WO2024066720A1 - Indicator threshold determination method and apparatus, storage medium, and electronic apparatus - Google Patents

Abstract

Embodiments of the present disclosure provide an indicator threshold determination method and apparatus, a storage medium, and an electronic apparatus. The method comprises: acquiring aggregated indicator data corresponding to a target indicator; determining an indicator data set from the aggregated indicator data, sorting first indicator data in the indicator data set to obtain second indicator data, clustering the second indicator data to obtain a plurality of clustered groups, and fitting the indicator data in each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein a same indicator data set represents indicator data of a same monitoring object; and determining an indicator threshold from an intersection coordinate set of the piecewise function according to an indicator bias of the target indicator. The technical solution solves the problem of how to determine an indicator threshold in the related technologies.

Description

Method, device, storage medium and electronic device for determining index threshold

This disclosure claims the priority of the Chinese patent application filed with the China Patent Office on September 30, 2022, with application number 202211225305.3 and invention name “Method, device, storage medium and electronic device for determining indicator threshold value”, the entire contents of which are incorporated by reference in this disclosure.

Technical Field

The present disclosure relates to the field of big data and artificial intelligence technology, and in particular, to a method, device, storage medium and electronic device for determining an indicator threshold.

Background technique

With the advent of the Internet of Everything era, sensors, smartphones, wearable devices, smart home appliances and other devices will become part of the Internet of Everything. Massive amounts of data will often be generated during the operation of the devices. Wireless network operators will usually mine the value of effective data and apply it to operation support and operation analysis in the process of rapid data processing. Mobile Internet-based services are rich and diverse, and different services have different requirements for network performance. Therefore, in the process of collecting data for operation support and operation analysis, it is often necessary to set thresholds based on the characteristics of the business and the actual situation of the indicators, so as to flexibly construct the evaluation criteria of the indicators.

There are many O&M analysis scenarios that require threshold setting, such as anomaly detection, root cause analysis, data prediction, alarm management, intelligent recovery, and perception evaluation. In the past, wireless network operators set thresholds for service indicators mainly based on fixed empirical thresholds of indicators or dynamic thresholds obtained from relatively complex statistical distributions. Even if dynamic thresholds based on mathematical methods such as statistical distribution are used, the threshold solution problem is converted into a threshold setting problem in another dimension, which makes it difficult to accurately and objectively measure the pros and cons of service indicators, and thus effectively guide network O&M and analysis and achieve the goal of maximizing data value.

Therefore, with regard to the related technologies, there is no effective solution to the problem of how to determine the indicator threshold.

Therefore, it is necessary to improve the related technology to overcome the above-mentioned defects in the related technology.

Summary of the invention

The embodiments of the present disclosure provide a method, device, storage medium and electronic device for determining an indicator threshold, so as to at least solve the problem of how to determine the indicator threshold.

According to one aspect of an embodiment of the present disclosure, a method for determining an indicator threshold is provided, comprising: obtaining aggregated indicator data corresponding to a target indicator; determining an indicator data set from the aggregated indicator data, sorting first indicator data in the indicator data set to obtain second indicator data, clustering the second indicator data to obtain a plurality of clustered groups, and fitting the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitored object; and determining an indicator threshold from a set of intersection coordinates of the piecewise functions according to the indicator bias of the target indicator.

According to another aspect of the embodiment of the present disclosure, a device for determining an indicator threshold is also provided, comprising: an acquisition module configured to acquire aggregate indicator data corresponding to a target indicator; a first determination module configured to determine a target indicator from the aggregate indicator data; Determine an indicator data set, sort the first indicator data in the indicator data set to obtain second indicator data, cluster the second indicator data to obtain multiple groups after clustering, and fit the indicator data of each group of the multiple groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents the indicator data of the same monitored object; a second determination module is configured to determine an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.

According to another aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned method for determining the indicator threshold value when running.

According to another aspect of an embodiment of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the method for determining the indicator threshold through the computer program.

Through the present disclosure, aggregated indicator data corresponding to a target indicator is obtained; an indicator data set is determined from the aggregated indicator data, first indicator data in the indicator data set is sorted to obtain second indicator data, the second indicator data is clustered to obtain a plurality of clustered groups, and the indicator data of each of the plurality of groups is fitted to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitored object; an indicator threshold is determined from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator, thereby solving the technical problem of how to determine the indicator threshold.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

FIG1 is a hardware structure block diagram of a computer terminal of a method for determining an indicator threshold value according to an embodiment of the present disclosure;

FIG2 is a flow chart of a method for determining an indicator threshold according to an embodiment of the present disclosure;

FIG3 is a schematic diagram of two-dimensional discrete points according to an embodiment of the present disclosure;

FIG. 4 is a structural block diagram of a device for determining an indicator threshold according to an embodiment of the present disclosure.

Detailed ways

In order to enable those skilled in the art to better understand the scheme of the present disclosure, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present disclosure.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to Those steps or elements explicitly listed may include other steps or elements not explicitly listed or inherent to these processes, methods, products or apparatuses.

The method embodiments provided in the embodiments of the present disclosure can be executed in a computer terminal or a similar computing device. Taking running on a computer terminal as an example, FIG1 is a hardware structure block diagram of a computer terminal of the method for determining the indicator threshold of the embodiment of the present disclosure. As shown in FIG1 , the computer terminal may include one or more (only one is shown in FIG1 ) processors 202 (the processor 202 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD) and a memory 204 configured to store data. In an exemplary embodiment, the above-mentioned computer terminal may also include a transmission device 206 and an input and output device 208 configured to have a communication function. It can be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the above-mentioned computer terminal. For example, the computer terminal may also include more or fewer components than those shown in FIG1 , or have a different configuration with the same function as that shown in FIG1 or more functions than those shown in FIG1 .

