CN-121997227-A - Method for detecting time sequence abnormality of server based on abnormal attention and multi-domain feature fusion automatic encoder

CN121997227ACN 121997227 ACN121997227 ACN 121997227ACN-121997227-A

Abstract

The invention discloses a server time sequence abnormality detection method based on an abnormality attention and multi-domain feature fusion automatic encoder, which has the advantages that the method can be used for describing the association structure change among different moments in a time sequence through an abnormality attention mechanism, so that the recognition capability of structural abnormality of a server is improved, the periodic change features of the time sequence under different time scales can be effectively captured through introducing a multi-scale frequency domain feature extraction and multi-domain feature fusion mechanism, the detection effect of a complex abnormal mode is improved, in addition, the method adopts an unsupervised reconstruction learning mode to train, does not need to manually label abnormal samples, can learn by utilizing a large amount of normal operation data, and has better universality and practical application value.

Inventors

SUN WEIJUN
WANG YUXIN

Assignees

大连理工大学

Dates

Publication Date: 20260508
Application Date: 20260120

Claims (10)

1. A method for detecting a timing anomaly of a server based on an anomaly attention and multi-domain feature fusion automatic encoder, the method comprising: The method comprises the steps of S1, collecting multi-dimensional operation state parameters recorded by a monitoring system in the operation process of a server, carrying out standardization processing on the multi-dimensional operation state parameters to obtain multi-dimensional operation state parameters, dividing the multi-dimensional operation state parameters through a sliding window to construct a time window sample, wherein the multi-dimensional operation state parameters at least comprise a processor utilization rate, a memory utilization rate, a disk read-write rate, a network throughput and a system load index; S2, performing linear mapping and superposition position coding on an operation state parameter formed by a plurality of time window samples to obtain an initial time domain feature representation, and taking the initial time domain feature representation as input of an abnormal attention module; in the current layer abnormal attention module, carrying out linear transformation on the time domain feature representation of the previous layer to obtain a query matrix, a key matrix and a value matrix; s3, carrying out Fourier transform on the running state parameters to obtain global frequency domain feature representation, dividing the running state parameters into a plurality of local subsequences, and carrying out frequency domain transform on the local subsequences to obtain local features; s4, after discrete cosine transformation is carried out on the multi-scale frequency domain characteristic representation, combining a nonlinear activation function and Obtaining attention weights of frequency domain channels by functions, and obtaining frequency domain enhancement features after enhancing the multi-scale frequency domain feature representation by the attention weights of the frequency domain channels; S5, combining the frequency domain enhancement feature and the initial time domain feature to obtain a time domain abnormal feature representation of the running state of the server through learning of the N layers of abnormal attention modules, and determining a feature representation after cross-domain fusion; S6, inputting Transformer Decoder the cross-domain fused characteristic representation to obtain a reconstruction time sequence of the running state of the server by time sequence decoding of the running state of the server, calculating a reconstruction error of the running state of the server, constructing a time correlation structure difference based on the sequence correlation matrix and the prior correlation matrix, determining a target abnormal score of the running state of the server based on the reconstruction error and the time correlation structure difference, and determining that the running state of the server is time sequence abnormal at a time point t when the target abnormal score is larger than a preset abnormal score, otherwise, the running state of the server is normal.
2. The method for detecting a temporal anomaly of a server based on an anomaly attention and multi-domain feature fusion automatic encoder according to claim 1, wherein the linear mapping and superposition position coding of the operation state parameters composed of a plurality of time window samples to obtain an initial temporal feature representation is implemented by the following expression: Wherein, the For an initial time domain feature representation of the abnormal attention module, For the entered time window batch data, Is a linear mapping layer; is a position code.
3. The method for detecting the timing anomaly of the server based on the anomaly attention and multi-domain feature fusion automatic encoder according to claim 1, wherein in the anomaly attention module of the current layer, the linear transformation is performed on the time domain feature representation of the previous layer to obtain a query matrix, a key matrix and a value matrix, and the method is implemented by the following expression: Wherein, the For the query matrix in the current layer of anomaly attention, In the form of a matrix of keys, In the form of a matrix of values, For the output characteristics of the previous layer of abnormal attention module, , , As a learnable linear mapping weight matrix, Index for the anomaly attention layer.
4. The method for detecting the timing anomaly of the server based on the anomaly attention and multi-domain feature fusion automatic encoder according to claim 1, wherein the determining of the sequence association matrix, the weighted time domain feature representation and the time domain feature representation based on the query matrix, the key matrix and the value matrix in combination with the normalization function is achieved by the following expression: = Wherein, the A sequence association matrix at time t; As a function of the normalization, The space dimension is hidden for the features; = Wherein, the A weighted time domain feature representation output for the abnormal attention module; the output characteristics of the abnormal attention module of the previous layer are obtained; is a value matrix; Wherein, the For the time domain feature representation output by the current layer anomaly attention module, Is a layer normalization operation.
5. The method for detecting a temporal anomaly in a server based on a fused anomaly attention and multi-domain feature automatic encoder of claim 4, wherein determining a scale parameter at each time location based on the output feature of each layer of anomaly attention module at each time location, and determining an a priori correlation matrix based on the scale parameter is accomplished by the following expression: Wherein, the Is the scale parameter at time position i; Is the first at time position i An output feature of the layer anomaly attention module; For a learnable linear mapping weight matrix at time position i Wherein, the Is the first The prior incidence matrix between the time positions i and j in the layer, wherein W represents the length of a time window; is a standardized operation; is a bit gaussian function; is the scale parameter at time position i.
6. The method for detecting the time sequence abnormality of the server based on the automatic encoder for fusing the abnormal attention and the multi-domain features according to claim 1 is characterized in that the operation state parameter is subjected to Fourier transform to obtain a global frequency domain feature representation, the operation state parameter is divided into a plurality of local subsequences, the local subsequences are subjected to frequency domain transform to obtain local features, and the multi-scale frequency domain feature representation is determined according to the global frequency domain feature representation and the local features by the following expression: Wherein, the In the case of a fast fourier transform, Is a batch running status parameter; is a global frequency domain feature representation; Wherein, the Is the mth local subsequence; the local feature corresponding to the mth local time slice; Wherein, the The method is characterized by being a fused multi-scale frequency domain characteristic representation; for a plurality of local features The local frequency domain features obtained after learning by the attention module; Is a feature stitching function.
7. The method for detecting server time sequence anomalies based on the anomaly attention and multi-domain feature fusion automatic encoder according to claim 1, wherein after discrete cosine transforming the multi-scale frequency domain feature representation, combining a nonlinear activation function and The function obtains the attention weight of the frequency domain channel The frequency domain enhancement feature obtained after the multi-scale frequency domain feature representation is enhanced by the frequency domain channel attention weight is realized by the following expression: Wherein, the Is a representation of frequency components that are characteristic of the frequency domain, Is discrete cosine transform; Wherein, the For the frequency domain channel attention weights, , For the full connection layer weight, As a function of the non-linear activation, Is that A function; Wherein, the Representing for multi-scale frequency domain features Frequency domain enhancement features after attention enhancement via frequency domain channels.
8. The method for detecting the time sequence abnormality of the server based on the automatic fusion of the abnormal attention and the multi-domain features according to claim 1, wherein the combination of the frequency domain enhancement feature and the initial time domain feature representation is realized by the following expression by learning N layers of abnormal attention modules to obtain a time domain abnormal feature representation of the running state of the server and determining the cross-domain fused feature representation: Wherein, the Is a query matrix in a cross-domain attention module; for a key matrix in a cross-domain attention module, Is a matrix of values in a cross-domain attention module; is a frequency domain enhancement feature; For initial time domain feature representation Obtaining a time domain abnormal characteristic representation of the running state of the server through learning of the N layers of abnormal attention modules; 、、 A linear mapping weight matrix which can be learned; Wherein, the Is a cross-domain attention score matrix; Is a normalization function; The space dimension is hidden for the features; Wherein, the For cross-domain fused feature representations, For cross-domain attention weighted temporal anomalies, For the frequency domain enhancement feature, Is a layer normalization operation.
9. The method for detecting a temporal anomaly of a server based on a fusion of anomaly attentions and multi-domain features of claim 1, wherein, The reconstruction error of the running state of the server is realized by the following expression: Wherein, the Is a reconstruction error of the server operating state at the point in time t, For the true running state vector of the server at the time point t Reconstructing a time sequence Reconstruction data at a time point t, Is a two-norm; The time-dependent structural differences are realized by the following expression: = (i=t) Wherein, the As a result of the fact that at the point in time t, For the sequence association matrix at time t, Is the first A priori correlation matrix at time position t in the layer, For KL divergence, the degree of difference between two associated distributions is measured.
10. The server timing anomaly detection method based on anomaly attention and multi-domain feature fusion automatic encoder of claim 9, wherein the target anomaly score is implemented by the following expression: Wherein, the A target anomaly score for the running state of the server at a time point t; the reconstruction error of the running state of the server at the time point t; is a weight coefficient.

Description

Method for detecting time sequence abnormality of server based on abnormal attention and multi-domain feature fusion automatic encoder Technical Field The invention relates to the technical field of server time sequence anomaly detection, in particular to a server time sequence anomaly detection method based on anomaly attention and multi-domain feature fusion automatic encoder. Background The time sequence abnormality detection is an important technology for identifying and analyzing abnormal behaviors deviating from a normal operation mode in time sequence data, and has wide application value in the fields of server operation monitoring, industrial system operation and maintenance, information system safety and the like. Taking server operation monitoring as an example, the server can continuously generate multidimensional time series data in a long-term operation process, wherein the multidimensional time series data comprises a processor utilization rate, a memory utilization rate, a disk read-write rate, a network throughput and the like, and the data can reflect the operation state and the load condition of the server. The existing time sequence anomaly detection method mainly comprises a method based on a statistical model, a method based on traditional machine learning and a method based on deep learning. The statistical model method relies on a distribution assumption set manually, is difficult to adapt to complex and changeable actual running environments, the traditional machine learning method generally needs manual design features and has limited generalization capability, and the anomaly detection method based on deep learning, which is proposed in recent years, improves detection performance to a certain extent, but most methods only pay attention to reconstruction errors of a time sequence in a numerical level, and neglects related structure changes and periodic frequency features inside the time sequence. In an actual server operation scene, the anomaly often appears as a numerical mutation of a single index, and can also cause the association relation between different time points to change or destroy a periodic load mode formed by service scheduling and access rules. The existing method cannot perform joint modeling from two layers of a time-associated structure and a frequency structure at the same time, so that the detection capability of structural abnormality, periodic abnormality and complex abnormality modes is insufficient, and the problem of missed detection or false detection is easy to occur. Therefore, a method for detecting time sequence anomalies capable of simultaneously characterizing time sequence correlation structure changes and multi-scale frequency domain features is needed to improve the accuracy and robustness of detecting complex operation anomalies. Disclosure of Invention In view of the foregoing, it is desirable to provide a method, an apparatus, a computer device, and a storage medium for detecting a temporal anomaly of a server based on an anomaly attention and multi-domain feature fusion automatic encoder. A server timing anomaly detection method based on anomaly attention and multi-domain feature fusion automatic encoder, the method comprising: The method comprises the steps of S1, collecting multi-dimensional operation state parameters recorded by a monitoring system in the operation process of a server, carrying out standardization processing on the multi-dimensional operation state parameters to obtain multi-dimensional operation state parameters, dividing the multi-dimensional operation state parameters through a sliding window to construct a time window sample, wherein the multi-dimensional operation state parameters at least comprise a processor utilization rate, a memory utilization rate, a disk read-write rate, a network throughput and a system load index; S2, performing linear mapping and superposition position coding on an operation state parameter formed by a plurality of time window samples to obtain an initial time domain feature representation, and taking the initial time domain feature representation as input of an abnormal attention module; in the current layer abnormal attention module, carrying out linear transformation on the time domain feature representation of the previous layer to obtain a query matrix, a key matrix and a value matrix; s3, carrying out Fourier transform on the running state parameters to obtain global frequency domain feature representation, dividing the running state parameters into a plurality of local subsequences, and carrying out frequency domain transform on the local subsequences to obtain local features; s4, after discrete cosine transformation is carried out on the multi-scale frequency domain characteristic representation, combining a nonlinear activation function and The function obtains the attention weight of the frequency domain channelThe multi-scale frequency domain feature representation is enhanced thr