CN105991362B - The fluctuation threshold range setting method and device of data traffic - Google Patents
The fluctuation threshold range setting method and device of data traffic Download PDFInfo
- Publication number
- CN105991362B CN105991362B CN201510075153.7A CN201510075153A CN105991362B CN 105991362 B CN105991362 B CN 105991362B CN 201510075153 A CN201510075153 A CN 201510075153A CN 105991362 B CN105991362 B CN 105991362B
- Authority
- CN
- China
- Prior art keywords
- value
- data
- current data
- threshold range
- fluctuation threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention discloses a kind of fluctuation threshold range setting methods of data traffic, which comprises is classified to obtain type of waveform information according to type of waveform of the historical data of current data to the current data；The fluctuation threshold range of the current data is set according to the type of waveform information and historical data flow information.The present invention further simultaneously discloses a kind of data traffic monitoring method, a kind of fluctuation threshold values range setting device of data traffic and a kind of data traffic monitoring system.
Description
Technical field
The present invention relates to the fluctuation threshold range setting methods and dress of data monitoring technical field more particularly to data traffic
It sets.
Background technique
Traditional traffic monitoring platform is to be judged after analyzing data traffic by preset threshold values, exceeds model
It encloses, initiates alarm processing, this kind of monitoring type is known as threshold values monitoring, is the way of current flux monitoring industry mainstream.For example,
One web failure rate is monitored, the threshold values of setting monitoring in advance is 0-10%, when monitoring system finds that certain segment fault rate is more than
10% alerts.
From summing up data analytic angle, threshold values monitoring is the Static Analysis Method to data traffic, and this method does not have
With surrounding time point Dynamic comparison, frequently results in monitoring system and reports by mistake or do not report when there is no real emergency event,
It finally allows user to warning information fiber crops mesh and loses the confidence.For example, do traffic monitoring to a website, this numerical value of flow can be because
It changes for factors such as time, environment, user is difficult to estimate a suitable threshold values setting to monitor supervision platform, because idle can
Can close to 0, when peak, rises 1000 or more or more, and the small then monitor supervision platform of threshold values setting is frequently reported by mistake, and threshold values setting is big
The changes in flow rate that can not then find burst also can not really play the role of alarm to the monitoring inaccuracy of flow.
Application No. is a kind of 201210401916, entitled modified network flow monitoring system and methods of threshold adaptive
Chinese invention patent application disclose a kind of method set by sliding window to threshold value, but the threshold value ginseng of this method
Numerical value is related with the size of sliding window, and the size of sliding window is to be manually set, therefore, obtained thresholding parameter value
It will receive the interference of human factor, finally obtained threshold value can not really reflect the feature of network flow.
Summary of the invention
In view of this, an embodiment of the present invention is intended to provide the fluctuation threshold range setting methods and device of data traffic, until
It can solve the technical problems such as available data traffic monitoring inaccuracy less.
The technical solution of the embodiment of the present invention is achieved in that
The embodiment of the invention provides a kind of fluctuation threshold range setting methods of data traffic, which comprises
Classified to obtain type of waveform letter according to type of waveform of the historical data of current data to the current data
Breath；
The current data is set according to the historical data flow information of the type of waveform information and the current data
Fluctuation threshold range；The fluctuation threshold range is used to trigger the alarm of the current data.
The embodiment of the invention also provides a kind of data traffic monitoring methods, which comprises
Acquire the flow value of current data；
Using the fluctuation threshold range setting method setting fluctuation threshold range of any of the above-described data traffic；
The flow value is compared with the fluctuation threshold range, if the flow value exceeds the fluctuation threshold values model
It encloses, then issues warning information.
The embodiment of the invention also provides a kind of fluctuation threshold values range setting device of data traffic, described device includes:
Data sorting unit, for being divided according to the historical data of current data the type of waveform of the current data
Class obtains type of waveform information；
Threshold values range setting module is fluctuated, for the historical data according to the type of waveform information and the current data
Flow information sets the fluctuation threshold range of the current data；The fluctuation threshold range is for triggering the current data
Alarm.
The embodiment of the invention also provides a kind of data traffic monitoring systems, and the system comprises any of the above-described numbers
According to the fluctuation threshold values range setting device of flow.
The fluctuation threshold range setting method and device of data traffic provided by the present invention, by the flow value with go through
The fluctuation threshold range of history data traffic compares, can be to the maximum extent according to the historical variations trend of current data itself to working as
The variation range of the flow value of preceding data judges, and avoids interference caused by subjective factors when static alarm threshold value is manually set,
Realize the accurate alarm of flow value variation.
Detailed description of the invention
Fig. 1 is the flow chart of the fluctuation threshold range setting method of the data traffic of embodiment 1；
Fig. 2 is the structural schematic diagram of the fluctuation threshold values range setting device of the data traffic of embodiment 3；
Fig. 3 is the actual curve and lottery ticket sales upper limit curve and lottery ticket pin of the lottery ticket sales under normal circumstances of embodiment 5
Measure the relational graph of lower limit curve；
Fig. 4 be embodiment 5 generations emergency circumstances under lottery ticket sales actual curve and lottery ticket sales upper limit curve
With the relational graph of lottery ticket sales lower limit curve；
Fig. 5 is the actual curve and lottery ticket sales that lottery ticket sales after interference factor are arranged according to emergency event of embodiment 5
The relational graph of upper limit curve and lottery ticket sales lower limit curve.
In order to clearly realize the structure of the embodiment of the present invention, certain size, structure and device are labelled in figure,
But signal needs are only for, are not intended to limit the invention in the specific dimensions, structure, device and environment, according to specific
Need, these devices and environment can be adjusted or be modified by those skilled in the art, the adjustment that is carried out or
Person's modification still includes in the range of appended claims.
Specific embodiment
In the following description, multiple and different aspects of the invention will be described, however, for common skill in the art
For art personnel, the present invention can be implemented just with some or all structures or process of the invention.In order to explain
Definition for, specific number, configuration and sequence are elaborated, however, it will be apparent that these specific details the case where
Under the present invention also can be implemented.It in other cases, will no longer for some well-known features in order not to obscure the present invention
It is described in detail.
Embodiment 1
In order to solve the technical problems such as available data traffic monitoring inaccuracy, a kind of data traffic is present embodiments provided
Threshold range setting method is fluctuated, as shown in Figure 1, a kind of data traffic monitoring method of the present embodiment includes:
S101: classified to obtain waveform class according to type of waveform of the historical data of current data to the current data
Type information；
The historical data of current data is able to reflect the characteristic of current data itself, can be to current data according to the characteristic
Type of waveform classification is carried out, the accuracy for the fluctuation threshold range setting of current data is laid a good foundation.
S102: described current according to the setting of the historical data flow information of the type of waveform information and the current data
The fluctuation threshold range of data；The fluctuation threshold range is used to trigger the alarm of the current data.
Type of waveform information is classified current data, is able to reflect current data by historical data flow information
Period of change and the information such as fluctuation range, on the basis of type of waveform information, in conjunction with historical data flow information to current
Data are analyzed, and can accurately be set according to the feature of current data itself to the fluctuation threshold range of current data,
The timely alarm to emergency event can be realized to the maximum extent.
The present embodiment by the flow value compared with fluctuating threshold range, can be to the maximum extent according to current data itself
Historical variations trend the variation range of the flow value of current data is judged, avoid be manually set alarm threshold value when
Interference caused by subjective factors realizes the accurate alarm of flow value variation.
The current data of this implementation can be can collected a variety of different data, correspondingly, the stream of the present embodiment
Magnitude is also possible to the amplitude of certain data.The variation speed of these data is different, some are the data of randomness, such as net
Stand flowing of access waveform, stock waveform, temperature waveform, wind speed waveform etc., some be the daily rise of the regular sun and
Time waveform, flood tide and the waveform for time of ebbing tide for falling etc..In order to analyze these waveforms, the present embodiment is first from wave
The speed degree of deformation is classified, and is alerted and is analyzed to it again after the completion of classification.
For this purpose, step S101 includes:
The flow change rate of the historical data of the current data is compared with setting value, if the flow change rate
Less than setting value, then the type of waveform of the current data is change type at a slow speed；Otherwise, the type of waveform of the current data
For quick change type.
The flow change rate refers to the undulating value of the flow value of data whithin a period of time, and undulating value is smaller, illustrates this
The variation of data is more stable, when undulating value is less than setting value, it is believed that the variation of data belongs to slowly varying；If data
Variation belongs to slowly varying, so that it may ignore certain attributes (such as periodically) of data itself, and only lean on going through for current data
History data can make reasonable supposition to the change in future of current data, and then fluctuation threshold range is arranged.Quickly variation
When type for change type at a slow speed, if current data belongs to quick change type, historical data is leaned on merely
Obtained fluctuation threshold range is likely to inaccuracy, can not find that emergency event flow value caused by current data changes, nothing
Method realizes really alarm.In addition, depending on the value of setting value is also required to according to the actual situation.
Therefore, it is necessary to the fluctuation threshold ranges of the data respectively to change type at a slow speed and quick change type to set process
It is analyzed, therefore, step S102 is specifically included and (is not limited to the present embodiment method):
Step S1021: when the type of waveform of the current data is change type at a slow speed, pass through the current data
Fluctuation threshold range described in the previous collection point of the corresponding collection point of flow value is set；Specifically:
When the type of waveform of the current data is change type at a slow speed, previous collection point (i.e. historical data is obtained
Flow information) corresponding flow value, in the previous collection point, setting first rises increment on the basis of corresponding flow value
With the first decline increment, first, which rises increment and the value of the first decline increment, can refer to the corresponding flow in preceding several collection points
The variable quantity of value, specific value is depending on actual conditions.It will be on the corresponding flow value in the previous collection point and described first
Rise the first upper limit value increment and that value is as the fluctuation threshold range；By the corresponding flow value in the previous collection point with
First lower limit value of the difference of the first decline increment as the fluctuation threshold range；First upper limit value and described
One lower limit value constitutes the fluctuation threshold range；Wherein, described first rises increment as positive value, and the first decline increment is positive
Value；The absolute value of the first rising increment and the first decline increment may be the same or different, and specific value view is practical to be needed
Depending on wanting.
Step S1022: when the type of waveform of the current data is quick change type, usually not according to changing at a slow speed
Just the fluctuation threshold range is handled by the corresponding flow value in simply previous collection point when type, but will be more
The variation tendency of more consideration current data itself sets the fluctuation threshold range.The present embodiment is worked as according to
The periodicity of preceding data sets the fluctuation threshold range, specifically includes:
If 1), the current data do not have periodically (in view of the current data of the present embodiment can be a variety of data,
" periodicity " herein only qualitatively illustrates, is not quantitative explanation, may also mean that without periodical without obvious
Periodicity), then the setting data collection point for obtaining before the corresponding collection point of the flow value (i.e. believe by historical data flow
Breath) corresponding historical data collection value (amplitude of the corresponding current data in collection point), according to the historical data collection value
The fluctuation threshold range is arranged in variation tendency；It should be noted that historical data collection value herein should be there is no
Otherwise the amplitude of current data when emergency event can make the setting inaccuracy for fluctuating threshold range.
