WO2021189845A1

WO2021189845A1 - Detection method and apparatus for time series anomaly point, and device and readable storage medium

Info

Publication number: WO2021189845A1
Application number: PCT/CN2020/125004
Authority: WO
Inventors: 邓悦; 郑立颖; 徐亮
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-09-22
Filing date: 2020-10-30
Publication date: 2021-09-30
Also published as: CN112131274A; CN112131274B

Abstract

A detection method and apparatus for a time series anomaly point, and a computer device and a computer-readable storage medium, which relate to the field of artificial intelligence. The method comprises: acquiring a target window in a time series to be processed, and acquiring windows to be processed corresponding to the target window (S101), wherein the number of windows to be processed is greater than one; on the basis of a preset model, determining, according to the target window and the windows to be processed, a similarity value between the target window and each of the windows to be processed (S102); and according to the similarity values, determining whether a time point corresponding to the target window is an anomaly point (S103). By means of the method, a target window and windows to be processed in a time series are acquired, such that collected sample series have a relatively small difference; and the similarity value between the target window and each of the windows to be processed is determined by means of the preset model, thereby avoiding a relatively great error in an obtained anomalous series.

Description

Method, device, equipment and readable storage medium for detecting abnormal points in time series

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on September 22, 2020, the application number is CN2020110068006, and the invention title is "Time series abnormal point detection method, device, equipment and readable storage medium". The entire content is incorporated into this application by reference.

Technical field

This application relates to the field of artificial intelligence, and in particular to methods, devices, equipment, and computer-readable storage medium names for detecting abnormal points in time series.

Background technique

In the field of AIOps, time series refers to a sequence composed of observation data of a certain indicator according to time. Hardware devices such as hosts and servers will generate a large number of indicator values during operation. For example, the CPU usage per second of the host and the hourly request volume of a certain business can form univariate time series indicator data. The anomaly detection of time series is to find the difference from the historical behavior pattern from the data.

The inventor realizes that traditional time series anomaly detection methods often use distance measurement methods, that is, by calculating the distance between a given univariate time series and the expected value and comparing it with a given threshold, if the distance is greater than the given threshold, it can be determined This point is an abnormal point. The threshold is usually selected as some basic statistics, such as the median or 90% quantile. However, the selection of the threshold is too subjective and is not suitable for data anomaly detection in all time series.

Summary of the invention

A method for detecting abnormal points in a time series, the method for detecting abnormal points in a time series includes:

Acquiring a target window in the to-be-processed time sequence, and acquiring a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

Based on a preset model, determining a similarity value between the target window and the window to be processed according to the target window and the window to be processed;

According to the similarity value, it is determined whether the time point corresponding to the target window is an abnormal point.

A detection device for abnormal points in a time series, the detection device for abnormal points in a time series includes:

An obtaining module, configured to obtain a target window in a time series to be processed, and obtain a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

The first determining module is configured to determine the similarity value between the target window and the window to be processed based on the preset model according to the target window and the window to be processed;

The second determining module is configured to determine whether the time point corresponding to the target window is an abnormal point according to the similarity value.

A computer device including a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein when the computer program is executed by the processor, the following steps are implemented :

A computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

The method, device, device, and computer-readable storage medium for detecting abnormal points in a time series proposed in the embodiments of the present application realize that by obtaining the target window and the window to be processed in the time series, the difference between the collected sample sequences is small , Through the preset model to determine the similarity value of the target window and the window to be processed, to avoid large errors in the obtained abnormal sequence.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings used in the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present application. Ordinary technicians can obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for detecting abnormal points in a time series provided by an embodiment of this application;

FIG. 2 is a schematic flowchart of sub-steps of the method for detecting abnormal points in the time series in FIG. 1;

Fig. 3 is a schematic flow diagram of sub-steps of the method for detecting abnormal points in the time series in Fig. 1;

4 is a schematic flowchart of sub-steps of the method for detecting abnormal points in the time series in FIG. 1;

FIG. 5 is a schematic diagram of a network layer of a preset model in an embodiment of the application;

6 is a schematic flowchart of sub-steps of the method for detecting abnormal points in the time series in FIG. 1;

FIG. 7 is a schematic flowchart of another method for detecting abnormal points in a time series provided by an embodiment of this application;

FIG. 8 is a schematic block diagram of a device for detecting abnormal points in a time series provided by an embodiment of the application;

FIG. 9 is a schematic block diagram of the structure of a computer device related to an embodiment of the application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

The technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

The flowchart shown in the drawings is only an example, and does not necessarily include all contents and operations/steps, nor does it have to be executed in the described order. For example, some operations/steps can also be decomposed, combined or partially combined, so the actual execution order may be changed according to actual conditions.

The embodiments of the present application provide a method, device, equipment, and computer-readable storage medium for detecting abnormal points in a time series. Among them, the method for detecting abnormal points in the time series can be applied to terminal devices, which can be mobile phones, tablet computers, notebook computers, and desktop computers.

Hereinafter, some embodiments of the present application will be described in detail with reference to the accompanying drawings. In the case of no conflict, the following embodiments and features in the embodiments can be combined with each other.

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a method for detecting abnormal points in a time series according to an embodiment of the application.

As shown in Fig. 1, the method for detecting abnormal points in the time series includes steps S101 to S103.

Step S101: Obtain a target window in the to-be-processed time series, and acquire a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one.

Exemplarily, obtaining the target window of the time series to be processed. The time series refers to a sequence formed by arranging the values of a certain statistical indicator of a certain phenomenon at different times in chronological order. The target window refers to the value obtained on the time series based on the window information and contains the value corresponding to the window on the time series. For example, based on the user's operation instruction, the target window corresponding to the operation instruction in the to-be-processed time sequence can be obtained through preset window information. Sliding on the time series based on the window information of the target window, and collecting the to-be-processed window corresponding to the target window on the time series.

In an embodiment, specifically, referring to FIG. 2, step S101 includes: sub-step S1011 to sub-step S1012.

Sub-step S1011, determine the target time point to be detected on the time sequence to be processed.

Receive the user's operation instruction, determine the corresponding time point of the operation instruction in the to-be-processed time sequence based on the operation instruction, and use the time point as the target time point to be detected.

Sub-step S1012: Obtain a target window corresponding to the target time point based on the preset window information and the target time point.

Obtain preset window information corresponding to the target time point, where the window information includes window length information, etc. Based on the target time point and the preset window information, a target window corresponding to the target time point is obtained. For example, when it is determined that the target time point on the time series to be processed is time t, and the length of the window information is 20 time points, the sequence corresponding to the 20 time points before time t in the time series to be processed is obtained as the time point t The target window.

In an embodiment, specifically, referring to FIG. 3, step S101 includes: sub-step S1013 to sub-step S1014.

Sub-step S1013: Determine the collection strategy of the target time point according to the time sequence to be processed.

The duration information of the to-be-processed time sequence is acquired, and the preset segmentation strategy is determined based on the duration information of the to-be-processed time sequence. The time sequence to be trained is segmented according to a preset segmentation strategy to obtain multiple sub-time sequences of the processing time sequence. For example, each time point of the time sequence to be trained is acquired, and it is determined whether the time sequence to be trained is less than a preset time point. If the time point is less than the preset time point, the time point is segmented based on the preset segmentation strategy. For example, the training time sequence is from 2018-1-1-00-00-00 to 2020-7-1-00-00-00, and the preset time point is 2020-1-1-00-00-00, then it is determined The time sequence to be trained is greater than the preset time point. Divide the time series to be trained into 2018-1-1-00-00-00 to 2020-1-1-00-00-00 and 2020-1-1-00-00-00 through the preset split strategy To 2020-7-1-00-00-00 two sub-time sequences to be trained. Through different sub-time series to be trained, the acquisition strategy of the time series to be trained is determined.

Sub-step S1014, based on the acquisition strategy and the preset window information, obtain a window to be processed corresponding to the target window.

Based on the preset acquisition strategy, the two time series to be trained are collected separately to obtain the to-be-processed window corresponding to the target window. When the duration information of the time sequence to be processed is the current time 2020-6-1-00-00-00, and the preset time information is 2020-7-1-00-00-00, the duration information includes the preset time Information, the collection strategy of the target time point is determined by the duration information. For example, determine the first acquisition strategy from the current moment to 2020-7-1-00-00-00, and determine the second acquisition strategy of 2020-7-1-00-00-00-2020-6-1-00-00-00 Acquisition strategy. Based on the preset window information and the first collection strategy, the current time on the to-be-processed time sequence is slid to 2020-7-1-00-00-00 to obtain the to-be-processed window corresponding to the target window. Based on the window information and the second collection strategy, slide 2020-7-1-00-00-00-2020-6-1-00-00-00 on the to-be-processed time series to obtain the corresponding target window Pending window. Among them, the sliding interval in 2020-7-1-00-00-00-2020-6-1-00-00-00 on the to-be-processed time series is greater than the current moment -2020 on the to-be-processed time series -The sliding interval in 7-1-00-00-00, and the number of windows to be processed is greater than 1.

Step S102: Based on a preset model, determine a similarity value between the target window and the window to be processed according to the target window and the window to be processed.

Exemplarily, through a preset model, the preset model is obtained through training in advance through training data. The training data includes windows to be trained, similar windows, and dissimilar windows. For example, the model to be trained is trained through the window to be trained and the similar window, the target window and the dissimilar window, and the weight parameters in the model are adjusted to obtain the corresponding preset model. The target window and the window to be processed are input into a preset model, and the preset model is run to obtain a similarity value between the target window and the window to be processed. If the number of windows to be processed is multiple, the windows to be processed and the target window are sequentially input into the preset model. For example, when the number of windows to be processed is three, they are respectively the window to be processed A1, the window to be processed A2, and the window to be processed A3. Input the to-be-processed window A1 and the target window into the preset model in turn to obtain the similarity value between the to-be-processed window A1 and the target window; input the to-be-processed window A2 and the target window into the preset model to obtain the to-be-processed window A2 and the target window The similarity value between the window A3 to be processed and the target window are input into the preset model to obtain the similarity value between the window A3 to be processed and the target window.

In an embodiment, specifically, referring to FIG. 4, step S102 includes: sub-step S1021 to sub-step S1023.

Sub-step S1021, based on a preset model, input the target window and the window to be processed into the preset model respectively.

Exemplarily, a preset model is obtained, and the preset model includes a twin neural network model. The target window and the window to be processed are respectively input into the preset model, where the model includes two input layers.

In sub-step S1022, the mapping parameters of the target window and the mapping parameters of the window to be processed are obtained respectively through the weight parameters of the preset model.

As shown in Figure 5, the preset model includes an input layer, a forward propagation layer, a back propagation layer, and an output layer. The value in the target window is mapped through the weight parameters in the input layer, the forward propagation layer, the back propagation layer, and the output layer in the preset model to obtain the mapping parameter of each value in the target window.

Sub-step S1023, based on the mapping parameter of the target window and the mapping parameter of the window to be processed, output the similarity value between the target window and the window to be processed.

The value in the window to be processed is mapped by the weight parameters in the input layer, the forward propagation layer, the back propagation layer, and the output layer in the preset model to obtain the mapping parameter of each value in the window to be processed. Based on the mapping parameter of each value in the target window and the mapping parameter of each value in the window to be processed, the similarity value corresponding to the target window and the window to be processed is obtained.

Step S103: Determine whether the time point corresponding to the target window is an abnormal point according to the similarity value.

Exemplarily, the similarity value between the target window and the window to be processed is acquired, and based on the similarity value between the target window and the window to be processed, it is determined that the time point corresponding to the target window is an abnormal point. Exemplarily, a preset threshold is acquired, and if the similarity value between the target window and the window to be processed is greater than the preset threshold, the time point is marked as an abnormal point. If the similarity value between the target window and the window to be processed is less than the preset threshold, it can be considered that the time point is not an abnormal point.

In an embodiment, specifically, referring to FIG. 6, step S103 includes: sub-step S1031 to sub-step S1032.

In sub-step S1031, it is determined whether the similarity value between the target window and each of the windows to be processed is less than a preset threshold.

Exemplarily, a preset threshold value is acquired, and whether the time point corresponding to the target window is an abnormal point is determined through the preset threshold value. The similarity value between the target window and the window to be processed is compared with the preset threshold. If the similarity value between the target window and the window to be processed is greater than or equal to the preset threshold, the time corresponding to the target window is determined The point is not an abnormal point; for example, when the preset threshold is 80%, and the similarity value between the target window and the window to be processed is obtained as 85%, it is determined that the time point corresponding to the target window is not an abnormal point.

In sub-step S1032, if the similarity value between the target window and any one of the windows to be processed is less than the preset threshold, it is determined that the target time point corresponding to the target window is an abnormal point.

If the similarity value between the target window and the window to be processed is less than the preset threshold, it is determined that the time point corresponding to the target window is an abnormal point. For example, when the preset threshold is 80%, if it is obtained that the similarity value between the target target window and the window to be processed is 75%, it is determined that the time point corresponding to the target window is an abnormal point.

In the embodiment of the present application, by acquiring the target window and the window to be processed in the time series, the difference between the collected sample sequence is small, and the similarity value of the target window and the window to be processed is determined by the preset model, so as to avoid the obtained The abnormal sequence has a large error. Map the time series fragments into the new space through the preset model, compare the similarity of the series, and avoid the disadvantages caused by missing sampling.

Please refer to FIG. 7. FIG. 7 is a schematic diagram of a scene for implementing the method for detecting abnormal points in a time series provided by this embodiment. As shown in FIG. 7, the method for detecting abnormal points in a time series includes:

Step S201: Obtain a window to be trained, a similar window, and a dissimilar window.

Exemplarily, the window to be trained, the similar window and the dissimilar window are acquired, wherein the number of the window to be trained, the similar window and the dissimilar window is at least one. Obtain the time sequence to be trained, and determine any time point on the time sequence to be trained. Based on the time point and the preset window information, the window corresponding to the waiting time point is obtained. For example, the length of the window information is preset to 20 time points, and based on the time point, 20 time points before the time point are used as the window corresponding to the time point. The similar window and the dissimilar window on the time series to be trained are collected through the window. For example, the value corresponding to the time point is obtained, and the corresponding time on the time sequence to be trained is determined based on the value. For example, when the value corresponding to the time point is 10, the value corresponding to each time in the time series to be trained is obtained. If the value 10 corresponding to the time point is obtained, the similarity window is obtained based on the time corresponding to the value 10. Obtain the time when the numerical value is different from the numerical value at the time point, and obtain the dissimilar window based on the time of the different numerical value. For example, 20 moments that are different from the value of the time point are acquired, and these 20 moments are combined to obtain the corresponding dissimilar window.

Specifically, the obtaining the window to be trained, the similar window, and the dissimilar window includes: determining any time point in a preset time sequence to be trained; determining window information based on the arbitrary time point, and obtaining the corresponding window at the any time point The window to be trained; determine the time that matches the arbitrary time point in the time sequence to be trained, and obtain the corresponding similarity window based on the window information; determine the time sequence to be trained and the arbitrary time point At the time of mismatch, the corresponding non-similar window is obtained based on the window information.

Exemplarily, upon receiving the user's operation instruction, the corresponding time point in the preset time sequence to be trained is determined based on the user's operation instruction, where the time point is any time point in the time sequence to be trained. When it is determined that the operation instruction corresponds to a time point in the preset time sequence to be trained, the window information is determined based on the time point. For example, the window information includes first preset window information and second preset window information. If the time point is the current time point, the window information corresponding to the time point is determined to be the first preset window information; if the time point is not the current time point, the window information corresponding to the time point is determined to be the second preset window information. The first preset window information is smaller than the second preset window information. For example, the length of the first preset window information is 10 time points, and the length of the second preset window information is 20 time points. Based on the window information corresponding to the time point, the window corresponding to the time point is obtained. For example, according to the window information and the time point of the time point, 10 time points before the time point are regarded as the window of the time point, and the window includes the values corresponding to the 10 time points before the time point.

Determine the time matching the arbitrary time point in the sub-time sequence, and obtain the corresponding similar window through the window information. The numerical value corresponding to the arbitrary time point in the time sequence to be trained is obtained, and the numerical value is matched with the numerical value at each time in the time sequence to be trained based on the numerical value. If the first numerical value that is the same as the numerical value is obtained, it is determined that the first time corresponding to the first numerical value matches the time corresponding to the arbitrary point. For example, when the value corresponding to any time point in the time series to be trained is acquired as 10, the time corresponding to the value 10 in the time series to be trained is acquired, and this time is taken as the first time at the arbitrary time point. Based on the window information corresponding to the arbitrary time point and the first moment, a similar window corresponding to the window is obtained. For example, according to the window information corresponding to the arbitrary time point, if the length of the window information is 20, the 20 time points before the first time point are regarded as the similar window at the arbitrary time point.

Determine the time in the sub-time sequence that does not match the arbitrary time point, and obtain the corresponding non-similar window through the window information. The numerical value corresponding to the arbitrary time point in the time sequence to be trained is obtained, and the numerical value is matched with the numerical value at each time in the time sequence to be trained based on the numerical value. If a second value different from the value is obtained, the second time corresponding to the second value is determined. For example, when the value corresponding to any time point in the time series to be trained is acquired as 10, the time corresponding to the value 10 in the time series to be trained is acquired, and this time is taken as the second time at the arbitrary time point. Based on the window information corresponding to the arbitrary time point and the second moment, a similar window corresponding to the window is obtained. For example, according to the window information corresponding to the arbitrary time point, if the length of the window information is 20, that is, 20 second moments with different values from the arbitrary time point are obtained, and the 20 second moments are combined, Get the non-similar window corresponding to the window.

Step S202: Training a preset model to be trained according to the windows to be trained, similar windows, and dissimilar windows, to obtain a trained preset model.

The acquired window, similar window and dissimilar window are trained in pairs of preset models to be trained, wherein the pair of preset models to be trained are trained as windows and similar windows, or windows and dissimilar windows. For example, the original two window time series data, namely window L = {X _t-10 ,X _t-9 ,...X _t-2 ,X _t-1 } and similar windows

Or, L={X _t-10 ,X _t-9 ,...X _t-2 ,X _t-1 } and dissimilar windows

Enter the left and right network layers as shown in Figure 5 respectively. In order to map the input of the two networks to the same new space, the weights of the two networks are shared. After model training, the mapping function of the network layer of the preset model is trained according to the label of each pair of windows, and then the feature difference between the similar window pair and the dissimilar window pair is learned, so that the distance of the similar window after mapping to the new space Close, the distance between the pair of dissimilar windows is longer. Then calculate the cross entropy of all matching window pairs as the loss function, and loop multiple times to update the network parameters by optimizing the loss function. Among them, w ₁ , w ₂ , w ₃ , w ₄ , and w ₅ are weight parameters, and x _t , x _t-1 and x _t+1 are L={X _t-10 ,X _t-9 ,...X _t-2 ,X _t-1 }, similar window

or

The value in. Improve the time series data mapping network structure, randomly delete extra connections in the network layer, thereby greatly enhancing the generalization of the model, broadening the scope of application, simplifying model parameters, reducing computational complexity, and reducing hardware configuration Requirements and save a lot of computing resources.

Step S203: Obtain a target window in the to-be-processed time series, and acquire a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one.

Step S204: Based on a preset model, determine a similarity value between the target window and the window to be processed according to the target window and the window to be processed.

Step S205: Determine whether the time point corresponding to the target window is an abnormal point according to the similarity value.

In the embodiment of the present application, the model automatically learns the feature difference between positive and negative sample pairs by collecting dissimilar windows and similar windows, omitting the subjective threshold selection step, and improving the accuracy of the model.

Please refer to FIG. 8. FIG. 8 is a schematic block diagram of an apparatus for detecting abnormal points in a time series according to an embodiment of the present application.

As shown in FIG. 8, the device 400 for detecting abnormal points in the time series includes: an acquiring module 401, a first determining module 402, and a second determining module 403.

The acquiring module 401 is configured to acquire a target window in a time series to be processed, and acquire a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

The first determining module 402, based on a preset model, determines a similarity value between the target window and the window to be processed according to the target window and the window to be processed;

The second determining module 403 is configured to determine whether the time point corresponding to the target window is an abnormal point according to the similarity value.

Among them, the obtaining module 401 is specifically also used for:

Determine the target time point to be detected on the time series to be processed;

Based on the preset window information and the target time point, a target window corresponding to the target time point is acquired.

Among them, the obtaining module 401 is specifically also used for:

Determine the collection strategy of the target time point according to the time sequence to be processed;

Based on the collection strategy and the preset window information, a window to be processed corresponding to the target window is acquired.

Wherein, the first determining module 402 is specifically further used for:

Based on a preset model, input the target window and the window to be processed into the preset model respectively;

Respectively acquiring the mapping parameter of the target window and the mapping parameter of the window to be processed through the weight parameter of the preset model;

Based on the mapping parameter of the target window and the mapping parameter of the window to be processed, the similarity value between the target window and the window to be processed is output.

Among them, the second determining module 403 is also specifically used for:

Determining whether the similarity value between the target window and each of the windows to be processed is less than a preset threshold;

If the similarity value between the target window and any of the windows to be processed is less than the preset threshold, it is determined that the target time point corresponding to the target window is an abnormal point.

Among them, the detection device for time series abnormal points is specifically used for:

Obtain the windows to be trained, similar windows and non-similar windows;

The preset model to be trained is trained according to the window to be trained, the similar window and the dissimilar window to obtain the preset model after training.

Determine any time point in the preset time sequence to be trained;

Determine window information based on the arbitrary time point, and obtain the window to be trained corresponding to the arbitrary time point;

Determining a time matching the arbitrary time point in the time sequence to be trained, and obtaining a corresponding similar window based on the window information;

Determine a time that does not match the arbitrary time point in the time sequence to be trained, and obtain a corresponding non-similar window based on the window information.

It should be noted that those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working process of the above-described device and each module and unit can be referred to in the above-mentioned time series abnormal point detection method embodiment The corresponding process will not be repeated here.

The apparatus provided in the foregoing embodiment may be implemented in the form of a computer program, and the computer program may run on the computer device as shown in FIG. 9.

Please refer to FIG. 9, which is a schematic block diagram of the structure of a computer device provided by an embodiment of the application. The computer device may be a terminal.

As shown in FIG. 9, the computer device includes a processor, a memory, and a network interface connected through a system bus, where the memory may include a non-volatile storage medium and an internal memory.

The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any method for detecting abnormal points in a time series.

The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any method for detecting abnormal points in the time series.

The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art can understand that the structure shown in FIG. 9 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. Specifically, the computer device may Including more or fewer parts than shown in the figure, or combining some parts, or having a different arrangement of parts.

It should be understood that the processor may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), and application specific integrated circuits (Application Specific Integrated Circuits). Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor.

Wherein, in an embodiment, the processor is used to run a computer program stored in a memory to implement the following steps:

In an embodiment, when the processor obtains the realization of the target window in the to-be-processed time sequence, it is used to realize:

In an embodiment, when the processor obtains the realization of the to-be-processed window corresponding to the target window, it is used to realize:

In one embodiment, when the processor determines the similarity value between the target window and the window to be processed based on a preset model and based on the target window and the window to be processed, the processor is configured to implement:

In an embodiment, when the processor determines whether the time point corresponding to the target window is an abnormal point realization according to the similarity value, the processor is used to realize:

In an embodiment, when the processor acquires the target window of the to-be-processed time sequence before being implemented, it is used to implement:

Obtain the windows to be trained, similar windows and non-similar windows;

In one embodiment, when the processor obtains the windows to be trained, the similar windows and the dissimilar windows to be implemented, it is used to implement:

Determine any time point in the preset time sequence to be trained;

The embodiments of the present application also provide a computer-readable storage medium, the computer-readable storage medium may be volatile or non-volatile, and the computer-readable storage medium stores a computer program, so The computer program includes program instructions, and the following steps are implemented when the program instructions are executed:

For the embodiments of the steps implemented when the program instructions are executed, reference may be made to the various embodiments of the method for detecting abnormal points in the time series of the present application.

The computer-readable storage medium may be the internal storage unit of the computer device described in the foregoing embodiment, for example, the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), and a Secure Digital (SD) ) Card, Flash Card, etc.

Further, the computer-readable storage medium may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, an application program required by at least one function, etc.; the storage data area may store Data created by the use of nodes, etc.

The blockchain referred to in this application is a new application mode of computer technology such as storage of preset models, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information for verification. The validity of the information (anti-counterfeiting) and the generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

It should be noted that in this article, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements not only includes those elements, It also includes other elements that are not explicitly listed, or elements inherent to the process, method, article, or system. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, article, or system that includes the element.

The serial numbers of the foregoing embodiments of the present application are for description only, and do not represent the superiority or inferiority of the embodiments. The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Anyone familiar with the technical field can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, these modifications or replacements shall be covered within the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

A method for detecting abnormal points in a time series, wherein the method for detecting abnormal points in a time series includes:

Acquiring a target window in the to-be-processed time sequence, and acquiring a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

Based on a preset model, determining a similarity value between the target window and the window to be processed according to the target window and the window to be processed;

According to the similarity value, it is determined whether the time point corresponding to the target window is an abnormal point.
The method for detecting abnormal points in a time series according to claim 1, wherein said obtaining the target window in the time series to be processed comprises:

Determine the target time point to be detected on the time series to be processed;

Based on the preset window information and the target time point, a target window corresponding to the target time point is acquired.
The method for detecting abnormal points in a time series according to claim 2, wherein said obtaining the window to be processed corresponding to the target window comprises:

Determine the collection strategy of the target time point according to the time sequence to be processed;

Based on the collection strategy and the preset window information, a window to be processed corresponding to the target window is acquired.
The method for detecting abnormal points in a time series according to claim 1, wherein the determining the similarity value between the target window and the window to be processed according to the target window and the window to be processed based on a preset model includes ；

Based on a preset model, input the target window and the window to be processed into the preset model respectively;

Respectively acquiring the mapping parameter of the target window and the mapping parameter of the window to be processed through the weight parameter of the preset model;

Based on the mapping parameter of the target window and the mapping parameter of the window to be processed, the similarity value between the target window and the window to be processed is output.
The method for detecting abnormal points in a time series according to claim 1, wherein the determining whether a time point corresponding to the target window is an abnormal point according to the similarity value comprises:

Determining whether the similarity value between the target window and each of the windows to be processed is less than a preset threshold;

If the similarity value between the target window and any of the windows to be processed is less than the preset threshold, it is determined that the target time point corresponding to the target window is an abnormal point.
The method for detecting abnormal points in a time series according to claim 1, wherein before said obtaining the target window of the time series to be processed, the method further comprises:

Obtain the windows to be trained, similar windows and non-similar windows;

The preset model to be trained is trained according to the window to be trained, the similar window and the dissimilar window to obtain the preset model after training.
The method for detecting abnormal points in a time series according to claim 6, wherein said obtaining the window to be trained, the similar window and the non-similar window comprises:

Determine any time point in the preset time sequence to be trained;

Determine window information based on the arbitrary time point, and obtain the window to be trained corresponding to the arbitrary time point;

Determining a time matching the arbitrary time point in the time sequence to be trained, and obtaining a corresponding similar window based on the window information;

Determine a time that does not match the arbitrary time point in the time sequence to be trained, and obtain a corresponding non-similar window based on the window information.
A device for detecting abnormal points in a time series, wherein the device for detecting abnormal points in a time series includes:

An obtaining module, configured to obtain a target window in a time series to be processed, and obtain a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

The first determining module is configured to determine the similarity value between the target window and the window to be processed according to the target window and the window to be processed based on a preset model;

The second determining module is configured to determine whether the time point corresponding to the target window is an abnormal point according to the similarity value.
A computer device, wherein the computer device includes a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein when the computer program is executed by the processor, the The following steps:

Acquiring a target window in the to-be-processed time sequence, and acquiring a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

Based on a preset model, determining a similarity value between the target window and the window to be processed according to the target window and the window to be processed;

According to the similarity value, it is determined whether the time point corresponding to the target window is an abnormal point.
9. The computer device according to claim 9, wherein said obtaining the target window in the time series to be processed comprises:

Determine the target time point to be detected on the time series to be processed;

Based on the preset window information and the target time point, a target window corresponding to the target time point is acquired.
10. The computer device according to claim 10, wherein said obtaining the to-be-processed window corresponding to the target window comprises:

Determine the collection strategy of the target time point according to the time sequence to be processed;

Based on the collection strategy and the preset window information, a window to be processed corresponding to the target window is acquired.
9. The computer device according to claim 9, wherein the determining the similarity value between the target window and the window to be processed according to the target window and the window to be processed based on a preset model comprises;

Based on a preset model, input the target window and the window to be processed into the preset model respectively;

Respectively acquiring the mapping parameter of the target window and the mapping parameter of the window to be processed through the weight parameter of the preset model;

Based on the mapping parameter of the target window and the mapping parameter of the window to be processed, the similarity value between the target window and the window to be processed is output.
9. The computer device according to claim 9, wherein the determining whether the time point corresponding to the target window is an abnormal point according to the similarity value comprises:

Determining whether the similarity value between the target window and each of the windows to be processed is less than a preset threshold;

If the similarity value between the target window and any of the windows to be processed is less than the preset threshold, it is determined that the target time point corresponding to the target window is an abnormal point.
9. The computer device according to claim 9, wherein, before said obtaining the target window of the time sequence to be processed, the following steps are further implemented when the computer program is executed by the processor:

Obtain the windows to be trained, similar windows and non-similar windows;

The preset model to be trained is trained according to the window to be trained, the similar window and the dissimilar window to obtain the preset model after training.
The computer device according to claim 14, wherein said acquiring a window to be trained, a similar window and a non-similar window comprises:

Determine any time point in the preset time sequence to be trained;

Determine window information based on the arbitrary time point, and obtain the window to be trained corresponding to the arbitrary time point;

Determining a time matching the arbitrary time point in the time sequence to be trained, and obtaining a corresponding similar window based on the window information;

Determine a time that does not match the arbitrary time point in the time sequence to be trained, and obtain a corresponding non-similar window based on the window information.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

Acquiring a target window in the to-be-processed time sequence, and acquiring a to-be-processed window corresponding to the target window, wherein the number of the to-be-processed windows is greater than one;

Based on a preset model, determining a similarity value between the target window and the window to be processed according to the target window and the window to be processed;

According to the similarity value, it is determined whether the time point corresponding to the target window is an abnormal point.
15. The computer-readable storage medium according to claim 16, wherein said obtaining the target window in the to-be-processed time series comprises:

Determine the target time point to be detected on the time series to be processed;

Based on the preset window information and the target time point, a target window corresponding to the target time point is acquired.
17. The computer-readable storage medium according to claim 17, wherein said obtaining the to-be-processed window corresponding to the target window comprises:

Determine the collection strategy of the target time point according to the time sequence to be processed;

Based on the collection strategy and the preset window information, a window to be processed corresponding to the target window is acquired.
15. The computer-readable storage medium of claim 16, wherein the determining the similarity value between the target window and the window to be processed according to the target window and the window to be processed based on a preset model comprises;

Based on a preset model, input the target window and the window to be processed into the preset model respectively;

Respectively acquiring the mapping parameter of the target window and the mapping parameter of the window to be processed through the weight parameter of the preset model;

Based on the mapping parameter of the target window and the mapping parameter of the window to be processed, the similarity value between the target window and the window to be processed is output.
15. The computer-readable storage medium of claim 16, wherein the determining whether the time point corresponding to the target window is an abnormal point according to the similarity value comprises:

Determining whether the similarity value between the target window and each of the windows to be processed is less than a preset threshold;

If the similarity value between the target window and any of the windows to be processed is less than the preset threshold, it is determined that the target time point corresponding to the target window is an abnormal point.