CN107566665B - Traffic method for detecting abnormality and its equipment - Google Patents
Traffic method for detecting abnormality and its equipment Download PDFInfo
- Publication number
- CN107566665B CN107566665B CN201710698916.2A CN201710698916A CN107566665B CN 107566665 B CN107566665 B CN 107566665B CN 201710698916 A CN201710698916 A CN 201710698916A CN 107566665 B CN107566665 B CN 107566665B
- Authority
- CN
- China
- Prior art keywords
- value
- threshold value
- traffic
- history
- historical trend
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Traffic Control Systems (AREA)
Abstract
The present invention provides a kind of traffic method for detecting abnormality and its equipment, comprising steps of timing calculates historical trend threshold step, cleans history traffic data, and periodically calculate historical trend threshold value according to the history traffic data after cleaning；History threshold detection step；Real-time tendency detecting step calculates real-time tendency threshold value according to the traffic data in first time period before current detection point, and whether detection live traffice amount exceeds real-time tendency threshold value；Whether historical trend detecting step, detection live traffice amount exceed historical trend threshold value；Alarm step is issued, live traffice amount exceeds history threshold value, when beyond real-time tendency threshold value and exceeding historical trend threshold value, issues warning information.On the basis of history threshold test, real-time tendency detection and historical trend detection is added, overcomes directly the defects of acquisition history telephone traffic setting alarm, improves the accuracy of traffic abnormality detection.
Description
Technical field
The present invention relates to calling traffic administration fields, and in particular to arrives a kind of traffic method for detecting abnormality and its equipment.
Background technique
There are a large amount of real time telephone traffic data in call center daily, needs to be monitored these real time datas to guarantee to exhale
It is the normal operation of center service.Current monitor mode is using history threshold alarm, although solving to a certain extent
The problem of by artificial setting alarm regulation, but still have defect.
History threshold alarm can go out history threshold value by directly acquiring history traffic statistic, however, being only merely straight
Acquisition history telephone traffic is connect, does not account for influence of the accidentalia to data, the bursts of traffic amount as caused by accidentalia, not instead
True traffic rule is reflected, the accuracy of traffic forecast can be interfered.Such as when festivals or holidays, telephone traffic is often than on ordinary days
It is more higher, when carrying out history threshold test to festivals or holidays telephone traffic, the case where being frequently encountered more than history threshold value and touch
There is no too big variations for hair alarm, the actually trend of these telephone traffics, and belonging to is normal situation, and which results in a large amount of
Accidentally accuse.Such accidentally accuse produces negative impact to calling traffic administration.
Summary of the invention
In view of the above problems, improving traffic abnormality detection it is an object of the invention to overcome history threshold alarm defect
Accuracy.
According to the first aspect of the invention, a kind of traffic method for detecting abnormality is provided, comprising steps of S100 timing calculates
History traffic data is divided into multiple periods, the history traffic of each period by minimum cleaning granularity by historical trend threshold step
Data polymerize to obtain multiple first data points according to polymerization dimension, calculate the same period by Moving Unit of first movement window
The first movement average value of multiple first data points is averaged differential ratio according to first movement mean value calculation first movement, according to
First movement be averaged differential ratio calculate each period first cleaning reference value, removal first cleaning reference range outside first
Data point calculates the historical trend threshold value of this period according to the first data point after the cleaning of this period；The inspection of S101 history threshold value
Step is surveyed, whether the live traffice amount that detection current detection point obtains exceeds history threshold value；S102 real-time tendency detecting step, will
Traffic data before current detection point in first time period polymerize to obtain multiple second data points according to polymerization dimension, moves with second
Dynamic window is the second moving average that Moving Unit calculates multiple second data points, calculates second according to the second moving average
Rolling average differential ratio calculates the second cleaning reference value, removal the second cleaning reference value model according to the second rolling average differential ratio
The second outer data point is enclosed, the second rolling average differential ratio is recalculated according to the second data point after cleaning, according to counting again
The the second rolling average differential ratio calculated calculates real-time tendency threshold value, compares whether live traffice amount exceeds real-time tendency threshold value；
Whether S103 historical trend detecting step, detection live traffice amount exceed historical trend threshold value；S105 issues alarm step, currently
Telephone traffic exceeds history threshold value, when beyond real-time tendency threshold value and exceeding historical trend threshold value, issues warning information.
Preferably, S100 step includes: by ought the history traffic data of identical period is formed within the scope of a few days a few days ago the
One data point is integrated into a data set, and the first data point outside the first cleaning reference range, history are removed in data set
Trend threshold value is a regional scope, including historical trend upper limit value and historical trend lower limit value, historical trend upper limit value are
The maximum value of data set expands multiple multiplied by first, and historical trend lower limit value is that the minimum value of data set expands again multiplied by first
Number.
Preferably, in S100 step, the first cleaning reference value is a regional scope, including the first cleaning reference upper level value
And the first cleaning reference lower limit value, the first cleaning reference upper level value are equal to the be averaged mean value of differential ratio of multiple first movements and add
2 times of first movement is averaged differential ratio standard deviation, and the first cleaning reference lower limit value is equal to multiple first movements and is averaged differential ratio
The first movement that mean value subtracts 2 times is averaged differential ratio standard deviation.
Preferably, in S100 step, daily timing calculates historical trend threshold value, to update historical trend threshold value daily.
Preferably, in S102 step, the second cleaning reference value is a regional scope, including the second cleaning reference upper level value
And second cleaning reference lower limit value, second cleaning reference upper level value be equal to multiple second rolling average differential ratios mean value adds
2 times of the second rolling average differential ratio standard deviation, the second cleaning reference lower limit value are equal to multiple second rolling average differential ratios
Mean value subtracts 2 times of the second rolling average differential ratio standard deviation.
Preferably, in real-time tendency detecting step, before current detection point first time period be current detection point before 1 hour extremely
Any time length in 3 hours.
Preferably, in S102 step, real-time tendency threshold value is a regional scope, including real-time tendency upper limit value and reality
When trend lower limit value, real-time tendency upper limit value be equal to multiple the second rolling average differential ratios recalculated mean value add 3 times
The the second rolling average differential ratio standard deviation recalculated obtains and value, and value expands multiple, the second cleaning ginseng multiplied by second
The mean value that lower limit value is examined equal to multiple rolling average differential ratios recalculated subtracts 3 times of rolling average differential ratios recalculated
Standard deviation obtains difference, and difference expands multiple multiplied by second.
Preferably, S104 amendment detecting step is further comprised the steps of:, detection live traffice amount is relative to number before current detection point
Whether the traffic amount variation of the history traffic data of a test point exceeds telephone traffic change threshold, in issuing alarm step, when
Preceding telephone traffic exceeds history threshold value, beyond real-time tendency threshold value and exceeds historical trend threshold value, and live traffice amount changes
When beyond telephone traffic change threshold, warning information is issued.
According to the second aspect of the invention, a kind of traffic abnormality detecting apparatus is provided, comprising: timing calculates historical trend
Threshold module, for history traffic data to be divided into multiple periods, the history traffic data of each period by minimum cleaning granularity
It polymerize to obtain multiple first data points according to polymerization dimension, calculates the multiple of same period by Moving Unit of first movement window
The first movement average value of first data point is averaged differential ratio, according to first according to first movement mean value calculation first movement
Rolling average differential ratio calculates the first cleaning reference value of each period, the first data outside removal the first cleaning reference range
Point calculates the historical trend threshold value of this period according to the first data point after the cleaning of this period；History threshold detection module,
Whether the live traffice amount for detecting current detection point monitoring exceeds history threshold value；Real-time tendency detection module, for that will work as
Traffic data before preceding test point in first time period polymerize to obtain multiple second data points according to polymerization dimension, mobile with second
Window is the second moving average that Moving Unit calculates multiple second data points, calculates second according to the second moving average and moves
Dynamic average differential ratio calculates the second cleaning reference value, removal the second cleaning reference range according to the second rolling average differential ratio
The second outer data point recalculates the second rolling average differential ratio according to the second data point after cleaning, according to recalculating
The second rolling average differential ratio calculate real-time tendency threshold value, compare whether live traffice amount exceeds real-time tendency threshold value；History
Trend-monitoring module, for detecting whether live traffice amount exceeds historical trend threshold value；Alarm module is super for live traffice amount
History threshold value out issues warning information when beyond real-time tendency threshold value and exceeding historical trend threshold value.
Preferably, further includes: amendment detection module, for detecting live traffice amount relative to inspections several before current detection point
Whether the traffic amount variation of the history traffic data of measuring point exceeds telephone traffic change threshold, and live traffice amount exceeds history threshold value,
Beyond real-time tendency threshold value and exceed historical trend threshold value, and when the variation of live traffice amount is beyond telephone traffic change threshold,
Alarm module issues warning information.
According to the third aspect of the present invention, a kind of computer readable storage medium is provided, computer journey is stored thereon with
The step of sequence, which realizes the traffic method for detecting abnormality of above-mentioned first aspect when being executed by processor.
According to the fourth aspect of the present invention, a kind of electronic equipment is provided, comprising: processor；And
Memory, the executable instruction for storage processor；Wherein, processor is configured to via execution executable instruction
The step of traffic method for detecting abnormality to execute above-mentioned first aspect.
The present invention is added real-time tendency detection and historical trend detection, overcomes on the basis of history threshold test
Directly the defects of acquisition history telephone traffic setting alarm, improves the accuracy of traffic abnormality detection.
Detailed description of the invention
Technical solution of the present invention is described in detail below in conjunction with the drawings and specific embodiments, so that of the invention
Characteristics and advantages become apparent.
Fig. 1 is the flow diagram of the traffic method for detecting abnormality of the embodiment of the present invention；
Fig. 2 is the detailed process schematic diagram of step S100 in Fig. 1；
Fig. 3 is the detailed process schematic diagram of step S102 in Fig. 1；
Fig. 4 is the module diagram of the traffic abnormality detecting apparatus of the embodiment of the present invention；
Fig. 5 is the module diagram of the electronic equipment of the embodiment of the present invention.
Specific embodiment
Detailed description will be provided to the embodiment of the present invention below.Although the present invention will combine some specific embodiments
It is illustrated and illustrates, but should be noted that the present invention is not merely confined to these embodiments.On the contrary, to the present invention
The modification or equivalent replacement of progress, are intended to be within the scope of the claims of the invention.
Some exemplary embodiments are described as the processing or method described as flow chart.Although flow chart grasps items
It is described into the processing of sequence, but many of these operations can be implemented concurrently, concomitantly or simultaneously.In addition, each
The sequence of item operation can be rearranged.The processing can be terminated when its operations are completed, it is also possible to have not
Including additional step in the accompanying drawings.The processing can correspond to method, function, regulation, subroutine, subprogram etc..
Fig. 1 is the flow diagram of the traffic method for detecting abnormality of the embodiment of the present invention, as shown in Figure 1, if the present invention
Be engaged in method for detecting abnormality comprising steps of
S100: timing calculates historical trend threshold value, cleans history traffic data, and according to the history traffic data after cleaning
Periodically calculate historical trend threshold value.
S101: whether history threshold test, the live traffice amount that detection current detection point obtains exceed history threshold value.
S102: real-time tendency detection becomes in real time according to the history traffic data calculating of first time period before current detection point
Whether gesture threshold value, detection live traffice amount exceed real-time tendency threshold value.
S103: whether historical trend detection, detection live traffice amount exceed historical trend threshold value.
S104: amendment detection detects history traffic number of the live traffice amount relative to test points several before current detection point
According to traffic amount variation whether exceed telephone traffic change threshold.
S105: issuing alarm, and live traffice amount exceeds history threshold value, beyond real-time tendency threshold value and exceeds historical trend
Threshold value, and when the variation of live traffice amount is beyond telephone traffic change threshold, issue warning information.
Step S100 is first carried out, cleans history traffic data, and periodically calculate according to the history traffic data after cleaning
Historical trend threshold value.The present embodiment is preferably as unit of day, and daily timing calculates historical trend threshold value, with more new historical daily
Trend threshold value improves the accuracy of traffic abnormality detection to ensure that historical trend threshold value has timeliness.
Fig. 2 is the detailed process schematic diagram of step S100 in Fig. 1, as shown in Fig. 2, will go through such as step S1001 division step
History traffic data is divided into multiple periods by minimum cleaning granularity.The history traffic data of each period is calculated according to polymerization dimension
Multiple first data point a.For example, taking minimum cleaning granularity is 10 minutes, taking polymerization dimension is 1 minute, then by history on the 1st
Traffic data was divided into 144 periods by 10 minutes for one section.In each period using the sum of every 1 minute history traffic data as
One the first data point a, to obtain 10 the first data point a.It should be noted that minimum cleaning granularity and polymerization dimension
It can be set as needed, such as polymerization dimension is 3 minutes, minimum cleaning granularity is to be within 30 minutes, or polymerization dimension is 5 points
Clock, minimum cleaning granularity is 1 hour.
Such as the first cleaning step of step S1002, the first cleaning reference value of the history traffic data of each period is calculated, is gone
The first data point a in addition to the first cleaning reference range.
Specifically, the multiple first data point a of same period are calculated using first movement window as Moving Unit first
Moving average, to obtain multiple moving average b.In the present embodiment, first movement window is preferably 3 to 5.Such as
Taking first movement window is 5, is that continuous 5 the first data points are chosen in starting, and calculate 5 first with current first data point a
The average value of data point is as 1 first movement average value b.It then is that starting chooses continuous 5 with the latter the first data point a
First data point, and the average value of 5 the first data points is calculated, to obtain 1 first movement average value b again.According to
Upper type successively calculates the first data point a all in the same period.The quantity of first movement average value b is the first data point a
Quantity subtract after first movement window plus 1.
Then, it according to first movement average value b, calculates first movement and is averaged differential ratio c.First movement is averaged differential ratio c
Meet following formula:
C=(b2-b1)/b1, wherein b1, b2 are continuous two first movement average value.
The first data point of the history traffic data formation of identical period it will ought be integrated into a number within the scope of a few days a few days ago
According to collection, the first cleaning reference value is calculated according to the first movement of the first data point in the same data set differential ratio that is averaged.This reality
It applies in example, the first cleaning reference value is under a regional scope, including the first cleaning reference upper level value and the first cleaning reference
Limit value.First cleaning reference upper level value be equal to multiple first movements be averaged differential ratio mean value plus 2 times first movement be averaged
Differential ratio standard deviation.First cleaning reference lower limit value be equal to multiple first movements be averaged differential ratio mean value subtract 2 times first
Rolling average differential ratio standard deviation.
According to the first of each period the cleaning reference value, when removing this outside the first cleaning reference range in data set
First data point of section.
If step S1003 calculates historical trend threshold step, according to the first data after the cleaning obtained in step S1002
The data set of point, calculates the historical trend threshold value of each period.The historical trend threshold value of each period is a regional scope,
Including historical trend upper limit value and historical trend lower limit value.Historical trend upper limit value be the period data collection maximum value multiplied by
First expands multiple, and historical trend lower limit value is that the minimum value of the period data collection expands multiple multiplied by first.
It continues to refer to figure 1, such as step S101, whether the live traffice amount for detecting current detection point monitoring exceeds history threshold
Value.History threshold value uses existing calculation, general to be obtained by directly acquisition history traffic data statistical, such as takes one section
The mean value of history traffic data in time.
In the present embodiment, when detection live traffice amount is without departing from history threshold value, shield alarm.When detection live traffice amount
Beyond history threshold value, then subsequent step S102 is continued to execute.
Fig. 3 is the detailed process schematic diagram of step S102 in Fig. 1.As shown in figure 3, first as step S1021 second is cleaned
Step calculates the second cleaning reference value of the traffic data before current detection point in first time period, removal the second cleaning reference
Second data point of first time period before current detection point outside value range.Preferably, first time period is before current detection point
Any time length before current detection point in 1 hour to 3 hours selects first time period too short or too long, all can not be accurate
Reflect the real-time tendency of telephone traffic.
Traffic data before acquisition current detection point in first time period, and the rolling average for calculating above-mentioned traffic data is poor
Divide rate.The method for calculating rolling average differential ratio is similar with the method for rolling average differential ratio is calculated in above-mentioned steps S100.
