CN112445832A - Data anomaly detection method and device, electronic equipment and storage medium - Google Patents
Data anomaly detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN112445832A CN112445832A CN201910804714.0A CN201910804714A CN112445832A CN 112445832 A CN112445832 A CN 112445832A CN 201910804714 A CN201910804714 A CN 201910804714A CN 112445832 A CN112445832 A CN 112445832A
- Authority
- CN
- China
- Prior art keywords
- trend
- time
- trend change
- time point
- point set
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 73
- 230000008859 change Effects 0.000 claims abstract description 370
- 230000002159 abnormal effect Effects 0.000 claims abstract description 47
- 238000001914 filtration Methods 0.000 claims description 19
- 238000012417 linear regression Methods 0.000 claims description 18
- 230000004044 response Effects 0.000 claims description 14
- 230000005856 abnormality Effects 0.000 claims description 12
- 238000012163 sequencing technique Methods 0.000 claims description 10
- 230000002547 anomalous effect Effects 0.000 claims description 3
- 238000010276 construction Methods 0.000 claims description 2
- 238000000034 method Methods 0.000 abstract description 18
- 238000012545 processing Methods 0.000 description 13
- 238000004891 communication Methods 0.000 description 10
- 230000001174 ascending effect Effects 0.000 description 7
- 238000010586 diagram Methods 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 6
- 230000000717 retained effect Effects 0.000 description 6
- 230000007774 longterm Effects 0.000 description 5
- 230000009286 beneficial effect Effects 0.000 description 4
- 230000003287 optical effect Effects 0.000 description 4
- 230000005236 sound signal Effects 0.000 description 4
- 101150117538 Set2 gene Proteins 0.000 description 3
- 238000012790 confirmation Methods 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 230000002829 reductive effect Effects 0.000 description 3
- 101150055297 SET1 gene Proteins 0.000 description 2
- 230000001133 acceleration Effects 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 230000006978 adaptation Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000012937 correction Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000003111 delayed effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 238000003384 imaging method Methods 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 230000000670 limiting effect Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000002441 reversible effect Effects 0.000 description 1
- 230000000630 rising effect Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000010183 spectrum analysis Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000012731 temporal analysis Methods 0.000 description 1
- 238000000700 time series analysis Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Probability & Statistics with Applications (AREA)
- Fuzzy Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The present disclosure relates to a data anomaly detection method, apparatus, electronic device, and storage medium, the method comprising: acquiring target service data to be detected; acquiring a first cross time point set of an average value curve of target service data under different first category time periods and a second cross time point set of the average value curve of the target service data under different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period; acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set; acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set; and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal. The method has the advantages of reducing the abnormal detection cost and improving the accuracy of the detection result.
Description
Technical Field
The present disclosure relates to the field of data processing technologies, and in particular, to a data anomaly detection method and apparatus, an electronic device, and a storage medium.
Background
In the scene of service time sequence data analysis, anomaly detection is a common scene, and the trend of indexes can be preliminarily obtained by analyzing the fluctuation rate and the slope of time sequence service indexes. However, generally, random factors exist in the service fluctuation, and under the interference of the random factors, a plurality of short-term fluctuations occur in the index, and if interference elimination is not performed, an erroneous growth conclusion can be obtained.
The traditional data anomaly detection focuses on short-term fluctuation anomaly, the time sequence is fitted for prediction to a certain degree, and if the actual value exceeds the prediction confidence interval, the data is considered to be anomalous; or performing derivative calculation, such as singular spectrum analysis, on the original time sequence waveform to obtain a derivative waveform and perform abnormal scanning in a mode of setting a threshold. The long-term trend anomaly detection is different from the short-term fluctuation anomaly detection method, the long-term trend anomaly detection is characterized in that certain fluctuation is eliminated to obtain a stable and smooth curve, and the corresponding service problem is locked through the change of the slope of the curve.
However, short-term anomaly detection is susceptible to noise, such as heavy snow in the south, which affects the amount of short video production, and local tower faults affect the network behavior in this area, but none of these are traffic anomalies, much like noise caused by a random phenomenon. And long-term abnormal detection easily causes detection result lag, and cannot accurately position the time point of trend change, so that the accuracy of the abnormal detection result is not high, and the business risk is increased.
Disclosure of Invention
The present disclosure provides a data anomaly detection method, apparatus, electronic device and storage medium, to at least solve the problems in the related art that the detection result is easily affected by noise and the accuracy of the anomaly detection result is not high. The technical scheme of the disclosure is as follows:
according to a first aspect of the embodiments of the present disclosure, a data anomaly detection method is provided, which includes:
acquiring target service data to be detected;
acquiring a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period;
acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set;
acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set;
and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal.
Optionally, the step of obtaining the trend change time point set of the target service data according to the first cross time point set and the second cross time point set includes:
for each second crossing time point in the second crossing time point set, acquiring an Nth first crossing time point before the second crossing time point from the first crossing time point set as a trend change time point, wherein N is a positive integer;
and sequencing the trend change time points according to the time sequence to obtain the trend change time point set.
Optionally, the step of arranging the trend change time points in a time sequence to obtain the trend change time point set includes:
sequencing the trend change time points according to a time sequence;
filtering the trend change time points according to the time distance between every two adjacent trend change time points until the reserved time distance between every two adjacent trend change time points meets a preset time threshold, and constructing a trend change time point set by the reserved trend change time points;
wherein, each filtration process comprises:
taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points;
and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance.
Optionally, the trend change parameter includes at least one of a linear regression slope, a change speed, and a change amplitude.
Optionally, the step of obtaining a trend change parameter between every two adjacent trend change time points in the trend change time point set includes:
acquiring a trend time period between every two adjacent trend change time points in the trend change time point set;
performing linear regression on the service data in the trend time period aiming at each trend time period, and acquiring a linear slope of the trend time period;
and acquiring the change speed and/or the change amplitude of the trend time period according to the starting time, the ending time, the starting point data value and the end point data value of the trend time period.
Optionally, the step of confirming that the service data corresponding to the trend change parameter is abnormal in response to the trend change parameter satisfying a preset abnormal condition includes:
acquiring the current trend of the target service data according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period;
and responding to the current trend meeting a preset abnormal condition, confirming that the service data corresponding to the current trend time period is abnormal, and performing service alarm.
According to a second aspect of the embodiments of the present disclosure, there is provided a data abnormality detection apparatus including:
the target service data acquisition module is configured to acquire target service data to be detected;
the crossing time point acquisition module is configured to execute the steps of acquiring a first crossing time point set of an average value curve of the target service data in different first category time periods and a second crossing time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period;
a trend change time point acquisition module configured to perform acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set;
a trend change parameter obtaining module configured to perform obtaining a trend change parameter between every two adjacent trend change time points in the trend change time point set;
and the data abnormity confirming module is configured to execute and respond that the trend change parameter meets a preset abnormity condition, and confirm that the business data corresponding to the trend change parameter is abnormal.
Optionally, the trend change time point obtaining module includes:
a trend change time point obtaining sub-module configured to perform, for each second intersection time point in the second intersection time point set, obtaining an nth first intersection time point before the second intersection time point from the first intersection time point set as a trend change time point, where N is a positive integer;
and the trend change time point set construction submodule is configured to perform sorting on the trend change time points according to a time sequence to obtain the trend change time point set.
Optionally, the trend change time point set constructing sub-module includes:
a trend change time point sorting unit configured to perform sorting of the trend change time points in chronological order;
a trend change time point filtering unit configured to perform filtering on trend change time points according to a time distance between every two adjacent trend change time points until a retained time distance between every two adjacent trend change time points satisfies a preset time threshold, and construct a set of trend change time points with the retained trend change time points;
wherein, each filtration process comprises:
taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points;
and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance.
Optionally, the trend change parameter includes at least one of a linear regression slope, a change speed, and a change amplitude.
Optionally, the trend change parameter obtaining module includes:
a trend time period obtaining submodule configured to perform obtaining a trend time period between every two adjacent trend change time points in the trend change time point set;
the linear slope obtaining submodule is configured to perform linear regression on the service data in the trend time period aiming at each trend time period and obtain the linear slope of the trend time period;
and the actual change parameter acquisition sub-module is configured to acquire the change speed and/or the change amplitude of the trend time period according to the start time, the end time, the starting point data value and the end point data value of the trend time period.
Optionally, the data exception confirming module includes:
the current trend acquisition sub-module is configured to execute the acquisition of the current trend of the target service data according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period;
and the data abnormity confirming submodule is configured to execute responding to the current trend meeting a preset abnormity condition, confirm the business data abnormity corresponding to the current trend time period, and perform business alarm.
According to a third aspect of the embodiments of the present disclosure, there is provided an electronic apparatus including:
a processor;
a memory for storing the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement any of the data anomaly detection methods as previously described.
According to a fourth aspect of embodiments of the present disclosure, there is provided a storage medium, wherein instructions that, when executed by a processor of an electronic device, enable the electronic device to perform any one of the data anomaly detection methods as described above.
According to a fifth aspect of embodiments of the present disclosure, there is provided a computer program product, which when executed by a processor of an electronic device, enables the electronic device to perform any one of the data anomaly detection methods as described above.
The technical scheme provided by the embodiment of the disclosure at least brings the following beneficial effects:
in the embodiment of the disclosure, target service data to be detected is acquired; acquiring a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period; acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set; acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set; and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal. The method has the beneficial effects of reducing the abnormal detection cost and improving the accuracy of the detection result.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure and are not to be construed as limiting the disclosure.
FIG. 1 is a flow chart illustrating a method of data anomaly detection according to an exemplary embodiment.
FIG. 2 is a flow chart illustrating another method of data anomaly detection according to an example embodiment.
Fig. 3 is a block diagram illustrating a data anomaly detection apparatus according to an exemplary embodiment.
Fig. 4 is a block diagram illustrating another data anomaly detection apparatus according to an exemplary embodiment.
FIG. 5 is a block diagram illustrating an apparatus in accordance with an example embodiment.
FIG. 6 is a block diagram illustrating another apparatus according to an example embodiment.
Detailed Description
In order to make the technical solutions of the present disclosure better understood by those of ordinary skill in the art, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.
It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the disclosure described herein are capable of operation in sequences other than those illustrated or otherwise described herein. The implementations described in the exemplary embodiments below are not intended to represent all implementations consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.
Fig. 1 is a flowchart illustrating a data anomaly detection method according to an exemplary embodiment, where as shown in fig. 1, the data anomaly detection method can be used in a mobile terminal such as a mobile phone or a computer, and includes the following steps:
in step S11, target service data to be detected is acquired.
In step S12, according to the time sequence relationship of the target service data, a first cross time point set of the average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods are obtained; the second category time period is greater than the first category time period.
In the embodiment of the present disclosure, in order to perform data anomaly detection, target service data to be detected needs to be obtained first, and specifically, the target service data may be obtained by any available method, which is not limited in the embodiment of the present disclosure. And according to the generation time of different target service data, the time sequence relation of the target service data can be obtained, and further abnormality detection is sequentially carried out according to the time sequence relation of the target service data.
The average value curve is a common time series analysis method in statistics, is usually found in time series data, and is used to smooth short-term fluctuations and reflect a longer-term variation trend or period, and specifically, data in a certain time period may be averaged, and the average values in different time periods are connected to form an average value curve. Furthermore, the place where the two average curves of different time periods intersect is usually the orientation of the data where the trend changes.
As mentioned above, the curves of the average values in different time periods intersect near the service inflection point, and the position where the inflection point usually occurs is the time when the abnormal trend of the service changes. In the embodiment of the present disclosure, in order to reduce the hysteresis of long-term abnormality detection while eliminating short-term fluctuations, the average value curves of different types of time periods may be combined.
The category of the time period may be divided according to the length of the time period. For example, two time period categories may be set according to the length of the time period, and the time length range of the first category time period is smaller than the time length range of the second category time period, where the first category time period is a short time period relative to the second category time period, and the second category time period is a long time period relative to the first category time period.
Specifically, a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of an average value curve of the target service data in different second category time periods may be obtained according to the time sequence relationship of the target service data; the second category time period is greater than the first category time period.
For example, two different first category time periods w1 and w2 may be selected according to the service requirement, and w1< w2, two average value curves when the time period lengths are w1 and w2 may be taken for the target service data, respectively. At this time, since w2 is greater than w1, the average curve under w2 has a longer delay than the average curve under w1, and the average curve under w2 always changes slower than the average curve under w1, and the speed of rising or falling is slow, so that when the trend of the target traffic data changes, the two different average curves have to intersect. Therefore, the intersection time point set of the average curve in the first category time period, that is, the first intersection time point set, can be obtained according to the positions of the intersection points of the average curves corresponding to w1 and w 2.
Correspondingly, different second category time periods such as w3 and w4 can be selected according to the service requirements, and w3 is less than w4, so that a second cross time point set of the average value curves of the target service data under w3 and w4 can be obtained. The method for obtaining the first cross time point set of the average value curve in the first category time period may be referred to specifically, and is not described herein again.
The specific number of the first category time period and the second category time period may be preset according to a requirement, and the crossing time points of the average value curves in the plurality of different time periods may include the crossing time points of at least any two average value curves. The specific value ranges of the first category time period and the second category time period may be preset according to specific service requirements, and the embodiment of the present disclosure is not limited.
In addition, in the embodiment of the disclosure, the variation of the average curve before and after the intersection point may also represent the variation trend of the current data. For example, for the above-mentioned time periods w1 and w2, when the state is changed from the value of the mean value curve corresponding to w1< the value of the mean value curve corresponding to w2 > the value of the mean value curve corresponding to w1 > the value of the mean value curve corresponding to w2, the trend of the target traffic data is changed from a falling or gentle trend to an ascending trend; conversely, when the state is changed from the value of the mean value curve corresponding to w1 > the value of the mean value curve corresponding to w2 to the value of the mean value curve corresponding to w1< the value of the mean value curve corresponding to w2, the trend of the target traffic data is changed from the upward trend to the downward or smooth trend.
In step S13, a set of trend change time points of the target service data is obtained according to the first set of intersection time points and the second set of intersection time points.
As described above, the existing trend inflection points detected in a shorter time period, that is, the intersection time points are numerous, so that the complexity of service analysis and investigation is increased, and the method is easily affected by short-term abnormal values, and the effect fluctuation is large, so that the long-term trend change which is more concerned by the service cannot be accurately detected; however, a relatively serious problem of inflection point hysteresis occurs when a relatively long time period is used for detection, that is, a found trend inflection point is delayed from a real service inflection point obviously, and the more the time period length is, the more the hysteresis is obvious, so that the accurate position of the trend inflection point cannot be accurately positioned.
Therefore, in the embodiment of the present disclosure, in order to improve the accuracy of the detected trend inflection point, the final trend inflection point may be determined by combining the intersection time points in the long and short time periods, that is, the trend change time point set of the target service data is obtained according to the first intersection time point set corresponding to the first category time period and the second intersection time point set corresponding to the second category time period. Specifically, the trend change time point set of the target service data may be obtained by correcting the second cross time point in the second category time period according to the first cross time point in the first category time period, and/or filtering the first cross time point in the first category time period according to the second cross time point in the second category time period. The correction strategy and/or the filtering strategy may be preset according to the requirement, and the embodiment of the present disclosure is not limited.
In step S14, a trend change parameter between every two adjacent trend change time points in the set of trend change time points is acquired.
After the final trend change time point set of the target service data is obtained, data anomaly detection can be further performed according to each trend change time point in the trend change time point set. At this time, data anomaly detection can be performed by taking service data between every two adjacent trend change time points in the front and back direction as a unit, so as to obtain trend change parameters between every two adjacent trend change time points in the trend change time point set in the front and back direction. Wherein, two adjacent trend change time points refer to two adjacent trend change time points according to the time sequence.
The content specifically included in the trend change parameter may be preset according to a requirement, and the embodiment of the present disclosure is not limited. For example, the trend change parameters may be set to include, but not limited to, a data change speed, a data change amplitude, and the like of the traffic data between the front and rear adjacent trend change time points. Furthermore, in the embodiments of the present disclosure, the trend change parameter may also be obtained in any available manner, and the embodiments of the present disclosure are not limited thereto.
For example, if the trend change parameter includes a data change amplitude, the data values at two adjacent trend change time points may be obtained, and then the difference between the data value at the next trend change time point and the data value at the previous trend change time point is taken, so as to obtain the corresponding data change amplitude between the two adjacent trend change time points.
In step S15, in response to that the trend change parameter satisfies a preset abnormal condition, it is determined that the business data corresponding to the trend change parameter is abnormal.
After the trend change parameters between every two adjacent trend change time points in the trend change time point set are obtained, whether data between every two adjacent trend change time points are abnormal or not can be detected according to the trend change parameters. Specifically, a corresponding abnormal condition may be preset for the trend change parameter according to the service requirement, and if the trend change parameter between some two adjacent trend change time points satisfies the abnormal condition, the service data abnormality corresponding to the corresponding trend change parameter may be confirmed, that is, the service data abnormality between the corresponding two adjacent trend change time points is confirmed, and/or the service data abnormality at the previous trend change time point of the corresponding two adjacent trend change time points is confirmed, and so on. Otherwise, it can be confirmed that the service data corresponding to the corresponding trend change parameter is not abnormal.
For example, if the trend change parameter includes a change amplitude and the preset prediction condition is that the change amplitude is a negative value, if the change amplitude between some two adjacent trend change time points is a negative value, it may be determined that the corresponding traffic data is abnormal.
In the embodiment of the present disclosure, after acquiring the trend change parameter between two adjacent trend change time points, data anomaly detection may be performed on the current trend change parameter; after acquiring the trend change parameter between every two adjacent trend change time points in the trend change time point set, performing anomaly detection on the service data corresponding to the corresponding trend change parameter according to the trend change parameter between every two adjacent trend change time points in sequence; or a certain time period can be taken as a period, and the abnormal detection is carried out on the service data in one time period each time; and so on. The specific configuration may be preset according to the requirement, and the embodiment of the present disclosure is not limited.
In the embodiment of the disclosure, target service data to be detected is acquired; acquiring a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period; acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set; acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set; and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal. The method has the beneficial effects of reducing the abnormal detection cost and improving the accuracy of the detection result.
Referring to fig. 2, in an embodiment of the present disclosure, the step S13 may further include:
step S131, for each second crossing time point in the second crossing time point set, acquiring an nth first crossing time point before the second crossing time point from the first crossing time point set as a trend change time point, where N is a positive integer.
And S132, sequencing the trend change time points according to the time sequence to obtain the trend change time point set.
Because the time period corresponding to the first cross time point set is smaller than the time period corresponding to the second cross time point set, that is, the number of first cross time points included in the first cross time point set is generally greater than the number of second cross time points included in the second cross time point set, and the hysteresis of the second cross time points is higher than that of the first cross time points. Therefore, in the embodiment of the present disclosure, in order to improve the accuracy of each trend change time point obtained by screening, according to each second intersection time point in the second intersection time point set, a first intersection time point which is matched with the first intersection time point set and has low hysteresis may be obtained from the first intersection time point set as a trend change time point, so that the number of the trend change time points is reduced, and the accuracy of each trend change time point is improved.
Specifically, for each second crossing time point in the second crossing time point set, an nth first crossing time point before the second crossing time point is obtained from the first crossing time point set as a trend change time point, and then the trend change time points may be sorted according to a time sequence to obtain the trend change time point set. The value of N is a positive integer, and the specific value of N may be preset according to a service requirement, which is not limited in this embodiment of the present disclosure, for example, N may be 1, and the like.
For example, for the first set of crossing time points set _ l and the second set of crossing time points set _2, the two sets of time points set _1 and set _2 may be arranged in reverse order according to time, then each second crossing time point t _ i in set _2 is traversed, the nth first crossing time point t _ s before t _ i is found from set _1 as a trend change time point, and so on, the trend change time point corresponding to each second crossing time point may be obtained. And then, sequencing the trend change time points according to the time sequence, and further constructing and obtaining a current trend change time point set of the target service data.
Optionally, in an embodiment of the present disclosure, the step S132 may further include:
step A1, sorting the trend change time points according to the time sequence;
step A2, filtering the trend change time points according to the time distance between every two adjacent trend change time points until the reserved time distance between every two adjacent trend change time points meets a preset time threshold, and constructing a trend change time point set by the reserved trend change time points;
wherein, each filtration process comprises:
step A21, taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points;
step A22, in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in the trend change time point combination corresponding to the time distance.
In addition, in practical application, if the two trend change time points are close to each other, the data anomaly detection is still easily affected by short-term anomaly values, and the complexity of the service data anomaly detection is increased.
Therefore, in the embodiment of the present disclosure, in order to further reduce the influence of short-term abnormal values and the complexity of data abnormality detection, after the trend change time points are sorted in the time sequence, the trend change time points may be further filtered according to the time distance between every two adjacent trend change time points, so as to avoid that the trend change time points are too close to each other. Specifically, the trend change time points may be filtered according to a time distance between every two adjacent trend change time points until the retained time distance between every two adjacent trend change time points satisfies a preset time threshold, and the trend change time point set is constructed with the retained trend change time points. The specific value of the preset time threshold may be preset according to a service requirement, and the embodiment of the present disclosure is not limited.
In each filtering process, every two adjacent trend change time points can be a group, and the time distance between every two adjacent trend change time points is obtained; and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance.
Specifically, when a time distance between two trend change time points in the trend change time point combination exceeds a preset time threshold, at least one trend change time point in the corresponding trend change time point combination may be correspondingly deleted, and when only one trend change time point is deleted, the previous trend change time point may be deleted, or the next trend change time point may be deleted.
Moreover, in order to ensure that the time distance between every two adjacent trend change time points in the finally generated trend change time point set meets the preset time threshold, the initially acquired trend change time points may be filtered at least once.
Optionally, in the disclosed embodiment, the trend change parameter may include, but is not limited to, at least one of a linear regression slope, a change speed, and a change amplitude.
The linear regression slope may include a slope obtained by performing linear regression on service data between two adjacent trend change time points; the actual change speed may include an average change speed, a real-time change speed, and the like of the traffic data between two adjacent trend change time points; the actual variation amplitude may include a variation amplitude of the traffic data at the latter trend change time point with respect to the former trend change time point, and the like.
Referring to fig. 2, in an embodiment of the present disclosure, the step S14 may further include:
step S141, acquiring a trend time period between every two adjacent trend change time points in the trend change time point set;
step S142, performing linear regression on the service data in the trend time period aiming at each trend time period, and acquiring a linear slope of the trend time period;
and step S143, acquiring the change speed and/or the change amplitude of the trend time period according to the start time, the end time, the start data value and the end data value of the trend time period.
In the embodiment of the present disclosure, in order to obtain a trend change parameter between every two adjacent trend change time points, the target service data may be divided by the trend change time points, and a trend time period between every two adjacent trend change time points in the trend change time point set is obtained, so that for each trend time period, the service data in one trend time period may be subjected to linear regression, and then a linear slope of the corresponding trend time period is obtained. Where linear regression can be performed in any useful manner, the disclosed embodiments are not limited in this regard.
In addition, the corresponding change speed and/or change amplitude of each trend time period can be obtained according to the starting time, the ending time, the starting point data value and the ending point data value of each trend time period.
For example, assuming that the start time of the current trend period is t0, the end time is t1, the data value at the start is y0, and the data value at the end is yt, the change speed of the corresponding trend period may be obtained to include (yt-y0)/(t1-t0), and the change amplitude may include yt-y 0.
Referring to fig. 2, in an embodiment of the present disclosure, the step S15 may further include:
step S151, acquiring the current trend of the target service data according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period;
step S152, in response to that the current trend meets a preset abnormal condition, determining that the service data corresponding to the current trend time period is abnormal, and performing service alarm.
In practical applications, the expected trend of data change will be different according to different business requirements. For example, for some regular services, the trend of data is continuously relatively smooth, for some problem removal services, the trend of data is continuously descending, and for some data production services, the trend of data is continuously ascending. The exception conditions set by different services will be different accordingly. Or, some data services may require that the data change trend thereof is relatively stable, such as being in an ascending or steady state all the time, or being in a descending state all the time, and so on.
Moreover, in the embodiment of the present disclosure, in order to perform a data anomaly alarm in time, real-time data anomaly detection may be performed on a current trend time period including current latest data, and specifically, a current trend of the target service data may be obtained according to a trend change parameter of the current trend time period and a trend change parameter of a previous trend time period.
For example, according to the trend change parameter of the current trend time period, it can be known that the data of the current trend time period is in an ascending trend, and according to the trend change parameter of the previous trend time period, it is known that the data of the previous trend time period is in a descending trend, and it can be obtained that the current trend of the target service data changes from ascending to descending. And if the preset abnormal condition comprises that the current trend is changed from ascending or extremely-fast ascending to descending or gentle, determining that the service data corresponding to the current trend time period is abnormal, and performing service alarm aiming at the target service data. The specific service alarm mode can be set by user according to requirements, and the embodiment of the disclosure is not limited.
Moreover, in order to facilitate the related staff to know the position of the data abnormality in time, the trend time period in which the data abnormality occurs and/or the previous trend change time point in the trend time period can be simultaneously prompted during the service alarm, and the like. The specific prompting mode can also be set by self-definition according to requirements, and the embodiment of the disclosure is not limited.
In the embodiment of the present disclosure, by aiming at each second intersection time point in the second intersection time point set, obtaining an nth first intersection time point before the second intersection time point from the first intersection time point set as a trend change time point, where N is a positive integer; and sequencing the trend change time points according to the time sequence to obtain the trend change time point set. Sequencing the trend change time points according to the time sequence; filtering the trend change time points according to the time distance between every two adjacent trend change time points until the reserved time distance between every two adjacent trend change time points meets a preset time threshold, and constructing a trend change time point set by the reserved trend change time points; wherein, each filtration process comprises: taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points; and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance. The accuracy of each trend change time point can be improved, the workload of anomaly detection can be further reduced, and the accuracy of an anomaly detection result can be improved.
Furthermore, in the disclosed embodiment, the trend change parameter includes at least one of a linear regression slope, a change speed, and a change amplitude. In addition, a trend time period between every two adjacent trend change time points in the trend change time point set can be obtained; performing linear regression on the service data in the trend time period aiming at each trend time period, and acquiring a linear slope of the trend time period; and acquiring the change speed and/or the change amplitude of the trend time period according to the starting time, the ending time, the starting point data value and the end point data value of the trend time period. The accuracy of the acquired trend change parameters can be improved.
In addition, the current trend of the target service data can be obtained according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period; and responding to the current trend meeting a preset abnormal condition, confirming that the service data corresponding to the current trend time period is abnormal, and performing service alarm. Therefore, abnormity detection can be carried out in time aiming at the current business data, business alarm can be carried out in time under the condition of data abnormity, and the accuracy of the data detection result and the timeliness of alarm are improved.
Fig. 3 is a block diagram illustrating a data anomaly detection apparatus according to an exemplary embodiment. Referring to fig. 3, the apparatus includes: the system comprises a target service data acquisition module 21, a cross time point acquisition module 22, a trend change time point acquisition module 23, a trend change parameter acquisition module 24 and a data abnormity confirmation module 25.
A target service data acquiring module 21 configured to perform acquiring target service data to be detected;
a crossing time point obtaining module 22 configured to obtain a first crossing time point set of the average value curve of the target service data in different first category time periods and a second crossing time point set of the average value curve of the target service data in different second category time periods according to the time sequence relationship of the target service data; the second category time period is greater than the first category time period;
a trend change time point obtaining module 23 configured to perform obtaining a trend change time point set of the target service data according to the first cross time point set and the second cross time point set;
a trend parameter obtaining module 24 configured to perform obtaining a trend parameter between every two adjacent trend time points in the set of trend time points;
and the data abnormity confirming module 25 is configured to execute confirming that the business data corresponding to the trend change parameter is abnormal in response to the trend change parameter meeting a preset abnormity condition.
In the embodiment of the disclosure, target service data to be detected is acquired; acquiring a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period; acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set; acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set; and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal. The method has the beneficial effects of reducing the abnormal detection cost and improving the accuracy of the detection result.
Referring to fig. 4, in the embodiment of the present disclosure, the trend change time point obtaining module 23 may further include:
a trend change time point obtaining sub-module 231 configured to perform, for each second crossing time point in the second crossing time point set, obtaining an nth first crossing time point before the second crossing time point from the first crossing time point set as a trend change time point, where N is a positive integer;
the trend change time point set constructing sub-module 232 is configured to perform sorting the trend change time points according to a time sequence, so as to obtain the trend change time point set.
Optionally, in this embodiment of the disclosure, the trend change time point set building sub-module 232 further may include:
a trend change time point sorting unit configured to perform sorting of the trend change time points in chronological order;
a trend change time point filtering unit configured to perform filtering on trend change time points according to a time distance between every two adjacent trend change time points until a retained time distance between every two adjacent trend change time points satisfies a preset time threshold, and construct a set of trend change time points with the retained trend change time points;
wherein, each filtration process comprises:
taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points;
and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance.
Optionally, in an embodiment of the present disclosure, the trend change parameter includes at least one of a linear regression slope, a change speed, and a change amplitude.
Referring to fig. 4, in the embodiment of the present disclosure, the trend parameter obtaining module 24 may further include:
a trend time period obtaining submodule 241 configured to perform obtaining a trend time period between every two adjacent trend change time points in the trend change time point set;
a linear slope obtaining sub-module 242 configured to perform linear regression on the traffic data in the trend time period for each of the trend time periods, and obtain a linear slope of the trend time period;
an actual variation parameter obtaining sub-module 243 configured to perform obtaining a variation speed and/or a variation amplitude of the trend time period according to the start time, the end time, the start point data value, and the end point data value of the trend time period.
Referring to fig. 4, in an embodiment of the present disclosure, the data exception confirmation module 25 may further include:
a current trend obtaining sub-module 251 configured to perform obtaining a current trend of the target service data according to a trend change parameter of a current trend time period and a trend change parameter of a previous trend time period;
and the data anomaly confirmation submodule 252 is configured to execute, in response to that the current trend meets a preset anomaly condition, confirming that the service data corresponding to the current trend time period is anomalous, and performing service alarm.
In the embodiment of the present disclosure, by aiming at each second intersection time point in the second intersection time point set, obtaining an nth first intersection time point before the second intersection time point from the first intersection time point set as a trend change time point, where N is a positive integer; and sequencing the trend change time points according to the time sequence to obtain the trend change time point set. Sequencing the trend change time points according to the time sequence; filtering the trend change time points according to the time distance between every two adjacent trend change time points until the reserved time distance between every two adjacent trend change time points meets a preset time threshold, and constructing a trend change time point set by the reserved trend change time points; wherein, each filtration process comprises: taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points; and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance. The accuracy of each trend change time point can be improved, the workload of anomaly detection can be further reduced, and the accuracy of an anomaly detection result can be improved.
Furthermore, in the disclosed embodiment, the trend change parameter includes at least one of a linear regression slope, a change speed, and a change amplitude. In addition, a trend time period between every two adjacent trend change time points in the trend change time point set can be obtained; performing linear regression on the service data in the trend time period aiming at each trend time period, and acquiring a linear slope of the trend time period; and acquiring the change speed and/or the change amplitude of the trend time period according to the starting time, the ending time, the starting point data value and the end point data value of the trend time period. The accuracy of the acquired trend change parameters can be improved.
In addition, the current trend of the target service data can be obtained according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period; and responding to the current trend meeting a preset abnormal condition, confirming that the service data corresponding to the current trend time period is abnormal, and performing service alarm. Therefore, abnormity detection can be carried out in time aiming at the current business data, business alarm can be carried out in time under the condition of data abnormity, and the accuracy of the data detection result and the timeliness of alarm are improved.
With regard to the apparatus in the above-described embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.
In addition, in an embodiment of the present disclosure, there is also provided an electronic device including:
a processor;
a memory for storing the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement any of the data anomaly detection methods as previously described.
The disclosed embodiments also provide a storage medium, and when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the data anomaly detection methods described above.
Embodiments of the present disclosure also provide a computer program product, which when executed by a processor of an electronic device, enables the electronic device to execute any one of the data anomaly detection methods described above.
FIG. 5 is a block diagram illustrating an apparatus 300 for data anomaly detection according to an example embodiment. For example, the apparatus 300 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, an exercise device, a personal digital assistant, and the like.
Referring to fig. 5, the apparatus 300 may include one or more of the following components: a processing component 302, a memory 304, a power component 306, a multimedia component 308, an audio component 310, an input/output (I/O) interface 312, a sensor component 314, and a communication component 316.
The processing component 302 generally controls overall operation of the device 300, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing components 302 may include one or more processors 320 to execute instructions to perform all or a portion of the steps of the methods described above. Further, the processing component 302 can include one or more modules that facilitate interaction between the processing component 302 and other components. For example, the processing component 302 may include a multimedia module to facilitate interaction between the multimedia component 308 and the processing component 302.
The memory 304 is configured to store various types of data to support operations at the device 300. Examples of such data include instructions for any application or method operating on device 300, contact data, phonebook data, messages, pictures, videos, and so forth. The memory 304 may be implemented by any type or combination of volatile or non-volatile memory devices, such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.
The power supply component 306 provides power to the various components of the device 300. The power components 306 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the apparatus 300.
The multimedia component 308 includes a screen that provides an output interface between the device 300 and a user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 308 includes a front facing camera and/or a rear facing camera. The front camera and/or the rear camera may receive external multimedia data when the device 300 is in an operating mode, such as a shooting mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.
The audio component 310 is configured to output and/or input audio signals. For example, audio component 310 includes a Microphone (MIC) configured to receive external audio signals when apparatus 300 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may further be stored in the memory 304 or transmitted via the communication component 316. In some embodiments, audio component 310 also includes a speaker for outputting audio signals.
The I/O interface 312 provides an interface between the processing component 302 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to: a home button, a volume button, a start button, and a lock button.
The sensor assembly 314 includes one or more sensors for providing various aspects of status assessment for the device 300. For example, sensor assembly 314 may detect an open/closed state of device 300, the relative positioning of components, such as a display and keypad of apparatus 300, the change in position of apparatus 300 or a component of apparatus 300, the presence or absence of user contact with apparatus 300, the orientation or acceleration/deceleration of apparatus 300, and the change in temperature of apparatus 300. Sensor assembly 314 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 314 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 314 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
The communication component 316 is configured to facilitate wired or wireless communication between the apparatus 300 and other devices. The apparatus 300 may access a wireless network based on a communication standard, such as WiFi, an operator network (such as 2G, 3G, 4G, or 5G), or a combination thereof. In an exemplary embodiment, the communication component 316 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 316 further includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
In an exemplary embodiment, the apparatus 300 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic components for performing the above-described methods.
In an exemplary embodiment, a storage medium comprising instructions, such as the memory 304 comprising instructions, executable by the processor 320 of the apparatus 300 to perform the method described above is also provided. Alternatively, the storage medium may be a non-transitory computer readable storage medium, which may be, for example, a ROM, a Random Access Memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.
FIG. 6 is a block diagram illustrating an apparatus 400 for data anomaly detection according to an example embodiment. For example, the apparatus 400 may be provided as a server. Referring to fig. 6, apparatus 400 includes a processing component 422, which further includes one or more processors, and memory resources, represented by memory 432, for storing instructions, such as applications, that are executable by processing component 422. The application programs stored in memory 432 may include one or more modules that each correspond to a set of instructions. Further, the processing component 422 is configured to execute instructions to perform any of the data anomaly detection methods described above.
The apparatus 400 may also include a power component 426 configured to perform power management of the apparatus 400, a wired or wireless network interface 450 configured to connect the apparatus 400 to a network, and an input output (I/O) interface 458. The apparatus 400 may operate based on an operating system, such as Windows Server, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, stored in the memory 432.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
It will be understood that the present disclosure is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims (10)
1. A data anomaly detection method is characterized by comprising the following steps:
acquiring target service data to be detected;
acquiring a first cross time point set of an average value curve of the target service data in different first category time periods and a second cross time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period;
acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set;
acquiring a trend change parameter between every two adjacent trend change time points in the trend change time point set;
and responding to the condition that the trend change parameter meets the preset abnormal condition, and confirming that the business data corresponding to the trend change parameter is abnormal.
2. The data anomaly detection method according to claim 1, wherein the step of obtaining the set of trend change time points of the target service data according to the first set of crossing time points and the second set of crossing time points comprises:
for each second crossing time point in the second crossing time point set, acquiring an nth first crossing time point before the second crossing time point from the first crossing time point set as the trend change time point, wherein N is a positive integer;
and sequencing the trend change time points according to the time sequence to obtain the trend change time point set.
3. The data abnormality detection method according to claim 2, wherein the step of arranging the trend change time points in time order to obtain the trend change time point set includes:
sequencing the trend change time points according to a time sequence;
filtering the trend change time points according to the time distance between every two adjacent trend change time points until the reserved time distance between every two adjacent trend change time points meets a preset time threshold, and constructing a trend change time point set by the reserved trend change time points;
wherein, each filtration process comprises:
taking every two adjacent trend change time points as a group, and acquiring the time distance between every two adjacent trend change time points;
and in response to the time distance exceeding a preset time threshold, deleting at least one trend change time point in a trend change time point combination corresponding to the time distance.
4. The data anomaly detection method according to any one of claims 1-3, wherein said trend change parameter comprises at least one of a linear regression slope, a change speed, a change amplitude.
5. The data anomaly detection method according to claim 4, wherein the step of obtaining a trend change parameter between every two adjacent trend change time points in the set of trend change time points comprises:
acquiring a trend time period between every two adjacent trend change time points in the trend change time point set;
performing linear regression on the service data in the trend time period aiming at each trend time period, and acquiring a linear slope of the trend time period;
and acquiring the change speed and/or the change amplitude of the trend time period according to the starting time, the ending time, the starting point data value and the end point data value of the trend time period.
6. The data anomaly detection method according to claim 5, wherein the step of confirming that the business data corresponding to the trend change parameter is anomalous in response to the trend change parameter satisfying a preset anomaly condition comprises:
acquiring the current trend of the target service data according to the trend change parameter of the current trend time period and the trend change parameter of the previous trend time period;
and responding to the current trend meeting a preset abnormal condition, confirming that the service data corresponding to the current trend time period is abnormal, and performing service alarm.
7. A data abnormality detection apparatus, characterized by comprising:
the target service data acquisition module is configured to acquire target service data to be detected;
the crossing time point acquisition module is configured to execute the steps of acquiring a first crossing time point set of an average value curve of the target service data in different first category time periods and a second crossing time point set of the average value curve of the target service data in different second category time periods according to the time sequence relation of the target service data; the second category time period is greater than the first category time period;
a trend change time point acquisition module configured to perform acquiring a trend change time point set of the target service data according to the first cross time point set and the second cross time point set;
a trend change parameter obtaining module configured to perform obtaining a trend change parameter between every two adjacent trend change time points in the trend change time point set;
and the data abnormity confirming module is configured to execute and respond that the trend change parameter meets a preset abnormity condition, and confirm that the business data corresponding to the trend change parameter is abnormal.
8. The data abnormality detection device according to claim 7, characterized in that the trend change time point acquisition module includes:
a trend change time point obtaining sub-module configured to perform, for each second intersection time point in the second intersection time point set, obtaining an nth first intersection time point before the second intersection time point from the first intersection time point set as the trend change time point, where N is a positive integer;
and the trend change time point set construction submodule is configured to perform sorting on the trend change time points according to a time sequence to obtain the trend change time point set.
9. An electronic device, comprising:
a processor;
a memory for storing the processor-executable instructions;
wherein the processor is configured to execute the instructions to implement the data anomaly detection method of any one of claims 1 to 6.
10. A storage medium in which instructions, when executed by a processor of an electronic device, enable the electronic device to perform the data anomaly detection method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910804714.0A CN112445832B (en) | 2019-08-28 | 2019-08-28 | Data anomaly detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910804714.0A CN112445832B (en) | 2019-08-28 | 2019-08-28 | Data anomaly detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112445832A true CN112445832A (en) | 2021-03-05 |
| CN112445832B CN112445832B (en) | 2024-02-23 |
Family
ID=74741401
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910804714.0A Active CN112445832B (en) | 2019-08-28 | 2019-08-28 | Data anomaly detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112445832B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115684918A (en) * | 2023-01-04 | 2023-02-03 | 北京志翔科技股份有限公司 | Switch state identification method and device |
| CN115994137A (en) * | 2023-03-23 | 2023-04-21 | 无锡弘鼎软件科技有限公司 | Data management method based on application service system of Internet of things |
| CN117391125A (en) * | 2023-12-08 | 2024-01-12 | 成都星幔长庚科技有限公司 | Data processing method and system based on neural network |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160164721A1 (en) * | 2013-03-14 | 2016-06-09 | Google Inc. | Anomaly detection in time series data using post-processing |
| CN107566665A (en) * | 2017-08-15 | 2018-01-09 | 携程旅游信息技术（上海）有限公司 | Traffic method for detecting abnormality and its equipment |
| CN109146236A (en) * | 2018-07-06 | 2019-01-04 | 东软集团股份有限公司 | Indexes Abnormality detection method, device, readable storage medium storing program for executing and electronic equipment |
| CN109587008A (en) * | 2018-12-28 | 2019-04-05 | 华为技术服务有限公司 | Detect the method, apparatus and storage medium of abnormal flow data |
| CN109697207A (en) * | 2018-12-25 | 2019-04-30 | 苏州思必驰信息科技有限公司 | The abnormality monitoring method and system of time series data |
| CN110032670A (en) * | 2019-04-17 | 2019-07-19 | 腾讯科技（深圳）有限公司 | Method for detecting abnormality, device, equipment and the storage medium of time series data |
-
2019
- 2019-08-28 CN CN201910804714.0A patent/CN112445832B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160164721A1 (en) * | 2013-03-14 | 2016-06-09 | Google Inc. | Anomaly detection in time series data using post-processing |
| CN107566665A (en) * | 2017-08-15 | 2018-01-09 | 携程旅游信息技术（上海）有限公司 | Traffic method for detecting abnormality and its equipment |
| CN109146236A (en) * | 2018-07-06 | 2019-01-04 | 东软集团股份有限公司 | Indexes Abnormality detection method, device, readable storage medium storing program for executing and electronic equipment |
| CN109697207A (en) * | 2018-12-25 | 2019-04-30 | 苏州思必驰信息科技有限公司 | The abnormality monitoring method and system of time series data |
| CN109587008A (en) * | 2018-12-28 | 2019-04-05 | 华为技术服务有限公司 | Detect the method, apparatus and storage medium of abnormal flow data |
| CN110032670A (en) * | 2019-04-17 | 2019-07-19 | 腾讯科技（深圳）有限公司 | Method for detecting abnormality, device, equipment and the storage medium of time series data |
Non-Patent Citations (1)
| Title |
|---|
| 李春生，宋佳: "基于关联度分析的生产异常模式挖掘", 计算机技术与发展, vol. 27, no. 9 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115684918A (en) * | 2023-01-04 | 2023-02-03 | 北京志翔科技股份有限公司 | Switch state identification method and device |
| CN115684918B (en) * | 2023-01-04 | 2023-04-07 | 北京志翔科技股份有限公司 | Switch state identification method and device |
| CN115994137A (en) * | 2023-03-23 | 2023-04-21 | 无锡弘鼎软件科技有限公司 | Data management method based on application service system of Internet of things |
| CN117391125A (en) * | 2023-12-08 | 2024-01-12 | 成都星幔长庚科技有限公司 | Data processing method and system based on neural network |
| CN117391125B (en) * | 2023-12-08 | 2024-03-01 | 成都星幔长庚科技有限公司 | Data processing method and system based on neural network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112445832B (en) | 2024-02-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110827253A (en) | Training method and device of target detection model and electronic equipment | |
| CN106766022B (en) | Sensor control method and device | |
| US20210279473A1 (en) | Video processing method and apparatus, electronic device, and storage medium | |
| CN112445832B (en) | Data anomaly detection method and device, electronic equipment and storage medium | |
| EP3166359A1 (en) | Network connecting method and apparatus, computer program and recording medium | |
| CN104462296B (en) | File management method and device and terminal | |
| CN110502444B (en) | Testing method and testing device for image processing algorithm | |
| CN110691268B (en) | Message sending method, device, server, mobile terminal and storage medium | |
| EP3045428A1 (en) | Method and device for prompting user based on smart water purifying equipment | |
| CN110312300B (en) | Control method, control device and storage medium | |
| CN108427618A (en) | Interim card state determines method, apparatus and computer readable storage medium | |
| CN109214175B (en) | Method, device and storage medium for training classifier based on sample characteristics | |
| CN111125388B (en) | Method, device and equipment for detecting multimedia resources and storage medium | |
| US11570693B2 (en) | Method and apparatus for sending and receiving system information, and user equipment and base station | |
| US11218990B2 (en) | Method and apparatus for receiving and sending system information, user equipment and base station | |
| CN111913850A (en) | Data anomaly detection method, device, equipment and storage medium | |
| CN105101076B (en) | Information reminding method and device | |
| CN112017598A (en) | Backlight brightness adjusting method and device | |
| CN112019948A (en) | Intercommunication device communication method, intercommunication device and storage medium | |
| CN116437240A (en) | Data information transmission method, device and equipment | |
| CN109088920B (en) | Evaluation method, device and equipment of intelligent sound box and storage medium | |
| CN108811080B (en) | Method, device and storage medium for cell registration | |
| CN107979695B (en) | Network message receiving method and device and storage medium | |
| CN108427582B (en) | Method and device for determining stuck state and computer readable storage medium | |
| CN108496392B (en) | User equipment access control method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |