CN110008247B - Method, device and equipment for determining abnormal source and computer readable storage medium - Google Patents
Method, device and equipment for determining abnormal source and computer readable storage medium Download PDFInfo
- Publication number
- CN110008247B CN110008247B CN201811525713.4A CN201811525713A CN110008247B CN 110008247 B CN110008247 B CN 110008247B CN 201811525713 A CN201811525713 A CN 201811525713A CN 110008247 B CN110008247 B CN 110008247B
- Authority
- CN
- China
- Prior art keywords
- time
- sub
- abnormality
- time sequence
- sequences
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computational Linguistics (AREA)
- Probability & Statistics with Applications (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Fuzzy Systems (AREA)
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the disclosure provides an abnormality source determination method, an abnormality source determination device and a computer-readable storage medium. The method for determining the source of the abnormality comprises the following steps: acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities; determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs; respectively determining the similarity of each of the plurality of sub-time sequences and the time sequence according to the determination result that the time sequence has the abnormality; according to the similarity between each of the plurality of sub-time sequences and the time sequence, at least one of the plurality of sub-time sequences is determined as the source of the time sequence with the abnormality, the abnormality can be described from the time sequence change, and the judgment of the source of the abnormality is avoided by considering the absolute value of the current state. Moreover, the source of the index abnormality can be accurately and quickly determined.
Description
Technical Field
The disclosed embodiments relate to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a computer-readable storage medium for determining an abnormality source.
Background
In the field of risk control, the general attention is paid to identifying risks or anomalies and improving the accuracy and coverage rate of identification. In this process, it is often found that new risks or abnormalities always occur, and the prevention and control of the new increased risks are time-consuming links in the risk control operation because the causes of the risks need to be located, and then the risk prevention and control is supplemented. Therefore, there is a need to quickly locate the dimension in which the risk or anomaly is located, i.e., the source of the anomaly. The currently known mode of anomaly source detection or downward detection is mainly manual off-line analysis. And after the monitoring index is abnormal, counting the monitoring index in dimensionality, thereby finding out the optimal dimensionality which is possible to cause a problem.
In the related technology, the dimension with the largest similarity proportion is found out by counting the current state and is used as the abnormal dimension to be probed. Such solutions have the following disadvantages:
1) taking the absolute value of the current state to account for, this may lead to erroneous judgment.
2) The relation between the index change of each dimension and the total index change is ignored.
Therefore, it is difficult to accurately and quickly determine the source of the index (or referred to as traffic data) abnormality.
Disclosure of Invention
In view of this, a first aspect of the present disclosure provides an abnormality source determining method, including:
acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities;
determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
A second aspect of the present disclosure provides an abnormality origin determining apparatus, including:
an acquisition module configured to acquire service data within a preset time period to generate a time series according to a preset time interval, wherein the time series comprises a plurality of sub-time series with different dimensions;
a first determination module configured to determine whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
a second determining module configured to determine similarity of each of the plurality of sub-time series with the time series according to a determination result that the time series has an abnormality;
and the third determining module is configured to determine at least one of the plurality of sub-time sequences as a source of the time sequence with abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
A third aspect of the present disclosure provides an electronic device comprising a memory and a processor; wherein the memory is to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the steps of:
acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities;
determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
A fourth aspect of the disclosure provides a computer readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the method according to the first aspect.
In the embodiment of the disclosure, a time sequence is generated according to a preset time interval by acquiring service data within a preset time period, wherein the time sequence comprises a plurality of sub-time sequences with different dimensions; determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs; according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively; and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity between each of the plurality of sub-time sequences and the time sequence, which is determined respectively, and describing the abnormality from the time sequence change rather than considering the absolute value of the current state, thereby avoiding the occurrence of misjudgment on the source of the abnormality. Moreover, the relation between the index of each dimension (or called service data) and the change of the total index is considered, and the relation is described by the similarity between the time series of the index of each dimension and the time series of the total index. Therefore, the source of the index abnormality can be accurately and quickly determined.
These and other aspects of the disclosure will be more readily apparent from the following description of the embodiments.
Drawings
In order to more clearly illustrate the embodiments of the present disclosure or technical solutions in the related art, the drawings required to be used in the description of the exemplary embodiments or the related art will be briefly described below, and it is obvious that the drawings in the description below are some exemplary embodiments of the present disclosure, and other drawings may be obtained by those skilled in the art without creative efforts.
FIG. 1 illustrates a flow diagram of an anomaly source determination method according to an embodiment of the present disclosure;
FIG. 2 shows a flowchart of an example of step S102 of an anomaly source determination method according to an embodiment of the present disclosure;
fig. 3 shows a flowchart of an example of step S104 of an abnormality source determination method according to another embodiment of the present disclosure;
FIG. 4 is a diagram illustrating an example application scenario of an anomaly source determination method according to an embodiment of the present disclosure;
fig. 5A to 5C are schematic diagrams illustrating an application scenario example of an abnormality source determination method according to another embodiment of the present disclosure;
fig. 6 shows a block diagram of the structure of an abnormality source determining apparatus according to another embodiment of the present disclosure;
FIG. 7 shows a block diagram of an electronic device according to an embodiment of the present disclosure;
fig. 8 is a schematic structural diagram of a computer system suitable for implementing an anomaly source determination method according to an embodiment of the present disclosure.
Detailed Description
In order to make the technical solutions of the present disclosure better understood by those skilled in the art, the technical solutions of the exemplary embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the exemplary embodiments of the present disclosure.
In some of the flows described in the specification and claims of this disclosure and in the above-described figures, a number of operations are included that occur in a particular order, but it should be clearly understood that these operations may be performed out of order or in parallel as they occur herein, the order of the operations being 101, 102, etc. merely to distinguish between various operations, and the order of the operations by themselves does not represent any order of performance. Additionally, the flows may include more or fewer operations, and the operations may be performed sequentially or in parallel. It should be noted that, the descriptions of "first", "second", etc. in this document are used for distinguishing different messages, devices, modules, etc., and do not represent a sequential order, nor limit the types of "first" and "second" to be different.
Technical solutions in exemplary embodiments of the present disclosure will be described clearly and completely with reference to the accompanying drawings in the exemplary embodiments of the present disclosure, and it is apparent that the described exemplary embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure. .
In the scheme of exploring dimensional anomaly according to the related art of the present disclosure, the absolute value of the current state is taken as a percentage, which may cause erroneous judgment to occur. For example, the dimension with the largest proportion is the most prominent anomaly dimension of the scene, but if its proportion is the largest at any point in time, it should not be counted as an anomaly dimension. Moreover, the scheme of exploring dimensional anomaly according to the related art of the present disclosure ignores the relationship of index variation of each dimension and total index variation. In order to solve this problem, in the process of probing or detecting an abnormality, the dimension of the abnormality causing the total index change needs to be found out, and therefore, not only the relationship between the index change of each dimension and the total index change cannot be ignored, but also the magnitude of the relationship needs to be quantified.
Embodiments of the present disclosure are described below with reference to the drawings.
Fig. 1 shows a flowchart of an anomaly source determination method according to an embodiment of the present disclosure. The method may comprise steps S101, S102 and S103 and S104.
In step S101, traffic data within a preset time period is acquired to generate a time series according to a preset time interval, where the time series includes a plurality of sub-time series with different dimensions.
In step S102, it is determined whether there is an abnormality in the time series using time series prediction data predicted for the time interval to which the time series belongs.
In step S103, the similarity between each of the plurality of sub time series and the time series is determined based on the determination result that there is an abnormality in the time series.
In step S104, at least one of the plurality of sub-time sequences is determined as a source of the time sequence having an abnormality based on the similarity between each of the plurality of sub-time sequences and the time sequence.
In an embodiment of the present disclosure, the service data in the preset time period may be service data in a time period of several hours, several days, several weeks, several months, and the like, for example, service data such as an access amount of a user, a search amount, and the like. The preset time interval refers to a basic unit of time constituting a preset time period. For example, traffic data for a preset time period of one week is generated in a time series in units of days, that is, the time series includes data for 7 preset time intervals.
In one embodiment of the present disclosure, that the time series includes a plurality of sub time series having different dimensions means that the time series includes a plurality of sub time series, each of which belongs to different dimensions. For example, the time series is a time series generated at preset time intervals within a preset time period on a national scale, and the sub-time series is a time series generated at preset time intervals within a preset time period of each province. That is, each province can be considered as a different dimension. It will be understood by those skilled in the art that the dimensions are not only divided by geographical range, but may be divided from various angles, for example, the age stage, gender, etc. of the user involved in the time series may also be taken as the dimensions of the sub-time series.
In one embodiment of the present disclosure, determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs refers to determining whether there is an abnormality in the acquired time series with the predicted time series as a reference. In one embodiment of the present disclosure, the prediction data may be obtained from a historical time series.
In an embodiment of the present disclosure, when determining whether the obtained time series has an abnormality, a similarity between the sub-time series of each dimension and the time series having the abnormality may be further determined, and then which sub-time series of the dimensions in the sub-time series of each dimension are most similar to the time series having the abnormality may be determined. At this point, those dimensions that are determined can be the source of the time series anomalies. For example, when it is determined that there is an abnormality in the time series that is not nationwide data, it is determined which of the sub-time series of the individual provinces are most similar to the national-dimensional time series, and those provinces to which the determined sub-time series most similar to the national-dimensional time series belong are taken as causes of the abnormality in the national time series.
In one embodiment of the present disclosure, step S103 includes: by calculating the shortest path between the service data of the time point on each of the plurality of sub-time sequences and the service data of the time point on the time sequence, the shorter the path between the service data of the time point on the sub-time sequence of a dimension and the service data of the time point on the time sequence is, the higher the similarity between the sub-time sequence of the dimension and the time sequence is.
In one embodiment of the present disclosure, a Dynamic Time Warping (DTW) algorithm may be used to measure the similarity between two Time series. In the related art, the dynamic time warping algorithm is mainly applied in the field of speech recognition to recognize whether two pieces of speech represent the same sentence. The specific process of the dynamic time warping algorithm is a dynamic planning process to find the shortest path between two points in time series. The smaller the value of the shortest path between points on two time series, the more similar the two time series are represented. In embodiments according to the present disclosure, the dimension of the sub-time series that is considered to be more similar to the time series of the total index is considered to be more relevant to the anomaly of the total index and thus may be considered to be the dimension of the detected anomaly. The specific way of calculating the shortest path between two points in the time sequence by the dynamic time normalization algorithm is not described herein.
In one embodiment of the present disclosure, step S104 includes: and taking at least one sub time sequence with the highest similarity with the time sequence in the plurality of sub time sequences as an abnormal source of the time sequence. In this embodiment, the number of sub time series having the highest similarity to the time series may be one or more, that is, the source of the time series abnormality causing the total index may be one or more.
In the embodiment of the disclosure, a time sequence is generated according to a preset time interval by acquiring service data within a preset time period, wherein the time sequence comprises a plurality of sub-time sequences with different dimensions; determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs; according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively; according to the similarity between each of the plurality of sub-time sequences and the time sequence, which is determined respectively, at least one of the plurality of sub-time sequences is determined as a source of the time sequence with the abnormality, and the abnormality can be characterized from the time sequence change rather than being considered from the absolute value of the current state, so that the erroneous judgment of the source of the abnormality is avoided. Moreover, the relation between the index of each dimension (or called service data) and the change of the total index is considered, and the relation is described by the similarity between the time series of the index of each dimension and the time series of the total index. Therefore, the source of the index abnormality can be accurately and quickly determined.
Step S102 in fig. 1 is further described below with reference to fig. 2.
Fig. 2 shows a flowchart of an example of step S102 of the abnormality source determination method according to an embodiment of the present disclosure. As shown in fig. 2, step S102 includes steps S201 and S202.
In step S201, the ratio of the difference between the time-series and time-series prediction data to the time-series prediction data is used as the degree of abnormality.
In step S202, it is determined whether there is an abnormality in the time series by determining whether the degree of abnormality exceeds a preset threshold.
In one embodiment of the present disclosure, time series prediction data may be obtained based on historical time series data. In one embodiment of the present disclosure, the degree of abnormality of the time series (time series actual value-time series prediction data)/time series prediction data. In one embodiment of the present disclosure, if the degree of abnormality of the time series exceeds a preset threshold, it is considered that an abnormality occurs, and a downward probing operation is required to be performed, that is, the dimension of the sub-time series with the highest similarity to the time series is determined.
Step S104 in fig. 1 is further described below with reference to fig. 3.
Fig. 3 shows a flowchart of an example of step S104 of an abnormality source determination method according to another embodiment of the present disclosure. In the embodiment shown in fig. 3, when at least one sub-time series having the highest similarity to the time series each includes a sub-time series of a plurality of sub-dimensions, step S104 includes steps S301 and S302.
In step S301, the similarity of each of the plurality of sub-sub time series to the time series is determined, respectively.
In step S302, at least one of the plurality of sub-time sequences is determined as a source of an abnormality in the time sequence according to the similarity between each of the plurality of sub-time sequences and the time sequence.
In one embodiment of the present disclosure, multiple downward pings may be made for a time series having multiple layer dimensions. For example, when it is determined that there is an abnormality in the time series that is not nationwide data, it is determined which of the sub-time series of the individual provinces are most similar to the national-dimensional time series, and those provinces to which the determined sub-time series most similar to the national-dimensional time series belong are taken as causes of the abnormality in the national time series. When the abnormality source needs to be further refined, the child time series of the province in which the abnormality occurs may be used as a parent time series, and the similarity between the child-child time series of the dimension of each county of the province and the child time series of the province is determined, thereby determining the abnormality source of the child time series of the province, that is, the abnormality source of the national time series. One skilled in the art will appreciate that the source of an anomaly may be determined more accurately by performing multiple downward searches of the source of the anomaly, i.e., determining the dimension to which the most similar sub-time series belong for each determined time series of the source of the anomaly.
Fig. 4 is a schematic diagram illustrating an example of an application scenario of the anomaly source determining method according to an embodiment of the present disclosure.
As shown in fig. 4, a total index time series is obtained, and abnormality detection is performed on the total index time series. When the total index time sequence is detected to be abnormal, the similarity between the fractal dimension index time sequence and the total index time sequence can be calculated through a dynamic time integration algorithm. The calculated time similarities of the fractal dimension indexes can be subjected to similarity ranking, and the dimensions of the 3 fractal dimension index time sequences with the highest similarity are considered as abnormal reasons. This completes the investigation of the cause of the abnormality (transaction).
Fig. 5A to 5C are schematic diagrams illustrating an application scenario example of an abnormality source determination method according to another embodiment of the present disclosure.
As shown in fig. 5A to 5C, when there is an abnormality in the total time series, the similarity between the sub time series of the three dimensions of the total time series and the total time series may be determined by the state time normalization algorithm to determine the cause of the abnormality in the total time series.
As shown in fig. 5A to 5C, compared with the similarity between the dimension-two time series and the total time series, the similarity between the dimension-two time series and the total time series is the highest, and therefore, the abnormality cause of the total time series abnormality can be determined as the dimension-two.
Therefore, the method for determining the source of the abnormality according to the embodiment of the disclosure can quickly detect the reason of the abnormality of the total time series, thereby greatly reducing the cost.
Fig. 6 shows a block diagram of an abnormality source determination device according to another embodiment of the present disclosure. The apparatus may include an acquisition module 601, a first determination module 602, a second determination module 603, and a third determination module 604.
The obtaining module 601 is configured to obtain service data in a preset time period to generate a time sequence according to a preset time interval, where the time sequence includes a plurality of sub-time sequences with different dimensions;
the first determination module 602 is configured to determine whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
the second determining module 603 is configured to determine, according to the determination result that there is an abnormality in the time series, a similarity of each of the plurality of sub-time series with the time series;
the third determining module 604 is configured to determine at least one of the plurality of sub-time sequences as a source of the time sequence having the abnormality according to the similarity between each of the plurality of sub-time sequences and the time sequence.
Having described the internal functionality and structure of the anomaly origin determining apparatus, in one possible design, the structure of the anomaly origin determining apparatus may be implemented as an anomaly origin determining device, as shown in FIG. 7, the processing device 700 may include a processor 701 and a memory 702.
The memory 702 is used for storing a program that supports an exception source determining apparatus to execute the exception source determining method in any one of the embodiments, and the processor 701 is configured to execute the program stored in the memory 702.
The memory 702 is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 701 to perform the steps of:
acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities;
determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
In one embodiment of the present disclosure, the determining whether there is an abnormality in the time series by using time series prediction data predicted for a time interval to which the time series belongs includes:
using the ratio of the difference between the time series and the time series prediction data to the time series prediction data as an abnormal degree;
determining whether there is an abnormality in the time series by determining whether the degree of abnormality exceeds a preset threshold.
In an embodiment of the present disclosure, the determining, according to the determination result that the time series has the abnormality, a similarity between each of the plurality of sub-time series and the time series, respectively, includes:
respectively calculating the shortest path between the service data of the time point on each of the plurality of sub-time sequences and the service data of the time point on the time sequence, wherein the shorter the path between the service data of the time point on the sub-time sequence of a dimension and the service data of the time point on the time sequence is, the higher the similarity between the sub-time sequence of the dimension and the time sequence is.
In an embodiment of the present disclosure, the determining, according to the similarity between each of the plurality of separately determined sub-time sequences and the time sequence, that at least one of the plurality of sub-time sequences is a source of the time sequence having an abnormality includes:
and taking at least one sub time sequence with the highest similarity with the time sequence in the plurality of sub time sequences as an abnormal source of the time sequence.
In an embodiment of the present disclosure, when at least one sub-time series having the highest similarity to the time series each includes a sub-time series of a plurality of sub-dimensions, the determining, according to the respectively determined similarities of each of the plurality of sub-time series to the time series, that at least one of the plurality of sub-time series is a source of the abnormality in the time series further includes:
determining a similarity of each of the plurality of sub-temporal sequences to the temporal sequence, respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
The processor 701 is configured to perform all or part of the steps of the aforementioned methods.
The structure of the abnormality source determining device may further include a communication interface, which is used for the abnormality source determining device to communicate with other devices or a communication network.
The exemplary embodiments of the present disclosure also provide a computer storage medium for storing computer software instructions for the apparatus for determining a source of an abnormality, which includes a program for executing the method for determining a source of an abnormality in any one of the above embodiments.
Fig. 8 is a schematic structural diagram of a computer system suitable for implementing an anomaly source determination method according to an embodiment of the present disclosure.
As shown in fig. 8, the computer system 800 includes a Central Processing Unit (CPU)801 that can execute various processes in the embodiment shown in fig. 1 described above according to a program stored in a Read Only Memory (ROM)802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. In the RAM803, various programs and data necessary for the operation of the system 800 are also stored. The CPU801, ROM802, and RAM803 are connected to each other via a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.
The following components are connected to the I/O interface 805: an input portion 806 including a keyboard, a mouse, and the like; an output section 807 including a signal such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 808 including a hard disk and the like; and a communication section 809 including a network interface card such as a LAN card, a modem, or the like. The communication section 809 performs communication processing via a network such as the internet. A drive 810 is also connected to the I/O interface 805 as necessary. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as necessary, so that a computer program read out therefrom is mounted on the storage section 808 as necessary.
In particular, according to embodiments of the present disclosure, the method described above with reference to fig. 1 may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a medium readable thereby, the computer program comprising program code for performing the data processing method of fig. 1. In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 809 and/or installed from the removable medium 811.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, a program segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, and/or combinations of special purpose hardware and computer instructions.
The units or modules described in the embodiments of the present disclosure may be implemented by software or hardware. The units or modules described may also be provided in a processor, and the names of the units or modules do not in some cases constitute a limitation on the units or modules themselves.
As another aspect, the present disclosure also provides a computer-readable storage medium, which may be the computer-readable storage medium included in the apparatus in the above-described embodiment; or it may be a separate computer readable storage medium not incorporated into the device. The computer readable storage medium stores one or more programs for use by one or more processors in performing the methods described in the present disclosure.
The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention in the present disclosure is not limited to the specific combination of the above-mentioned features, but also encompasses other embodiments in which any combination of the above-mentioned features or their equivalents is possible without departing from the inventive concept. For example, the above features and (but not limited to) the features disclosed in this disclosure having similar functions are replaced with each other to form the technical solution.
Claims (12)
1. An abnormality origin determining method, comprising:
acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities;
determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
2. The method of claim 1, wherein the determining whether the time series has an anomaly using time series prediction data predicted for a time interval to which the time series belongs comprises:
using the ratio of the difference between the time series and the time series prediction data to the time series prediction data as the degree of abnormality;
determining whether there is an abnormality in the time series by determining whether the degree of abnormality exceeds a preset threshold.
3. The method according to claim 1, wherein the determining the similarity of each of the plurality of sub-time sequences with the time sequence according to the determination result that the time sequence has the abnormality comprises:
respectively calculating the shortest path between the service data of the time point on each of the plurality of sub-time sequences and the service data of the time point on the time sequence, wherein the shorter the path between the service data of the time point on the sub-time sequence of a dimension and the service data of the time point on the time sequence is, the higher the similarity between the sub-time sequence of the dimension and the time sequence is.
4. The method according to claim 1, wherein the determining at least one of the plurality of sub-time sequences as a source of the time sequence having the abnormality based on the similarity between each of the plurality of sub-time sequences and the time sequence comprises:
and taking at least one sub time sequence with the highest similarity with the time sequence in the plurality of sub time sequences as an abnormal source of the time sequence.
5. The method according to claim 4, wherein when at least one sub-time sequence having the highest similarity with the time sequence each includes a sub-time sequence of a plurality of sub-dimensions, the determining at least one of the plurality of sub-time sequences as a source of the abnormality in the time sequence based on the respectively determined similarity of each of the plurality of sub-time sequences with the time sequence further comprises:
determining a similarity of each of the plurality of sub-temporal sequences to the temporal sequence, respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
6. An abnormality origin determining apparatus, characterized by comprising:
an acquisition module configured to acquire service data within a preset time period to generate a time series according to a preset time interval, wherein the time series comprises a plurality of sub-time series with different dimensions;
a first determination module configured to determine whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
a second determining module configured to determine, according to a determination result that there is an abnormality in the time series, a similarity of each of the plurality of sub-time series with the time series, respectively;
and the third determining module is configured to determine at least one of the plurality of sub-time sequences as a source of the time sequence with abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
7. An electronic device comprising a memory and a processor; wherein the memory is to store one or more computer instructions, wherein the one or more computer instructions are to be executed by the processor to implement the steps of:
acquiring service data in a preset time period to generate a time sequence according to a preset time interval, wherein the time sequence comprises a plurality of sub-time sequences with different dimensionalities;
determining whether there is an abnormality in the time series using time series prediction data predicted for a time interval to which the time series belongs;
according to the determination result that the time sequence is abnormal, determining the similarity of each of the plurality of sub-time sequences and the time sequence respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with the abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
8. The electronic device of claim 7, wherein the determining whether the time series has an anomaly using time series prediction data predicted for a time interval to which the time series belongs comprises:
using the ratio of the difference between the time series and the time series prediction data to the time series prediction data as the degree of abnormality;
determining whether there is an abnormality in the time series by determining whether the degree of abnormality exceeds a preset threshold.
9. The electronic device according to claim 7, wherein the determining, according to the determination result that the time series has the abnormality, a similarity between each of the plurality of sub-time series and the time series, respectively, includes:
respectively calculating the shortest path between the service data of the time point on each of the plurality of sub-time sequences and the service data of the time point on the time sequence, wherein the shorter the path between the service data of the time point on the sub-time sequence of a dimension and the service data of the time point on the time sequence is, the higher the similarity between the sub-time sequence of the dimension and the time sequence is.
10. The electronic device according to claim 7, wherein said determining at least one of the plurality of sub-time sequences as a source of the abnormality in the time sequence according to the similarity between each of the plurality of sub-time sequences and the time sequence comprises:
and taking at least one sub time sequence with the highest similarity with the time sequence in the plurality of sub time sequences as an abnormal source of the time sequence.
11. The electronic device according to claim 10, wherein when at least one sub-time sequence having a highest similarity with the time sequence each includes a sub-time sequence of a plurality of sub-dimensions, the determining at least one of the plurality of sub-time sequences as a source of the abnormality in the time sequence according to the respectively determined similarities of each of the plurality of sub-time sequences with the time sequence further comprises:
determining a similarity of each of the plurality of sub-temporal sequences to the temporal sequence, respectively;
and determining at least one of the plurality of sub-time sequences as a source of the time sequence with abnormality according to the similarity of each of the plurality of sub-time sequences with the time sequence.
12. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed by a processor, implement the method of any one of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811525713.4A CN110008247B (en) | 2018-12-13 | 2018-12-13 | Method, device and equipment for determining abnormal source and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811525713.4A CN110008247B (en) | 2018-12-13 | 2018-12-13 | Method, device and equipment for determining abnormal source and computer readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110008247A CN110008247A (en) | 2019-07-12 |
| CN110008247B true CN110008247B (en) | 2022-08-16 |
Family
ID=67165126
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811525713.4A Active CN110008247B (en) | 2018-12-13 | 2018-12-13 | Method, device and equipment for determining abnormal source and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110008247B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111104438A (en) * | 2019-11-21 | 2020-05-05 | 新浪网技术(中国)有限公司 | Method and device for determining periodicity of time sequence and electronic equipment |
| CN111835738B (en) * | 2020-06-30 | 2021-09-24 | 山东大学 | Network abnormal flow automatic detection method based on time series mining |
| WO2022032674A1 (en) * | 2020-08-14 | 2022-02-17 | Beijing Didi Infinity Technology And Development Co., Ltd. | Systems and methods for detecting abnormal charging events |
| CN114154058A (en) * | 2021-11-02 | 2022-03-08 | 支付宝(杭州)信息技术有限公司 | Account operator identity prediction method and device |
| CN114235652A (en) * | 2021-11-30 | 2022-03-25 | 国网北京市电力公司 | Smoke dust particle concentration abnormity identification method and device, storage medium and equipment |
| CN114363062B (en) * | 2021-12-31 | 2024-07-09 | 深信服科技股份有限公司 | Domain name detection method, system, equipment and computer readable storage medium |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2006107179A (en) * | 2004-10-06 | 2006-04-20 | Ntt Data Corp | Outlying observation detection device, change point detection device, outlying observation detection method and change point detection method |
| CN103729530A (en) * | 2012-10-15 | 2014-04-16 | 富士通株式会社 | Device and method for processing sequence |
| CN105224543A (en) * | 2014-05-30 | 2016-01-06 | 国际商业机器公司 | For the treatment of seasonal effect in time series method and apparatus |
| CA2921054A1 (en) * | 2015-04-10 | 2016-10-10 | Pankaj Malhotra | Anomaly detection system and method |
| CN106126391A (en) * | 2016-06-28 | 2016-11-16 | 北京百度网讯科技有限公司 | System monitoring method and apparatus |
| CN106502815A (en) * | 2016-10-20 | 2017-03-15 | 北京蓝海讯通科技股份有限公司 | A kind of abnormal cause localization method, device and computing device |
| CN106657410A (en) * | 2017-02-28 | 2017-05-10 | 国家电网公司 | Detection method for abnormal behaviors based on user access sequence |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN108846058A (en) * | 2018-06-01 | 2018-11-20 | 阿里巴巴集团控股有限公司 | Abnormal data bearing calibration, device and processing equipment in a kind of time series |
-
2018
- 2018-12-13 CN CN201811525713.4A patent/CN110008247B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2006107179A (en) * | 2004-10-06 | 2006-04-20 | Ntt Data Corp | Outlying observation detection device, change point detection device, outlying observation detection method and change point detection method |
| CN103729530A (en) * | 2012-10-15 | 2014-04-16 | 富士通株式会社 | Device and method for processing sequence |
| CN105224543A (en) * | 2014-05-30 | 2016-01-06 | 国际商业机器公司 | For the treatment of seasonal effect in time series method and apparatus |
| CA2921054A1 (en) * | 2015-04-10 | 2016-10-10 | Pankaj Malhotra | Anomaly detection system and method |
| CN106126391A (en) * | 2016-06-28 | 2016-11-16 | 北京百度网讯科技有限公司 | System monitoring method and apparatus |
| CN106502815A (en) * | 2016-10-20 | 2017-03-15 | 北京蓝海讯通科技股份有限公司 | A kind of abnormal cause localization method, device and computing device |
| CN106657410A (en) * | 2017-02-28 | 2017-05-10 | 国家电网公司 | Detection method for abnormal behaviors based on user access sequence |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN108846058A (en) * | 2018-06-01 | 2018-11-20 | 阿里巴巴集团控股有限公司 | Abnormal data bearing calibration, device and processing equipment in a kind of time series |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110008247A (en) | 2019-07-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110008247B (en) | Method, device and equipment for determining abnormal source and computer readable storage medium | |
| CN111459695B (en) | Root cause positioning method, root cause positioning device, computer equipment and storage medium | |
| CN107086944B (en) | Anomaly detection method and device | |
| CN112436968B (en) | Network traffic monitoring method, device, equipment and storage medium | |
| US9753801B2 (en) | Detection method and information processing device | |
| US10852357B2 (en) | System and method for UPS battery monitoring and data analysis | |
| CN113852603B (en) | Abnormality detection method and device for network traffic, electronic equipment and readable medium | |
| EP2963553B1 (en) | System analysis device and system analysis method | |
| US20140365829A1 (en) | Operation management apparatus, operation management method, and program | |
| CN105094708B (en) | The Forecasting Methodology and device of a kind of disk size | |
| CN108228428B (en) | Method and apparatus for outputting information | |
| CN110333962B (en) | Electronic component fault diagnosis model based on data analysis and prediction | |
| EP2963552B1 (en) | System analysis device and system analysis method | |
| CN107391335B (en) | Method and equipment for checking health state of cluster | |
| CN112800061B (en) | Data storage method, device, server and storage medium | |
| US20140067773A1 (en) | Transient detection for predictive health management of data processing systems | |
| CN111666171A (en) | Fault identification method and device, electronic equipment and readable storage medium | |
| US20190179867A1 (en) | Method and system for analyzing measurement-yield correlation | |
| CN110399903B (en) | Abnormal data detection method and device and computer readable storage medium | |
| CN115659411A (en) | Method and device for data analysis | |
| CN111651340B (en) | Alarm data rule mining method and device and electronic equipment | |
| CN115932144B (en) | Chromatograph performance detection method, chromatograph performance detection device, chromatograph performance detection equipment and computer medium | |
| CN114938339B (en) | Data processing method and related device | |
| CN115774648A (en) | Abnormity positioning method, device, equipment and storage medium | |
| CN114579519A (en) | File system abnormality detection method and device, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |