WO2018077152A1 - 一种主机变量异常检测方法及系统 - Google Patents

一种主机变量异常检测方法及系统 Download PDF

Info

Publication number
WO2018077152A1
WO2018077152A1 PCT/CN2017/107407 CN2017107407W WO2018077152A1 WO 2018077152 A1 WO2018077152 A1 WO 2018077152A1 CN 2017107407 W CN2017107407 W CN 2017107407W WO 2018077152 A1 WO2018077152 A1 WO 2018077152A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule set
association rule
host
variable
similarity
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/107407
Other languages
English (en)
French (fr)
Inventor
马平清
王巍
韩智东
廉宜果
戴月
朱雅蓉
李昂
朱伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Publication of WO2018077152A1 publication Critical patent/WO2018077152A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751—Error or fault detection not based on redundancy
    • G06F11/0754—Error or fault detection not based on redundancy by exceeding limits
    • G06F11/076—Error or fault detection not based on redundancy by exceeding limits by exceeding a count or rate limit, e.g. word- or bit count limit

Definitions

  • the present invention relates to a data anomaly detection technique, and in particular to a host variable anomaly detection method and system.
  • Association rule mining refers to finding all the rules whose support degree is greater than or equal to min-sup and the confidence is greater than or equal to min-conf.
  • Min-sup and min-conf are the corresponding support and confidence thresholds.
  • association rule mining can find interesting relationships between different attributes in massive data, it has a wide range of applications.
  • a fuzzy weighted association rule mining method is proposed, which combines fuzzy sets, Apriori data mining algorithms and time series analysis to mine alarm association rules. And it is applied to large-scale industrial production, effectively suppressing the flood of industrial alarms.
  • Some literatures use association rules and Markov model ideas to mine IP positioning data sets to improve the accuracy and coverage of IP positioning.
  • Some papers use Apriori algorithm to explore the credit risk contagion between listed companies, apply it to the risk assessment of listed companies, and find that the credit risk contagion between listed companies with strong association rules is obvious, and provide decision support for listed company risk control.
  • the accuracy rate is low, and the missed detection rate is high.
  • the main purpose of the embodiments of the present invention is to provide a host variable anomaly detection method and system, which can cope with a variety of different anomaly detection requirements and improve the accuracy of anomaly detection.
  • an embodiment of the present invention provides a host variable anomaly detection method, where the host variable anomaly detection method includes: calculating a plurality of hosts to be detected by using an association rule algorithm according to a data window of a first preset time length a first association rule set between variables; sliding the data window backward according to a second preset time, and calculating an interval between the variables in the data window after sliding backward according to a preset time by an association rule algorithm a second association rule set; comparing each rule in the second association rule set with each rule in the first association rule set, and calculating a similarity between the first association rule set and the second association rule set And comparing the similarity with the minimum similarity of the rule set to determine whether an abnormality occurs in the variable of the host to be detected.
  • the embodiment of the present invention further provides a host variable abnormality detecting system, where the host variable abnormality detecting system includes: a first association rule set computing unit, configured to use an association rule algorithm according to a data window of a first preset time length, Calculating a first association rule set between the plurality of variables of the host to be detected; the second association rule set calculation unit is configured to slide the data window backward according to the second preset time, and calculate according to the preset rule algorithm a second association rule set between the variables in the data window after the time is swept backward; a similarity calculation unit, configured to separately use each rule in the second association rule set and the first association rule set Performing an alignment on each rule, calculating a similarity between the first association rule set and the second association rule set; the abnormal situation determination unit is configured to compare the similarity with the rule set minimum similarity, and determine the to-be-determined Check if the host's variables are abnormal.
  • a first association rule set computing unit configured to use an association rule algorithm according to a data window of a first
  • the embodiment of the invention further provides a computer device comprising a memory, a processor and a computer program stored on the memory and operable on the processor, the processor implementing the method when the computer program is executed.
  • the embodiment of the invention further provides a computer readable storage medium storing a computer program for performing the above method.
  • the beneficial effects of the embodiments of the present invention are that the sliding window technology and the association rule algorithm can be combined to determine a rule set between multiple variables of the host to be detected, and the similarity of the data before and after sliding through the sliding window is used to determine the to-be-detected. Whether the host variable is abnormal or not, compared with the existing anomaly detection technology, the coverage and accuracy of the anomaly detection can be improved, and the method is universal and can be applied to various data anomaly detection occasions.
  • FIG. 1 is a flowchart of a host variable anomaly detecting method according to an embodiment of the present invention
  • FIGS. 2A-2B are schematic structural diagrams of a host variable abnormality detecting system according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a similarity calculation unit according to an embodiment of the present invention.
  • Embodiments of the present invention provide a host variable abnormality detecting method and system. The invention will be described in detail below with reference to the accompanying drawings.
  • An embodiment of the present invention provides a host variable abnormality detecting method. As shown in FIG. 1 , the host variable abnormality detecting method mainly includes the following steps:
  • Step S101 Calculate a first association rule set between multiple variables of the host to be detected by using an association rule algorithm according to a data window of a first preset time length;
  • Step S102 sliding the data window backward according to the second preset time, and calculating, by using the association rule algorithm, a second association rule set between the variables in the data window sliding backward according to the preset time;
  • Step S103 Comparing each rule in the second association rule set with each rule in the first association rule set, and calculating a similarity between the first association rule set and the second association rule set;
  • Step S104 Compare the similarity with the minimum similarity of the rule set to determine whether an abnormality occurs in the variable of the host to be detected.
  • the host variable abnormality detecting method in the embodiment of the present invention combines the sliding window technology and the association rule algorithm to determine a rule set between a plurality of variables of the host to be detected, and through a sliding window.
  • the similarity of the data before and after the sliding is used to determine whether the variable of the host to be detected is abnormal.
  • the coverage and accuracy of the anomaly detection can be improved, and the method is universal and can be applied to A variety of data anomaly detection occasions.
  • the host variable anomaly detection method in the embodiment of the present invention is further described below in conjunction with specific embodiments.
  • step S101 according to the data window of the first preset time length, the first association rule set between the plurality of variables of the host to be detected is calculated by the association rule algorithm.
  • the host to be detected may contain multiple variables, as shown in Table 1 below.
  • two variables of a host in the above table are selected, and according to a data window of a first preset time length (for example, one day), an association rule algorithm is used to calculate between two variables of the host to be detected.
  • the first association rule set R1 is as shown in Table 2 below.
  • the pre-rule, the post-rule, the sub-rule of the rule, the sub-rule of the rule, the minimum support of the rule, and the minimum confidence of the rule are all given in the form of parameters, which is convenient for the adjustment of the later data verification.
  • the given example is a process of calculating an association rule for two variables in the host.
  • the Apriori algorithm is selected as the association rule algorithm described above, but the present invention is not limited thereto, and different association rule algorithms may be selected according to actual conditions.
  • frontItem represents the pre-item of the rule
  • behindItem represents the post-item
  • Support represents support
  • Confidence represents confidence
  • the Apriori algorithm described above is one of the most influential Boolean association rules algorithms. Therefore, the basic idea of the Apriori algorithm based on the above tasks is to first find out all the frequent itemsets, and the selected item sets need to meet the preset maximum. Small support. The found frequent itemsets are then used to generate strong association rules, where the generated rules must satisfy the minimum confidence.
  • step S102 the data window is backwardly swept according to the second preset time, and the second association rule set between the variables in the data window after sliding backward according to the preset time is calculated by the association rule algorithm.
  • the sliding window technology is combined with the association rule algorithm.
  • the first association rule set described above is the rule for obtaining the data of the above two variables in one day (from 00:00 to 00:00). set.
  • a preset time for example, 5 minutes
  • the data of the above two variables in the day 00:05 to the next day 00:05 is obtained, and the second is calculated by the Apriori algorithm.
  • each rule in the second association rule set is compared with each rule in the first association rule set, and the similarity between the first association rule set and the second association rule set is calculated.
  • each rule in the second association rule set R2 is compared with each rule in the first association rule set R1 by using a rule set comparison algorithm.
  • the comparison content is: the rule pre-item, the rule post-item, the rule minimum support degree, and the rule minimum confidence.
  • the comparison method is: when the rule support degree and the rule confidence degree are compared, the deviation can be set, that is, the second association rule A rule in the set R2 is the same as the before and after terms of a rule in the first association rule set R1.
  • the two rules are the same. Then, the number S(Sum) of the same rule in the first association rule set R1 and the second association rule set R1 is statistically determined.
  • the similarity between the first association rule set and the second association rule set is calculated according to the total number of the first association rule set rules and the number of the same rules.
  • the similarity S of the first association rule set R1 and the second association rule set R2 is calculated in combination with the total number R1 (Sum) of the rules in the first association rule set R1.
  • the sliding window is moved backwards every 5 minutes as a preset time, thereby acquiring the second association rule set R2.
  • step S104 the calculated similarity S of the first association rule set R1 and the second association rule set R2 is compared with the minimum similarity of the rule set, and it is determined whether the variable of the host to be detected is abnormal.
  • the historical data is used to verify and adjust the relevant parameters to obtain the minimum similarity S(Min) of different rule sets. For example, when observing historical data, when there are no faults and events in the actual production environment, the corresponding S(Dif) is 0.006, C(Dif) is 0.03, and S(Min) is 85%.
  • variables mentioned above are also only an example description.
  • a plurality of variables may be included in the host, and abnormality detection may be performed between different variables, and the host variable abnormality detection may be performed by using the embodiment of the present invention.
  • the above process of the method is implemented, and details are not described herein again.
  • the above is the main process of the abnormality detection method of the host variable abnormality detecting method in the embodiment of the present invention.
  • the fusion association analysis and the sliding window technology are used, and in actual application, according to the verification result, the corresponding adjustment is performed.
  • the parameters are used to obtain the similarity between different sliding window rule sets, and then compared with the minimum similarity to determine the abnormal condition of the variable. It can effectively improve the accuracy of abnormal detection and detection coverage, and reduce the rate of false negative detection.
  • the host variable abnormality detecting method of the embodiment of the present invention may further include the following steps: when determining that an abnormality occurs in a variable of the host to be detected, replacing the data with the data of the variable in the previous data window. The data of the variable in the data window after the preset time is swept backward.
  • the rule set similarity of the current window period is formed by comparing the latest window period rule set with the rule set of the previous window period.
  • the host variable anomaly detection method based on the embodiment of the present invention performs actual testing in the actual application process, and compares with the abnormality detection result of the traditional data center.
  • the specific test results are shown in Table 4 and Table 5 below.
  • Table 4 shows the table of traditional monitoring anomalies in October 2015.
  • host_name represents the host name
  • parameter represents the host variable
  • date_time represents the time point
  • value_str represents the specific value of the host variable at that time.
  • host_name represents the host name
  • parameter1 represents a variable of the host
  • parameter2 represents another variable of the host
  • windows represents the window period, in units of 5 minutes
  • percentage represents the similarity between the current window period and the previous window period rule set.
  • S(min) represents the minimum similarity of the rule set
  • isalarm represents whether the current rule set similarity is less than the rule set minimum similarity, 1 means less than, 0 means greater than.
  • the host error anomaly detection method according to the embodiment of the present invention has an abnormality detection accuracy of 98%, a detection coverage rate of 100%, and a detection false negative rate of 0 (traditional false negative report).
  • the rate is 66.7%).
  • the actual effect is significantly better than the anomaly detection of the traditional data center.
  • the embodiment of the present invention further provides a host variable abnormality detecting system.
  • the host variable abnormality detecting system mainly includes: a first associated rule set computing unit 1, and a second associated rule set computing unit 2.
  • the first association rule set calculation unit 1 is configured to calculate, according to the data window of the first preset time length, the first association rule set between the multiple variables of the host to be detected by using the association rule algorithm;
  • the second association The rule set calculation unit 2 is configured to slide the data window backward according to the second preset time, and calculate the second association rule set between the variables in the data window after sliding backward according to the preset time by the association rule algorithm;
  • the similarity calculation The unit 3 is configured to compare each rule in the second association rule set with each rule in the first association rule set, and calculate a similarity between the first association rule set and the second association rule set;
  • the abnormal situation determination unit 4 It is used to compare the similarity with the minimum similarity of the rule set, and determine whether the variable of the host to be detected is abnormal.
  • the host variable abnormality detecting system of the embodiment of the present invention combines the sliding window technology and the association rule algorithm to determine a rule set between a plurality of variables of the host to be detected, and slides through the mutual cooperation of the components described above.
  • the similarity of the data before and after the window sliding is used to determine whether the variable of the host to be detected is abnormal.
  • the coverage and accuracy of the anomaly detection can be improved, and the system has universal applicability and can be applied. For a variety of data anomaly detection occasions.
  • the host variable abnormality detecting system of the embodiment of the present invention is further described below in conjunction with specific embodiments.
  • the first association rule set calculation unit 1 is configured to calculate a first association rule set between the plurality of variables of the host to be detected by using an association rule algorithm according to the data window of the first preset time length.
  • the host to be detected may contain multiple variables, as shown in Table 1.
  • two variables of a host in Table 1 are selected, and according to a data window of a first preset time length (for example, one day), an association rule algorithm is used to calculate between two variables of the host to be detected.
  • the first association rule set R1 is as shown in Table 2.
  • the pre-rule, the post-rule, the sub-rule of the rule, the sub-rule of the rule, the minimum support of the rule, and the minimum confidence of the rule are all given in the form of parameters, which is convenient for the adjustment of the later data verification.
  • the given example is a process of calculating an association rule for two variables in the host.
  • the Apriori algorithm is selected as the association rule algorithm described above, but the present invention is not limited thereto, and different association rule algorithms may be selected according to actual conditions.
  • the above Apriori algorithm is one of the most influential Boolean association rules algorithms. Therefore, the basic idea of the Apriori algorithm based on the above tasks is to first find out all the frequent itemsets, and the selected item sets need to meet the preset minimum support. degree. The found frequent itemsets are then used to generate strong association rules, where the generated rules must satisfy the minimum confidence.
  • the second association rule set calculation unit 2 is configured to slide the data window backward according to the second preset time, and calculate the second association between the variables in the data window that is backwardly swept by the preset time by the association rule algorithm. Rule set.
  • the sliding window technology is combined with the association rule algorithm.
  • the first association rule set described above is the rule for obtaining the data of the above two variables in one day (from 00:00 to 00:00). set.
  • a preset time for example, 5 minutes
  • the data of the above two variables in the day 00:05 to the next day 00:05 is obtained, and the second is calculated by the Apriori algorithm.
  • the similarity calculation unit 3 is configured to compare each rule in the second association rule set with each rule in the first association rule set, and calculate the similarity between the first association rule set and the second association rule set. .
  • the similarity calculation unit 3 mainly includes: a same rule quantity determining module 31, configured to determine, according to the comparison result, the number of the same rules in the first association rule set and the second association rule set;
  • the module 32 is configured to calculate the similarity according to the total number of the first association rule set rules and the number of the same rules.
  • the same rule quantity determining module 31 described above compares each rule in the second association rule set R2 with each rule in the first association rule set R1 by using a rule set comparison algorithm.
  • the comparison content is: the rule pre-item, the rule post-item, the rule minimum support degree, and the rule minimum confidence.
  • the comparison method is: when the rule support degree and the rule confidence degree are compared, the deviation can be set, that is, the second association rule A rule in the set R2 is the same as the before and after terms of a rule in the first association rule set R1.
  • the two rules are the same. Then, the number S(Sum) of the same rule in the first association rule set R1 and the second association rule set R1 is statistically determined.
  • the similarity calculation module 32 may combine the rules in the first association rule set R1.
  • the total number R1 (Sum) is used to calculate the similarity S of the first association rule set R1 and the second association rule set R2.
  • the sliding window is moved backwards every 5 minutes as a preset time, thereby acquiring the second association rule set R2.
  • the abnormality judging unit 4 compares the calculated similarity S of the first association rule set R1 and the second association rule set R2 with the minimum similarity of the rule set, and determines whether the variable of the host to be detected is abnormal. happening.
  • the historical data is used to verify and adjust the relevant parameters to obtain the minimum similarity S(Min) of different rule sets. For example, when observing historical data, when there are no faults and events in the actual production environment, the corresponding S(Dif) is 0.006, C(Dif) is 0.03, and S(Min) is 85%.
  • variables mentioned above are also only an example description.
  • a plurality of variables may be included in the host, and abnormality detection may be performed between different variables, and the host variable abnormality detection may be performed by using the embodiment of the present invention.
  • the above process of the system is implemented and will not be described here.
  • the above is the main process of the abnormality detection of the host variable abnormality detecting system in the embodiment of the present invention.
  • the fusion association analysis and the sliding window technology are used, and in actual applications, according to the verification result, the corresponding parameters are adjusted to obtain different
  • the similarity between the sliding window rule sets is then compared with the minimum similarity to determine the abnormality of the variable. It can effectively improve the accuracy of abnormal detection and detection coverage, and reduce the rate of false negative detection.
  • the host variable abnormality detecting system of the embodiment of the present invention may further include an abnormality processing unit, configured to use data of the variable in the previous data window when determining that an abnormality occurs in a variable of the host to be detected.
  • the data of the variable in the data window after sliding backward according to the preset time is replaced.
  • the exception handling unit replaces the data for this window period with the last sliding window period data with no exception, and then recalculates the rule set.
  • the rule set similarity of the current window period is formed by comparing the latest window period rule set with the rule set of the previous window period.
  • a computer apparatus comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor implementing the method when the computer program is executed.
  • the processor executing method further includes: when determining that the variable of the host to be detected has an abnormal condition, replacing the data that is backwardly swept according to the preset time by using data of the variable in the previous data window. The data of the variables described in the window.
  • each rule in the second association rule set is compared with each rule in the first association rule set, and the first association rule set and the second association rule set are calculated.
  • the similarity includes: determining, according to the comparison result, the number of the same rules in the first association rule set and the second association rule set; calculating the number according to the total number of the first association rule set concentration rules and the number of the same rules Similarity.
  • the determining, by the processor, whether the variable of the host to be detected is abnormal specifically: when the similarity is greater than or equal to the minimum similarity of the rule set, determining the to-be-detected The variable of the host is normal; when the similarity is less than the minimum similarity of the rule set, it is determined that the variable of the host to be detected is abnormal.
  • the present invention also provides a computer readable storage medium storing a computer program for performing the above method.
  • the data of the variable in the data window after sliding backward according to the preset time is replaced by the data of the variable in the previous data window.
  • Each of the rules in the second association rule set is compared with each rule in the first association rule set, and the similarity between the first association rule set and the second association rule set is calculated, which includes: Determining, by the result, the number of the same rules in the first association rule set and the second association rule set; calculating the similarity according to the total number of the first association rule set central rules and the number of the same rules.
  • the computer program performs determining whether the variable of the host to be detected is abnormal, and specifically includes: when the similarity is greater than or equal to the minimum similarity of the rule set, determining the to-be-detected The variable of the host is normal; when the similarity is less than the minimum similarity of the rule set, it is determined that the variable of the host to be detected is abnormal.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Complex Calculations (AREA)

Abstract

本发明提供一种主机变量异常检测方法及系统，该方法包括：按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；按照第二预设时间向后滑动数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中变量之间的第二关联规则集；将第二关联规则集中的每条规则分别与第一关联规则集中的每条规则进行比对，计算第一关联规则集与第二关联规则集的相似度；根据相似度与规则集最小相似度进行比较，判断待检测主机的变量是否出现异常情况。

Description

一种主机变量异常检测方法及系统
相关申请的交叉引用
本申请要求2016年10月24日递交，申请号为CN201610924584.0，标题为“一种主机变量异常检测方法及系统”的中国专利的优先权，上述专利申请的全部内容被引用作为参考。
技术领域
本发明是关于数据异常检测技术，具体地，是关于一种主机变量异常检测方法及系统。
背景技术
关联规则挖掘是指找出支持度大于等于min-sup并且置信度大于等于min-conf的所有规则,min-sup和min-conf是对应的支持度和置信度阈值。
由于关联规则挖掘能够发现海量数据中不同属性之间的有趣关系，因此其应用范围较为广泛。有文献提出了一种模糊加权关联规则挖掘方法，结合模糊集合、Apriori数据挖掘算法和时间序列分析，挖掘报警关联规则。并将其应用于大规模工业生产中，有效的抑制了工业报警的泛滥。有文献运用关联规则和马尔可夫模型的思想对IP定位数据集进行挖掘，以此提高IP定位的准确率和覆盖率。有文献运用Apriori算法,挖掘上市公司之间的信用风险传染，将其应用于上市公司风险评估中，发现产生强关联规则的上市公司之间信用风险传染较为明显，为上市公司风险控制提供决策支持。有文献应用关联规则挖掘算法，对民航快递市场销售数据进行挖掘，为民航快递市场营销提供决策支持。
然而，基于上述算法所进行的异常检测所具备的缺点主要有以下几点：
1.准确率偏低，其漏检率偏高。
2.仅仅支持单一变量的检测，无法对多变量进行检测。
3.通过设定阈值来完成的，而阈值是经验值，且都是静态的，其科学性较差。
发明内容
本发明实施例的主要目的在于提供一种主机变量异常检测方法及系统，以应对多种不同的异常检测需求，提高异常检测准确率。
为了实现上述目的，本发明实施例提供一种主机变量异常检测方法，所述的主机变量异常检测方法包括：按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；按照第二预设时间向后滑动所述的数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中所述变量之间的第二关联规则集；将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度；根据所述相似度与规则集最小相似度进行比较，判断所述待检测主机的变量是否出现异常情况。
本发明实施例还提供一种主机变量异常检测系统，所述的主机变量异常检测系统包括：第一关联规则集计算单元，用于按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；第二关联规则集计算单元，用于按照第二预设时间向后滑动所述的数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中所述变量之间的第二关联规则集；相似度计算单元，用于将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度；异常情况判断单元，用于根据所述相似度与规则集最小相似度进行比较，判断所述待检测主机的变量是否出现异常情况。
本发明实施例还提供一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现上述方法。
本发明实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有执行上述方法的计算机程序。
本发明实施例的有益效果在于，能够实现将滑动窗口技术与关联规则算法相结合，确定待检测主机的多个变量之间的规则集，并通过滑动窗口滑动前后数据的相似度来判断待检测主机的变量是否出现异常情况，相较于现有的异常检测技术，能够提高异常检测的覆盖率以及准确度，且此方法具有普适性，能够适用于多种数据异常检测场合。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为根据本发明实施例的主机变量异常检测方法的流程图；
图2A至图2B为根据本发明实施例的主机变量异常检测系统的结构示意图；
图3为根据本发明实施例的相似度计算单元的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种主机变量异常检测方法及系统。以下结合附图对本发明进行详细说明。
本发明实施例提供一种主机变量异常检测方法，如图1所示，该主机变量异常检测方法主要包括以下步骤：
步骤S101：按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；
步骤S102：按照第二预设时间向后滑动数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中的变量之间的第二关联规则集；
步骤S103：将第二关联规则集中的每条规则分别与第一关联规则集中的每条规则进行比对，计算第一关联规则集与第二关联规则集的相似度；
步骤S104：根据相似度与规则集最小相似度进行比较，判断待检测主机的变量是否出现异常情况。
通过上述的步骤S101至步骤S104，本发明实施例的主机变量异常检测方法，实现将滑动窗口技术与关联规则算法相结合，确定待检测主机的多个变量之间的规则集，并通过滑动窗口滑动前后数据的相似度来判断待检测主机的变量是否出现异常情况，相较于现有的异常检测技术，能够提高异常检测的覆盖率以及准确度，且此方法具有普适性，能够适用于多种数据异常检测场合。
以下结合具体实施例，对本发明实施例的主机变量异常检测方法做进一步说明。
上述的步骤S101，按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集。
在实际应用中，待检测主机中可能包含有多种变量，如下表1所示。
表1
Figure PCTCN2017107407-appb-000001
在本发明实施例中，是选取上述表格中一主机的两个变量，按照第一预设时间长度(例如是一天)的数据窗口，通过关联规则算法，计算待检测主机的两个变量之间的第一关联规则集R1，如下表2所示。其中规则前项、规则后项、规则前项的分箱数、规则后项的分箱数、规则最小支持度、规则最小置信度均以参数形式给出，便于后期数据验证时的调整。
需要说明的是，在此实施例中，给出的示例是针对主机中的两个变量计算关联规则的过程。但实际应用中，也可是针对三个或三个以上的变量，本发明并不以此为限。并且，是选用Apriori算法作为上述的关联规则算法，但本发明并不以此为限，可根据实际情况选用不同的关联规则算法。
表2
Figure PCTCN2017107407-appb-000002
上表中，frontItem表示规则前项，behindItem表示规则后项，Support表示支持度，Confidence表示置信度。
上述的Apriori算法是一种最有影响的布尔关联规则算法，因此，基于上述任务的Apriori算法基本思想是：首先找出所有的频繁项集，选出的项集需要满足预先设定的最 小支持度。然后使用找到的频繁项集产生强关联规则，其中所产生的规则必须满足最小置信度。
上述步骤S102，按照第二预设时间向后滑动数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中的变量之间的第二关联规则集。
在本发明实施例中，是将滑动窗口技术与关联规则算法相结合。例如，对于表1中，Host1主机的两个变量CPUUserTime及DSKPercentBus，上述的第一关联规则集即是获取上述两个变量在一天内的数据(当天00：00至次日00：00)的规则集。而基于滑动窗口，按预设时间(例如是5分钟)向后滑动数据窗口，则是获取上述两个变量在当天00：05至次日00：05的数据，并通过Apriori算法计算生成第二关联规则集R2。
上述步骤S103，将第二关联规则集中的每条规则分别与第一关联规则集中的每条规则进行比对，计算第一关联规则集与第二关联规则集的相似度。
具体地，是利用规则集比对算法，对第二关联规则集R2中的每条规则与第一关联规则集R1中的每条规则进行比对。其中比对内容为：规则前项、规则后项、规则最小支持度、规则最小置信度，比对方法为：规则支持度和规则置信度比较时，可以按照偏差进行设置，即第二关联规则集R2中的一条规则和第一关联规则集R1中一条规则的前后项相同，如果这两条规则的支持度偏差S(Dif)及置信度偏差C(Dif)分别在给定支持度偏差阈值范围及置信度偏差阈值范围内(S(Dif)和C(Dif)是可参数化的，根据验证结果进行调整)，则这两条规则是相同的。然后，统计确定第一关联规则集R1与第二关联规则集R1中相同规则的数量S(Sum)。
然后，根据第一关联规则集中规则的总数及相同规则的数量计算第一关联规则集与第二关联规则集的相似度。
具体地，在一实施例中，是结合第一关联规则集R1中规则的总数R1(Sum)来计算第一关联规则集R1及第二关联规则集R2的相似度S。可通过以下公式计算第一关联规则集R1及第二关联规则集R2的相似度S：S＝S(Sum)/R1(Sum)×100％，计算结果如下表3所示。
表3
Figure PCTCN2017107407-appb-000003
通过上表可以看出，在此实施例中，是以每5分钟作为预设时间，向后移动滑动窗口，从而获取第二关联规则集R2。
然后，即可通过步骤S104，将计算得到的第一关联规则集R1及第二关联规则集R2的相似度S与规则集最小相似度进行比较，判断待检测主机的变量是否出现异常情况。
其中，利用历史数据验证，调整相关参数，得到不同规则集的最小相似度S(Min)。例如是，观察历史数据，在实际生产环境中没有发生故障和事件时，其相应的S(Dif)为0.006，C(Dif)为0.03，S(Min)为85％。
将相似度S与规则集最小相似度S(Min)进行比较，如果S≥S(Min)，则判定待检测主机的变量正常；如果S<S(Min)，则判定待检测主机的变量出现异常情况。
结合上表3中的数据可以看出，对于规则集最小相似度S(Min)为85％时，HOST1的变量CPUUserTime及DSKPercentBus的异常情况出现在2015/10/29 1:05，其余时间均为正常。
需要说明的是，上述实施例中所列举的具体时间、数值及百分比等数据均为举例说明，而并非用以限制本发明。在具体实施时，上述的具体时间、数值及百分比等数据均可根据实际情况和实际需要进行调整。
并且，上文中所提及的变量也仅是实例说明，在实际应用中，主机中可包含多种变量，针对不同的变量之间进行异常检测，均可通过本发明实施例的主机变量异常检测方法的上述过程实现，在此不再赘述。
以上即是本发明实施例的主机变量异常检测方法在进行异常检测的主要过程，通过上述过程，融合关联分析和滑动窗口技术，在实际应用中，根据验证结果，调整相应的 参数，得出不同滑动窗口规则集之间的相似度，然后与最小相似度进行比较，判断变量的异常情况。能够有效提高异常检测准确率及检测覆盖率，并减小检测漏报率。
在一实施例中，本发明实施例的主机变量异常检测方法还可包括如下步骤：当确定待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
如果出现异常情况，用上一个没有异常的滑动窗口期数据替换本窗口期的数据，然后重新计算规则集。用最新的窗口期规则集和上一个窗口期的规则集对比，形成当前窗口期的规则集相似度。
例如，对于上表3中的数据而言，当2015/10/29 1:05的数据出现异常时，用2015/10/29 1:00的数据替换2015/10/29 1:05的数据，并用替换后的2015/10/29 1:05的数据与2015/10/29 1:10的数据再进行相似度计算。
基于本发明实施例的主机变量异常检测方法，在实际应用过程中进行了实际测试，并与传统数据中心的异常检测结果进行比对。具体测试结果如下表4及表5所示。
表4
Figure PCTCN2017107407-appb-000004
表4中示出的是2015年10月份传统监控异常事件表。
上表中，host_name代表主机名，parameter代表主机的变量，date_time代表时间点，value_str代表该时间点下该主机变量的具体值。
表5
Figure PCTCN2017107407-appb-000005
上表中host_name代表主机名，parameter1代表主机的某一变量，parameter2代表主机的另一变量，windows代表窗口期，以5分钟为单位，percent代表当前窗口期与上一窗口期规则集的相似度，S(min)代表规则集最小相似度，isalarm代表当前规则集相似度是否小于规则集最小相似度，1表示小于，0表示大于。
通过表4及表5的检测结果对比可知，利用本发明实施例的主机变量异常检测方法，异常检测准确率为98％，检测覆盖率为100％，检测漏报率为0(传统的漏报率为66.7％)。其实际效果要明显优于传统数据中心的异常检测。
本发明实施例还提供一种主机变量异常检测系统，如图2A至图2B所示，该主机变量异常检测系统主要包括：第一关联规则集计算单元1、第二关联规则集计算单元2、相似度计算单元3及异常情况判断单元4等。
其中，上述的第一关联规则集计算单元1用于按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；第二关联规则集计算单元2用于按照第二预设时间向后滑动数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中的变量之间的第二关联规则集；相似度计算单元3用于将第二关联规则集中的每条规则分别与第一关联规则集中的每条规则进行比对，计算第一关联规则集与第二关联规则集的相似度；异常情况判断单元4用于根据相似度与规则集最小相似度进行比较，判断待检测主机的变量是否出现异常情况。
通过上述的各个组成部分的相互协作，本发明实施例的主机变量异常检测系统，实现将滑动窗口技术与关联规则算法相结合，确定待检测主机的多个变量之间的规则集，并通过滑动窗口滑动前后数据的相似度来判断待检测主机的变量是否出现异常情况，相较于现有的异常检测技术，能够提高异常检测的覆盖率以及准确度，且此系统具有普适性，能够适用于多种数据异常检测场合。
以下结合具体实施例，对本发明实施例的主机变量异常检测系统做进一步说明。
上述的第一关联规则集计算单元1，用于按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集。
在实际应用中，待检测主机中可能包含有多种变量，如表1所示。
在本发明实施例中，是选取表1中一主机的两个变量，按照第一预设时间长度(例如是一天)的数据窗口，通过关联规则算法，计算待检测主机的两个变量之间的第一关联规则集R1，如表2所示。其中规则前项、规则后项、规则前项的分箱数、规则后项的分箱数、规则最小支持度、规则最小置信度均以参数形式给出，便于后期数据验证时的调整。
需要说明的是，在此实施例中，给出的示例是针对主机中的两个变量计算关联规则的过程。但实际应用中，也可是针对三个或三个以上的变量，本发明并不以此为限。并且，是选用Apriori算法作为上述的关联规则算法，但本发明并不以此为限，可根据实际情况选用不同的关联规则算法。
上述的Apriori算法是一种最有影响的布尔关联规则算法，因此，基于上述任务的Apriori算法基本思想是：首先找出所有的频繁项集，选出的项集需要满足预先设定的最小支持度。然后使用找到的频繁项集产生强关联规则，其中所产生的规则必须满足最小置信度。
上述的第二关联规则集计算单元2，用于按照第二预设时间向后滑动数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中的变量之间的第二关联规则集。
在本发明实施例中，是将滑动窗口技术与关联规则算法相结合。例如，对于表1中，Host1主机的两个变量CPUUserTime及DSKPercentBus，上述的第一关联规则集即是获取上述两个变量在一天内的数据(当天00：00至次日00：00)的规则集。而基于滑动窗口，按预设时间(例如是5分钟)向后滑动数据窗口，则是获取上述两个变量在当天00：05至次日00：05的数据，并通过Apriori算法计算生成第二关联规则集R2。
上述的相似度计算单元3，用于将第二关联规则集中的每条规则分别与第一关联规则集中的每条规则进行比对，计算第一关联规则集与第二关联规则集的相似度。
具体地，如图3所示，相似度计算单元3主要包括：相同规则数量确定模块31，用于根据比对结果确定第一关联规则集与第二关联规则集中相同规则的数量；相似度计算模块32，用于根据第一关联规则集中规则的总数及相同规则的数量计算相似度。
其中，上述的相同规则数量确定模块31是利用规则集比对算法，对第二关联规则集R2中的每条规则与第一关联规则集R1中的每条规则进行比对。其中比对内容为：规则前项、规则后项、规则最小支持度、规则最小置信度，比对方法为：规则支持度和规则置信度比较时，可以按照偏差进行设置，即第二关联规则集R2中的一条规则和第一关联规则集R1中一条规则的前后项相同，如果这两条规则的支持度偏差S(Dif)及置信度偏差C(Dif)分别在给定支持度偏差阈值范围及置信度偏差阈值范围内(S(Dif)和C(Dif)是可参数化的，根据验证结果进行调整)，则这两条规则是相同的。然后，统计确定第一关联规则集R1与第二关联规则集R1中相同规则的数量S(Sum)。
在通过相同规则数量确定模块31确定了第一关联规则集R1与第二关联规则集R2中相同规则的数量S(Sum)后，相似度计算模块32可结合第一关联规则集R1中规则的总数R1(Sum)来计算第一关联规则集R1及第二关联规则集R2的相似度S。
具体地，在一实施例中，相似度计算模块32可通过以下公式计算第一关联规则集R1及第二关联规则集R2的相似度S：S＝S(Sum)/R1(Sum)×100％，计算结果如表3所示。
通过表3可以看出，在此实施例中，是以每5分钟作为预设时间，向后移动滑动窗口，从而获取第二关联规则集R2。
然后，即可通过异常情况判断单元4，将计算得到的第一关联规则集R1及第二关联规则集R2的相似度S与规则集最小相似度进行比较，判断待检测主机的变量是否出现异常情况。
其中，利用历史数据验证，调整相关参数，得到不同规则集的最小相似度S(Min)。例如是，观察历史数据，在实际生产环境中没有发生故障和事件时，其相应的S(Dif)为0.006，C(Dif)为0.03，S(Min)为85％。
将相似度S与规则集最小相似度S(Min)进行比较，如果S≥S(Min)，则判定待检测主机的变量正常；如果S<S(Min)，则判定待检测主机的变量出现异常情况。
结合表3中的数据可以看出，对于规则集最小相似度S(Min)为85％时，HOST1的变量CPUUserTime及DSKPercentBus的异常情况出现在2015/10/29 1:05，其余时间均为正常。
需要说明的是，上述实施例中所列举的具体时间、数值及百分比等数据均为举例说明，而并非用以限制本发明。在具体实施时，上述的具体时间、数值及百分比等数据均可根据实际情况和实际需要进行调整。
并且，上文中所提及的变量也仅是实例说明，在实际应用中，主机中可包含多种变量，针对不同的变量之间进行异常检测，均可通过本发明实施例的主机变量异常检测系统的上述过程实现，在此不再赘述。
以上即是本发明实施例的主机变量异常检测系统在进行异常检测的主要过程，通过上述过程，融合关联分析和滑动窗口技术，在实际应用中，根据验证结果，调整相应的参数，得出不同滑动窗口规则集之间的相似度，然后与最小相似度进行比较，判断变量的异常情况。能够有效提高异常检测准确率及检测覆盖率，并减小检测漏报率。
在一实施例中，本发明实施例的主机变量异常检测系统还可包括异常情况处理单元，用于当确定待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
如果出现异常情况，异常情况处理单元用上一个没有异常的滑动窗口期数据替换本窗口期的数据，然后重新计算规则集。用最新的窗口期规则集和上一个窗口期的规则集对比，形成当前窗口期的规则集相似度。
例如，对于表3中的数据而言，当2015/10/29 1:05的数据出现异常时，用2015/10/29 1:00的数据替换2015/10/29 1:05的数据，并用替换后的2015/10/29 1:05的数据与2015/10/29 1:10的数据再进行相似度计算。
在一实施例中，还提供一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现上述方法。其中，所述处理器执行方法还包含：当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。在上述实施例中，将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度，具体包括：根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
在一实施例中，所述处理器执行判断所述待检测主机的变量是否出现异常情况，具体包括：当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；当所述相似度小于所述规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
在一实施例中，本发明还提供一种计算机可读存储介质，所述计算机可读存储介质存储有执行上述方法的计算机程序。其中，当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度，具体包括：根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
在上述实施例中，所述计算机程序执行判断所述待检测主机的变量是否出现异常情况，具体包括：当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；当所述相似度小于所述规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
本领域普通技术人员当可知，以上主机变量异常检测方法及系统中各实施例中记载的技术方案及其任意组合方案均可通过上述计算机可读存储介质所运行的程序以及上述计算机设备中处理器执行，本发明在此就不再一一举例说明。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分步骤可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读取存储介质中，比如ROM/RAM、磁碟、光盘等。
以上所述的具体实施例，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施例而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (18)

  1. 一种主机变量异常检测方法，其特征在于，所述的主机变量异常检测方法包括：
    按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；
    按照第二预设时间向后滑动所述的数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中所述变量之间的第二关联规则集；
    将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度；
    根据所述相似度与规则集最小相似度进行比较，判断所述待检测主机的变量是否出现异常情况。
  2. 根据权利要求1所述的主机变量异常检测方法，其特征在于，当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
  3. 根据权利要求1所述的主机变量异常检测方法，其特征在于，将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度，具体包括：
    根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；
    根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
  4. 根据权利要求3所述的主机变量异常检测方法，其特征在于，根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量，具体包括：
    比对所述第一关联规则集与第二关联规则集的每条规则之间，是否满足以下条件：
    所述第一关联规则集与第二关联规则集的规则前项及规则后项是否相同；
    所述第一关联规则集与第二关联规则集的最小支持度的支持度偏差在支持度偏差阈值范围内；
    所述第一关联规则集与第二关联规则集的最小置信度的置信度偏差在置信度偏差阈值范围内；
    如果均满足所述条件，则判定所述第一关联规则集与第二关联规则集中的规则属于相同规则；
    统计所述相同规则的数量。
  5. 根据权利要求3所述的主机变量异常检测方法，其特征在于，通过以下公式计算所述相似度：
    S＝S(Sum)/R1(Sum)×100％，
    其中，S为所述相似度；S(Sum)为所述相同规则的数量；R1(Sum)为所述第一关联规则集中规则的总数。
  6. 根据权利要求1所述的主机变量异常检测方法，其特征在于，判断所述待检测主机的变量是否出现异常情况，具体包括：
    当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；
    当所述相似度小于所述规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
  7. 一种主机变量异常检测系统，其特征在于，所述的主机变量异常检测系统包括：
    第一关联规则集计算单元，用于按照第一预设时间长度的数据窗口，通过关联规则算法，计算待检测主机的多个变量之间的第一关联规则集；
    第二关联规则集计算单元，用于按照第二预设时间向后滑动所述的数据窗口，通过关联规则算法计算按照预设时间向后滑动后的数据窗口中所述变量之间的第二关联规则集；
    相似度计算单元，用于将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度；
    异常情况判断单元，用于根据所述相似度与规则集最小相似度进行比较，判断所述待检测主机的变量是否出现异常情况。
  8. 根据权利要求7所述的主机变量异常检测系统，其特征在于，所述主机变量异常检测系统还包括：
    异常情况处理单元，用于当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
  9. 根据权利要求7所述的主机变量异常检测系统，其特征在于，所述的相似度计算单元包括：
    相同规则数量确定模块，用于根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；
    相似度计算模块，用于根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
  10. 根据权利要求7所述的主机变量异常检测系统，其特征在于，所述异常情况判断单元具体用于：
    当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；
    当所述相似度小于规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
  11. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现权利要求1所述方法。
  12. 根据权利要求11所述的计算机设备，其特征在于，所述处理器执行方法还包含：当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
  13. 根据权利要求11所述的计算机设备，其特征在于，所述处理器执行将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度，具体包括：
    根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；
    根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
  14. 根据权利要求11所述的计算机设备，其特征在于，所述处理器执行判断所述待检测主机的变量是否出现异常情况，具体包括：
    当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；
    当所述相似度小于所述规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有执行权利要求1所述方法的计算机程序。
  16. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述计算机程序执行方法还包含：当确定所述待检测主机的变量出现异常情况时，用前一数据窗口中的所述变量的数据替换所述按照预设时间向后滑动后的数据窗口中所述变量的数据。
  17. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述计算机程序执行将所述第二关联规则集中的每条规则分别与所述第一关联规则集中的每条规则进行比对，计算所述第一关联规则集与第二关联规则集的相似度，具体包括：
    根据比对结果确定所述第一关联规则集与第二关联规则集中相同规则的数量；
    根据所述第一关联规则集中规则的总数及所述相同规则的数量计算所述相似度。
  18. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述计算机程序执行判断所述待检测主机的变量是否出现异常情况，具体包括：
    当所述相似度大于或等于所述规则集最小相似度时，则判定所述待检测主机的变量正常；
    当所述相似度小于所述规则集最小相似度时，则判定所述待检测主机的变量出现异常情况。
PCT/CN2017/107407 2016-10-24 2017-10-24 一种主机变量异常检测方法及系统 Ceased WO2018077152A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610924584.0A CN106528313B (zh) 2016-10-24 2016-10-24 一种主机变量异常检测方法及系统
CN201610924584.0 2016-10-24

Publications (1)

Publication Number Publication Date
WO2018077152A1 true WO2018077152A1 (zh) 2018-05-03

Family

ID=58291572

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/107407 Ceased WO2018077152A1 (zh) 2016-10-24 2017-10-24 一种主机变量异常检测方法及系统

Country Status (2)

Country Link
CN (1) CN106528313B (zh)
WO (1) WO2018077152A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131274A (zh) * 2020-09-22 2020-12-25 平安科技（深圳）有限公司 时间序列异常点的检测方法、装置、设备及可读存储介质
CN112988536A (zh) * 2021-03-09 2021-06-18 北京奇艺世纪科技有限公司 一种数据异常检测方法、装置、设备及存储介质
CN113726814A (zh) * 2021-09-09 2021-11-30 中国电信股份有限公司 用户异常行为识别方法、装置、设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106528313B (zh) * 2016-10-24 2018-10-16 中国银联股份有限公司 一种主机变量异常检测方法及系统
CN113988182A (zh) * 2021-10-26 2022-01-28 西安热工研究院有限公司 一种基于KMeans-FPgrowth算法的矿用卡车发动机故障预警方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101853277A (zh) * 2010-05-14 2010-10-06 南京信息工程大学 一种基于分类和关联分析的漏洞数据挖掘方法
US9043354B1 (en) * 2009-10-16 2015-05-26 Iqor U.S. Inc. Apparatuses, methods and systems for an automated data extractor
CN105099759A (zh) * 2015-06-23 2015-11-25 上海华为技术有限公司 一种检测方法及装置
CN106528313A (zh) * 2016-10-24 2017-03-22 中国银联股份有限公司 一种主机变量异常检测方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070260568A1 (en) * 2006-04-21 2007-11-08 International Business Machines Corporation System and method of mining time-changing data streams using a dynamic rule classifier having low granularity
CN101667197A (zh) * 2009-09-18 2010-03-10 浙江大学 基于滑动窗口的数据流关联规则挖掘方法
CN101937447B (zh) * 2010-06-07 2012-05-23 华为技术有限公司 一种告警关联规则挖掘方法、规则挖掘引擎及系统
CN102098175B (zh) * 2011-01-26 2015-07-01 浪潮通信信息系统有限公司 一种移动互联网告警关联规则获取方法
CN103400152B (zh) * 2013-08-20 2016-08-10 哈尔滨工业大学 基于分层聚类的滑动窗口多数据流异常检测方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9043354B1 (en) * 2009-10-16 2015-05-26 Iqor U.S. Inc. Apparatuses, methods and systems for an automated data extractor
CN101853277A (zh) * 2010-05-14 2010-10-06 南京信息工程大学 一种基于分类和关联分析的漏洞数据挖掘方法
CN105099759A (zh) * 2015-06-23 2015-11-25 上海华为技术有限公司 一种检测方法及装置
CN106528313A (zh) * 2016-10-24 2017-03-22 中国银联股份有限公司 一种主机变量异常检测方法及系统

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131274A (zh) * 2020-09-22 2020-12-25 平安科技（深圳）有限公司 时间序列异常点的检测方法、装置、设备及可读存储介质
CN112131274B (zh) * 2020-09-22 2024-01-19 平安科技（深圳）有限公司 时间序列异常点的检测方法、装置、设备及可读存储介质
CN112988536A (zh) * 2021-03-09 2021-06-18 北京奇艺世纪科技有限公司 一种数据异常检测方法、装置、设备及存储介质
CN112988536B (zh) * 2021-03-09 2023-08-22 北京奇艺世纪科技有限公司 一种数据异常检测方法、装置、设备及存储介质
CN113726814A (zh) * 2021-09-09 2021-11-30 中国电信股份有限公司 用户异常行为识别方法、装置、设备及存储介质
CN113726814B (zh) * 2021-09-09 2022-09-02 中国电信股份有限公司 用户异常行为识别方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN106528313A (zh) 2017-03-22
CN106528313B (zh) 2018-10-16

Similar Documents

Publication Publication Date Title
US10417072B2 (en) Scalable predictive early warning system for data backup event log
WO2018077152A1 (zh) 一种主机变量异常检测方法及系统
US9652354B2 (en) Unsupervised anomaly detection for arbitrary time series
CN107528722B (zh) 一种时间序列中异常点检测方法及装置
CN109362235B (zh) 对网络可访问存储装置处的事务进行分类的方法
WO2020259421A1 (zh) 一种业务系统的监控方法及装置
US9558347B2 (en) Detecting anomalous user behavior using generative models of user actions
CN110874674A (zh) 一种异常检测方法、装置及设备
US9915932B2 (en) System and method for equipment monitoring using a group candidate baseline and probabilistic model
WO2020220758A1 (zh) 一种异常交易节点的检测方法及装置
CN102902699A (zh) 事件流的偏差检测系统和/或方法
CN105659248A (zh) 通过合规性测试进行自动化的风险跟踪
CN111666187A (zh) 用于检测异常响应时间的方法和装置
CN107391335A (zh) 一种用于检查集群健康状态的方法和设备
CN108108253A (zh) 一种面向多数据流的异常状态检测方法
CN111143101A (zh) 用于确定故障根源的方法、装置、存储介质及电子设备
US9069819B1 (en) Method and apparatus for reliable I/O performance anomaly detection in datacenter
CN105825130B (zh) 一种信息安全预警方法及装置
US12615105B2 (en) System and method to measure and score application health via correctable errors
WO2019019429A1 (zh) 一种虚拟机异常检测方法、装置、设备及存储介质
CN108696486A (zh) 一种异常操作行为检测处理方法及装置
Zhou et al. Proactive drive failure prediction for cloud storage system through semi-supervised learning
CN109947615A (zh) 分布式系统的监控方法和装置
CN114416418B (zh) 数据检测方法、装置、电子设备和存储介质
US20140059535A1 (en) Software Inventory Using a Machine Learning Algorithm

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17865890

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17865890

Country of ref document: EP

Kind code of ref document: A1