Specifically, the traffic data aggregate in first time period before current detection point is obtained more according to polymerization dimension
A second data point e calculates the moving average of multiple second data point e using the second moving window as Moving Unit, thus
To multiple second moving average f.In the present embodiment, in the present embodiment, the second moving window is preferably 3 to 5.Such as
Taking the second moving window is 5, is that continuous 5 the second data point e calculating average value is chosen in starting with current second data point e, from
And 1 the second moving average f is obtained, successively calculate the second all data points.
Then, according to the second moving average f, the second rolling average differential ratio g is calculated.Second rolling average differential ratio g
Meet following formula:
G=(f2-f1)/f1, wherein f1, f2 are continuous two the second moving averages.
The second cleaning reference value is calculated according to the second rolling average differential ratio g.Second cleaning reference value is a region model
It encloses, including the second cleaning reference upper level value and the second cleaning reference lower limit value.Second cleaning reference upper level value is equal to multiple the
The mean value of two rolling average differential ratios adds 2 times of the second rolling average differential ratio standard deviation.Second cleaning reference lower limit value etc.
2 times of the second rolling average differential ratio standard deviation is subtracted in the mean value of multiple second rolling average differential ratios.
The second data point before current detection point outside removal the second cleaning reference range in first time period.
Then, it executes S1022 and calculates real-time tendency threshold step, according to first time period before the current detection point after cleaning
Second rolling average differential ratio of the second interior data point calculates real-time tendency threshold value.Specifically, with the current inspection after cleaning
The second data point before measuring point in first time period is data computer capacity, recalculates the second moving average, and according to weight
The second moving average newly calculated recalculates the second rolling average differential ratio, specifically recalculates the second rolling average difference
Calculate that the method for the second rolling average differential ratio is identical, and details are not described herein again in the method for rate and above-mentioned steps S1021.Become in real time
Gesture threshold value is a regional scope, including real-time tendency upper limit value and real-time tendency lower limit value.Real-time tendency upper limit value is equal to
The mean value of multiple the second rolling average differential ratios recalculated adds 3 times of second rolling average differential ratio standards recalculated
Difference obtains and value, and above-mentioned and value expands multiple multiplied by second.Second cleaning reference lower limit value is equal to multiple shiftings recalculated
The mean value of dynamic average differential ratio subtracts 3 times of rolling average differential ratio standard deviations recalculated and obtains differences, above-mentioned difference multiplied by
Expand multiple with second.
S1023 threshold value comparison step, compares whether live traffice amount exceeds real-time tendency threshold value.In the present embodiment, when
Live traffice amount is detected without departing from real-time tendency threshold value, shield alarm.Exceed real-time tendency threshold value when detecting live traffice amount, then
Continue to execute subsequent step S103.
Step S103 is historical trend detection, and whether detection live traffice amount exceeds historical trend threshold value.Specifically, will
The historical trend threshold value obtained in live traffice amount and step S100 is compared.When determining corresponding to current detection point first
Live traffice amount, is then compared by section with the historical trend threshold value of corresponding period.In the present embodiment, when the current words of detection
Historical trend threshold value of the business amount without departing from the corresponding period, shield alarm.When detection live traffice amount exceeds the history of corresponding period
Trend threshold value then continues to execute subsequent step S104.
Step S104 is amendment detection, and detection live traffice amount is talked about relative to the history of test points several before current detection point
Whether the traffic amount variation for data of being engaged in exceeds telephone traffic change threshold.The traffic amount variation of history traffic data passes through transformation magnitude
And interconversion rate embodies.The average value of the history traffic data of several test points, compares live traffice before calculating current detection point
The variation magnitude of the average value of amount and the history traffic data of preceding several test points, if variation magnitude is less than preset threshold,
Such as 10, then shield alarm.Compare the change rate of the average value of the history traffic data of live traffice amount and preceding several test points,
If being less than preset threshold, such as 30%, then shield alarm.
When the variation magnitude and change rate of live traffice amount exceed respective preset threshold, thens follow the steps S105 and issue announcement
It is alert.That is, in the present embodiment, alarm, which is issued, needs live traffice amount beyond history threshold value, beyond real-time tendency threshold value and
Beyond historical trend threshold value, and the variation of live traffice amount meets simultaneously beyond telephone traffic change threshold.
In other embodiments, it also can be omitted S104 amendment detecting step, however correcting detecting step can be further
Improve the accuracy and real-time of alarm.
The execution sequence of the step S100 to step S104 of traffic method for detecting abnormality of the invention is not limited to above-mentioned reality
The mode introduced in example is applied, history threshold test, real-time tendency detection, historical trend is detected can hold simultaneously with amendment detection
Row, can also be executed with random order.Timing calculates historical trend threshold step and need to only execute before historical trend detection
Can, it is also not limited to execute sequence in the present embodiment.
Traffic data before the analysis and current detection point of comprehensive history traffic data in first time period, generation are gone through
History trend threshold value and real-time tendency threshold value overcome the defects of single history threshold alarm, improve accuracy.Further plus
Enter amendment monitoring, so that deeper time improves the accuracy and real-time of alarm.
It the step of by above a few re-detections, farthest ensure that the accuracy of alarm, reduce the case where accidentally accusing.
The business datum that the present invention is suitable for all incoming call exhalation amounts in call center monitors, and substantially increases accuracy rate.
The present invention has good expansion, for a certain new business monitoring data, only needs certain historical data amount
Traffic method for detecting abnormality of the invention can be applied, auto-alarming detection is carried out.
The present invention also provides a kind of traffic abnormality detecting apparatus.Fig. 4 is that the traffic abnormality detection of the embodiment of the present invention is set
Standby module diagram.As shown in figure 4, traffic abnormality detecting apparatus 10 includes that timing calculates historical trend threshold module 11, go through
History threshold detection module 12, real-time tendency detection module 13, historical trend detection module 14 and alarm module 15.Timing calculates
Historical trend threshold module 11 is used to history traffic data being divided into multiple periods, the history of each period by minimum cleaning granularity
Traffic data polymerize to obtain multiple first data points according to polymerization dimension, calculates by Moving Unit of first movement window with for the moment
The first movement average value of multiple first data points of section is averaged differential ratio according to first movement mean value calculation first movement,
According to first movement be averaged differential ratio calculate each period first cleaning reference value, removal first cleaning reference range outside
First data point calculates the historical trend threshold value of this period according to the first data point after the cleaning of this period.The inspection of history threshold value
Module 12 is surveyed to be used to detect whether the live traffice amount that current detection point monitors exceeds history threshold value.Real-time tendency detection module 13
For the traffic data in first time period before current detection point to be polymerize to obtain multiple second data points according to polymerization dimension, with
Second moving window is the second moving average that Moving Unit calculates multiple second data points, according to the second moving average meter
The second rolling average differential ratio is calculated, the second cleaning reference value, removal the second cleaning ginseng are calculated according to the second rolling average differential ratio
The second data point outside value range is examined, the second rolling average differential ratio is recalculated according to the second data point after cleaning, according to
The the second rolling average differential ratio recalculated calculates real-time tendency threshold value, compares whether live traffice amount exceeds real-time tendency threshold
Value.Historical trend detection module 14 is for detecting whether live traffice amount exceeds historical trend threshold value.Alarm module 15 is for working as
Preceding telephone traffic exceeds history threshold value, when beyond real-time tendency threshold value and exceeding historical trend threshold value, issues warning information.
The modules of traffic abnormality detecting apparatus 10 execute the step of above-mentioned this law bright traffic method for detecting abnormality, tool
Body step is as described in above-mentioned traffic method for detecting abnormality, and details are not described herein again.
In exemplary embodiment disclosed by the invention, a kind of computer readable storage medium is additionally provided, is stored thereon
There is computer program, which may be implemented the exception of traffic described in any one above-mentioned embodiment when being executed by such as processor
The step of detection method.In some possible embodiments, various aspects of the invention are also implemented as a kind of program production
The form of product comprising program code, when described program product is run on the terminal device, said program code is for making institute
It states terminal device and executes described in this specification above-mentioned traffic method for detecting abnormality part various exemplary realities according to the present invention
The step of applying mode.
The program product for realizing the above method of embodiment according to the present invention can use Portable, compact
Disk read-only memory (CD-ROM) and including program code, and can be run on terminal device, such as PC.However,
Program product of the invention is without being limited thereto, and in this document, readable storage medium storing program for executing, which can be, any includes or storage program has
Shape medium, the program can be commanded execution system, device or device use or in connection.
Described program product can be using any combination of one or more readable mediums.Readable medium can be readable letter
Number medium or readable storage medium storing program for executing.Readable storage medium storing program for executing for example can be but be not limited to electricity, magnetic, optical, electromagnetic, infrared ray or
System, device or the device of semiconductor, or any above combination.The more specific example of readable storage medium storing program for executing is (non exhaustive
List) include: electrical connection with one or more conducting wires, portable disc, hard disk, random access memory (RAM), read-only
Memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disc read only memory
(CD-ROM), light storage device, magnetic memory device or above-mentioned any appropriate combination.
The computer readable storage medium may include in a base band or the data as the propagation of carrier wave a part are believed
Number, wherein carrying readable program code.The data-signal of this propagation can take various forms, including but not limited to electromagnetism
Signal, optical signal or above-mentioned any appropriate combination.Readable storage medium storing program for executing can also be any other than readable storage medium storing program for executing
Readable medium, the readable medium can send, propagate or transmit for by instruction execution system, device or device use or
Person's program in connection.The program code for including on readable storage medium storing program for executing can transmit with any suitable medium, packet
Include but be not limited to wireless, wired, optical cable, RF etc. or above-mentioned any appropriate combination.
The program for executing operation of the present invention can be write with any combination of one or more programming languages
Code, described program design language include object oriented program language-Java, C++ etc., further include conventional
Procedural programming language-such as " C " language or similar programming language.Program code can be fully in user
It calculates and executes in equipment, partly executes on a user device, being executed as an independent software package, partially in user's calculating
Upper side point is executed on a remote computing or is executed in remote computing device or server completely.It is being related to far
Journey calculates in the situation of equipment, and remote computing device can pass through the network of any kind, including local area network (LAN) or wide area network
(WAN), it is connected to user calculating equipment, or, it may be connected to external computing device (such as utilize ISP
To be connected by internet).
In an exemplary embodiment of the disclosure, a kind of electronic equipment is also provided, which may include processor,
And the memory of the executable instruction for storing the processor.Wherein, the processor is configured to via described in execution
Executable instruction is come the step of executing traffic method for detecting abnormality described in any one above-mentioned embodiment.
Person of ordinary skill in the field it is understood that various aspects of the invention can be implemented as system, method or
Program product.Therefore, various aspects of the invention can be embodied in the following forms, it may be assumed that complete hardware embodiment, complete
The embodiment combined in terms of full Software Implementation (including firmware, microcode etc.) or hardware and software, can unite here
Referred to as circuit, " module " or " system ".
The electronic equipment 20 of this embodiment according to the present invention is described referring to Fig. 5.The electronics that Fig. 5 is shown is set
Standby 20 be only an example, should not function to the embodiment of the present invention and use scope bring any restrictions.
As shown in figure 5, electronic equipment 20 is showed in the form of universal computing device.The component of electronic equipment 20 may include
But it is not limited to: at least one processing unit 21, at least one storage unit 22.
Wherein, the storage unit 22 is stored with program code, and said program code can be held by the processing unit 21
Row, so that each according to the present invention described in the execution of the processing unit 21 this specification above-mentioned traffic method for detecting abnormality part
The step of kind illustrative embodiments.For example, the processing unit 21 can execute step as shown in fig. 1.
The storage unit 22 may include the readable medium of volatile memory cell form, such as random access memory list
First (RAM) and/or cache memory unit, can further include read-only memory unit (ROM).
The storage unit 22 can also include program/utility with one group of (at least one) program module, this
The program module of sample includes but is not limited to: operating system, one or more application program, other program modules and program number
According to the realization that may include network environment in, each of these examples or certain combination.
Electronic equipment 20 can also be logical with one or more external equipments (such as keyboard, sensing equipment, bluetooth equipment etc.)
Letter, can also be enabled a user to one or more equipment interact with the electronic equipment 20 communicate, and/or with make the electronics
Any equipment (such as router, modem etc.) that equipment 20 can be communicated with one or more of the other calculating equipment
Communication.This communication can be carried out by input/output (I/O) interface.Also, electronic equipment 20 can also pass through Network adaptation
Device and one or more network (such as local area network (LAN), wide area network (WAN) and/or public network, such as internet) logical
Letter.Network adapter can be communicated by bus with other modules of electronic equipment 20.It should be understood that although not shown in the drawings,
Other hardware and/or software module can be used in conjunction with electronic equipment 20, including but not limited to: microcode, device driver, superfluous
Remaining processing unit, external disk drive array, RAID system, tape drive and data backup storage system etc..
Through the above description of the embodiments, those skilled in the art is it can be readily appreciated that example described herein is implemented
Mode can also be realized by software realization in such a way that software is in conjunction with necessary hardware.Therefore, according to the disclosure
The technical solution of embodiment can be embodied in the form of software products, which can store non-volatile at one
Property storage medium (can be CD-ROM, USB flash disk, mobile hard disk etc.) in or network on, including some instructions are so that a calculating
Equipment (can be personal computer, server or network equipment etc.) executes the above-mentioned traffic according to disclosure embodiment
Method for detecting abnormality.
The above is only specific application examples of the invention, are not limited in any way to protection scope of the present invention.Except above-mentioned
Outside embodiment, the present invention can also have other embodiment.All technical solutions formed using equivalent substitution or equivalent transformation,
It falls within scope of the present invention.
Claims (12)
1. a kind of traffic method for detecting abnormality, it is characterised in that comprising steps of
S100 timing calculates historical trend threshold step, history traffic data is divided into multiple periods by minimum cleaning granularity, often
The history traffic data of a period polymerize to obtain multiple first data points according to polymerization dimension, is mobile single with first movement window
Position calculates the first movement average value of multiple first data points of same period, according to the first movement mean value calculation first
Rolling average differential ratio, according to the first movement be averaged differential ratio calculate each period first cleaning reference value, remove institute
First data point outside the first cleaning reference range is stated, according to first data point after the cleaning of this period, meter
Calculate the historical trend threshold value of this period；
Whether S101 history threshold detection step, the live traffice amount that detection current detection point obtains exceed history threshold value；
S102 real-time tendency detecting step, by the traffic data in first time period before current detection point according to polymerization dimension polymerization
Multiple second data points are obtained, the second rolling average of multiple second data points is calculated using the second moving window as Moving Unit
Value calculates the second rolling average differential ratio according to second moving average, according to the second rolling average differential ratio meter
The second cleaning reference value is calculated, second data point outside the second cleaning reference range is removed, according to the after cleaning
Two data points recalculate the second rolling average differential ratio, are become in real time according to the second rolling average differential ratio calculating recalculated
Gesture threshold value, compares whether live traffice amount exceeds the real-time tendency threshold value；
Whether S103 historical trend detecting step, detection live traffice amount exceed the historical trend threshold value；
S105 issues alarm step, and live traffice amount exceeds the history threshold value, beyond the real-time tendency threshold value and exceeds
When the historical trend threshold value, warning information is issued；
The rolling average differential ratio is that the latter moving average and previous movement in continuous two moving averages are put down
The difference of mean value divided by previous moving average ratio.
2. traffic method for detecting abnormality as described in claim 1, it is characterised in that the S100 step includes:
The first data point of the history traffic data formation of identical period it will ought be integrated into a data set within the scope of a few days a few days ago,
First data point outside the first cleaning reference range is removed in data set, the historical trend threshold value is one
Regional scope, including historical trend upper limit value and historical trend lower limit value, the historical trend upper limit value are the institute after cleaning
The maximum value for stating data set expands multiple multiplied by first, and the historical trend lower limit value is the minimum of the data set after cleaning
Value expands multiple multiplied by first.
3. traffic method for detecting abnormality as described in claim 1, it is characterised in that in the S100 step, first cleaning
Reference value is a regional scope, including the first cleaning reference upper level value and the first cleaning reference lower limit value, and described first is clear
Reference upper level value is washed to add 2 times of first movement equal to the be averaged mean value of differential ratio of multiple first movements and be averaged differential ratio standard
Difference, it is described first cleaning reference lower limit value be equal to multiple first movements be averaged differential ratio mean value subtract 2 times first movement put down
Equal differential ratio standard deviation.
4. traffic method for detecting abnormality as described in claim 1, it is characterised in that in the S100 step, daily timing is calculated
Historical trend threshold value, to update the historical trend threshold value daily.
5. traffic method for detecting abnormality as described in claim 1, it is characterised in that in the S102 step, second cleaning
Reference value is a regional scope, including the second cleaning reference upper level value and the second cleaning reference lower limit value, and described second is clear
Wash the second rolling average differential ratio standard that reference upper level value adds 2 times equal to the mean value of multiple second rolling average differential ratios
Difference, the second movement that the mean value that the second cleaning reference lower limit value is equal to multiple second rolling average differential ratios subtracts 2 times are flat
Equal differential ratio standard deviation.
6. traffic method for detecting abnormality as described in claim 1, it is characterised in that described in the real-time tendency detecting step
First time period is any time length before current detection point in 1 hour to 3 hours before current detection point.
7. traffic method for detecting abnormality as described in claim 1, it is characterised in that in the S102 step, the real-time tendency
Threshold value is a regional scope, including real-time tendency upper limit value and real-time tendency lower limit value, described real-time tendency upper limit value etc.
3 times of second rolling average differential ratio marks recalculated are added in the mean value of multiple the second rolling average differential ratios recalculated
Quasi- difference obtains and is worth, and described and value expands multiple multiplied by second, and the second cleaning reference lower limit value is counted again equal to multiple
It is poor that the mean value for the second rolling average differential ratio calculated subtracts 3 times of the second rolling average differential ratio standard deviations recalculated acquisitions
Value, the difference expand multiple multiplied by second.
8. traffic method for detecting abnormality as described in claim 1, it is characterised in that further comprise the steps of:
S104 corrects detecting step, detects history traffic data of the live traffice amount relative to test points several before current detection point
Traffic amount variation whether exceed telephone traffic change threshold,
In the sending alarm step, live traffice amount exceeds the history threshold value, beyond the real-time tendency threshold value and
Beyond the historical trend threshold value, and when the variation of live traffice amount is beyond the telephone traffic change threshold, warning information is issued.
9. a kind of traffic abnormality detecting apparatus, characterized by comprising:
Timing calculates historical trend threshold module, for history traffic data to be divided into multiple periods by minimum cleaning granularity, often
The history traffic data of a period polymerize to obtain multiple first data points according to polymerization dimension, is mobile single with first movement window
Position calculates the first movement average value of multiple first data points of same period, according to the first movement mean value calculation first
Rolling average differential ratio, according to the first movement be averaged differential ratio calculate each period first cleaning reference value, remove institute
First data point outside the first cleaning reference range is stated, according to first data point after the cleaning of this period, meter
Calculate the historical trend threshold value of this period；
Whether history threshold detection module, the live traffice amount for detecting current detection point monitoring exceed history threshold value；
Real-time tendency detection module, for the traffic data in first time period before current detection point to polymerize according to polymerization dimension
Multiple second data points are obtained, the second rolling average of multiple second data points is calculated using the second moving window as Moving Unit
Value calculates the second rolling average differential ratio according to second moving average, according to the second rolling average differential ratio meter
The second cleaning reference value is calculated, second data point outside the second cleaning reference range is removed, according to the after cleaning
Two data points recalculate the second rolling average differential ratio, are become in real time according to the second rolling average differential ratio calculating recalculated
Gesture threshold value, compares whether live traffice amount exceeds the real-time tendency threshold value；
Historical trend detection module, for detecting whether live traffice amount exceeds the historical trend threshold value；
Alarm module exceeds the history threshold value for live traffice amount, beyond the real-time tendency threshold value and beyond described
When historical trend threshold value, warning information is issued；
The rolling average differential ratio is that the latter moving average and previous movement in continuous two moving averages are put down
The difference of mean value divided by previous moving average ratio.
10. traffic abnormality detecting apparatus as claimed in claim 9, it is characterised in that further include:
Detection module is corrected, for detecting history traffic data of the live traffice amount relative to test points several before current detection point
Traffic amount variation whether exceed telephone traffic change threshold,
Live traffice amount exceeds the history threshold value, beyond the real-time tendency threshold value and exceeds the historical trend threshold value,
And when the variation of live traffice amount is beyond the telephone traffic change threshold, the alarm module issues warning information.
11. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the program is by processor
The step of traffic method for detecting abnormality described in any one of claims 1 to 8 is realized when execution.
12. a kind of electronic equipment characterized by comprising
Processor；And
Memory, for storing the executable instruction of the processor；
Wherein, the processor is configured to come described in any one of perform claim requirement 1 to 8 via the execution executable instruction
The step of traffic method for detecting abnormality.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710698916.2A CN107566665B (en) | 2017-08-15 | 2017-08-15 | Traffic method for detecting abnormality and its equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710698916.2A CN107566665B (en) | 2017-08-15 | 2017-08-15 | Traffic method for detecting abnormality and its equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107566665A CN107566665A (en) | 2018-01-09 |
| CN107566665B true CN107566665B (en) | 2019-09-24 |
Family
ID=60974476
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710698916.2A Active CN107566665B (en) | 2017-08-15 | 2017-08-15 | Traffic method for detecting abnormality and its equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107566665B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108132867B (en) * | 2018-01-11 | 2021-05-25 | 合肥科博软件技术有限公司 | Equipment fault alarm method and computing equipment |
| CN108377201B (en) * | 2018-02-09 | 2021-03-26 | 腾讯科技（深圳）有限公司 | Network anomaly sensing method, device, equipment and computer readable storage medium |
| CN108775914B (en) * | 2018-05-07 | 2020-09-22 | 青岛海信网络科技股份有限公司 | Traffic equipment detection method and detection equipment |
| CN108664603B (en) * | 2018-05-09 | 2022-06-03 | 北京奇艺世纪科技有限公司 | Method and device for repairing abnormal aggregation value of time sequence data |
| CN109377059A (en) * | 2018-10-27 | 2019-02-22 | 平安医疗健康管理股份有限公司 | A kind of data processing method and equipment based on risk management and control |
| CN109614291A (en) * | 2018-12-11 | 2019-04-12 | 上海连尚网络科技有限公司 | Alarm method and device |
| CN110309153B (en) * | 2019-06-28 | 2023-07-14 | 携程旅游信息技术（上海）有限公司 | Method, system, equipment and storage medium for processing monitoring data of call center |
| CN112445832B (en) * | 2019-08-28 | 2024-02-23 | 北京达佳互联信息技术有限公司 | Data anomaly detection method and device, electronic equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| FR2822010A1 (en) * | 2001-03-07 | 2002-09-13 | France Telecom | Telephone traffic analysis/telephone service analysis having switching network with surveilling mechanism delivering digital words/decoded/traffic analysis selected/crossing interface. |
| CN101764893A (en) * | 2009-10-12 | 2010-06-30 | 南京联创科技集团股份有限公司 | Communication traffic fluctuation monitoring method based on data intermediate layer |
| CN105162994A (en) * | 2015-09-24 | 2015-12-16 | 携程计算机技术（上海）有限公司 | Method and system for detecting traffic fault of call center and server |
| CN106357939A (en) * | 2016-09-30 | 2017-01-25 | 携程旅游信息技术（上海）有限公司 | Call traffic monitoring method and monitoring system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101332814B1 (en) * | 2011-08-24 | 2013-12-02 | 주식회사 팬택 | Apparatus and Method for Controlling Polling |
-
2017
- 2017-08-15 CN CN201710698916.2A patent/CN107566665B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| FR2822010A1 (en) * | 2001-03-07 | 2002-09-13 | France Telecom | Telephone traffic analysis/telephone service analysis having switching network with surveilling mechanism delivering digital words/decoded/traffic analysis selected/crossing interface. |
| CN101764893A (en) * | 2009-10-12 | 2010-06-30 | 南京联创科技集团股份有限公司 | Communication traffic fluctuation monitoring method based on data intermediate layer |
| CN105162994A (en) * | 2015-09-24 | 2015-12-16 | 携程计算机技术（上海）有限公司 | Method and system for detecting traffic fault of call center and server |
| CN106357939A (en) * | 2016-09-30 | 2017-01-25 | 携程旅游信息技术（上海）有限公司 | Call traffic monitoring method and monitoring system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107566665A (en) | 2018-01-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107566665B (en) | Traffic method for detecting abnormality and its equipment | |
| CN111143102B (en) | Abnormal data detection method and device, storage medium and electronic equipment | |
| CN109242135B (en) | Model operation method, device and business server | |
| CN111785392B (en) | Population quantity early warning method and device, electronic equipment and computer readable medium | |
| CN108563548A (en) | Method for detecting abnormality and device | |
| CN107766533A (en) | Telephone traffic abnormal automatic testing method and system, storage medium, electronic equipment | |
| CN109977552B (en) | Equipment residual life prediction method and system considering state detection influence | |
| CN108696368B (en) | Network element health state detection method and equipment | |
| JP5827426B1 (en) | Predictive diagnosis system and predictive diagnosis method | |
| JP5827425B1 (en) | Predictive diagnosis system and predictive diagnosis method | |
| CN107231493B (en) | Automatic alarm method and its device, storage medium, the electronic equipment of call center | |
| CN106443164B (en) | The monitoring method of transient state and stable state event in a kind of electric energy classification metering process | |
| CN112395120A (en) | Abnormal point detection method, device, equipment and storage medium | |
| CN107331129B (en) | A kind of loss judgment method and device based on motion sensor | |
| CN114301803A (en) | Network quality detection method and device, electronic equipment and storage medium | |
| CN109063947A (en) | A kind of abnormality recognition method of time series, device and service server | |
| CN109490612A (en) | A kind of exchange measuring method that frequency is adaptive and system | |
| CN117129897A (en) | Method, system, storage medium and terminal for scoring health states in battery module/battery cluster | |
| CN116720983A (en) | Power supply equipment abnormality detection method and system based on big data analysis | |
| CN115758071A (en) | Clock error prediction method, device, equipment and storage medium of atomic clock | |
| CN114867050A (en) | Vehicle flow detection method, device, system, equipment and storage medium | |
| CN110764975A (en) | Early warning method and device for equipment performance and monitoring equipment | |
| CN114692987A (en) | Time sequence data analysis method, device, equipment and storage medium | |
| CN112418534B (en) | Method and device for predicting quantity of collected parts, electronic equipment and computer readable storage medium | |
| CN115145902A (en) | Data processing method, data processing apparatus, storage medium, and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |