CN117454196B - Anomaly detection method, device, equipment and medium based on time sequence prediction - Google Patents
Anomaly detection method, device, equipment and medium based on time sequence prediction Download PDFInfo
- Publication number
- CN117454196B CN117454196B CN202311508481.2A CN202311508481A CN117454196B CN 117454196 B CN117454196 B CN 117454196B CN 202311508481 A CN202311508481 A CN 202311508481A CN 117454196 B CN117454196 B CN 117454196B
- Authority
- CN
- China
- Prior art keywords
- data set
- processing
- shape transformation
- baseline
- original sequence
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 97
- 230000009466 transformation Effects 0.000 claims abstract description 150
- 238000012545 processing Methods 0.000 claims abstract description 107
- 230000008859 change Effects 0.000 claims abstract description 63
- 238000010606 normalization Methods 0.000 claims abstract description 20
- 230000002159 abnormal effect Effects 0.000 claims abstract description 15
- 238000007621 cluster analysis Methods 0.000 claims description 8
- 238000007781 pre-processing Methods 0.000 claims description 3
- 238000012216 screening Methods 0.000 claims description 3
- 230000005856 abnormality Effects 0.000 abstract description 14
- 238000000034 method Methods 0.000 description 23
- 230000006870 function Effects 0.000 description 11
- 238000004891 communication Methods 0.000 description 9
- 230000008569 process Effects 0.000 description 9
- 238000006243 chemical reaction Methods 0.000 description 8
- 230000003068 static effect Effects 0.000 description 6
- 238000013459 approach Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 238000012544 monitoring process Methods 0.000 description 5
- 238000012423 maintenance Methods 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000035945 sensitivity Effects 0.000 description 3
- 230000001133 acceleration Effects 0.000 description 2
- 230000002776 aggregation Effects 0.000 description 2
- 238000004220 aggregation Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000005484 gravity Effects 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000005236 sound signal Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 238000012790 confirmation Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000010897 surface acoustic wave method Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2123/00—Data types
- G06F2123/02—Data types in the time domain, e.g. time-series data
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Cheminformatics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Probability & Statistics with Applications (AREA)
- Debugging And Monitoring (AREA)
Abstract
The application discloses an anomaly detection method based on time sequence prediction, which comprises the steps of obtaining an original sequence data set to be detected abnormally, the original sequence data set and a historical time threshold; according to the historical time threshold, carrying out data prediction processing on the original sequence data set to obtain a baseline data set; performing normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set; performing shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set; performing benchmarking processing on the shape transformation data set to obtain a benchmarking change set; and detecting the shape transformation data set according to all the reference variable quantities to obtain an abnormal detection result. The abnormality detection method can reduce the abnormality false alarm phenomenon and the personnel workload of the service and effectively improve the accuracy of the abnormality alarm of the service. The application can be widely applied to the technical field of operation and data processing.
Description
Technical Field
The application relates to the technical field of operation and data processing, in particular to an anomaly detection method, device, equipment and medium based on time sequence prediction.
Background
In recent years, with the vigorous development of internet technology, users access the internet through terminals to handle various services more and more commonly, the service scale continues to grow at a high speed, the service iteration is fast, the logic is complex, the associated services are more, and when an abnormal condition occurs in a certain service, the service system is very easy to fail or crash, so that the service index abnormal detection technology is increasingly focused by related personnel.
At present, in the traditional anomaly detection model, the monitoring threshold value of each service index is a static threshold value, and a false alarm phenomenon often occurs when the service is in normal operation, so that service developers lose sensitivity to anomaly alarms in daily operation and maintenance, and the false alarm rate is higher; in addition, because the monitoring threshold value of each service index is a static threshold value, the workload of independently setting the static threshold value for each index by service developers is high, and the labor cost is high; in addition, the phenomenon of false alarm is very easy to occur when the traditional anomaly detection model has the phenomenon of data fluctuation of data magnitude.
Accordingly, there is a need for solving and optimizing the problems associated with the prior art.
Disclosure of Invention
In order to solve at least one of the technical problems, the application provides an anomaly detection method, an anomaly detection device, anomaly detection equipment and an anomaly detection medium based on time sequence prediction, wherein the anomaly detection method can effectively reduce the phenomenon of abnormal false alarm of a service, effectively improve the accuracy of service abnormal alarm and effectively reduce the workload of personnel.
According to a first aspect of the present application, there is provided an anomaly detection method based on timing prediction, comprising:
acquiring an original sequence data set to be detected abnormally and a preset historical time threshold, wherein the original sequence data set comprises a plurality of original sequence data;
According to the historical time threshold, carrying out data prediction processing on the original sequence data set to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence;
Performing normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities, and the sequence similarities are used for recording the similarity between the baseline data and the corresponding original sequence data;
Performing shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording shape transformation amounts between all the baseline data and the corresponding original sequence data;
Performing benchmarking processing on the shape transformation data set to obtain a benchmark variation set, wherein the benchmark variation set comprises a plurality of benchmark variation amounts;
And detecting the shape transformation data set according to all the reference variable amounts to obtain an abnormal detection result corresponding to the original sequence data set.
Further, in an embodiment of the present application, the performing data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set includes:
Acquiring a preset confidence interval;
screening the original sequence data set according to the historical time threshold to obtain a first basic data set;
According to the confidence interval, carrying out data preprocessing on the first basic data set to obtain a second basic data set;
And carrying out time sequence prediction processing on the second basic data set to obtain the baseline data set.