The memory 204 may be configured to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the method for determining the index threshold value in the embodiment of the present disclosure, and the processor 202 executes various functional applications and data processing by running the computer programs stored in the memory 204, that is, to implement the above method. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 204 may further include a memory remotely arranged relative to the processor 202, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The transmission device 206 is configured to receive or send data via a network. Specific examples of the above-mentioned network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 206 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 206 can be a radio frequency (Radio Frequency, referred to as RF) module, which is configured to communicate with the Internet wirelessly.

The following is an explanation of the meanings of the technical terms mentioned in this disclosure:

KQI, Key Quality Indicators, service quality parameters;

KPI, Key Performance Index, key performance indicator;

TCP, Transmission Control Protocol, transmission control protocol;

RTT, Round-Trip Time, round-trip delay;

CPU, Central Processing Unit, central processing unit.

FIG2 is a flow chart of a method for determining an indicator threshold according to an embodiment of the present disclosure. As shown in FIG2 , the steps of the method include:

Step S202, obtaining aggregated indicator data corresponding to the target indicator.

Step S204, determining an indicator data set from the aggregated indicator data, and performing a The indicator data are sorted to obtain second indicator data, the second indicator data are clustered to obtain multiple groups after clustering, and the indicator data of each group of the multiple groups are fitted to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents the indicator data of the same monitoring object.

It should be noted that the above-mentioned clustering algorithms for clustering the second indicator data may include Kmeans clustering algorithm, DBSCAN-density-based spatial clustering algorithm, spectral clustering algorithm, GMM-Gaussian mixture model clustering algorithm, MeanShift-mean migration clustering algorithm, hierarchical clustering, etc., but are not limited to these.

Step S206: determining an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.

The disclosed embodiment obtains aggregated indicator data corresponding to the target indicator; determines an indicator data set from the aggregated indicator data, sorts the first indicator data in the indicator data set to obtain second indicator data, clusters the second indicator data to obtain a plurality of clustered groups, and fits the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents the indicator data of the same monitored object; determines an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator, thereby solving the problem of how to determine the indicator threshold.

In an exemplary embodiment, in order to better understand the implementation process of obtaining the aggregated indicator data corresponding to the target indicator in the above step S202, the following implementation steps are proposed: determine the pre-set monitoring dimension, the monitoring object of the monitoring dimension, the indicator category of the target indicator, the initial indicator data under the indicator category, and the time aggregation granularity corresponding to the target indicator; determine the indicator data to be aggregated according to the pre-set monitoring dimension, the monitoring object of the monitoring dimension, the indicator category of the target indicator, and the initial indicator data under the indicator category; aggregate the indicator data to be aggregated according to the time aggregation granularity corresponding to the target indicator to obtain the aggregated indicator data corresponding to the target indicator.

In an exemplary embodiment, a technical solution is proposed for aggregating the indicator data to be aggregated according to the time aggregation granularity corresponding to the target indicator to obtain the aggregated indicator data corresponding to the target indicator, which specifically includes: obtaining a first time granularity of the indicator data to be aggregated; when it is determined that the first time granularity is smaller than the time aggregation granularity, obtaining the first indicator data of the indicator data to be aggregated within the first time granularity, and aggregating multiple first time granularities into the time aggregation granularity; aggregating multiple first indicator data within the multiple first time granularities into first aggregated indicator data within the time aggregation granularity, and determining the first aggregated indicator data as the aggregated indicator data corresponding to the target indicator.

In an exemplary embodiment, when it is determined that the first time granularity is equal to the time aggregation granularity, first indicator data of the indicator data to be aggregated within the first time granularity can be obtained, and the first indicator data can be determined as the aggregated indicator data corresponding to the target indicator.

In an exemplary embodiment, before clustering the second indicator data, the second indicator data can be further standardized to obtain a plurality of standardized indicator values, wherein each standardized indicator value corresponds to a sorting number; for each standardized indicator value, the sorting number corresponding to the standardized indicator value is determined as the horizontal coordinate, and the standardized indicator value is determined as the vertical coordinate to obtain the coordinate point corresponding to the standardized indicator value; the coordinate slopes between the two adjacent coordinate points are determined to obtain a plurality of coordinate slopes, and for each of the plurality of coordinate slopes, a smoothing value of each coordinate slope is determined to obtain a plurality of smoothing values; based on the plurality of smoothing values, The sliding value determines third indicator data, and determines the third indicator data as the updated second indicator data.

It should be noted that the above-mentioned standardization processing may include normalization processing. For example, the second indicator data may be standardized by using a normalization processing method to compress the range to within the range of [0, 1], so as to standardize the data and improve the data processing efficiency.

In an exemplary embodiment, in the process of determining the smoothing value of each coordinate slope among the multiple coordinate slopes to obtain multiple smoothing values, the following technical solution is proposed: clustering the multiple coordinate slopes according to a preset clustering algorithm to obtain multiple groups of slope values; for each group of slope values, determining the mean of the coordinate slopes of each group of slope values as the smoothing value of the coordinate slope of each group of slope values.

Among them, the above-mentioned preset clustering algorithms may include Kmeans clustering algorithm, DBSCAN-density-based spatial clustering algorithm, spectral clustering algorithm, GMM-Gaussian mixture model clustering algorithm, MeanShift-mean shift clustering algorithm, hierarchical clustering, etc., and the present disclosure does not limit this.

In an exemplary embodiment, a technical solution is also proposed, and the specific steps include: when it is determined that there is a target group slope value among the multiple groups of slope values, the smoothed value of the coordinate slope of the adjacent group slope value adjacent to the target group slope value is determined as the smoothed value of the coordinate slope within the target group slope value, or the smoothed value of the coordinate slope within the target group slope value is determined according to a preset smoothing value, wherein the number of coordinate slopes within the target group slope value is different from the number of coordinate slopes within each group of slope values.

In an exemplary embodiment, after clustering the second indicator data to obtain multiple groups after clustering, and fitting the indicator data of each group of the multiple groups to obtain the piecewise function corresponding to each group, further, multiple groups of means can be obtained according to the mean of the indicator data of each group, and a mean set can be determined according to the multiple groups of means, wherein the mean set includes the means corresponding to each piecewise function; the intersection coordinates of the intersection coordinate set of the piecewise function are determined, the left derivative and the right derivative corresponding to the intersection coordinates are determined, and the first mean of the first piecewise function corresponding to the left derivative in the mean set and the second mean of the second piecewise function corresponding to the right derivative in the mean set are determined; based on the first mean and the second mean, it is determined whether to retain the intersection coordinates within the indicator threshold set.

In an exemplary embodiment, the following technical solution is proposed to illustrate the implementation process of determining whether to retain the intersection coordinates within the indicator threshold set based on the first mean and the second mean: determine a first absolute distance value between the intersection coordinates and the origin coordinates; determine first coordinate information corresponding to the first mean based on the first absolute distance value and the first mean, wherein the first coordinate information represents the independent variable value of the first piecewise function; determine second coordinate information corresponding to the second mean based on the first absolute distance value and the second mean, wherein the second coordinate information represents the independent variable value of the second piecewise function; when it is determined that the first coordinate information is the same as the second coordinate information, retain the intersection coordinates within the indicator threshold set; when it is determined that the first coordinate information is different from the second coordinate information, retain the intersection coordinates within the indicator threshold set.

In an exemplary embodiment, a technical solution is proposed for implementing the above step S206 of determining the indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator, specifically including: determining the set of non-differentiable points of the piecewise function and the coordinate points whose second-order derivatives are target values; determining the indicator threshold set based on the set of non-differentiable points, the coordinate points whose second-order derivatives are target values, and the intersection coordinate set of the piecewise function; determining the set of indicator thresholds according to the set of non-differentiable points, the coordinate points whose second-order derivatives are target values, and the intersection coordinate set of the piecewise function; determining the set of The indicator bias of the target indicator determines the indicator threshold from the indicator threshold set.

It should be noted that the target value may be, for example, 0, but is not limited thereto.

In an exemplary embodiment, the process of determining an indicator threshold from an indicator threshold set according to the indicator bias of the target indicator can be implemented in a variety of ways, specifically including: Way 1, when it is determined that the indicator bias of the target indicator is negative, if the type of the indicator threshold is determined to be an alarm threshold, then the maximum value in the indicator threshold set is determined as the indicator threshold; if the type of the indicator threshold is determined to be a preferential threshold, then the minimum value in the indicator threshold set is determined as the indicator threshold.

Method 2: When it is determined that the indicator bias of the target indicator is positive, if the type of the indicator threshold is determined to be an alarm threshold, the minimum value in the indicator threshold set is determined as the indicator threshold; if the type of the indicator threshold is determined to be a preferential threshold, the maximum value in the indicator threshold set is determined as the indicator threshold.

Optionally, in the above embodiment, the alarm threshold can be understood as a threshold when the performance corresponding to the indicator data of the target indicator is poor. For example, the alarm threshold of the CPU usage is set to 80%, at which time the CPU occupies more resources and the performance is poor. The optimal threshold can be understood as a threshold when the performance corresponding to the indicator data of the target indicator is better. For example, the optimal threshold of the network delay is set to 10%, at which time the network delay is small and the performance is better. In particular, for multiple optimal thresholds, the smallest one is selected as the optimal delay.

Furthermore, the process of determining the indicator threshold of the embodiment of the present disclosure is further described in detail through the following steps.

(1) Model building unit:

First, based on the actual business scenarios of operation and maintenance applications, the monitoring dimensions and indicators are determined, and the key KPI indicator system for operation and maintenance scenarios {KPI1, KPI2, ..., KPIn} is constructed; then, according to the actual real-time requirements of business operation and maintenance, the time aggregation granularity is determined, and the time granularity indicator aggregation is performed on each dimension-KPI data to construct a five-tuple data of {dimension (i.e. monitoring dimension), object (i.e. monitoring object), time granularity (i.e. time aggregation granularity), indicator (i.e. indicator category of target indicator), data (i.e. initial indicator data under indicator category)}; among them, the business indicator configuration information needs to clarify the bias of the indicator and the normal range of the indicator.

(2) Solve the mapping function based on discrete sample points:

Step a, construct a single-dimensional single-object or multi-object KPI indicator data set (the object range selection depends on the actual application scenario), sort the data values of the time series indicators (from small to large or from large to small), and obtain a two-dimensional sequence of ID values and KPI indicator values {i: Valuei}, i∈[1, N], N is the number of samples in the data set, and the ID value is the corresponding serial number of the sorted KPI indicator, starting from 1 and increasing by an interval of 1.

In order to make it easier to understand, the two-dimensional sequence can be expressed as a two-dimensional discrete point image with the sample ID and KPI index value as the coordinate axis. As shown in Figure 3, the coordinate point is the ID as the horizontal axis and the KPI index value as the vertical axis.

Step b: Considering that the KPI indicator value may fluctuate greatly, in order to facilitate subsequent processing, the indicator is first standardized. The KPI indicator value is standardized by a normalization processing method, and the range is compressed to the range of [0, 1].

Step c, calculate the slope k=(y ₂ -y ₁ )/(x ₂ -x ₁ ) between two consecutive points in segments, and perform three-point mean smoothing of the slope k', perform clustering based on the smoothing slope k' and ID value to obtain G groups, calculate the mean of the smoothing slope of each group, and use set K to mark them.

Among them, the use of clustering algorithms can avoid excessive parameter settings in the process of building the algorithm model, and can classify data with differences in the sequence, making it easier to obtain turning points later. The present disclosure does not specifically limit the type of clustering algorithms.

Step d: For the G clustering result sets of step c, curve fitting is performed respectively to obtain a piecewise function f(x) having G fitting functions. The curve fitting method can quickly obtain an approximate piecewise function, which provides an effective way to solve the turning point in the subsequent automatic threshold calculation process.

(3) Automatic calculation of threshold:

Step a: Solve the intersection coordinate information of each adjacent piecewise fitting function. For the intersection coordinates, solve the x∈[1, N] interval, the f(x) non-differentiable point set C and the coordinate points where the second-order derivative is 0 to form the threshold set T. For x∈C, calculate the left derivative k1' and the right derivative k2' respectively, and calculate the absolute distance between k1' and k2' and k∈K to determine the category. If both the left and right derivatives belong to the same group, it means that the point is not the turning point we want to find, and then remove the point from the threshold set T.

Step b: Combine the indicator bias information provided in the business indicator configuration information in step 1 and take the maximum or minimum value in the threshold set T as the threshold solution.

Next, the method for determining the indicator threshold is further described in conjunction with the following embodiments. The following embodiments use different operation and maintenance scenarios and their corresponding indicator data for description.

Example 1

Taking the IT equipment operation and maintenance scenario based on the underlying monitoring indicators as an example, during the operation and maintenance process, it is often necessary to set thresholds based on the resource usage of the server. When the set threshold is reached, an alarm needs to be issued and server expansion needs to be considered.

For the model building unit, it is determined that the monitoring dimension of this embodiment is the server, the objects are server A, server B, and server C, and the indicators are CPU usage (%), memory usage (%), disk usage (%), and network rate (kbps). The above indicators are constructed into a key KPI indicator system for server equipment operation and maintenance scenarios;

According to the actual real-time requirements of business operation and maintenance, the time aggregation granularity is determined to be 1 hour. Taking the server's CPU utilization rate (%) as the target indicator, the indicator is aggregated at the time granularity to construct a five-tuple data of {dimension, object, time granularity, indicator, data}; the business indicator configuration information clearly states that the bias of the CPU utilization rate (%) indicator is negative, and the normal range of the indicator is 0 to 100.

Get the aggregated CPU usage indicator data for 24 hours in a day with 1 hour as the granularity as shown in Table 1:

Table 1: Index data record table

Based on the contents of the above model building unit, the mapping function is solved according to the discrete sample points.

First, in the results of the model building unit, determine server A and server B as objects, select their corresponding indicator data sets, sort the indicator data in the set according to the values, and obtain a two-dimensional sequence {i: Valuei}, i∈[1, 48] of the combination of ID values and CPU usage (%) values, and construct a two-dimensional discrete point image with the horizontal axis as the sample ID and the vertical axis as the CPU usage (%).

Secondly, the CPU usage (%) indicator value is normalized. The minimum-maximum scaling method can be used to compress the indicator range to the range of [0, 1]. The normalization function is as follows:

The two-dimensional sequence discrete points within the above two-dimensional sequence can be understood as coordinate points corresponding to the above standardized index values.

Again, the slope between two consecutive points is calculated in segments (equivalent to the above-mentioned coordinate slope), and the slope is smoothed by the three-point mean slope k’. The three-point mean smoothed slope cannot be calculated for the last two points, and the three-point mean smoothed slope of the previous point can be used instead to obtain a new sequence of ID values and three-point mean smoothed slopes {i:k’i}, i∈[1,48]. DBSCAN clustering is performed on the values in the sequence to obtain 4 groups, and the mean of the smoothed slope of each group is calculated (equivalent to the process of determining the mean of the coordinate slope of each group of slope values as the smoothed value of the coordinate slope of each group of slope values for each group of slope values), and the set K={0.046, 0.012, 0.034, 0.089} is obtained.

Finally, a linear linear function is used to fit the data of each group in the previous step to obtain a piecewise function f(x) with 4 segments.

Based on the mapping function solved above, the threshold is automatically learned.

First, solve the intersection coordinate set X = {(10, 0.3), (30, 0.5), (40, 0.8)} of each adjacent piecewise fitting function. For the intersection coordinates, solve the x∈[1, 48] interval, the set C of non-differentiable points of f(x) and the coordinate points where the second-order derivative is 0. The threshold set T is formed. In this embodiment, the sets C and T are also {(10, 0.3), (30, 0.5), (40, 0.8)}. For x∈C, the left derivative k1' and the right derivative k2' are calculated respectively. The absolute distances with k∈K are calculated for k1' and k2' respectively. k selects the mean of the smooth slopes of the groups corresponding to the piecewise functions on the left and right sides of the coordinate point. According to the calculated absolute distance, the belonging category is determined. For the coordinate point (10, 0.3), the left derivative k1' and the right derivative k2' are 0.04 and 0.01 respectively. The mean of the smooth slopes of the groups corresponding to the piecewise functions on the left and right sides of the coordinate point (10, 0.3) are 0.046 and 0.012 respectively. According to the absolute distance calculation, the left derivative k1' and the right derivative k2' belong to different groups, and the point is not removed from the threshold set T. The same goes for other coordinate points, and the final threshold set T is {(10, 0.3), (30, 0.5), (40, 0.8)}.

Secondly, combined with the negative bias of the indicator set in the business indicator configuration information of the model building unit, and the usage scenario is to find the CPU usage rate (%) that needs to issue an alarm, that is, the worse threshold, so the maximum value of the smooth slope of the three-point mean in the threshold set T is selected as 0.8 as the reference value for generating the threshold. Based on this value, the CPU usage rate (%) indicator value before normalization is obtained in reverse, which is 90.72, which is the required threshold solution.

Example 2

Taking the business system operation and maintenance scenario of building KPI/KQI indicators based on the model as an example, in the network operation and maintenance of mobile operators, it is necessary to pay attention to the KQI indicators of the cell and evaluate the perception of the cell through the KQI of the cell. In the evaluation process, it is usually necessary to set the KQI indicator threshold.

For the model building unit, it is determined that the monitoring dimension of this embodiment is the cell, the objects are cell 622001, cell 622002, cell 622003, ..., cell 622099, and the indicators are TCP connection success rate (%), TCP retransmission rate (%), TCP disorder rate (%), TCP average RTT delay (ms);

According to the actual real-time requirements of business operation and maintenance, the time aggregation granularity is determined to be 1 hour. Taking the TCP average RTT delay (ms) of the cell as an example, the indicator is aggregated at the time granularity to construct the five-tuple data of {dimension, object, time granularity, indicator, data}; the business indicator configuration information clearly states that the bias of the TCP average RTT delay (ms) indicator is negative, and the normal range of the indicator is greater than or equal to 0.

Get the average TCP RTT delay (ms) indicator data after aggregation with a granularity of 1 hour for 24 hours in a day.

Based on the contents of the above model building unit, the mapping function is solved according to the discrete sample points.

First, in the results of the model building unit, 50 cells, including cell 622001, cell 622002, cell 622003, ..., cell 622050, are determined as objects, and their corresponding indicator data sets are selected. The indicator data in the set are sorted according to the values to obtain a two-dimensional sequence {i: Valuei}, i∈[1, 1200] of the combination of ID value and TCP average RTT delay (ms) value. A two-dimensional discrete point image is constructed with the horizontal axis as sample ID and the vertical axis as TCP average RTT delay (ms).

Secondly, the indicator value of TCP average RTT delay (ms) is normalized, and the minimum-maximum scaling method can be used to compress the indicator range to the range of [0, 1].

Again, calculate the slope between two consecutive points in segments, and perform three-point mean smoothing on the slope k’. The three-point mean smoothing slope cannot be calculated for the last two points, so the three-point mean smoothing slope of the previous point can be used instead to obtain a new sequence of ID values and three-point mean smoothing slopes {i:k’i}, i∈[1, 1200]. Perform Gaussian mixture clustering on the values in the sequence to obtain 13 groups. Calculate the mean of the smoothing slopes of each group to obtain the set K.

Finally, use linear first-order function, quadratic function, etc. to fit the data of each group in the previous step. You can choose to fit The best curve is taken as the fitting result, and a piecewise function f(x) having 13 segments is obtained.

Based on the mapping function solved above, the threshold is automatically learned.

First, solve the intersection coordinate set X of each adjacent piecewise fitting function. For the intersection coordinates, solve the interval x∈[1,1200], the non-differentiable point set C of f(x) and the coordinate points where the second-order derivative is 0 to form the threshold set T. For x∈C, calculate the left derivative k1' and the right derivative k2' respectively. For k1' and k2', calculate the absolute distance with k∈K respectively. k selects the mean of the smooth slope of the groupings corresponding to the piecewise functions on the left and right sides of the coordinate point. According to the calculated absolute distance, determine the belonging category. If it belongs to the same group, the point is removed from the threshold set T.

Secondly, combined with the negative bias of the indicator set in the business indicator configuration information of the model building unit, and the usage scenario is to find the ideal threshold, the minimum value of the smooth slope of the three-point mean in the threshold set T, 0.123, is selected as the reference value for generating the threshold. Based on this value, the TCP average RTT delay (ms) indicator value of 2.5 before normalization is obtained in reverse, which is the required threshold solution.

Based on the above embodiments, according to the actual distribution characteristics of different types of indicators in real networks, for example, most indicators have a "three-segment" feature, namely a small number of "degraded" samples, the vast majority of "normal" samples, and a small number of "high-quality" samples. The problem of calculating the indicator threshold can be converted into an image solving problem.

In the solution process, the unilaterality of the indicators is first divided to distinguish between positive and negative indicators. Secondly, the indicator data is preprocessed and the rate of change of the curve is calculated. Then, the machine learning algorithm is used to train the indicator data model. Finally, the threshold learning is transformed into a solution problem based on the turning point of the unilaterality of the indicator, so as to realize the intelligent generation of thresholds for different types of indicators with lower cost and higher accuracy.

Compared with the traditional fixed empirical threshold or the relatively complex dynamic threshold based on statistical distribution, the problem that the threshold or the converted threshold needs to be manually set can be solved more thoroughly. The technical solution disclosed in the present invention has better applicability and accuracy, and provides a strong guarantee for the operation and maintenance support and operation analysis of mobile operators, which not only helps mobile operators to perform operation and maintenance support and operation analysis more accurately, but also greatly saves labor costs.

In addition, the present disclosure relates to the field of big data and artificial intelligence technology, and in particular to the field of communication big data and engineering operation and maintenance in the Internet, the Internet of Things, etc., where a large number of indicator thresholds need to be set in a targeted manner, such as the operation and maintenance support and operation analysis of mobile operators, such as anomaly detection, root cause analysis, data prediction, alarm management, intelligent recovery and perception evaluation. The setting method of indicator thresholds on the market is currently widely used, and the indicator threshold is mainly set based on the fixed empirical threshold of the indicator or the dynamic threshold obtained by relatively complex statistical distribution. With the in-depth development of artificial intelligence technology, the model built based on artificial intelligence algorithms has better applicability. The present disclosure converts the calculation problem of the indicator threshold into an image solving problem, and combines artificial intelligence algorithms for training and prediction. The artificial intelligence algorithms used also have more choices in practical applications, such as neural network, clustering, classification and other algorithms. The constructed model has good accuracy and broad application prospects, which provides a premise for the precision and intelligence of mobile operator engineering operation and maintenance, and also clarifies the direction for reducing labor costs.

This disclosure is aimed at the field of operation and maintenance, especially large and complex architecture systems. It includes IT equipment operation and maintenance based on underlying monitoring indicators and business system operation and maintenance based on model-based KPI/KQI indicators. By collecting and cleaning key system indicators, building monitoring dimension models and automatically learning indicator thresholds, it is possible to identify faults or risks in the system, thereby facilitating network optimization personnel to handle or avoid faults in advance.

In this embodiment, a device for determining an indicator threshold is also provided, which is used to implement the above embodiments and preferred implementation methods. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

FIG4 is a structural block diagram of a device for determining an indicator threshold according to an embodiment of the present disclosure. As shown in FIG4 , the device for determining an indicator threshold includes:

An acquisition module 42 is configured to acquire aggregated indicator data corresponding to a target indicator;

A first determination module 44 is configured to determine an indicator data set from the aggregated indicator data, sort the first indicator data in the indicator data set to obtain second indicator data, cluster the second indicator data to obtain a plurality of clustered groups, and fit the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitored object;

It should be noted that the above-mentioned clustering algorithms for clustering the second indicator data may include Kmeans clustering algorithm, DBSCAN-density-based spatial clustering algorithm, spectral clustering algorithm, GMM-Gaussian mixture model clustering algorithm, MeanShift-mean migration clustering algorithm, hierarchical clustering, etc., but are not limited to these.

The second determination module 46 is configured to determine an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.

Through the above-mentioned device, aggregated indicator data corresponding to the target indicator is obtained; an indicator data set is determined from the aggregated indicator data, the first indicator data in the indicator data set is sorted to obtain second indicator data, the second indicator data is clustered to obtain multiple clustered groups, and the indicator data of each group of the multiple groups is fitted to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents the indicator data of the same monitored object; an indicator threshold is determined from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator, thereby solving the problem of how to determine the indicator threshold.

In an exemplary embodiment, the acquisition module 42 is further configured to: determine a preset monitoring dimension, a monitoring object of the monitoring dimension, an indicator category of the target indicator, the initial indicator data under the indicator category, and a time aggregation granularity corresponding to the target indicator; determine the indicator data to be aggregated according to the preset monitoring dimension, the monitoring object of the monitoring dimension, the indicator category of the target indicator, and the initial indicator data under the indicator category; aggregate the indicator data to be aggregated according to the time aggregation granularity corresponding to the target indicator to obtain the aggregated indicator data corresponding to the target indicator.

In an exemplary embodiment, the acquisition module 42 is further configured to: acquire the first time granularity of the indicator data to be aggregated; when determining that the first time granularity is smaller than the time aggregation granularity, acquire the first indicator data of the indicator data to be aggregated within the first time granularity, and aggregate multiple first time granularities into the time aggregation granularity; aggregate multiple first indicator data within the multiple first time granularities into first aggregate indicator data within the time aggregation granularity, and determine the first aggregate indicator data as the aggregate indicator data corresponding to the target indicator.

In an exemplary embodiment, the above-mentioned acquisition module 42 is also configured to: when it is determined that the first time granularity is equal to the time aggregation granularity, obtain the first indicator data of the indicator data to be aggregated within the first time granularity, and determine the first indicator data as the aggregation indicator data corresponding to the target indicator.

In an exemplary embodiment, the acquisition module 42 is further configured as follows: before clustering the second indicator data, the second indicator data is standardized to obtain a plurality of standardized indicator values, wherein each standardized indicator value corresponds to a sorting number; for each standardized indicator value, the sorting number corresponding to the standardized indicator value is determined as the horizontal coordinate, and the standardized indicator value is determined as the vertical coordinate to obtain the coordinate point corresponding to the standardized indicator value; the coordinate slopes between two adjacent coordinate points are determined to obtain a plurality of coordinate slopes, and for each of the plurality of coordinate slopes, a smoothing value of each coordinate slope is determined to obtain a plurality of smoothing values; the third indicator data is determined according to the plurality of smoothing values, and the third indicator data is determined as the updated second indicator data.

It should be noted that the above-mentioned standardization processing may include normalization processing. For example, the second indicator data may be standardized by using a normalization processing method to compress the range to within the range of [0, 1], so as to standardize the data and improve the data processing efficiency.

In an exemplary embodiment, the acquisition module 42 is further configured to: in the process of determining the smoothing value of each coordinate slope in the multiple coordinate slopes to obtain multiple smoothing values, cluster the multiple coordinate slopes according to a preset clustering algorithm to obtain multiple groups of slope values; for each group of slope values, determine the mean of the coordinate slopes of each group of slope values as the smoothing value of the coordinate slope of each group of slope values.

Among them, the above-mentioned preset clustering algorithms may include Kmeans clustering algorithm, DBSCAN-density-based spatial clustering algorithm, spectral clustering algorithm, GMM-Gaussian mixture model clustering algorithm, MeanShift-mean shift clustering algorithm, hierarchical clustering, etc., and the present disclosure does not limit this.

In an exemplary embodiment, the acquisition module 42 is further configured to: when it is determined that there is a target group slope value among the multiple groups of slope values, determine the smoothed value of the coordinate slope of the adjacent group slope value adjacent to the target group slope value as the smoothed value of the coordinate slope within the target group slope value, or determine the smoothed value of the coordinate slope within the target group slope value according to a preset smoothing value, wherein the number of coordinate slopes within the target group slope value is different from the number of coordinate slopes within each group of slope values.

In an exemplary embodiment, the first determination module 44 is further configured to: obtain multiple groups of means according to the mean of the indicator data of each group, and determine a mean set according to the multiple groups of means, wherein the mean set includes the means corresponding to each piecewise function; determine the intersection coordinates of the intersection coordinate set of the piecewise function, determine the left derivative and the right derivative corresponding to the intersection coordinates, and determine the first mean of the first piecewise function corresponding to the left derivative in the mean set and the second mean of the second piecewise function corresponding to the right derivative in the mean set; determine whether to retain the intersection coordinates within the indicator threshold set based on the first mean and the second mean.

In an exemplary embodiment, the first determination module 44 is further configured to: determine a first absolute distance value between the intersection coordinates and the origin coordinates; determine first coordinate information corresponding to the first mean according to the first absolute distance value and the first mean, wherein the first coordinate information represents the independent variable value of the first piecewise function; determine second coordinate information corresponding to the second mean according to the first absolute distance value and the second mean, wherein the second coordinate information represents the independent variable value of the second piecewise function; when it is determined that the first coordinate information is the same as the second coordinate information, retain the intersection coordinates within the indicator threshold set; when it is determined that the first coordinate information is different from the second coordinate information, retain the intersection coordinates within the indicator threshold set.

In an exemplary embodiment, the second determination module 46 is further configured to: determine the set of non-differentiable points of the piecewise function and the coordinate points where the second-order derivative is the target value; determine the indicator threshold set based on the set of non-differentiable points, the coordinate points where the second-order derivative is the target value, and the coordinate set of the intersection of the piecewise function; and determine the indicator threshold from the indicator threshold set according to the indicator bias of the target indicator.

In an exemplary embodiment, the second determination module 46 is further configured as follows: when it is determined that the indicator bias of the target indicator is negative, if the type of the indicator threshold is determined to be an alarm threshold, the maximum value in the indicator threshold set is determined as the indicator threshold; if the type of the indicator threshold is determined to be a preferential threshold, the minimum value in the indicator threshold set is determined as the indicator threshold.

In an exemplary embodiment, the above-mentioned second determination module 46 is also configured as follows: when it is determined that the indicator bias of the target indicator is positive, if the type of the indicator threshold is determined to be an alarm threshold, the minimum value in the indicator threshold set is determined as the indicator threshold; if the type of the indicator threshold is determined to be a preferential threshold, the maximum value in the indicator threshold set is determined as the indicator threshold.

Furthermore, the present disclosure proposes a threshold intelligent learning and operation and maintenance device based on curve image calculation, which can solve the core problem of replacement of threshold self-learning in the industry (i.e., converting one threshold automatic learning process into the threshold setting of another threshold), and truly achieve automatic identification and operation and maintenance of thresholds without human intervention. Through the collection, cleaning, and model construction of big data operation and maintenance indicators, the indicator data of the monitoring object based on the granularity of the actual application scenario is obtained; the constructed data is displayed in a sequence graphical manner, the distribution data is converted into a curve image, and by solving the turning point of the distribution, combined with the actual indicator business characteristics, the indicator threshold self-learning function is further realized.

A first aspect of the present disclosure provides a model building unit based on collected indicators, which is configured to implement functions such as data cleaning, aggregate model description, and core business indicator configuration item description.

The second aspect of the present disclosure provides a method for solving a mapping function based on discrete sample points, the method comprising: converting the time series data after model construction into the image representation required for solving the threshold in the present disclosure. It should be noted that the image is not actually drawn here, but the converted data sequence can express the characteristics of the image; through clustering and image fitting algorithms, a mapping function of the image based on the sample sequence is obtained.

The third aspect of the present disclosure provides a threshold automatic learning calculation method based on curve image calculation, the method comprising: solving the slope change rate of the function curve obtained in the above steps, combining the business characteristics of the indicator, to obtain the threshold intelligent recognition result.

The fourth aspect of the present disclosure provides a threshold automatic learning device based on curve image calculation, the device comprising: a real-time data aggregation module, configured to perform real-time data cleaning and indicator aggregation for key KPI indicators of each entity node of the multi-dimensional system of the operation and maintenance system; a threshold intelligent identification module, configured to execute the method in the above steps.

A fifth aspect of the present disclosure provides an electronic device, the electronic device comprising a computer processor and a memory: the computer memory is configured to store a computer program;

The processor is configured to implement the functions implemented by the model building unit described in the first aspect above, and to execute a method for solving a mapping function based on discrete sample points described in the second aspect above and a threshold automatic learning calculation method based on curve image calculation described in the third aspect.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a readable storage medium (such as ROM/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present disclosure.

In an exemplary embodiment, the above-mentioned computer-readable storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

S1, obtain the aggregated indicator data corresponding to the target indicator;

S2, determining an indicator data set from the aggregated indicator data, sorting the first indicator data in the indicator data set to obtain second indicator data, clustering the second indicator data to obtain a plurality of clustered groups, and fitting the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitoring object;

S3, determining an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.

In an exemplary embodiment, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

Obviously, those skilled in the art should understand that the above modules or steps of the present disclosure can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (15)

1. A method for determining an indicator threshold, comprising:

   Get the aggregated indicator data corresponding to the target indicator;

   Determine an indicator data set from the aggregated indicator data, sort the first indicator data in the indicator data set to obtain second indicator data, cluster the second indicator data to obtain a plurality of clustered groups, and fit the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitoring object;

   An indicator threshold is determined from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.
2. The method for determining an indicator threshold according to claim 1, wherein obtaining aggregate indicator data corresponding to the target indicator comprises:

   Determine a preset monitoring dimension, a monitoring object of the monitoring dimension, an indicator category of the target indicator, initial indicator data under the indicator category, and a time aggregation granularity corresponding to the target indicator;

   Determine the indicator data to be aggregated according to the preset monitoring dimension, the monitoring object of the monitoring dimension, the indicator category of the target indicator, and the initial indicator data under the indicator category;

   The indicator data to be aggregated is aggregated according to the time aggregation granularity corresponding to the target indicator to obtain aggregated indicator data corresponding to the target indicator.
3. The method for determining the indicator threshold according to claim 2, wherein the to-be-aggregated indicator data is aggregated according to the time aggregation granularity corresponding to the target indicator to obtain the aggregated indicator data corresponding to the target indicator, comprising:

   Obtaining a first time granularity of the indicator data to be aggregated;

   In the case of determining that the first time granularity is smaller than the time aggregation granularity, obtaining first indicator data of the indicator data to be aggregated within the first time granularity, and aggregating multiple first time granularities into the time aggregation granularity;

   Aggregate the multiple first indicator data within the multiple first time granularities into first aggregated indicator data within the time aggregation granularity, and determine the first aggregated indicator data as the aggregated indicator data corresponding to the target indicator.
4. The method for determining an indicator threshold according to claim 3, wherein the method further comprises:

   When it is determined that the first time granularity is equal to the time aggregation granularity, first indicator data of the indicator data to be aggregated within the first time granularity is obtained, and the first indicator data is determined as the aggregation indicator data corresponding to the target indicator.
5. The method for determining an indicator threshold according to claim 1, wherein, before clustering the second indicator data, the method further comprises:

   Performing standardization processing on the second indicator data to obtain a plurality of standardized indicator values, wherein each standardized indicator value corresponds to a sorting sequence number;

   For each standardized indicator value, the sorting sequence number corresponding to the standardized indicator value is determined as the horizontal coordinate, and the standardized indicator value is determined as the vertical coordinate to obtain the coordinate point corresponding to the standardized indicator value;

   Determine the coordinate slopes between the two adjacent coordinate points to obtain a plurality of coordinate slopes, and for each of the plurality of coordinate slopes, determine a smoothing value of each of the coordinate slopes to obtain a plurality of smoothing values;

   A third indicator data is determined according to the plurality of smoothed values, and the third indicator data is determined as the updated second indicator data.
6. The method for determining the indicator threshold according to claim 5, wherein, in the process of determining the smoothed value of each of the multiple coordinate slopes to obtain the multiple smoothed values, the method comprises:

   Clustering the multiple coordinate slopes according to a preset clustering algorithm to obtain multiple groups of slope values;

   For each set of slope values, the mean value of the coordinate slopes of each set of slope values is determined as the smoothed value of the coordinate slopes of each set of slope values.
7. The method for determining an indicator threshold according to claim 6, wherein the method further comprises:

   When it is determined that there is a target group slope value among the multiple groups of slope values, the smoothed value of the coordinate slope of the adjacent group slope value adjacent to the target group slope value is determined as the smoothed value of the coordinate slope within the target group slope value, or the smoothed value of the coordinate slope within the target group slope value is determined according to a preset smoothing value, wherein the number of coordinate slopes within the target group slope value is different from the number of coordinate slopes within each group of slope values.
8. The method for determining the indicator threshold according to claim 1, wherein, after clustering the second indicator data to obtain a plurality of clustered groups, and fitting the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, the method further comprises:

   Obtaining multiple groups of means according to the mean values of the indicator data of each group, and determining a mean set according to the multiple groups of means, wherein the mean set includes the means corresponding to each piecewise function;

   Determine the intersection coordinates of the intersection coordinate set of the piecewise functions, determine the left derivative and the right derivative corresponding to the intersection coordinates, and determine a first mean of the first piecewise function corresponding to the left derivative in the mean set and a second mean of the second piecewise function corresponding to the right derivative in the mean set;

   A determination is made based on the first mean and the second mean whether to keep the intersection point coordinates within the indicator threshold set.
9. The method for determining an indicator threshold according to claim 8, wherein determining whether to keep the intersection coordinates within the indicator threshold set based on the first mean and the second mean comprises:

   Determine a first absolute distance value between the intersection point coordinates and the origin point coordinates;

   Determining first coordinate information corresponding to the first mean value according to the first absolute distance value and the first mean value, wherein the first coordinate information represents the value of the independent variable of the first piecewise function;

   Determining second coordinate information corresponding to the second mean value according to the first absolute distance value and the second mean value, wherein the second coordinate information represents the value of the independent variable of the second piecewise function;

   When it is determined that the first coordinate information is the same as the second coordinate information, retaining the intersection coordinates within the indicator threshold set;

   When it is determined that the first coordinate information is different from the second coordinate information, the intersection coordinates are retained in the The indicator threshold set.
10. The method for determining an indicator threshold according to claim 1, wherein determining the indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator comprises:

    Determine a set of non-differentiable points of the piecewise function and coordinate points whose second-order derivatives are target values;

    Determine the indicator threshold set based on the non-differentiable point set, the coordinate point where the second-order derivative is the target value, and the intersection coordinate set of the piecewise function;

    An indicator threshold is determined from an indicator threshold set according to the indicator bias of the target indicator.
11. The method for determining an indicator threshold according to claim 1, wherein determining the indicator threshold from the indicator threshold set according to the indicator bias of the target indicator comprises:

    In the case where it is determined that the indicator bias of the target indicator is negative, if it is determined that the type of the indicator threshold is an alarm threshold, a maximum value in the indicator threshold set is determined as the indicator threshold;

    If it is determined that the type of the indicator threshold is a preferential threshold, the minimum value in the indicator threshold set is determined as the indicator threshold.
12. The method for determining an indicator threshold according to claim 1, wherein determining the indicator threshold from the indicator threshold set according to the indicator bias of the target indicator comprises:

    In the case where it is determined that the indicator bias of the target indicator is positive, if it is determined that the type of the indicator threshold is an alarm threshold, a minimum value in the indicator threshold set is determined as the indicator threshold;

    If it is determined that the type of the indicator threshold is a preferential threshold, the maximum value in the indicator threshold set is determined as the indicator threshold.
13. A device for determining an indicator threshold, comprising:

    An acquisition module is configured to obtain the aggregated indicator data corresponding to the target indicator;

    A first determination module is configured to determine an indicator data set from the aggregated indicator data, sort the first indicator data in the indicator data set to obtain second indicator data, cluster the second indicator data to obtain a plurality of clustered groups, and fit the indicator data of each of the plurality of groups to obtain a piecewise function corresponding to each group, wherein the same indicator data set represents indicator data of the same monitored object;

    The second determination module is configured to determine an indicator threshold from the intersection coordinate set of the piecewise function according to the indicator bias of the target indicator.
14. A computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to execute the method described in any one of claims 1 to 12 when run.
15. An electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 12 through the computer program.