Method, device, and computer program product for anomaly detection for storage system

1 . A method for anomaly detection for a storage system, comprising:

acquiring a plurality of attribute values of a plurality of volume data block entries;

clustering a first portion of the plurality of volume data block entries into a homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries; and

determining a second portion of the plurality of volume data block entries that are not clustered into the homogeneous pool as anomalous entries.

2 . The method according to claim 1 , wherein the plurality of attribute values of the plurality of volume data block entries comprise a first value of an attribute of a first volume data block entry and a second value of the attribute of a second volume data block entry, and clustering the first portion of the plurality of volume data block entries into the homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries comprises:

transforming the first value to a third value based on a type of the attribute;

transforming the second value to a fourth value based on the type of the attribute, wherein a difference between the third value and the fourth value is greater than a difference between the first value and the second value; and

clustering one or both of the first volume data block entry and the second volume data block entry into the homogeneous pool based on the third value and the fourth value.

3 . The method according to claim 1 , wherein clustering the first portion of the plurality of volume data block entries into the homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries comprises:

determining a first volume data block entry of the plurality of volume data block entries as an anchor entry;

creating a candidate homogeneous pool based on the anchor entry;

determining the homogeneous pool based on the candidate homogeneous pool and a third portion of the plurality of volume data block entries; and

clustering a fourth portion of the plurality of volume data block entries into the homogeneous pool based on a plurality of attribute values of the fourth portion, wherein the first portion comprises the fourth portion and at least part of the third portion.

4 . The method according to claim 3 , wherein determining the homogeneous pool based on the candidate homogeneous pool and the third portion of the plurality of volume data block entries comprises:

determining a first density of the candidate homogeneous pool, the first density being indicative of a difference between a plurality of volume data block entries in the candidate homogeneous pool;

determining a second density of the candidate homogeneous pool if a second volume data block entry in the third portion is added to the candidate homogeneous pool;

determining, based on the first density and the second density of the candidate homogeneous pool, a density change of the candidate homogeneous pool if the second volume data block entry is added to the candidate homogeneous pool; and

determining the homogeneous pool based on the density change of the candidate homogeneous pool.

5 . The method according to claim 4 , wherein determining the homogeneous pool based on the density change of the candidate homogeneous pool comprises:

adding the second volume data block entry to the candidate homogeneous pool in response to the density change being greater than a predetermined density change threshold; and

determining the candidate homogeneous pool as the homogeneous pool in response to a number of volume data block entries in the candidate homogeneous pool being greater than a predetermined number threshold.

6 . The method according to claim 3 , wherein determining the second portion of the plurality of volume data block entries that is not clustered into the homogeneous pool as anomalous entries comprises:

determining, after determining the homogeneous pool, a density change of the homogeneous pool if a third volume data block entry of the plurality of volume data block entries is added to the homogeneous pool; and

determining the third volume data block entry as an anomalous entry in response to the density change of the homogeneous pool being greater than a predetermined density change threshold.

7 . The method according to claim 6 , further comprising:

determining, after determining the homogeneous pool, a first number of volume data block entries that are subsequently clustered into the homogeneous pool and a second number of volume data block entries that are not clustered into the homogeneous pool; and

re-establishing a new homogeneous pool by selecting a new anchor entry in response to a ratio of the first number to the second number being less than a predetermined ratio threshold.

8 . The method according to claim 1 , further comprising:

determining a total number of the plurality of volume data block entries;

splitting the plurality of volume data block entries into a first group of volume data block entries and a second group of volume data block entries in response to the total number being greater than a first predetermined total number threshold; and

detecting in parallel anomalous entries in the first group of volume data block entries and anomalous entries in the second group of volume data block entries.

9 . The method according to claim 8 , wherein detecting in parallel the anomalous entries in the first group of volume data block entries and the anomalous entries in the second group of volume data block entries comprises:

splitting the first group of volume data block entries into a third group of volume data block entries and a fourth group of volume data block entries; and

detecting serially anomalous entries in the third group of volume data block entries and anomalous entries in the fourth group of volume data block entries.

10 . The method according to claim 9 , wherein detecting serially the anomalous entries in the third group of volume data block entries and the anomalous entries in the fourth group of volume data block entries comprises:

determining the number of the anomalous entries in the third group of volume data block entries;

adding a portion of entries in the third group of volume data block entries to the fourth group of volume data block entries in response to the number of the anomalous entries in the third group of volume data block entries being less than a predetermined anomaly number threshold; and

detecting anomalous entries in the fourth group of volume data block entries.

11 . An electronic device, comprising:

at least one processor; and

a memory coupled to the at least one processor and having instructions stored thereon, the instructions, when executed by the at least one processor, causing the electronic device to perform actions comprising:

acquiring a plurality of attribute values of a plurality of volume data block entries;

clustering a first portion of the plurality of volume data block entries into a homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries; and

determining a second portion of the plurality of volume data block entries that are not clustered into the homogeneous pool as anomalous entries.

12 . The device according to claim 11 , wherein the plurality of attribute values of the plurality of volume data block entries comprise a first value of an attribute of a first volume data block entry and a second value of the attribute of a second volume data block entry, and clustering the first portion of the plurality of volume data block entries into the homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries comprises:

transforming the first value to a third value based on a type of the attribute;

transforming the second value to a fourth value based on the type of the attribute, wherein a difference between the third value and the fourth value is greater than a difference between the first value and the second value; and

clustering one or both of the first volume data block entry and the second volume data block entry into the homogeneous pool based on the third value and the fourth value.

13 . The device according to claim 11 , wherein clustering the first portion of the plurality of volume data block entries into the homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries comprises:

determining a first volume data block entry of the plurality of volume data block entries as an anchor entry;

creating a candidate homogeneous pool based on the anchor entry;

determining the homogeneous pool based on the candidate homogeneous pool and a third portion of the plurality of volume data block entries; and

clustering a fourth portion of the plurality of volume data block entries into the homogeneous pool based on a plurality of attribute values of the fourth portion, wherein the first portion comprises the fourth portion and at least part of the third portion.

14 . The device according to claim 13 , wherein determining the homogeneous pool based on the candidate homogeneous pool and the third portion of the plurality of volume data block entries comprises:

determining a first density of the candidate homogeneous pool, the first density being indicative of a difference between a plurality of volume data block entries in the candidate homogeneous pool;

determining a second density of the candidate homogeneous pool if a second volume data block entry in the third portion is added to the candidate homogeneous pool;

determining, based on the first density and the second density of the candidate homogeneous pool, a density change of the candidate homogeneous pool if the second volume data block entry is added to the candidate homogeneous pool; and

determining the homogeneous pool based on the density change of the candidate homogeneous pool.

15 . The device according to claim 14 , wherein determining the homogeneous pool based on the density change of the candidate homogeneous pool comprises:

adding the second volume data block entry to the candidate homogeneous pool in response to the density change being greater than a predetermined density change threshold; and

determining the candidate homogeneous pool as the homogeneous pool in response to a number of volume data block entries in the candidate homogeneous pool being greater than a predetermined number threshold.

16 . The device according to claim 13 , wherein determining the second portion of the plurality of volume data block entries that is not clustered into the homogeneous pool as anomalous entries comprises:

determining, after determining the homogeneous pool, a density change of the homogeneous pool if a third volume data block entry of the plurality of volume data block entries is added to the homogeneous pool; and

determining the third volume data block entry as an anomalous entry in response to the density change of the homogeneous pool being greater than a predetermined density change threshold.

17 . The device according to claim 16 , wherein the actions further comprise:

determining, after determining the homogeneous pool, a first number of volume data block entries that are subsequently clustered into the homogeneous pool and a second number of volume data block entries that are not clustered into the homogeneous pool; and

re-establishing a new homogeneous pool by selecting a new anchor entry in response to a ratio of the first number to the second number being less than a predetermined ratio threshold.

18 . The device according to claim 11 , wherein the actions further comprise:

determining a total number of the plurality of volume data block entries;

splitting the plurality of volume data block entries into a first group of volume data block entries and a second group of volume data block entries in response to the total number being greater than a first predetermined total number threshold; and

detecting in parallel anomalous entries in the first group of volume data block entries and anomalous entries in the second group of volume data block entries.

19 . The device according to claim 18 , wherein detecting in parallel the anomalous entries in the first group of volume data block entries and the anomalous entries in the second group of volume data block entries comprises:

splitting the first group of volume data block entries into a third group of volume data block entries and a fourth group of volume data block entries; and

detecting serially anomalous entries in the third group of volume data block entries and anomalous entries in the fourth group of volume data block entries.

20 . A computer program product having a non-transitory computer readable medium which stores a set of instructions to perform anomaly detection for a storage system; the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:

acquiring a plurality of attribute values of a plurality of volume data block entries;

clustering a first portion of the plurality of volume data block entries into a homogeneous pool based on the plurality of attribute values of the plurality of volume data block entries; and

determining a second portion of the plurality of volume data block entries that are not clustered into the homogeneous pool as anomalous entries.