Further, in an embodiment of the present application, the normalizing and similarity processing is performed on the original sequence data set according to the baseline data set to obtain a similar sequence data set, including:
performing first normalization processing on the baseline data set to obtain a first intermediate data set;
Performing second normalization processing on the original sequence data set to obtain a second intermediate data set;
And carrying out cosine similarity processing on the first intermediate data set and the second intermediate data set to obtain the similar sequence data set.
Further, in an embodiment of the present application, the performing shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformed data set includes:
Determining the current sequence similarity corresponding to the current baseline data and the current original sequence data according to the current baseline data in the baseline data set;
Performing deviation processing on the current baseline data and the current original sequence data to obtain a first difference value;
performing product processing on the first difference value according to the similarity of the current sequence to obtain the shape transformation quantity;
returning to the step of determining the current sequence similarity corresponding to the current baseline data according to the current baseline data in the baseline data and the step of determining the current original sequence data until all baseline data in the baseline data set are processed;
and integrating all the shape transformation quantities to obtain the shape transformation data set.
Further, in an embodiment of the present application, the performing a benchmarking process on the shape transformation data set to obtain a benchmarking change set includes:
performing variable point detection processing on the shape transformation data set to obtain a variable point detection result;
and carrying out cluster analysis processing on the shape transformation data set according to the change point detection result to obtain the reference change set.
Further, in an embodiment of the present application, the performing cluster analysis processing on the shape transformation dataset according to the change point detection result to obtain the reference change set includes:
if the change point detection result is negative, performing first clustering treatment on the shape transformation data set to obtain a plurality of first clustering clusters;
and carrying out second average processing on each first cluster to obtain the reference change set.
Further, in an embodiment of the present application, the performing cluster analysis processing on the shape transformation dataset according to the change point detection result to obtain the reference change set includes:
if the change point detection result is yes, a preset sequence threshold value is obtained;
performing secondary transformation processing on the shape transformation data set according to the sequence threshold value to obtain a second transformation data set;
performing second clustering on the second transformation data set to obtain a plurality of second clustering clusters;
and carrying out second average processing on each second cluster to obtain the reference change set.
According to a second aspect of the present application, there is provided an abnormality detection system based on timing prediction, comprising:
the acquisition module is used for acquiring an original sequence data set to be detected abnormally and a preset historical time threshold value, wherein the original sequence data set comprises a plurality of original sequence data;
The prediction module is used for carrying out data prediction processing on the original sequence data set according to the historical time threshold value to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence;
The similarity module is used for carrying out normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities, and the sequence similarities are used for recording the similarities between the baseline data and the corresponding original sequence data;
The transformation module is used for carrying out shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording the shape transformation quantity between all the baseline data and the corresponding original sequence data;
The reference module is used for carrying out reference processing on the shape transformation data set to obtain a reference change set, and the reference change set comprises a plurality of reference change amounts;
And the detection module is used for carrying out detection processing on the shape transformation data set according to all the reference variable quantities to obtain an abnormal detection result corresponding to the original sequence data set.
According to a third aspect of the present application, there is provided a computer device comprising:
At least one processor;
At least one memory for storing at least one program;
the at least one program, when executed by the at least one processor, causes the at least one processor to implement the method as described in the above aspects.
According to a fourth aspect of the present application there is provided a computer readable storage medium having stored therein a processor executable program which when executed by the processor is for carrying out the method as described in the above aspects.
The technical scheme provided by the embodiment of the application has the beneficial effects that:
the application provides an anomaly detection method based on time sequence prediction, which comprises the following steps: acquiring an original sequence data set to be detected abnormally and a preset historical time threshold, wherein the original sequence data set comprises a plurality of original sequence data; according to the historical time threshold, carrying out data prediction processing on the original sequence data set to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence; performing normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities which are used for recording the similarity between the baseline data and the corresponding original sequence data; performing shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording all the baseline data and performing benchmark processing on the shape transformation data set by the shape transformation quantity between the shape transformation data set and the corresponding original sequence data to obtain a benchmark change set, and the benchmark change set comprises a plurality of benchmark change quantities; and detecting the shape transformation data set according to all the reference variable amounts to obtain an abnormal detection result corresponding to the original sequence data set. The abnormality detection method can effectively reduce the abnormality false alarm phenomenon of the service, effectively improve the accuracy of service abnormality alarm and effectively reduce the workload of personnel.
Drawings
FIG. 1 is a flowchart of an anomaly detection method based on time sequence prediction according to an embodiment of the present application;
FIG. 2 is a logic schematic diagram of an anomaly detection method based on time sequence prediction according to an embodiment of the present application;
fig. 3 is a detailed flowchart of step S102 according to an embodiment of the present application;
Fig. 4 is a detailed flowchart of step S103 according to an embodiment of the present application;
Fig. 5 is a detailed flowchart of step S104 according to an embodiment of the present application;
Fig. 6 is a detailed flowchart of step S105 according to an embodiment of the present application;
Fig. 7 is a detailed flowchart of a first step S1052 provided in an embodiment of the present application;
Fig. 8 is a detailed flowchart of a second step S1052 provided in an embodiment of the present application;
FIG. 9 is a block diagram of an anomaly detection system based on timing prediction according to an embodiment of the present application;
fig. 10 is a block diagram of a computer device according to an embodiment of the present application.
Detailed Description
The application will be further described with reference to the drawings and specific examples. The described embodiments should not be taken as limitations of the present application, and all other embodiments that would be obvious to one of ordinary skill in the art without making any inventive effort are intended to be within the scope of the present application.
In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is to be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with one another without conflict.
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of the application only and is not intended to be limiting of the application.
At present, in the traditional anomaly detection model, the monitoring threshold value of each service index is a static threshold value, and a false alarm phenomenon often occurs when the service is in normal operation, so that service developers lose sensitivity to anomaly alarms in daily operation and maintenance, and the false alarm rate is higher; in addition, because the monitoring threshold value of each service index is a static threshold value, the workload of independently setting the static threshold value for each index by service developers is high, and the labor cost is high; in addition, the phenomenon of false alarm is very easy to occur when the traditional anomaly detection model has the phenomenon of data fluctuation of data magnitude.
In view of the above, the embodiments of the present application provide an anomaly detection method, apparatus, device, and medium based on time sequence prediction, where the anomaly detection method can effectively reduce the phenomenon of abnormal false alarm of a service, effectively improve the accuracy of service anomaly alarm, and effectively reduce the workload of personnel.
The embodiment of the application provides an abnormality detection method, a system, a device and a medium based on time sequence prediction, which can be specifically described by the following embodiment.
The anomaly detection method based on time sequence prediction provided by the embodiment of the application can be applied to a running data processing (cloud service) application scene. In the operation and maintenance data processing application scene, operation and maintenance personnel can perform abnormality detection on the service through the abnormality detection method provided by the embodiment of the application, so that the abnormality false alarm phenomenon of the service can be effectively reduced, the accuracy of service abnormality alarm can be effectively improved, and the workload of personnel can be effectively reduced.
The application is operational with numerous general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
It should be noted that, in each specific embodiment of the present application, when related processing is required according to user information, user behavior data, user history data, user location information, and other data related to user identity or characteristics, permission or consent of the user is obtained first, and the collection, use, processing, and the like of the data comply with related laws and regulations and standards. In addition, when the embodiment of the application needs to acquire the sensitive personal information of the user, the independent permission or independent consent of the user is acquired through popup or jump to a confirmation page and the like, and after the independent permission or independent consent of the user is definitely acquired, the necessary relevant data of the user for enabling the embodiment of the application to normally operate is acquired.
Referring to fig. 1 and 2, fig. 1 is an optional flowchart of an anomaly detection method based on timing prediction according to an embodiment of the present application, which may include, but is not limited to, steps S101 to S106.
Step S101, acquiring an original sequence data set to be detected abnormally and a preset historical time threshold, wherein the original sequence data set comprises a plurality of original sequence data;
In the embodiment of the application, the original sequence data set can be derived from multi-dimensional log files such as a service index log, a system index log, an application index log and the like in each service system, after the multi-dimensional log files are acquired, time sequence information is added according to the log types of the log files, the added log files are sent to a kafka message queue, the time sequence information is taken as a time transverse axis to analyze the original sequence data in a JSON format, and then a plurality of original sequence data are integrated to be used as the original sequence data set. The specific value of the historical time threshold may be set according to the actual requirement, and may specifically be any one of 3 days, 5 days, 7 days, 10 days, etc., and the present application is merely illustrated and not limited in any way. It should be noted that, in the embodiment of the present application, the historical time threshold is described as 7 days.
Step S102, according to the historical time threshold, carrying out data prediction processing on the original sequence data set to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence;
Referring to fig. 3, in the step S102, according to the historical time threshold, data prediction processing is performed on the original sequence data set to obtain a baseline data set, including:
s1021, acquiring a preset confidence interval;
step S1022, screening the original sequence data set according to the historical time threshold to obtain a first basic data set;
Step S1023, carrying out data preprocessing on the first basic data set according to the confidence interval to obtain a second basic data set;
And step S1024, performing time sequence prediction processing on the second basic data set to obtain the baseline data set.
It may be appreciated that the confidence interval may be a preset interval, or may be an estimated interval calculated according to the original sequence data set or the first basic data set; according to the method and the device, an original sequence data set of 7 days in the past can be inquired through a search engine in a business system according to a historical time threshold, and the inquired sequence data set is used as a first basic data set; then, according to the confidence interval, the first basic data outside the confidence interval is removed, and the missing value is filled to obtain a second basic data set; then, the time series prediction is performed based on the second basic data set, and the data series prediction on the second basic data set may be implemented by a time series data prediction (propset) algorithm, which is not described herein in detail.
Step S103, performing normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities, and the sequence similarities are used for recording the similarities between the baseline data and the corresponding original sequence data;
referring to fig. 4, in step S103, normalization and similarity processing is performed on the original sequence data set according to the baseline data set to obtain a similar sequence data set, including:
Step S1031, performing first normalization processing on the baseline data set to obtain a first intermediate data set;
Step S1032, performing a second normalization process on the original sequence data set to obtain a second intermediate data set;
and step 1033, performing cosine similarity processing on the first intermediate data set and the second intermediate data set to obtain the similar sequence data set.
In the embodiment of the application, the baseline data set and the original sequence data set can be firstly determined to contain data points with the same length (namely, each baseline data corresponds to one original sequence data), and then the baseline data set and the original sequence data set are normalized by any one normalization method of extremum normalization (Min-max normalization), average normalization (Mean normalization) and the like, so as to obtain a first intermediate data set and a second intermediate data set; and then, calculating cosine similarity between the first intermediate data set and the second intermediate data set to obtain a plurality of sequence similarity, wherein the sequence similarity is used for recording similarity between each baseline data and corresponding original sequence data, and then forming a similar sequence data set from the plurality of sequence similarity according to time sequence.