The fluctuation threshold range is arranged according to the variation tendency of the historical data collection value to specifically include: described in calculating
Change rate between historical data collection value determines the fluctuation threshold range by the change rate.Specifically:
Calculate the change rate between the historical data collection value, by the maximum value of the change rate with the flow value
The acquisition moment nearest historical data collection value (the data width of the previous data collection point of Current data acquisition point
Value) at obtained increment as second rise increment and the second decline increment, will be nearest with the acquisition moment of the flow value
The historical data collection value is as prediction initial value, the prediction initial value and described second rising increment and value is as institute
State the second upper limit value of fluctuation threshold range；The difference of the prediction initial value and the second decline increment is as the fluctuation
Second lower limit value of threshold range；Second upper limit value and second lower limit value constitute the fluctuation threshold range；Wherein,
Described second rises increment as positive value, and the second decline increment is positive value.
The calculation formula of change rate are as follows:
Wherein:
biFor i-th of change rate, i=1,2 ..., n, n is the quantity of historical data collection value；I value is smaller, and i value is corresponding
The collection point of the collection value of the collection point and current data of historical data collection value is remoter；
ΔFiFor the difference between i-th of historical data collection value and the (i-1)-th historical data collection value；
T is the collection point period, and for the sake of convenient, the value of t can be 1.
The calculation formula of second upper limit value are as follows:
Fu=Fn+bi×Fn
Wherein:
FuFor the second upper limit value；
FnFor the historical data collection value nearest with the acquisition moment of the flow value, correspondingly, bi×FnIt is second
Rise increment or the second decline increment.
The calculation formula of second lower limit value are as follows:
Fd=Fn-bi×Fn
Wherein:
FdFor the second lower limit value.
Fluctuation threshold range can also be set by the undulating value of the flow value of current data, wherein fluctuation
The calculation formula (being not limited to the formula, be also possible to other similar formula) of value may is that
Wherein:
FbFor the undulating value of current data；
M is the flow value of current data；
MkFor the flow value of preceding k-th of collection point；K=-l ..., 0, l is going through before the corresponding collection point of current data
History collection point sum.
If 2), the current data has periodically, according to historical data curve (the i.e. history number of the current data
According to flow information) the setting fluctuation threshold range.Historical data curve herein refers to that the preceding of current data several is not sent out
The curve that data in the period of raw emergency event are constituted.Since current data has periodically, then by the way that there is no bursts
The historical data of event can make prediction to the variation tendency of normal current data, this just significantly reduces setting fluctuation
The difficulty of threshold range, and have the objectivity of current data itself, the also stream of the current data caused by emergency event
Magnitude carries out accurate judgement.
The fluctuation threshold range is arranged according to the historical data curve of the current data to specifically include: being worked as by described
The historical data of preceding data obtains the upper limit curve and lower limit curve of the fluctuation threshold range, from the upper limit curve and lower limit
The fluctuation threshold range of the collection point of the corresponding current data is determined on curve, specifically:
The historical data for obtaining the preceding setting period of the current data, according to the preceding history number for setting a period
According to the maximum difference of Mean curve and each collection point is obtained, herein, Mean curve refers to the preceding setting on each collection point
The historical data in a period is averaged, and the mean value on all collection points is done the curve that line obtains；On the Mean curve
Each collection point on increase the maximum difference of the corresponding collection point and obtain the upper limit curve of the fluctuation threshold range；In
The corresponding maximum difference is reduced on each collection point on the Mean curve obtains the lower limit of the fluctuation threshold range
Curve；Benchmark corresponding with the collection point of current data collection point is found from the upper limit curve and lower limit curve, herein
Benchmark collection point refers to the coincidence point with the collection point of current data on the period, for example, the period when collection point of current data
For 24 hours 11 points 30 seconds 50 minutes, then benchmark collection point refer to 24 hours in upper limit curve and lower limit curve 11 points 50 minutes
30 seconds.Using the corresponding value in the upper limit curve and lower limit curve in benchmark collection point as the fluctuation threshold range
Third upper limit value and third lower limit value；The third upper limit value and third lower limit value constitute the fluctuation threshold range；Wherein,
The maximum difference is positive value.
The calculation formula of the corresponding amplitude in each collection point on Mean curve are as follows:
Wherein:
CjzyFor the mean value of the amplitude in z period on y-th of collection point of Mean curve, j is mean value symbol；M is the period
Quantity；Y=1 ..., n, n are the quantity of collection point；
CzyFor the amplitude of y-th of collection point in z-th of period.
Obtain the corresponding amplitude C in each collection point on Mean curvejzyAfterwards, by all CjzyLine has just obtained mean value song
Line.
The calculation formula of each amplitude in upper limit curve are as follows:
Cuy=Cjzy+ΔFy
Wherein:
CuyFor the upper limit magnitude of y-th of collection point, u is upper limit symbol；
ΔFyFor the maximum difference between the amplitude on the z period of y-th of collection point.
Obtain each amplitude C in upper limit curveuyAfterwards, by all CuyLine has just obtained upper limit curve.
The calculation formula of each amplitude in lower limit curve are as follows:
Cdy=Cjzy-ΔFy
Wherein:
CdyFor the Lower Limit Amplitude of y-th of collection point, d is lower limit symbol；
Obtain each amplitude C in lower limit curvedyAfterwards, by all CdyLine has just obtained lower limit curve.
The above-mentioned setting to the fluctuation threshold range is belonged to be done on the basis of the changing rule of current data itself
Out, if receiving the interference (hair as artificially caused can to influence the event of current data of known event to current data
Raw or other events), then it needs to make anticipation to the event to the intrinsic regular bring influence of current data.
For this purpose, the present embodiment method further include:
Interference factor is set according to specified event, the fluctuation threshold range is arranged by the interference factor, comprising:
If the current data is interfered by specified event, according to the specified event setup interference factor, and according to
The interference factor is adjusted the fluctuation threshold range.Specified event herein can be known event, such as in coloured silk
Ticket is got the winning number in a bond before announcement, artificially publicity etc. has been carried out to the prizes pool amount of money on a large scale, so to a certain extent to the sales volume of lottery ticket
Influence is caused, therefore lottery ticket sales amount curve can also change, can also be that other occur before current data, and right
The event that current data impacts.
The method of the present embodiment adjustment includes, by the previous collection point of the corresponding collection point of the flow value of current data
Flow value obtains interference increment multiplied by the standard flow value as reference flow magnitude, by the interference factor；By the benchmark
Flow value and the 4th upper limit value interference increment and that value is as the fluctuation threshold range；By the reference flow magnitude with
Fourth lower limit value of the difference of the interference increment as the fluctuation threshold range；Under 4th upper limit value and the described 4th
Limit value constitutes the fluctuation threshold range；Wherein, the interference factor is positive value；The interference increment is positive value.
Embodiment 2
Present embodiments provide a kind of data traffic monitoring method, comprising:
Step S201: the flow value of current data is acquired；
The current data of the present embodiment can be the data such as website visiting amount, and flow value (or width can be used by being also possible to other
Value) data that are characterized.It is usually false to the basis of fluctuation threshold range setting when being acquired to the flow value of current data
Determine the flow value when flow value of current data is not belonging to alarm status.The mode of acquisition is acquisition in real time, is such as supervised by data
Control the flow value etc. that device reads current data.
Step S202: using the fluctuation threshold range setting method setting fluctuation threshold values of data traffic described in embodiment 1
Range；
The characteristics of fluctuation threshold range setting method of embodiment 1 can be according to current data itself, accurately to fluctuation
Threshold range is set, and fluctuation threshold range is set by the historical variations trend of current data itself, for characterizing
The variation tendency of current data avoids to be manually set in this way interference caused by subjective factors when alarm threshold value, to the maximum extent root
It is alerted according to the variation tendency of current data itself, can really reflect the variation of current data, be the flow value of current data
It is accurate alarm prepare.
Step S203: the flow value is compared with the fluctuation threshold range, if the flow value is beyond described
Threshold range is fluctuated, then issues warning information.
Embodiment 3
The present embodiment and embodiment 1 belong to same inventive concept, present embodiments provide a kind of flutter valve of data traffic
It is worth range setting device, as shown in Fig. 2, described device includes:
Data sorting unit 301, for according to the historical data of current data to the type of waveform of the current data into
Row classification obtains type of waveform information；
The historical data of current data is able to reflect the characteristic of current data itself, can be to current data according to the characteristic
Type of waveform classification is carried out, the accuracy for the fluctuation threshold range setting of current data is laid a good foundation.
Threshold values range setting module 302 is fluctuated, for the history according to the type of waveform information and the current data
Data traffic information sets the fluctuation threshold range of the current data；The fluctuation threshold range is for triggering the current number
According to alarm.
Type of waveform information is classified current data, is able to reflect current data by historical data flow information
Period of change and the information such as fluctuation range, on the basis of type of waveform information, in conjunction with historical data flow information to current
Data are analyzed, and can accurately be set according to the feature of current data itself to the fluctuation threshold range of current data,
The timely alarm to emergency event can be realized to the maximum extent.
The current data of this implementation can be can collected a variety of data, correspondingly, the flow value of the present embodiment
It can be the amplitude of certain data.The variation speed of these data is different, some are the data of randomness, such as website visiting
Flow waveform, stock waveform, temperature waveform, wind speed waveform etc., some are the daily rises of the regular sun and fall
Time waveform, flood tide and the waveform for time of ebbing tide etc..In order to analyze these waveforms, the present embodiment changes from waveform first
Speed degree classify, after the completion of classification it is alerted analyze again.
For this purpose, the data sorting unit 301 further include:
Data classification subelement, for comparing the flow change rate of the historical data of the current data with setting value
Compared with if the flow change rate is less than setting value, the type of waveform of the current data is change type at a slow speed；Otherwise, institute
The type of waveform for stating current data is quick change type.The flow change rate refers to the flow value of data whithin a period of time
Undulating value, undulating value is smaller, illustrate that the variation of the data is more stable, when undulating value be less than setting value when, it is believed that data
Variation belongs to slowly varying；If the variation of data belongs to slowly varying, so that it may ignore certain attributes of data itself (such as week
Phase property etc.), and reasonable supposition only can be made to the change in future of current data by the historical data of current data, in turn
Setting fluctuation threshold range.When quick change type for change type at a slow speed, if current data belongs to quickly
Change type is then likely to inaccurate by the fluctuation threshold range that historical data obtains merely, and emergency event can not be found to working as
The variation of flow value caused by preceding data, cannot achieve real alarm.In addition, the value of setting value is also required to according to the actual situation
Depending on.
Wherein, the fluctuation threshold values range setting module 302 includes:
First threshold value setting subelement, for the type of waveform in the current data be change type at a slow speed when, pass through
Fluctuation threshold range described in the previous collection point of the corresponding collection point of the flow value of the current data is set, specific to wrap
It includes:
When the type of waveform of the current data is change type at a slow speed, the corresponding flow in previous collection point is obtained
Value, in the previous collection point, setting first rises increment and the first decline increment on the basis of corresponding flow value, and first
The value of rising increment and the first decline increment can refer to the variable quantity of the corresponding flow value in preceding several collection points, specific value
Depending on actual conditions.Described in the corresponding flow value in the previous collection point and described first are risen increment and value conduct
Fluctuate the first upper limit value of threshold range；By the difference of the corresponding flow value in the previous collection point and the first decline increment
It is worth the first lower limit value as the fluctuation threshold range；First upper limit value and first lower limit value constitute the fluctuation
Threshold range；Wherein, described first rises increment as positive value, and the first decline increment is positive value；Described first rises increment
It may be the same or different with the absolute value of the first decline increment, specific value is depending on actual needs.
Second threshold value setting subelement, for the type of waveform in the current data be quick change type when, according to
The periodicity of the current data sets the fluctuation threshold range.
Specifically, the second threshold value setting subelement includes:
First threshold value setting module, for it is corresponding to obtain the flow value when the current data does not have periodical
Collection point before the corresponding historical data collection value of setting data collection point, according to the change of the historical data collection value
The fluctuation threshold range is arranged in change trend, it should be noted that historical data collection value herein should be that there is no prominent
Otherwise the amplitude of current data when hair event can make the setting inaccuracy for fluctuating threshold range.
First threshold value setting module further includes the first threshold value setting submodule, and the first threshold value setting submodule is for calculating institute
The change rate between historical data collection value is stated, the fluctuation threshold range is determined by the change rate, is specifically included:
Calculate the change rate between the historical data collection value, by the maximum value of the change rate with the flow value
The acquisition moment nearest historical data collection value at obtained increment rise increment and the second decline increment as second,
Using the historical data collection value nearest with the acquisition moment of the flow value as prediction initial value, the prediction initial value
Rise the second upper limit value increment and that value is as the fluctuation threshold range with described second；The prediction initial value and described
Second lower limit value of the difference of second decline increment as the fluctuation threshold range；Under second upper limit value and described second
Limit value constitutes the fluctuation threshold range；Wherein, described second rises increment as positive value, and the second decline increment is positive value；
The calculation formula of change rate are as follows:
Wherein:
biFor i-th of change rate, i=1,2 ..., n, n is the quantity of historical data collection value；I value is smaller, and i value is corresponding
The collection point of the collection value of the collection point and current data of historical data collection value is remoter；
ΔFiFor the difference between i-th of historical data collection value and the (i-1)-th historical data collection value；
T is the collection point period, and for the sake of convenient, the value of t can be 1.
The calculation formula of second upper limit value are as follows:
Fu=Fn+bi×Fn
Wherein:
FuFor the second upper limit value；
FnFor the historical data collection value nearest with the acquisition moment of the flow value, correspondingly, bi×FnIt is second
Rise increment or the second decline increment.
The calculation formula of second lower limit value are as follows:
Fd=Fn-bi×Fn
Wherein:
FdFor the second lower limit value.
Fluctuation threshold range can also be set by the undulating value of the flow value of current data, wherein fluctuation
The calculation formula (being not limited to the formula, be also possible to other similar formula) of value may is that
Wherein:
FbFor the undulating value of current data；
M is the flow value of current data；
MkFor the flow value of preceding k-th of collection point；K=-l ..., 0, l is going through before the corresponding collection point of current data
History collection point sum.
Second threshold value setting module is used for when the current data has periodical, according to going through for the current data
The fluctuation threshold range is arranged in history data and curves.
Second threshold value setting module further includes the second threshold value setting submodule, and the second threshold value setting submodule is for passing through institute
The historical data for stating current data obtains the upper limit curve and lower limit curve of the fluctuation threshold range, from the upper limit curve and
The fluctuation threshold range that the collection point of the corresponding current data is determined in lower limit curve, specifically includes:
The historical data for obtaining the preceding setting period of the current data, according to the preceding history number for setting a period
According to obtaining the maximum difference of Mean curve and each collection point；Increase corresponding be somebody's turn to do on each collection point on the Mean curve
The maximum difference of collection point obtains the upper limit curve of the fluctuation threshold range；Each acquisition on the Mean curve
The corresponding maximum difference is reduced on point obtains the lower limit curve of the fluctuation threshold range；From the upper limit curve and lower limit
Benchmark corresponding with the collection point of current data collection point is found on curve, benchmark collection point is corresponding in the upper limit curve
With the value in lower limit curve respectively as the third upper limit value and third lower limit value of the fluctuation threshold range；The maximum difference
For positive value.
The calculation formula of the corresponding amplitude in each collection point on Mean curve are as follows:
Wherein:
CjzyFor the mean value of the amplitude in z period on y-th of collection point of Mean curve, j is mean value symbol；M is the period
Quantity；Y=1 ..., n, n are the quantity of collection point；
CzyFor the amplitude of y-th of collection point in z-th of period.
Obtain the corresponding amplitude C in each collection point on Mean curvejzyAfterwards, by all CjzyLine has just obtained mean value song
Line.
The calculation formula of each amplitude in upper limit curve are as follows:
Cuy=Cjzy+ΔFy
Wherein:
CuyFor the upper limit magnitude of y-th of collection point, u is upper limit symbol；
ΔFyFor the maximum difference between the amplitude on the z period of y-th of collection point.
Obtain each amplitude C in upper limit curveuyAfterwards, by all CuyLine has just obtained upper limit curve.
The calculation formula of each amplitude in lower limit curve are as follows:
Cdy=Cjzy-ΔFy
Wherein:
CdyFor the Lower Limit Amplitude of y-th of collection point, d is lower limit symbol；
Obtain each amplitude C in lower limit curvedyAfterwards, by all CdyLine has just obtained lower limit curve.
The above-mentioned setting to the fluctuation threshold range is belonged to be done on the basis of the changing rule of current data itself
Out, if receiving the interference (hair as artificially caused can to influence the event of current data of known event to current data
Raw or other events), then it needs to make anticipation to the event to the intrinsic regular bring influence of current data.Therefore, described
Device further include:
Control unit is interfered, for interference factor to be arranged according to the event of specifying, the wave is arranged by the interference factor
Dynamic threshold range, specifically includes:
When the current data is interfered by specified event, according to the specified event setup interference factor, and according to
The interference factor is adjusted the fluctuation threshold range；The method of the adjustment includes, by the flow value of current data
The flow value of the previous collection point of corresponding collection point is as reference flow magnitude, by the interference factor multiplied by the reference flow
Magnitude obtains interference increment；By the reference flow magnitude and the interference increment and value as described fluctuate the of threshold range
Four upper limit values；Using the difference of the reference flow magnitude and the interference increment as the 4th lower limit of the fluctuation threshold range
Value；4th upper limit value and the 4th lower limit value constitute the fluctuation threshold range；Wherein, the interference factor is positive
Value；The interference increment is positive value.
Embodiment 4
A kind of data traffic monitoring system is present embodiments provided, the system comprises data traffics described in embodiment 3
Fluctuation threshold values range setting device, can also include the equipment that other are used to the operations such as show, analyze, details are not described herein again.
Embodiment 5
The present invention will be described by an actual scene for the present embodiment.
By taking the sale of lottery ticket as an example, it is generally the case that people's work hours buy the limited time of lottery ticket, the quantity of purchase
Will not be more, and weekend has plenty of time, a possibility that buying lottery ticket, is also big, and therefore, the lottery ticket sales at weekend often compare working day
Lottery ticket sales amount it is big.Therefore, we can roughly think that the sales volume of lottery ticket belongs to quick change type, also, lottery ticket
Sales volume curve has periodically (as unit of weekly), so, lottery ticket pin is arranged using historical data curve for the present embodiment
The fluctuation threshold range of amount.
To choose first 5 there is no the lottery ticket sales period of emergency event, each period, 7 collection points (were single with day
Position) for, the calculation formula of the corresponding amplitude in each collection point on lottery ticket sales Mean curve are as follows:
Wherein:
CjzyFor the mean value of the amplitude in z period on y-th of collection point of Mean curve, j is mean value symbol；The number in period
Amount is 5；The quantity of collection point is 7；
CzyFor the amplitude of y-th of collection point in z-th of period.
Obtain the corresponding amplitude C in each collection point on lottery ticket sales Mean curvejzyAfterwards, by all CjzyLine just obtains
Lottery ticket sales Mean curves.
The calculation formula of each amplitude in lottery ticket sales upper limit curve are as follows:
Cuy=Cjzy+ΔFy
Wherein:
CuyFor the upper limit magnitude of y-th of collection point, u is upper limit symbol；
ΔFyFor the maximum difference between the amplitude on the z period of y-th of collection point.
Obtain each amplitude C in lottery ticket sales upper limit curveuyAfterwards, by all CuyLine has just obtained on lottery ticket sales
Limit curve.
The calculation formula of each amplitude in lottery ticket sales lower limit curve are as follows:
Cdy=Cjzy-ΔFy
Wherein:
CdyFor the Lower Limit Amplitude of y-th of collection point, d is lower limit symbol.
Obtain each amplitude C in lottery ticket sales lower limit curvedyAfterwards, by all CdyLine has just obtained under lottery ticket sales
Curve is limited, as shown in Figure 3.From the figure 3, it may be seen that under normal circumstances, the actual curves of lottery ticket sales in lottery ticket sales upper limit curve and
Between lottery ticket sales lower limit curve, while illustrating there is no emergency event.
When there is other unknown emergency events to occur, the actual curves of lottery ticket sales beyond lottery ticket sales upper limit curve and
The range of lottery ticket sales lower limit curve issues alarm, as shown in Figure 4 at this time.
It is found if certain emergency event is before impacting lottery ticket sales, for example, right in certain day (such as Thursday)
Lottery ticket is publicized, such as progressive prize number reaches 10 and recalls, it is contemplated that lottery ticket publicity influence, can set at this time interference because
Son is just adjusted lottery ticket sales upper limit curve and lottery ticket sales lower limit curve before alarm occurs for lottery ticket sales curve, such as
Shown in Fig. 5, this makes it possible to avoid unnecessary alarm.
In several embodiments provided herein, it should be understood that disclosed device and method can pass through it
Its mode is realized.Apparatus embodiments described above are merely indicative, for example, the division of the unit, only
A kind of logical function partition, there may be another division manner in actual implementation, such as: multiple units or components can combine, or
It is desirably integrated into another system, or some features can be ignored or not executed.In addition, shown or discussed each composition portion
Mutual coupling or direct-coupling or communication connection is divided to can be through some interfaces, the INDIRECT COUPLING of equipment or unit
Or communication connection, it can be electrical, mechanical or other forms.
Above-mentioned unit as illustrated by the separation member, which can be or may not be, to be physically separated, aobvious as unit
The component shown can be or may not be physical unit, it can and it is in one place, it may be distributed over multiple network lists
In member；Some or all of units can be selected to achieve the purpose of the solution of this embodiment according to the actual needs.
In addition, each functional unit in various embodiments of the present invention can be fully integrated into a processing module, it can also
To be each unit individually as a unit, can also be integrated in one unit with two or more units；It is above-mentioned
Integrated unit both can take the form of hardware realization, can also realize in the form of hardware adds SFU software functional unit.
Those of ordinary skill in the art will appreciate that: realize that all or part of the steps of above method embodiment can pass through
The relevant hardware of program instruction is completed, and program above-mentioned can be stored in a computer readable storage medium, the program
When being executed, step including the steps of the foregoing method embodiments is executed；And storage medium above-mentioned include: movable storage device, it is read-only
Memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or
The various media that can store program code such as person's CD.
The above description is merely a specific embodiment, but scope of protection of the present invention is not limited thereto, any
Those familiar with the art in the technical scope disclosed by the present invention, can easily think of the change or the replacement, and should all contain
Lid is within protection scope of the present invention.Therefore, protection scope of the present invention should be based on the protection scope of the described claims.
Claims (16)
1. a kind of fluctuation threshold range setting method of data traffic, which is characterized in that the described method includes:
Classified to obtain type of waveform information according to type of waveform of the historical data of current data to the current data；
When the type of waveform of the current data is change type at a slow speed, the flow value for obtaining the current data corresponding is adopted
The corresponding flow value in previous collection point for collecting point, by being arranged on the basis of the corresponding flow value in the previous collection point
First rising increment and the first decline increment set fluctuation threshold range；Wherein, described first rises increment and described
The value of first decline increment is determined according to the variable quantity of the flow value of preceding predetermined collection point；By the previous collection point pair
The flow value and described first answered rise the first upper limit value increment and that value is as the fluctuation threshold range；It will be described previous
First lower limit value of the difference of a corresponding flow value in collection point and the first decline increment as the fluctuation threshold range；
Whether when the type of waveform of the current data is quick change type, it is periodically right to be had according to the current data
Fluctuation threshold range is set.
2. the method according to claim 1, wherein the historical data according to current data is to described current
The type of waveform of data is classified to obtain type of waveform information
The flow change rate of the historical data of the current data is compared with setting value, if the flow change rate is less than
Setting value, then the type of waveform of the current data is change type at a slow speed；Otherwise, the type of waveform of the current data is fast
Fast change type.
3. the method according to claim 1, wherein described according to the periodical to the wave of the current data
Dynamic threshold range carries out setting
If the current data does not have periodically, the setting data before obtaining the corresponding collection point of the flow value are adopted
The corresponding historical data collection value of collection point, is arranged the fluctuation threshold values model according to the variation tendency of the historical data collection value
It encloses；
If the current data has periodically, the fluctuation threshold values is arranged according to the historical data curve of the current data
Range.
4. according to the method described in claim 3, it is characterized in that, the variation tendency according to the historical data collection value
The fluctuation threshold range, which is arranged, includes:
The change rate between the historical data collection value is calculated, the fluctuation threshold range is determined by the change rate.
5. according to the method described in claim 3, it is characterized in that, described set according to the historical data curve of the current data
Setting the fluctuation threshold range includes:
The upper limit curve and lower limit curve of the fluctuation threshold range are obtained by the historical data of the current data, from described
The fluctuation threshold range of the collection point of the corresponding current data is determined in upper limit curve and lower limit curve.
6. the method according to claim 1, wherein the method also includes:
Interference factor is set according to specified event, the fluctuation threshold range is arranged by the interference factor.
7. a kind of data traffic monitoring method, which is characterized in that the described method includes:
Acquire the flow value of current data；
Fluctuation threshold values model is arranged using the fluctuation threshold range setting method of any data traffic of claim 1-6
It encloses；
The flow value is compared with the fluctuation threshold range, if the flow value exceeds the fluctuation threshold range,
Then issue warning information.
8. a kind of fluctuation threshold values range setting device of data traffic, which is characterized in that described device includes:
Data sorting unit, for classify to the type of waveform of the current data according to the historical data of current data
To type of waveform information；
Threshold values range setting module is fluctuated, for the historical data flow according to the type of waveform information and the current data
The fluctuation threshold range of current data described in information setting；The fluctuation threshold range is used to trigger the announcement of the current data
It is alert；
Wherein, the fluctuation threshold values range setting module includes:
When first threshold value setting subelement for the type of waveform in the current data is change type at a slow speed, described in acquisition
The corresponding flow value in previous collection point of the corresponding collection point of the flow value of current data, by the previous collection point
The first rising increment of setting and the first decline increment set fluctuation threshold range on the basis of corresponding flow value；Its
In, described first, which rises increment and described first, declines the value of increment according to the variable quantity of the preceding flow value for making a reservation for a collection point
It determines；The corresponding flow value in the previous collection point and described first are risen into the increment and value conduct fluctuation threshold values model
The first upper limit value enclosed；Using the difference of the previous corresponding flow value in collection point and the first decline increment as described in
Fluctuate the first lower limit value of threshold range；
Second threshold value setting subelement, for the type of waveform in the current data be quick change type when, according to described
Whether current data, which has, periodically sets the fluctuation threshold range.
9. device according to claim 8, which is characterized in that the data sorting unit further include:
Data classification subelement, for the flow change rate of the historical data of the current data to be compared with setting value,
If the flow change rate is less than setting value, the type of waveform of the current data is change type at a slow speed；Otherwise, described to work as
The type of waveform of preceding data is quick change type.
10. device according to claim 8, which is characterized in that the second threshold value setting subelement includes:
First threshold value setting module, for obtaining when the current data does not have periodical, the flow value is corresponding to be adopted
The corresponding historical data collection value of setting data collection point before collection point, becomes according to the variation of the historical data collection value
The fluctuation threshold range is arranged in gesture；
Second threshold value setting module is used for when the current data has periodical, according to the history number of the current data
According to curve, the fluctuation threshold range is set.
11. device according to claim 10, which is characterized in that the first threshold value setting module includes:
First threshold value setting submodule passes through the change rate for calculating the change rate between the historical data collection value
Determine the fluctuation threshold range.
12. device according to claim 10, which is characterized in that the second threshold value setting module includes:
Second threshold value setting submodule, for obtaining the fluctuation threshold range by the historical data of the current data
Curve and lower limit curve are limited, described in the collection point that the corresponding current data is determined from the upper limit curve and lower limit curve
Fluctuate threshold range.
13. device according to claim 8, which is characterized in that described device further include:
Control unit is interfered, for interference factor to be arranged according to the event of specifying, the flutter valve is arranged by the interference factor
It is worth range.
14. a kind of data traffic monitoring system, which is characterized in that the system comprises any data of claim 8-13
The fluctuation threshold values range setting device of flow.
15. a kind of storage medium, has processor-executable instruction, described instruction is executed by one or more processors
When, realize the fluctuation threshold range setting method of data traffic as claimed in any one of claims 1 to 6.
16. a kind of storage medium, has processor-executable instruction, described instruction is executed by one or more processors
When, realize data traffic monitoring method as claimed in claim 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510075153.7A CN105991362B (en) | 2015-02-12 | 2015-02-12 | The fluctuation threshold range setting method and device of data traffic |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510075153.7A CN105991362B (en) | 2015-02-12 | 2015-02-12 | The fluctuation threshold range setting method and device of data traffic |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105991362A CN105991362A (en) | 2016-10-05 |
| CN105991362B true CN105991362B (en) | 2019-10-29 |
Family
ID=57041138
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510075153.7A Active CN105991362B (en) | 2015-02-12 | 2015-02-12 | The fluctuation threshold range setting method and device of data traffic |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105991362B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106960126B (en) * | 2017-03-28 | 2020-03-24 | 联想(北京)有限公司 | Data early warning method and equipment |
| CN108668311B (en) * | 2017-03-29 | 2021-07-30 | 中国移动通信集团四川有限公司 | Cell area traffic early warning method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101051952A (en) * | 2007-04-18 | 2007-10-10 | 东南大学 | Self adaption sampling stream measuring method under high speed multilink logic channel environment |
| CN103685072A (en) * | 2013-11-27 | 2014-03-26 | 中国电子科技集团公司第三十研究所 | Method for quickly distributing network flow |
| CN103780445A (en) * | 2012-10-22 | 2014-05-07 | 北京临近空间飞行器系统工程研究所 | Threshold-self-adaptive-correcting network flow monitoring system and method |
| CN103888315A (en) * | 2014-03-24 | 2014-06-25 | 北京邮电大学 | Self-adaptation burst flow detection device and detection method thereof |
| CN104348747A (en) * | 2014-05-22 | 2015-02-11 | 国网山西省电力公司信息通信分公司 | Method and system for monitoring flow in MPLS-VPN (Multiple Protocol Label Switching-Virtual Private Network) |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070002736A1 (en) * | 2005-06-16 | 2007-01-04 | Cisco Technology, Inc. | System and method for improving network resource utilization |
-
2015
- 2015-02-12 CN CN201510075153.7A patent/CN105991362B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101051952A (en) * | 2007-04-18 | 2007-10-10 | 东南大学 | Self adaption sampling stream measuring method under high speed multilink logic channel environment |
| CN103780445A (en) * | 2012-10-22 | 2014-05-07 | 北京临近空间飞行器系统工程研究所 | Threshold-self-adaptive-correcting network flow monitoring system and method |
| CN103685072A (en) * | 2013-11-27 | 2014-03-26 | 中国电子科技集团公司第三十研究所 | Method for quickly distributing network flow |
| CN103888315A (en) * | 2014-03-24 | 2014-06-25 | 北京邮电大学 | Self-adaptation burst flow detection device and detection method thereof |
| CN104348747A (en) * | 2014-05-22 | 2015-02-11 | 国网山西省电力公司信息通信分公司 | Method and system for monitoring flow in MPLS-VPN (Multiple Protocol Label Switching-Virtual Private Network) |
Non-Patent Citations (1)
| Title |
|---|
| 基于流量采集与参数测量的网络可靠性分析系统的设计与实现;李达;《中国优秀硕士学位论文全文数据库（信息科技辑）》;20100515;正文第24页第3.2.2节，第26页第4.1节，图4.4-4.6 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105991362A (en) | 2016-10-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108491310B (en) | A kind of log monitoring method and system | |
| CN104807644B (en) | A kind of fault early warning method and system of paddle change system of wind turbines | |
| CN108965055A (en) | A kind of network flow abnormal detecting method taking a method based on historical time | |
| CN103744389B (en) | A kind of method for early warning of production of hydrocarbons equipment running status | |
| US8009041B2 (en) | Access monitoring and control system and method | |
| CN101718634A (en) | Equipment state comprehensive dynamic alarming method based on multivariate probability model | |
| US20080270071A1 (en) | Nonparametric method for determination of anomalous event states in complex systems exhibiting non-stationarity | |
| CN107203450A (en) | The sorting technique and equipment of failure | |
| EP2166422B1 (en) | Method of alarm mask generation and condition monitoring of wind turbines | |
| CN106100937A (en) | System monitoring method and apparatus | |
| CN110445680A (en) | Network flow abnormal detecting method, device and server | |
| CN109359873B (en) | Based on PCA-T2Health assessment method for ball screw pair | |
| CN111441864A (en) | Engine health diagnosis method and engine diagnosis system | |
| CN106612216A (en) | Method and apparatus of detecting website access exception | |
| CN102129776A (en) | Automatic detection method and system of abnormal pedestrian traffic state | |
| CN102087787B (en) | Prediction device and prediction method for short time traffic conditions | |
| CN106599487A (en) | ARIMA model and user regulation-based dynamic variance real-time alarming method | |
| CN107257351A (en) | One kind is based on grey LOF Traffic anomaly detections system and its detection method | |
| CN106649755A (en) | Threshold self-adaption setting abnormity detection method for multi-dimensional real-time power transformation device data | |
| CN105743595A (en) | Fault early warning method and device for medium and short wave transmitter | |
| CN105991362B (en) | The fluctuation threshold range setting method and device of data traffic | |
| CN202075864U (en) | Abnormal traffic state automatic detection system | |
| CN109857618A (en) | A kind of monitoring method, apparatus and system | |
| CN103647665A (en) | Network flow curve analysis method and apparatus | |
| CN114184870A (en) | Non-invasive load identification method and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |