% from the system record file. If the selected current status data belongs to the highest abnormal level, the monitoring host can output the corresponding second command to the remote host to regulate the usage status of the remote host’s CPU.

In addition, in addition to the above-mentioned embodiment, after step S51, the monitoring host can also use the second learning model based on the second data, and use the K-nearest neighbor algorithm to output the trend state corresponding to the second data to the remote host, so that the user of the remote host can judge whether it is necessary to regulate the use status of the remote host according to the trend state. In short, the trend pattern corresponding to the second data indicates the degree of abnormality of the second data.

To sum up, according to the abnormal event monitoring method of one or more embodiments of the present invention, the abnormal events that may occur in the remote host can be predicted in advance at the monitoring host side, and the corresponding second command can be output to the remote host, so as to reduce the probability of abnormal conditions occurring in the remote host. Moreover, it is possible to prevent the maintenance process of the remote host from being affected by human negligence and causing the maintenance process to be unsmooth. In addition, the abnormal event monitoring method according to one or more embodiments of the present invention can more automatically and accurately determine the second command applicable to the remote host. According to the abnormal event monitoring method of one or more embodiments of the present invention, the first data set and the second data set are generated by pruning and condensing the data used for training the first learning model, which can further reduce the data calculation amount of the monitoring host in the process of generating the first learning model.

Although the present invention is disclosed by the aforementioned embodiments, they are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, all changes and modifications are within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the appended scope of patent application.

S1, S3, S5, S7: steps S101, S103, S105, S107, S109, S111, S113, S114, S115, S117, S119: steps S51, S53, S55: steps

FIG. 1 is a flowchart of a method for monitoring abnormal events according to an embodiment of the present invention. FIG. 2 is a detailed flowchart of step S1 in FIG. 1 . FIG. 3 is a detailed flowchart of step S5 in FIG. 1 .

S1, S3, S5, S7: steps

Claims (8)

A method for monitoring abnormal events, comprising: executing with a monitoring host: training a first learning model of the monitoring host with a plurality of first data and a plurality of first commands of a remote host to generate a second learning model, wherein the first data are data of abnormal events in the past operation of the remote host, and the first commands are instructions for solving or alleviating the first data; detecting the operation status of the remote host to generate a second data; using the second learning model to generate a corresponding second command according to the second data; and outputting the second command to the remote host, Wherein, training the first learning model of the monitoring host with the first data and the first instructions of the remote host includes obtaining the first data, and obtaining the first data includes: obtaining a first event of the remote host, wherein the first event occurs at a first time point; using a plurality of first state data of a time series including the first time point as a first data set; standardizing the first data set to generate a second data set, wherein the second data set includes a plurality of variables of the remote host in the time series; performing a correlation on the second data set analysis; and According to the result of the correlation analysis, one or more of the variables whose correlation is lower than a threshold value is removed to update the second data set, and the updated second data set is used as one of the first data. The abnormal event monitoring method as described in claim 1, wherein training the first learning model with the first data and the first instructions further includes: using one of the first data as a training sample; judging whether an observation parameter and the training sample have a trend pattern based on a regression model; when judging that the training sample has the trend pattern, using the other of the first data as a detection sample; performing a time series test on the test sample according to the observation parameter and the regression model; The regression model is used as the first learning model. The abnormal event monitoring method as described in claim 2, wherein when it is judged based on the regression model that the observed parameter and the training sample do not have the trend pattern, the method further includes executing with the monitoring host: adjusting the observed parameter, or performing a difference on the training sample; and using the adjusted observed parameter or the differentiated training sample to determine whether the observed parameter and the training sample have the trend pattern. The abnormal event monitoring method as described in claim item 2, wherein when it is judged that the observed parameter and the regression model fail the time series test, the method further includes executing with the monitoring host: adjusting the observed parameter, or performing a difference on the training sample; and using the adjusted observed parameter or the differentiated training sample to determine whether the observed parameter and the training sample have the trend pattern. The abnormal event monitoring method as described in claim 1, wherein using the first data and the first instructions of the remote host to train the first learning model of the monitoring host further includes: training the first learning model with a plurality of abnormal levels respectively corresponding to the first data and the first instructions, and using the second learning model to generate the corresponding second command according to the second data includes: using the second learning model to determine one of the abnormal levels to which the second data belongs; the second instruction. The abnormal event monitoring method as described in claim 5, wherein the abnormal levels include a highest abnormal level, and using the second learning model to generate the second command corresponding to the one of the abnormal levels to which the second data belongs includes: receiving a system log file from the remote host, wherein the system log file includes a plurality of pieces of status data; using the second learning model to select at least one of the status data that belongs to the highest abnormal level; The second instruction of the at least one state data belonging to the highest abnormal level is generated by the second learning model. The abnormal event monitoring method as described in claim 1, wherein using the second learning model to generate the corresponding second instruction according to the second data includes: using a K-nearest neighbor algorithm to output a trend pattern corresponding to the second data based on the second learning model. The abnormal event monitoring method as claimed in claim 1, wherein after the second learning model is used to generate the corresponding second instruction according to the second data, the method further includes: outputting a warning notification to the remote host.

Images