基于LSTM-SVM模型的ES多变量时序异常检测

Multi-Variable Timing Anomaly Detection of Embedded Software Based on LSTM-SVM Model

目前嵌入式软件多变量时序异常检测没有对时序样本数据进行预测和缺陷数据分类,存在ROC曲线偏低、MCC系数小和损失函数大的问题。提出基于LSTM-SVM模型的嵌入式软件多变量时序异常检测方法,首先在LSTM模型下预测时序样本数据,并利用支持向量机将大部分时序异常数据进行分类,将两者综合构成LSTM-SVM模型。其次利用LSTM-SVM模型预测出的时间序列数据进行离线检测,通过执行片段提取和预处理、执行片段匹配、相关时间约束识别和异常时序检测四步完成时序异常检测,实现嵌入式软件多变量时序异常检测。实验结果表明,所提方法的ROC曲线高、MCC系数大和损失函数小。

At present,some detection methods ignore predicting the time-series sample data and classifying the defect data,leading to low ROC curve,small MCC coefficient and large loss function.Therefore,this paper presented a method to detect the anomaly of multi-variable time series of embedded software based on the LSTMSVM model.Firstly,based on the LSTM model we predicted the time-series sample data and used the support vector machine to classify most of the abnormal time-series data.Combining the two,we built an LSTM-SVM model.Secondly,we used the time-series data predicted by the LSTM-SVM model to perform an offline detection.After a series of steps such as fragment extraction and fragment preprocessing,fragment matching,time constraint recognition and abnormal time-series detection,we completed the time-series anomaly detection.Finally,we achieved anomaly detection for multi-variable time sequences of embedded software.Experimental results proved that the proposed method can get a high ROC curve,a large MCC coefficient and a small loss function.