Illustratively, the equivalent formula for the similarity between the first intermediate data set and the second intermediate data set may be expressed as:
Where similarity is the set of sequence similarities (i.e., similar sequence data set), A is the first intermediate data set, B is the second intermediate data set, dot_product (A, B) is the dot product of the first intermediate data set and the second intermediate data set, norm (A) is the norm of the first intermediate data set, and norm (B) is the norm of the second intermediate data set.
Step S104, carrying out shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording the shape transformation quantity between all the baseline data and the corresponding original sequence data;
Referring to fig. 5, in the step S104, a shape transformation process is performed on the original sequence data set and the baseline data set according to the similar sequence data set, to obtain a shape transformed data set, including:
Step S1041, determining a current sequence similarity corresponding to the current baseline data and current original sequence data according to the current baseline data in the baseline data set;
step S1042, performing deviation processing on the current baseline data and the current original sequence data to obtain a first difference value;
step S1043, performing product processing on the first difference value according to the similarity of the current sequence to obtain the shape transformation quantity;
Step S1044, returning to the step of determining the similarity of the current sequence corresponding to the current baseline data and the current original sequence data according to the current baseline data in the baseline data until all the baseline data in the baseline data set are processed;
Step S1045, performing an integration process on all the shape transformation amounts to obtain the shape transformation dataset.
In the embodiment of the application, the similar sequence data set can be used as a weight, so that the data magnitude based on the time sequence is provided for the original sequence data set and/or the baseline data set, and the influence of the data magnitude on the service index is eliminated. Specifically, first, baseline data, original sequence data, and corresponding sequence similarity at the current time point may be determined; then, calculating an absolute difference value between the baseline data and the original sequence data, and taking the calculated absolute difference value as a first difference value; and then, carrying out product processing on the first difference value according to the complement of the similarity of the current sequence to obtain the shape transformation quantity at the current time point. After the shape transformation amount at the current time point is obtained, steps S1041 to S1044 may be looped until the shape transformation amounts at all time points have been obtained, and the loop is exited, and all the obtained shape transformation amounts are combined to obtain the shape transformation data set.
It should be noted that, since each baseline data is processed to generate a corresponding shape transformation amount, the loop exit condition in step S1044 is substantially equal to that all the baseline data in the baseline data set have been processed, and the application will not be described herein in detail. It should be noted that the equivalent formula of the shape transformation amount can be expressed as:
svi＝(1-similarityi)×|Xi-Yi|
wherein sv i is the i-th shape change amount, similarity i is the i-th sequence similarity, X i is the i-th baseline data in the baseline data set, and Y i is the i-th original sequence data in the original sequence data set.
Step S105, performing benchmarking processing on the shape transformation data set to obtain a benchmark variation set, wherein the benchmark variation set comprises a plurality of benchmark variation amounts;
referring to fig. 6, the step S105 of referencing the shape conversion data set to obtain a reference change set includes:
step S1051, performing variable point detection processing on the shape transformation data set to obtain a variable point detection result;
In the embodiment of the present application, the change point is an abnormal point in the shape transformation data set where the shape transformation amount approaches 0 or equal to 0, and the change point detection result is used to record whether each shape transformation amount is a change point in the shape transformation data set. Specifically, a shape threshold or a difference threshold may be preset, and the change point detection of each shape transformation amount in the shape transformation dataset is implemented through the shape threshold or the difference threshold.
It is to be understood that the change point detection processing described in the embodiment of the present application may be implemented in two ways, the first way is to judge whether the shape conversion amount approaches 0 or equal to 0 through the shape threshold value, when the shape conversion amount is equal to or smaller than the shape threshold value, the change point detection result is yes, and when the shape conversion amount is larger than the shape threshold value, the change point detection result is no. The second mode is a mode of judging whether the shape conversion amount approaches 0 or equal to 0 through a difference threshold, when the first difference is smaller than or equal to the difference threshold, the change point detection result is yes, and when the first difference is larger than the difference threshold, the change point detection result is no.
It should be noted that, since the shape transformation amount in the embodiment of the present application is the product of the first difference value and the sequence similarity, when the first difference value approaches 0 or equal to 0, the shape transformation amount also approaches 0 or equal to 0; in addition, specific values of the difference threshold and the shape threshold may be set according to actual situations, and the present application will not be described herein in detail.
Step S1052, performing cluster analysis processing on the shape transformation dataset according to the change point detection result, to obtain the reference change set.
Referring to fig. 7, in the step S1052, the clustering analysis is performed on the shape transformation dataset according to the change point detection result to obtain the reference change set, including:
Step S10521, if the change point detection result is no, performing a first clustering process on the shape transformation dataset to obtain a plurality of first clusters;
and step S10522, performing second mean processing on each first cluster to obtain the reference change set.
In the embodiment of the application, when the change point detection result is no, it is indicated that all the shape transformation amounts in the shape transformation data set do not belong to the change point, at this time, each shape transformation amount can be correspondingly used as one sample data, histogram statistics is performed on distance values between the sample data, any one of clustering algorithms such as K-Means (K-Means) clustering, density (Dbscan) clustering, mean shift (MEAN SHIFT) clustering and the like is used to obtain a plurality of clusters, and then the mean value of each first cluster is calculated to obtain a plurality of reference variation amounts, and all the reference variation amounts are combined into a reference variation set.
Referring to fig. 8, in the step S1052, the clustering analysis is performed on the shape transformation dataset according to the change point detection result to obtain the reference change set, including:
step S10525, if the change point detection result is yes, acquiring a preset sequence threshold;
Step S10526, performing secondary transformation processing on the shape transformation data set according to the sequence threshold value to obtain a second transformation data set;
S10527, performing second aggregation processing on the second transformation data set to obtain a plurality of second aggregation clusters;
and step S10528, performing second mean processing on each second cluster to obtain the reference change set.
In the embodiment of the application, when the detection result of the variable point is yes, it is explained that part of the shape transformation amount in the shape transformation data set belongs to the variable point, at this time, the shape transformation amount belonging to the variable point can be determined first, then adjacent data corresponding to the shape transformation amount belonging to the variable point is determined according to the sequence threshold, and the shape transformation amount belonging to the variable point is compensated according to the adjacent data, so as to obtain the compensated shape transformation amount. After compensating all the shape transformation amounts belonging to the transformation points, combining the normal shape transformation amounts in the shape transformation data set with the compensated shape transformation amounts to obtain a second transformation data set.
For example, when the sequence threshold is 1, that is, when the previous shape conversion amount belonging to the shape conversion amount of the variable point is selected as the adjacent data, an equivalent formula of compensating the shape conversion amount belonging to the variable point according to the adjacent data can be expressed as:
Wherein, For the compensated shape transformation amount, similarity i is the i-th sequence similarity, sv i-1 is the i-1-th shape transformation amount, and sv i is the i-th shape transformation amount.
It can be understood that the specific value of the sequence threshold can be set according to the actual situation, in addition, the sequence threshold can be used for representing a time unit, for example, if the sequence threshold is 1, the shape transformation amount of the previous minute of the shape transformation amount belonging to the transformation point can be selected as the adjacent data, and the application is only illustrated, so that the actual requirement can be met. It should be noted that, the steps S10527 and S10528 are similar to the steps S10521 and S10522 described above, and so on, and the present application is not described in detail herein.
And step S106, detecting the shape transformation data set according to all the reference variable amounts to obtain an abnormality detection result corresponding to the original sequence data set.
In the embodiment of the present application, since the reference variation amounts are clustering results corresponding to the shape transformation data set or the second transformation data set, each reference variation amount may be used as an abnormality threshold corresponding to the original sequence data set and in multiple levels. Specifically, taking a density clustering algorithm as an example for clustering, three clusters can be obtained by setting the minimum sample number MinPts to 3, and then three reference change amounts are determined according to the obtained three clusters, which can be used as abnormal thresholds of a notification level, a risk level and a disaster level.
It should be noted that, in the embodiment of the present application, the shape transformation dataset may have a plurality of states, which may be a shape transformation dataset directly obtained after the shape transformation processing, or may be a second transformation dataset obtained after the secondary transformation processing (the set of events may be that the shape transformation dataset is detected by the detection processing of the shape transformation dataset, or may be that the shape transformation dataset directly obtained after the shape transformation processing is detected by the detection processing of the second transformation dataset obtained after the secondary transformation processing), and when a situation that the amount of change is larger than the reference amount occurs in the two ways, an alarm may be given according to a specific level.
In conclusion, the anomaly detection method based on time sequence prediction provided by the application can dynamically regulate and control the anomaly threshold according to the input data, and has high convenience; the dimension difference between the data jitter factor and different data characteristics is eliminated through the transformation quantity, so that the accuracy and stability of anomaly detection can be effectively improved, and the error notification phenomenon caused by dimension sensitivity in the detection process can be effectively reduced; and by means of variable point detection, compensation of abnormal points of data is achieved, and accuracy and instantaneity of abnormal detection can be further improved.
Fig. 9 is a schematic frame diagram of an anomaly detection system based on time sequence prediction according to an embodiment of the present application, including:
an obtaining module 310, configured to obtain an original sequence data set to be detected abnormally, and an original sequence data set, where the original sequence data set includes a plurality of original sequence data, and a preset historical time threshold;
the prediction module 320 is configured to perform data prediction processing on the original sequence data set according to the historical time threshold value, so as to obtain a baseline data set, where the baseline data set includes a plurality of baseline data, and each baseline data corresponds to a different time sequence;
A similarity module 330, configured to perform normalization and similarity processing on the original sequence data set according to the baseline data set, so as to obtain a similar sequence data set, where the similar sequence data set includes a plurality of sequence similarities, and the sequence similarities are used to record the similarity between the baseline data and the corresponding original sequence data;
The transformation module 340 is configured to perform shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set, so as to obtain a shape transformation data set, where the shape transformation data set is used to record shape transformation amounts between all the baseline data and the corresponding original sequence data;
A reference module 350, configured to perform a referencing process on the shape transformation data set to obtain a reference change set, where the reference change set includes a plurality of reference change amounts;
And the detection module 360 is configured to perform detection processing on the shape transformation dataset according to all the reference variation amounts, so as to obtain an anomaly detection result corresponding to the original sequence dataset. It can be understood that the content in the above method embodiment is applicable to the system embodiment, and the functions specifically implemented by the system embodiment are the same as those of the above method embodiment, and the achieved beneficial effects are the same as those of the above method embodiment.
Fig. 10 is a schematic structural diagram of a computer device according to an embodiment of the present application, including:
At least one processor 980;
at least one memory 920 for storing at least one program;
the at least one program, when executed by the at least one processor 980, causes the at least one processor 980 to implement the methods as described in the various embodiments previously discussed.
Embodiments of the present application also provide a computer-readable storage medium in which a processor-executable program is stored, which when executed by the processor 980 is configured to implement the methods according to the foregoing embodiments.
In particular, the computer device may be a user terminal or a server, as shown in fig. 10.
The embodiment of the application takes the example that the computer equipment is a user terminal as follows:
As shown in fig. 10, the computer device 900 may include RF (Radio Frequency) circuitry 910, memory 920 including one or more computer-readable storage media, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a WiFi module 970, a processor 980 including one or more processing cores, and a power supply 990. It will be appreciated by those skilled in the art that the device structure shown in fig. 10 is not limiting of the electronic device and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.
The RF circuit 910 may be used for receiving and transmitting signals during a message or a call, and in particular, after receiving downlink information of a base station, the downlink information is processed by one or more processors 980; in addition, data relating to uplink is transmitted to the base station. Typically, the RF circuitry 910 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier ), a duplexer, and the like. In addition, the RF circuitry 910 may also communicate with networks and other devices via wireless communications. The wireless communication may use any communication standard or protocol including, but not limited to, GSM (Global System of Mobile communication, global system for mobile communications), GPRS (GENERAL PACKET Radio Service), CDMA (Code Division Multiple Access ), WCDMA (Wideband Code Division Multiple Access, wideband code division multiple access), LTE (Long Term Evolution ), email, SMS (Short MESSAGING SERVICE), short message Service), and the like.
Memory 920 may be used to store software programs and modules. Processor 980 performs various functional applications and data processing by executing software programs and modules stored in memory 920. The memory 920 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program (such as a sound playing function, an image playing function, etc.) required for at least one function, and the like; the storage data area may store data created according to the use of the device 900 (such as audio data, phonebooks, etc.), and the like. In addition, memory 920 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory 920 may also include a memory controller to provide access to memory 920 by processor 980 and input unit 930. While fig. 10 shows RF circuitry 910, it is to be understood that it is not a necessary component of device 900 and may be omitted entirely as desired without changing the essence of the invention.
The input unit 930 may be used to receive input numeric or character information and to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control. In particular, the input unit 930 may comprise a touch-sensitive surface 932 and other input devices 931. The touch-sensitive surface 932, also referred to as a touch display screen or a touch pad, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on the touch-sensitive surface 932 or thereabout using any suitable object or accessory such as a finger, stylus, etc.), and actuate the corresponding connection device according to a predetermined program. Alternatively, the touch-sensitive surface 932 may include both a touch-detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 980, and can receive commands from the processor 980 and execute them. In addition, the touch-sensitive surface 932 may be implemented in a variety of types, such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch-sensitive surface 932, the input unit 930 may also comprise other input devices 931. In particular, other input devices 931 may include, but are not limited to, one or more of a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, mouse, joystick, etc.
The display unit 940 may be used to display information entered by a user or information provided to a user and various graphical user interfaces of the control 900, which may be composed of graphics, text, icons, video and any combination thereof. The display unit 940 may include a display panel 941, and alternatively, the display panel 941 may be configured in the form of an LCD (Liquid CRYSTAL DISPLAY), an OLED (Organic Light-Emitting Diode), or the like. Further, the touch sensitive surface 932 may be overlaid on the display panel 941, and upon detection of a touch operation thereon or thereabout by the touch sensitive surface 932, the touch sensitive surface 932 is passed to the processor 980 to determine a type of touch event, and the processor 980 then provides a corresponding visual output on the display panel 941 based on the type of touch event. Although in fig. 10 the touch-sensitive surface 932 and the display panel 941 are implemented as two separate components for input and output functions, in some embodiments the touch-sensitive surface 932 may be integrated with the display panel 941 to implement input and output functions.
The computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor that may adjust the brightness of the display panel 941 according to the brightness of ambient light, and a proximity sensor that may turn off the display panel 941 and/or the backlight when the device 900 is moved to the ear. As one of the motion sensors, the gravity acceleration sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and the direction when the mobile phone is stationary, and can be used for applications of recognizing the gesture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometer and knocking), and the like; other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc. that may also be configured with the device 900 are not described in detail herein.
Audio circuitry 960, speaker 961, microphone 962 may provide an audio interface between a user and device 900. Audio circuit 960 may transmit the received electrical signal converted from audio data to speaker 961, where it is converted to a sound signal by speaker 961 for output; on the other hand, microphone 962 converts the collected sound signals into electrical signals, which are received by audio circuit 960 and converted into audio data, which are processed by audio data output processor 980 for transmission to another control device via RF circuit 910 or for output to memory 920 for further processing. Audio circuitry 960 may also include an ear bud jack to provide communication of peripheral headphones with device 900.
The device 900 may communicate information with a wireless transmission module provided on the combat device via the WiFi module 970.
Processor 980 is a control center for device 900, connecting various portions of the overall control device using various interfaces and wiring, performing various functions of device 900 and processing data by running or executing software programs and/or modules stored in memory 920, and invoking data stored in memory 920, thereby performing overall monitoring of the control device. Optionally, processor 980 may include one or more processing cores; alternatively, processor 980 may integrate an application processor with a modem processor, where the application processor primarily handles operating systems, user interfaces, applications programs, etc., and the modem processor primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 950.
The device 900 also includes a power source 990 (e.g., a battery) that provides power to the various components, preferably in logical communication with the processor 980 through a power management system, for managing charge, discharge, and power consumption by the power management system. The power source 990 may also include one or more of any components, such as a direct current or alternating current power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
Although not shown, the device 900 may also include a camera, a bluetooth module, etc., which will not be described in detail herein.
Embodiments of the present application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the method described in the foregoing embodiments.
The terms "first," "second," "third," "fourth," and the like in the description of the application and in the above figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented, for example, in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.
It should be understood that in the present application, "at least one (item)" means one or more, and "a plurality" means two or more. "and/or" for describing the association relationship of the association object, the representation may have three relationships, for example, "a and/or B" may represent: only a, only B and both a and B are present, wherein a, B may be singular or plural. The character "/" generally indicates that the context-dependent object is an "or" relationship. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b or c may represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, c may be single or plural.
In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in whole or in part in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory RAM), a magnetic disk, or an optical disk, etc., which can store program codes.
The step numbers in the above method embodiments are set for convenience of illustration, and the order of steps is not limited in any way, and the execution order of the steps in the embodiments may be adaptively adjusted according to the understanding of those skilled in the art.
While the preferred embodiment of the present application has been described in detail, the present application is not limited to the embodiments described above, and various equivalent modifications and substitutions can be made by those skilled in the art without departing from the spirit of the present application, and these equivalent modifications and substitutions are intended to be included in the scope of the present application as defined in the appended claims.
Claims (8)
1. An anomaly detection method based on time sequence prediction, comprising the following steps:
Acquiring an original sequence data set to be detected abnormally and a preset historical time threshold, wherein the original sequence data set comprises a plurality of original sequence data; the original sequence data set is obtained based on log files analyzed horizontally and vertically in time;
According to the historical time threshold, carrying out data prediction processing on the original sequence data set to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence;
Performing normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities which are used for recording the similarity between the baseline data and the corresponding original sequence data;
Performing shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording shape transformation amounts between all the baseline data and the corresponding original sequence data;
Performing benchmarking processing on the shape transformation data set to obtain a benchmark variation set, wherein the benchmark variation set comprises a plurality of benchmark variation amounts;
Detecting the shape transformation data set according to all the reference variable amounts to obtain an abnormal detection result corresponding to the original sequence data set;
the processing of the shape transformation of the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set comprises the following steps:
Determining the current sequence similarity corresponding to the current baseline data and the current original sequence data according to the current baseline data in the baseline data set;
Performing deviation processing on the current baseline data and the current original sequence data to obtain a first difference value;
performing product processing on the first difference value according to the similarity of the current sequence to obtain the shape transformation quantity;
returning to the step of determining the current sequence similarity corresponding to the current baseline data according to the current baseline data in the baseline data and the step of determining the current original sequence data until all baseline data in the baseline data set are processed;
integrating all the shape transformation quantities to obtain the shape transformation data set;
The step of performing benchmarking processing on the shape transformation data set to obtain a benchmarking change set includes:
performing variable point detection processing on the shape transformation data set to obtain a variable point detection result;
and carrying out cluster analysis processing on the shape transformation data set according to the change point detection result to obtain the reference change set.
2. The anomaly detection method based on time sequence prediction according to claim 1, wherein the performing data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set includes:
Acquiring a preset confidence interval;
screening the original sequence data set according to the historical time threshold to obtain a first basic data set;
According to the confidence interval, carrying out data preprocessing on the first basic data set to obtain a second basic data set;
And carrying out time sequence prediction processing on the second basic data set to obtain the baseline data set.
3. The anomaly detection method based on time sequence prediction according to claim 1, wherein the normalizing and similarity processing is performed on the original sequence data set according to the baseline data set to obtain a similar sequence data set, comprising:
performing first normalization processing on the baseline data set to obtain a first intermediate data set;
Performing second normalization processing on the original sequence data set to obtain a second intermediate data set;
And carrying out cosine similarity processing on the first intermediate data set and the second intermediate data set to obtain the similar sequence data set.
4. The anomaly detection method based on time sequence prediction according to claim 1, wherein the performing cluster analysis processing on the shape transformation dataset according to the change point detection result to obtain the reference change set includes:
if the change point detection result is negative, performing first clustering treatment on the shape transformation data set to obtain a plurality of first clustering clusters;
and carrying out second average processing on each first cluster to obtain the reference change set.
5. The anomaly detection method based on time sequence prediction according to claim 1, wherein the performing cluster analysis processing on the shape transformation dataset according to the change point detection result to obtain the reference change set includes:
if the change point detection result is yes, a preset sequence threshold value is obtained;
performing secondary transformation processing on the shape transformation data set according to the sequence threshold value to obtain a second transformation data set;
performing second clustering on the second transformation data set to obtain a plurality of second clustering clusters;
and carrying out second average processing on each second cluster to obtain the reference change set.
6. An anomaly detection system based on timing prediction, comprising:
the acquisition module is used for acquiring an original sequence data set to be detected abnormally and a preset historical time threshold value, wherein the original sequence data set comprises a plurality of original sequence data; the original sequence data set is obtained based on log files analyzed horizontally and vertically in time;
The prediction module is used for carrying out data prediction processing on the original sequence data set according to the historical time threshold value to obtain a baseline data set, wherein the baseline data set comprises a plurality of baseline data, and each baseline data corresponds to a different time sequence;
The similarity module is used for carrying out normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, wherein the similar sequence data set comprises a plurality of sequence similarities, and the sequence similarities are used for recording the similarities between the baseline data and the corresponding original sequence data;
The transformation module is used for carrying out shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, wherein the shape transformation data set is used for recording the shape transformation quantity between all the baseline data and the corresponding original sequence data;
The reference module is used for carrying out reference processing on the shape transformation data set to obtain a reference change set, and the reference change set comprises a plurality of reference change amounts;
The detection module is used for carrying out detection processing on the shape transformation data set according to all the reference variable amounts to obtain an abnormal detection result corresponding to the original sequence data set;
the processing of the shape transformation of the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set comprises the following steps:
Determining the current sequence similarity corresponding to the current baseline data and the current original sequence data according to the current baseline data in the baseline data set;
Performing deviation processing on the current baseline data and the current original sequence data to obtain a first difference value;
performing product processing on the first difference value according to the similarity of the current sequence to obtain the shape transformation quantity;
returning to the step of determining the current sequence similarity corresponding to the current baseline data according to the current baseline data in the baseline data and the step of determining the current original sequence data until all baseline data in the baseline data set are processed;
integrating all the shape transformation quantities to obtain the shape transformation data set;
The step of performing benchmarking processing on the shape transformation data set to obtain a benchmarking change set includes:
performing variable point detection processing on the shape transformation data set to obtain a variable point detection result;
and carrying out cluster analysis processing on the shape transformation data set according to the change point detection result to obtain the reference change set.
7. A computer device, comprising:
At least one processor;
At least one memory for storing at least one program;
the at least one program, when executed by the at least one processor, causes the at least one processor to implement the timing prediction based anomaly detection method of any one of claims 1-5.
8. A computer-readable storage medium in which a processor-executable program is stored, characterized in that the processor-executable program, when executed by the processor, is for implementing the anomaly detection method based on timing prediction according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311508481.2A CN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311508481.2A CN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117454196A CN117454196A (en) | 2024-01-26 |
| CN117454196B true CN117454196B (en) | 2024-10-29 |
Family
ID=89587263
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311508481.2A Active CN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117454196B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114818969A (en) * | 2022-05-13 | 2022-07-29 | 清华大学 | Method and device for detecting position and type of change point |
| CN114969738A (en) * | 2022-05-27 | 2022-08-30 | 天翼爱音乐文化科技有限公司 | Interface abnormal behavior monitoring method, system, device and storage medium |
Family Cites Families (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6064770A (en) * | 1995-06-27 | 2000-05-16 | National Research Council | Method and apparatus for detection of events or novelties over a change of state |
| US7096153B2 (en) * | 2003-12-31 | 2006-08-22 | Honeywell International Inc. | Principal component analysis based fault classification |
| CN107609574A (en) * | 2017-08-18 | 2018-01-19 | 上海电力学院 | Wind turbines fault early warning method based on data mining |
| CN112685273B (en) * | 2020-12-29 | 2024-07-16 | 京东科技控股股份有限公司 | Abnormality detection method, abnormality detection device, computer device, and storage medium |
| CA3123281A1 (en) * | 2021-06-25 | 2022-12-25 | Cenovus Energy Inc. | Apparatus and method for oil production forecasting |
| CN114048782A (en) * | 2021-11-16 | 2022-02-15 | 东莞市人民医院 | Anesthesia depth monitoring method based on artificial intelligence |
| CN114385869A (en) * | 2021-12-20 | 2022-04-22 | 珠海格力电器股份有限公司 | Method and device for detecting data abnormity, storage medium and computer equipment |
| CN115169225A (en) * | 2022-06-30 | 2022-10-11 | 中国人民解放军国防科技大学 | Adaptive weighting method applied to sea ice multi-mode ensemble prediction |
| CN115907181B (en) * | 2022-12-01 | 2023-06-23 | 郑州铁路职业技术学院 | Urban rail transit passenger flow prediction method and system |
-
2023
- 2023-11-13 CN CN202311508481.2A patent/CN117454196B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114818969A (en) * | 2022-05-13 | 2022-07-29 | 清华大学 | Method and device for detecting position and type of change point |
| CN114969738A (en) * | 2022-05-27 | 2022-08-30 | 天翼爱音乐文化科技有限公司 | Interface abnormal behavior monitoring method, system, device and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117454196A (en) | 2024-01-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111726341B (en) | Data detection method and device, electronic equipment and storage medium | |
| WO2015081801A1 (en) | Method, server, and system for information push | |
| CN110334124B (en) | Compression algorithm selection method, device and equipment | |
| CN112540996B (en) | Service data verification method and device, electronic equipment and storage medium | |
| CN110659179B (en) | Method and device for evaluating system running condition and electronic equipment | |
| CN114595124B (en) | Time sequence abnormity detection model evaluation method, related device and storage medium | |
| CN112256748A (en) | Abnormity detection method and device, electronic equipment and storage medium | |
| CN114282169A (en) | Abnormal data detection method and related device | |
| CN114840565A (en) | Sampling query method, device, electronic equipment and computer readable storage medium | |
| CN117454196B (en) | Anomaly detection method, device, equipment and medium based on time sequence prediction | |
| CN111314177B (en) | Work and rest time period identification method based on wireless signals and related device | |
| CN108600356B (en) | Message pushing method and device | |
| CN113918757A (en) | Application recommendation method and device, electronic equipment and storage medium | |
| CN114840570A (en) | Data processing method and device, electronic equipment and storage medium | |
| CN111818548A (en) | Data processing method, device and equipment | |
| CN117574222B (en) | Benthonic habitat classification method, system, equipment and medium | |
| CN117332153B (en) | Label selection method, system, equipment and medium based on interval matrix | |
| CN117970881A (en) | Flexible workshop job scheduling method, system, equipment and medium | |
| CN118612041A (en) | Alarm data processing method and device, electronic equipment and storage medium | |
| CN115378791A (en) | Data management method, device, storage medium and electronic equipment | |
| CN114862567A (en) | Customer industry determining method and device, electronic equipment and storage medium | |
| CN107526668A (en) | Cpu monitor method and apparatus, computer equipment, computer-readable recording medium | |
| CN114493716A (en) | Service prediction method, device, electronic equipment and storage medium | |
| CN117528615A (en) | Network overlapping identification method, system, equipment and medium based on mobile terminal | |
| CN115130606A (en) | KPI time sequence detection method and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |