CN107871190A

CN107871190A - A kind of operational indicator monitoring method and device

Info

Publication number: CN107871190A
Application number: CN201610849587.2A
Authority: CN
Inventors: 马小鹏; 马涛; 李金辉
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Group Holding Ltd
Priority date: 2016-09-23
Filing date: 2016-09-23
Publication date: 2018-04-03
Anticipated expiration: 2036-09-23
Also published as: CN107871190B

Abstract

This application discloses a kind of operational indicator monitoring method and device, can be by the way of the history for treating monitoring business index monitors sample data progress statistical analysis, the bound threshold value of the data to be monitored of automatic Prediction operational indicator to be monitored, and the bound threshold value obtained based on prediction, determine whether data to be monitored are abnormal data；Or the abnormal data in the time series data to be monitored of operational indicator to be monitored can be identified by the way of detection of change-point.Fixed same ring is set than threshold value due to manual type need not be relied on, the generation for situations such as therefore, it is possible on the basis of monitoring cost is reduced, expand monitoring range, avoiding reporting by mistake, failing to report, improves the sensitivity and accuracy of operational indicator monitoring.

Description

A kind of operational indicator monitoring method and device

Technical field

The application is related to operational indicator monitoring technology field, more particularly to a kind of operational indicator monitoring method and device.

Background technology

For all kinds of business such as Internet advertising business, in order to ensure that it being capable of normal operation, it is often necessary to it Carry out the real-time of operational indicator or timing monitors.

Specifically, at present industry frequently with each operational indicator of human configuration same ring than threshold value mode (that is, by O＆M people Member is using manual type configuration service monitored item, and configure fixed same ring to each monitor control index of each business monitoring item one by one Than threshold value), each operational indicator is monitored, when the year-on-year and ring ratio amplitude of variation static threshold more than corresponding to simultaneously, then Abnormity point is considered, so as to cause there may be problems with：

Problem one：Because business monitoring item, operational indicator species are various, and, multiple tools may be present in each business monitoring item The monitoring period of standby different characteristic, a business monitoring item is caused to usually require 10~20 threshold values of configuration so that threshold value configures Process complexity it is cumbersome, monitoring cost is high.

Problem two：When Added Business monitored item, if without notifying operation maintenance personnel, Added Business monitored item in time Each operational indicator by monitoring blind area state, cause it is possible that monitoring careless mistake.

Problem three：Due to being that detected value contrasted with the last week same time on year-on-year basis, ring ratio is detected value and yesterday same time Contrast, and, the traffic characteristic of festivals or holidays at weekend etc. differs greatly with other dates, so for manually setting with ring than threshold value For monitor mode, because of situations such as easily occurring failing to report, reporting by mistake, such as often occur in festivals or holidays and alternate date on working day Report by mistake or fail to report.

That is, existing operational indicator monitor mode asking of having that accuracy is relatively low and monitoring cost is higher etc. Topic, therefore, need badly and provide a kind of new operational indicator monitoring method to solve the above problems.

The content of the invention

The embodiment of the present application provides a kind of operational indicator monitoring method and device, to solve existing operational indicator prison The problem of accuracy present in prosecutor formula is relatively low and monitoring cost is higher etc..

On the one hand, the embodiment of the present application provides a kind of operational indicator monitoring method, including：

Obtain the data to be monitored of operational indicator to be monitored；

For each data to be monitored got, according to setting, corresponding with the data to be monitored upper limit threshold And lower threshold, judge whether the data to be monitored meet following condition：The value of the data to be monitored is not less than corresponding Upper limit threshold or not higher than corresponding lower threshold；

If the determination result is YES, it is determined that the data to be monitored are candidate's abnormal data；

Wherein, the upper limit threshold corresponding with the data to be monitored and lower threshold are by referring to the business to be monitored It is marked on the history monitoring sample at the one or more history same period time points corresponding with the time point where the data to be monitored Data are carried out obtained by statistical analysis.

On the other hand, the embodiment of the present application provides another operational indicator monitoring method, including：

Obtain the time series data to be monitored of operational indicator to be monitored；

Detection of change-point algorithm based on setting carries out detection of change-point to the time series data to be monitored, with described in judgement It whether there is height in time series data to be monitored；

If in the presence of, by it is in the time series data to be monitored, with the height corresponding to time point it is corresponding Data, as candidate's abnormal data in the time series data to be monitored.

Another aspect, the embodiment of the present application provide a kind of operational indicator supervising device, including：

Data capture unit, for obtaining the data to be monitored of operational indicator to be monitored；

Statistical analysis unit, for each data to be monitored got for the data capture unit, by this Operational indicator to be monitored is at the one or more history same period time points corresponding with the time point where the data to be monitored History monitoring sample data carries out statistical analysis, obtains the upper limit threshold and lower threshold corresponding with the data to be monitored；

Index judging unit, for each data to be monitored got for the data capture unit, according to described Statistical analysis unit analyzes the obtained upper limit threshold and lower threshold corresponding with the data to be monitored, judges that this is to be monitored Whether data meet following condition：The value of the data to be monitored is not less than corresponding upper limit threshold or not higher than under corresponding Limit threshold value；

Abnormal determining unit, if for the judged result according to the index judging unit, it is determined that being directed to the number to be monitored According to judged result be yes, it is determined that the data to be monitored are candidate's abnormal data.

Another further aspect, the embodiment of the present application provide another operational indicator supervising device, including：

Data capture unit, for obtaining the time series data to be monitored of operational indicator to be monitored；

Detection of change-point unit, the data capture unit is got for the detection of change-point algorithm based on setting described in Time series data to be monitored carries out detection of change-point, to judge to whether there is height in the time series data to be monitored；

Abnormal determining unit, if for the testing result according to the detection of change-point unit, determine the time to be monitored Height in sequence data be present, then by it is in the time series data to be monitored, time point corresponding with the height is relative The data answered, as candidate's abnormal data in the time series data to be monitored.

On the other hand, the embodiment of the present application additionally provides another operational indicator supervising device, including：

Memory, for storing software program and module；

Processor, for the software program and module being stored in by operation in memory, perform following operate：

Obtain the data to be monitored of operational indicator to be monitored；And each data to be monitored for getting, according to setting , corresponding with the data to be monitored upper limit threshold and lower threshold, judge whether the data to be monitored meet following bar Part：The value of the data to be monitored is not less than corresponding upper limit threshold or not higher than corresponding lower threshold；

Wherein, the upper limit threshold corresponding with the data to be monitored and lower threshold are the processors by being treated to this Monitoring business index is gone through the one or more time points history same period corresponding with the time point where the data to be monitored History monitoring sample data is carried out obtained by statistical analysis.

Another aspect, the embodiment of the present application additionally provide another operational indicator supervising device, including：

Memory, for storing software program and module；

Obtain the time series data to be monitored of operational indicator to be monitored；And the detection of change-point algorithm based on setting is to described Time series data to be monitored carries out detection of change-point, to judge to whether there is height in the time series data to be monitored；If In the presence of, then by it is in the time series data to be monitored, with the height corresponding to time point corresponding data, as institute State candidate's abnormal data in time series data to be monitored.

The application has the beneficial effect that：

The embodiment of the present application provides a kind of operational indicator monitoring method and device, can use and treat monitoring business index History monitoring sample data carries out the mode of statistical analysis, the bound of the data to be monitored of automatic Prediction operational indicator to be monitored Threshold value, and the bound threshold value obtained based on prediction, determine whether data to be monitored are abnormal data；Or height can be used The mode of detection, identify the abnormal data in the time series data to be monitored of operational indicator to be monitored.Due to people need not be relied on Work mode sets fixed same ring than threshold value, therefore, it is possible on the basis of monitoring cost is reduced, expand monitoring range, avoids The generation for situations such as reporting by mistake, failing to report, improve the sensitivity and accuracy of operational indicator monitoring.

Brief description of the drawings

In order to illustrate more clearly of the technical scheme in the embodiment of the present application, make required in being described below to embodiment Accompanying drawing is briefly introduced, it should be apparent that, drawings in the following description are only some embodiments of the present application, for this For the those of ordinary skill in field, on the premise of not paying creative work, other can also be obtained according to these accompanying drawings Accompanying drawing.

Fig. 1 show a kind of possible schematic flow sheet of the operational indicator monitoring method of the offer of the embodiment of the present application one；

Fig. 2 show a kind of possible schematic flow sheet of the dynamic threshold prediction of the offer of the embodiment of the present application one；

Fig. 3 show a kind of possible schematic flow sheet of the detection of change-point of the offer of the embodiment of the present application one；

Fig. 4 show a kind of possible application scenarios signal of the operational indicator monitoring method of the offer of the embodiment of the present application one Figure；

Fig. 5 show a kind of structural representation of operational indicator supervising device of the offer of the embodiment of the present application two；

Fig. 6 show the structural representation of another operational indicator supervising device of the offer of the embodiment of the present application two；

Fig. 7 show the structural representation of another operational indicator supervising device of the offer of the embodiment of the present application two；

Fig. 8 show the structural representation of another operational indicator supervising device of the offer of the embodiment of the present application two.

Embodiment

In order that the purpose, technical scheme and advantage of the application are clearer, the application is made below in conjunction with accompanying drawing into One step it is described in detail, it is clear that described embodiment is only some embodiments of the present application, rather than whole implementation Example.Based on the embodiment in the application, what those of ordinary skill in the art were obtained under the premise of creative work is not made All other embodiment, belong to the scope of the application protection.

Embodiment one：

In order to solve that accuracy present in existing operational indicator monitor mode is relatively low and monitoring cost is higher etc. Problem, the embodiment of the present application one provide a kind of operational indicator monitoring method, are applicable to the various industry such as Internet advertising business The monitoring of the miscellaneous service index of business.As shown in figure 1, it is the one of the operational indicator monitoring method that the embodiment of the present application one provides The possible schematic flow sheet of kind.As shown in Figure 1, the operational indicator monitoring method may include two can independent operating monitoring side Case：

One is the operational indicator monitoring scheme based on dynamic threshold prediction, and it specifically may include S11：Dynamic threshold is predicted； S12：Whether judgment threshold punctures；S13：Determine the steps such as candidate's abnormal data.Wherein, in S11, can use to industry to be monitored History of the index of being engaged at the one or more history same period time points corresponding with the time point where data to be monitored monitors sample Notebook data carries out the mode of statistical analysis, the bound threshold value of automatic Prediction data to be monitored；In S12, it can be based on measuring in advance The bound threshold value of the data to be monitored arrived, judges whether the value of the data to be monitored exceedes corresponding threshold value, as judged to treat Whether the value of monitoring data meets following condition：Not less than corresponding upper limit threshold or not higher than corresponding lower threshold；Phase Ying Di, in the S13 of the monitoring scheme, it can determine candidate's abnormal data according to S12 judged result, e.g., value be not less than Corresponding upper limit threshold or not higher than corresponding lower threshold data to be monitored as candidate's abnormal data.

Another is the operational indicator monitoring scheme based on detection of change-point algorithm, and it specifically may include S10：Detection of change-point, with Judge to whether there is height in the time series data to be monitored of operational indicator to be monitored；S13：Determine that candidate's abnormal data etc. walks Suddenly.Wherein, in S10, the time series data to be monitored of monitoring business index can be treated based on the detection of change-point algorithm of setting Detection of change-point is carried out, to judge to whether there is height in the time series data to be monitored；Correspondingly, in the monitoring scheme In S13, candidate's abnormal data can be determined according to S10 judged result, e.g., by it is in time series data to be monitored, with it is described The corresponding data of time point corresponding to height, as candidate's abnormal data in time series data to be monitored.

In the first monitoring scheme, due to that can accomplish that threshold value dynamic produces, participated in without operation maintenance personnel, and dynamic It is special that threshold value can adapt to festivals or holidays, weekend and workaday the change of divergence and the flow of different monitoring period to a certain extent Difference etc. is levied, thus, can be in the base for reducing monitoring cost, expanding monitoring range compared with the mode of static threshold is manually set On plinth, the sensitivity and accuracy of operational indicator monitoring are improved.

And in second of monitoring scheme, and can because detection of change-point is manually set with ring than threshold value without relying on The continuous micro change of data is identified, thus, it can also pass through on the basis of monitoring cost is reduced, expand monitoring range Avoid because continuous micro change accumulation caused by fail to report wait to improve operational indicator monitor sensitivity and accuracy.

That is, in scheme described in the embodiment of the present application, the history monitoring sample for treating monitoring business index can be used Notebook data carries out the mode of statistical analysis, the bound threshold value of the data to be monitored of automatic Prediction operational indicator to be monitored, and base In the bound threshold value that prediction obtains, determine whether data to be monitored are abnormal data；Or the side of detection of change-point can be used Formula, identify the abnormal data in the time series data to be monitored of operational indicator to be monitored.Set due to manual type need not be relied on Fixed same ring is put than threshold value, therefore, it is possible on the basis of monitoring cost is reduced, expand monitoring range, avoids reporting by mistake, fail to report Situations such as generation, improve operational indicator monitoring sensitivity and accuracy.In addition, identifying operational indicator to be monitored After abnormal data, it can also be alerted and/or the operation such as Analysis on Abnormal is carried out to abnormal data, it is different to be avoided as much as The economic loss that the presence of regular data is brought to user, improve the application experience of user.

Further, it should be noted that the above-mentioned two monitoring scheme of the embodiment of the present application offer is except each can independently transport Outside row, it can also be combined with each other.Such as, treated based on dynamic threshold prediction while monitoring data is monitored or it Afterwards, detection of change-point can be also carried out to it, or, first treat monitoring data and carry out detection of change-point, it is pre- based on dynamic threshold again afterwards Survey is treated monitoring data and is monitored, and further to improve the sensitivity and accuracy of operational indicator monitoring, this is not made Limit.

Each step involved by the above-mentioned two monitoring scheme of the embodiment of the present application is carried out below in conjunction with Fig. 2, Fig. 3 Further describe in detail.

Alternatively, in the first monitoring scheme, before S11 is performed, operational indicator to be monitored can be generally obtained first Data to be monitored.

Alternatively, in herein described embodiment, the to be monitored of operational indicator to be monitored can be obtained in the following manner Data：

The operational indicator to be monitored that the service server for storing operational indicator data to be monitored pushes is received to wait to supervise Control data；Or the data to be monitored from active obtaining operational indicator to be monitored at the service server.

That is, passive reception or active obtaining two ways can be used, required for being obtained at corresponding service server Data to be monitored.In addition, the one or more that the data to be monitored got can be one or more operational indicators to be monitored are treated Monitoring data, this is not repeated.

Wherein, service server can be online storage service device or the on-line storages such as Tair, Treasure, HBase, UPS System, or the offline storage server such as ODPS (Open Data Processing Service, big data calculate service) or Offline storage system.In addition, it is by Internet advertising business (alternatively referred to as internet information launches business) of business to be monitored Example, the operational indicator to be monitored may include any one or more in following index：The new user's registration of business to be monitored Quantity, and, clicking rate (CTR, Click Through Rate), single click on income (CPC, Cost Per Click), thousand The dispensing feedback index such as secondary exposure income (RPM, Ad revenue Per thousand Impressions), does not make to this Repeat.

Further, when obtaining the data to be monitored of operational indicator to be monitored, it also may specify the corresponding time to be monitored Section (the specific value of the period can be adjusted flexibly according to actual conditions), to obtain business to be monitored at service server Data of the index within the period to be monitored of the setting, and the number to be monitored using the data as the operational indicator to be monitored According to.

In addition, it is necessary to explanation, the data to be monitored got generally can be time series data to be monitored, wherein, Time series (or dynamic series) refers to sequentially arranging the time order and function that the numerical value of same index is occurred by it into the number formed Row；And for the ease of dynamic threshold tuning, the time series data to be monitored got generally can be just that too distribution characteristics is enough Obvious time series data, i.e. numerical fluctuations it is smaller (e.g., the difference between adjacent data be less than setting first threshold) or The time series data of standard variance corresponding to person smaller (e.g., corresponding standard variance is less than the Second Threshold set)；Wherein, First threshold, Second Threshold can flexibly be set according to actual conditions.

For example, with the data instance to be monitored of the active obtaining operational indicator to be monitored at service server, it is if desired right Operational indicator to be monitored in some day 05:00~06:Data in 00 this period are monitored, then can be from business service Active obtaining operational indicator to be monitored is the 05 of some day at device:00~06:Time series data in 00 period, and will To be monitored data of the time series data as the operational indicator to be monitored.

Further optionally, can also according to the actual requirements after the data to be monitored of operational indicator to be monitored are got, will Form required for the data format chemical conversion follow-up data processing to be monitored, is not repeated this.

Correspondingly, after the data to be monitored of operational indicator to be monitored are got, you can perform the operation described in S11. Specifically, as shown in Figure 2 (Fig. 2 is a kind of possible schematic flow sheet of dynamic threshold prediction), in S11, for be monitored Each data to be monitored of operational indicator, it can predict to obtain the upper limit threshold corresponding with the data to be monitored by following steps And lower threshold：

S21：Operational indicator to be monitored is obtained in the one or more corresponding with the time point where the data to be monitored The history monitoring sample data at the history time point same period.

Alternatively, can be from historical data (these historical datas of operational indicator to be monitored in the historical time section of setting Can be obtained from corresponding service server) in, obtain the history monitoring sample data corresponding with the data to be monitored；Its In, the specific value of the historical time section of the setting can be adjusted flexibly according to actual conditions, and this is not repeated.

For example, to treat monitoring business index A on 09 25th, 2,016 9:The bound threshold value of 00am data is entered Row prediction, the business to be monitored in 1~2 month (can also be longer or shorter, can be adjusted as needed) that can obtain over refer to A is marked 9:00am one or more desired values, and using each desired value got as the operational indicator A to be monitored 2016 25 days 09 month 9 year:The history monitoring sample data of 00am data.

In addition, it is necessary to explanation, the history time point same period at each time point typically refers to be in same with the time point Under one time standard (such as 24 hours systems are made for 12 hours), and the historical time corresponding with time point point.For example, when being directed to Between put on 03 31st, 2,016 9:For 00am, the history time point same period at the time point can be on 03 30th, 2,016 9: 00am, on 03 20th, 2,016 9:00am, on 03 31st, 2,015 9:00am etc..

Further, it should be noted that operational indicator to be monitored is corresponding with the time point where the data to be monitored History monitoring sample data (that is, the history monitoring corresponding with the data to be monitored at the one or more time points history same period Sample data) it generally can be the corresponding period attribute history prison consistent with period attribute corresponding to the data to be monitored Control sample data.

That is, in order to distinguish the difference of sample, to prevent standard variance is excessive from causing the prediction of bound threshold value not Accurately, the data sample that there are same characteristic features with data to be monitored can be selected as needed when choosing sample, it is follow-up to improve Prediction effect.

For example, with the clicking rate of Internet advertising business, single click on income, thousand exposure income etc. dispensing feedback indexs Exemplified by, because the traffic characteristic of working day and festivals or holidays differ greatly, so it is determined that each data to be monitored of the index are gone through When history monitors sample data, the period attribute (being such as working day or festivals or holidays) of each data to be monitored can be also first determined, and According to the period attribute of each data to be monitored, the period corresponding with the data to be monitored of period attribute corresponding to selection The consistent historical data of attribute monitors sample data as the history of the data to be monitored.

In addition, in order to further improve the accuracy of bound threshold value prediction, it is relative with the data to be monitored getting After the history monitoring sample data answered, the noise data that may also be filtered in history monitoring sample data (that is, occurred abnormal Data), with cause sample sequence just too distribution characteristics is obvious enough.

Further, alternatively, can also be according to reality before the history monitoring sample data corresponding with data to be monitored is obtained Border demand, historical data of the operational indicator to be monitored in the historical time section of setting is formatted into needed for follow-up data processing The form wanted, so that based on the historical data after formatting, the history for obtaining data to be monitored monitors sample data.

S22：Determine the operational indicator to be monitored at one or more corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at the individual time point history same period.

Optionally it is determined that the operational indicator to be monitored in one corresponding with the time point where the data to be monitored or The average value of the history monitoring sample data at the multiple time points history same period, can be embodied as：

The operational indicator to be monitored is calculated to go through in the one or more corresponding with the time point where the data to be monitored The weighted average or arithmetic mean of instantaneous value of the history monitoring sample data at the history time point same period；

Using the weighted average being calculated or arithmetic mean of instantaneous value as the operational indicator to be monitored with the number to be monitored According to the average value of the history monitoring sample data at the corresponding one or more time points history same period at the time point at place.

That is, by the way of weighted average is calculated or the mode of arithmetic mean of instantaneous value can be calculated it is calculated and treats The average value of the history monitoring sample data of monitoring data.

If for example, the history monitoring sample data of data to be monitored on long terms in regular change (such as continuous rise or Continuous decrease etc.), then the history that the data to be monitored can be calculated by the way of weighted average is calculated monitors sample number According to average value, wherein, weight corresponding to each sample data in the history of the data to be monitored monitoring sample data can basis The amplitude of regularity change is set, such as can be according to nearer apart from current point in time, then the higher mode of weight is configured；Or Person, it is not easy to change if the history monitoring sample data of the data to be monitored is relatively stable on long terms, can uses and calculate arithmetic The average value of the history monitoring sample data of the data to be monitored is calculated in the mode of average value.

In addition, it is necessary to explanation, operational indicator to be monitored is corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at the one or more time points history same period is also referred to as the base of the data to be monitored Quasi- value, is not repeated this.

S23：By the average value of the first setting coefficient times, as the upper limit threshold corresponding with the data to be monitored, with And the average value by the second setting coefficient times, as the lower threshold corresponding with the data to be monitored, wherein, described the One setting coefficient is not more than 1 not less than 1, the second setting coefficient.

In addition, the first setting coefficient and the described second setting coefficient are generally different, this is not repeated.

Further, as shown in Fig. 2 after S21 and S22 has been performed, S23 can not be also performed, but perform following steps：

S24：Determine the operational indicator to be monitored at one or more corresponding with the time point where the data to be monitored The standard variance of the history monitoring sample data at the individual time point history same period.

Wherein, the standard variance of the history corresponding with the data to be monitored monitoring sample data can be based on step S22 institutes The average value and existing standard variance calculation formula being calculated are calculated, and this is not repeated.

S25：Using the average value with the standard variance sum of the 3rd setting coefficient times as relative with the data to be monitored The upper limit threshold answered, using the difference of the average value and the standard variance of the 4th setting coefficient times as relative with the data to be monitored The lower threshold answered, wherein, the 3rd setting coefficient, the 4th setting coefficient are not less than 0.

That is, the bound threshold value corresponding to data to be monitored can be according to the direct system of a reference value of data to be monitored Number regulation is drawn, alternatively, it is also possible to the history of a reference value according to data to be monitored and data to be monitored monitoring sample data Standard variance regulation is drawn, this is not construed as limiting.

Further, it is necessary to illustrate, for each data to be monitored of operational indicator to be monitored, according to above-mentioned step Rapid prediction is obtained after the bound threshold value corresponding to the data to be monitored, you can for the data to be monitored, perform S12 and Operation described in S13, to determine whether the data to be monitored are candidate's abnormal data.That is, because data to be monitored are led to Chang Kewei is multiple, thus, S11 and S12, S13 can generally intert progress, and this is not repeated.

In addition, it is necessary to explanation, in herein described embodiment, the bound threshold corresponding to each data to be monitored Value is except that can be that the history for having previously been based on the data to be monitored is monitored in addition to sample data is predicted to obtain or supervised During control, the history monitoring sample data based on the data to be monitored predicts what is obtained in real time；And it is somebody's turn to do in prediction After bound threshold value corresponding to data to be monitored, real-time or timing can be also carried out to it according to newest sample data more Newly, this is not also repeated.

As shown in the above, in the first monitoring scheme described in S11, S12 and S13, treated due to that can use The history monitoring sample data of monitoring business index carries out the mode of statistical analysis, and automatic Prediction operational indicator to be monitored is waited to supervise The bound threshold value of data, and the bound threshold value obtained based on prediction are controlled, determines whether data to be monitored are abnormal data. I.e., it is possible to accomplish that threshold value dynamic produces, participated in without operation maintenance personnel, thus, can compared with the mode of static threshold is manually set On the basis of monitoring cost is reduced, expand monitoring range, the sensitivity and accuracy of operational indicator monitoring are improved.

But some achievement datas are only after continuous micro change accumulation to a certain extent in being monitored due to operational indicator It can just be found, either static threshold or dynamic threshold are all difficult to find in this case.Thus, asked to solve this Topic, the deficiency in a manner of making up dynamic threshold in detection continuous micro change, in scheme described in the embodiment of the present application, may be used also The data to be monitored that monitoring business index is treated using detection of change-point algorithm (changepoint algorithms) carry out detection of change-point, enter And identify candidate's abnormal data (i.e. using the second monitoring scheme including S10 and S13 in Fig. 1 to industry to be monitored Business index data to be monitored be monitored), with prevent because continuous micro change accumulation caused by fail to report wait generation, raising industry The accuracy of index of being engaged in monitoring.

Alternatively, because detection of change-point algorithm is commonly used for the change in the given complete time sequence data of detection Point, thus, in the second monitoring scheme, before S10 is performed, can generally obtain first operational indicator to be monitored it is to be monitored when Between sequence data.

Alternatively, it is similar with foregoing associated description, passive reception or active obtaining two ways can be used, from corresponding industry The time series data to be monitored of operational indicator to be monitored is obtained at business server.And obtaining treating for operational indicator to be monitored During monitoring period sequence data, the corresponding period to be monitored also may specify.In addition, using business to be monitored as Internet advertising industry Exemplified by business, the operational indicator to be monitored may include any one or more in following index：The new user of business to be monitored Number-of-registration, clicking rate, single click on income, expose income etc. thousand times, this is not repeated.

Further, in order to improve the accuracy of detection of change-point, the time series data to be monitored got generally can be just too Distribution characteristics time series data obvious enough, i.e. numerical fluctuations be smaller or the corresponding less time series of standard variance Data.And after time series data to be monitored is got, can also according to the actual requirements, by the time series number to be monitored The form required according to follow-up data processing is formatted into, is not also repeated this.

Correspondingly, after the time series data to be monitored of operational indicator to be monitored is got, you can perform described in S10 Operation.Specifically, as shown in Figure 3 a kind of possible schematic flow sheet of detection of change-point (Fig. 3 be), S10 may particularly include with Lower step：

S31：It is determined that the difference accumulation and sequence corresponding with the time series data to be monitored.

Alternatively, the difference accumulation and sequence corresponding with the time series data to be monitored can be determined in the following manner Arrange (i.e. CUSUM sequences)：

The difference accumulation and data of each data in the time series data to be monitored are determined successively；

The difference accumulation and data of each data in the time series data to be monitored determined successively, obtain with The time series data to be monitored corresponding difference accumulation and sequence.

In addition, for any data in the time series data to be monitored, determine that the difference of any data is tired out Product and data, it may include following steps：

Calculate difference between the value of any data and the average value of the time series data to be monitored, Yi Jisuo State the time point in time series data to be monitored be located at the time point of any data before each data value with it is described Difference between the average value of time series data to be monitored；

Difference accumulation and data using the above-mentioned each difference sum being calculated as any data.

, wherein it is desired to explanation, because the time series data to be monitored is the sequence data on continuous time point, So the average value of the time series data to be monitored can be calculated by the way of arithmetic mean of instantaneous value is calculated；Certainly, The average value of the time series data to be monitored can be calculated by the way of weighted average is calculated, this is not limited It is fixed.

That is, using time series data to be monitored as [X1, X2, X3, X4 ..., X10] exemplified by, can calculate in the following manner The difference accumulation and data of wherein each data：

1) the average value Xavg of the time series data to be monitored, is calculated, can be (X1+X2+X3+X4+...+ e.g. X10)/10 or (X1*m1+X2*m2+...+X10*m10)/10, wherein, m1, m2, m3 ..., m10 is respectively X1, X2, X3, X4 ..., X10 weight；

2) amplitude for each sample data deviation average, being examined in the time series data to be monitored, and In this process, the amplitude sum of all sample data deviation averages, is obtained before being added up at the time of each sample data To following result：

S1=(X1-Xavg)；

S2=S1+ (X2-Xavg)；

...

S10=S9+ (X10-Xavg).

Wherein, S1, S2, S3 ..., S10 are respectively X1, X2, X3, X4 ..., X10 difference accumulation and data.

That is, difference accumulation corresponding to each data and data be the data and the data before each data with The accumulation of the deviation of desired value (that is, the average value of time series data to be monitored) and, even so that in Process Mean Minor fluctuations also result in the stable increase (or reduction) of cumulative departure value so that difference accumulation and sequence can reflect described Data in time series data to be monitored elapse the accumulation tendency that micro change occurs over time.

Alternatively, in order to improve the accuracy that follow-up height determines, further to improve the accuracy of operational indicator monitoring, It is determined that before the difference accumulation and sequence corresponding with the time series data to be monitored, methods described may also include following Step：

S30：The difference of a reference value of each data and the data in the time series data to be monitored is determined successively Data, and the difference of each data in the time series data to be monitored determined successively and a reference value of the data Data, obtain the sequence of differences corresponding with the time series data to be monitored.

Wherein, a reference value of each data in time series data to be monitored can be used described in the first monitoring scheme A reference value calculation be calculated, to improve the accuracy of a reference value, and then improve the accuracy of follow-up detection of change-point.When So, it is necessary to which explanation, in the second monitoring scheme, can also rule of thumb be manually set a reference value corresponding to each data, to this It is not construed as limiting.

Correspondingly, the difference accumulation and sequence corresponding with the time series data to be monitored of the determination described in S31, can Including：

The difference accumulation and sequence corresponding with the time series data to be monitored are determined according to the sequence of differences.

Wherein, the difference accumulation and sequence corresponding with the time series data to be monitored are determined according to the sequence of differences The embodiment of row according to the time series data to be monitored with directly determining and the time series data to be monitored Corresponding difference accumulation is similar with the embodiment of sequence, e.g., can determine each data in the sequence of differences successively Difference accumulation and data, and the difference accumulation and data of each data in the sequence of differences determined successively obtain The difference accumulation and sequence corresponding with the time series data to be monitored, is not repeated this.

That is, in the present embodiment, time series data (the i.e. testing number to be monitored got can be directly based upon According to) difference accumulation and sequence, and application algorithm detection height are determined, can also be by each data in time series data to be monitored Subtract each other the sequence of differences for drawing detection data and a reference value successively with corresponding a reference value, then determined again based on the sequence of differences Difference accumulation and sequence and application algorithm detection height, are not construed as limiting to this.

S32：Judge to whether there is height in the difference accumulation and sequence.

Alternatively, judge to whether there is height in the difference accumulation and sequence, it may include：

Judge to be changed into negative with the presence or absence of first derivative in the difference accumulation and sequence from positive number or from negative be changed into just Several state change points；

If in the presence of (if state change point is not present, can be explained the difference accumulation and sequence in height is not present), then Judge it is after the state change point, including with the state change point close to point including (the setting of continuous setting number Number can be adjusted flexibly according to actual conditions) point first derivative positive negativity whether with the first derivative of the state change point Positive negativity is identical, if so, then using the state change point as the height in the difference accumulation and sequence (i.e., it may be determined that described Height be present in difference accumulation and sequence).

Such as, however, it is determined that the first derivative each put on curve corresponding to the difference accumulation and sequence is changed into negative from positive number The variable condition that number or negative are changed into positive number continues 3 points, then it is believed that the point for occurring changing first is height.

Because the data that can be reflected in time series data to be monitored due to difference accumulation and sequence are over time The accumulation tendency of micro change occurs for passage, thus, if in the case that the sequence does not have height, curve corresponding to this sequence On do not have notable flex point, if it find that then illustrating the sequence with the presence of height in the presence of notable flex point.

Alternatively, before using the state change point as the height in the difference accumulation and sequence, methods described is also It may include：

Calculate the confidence level of the height in the difference accumulation and sequence；And

Determine the confidence threshold value (confidence level of confidence level not less than setting of the height in the difference accumulation and sequence Threshold value can be adjusted flexibly according to actual conditions).

That is, in order to improve the accuracy of business monitoring, candidate's height that can be in difference accumulation and sequence carries out confidence After checking, then using candidate's height as final required height.

Alternatively, when the confidence level of the height in the difference accumulation and sequence can calculate to be monitored by iterating Between sequence data the maximum of cumulant variable and the difference Sdiffi of minimum value obtain.Wherein, the differences between samples master of iteration To be defined by upsetting the order of sample sequence (time series data i.e. to be monitored) at random, if in iteration n times, Sdiffi The Sdiff obtained less than original order number is m, then the height in the difference accumulation and sequence of time series data to be monitored Confidence level (or confidence level of the height in time series data alternatively referred to as to be monitored) be then m/n*100%.Due to confidence Confidence level has been stablized in more iteration of the sample sequence more than 1000 times spent more than 95%, so when the confidence level of height For more than 95% when, can be using the height in the difference accumulation and sequence as actual height.

Further, after height is identified in the manner described above, you can the operation described in step S13 is performed, will It is in time series data to be monitored, with the height corresponding to time point corresponding data, as time series to be monitored Candidate's abnormal data in data.

As shown in the above, in the second monitoring scheme described in S10 and S13, can by the way of detection of change-point, Identify the abnormal data in the time series data to be monitored of operational indicator to be monitored.Manually set because detection of change-point need not rely on Same ring is put than threshold value, and can recognize that the continuous micro change of data, thus, monitoring cost can also reduced, expanding prison Control scope on the basis of, by avoid because continuous micro change accumulation caused by fail to report wait to improve operational indicator monitoring Sensitivity and accuracy.

Further, as shown in figure 1, due to when the distribution of data sample is not preferable normal distribution, dynamic threshold Detection or detection of change-point can be affected, thus, in order to filter out some unnecessary wrong reports, further improve operational indicator The accuracy of monitoring, methods described can also include the steps of：

S14：For each candidate's abnormal data, according to setting, corresponding with candidate's abnormal data year-on-year threshold value And it is following to judge whether candidate's abnormal data meets than threshold value (two threshold values can flexibly be set according to actual conditions) for ring Condition, if so, then using candidate's abnormal data as actual abnormal data, otherwise, using candidate's abnormal data as non-exception Data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.

That is, in herein described embodiment, can be abnormal to candidate by way of same ring is revealed all the details than static threshold Data carry out recurrence checking, to prevent because of the wrong report in a manner of automatic detection caused by by sample quality deleterious effect, to this not Repeat.

In addition, it is necessary to explanation, after the abnormal data of operational indicator to be monitored is identified, can also be alerted (sound Sound alerts and/or information alert) and/or the operation such as Analysis on Abnormal is carried out to abnormal data, to be avoided as much as exception The economic loss that the presence of data is brought to user, improve the application experience of user.

Finally, exemplified by the operational indicator monitoring method shown in Fig. 1 is applied into Internet advertising field, with reference to figure (Fig. 4 is a kind of possible application scenarios signal of the operational indicator monitoring method in such cases to application scenarios shown in 4 Figure), the specific implementation flow monitored to the operational indicator under this kind of scene is briefly described, and the scene can for example include： Advertisement Server 41 (or can be described as information and launch server) and monitoring server 42, wherein：

Caused miscellaneous service achievement data during Internet advertising service operation can be stored with Advertisement Server 41, Such as, the new user's registration quantity of Internet advertising business, the clicking rate of Internet advertising (or advertisement position), single click on income with And thousand any one or more achievement datas exposed in income etc..

Correspondingly, monitoring server 42 can be received or the mode such as active obtaining is from advertisement using passive according to the actual requirements The data to be monitored of advertising business index to be monitored are obtained at server 41, e.g., advertising business index to be monitored is just distributed very much Feature time series data obvious enough etc., and the data to be monitored to getting are monitored.Such as,

Monitoring server 42 can be directed to each data to be monitored for getting, according to setting, with the data phase to be monitored Corresponding upper limit threshold and lower threshold, judge whether the data to be monitored meet following condition：The data to be monitored take Value is not less than corresponding upper limit threshold or not higher than corresponding lower threshold；If the determination result is YES, it is determined that the number to be monitored According to for candidate's abnormal data；Wherein, the upper limit threshold corresponding with the data to be monitored and lower threshold are by being treated to this Advertising business index is monitored at the one or more history same period time points corresponding with the time point where the data to be monitored History monitoring sample data carry out statistical analysis obtained by.

The history monitoring sample data of advertising business index to be monitored is carried out that is, monitoring server 42 can use The mode of statistical analysis, the bound threshold value of the data to be monitored of automatic Prediction advertising business index to be monitored, and based on prediction Obtained bound threshold value, determine whether data to be monitored are abnormal data.Due to that can accomplish that threshold value dynamic produces, without fortune Dimension personnel participate in, and dynamic threshold can adapt to a certain extent festivals or holidays, weekend and workaday the change of divergence and Traffic characteristic difference of different monitoring period etc., thus, with manually set static threshold mode compared with, can reduce monitoring into This, expand monitoring range on the basis of, the generation for situations such as avoiding reporting by mistake, failing to report, improve the monitoring of Internet advertising operational indicator Sensitivity and accuracy.

In addition, if the data to be monitored that monitoring server 42 is got at Advertisement Server 41 are time series to be monitored Data, then monitoring server 42 can also the detection of change-point algorithm based on setting height is carried out to the time series data to be monitored Detection, to judge to whether there is height in the time series data to be monitored；If in the presence of by the time series to be monitored It is in data, with the height corresponding to time point corresponding data, as the time in the time series data to be monitored Select abnormal data.

That is, monitoring server 42 can also identify advertising business index to be monitored by the way of detection of change-point Abnormal data in time series data to be monitored.Due to detection of change-point without rely on it is artificial set with ring than threshold value, and energy The continuous micro change of data is enough identified, thus, it can also be kept away on the basis of monitoring cost is reduced, expand monitoring range The generation for situations such as exempting to report by mistake, failing to report, improve the sensitivity and accuracy of the monitoring of Internet advertising operational indicator.

In addition, it is necessary to explanation, Advertisement Server 41 and monitoring server 42 can carry out communication link by communication network Connect, the network can be LAN, wide area network etc..Wherein, Advertisement Server 41 can be Tair, Treasure, HBase, UPS Deng online storage service device or online storage subsystem, or the offline storage such as ODPS server or offline storage system.Monitoring clothes Business device 42 can be any server apparatus that can support the processing operation such as operational indicator monitoring.

Further, it should be noted that the application scenarios shown in Fig. 4 are for only for ease of and understand spirit herein and principle And show, presently filed embodiment is unrestricted in this regard.On the contrary, presently filed embodiment can apply to fit The monitoring scene of any scene, such as other non-internet advertising businesses, or the applied field such as business forecasting, decision support Scape, this is repeated no more.

Finally, it is necessary to explanation, limitation of the scheme without language, software or hardware described in the embodiment of the present application.But In order to improve the efficiency of data processing, it can preferentially be easy to the programming language of statistical analysis, and property from JAVA language, R language etc. Can high hardware etc. realize that the embodiment of the present application is not also repeated this.

Embodiment two：

Based on the inventive concept same with the first monitoring scheme in the embodiment of the present application one, the embodiment of the present application two carries A kind of operational indicator supervising device is supplied, the specific implementation of the operational indicator supervising device can be found in the embodiment of the present application one The associated description of the first monitoring scheme, this is not repeated.Specifically, as shown in figure 5, the operational indicator supervising device 50 can Including：

Data capture unit 51, available for the data to be monitored for obtaining operational indicator to be monitored；

Statistical analysis unit 52, available for each data to be monitored got for the data capture unit 51, lead to Cross to the operational indicator to be monitored in the one or more history same period corresponding with the time point where the data to be monitored Between put history monitoring sample data carry out statistical analysis, obtain the upper limit threshold and lower limit corresponding with the data to be monitored Threshold value；

Index judging unit 53, available for each data to be monitored got for the data capture unit 51, root The upper limit threshold and lower threshold corresponding with the data to be monitored obtained according to the statistical analysis unit 52 analysis, judges Whether the data to be monitored meet following condition：The value of the data to be monitored is not less than corresponding upper limit threshold or is not higher than Corresponding lower threshold；

Abnormal determining unit 54, if available for the judged result according to the index judging unit 53, it is determined that being treated for this The judged result of monitoring data is yes, it is determined that the data to be monitored are candidate's abnormal data.

Alternatively, the data capture unit 51, it is particularly used in reception and is used to store operational indicator data to be monitored The data to be monitored of the operational indicator to be monitored of service server push；Or wait to supervise from active obtaining at the service server Control the data to be monitored of operational indicator.

Wherein, the operational indicator to be monitored may include any one or more in following index：Business to be monitored New user's registration quantity, clicking rate, single click on income and thousand exposure incomes etc..

Alternatively, the statistical analysis unit 52 is particularly used in each number to be monitored for operational indicator to be monitored According to determining the operational indicator to be monitored in the one or more history same periods corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at time point；And the average value by the first setting coefficient again, as to be monitored with this The corresponding upper limit threshold of data, average value for setting coefficient times by second, under corresponding with the data to be monitored Threshold value is limited, wherein, the first setting coefficient is not more than 1 not less than 1, the second setting coefficient.

Or

The statistical analysis unit 52 is particularly used in each data to be monitored for operational indicator to be monitored, it is determined that should Operational indicator to be monitored is at the one or more history same period time points corresponding with the time point where the data to be monitored History monitors the average value and standard variance of sample data；And standard variance by the average value and the 3rd setting coefficient again Sum is as the upper limit threshold corresponding with the data to be monitored, by the average value and the standard variance of the 4th setting coefficient times Difference as the lower threshold corresponding with the data to be monitored, wherein, it is described 3rd setting coefficient, it is described 4th setting coefficient It is not less than 0.

Wherein, the operational indicator to be monitored is gone through in the one or more corresponding with the time point where the data to be monitored The history monitoring sample data at the history time point same period generally can be corresponding period attribute it is corresponding with the data to be monitored when Between section attribute it is consistent history monitoring sample data.

In addition, the operational indicator to be monitored is gone through in the one or more corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at the history time point same period, can be that the statistical analysis unit 52 is counted in the following manner Obtain：

Further, as shown in figure 5, the operational indicator supervising device 50 may also include：

Authentication unit 55 is returned, determines that the data to be monitored are candidate's exception number available in the abnormal determining unit 54 According to afterwards, according to setting, corresponding with the data to be monitored year-on-year threshold value and ring than threshold value, the data to be monitored are judged Whether following condition is met, if so, then otherwise, the data to be monitored are made using the data to be monitored as actual abnormal data For non-abnormal data：

Further, based on the inventive concept same with the first monitoring scheme in the embodiment of the present application one, the application Embodiment two additionally provides another operational indicator supervising device, and the specific implementation of another operational indicator supervising device can be joined The associated description for the first monitoring scheme seen in the embodiment of the present application one, this is not repeated.Specifically, as shown in fig. 6, should Another operational indicator supervising device 60 may include：

Memory 61, available for storage software program and module；

Processor 62, available for the software program and module being stored in by operation in memory 61, perform following grasp Make：

Wherein, the upper limit threshold corresponding with the data to be monitored and lower threshold are the processors 61 by this Operational indicator to be monitored is at the one or more history same period time points corresponding with the time point where the data to be monitored History monitoring sample data is carried out obtained by statistical analysis.

Alternatively, the processor 61 is particularly used in the business service for receiving and being used for storing operational indicator data to be monitored The data to be monitored of the operational indicator to be monitored of device push；Or refer to from active obtaining business to be monitored at the service server Target data to be monitored.

Further, the processor 61 is particularly used in each data to be monitored for operational indicator to be monitored, really The fixed operational indicator to be monitored is in the one or more history same period times corresponding with the time point where the data to be monitored The average value of the history monitoring sample data of point；And by the average value of the first setting coefficient times, as with the data to be monitored Corresponding upper limit threshold, average value for setting coefficient times by second, as the lower limit threshold corresponding with the data to be monitored Value, wherein, the first setting coefficient is not more than 1 not less than 1, the second setting coefficient.

Or

The processor 61 is particularly used in each data to be monitored for operational indicator to be monitored, determines that this is to be monitored History of the operational indicator at the one or more history same period time points corresponding with the time point where the data to be monitored is supervised Control the average value and standard variance of sample data；And the standard variance sum of the average value and the 3rd setting coefficient times is made For the upper limit threshold corresponding with the data to be monitored, the difference of the average value and the standard variance of the 4th setting coefficient times is made For the lower threshold corresponding with the data to be monitored, wherein, the 3rd setting coefficient, the 4th setting coefficient be not small In 0.

In addition, the operational indicator to be monitored is gone through in the one or more corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at the history time point same period, can be that the processor 62 is calculated in the following manner 's：

Further, the processor 62 can be additionally used in it is determined that the data to be monitored be candidate's abnormal data after, root According to setting, corresponding with the data to be monitored year-on-year threshold value and ring than threshold value, judge whether the data to be monitored meet Following condition, if so, then using the data to be monitored as actual abnormal data, otherwise, using the data to be monitored as non-exception Data：

That is, in a kind of possible design, it may include memory in the structure of another operational indicator supervising device 60 61 and processor 62, the processor 62 is configured as supporting to perform phase in the first monitoring scheme in the embodiment of the present application one The function of answering.The memory 61 is used to couple with processor 62, and it preserves processor 62 and performed in the embodiment of the present application one Corresponding programmed instruction and data necessary to function in the first monitoring scheme.

Wherein, memory 61 may include internal memory 611 and external memory storage 612, and internal memory 611 is used to temporarily deposit processor 62 In operational data, and the data exchanged with external memory storages 612 such as hard disks, processor 62 deposited by internal memory 611 with outside Reservoir 612 carries out data exchange.Internal memory 611 can be nonvolatile storage (Non-Volatile Random Access Memory, NVRAM), dynamic RAM (Dynamic Random Access Memory, DRAM), static random storage One of device (Static RAM, SRAM), Flash flash memories etc.；External memory storage 612 can be hard disk, CD, USB disk, soft Disk or magnetic tape station etc..

In addition, processor 62 can be central processing unit (CPU), general processor, digital signal processor (DSP), specially With integrated circuit (ASIC), field programmable gate array (FPGA) or other PLDs, transistor logic, Hardware component or its any combination.It can realize or perform various exemplary with reference to described by present disclosure Logic block, module and circuit.The processor 62 can also be the combination for realizing computing function, such as include one or more Combination of micro processor combination, DSP and microprocessor etc..

Further, it will appreciated by the skilled person that it can pass through between the memory 61 and the processor 62 The communication of bus 63 shown in Fig. 6 is connected；And the structure shown in Fig. 6 is only to illustrate, it is not supervised to another operational indicator The structure of control device 60 causes to limit.For example, another operational indicator supervising device 60 may also include it is more more than shown in Fig. 6 Either less component or with configuration different from shown in Fig. 6 etc..

Further, based on the inventive concept same with second of monitoring scheme in the embodiment of the present application one, the application Embodiment two additionally provides another operational indicator supervising device, and the specific implementation of another operational indicator supervising device can be joined The associated description for second of the monitoring scheme seen in the embodiment of the present application one, is not repeated this.Specifically, as shown in fig. 7, should Another operational indicator supervising device 70 may include：

Data capture unit 71, available for the time series data to be monitored for obtaining operational indicator to be monitored；

Detection of change-point unit 72, the data capture unit 71 is got available for the detection of change-point algorithm based on setting The time series data to be monitored carry out detection of change-point, to judge in the time series data to be monitored with the presence or absence of becoming Point；

Abnormal determining unit 73, if available for the testing result according to the detection of change-point unit 72, it is determined that described wait to supervise Height be present in control time series data, then by the time in the time series data to be monitored, corresponding with the height The corresponding data of point, as candidate's abnormal data in the time series data to be monitored.

Alternatively, the data capture unit 71, it is particularly used in reception and is used to store operational indicator data to be monitored The time series data to be monitored of the operational indicator to be monitored of service server push；Or at the service server actively Obtain the time series data to be monitored of operational indicator to be monitored.

Alternatively, it is corresponding with the time series data to be monitored to be particularly used in determination for the detection of change-point unit 72 Difference accumulation and sequence, and judge to whether there is height in the difference accumulation and sequence.

Specifically, the detection of change-point unit 72 is particularly used in determines in the time series data to be monitored successively The difference accumulation and data of each data；And the difference of each data in the time series data to be monitored determined successively Accumulation and data, obtain the difference accumulation and sequence corresponding with the time series data to be monitored.

Wherein, specifically may be used for any data in the time series data to be monitored, the detection of change-point unit 72 For determining the difference accumulation and data of any data in the following manner：

Alternatively, as shown in fig. 7, another operational indicator supervising device 70 may also include sequence of differences determining unit 74：

The sequence of differences determining unit 74, determined and the time to be monitored available in the detection of change-point unit 72 Before sequence data corresponding difference accumulation and sequence, each data in the time series data to be monitored are determined successively With the difference data of a reference value of the data, and each data in the time series data to be monitored determined successively With the difference data of a reference value of the data, the sequence of differences corresponding with the time series data to be monitored is obtained；

Correspondingly, the detection of change-point unit 72 be particularly used according to the sequence of differences determine with it is described to be monitored when Between the corresponding difference accumulation and sequence of sequence data.

Wherein, for any data in the time series data to be monitored, a reference value of the data can be described What detection of change-point unit 72 obtained in the following manner：

Operational indicator to be monitored is obtained in the one or more history same period corresponding with the time point where the data Between put history monitoring sample data；

The average value of the history monitoring sample data got is calculated, and using the average value being calculated as the data A reference value.

Still optionally further, the detection of change-point unit 72 be particularly used in judge in the difference accumulation and sequence whether There is first derivative to be changed into negative from positive number or be changed into the state change point of positive number from negative；If in the presence of, judge the state become Change point after, including with the state change point close to point including continuous setting number point first derivative positive negativity It is whether identical with the positive negativity of the first derivative of the state change point, if so, then tiring out using the state change point as the difference Height in product and sequence.

In addition, the detection of change-point unit 72 can be additionally used in using the state change point as the difference accumulation and sequence In height before, calculate the confidence level of the height in the difference accumulation and sequence；And determine the difference accumulation and sequence In height confidence level not less than setting confidence threshold value.

Further, as shown in fig. 7, another operational indicator supervising device 70 may also include：

Authentication unit 75 is returned, available for for each candidate's abnormal data in the time series data to be monitored, According to setting, corresponding with candidate's abnormal data year-on-year threshold value and ring than threshold value, judge that candidate's abnormal data is It is no to meet following condition, if so, then using candidate's abnormal data as actual abnormal data, otherwise, by candidate's abnormal data As non-abnormal data：

Further, based on the inventive concept same with second of monitoring scheme in the embodiment of the present application one, the application Embodiment two additionally provides another operational indicator supervising device, and the specific implementation of another operational indicator supervising device can be joined The associated description for second of the monitoring scheme seen in the embodiment of the present application one, is not repeated this.Specifically, as shown in figure 8, should Another operational indicator supervising device 80 may include：

Memory 81, available for storage software program and module；

Processor 82, available for the software program and module being stored in by operation in memory, perform following operate：

Alternatively, the processor 82, the business clothes for receiving and being used to store operational indicator data to be monitored are particularly used in The time series data to be monitored of the operational indicator to be monitored of business device push；Or treated from active obtaining at the service server The time series data to be monitored of monitoring business index.

Alternatively, the processor 82, which is particularly used in, determines the difference corresponding with the time series data to be monitored Accumulation and sequence, and judge to whether there is height in the difference accumulation and sequence.

Specifically, the processor 82 is particularly used in each data determined successively in the time series data to be monitored Difference accumulation and data；And the difference accumulation of each data in the time series data to be monitored determined successively and Data, obtain the difference accumulation and sequence corresponding with the time series data to be monitored.

Wherein, it is particularly used in logical for any data in the time series data to be monitored, the processor 82 Cross difference accumulation and data that in the following manner determines any data：

Alternatively, the processor 82 can be additionally used in it is determined that the difference corresponding with the time series data to be monitored Before accumulation and sequence, the difference of a reference value of each data and the data in the time series data to be monitored is determined successively Value Data, and the difference of each data in the time series data to be monitored determined successively and a reference value of the data Value Data, obtain the sequence of differences corresponding with the time series data to be monitored, with according to the sequence of differences determine with The time series data to be monitored corresponding difference accumulation and sequence.

Wherein, for any data in the time series data to be monitored, a reference value of the data can be described What processor 82 obtained in the following manner：

Still optionally further, the processor 82, which is particularly used in, judges to whether there is one in the difference accumulation and sequence Order derivative is changed into negative from positive number or is changed into the state change point of positive number from negative；If in the presence of, judge the state change point it Afterwards, including with the state change point close to point including continuous setting number point first derivative positive negativity whether with The positive negativity of the first derivative of the state change point is identical, if so, then using the state change point as the difference accumulation and sequence Height in row.

In addition, the processor 82 can be additionally used in using the state change point as the change in the difference accumulation and sequence Before point, the confidence level of the height in the difference accumulation and sequence is calculated；And determine the change in the difference accumulation and sequence Confidence threshold value of the confidence level of point not less than setting.

Further, each candidate that the processor 82 can also be used to be directed in the time series data to be monitored is different Regular data, according to setting, corresponding with candidate's abnormal data year-on-year threshold value and ring than threshold value, judge candidate exception Whether data meet following condition, if so, then using candidate's abnormal data as actual abnormal data, it is otherwise, the candidate is different Regular data is as non-abnormal data：

That is, in a kind of possible design, it may include memory in the structure of another operational indicator supervising device 80 81 and processor 82, the processor 82 is configured as supporting to perform phase in second of monitoring scheme in the embodiment of the present application one The function of answering.The memory 81 is used to couple with processor 82, and it preserves processor 82 and performed in the embodiment of the present application one Corresponding programmed instruction and data necessary to function in second of monitoring scheme.

Wherein, memory 81 may include internal memory 811 and external memory storage 812, and internal memory 811 is used to temporarily deposit processor 82 In operational data, and the data exchanged with external memory storages 812 such as hard disks, processor 82 deposited by internal memory 811 with outside Reservoir 812 carries out data exchange.Internal memory 811 can be nonvolatile storage, dynamic RAM, SRAM, One of Flash flash memories etc.；External memory storage 812 can be hard disk, CD, USB disk, floppy disk or magnetic tape station etc..

In addition, processor 82 can be central processing unit (CPU), general processor, digital signal processor (DSP), specially With integrated circuit (ASIC), field programmable gate array (FPGA) or other PLDs, transistor logic, Hardware component or its any combination.It can realize or perform various exemplary with reference to described by present disclosure Logic block, module and circuit.The processor 82 can also be the combination for realizing computing function, such as include one or more Combination of micro processor combination, DSP and microprocessor etc..

Further, it will appreciated by the skilled person that it can pass through between the memory 81 and the processor 82 The communication of bus 83 shown in Fig. 8 is connected；And the structure shown in Fig. 8 is only to illustrate, it is not supervised to another operational indicator The structure of control device 80 causes to limit.For example, another operational indicator supervising device 80 may also include it is more more than shown in Fig. 8 Either less component or with configuration different from shown in Fig. 8 etc..

It will be understood by those skilled in the art that embodiments herein can be provided as method, apparatus (equipment) or computer journey Sequence product.Therefore, in terms of the application can use complete hardware embodiment, complete software embodiment or combine software and hardware The form of embodiment.Moreover, the application can use the calculating for wherein including computer usable program code in one or more The computer program that machine usable storage medium is implemented on (including but is not limited to magnetic disk storage, CD-ROM, optical memory etc.) The form of product.

The application is the flow chart with reference to method, apparatus (equipment) and computer program product according to the embodiment of the present application And/or block diagram describes.It should be understood that can be by each flow in computer program instructions implementation process figure and/or block diagram And/or square frame and the flow in flow chart and/or block diagram and/or the combination of square frame.These computer programs can be provided to refer to The processors of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing devices is made to produce One machine so that produced by the instruction of computer or the computing device of other programmable data processing devices for realizing The device for the function of being specified in one flow of flow chart or multiple flows and/or one square frame of block diagram or multiple square frames.

These computer program instructions, which may be alternatively stored in, can guide computer or other programmable data processing devices with spy Determine in the computer-readable memory that mode works so that the instruction being stored in the computer-readable memory, which produces, to be included referring to Make the manufacture of device, the command device realize in one flow of flow chart or multiple flows and/or one square frame of block diagram or The function of being specified in multiple square frames.

These computer program instructions can be also loaded into computer or other programmable data processing devices so that counted Series of operation steps is performed on calculation machine or other programmable devices to produce computer implemented processing, so as in computer or The instruction performed on other programmable devices is provided for realizing in one flow of flow chart or multiple flows and/or block diagram one The step of function of being specified in individual square frame or multiple square frames.

Although having been described for the preferred embodiment of the application, those skilled in the art once know basic creation Property concept, then can make other change and modification to these embodiments.So appended claims be intended to be construed to include it is excellent Select embodiment and fall into having altered and changing for the application scope.

Obviously, those skilled in the art can carry out the essence of various changes and modification without departing from the application to the application God and scope.So, if these modifications and variations of the application belong to the scope of the application claim and its equivalent technologies Within, then the application is also intended to comprising including these changes and modification.

Claims

A kind of 1. operational indicator monitoring method, it is characterised in that including：

Obtain the data to be monitored of operational indicator to be monitored；

For each data to be monitored got, according to setting, corresponding with the data to be monitored upper limit threshold and Lower threshold, judges whether the data to be monitored meet following condition：The value of the data to be monitored is not less than the corresponding upper limit Threshold value or not higher than corresponding lower threshold；

If the determination result is YES, it is determined that the data to be monitored are candidate's abnormal data；

Wherein, the upper limit threshold corresponding with the data to be monitored and lower threshold are by existing to the operational indicator to be monitored The history monitoring sample data at the one or more history same period time points corresponding with the time point where the data to be monitored Obtained by progress statistical analysis.
2. the method as described in claim 1, it is characterised in that the operational indicator to be monitored includes any in following index It is one or more：The new user's registration quantity of business to be monitored, clicking rate, single click on income and thousand exposure incomes.
3. method as claimed in claim 1 or 2, it is characterised in that obtain the data to be monitored of operational indicator to be monitored, wrap Include：

Receive the number to be monitored for the operational indicator to be monitored that the service server for storing operational indicator data to be monitored pushes According to；Or

From the data to be monitored of active obtaining operational indicator to be monitored at the service server.
4. the method as described in claim 1, it is characterised in that for each data to be monitored of operational indicator to be monitored, with The corresponding upper limit threshold of the data to be monitored and lower threshold obtain in the following manner：

Determine that the operational indicator to be monitored is same in the one or more history corresponding with the time point where the data to be monitored The average value of the history monitoring sample data at time point phase；

The average value for setting coefficient times by first, as the upper limit threshold corresponding with the data to be monitored, and, by second The average value of coefficient times is set, as the lower threshold corresponding with the data to be monitored, wherein, the first setting coefficient It is not more than 1 not less than 1, the second setting coefficient.
5. the method as described in claim 1, it is characterised in that for each data to be monitored of operational indicator to be monitored, with The corresponding upper limit threshold of the data to be monitored and lower threshold obtain in the following manner：

Determine that the operational indicator to be monitored is same in the one or more history corresponding with the time point where the data to be monitored The average value and standard variance of the history monitoring sample data at time point phase；

Using the average value with the standard variance sum of the 3rd setting coefficient times as the upper limit corresponding with the data to be monitored Threshold value, using the difference of the average value and the standard variance of the 4th setting coefficient times as the lower limit corresponding with the data to be monitored Threshold value, wherein, the 3rd setting coefficient, the 4th setting coefficient are not less than 0.
6. the method as described in claim 4 or 5, it is characterised in that determine the operational indicator to be monitored with the number to be monitored According to the average value of the history monitoring sample data at the corresponding one or more time points history same period at the time point at place, bag Include：

It is same in the one or more history corresponding with the time point where the data to be monitored to calculate the operational indicator to be monitored The weighted average or arithmetic mean of instantaneous value of the history monitoring sample data at time point phase；

Using the weighted average being calculated or arithmetic mean of instantaneous value as the operational indicator to be monitored with the data institute to be monitored The corresponding one or more time points history same period at time point history monitoring sample data average value.
7. the method as described in claim 1, it is characterised in that it is determined that the data to be monitored be candidate's abnormal data after, Methods described also includes：

According to setting, corresponding with the data to be monitored year-on-year threshold value and ring than threshold value, judge that the data to be monitored are It is no to meet following condition, if so, then using the data to be monitored as actual abnormal data, otherwise, using the data to be monitored as Non- abnormal data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.
8. the method as described in claim 1, it is characterised in that the operational indicator to be monitored with the data to be monitored where The history monitoring sample data at the corresponding one or more time points history same period at time point be corresponding period attribute with The consistent history monitoring sample data of period attribute corresponding to the data to be monitored.
A kind of 9. operational indicator monitoring method, it is characterised in that including：

Obtain the time series data to be monitored of operational indicator to be monitored；

Detection of change-point algorithm based on setting carries out detection of change-point to the time series data to be monitored, to wait to supervise described in judgement It whether there is height in control time series data；

If in the presence of, by it is in the time series data to be monitored, with the height corresponding to time point corresponding data, As candidate's abnormal data in the time series data to be monitored.
10. method as claimed in claim 9, it is characterised in that the operational indicator to be monitored includes appointing in following index Meaning is one or more：The new user's registration quantity of business to be monitored, clicking rate, single click on income and thousand exposure incomes.
11. the method as described in claim 9 or 10, it is characterised in that obtain the time sequence to be monitored of operational indicator to be monitored Column data, including：

Receive for store operational indicator data to be monitored service server push operational indicator to be monitored it is to be monitored when Between sequence data；Or

From the time series data to be monitored of active obtaining operational indicator to be monitored at the service server.
12. method as claimed in claim 9, it is characterised in that the detection of change-point algorithm based on setting to it is described to be monitored when Between sequence data carry out detection of change-point, to judge to whether there is in the time series data to be monitored height, including：

It is determined that the difference accumulation and sequence corresponding with the time series data to be monitored, and judge the difference accumulation and sequence It whether there is height in row.
13. method as claimed in claim 12, it is characterised in that it is determined that corresponding with the time series data to be monitored Difference accumulation and sequence, including：

The difference accumulation and data of each data in the time series data to be monitored are determined successively；

The difference accumulation and data of each data in the time series data to be monitored determined successively, obtain with it is described Time series data to be monitored corresponding difference accumulation and sequence.
14. method as claimed in claim 13, it is characterised in that for any number in the time series data to be monitored According to, the difference accumulation and data of any data are determined, including：

Calculate the difference between the value of any data and the average value of the time series data to be monitored and described treat Time point in monitoring period sequence data be located at the time point of any data before the values of each data wait to supervise with described Control the difference between the average value of time series data；

Difference accumulation and data using the above-mentioned each difference sum being calculated as any data.
15. method as claimed in claim 12, it is characterised in that it is determined that corresponding with the time series data to be monitored Difference accumulation and sequence before, methods described also includes：

The difference data of a reference value of each data and the data in the time series data to be monitored, and root are determined successively According to the difference data of each data in the time series data to be monitored determined successively and a reference value of the data, obtain The sequence of differences corresponding with the time series data to be monitored；

It is determined that the difference accumulation and sequence corresponding with the time series data to be monitored, including：

The difference accumulation and sequence corresponding with the time series data to be monitored are determined according to the sequence of differences.
16. method as claimed in claim 15, it is characterised in that for any number in the time series data to be monitored According to a reference value of the data obtains in the following manner：

Operational indicator to be monitored is obtained at the one or more history same period time points corresponding with the time point where the data History monitoring sample data；

Calculate the average value of the history monitoring sample data got, and the benchmark using the average value being calculated as the data Value.
17. method as claimed in claim 12, it is characterised in that judge in the difference accumulation and sequence with the presence or absence of change Point, including：

Judge to be changed into negative with the presence or absence of first derivative in the difference accumulation and sequence from positive number or be changed into positive number from negative State change point；

If in the presence of, judge it is after the state change point, including with the state change point close to point including continuous setting Whether the positive negativity of the first derivative of the point of number is identical with the positive negativity of the first derivative of the state change point, if so, then will The state change point is as the height in the difference accumulation and sequence.
18. method as claimed in claim 17, it is characterised in that using the state change point as the difference accumulation and sequence Before height in row, methods described also includes：

Calculate the confidence level of the height in the difference accumulation and sequence；And

Determine confidence threshold value of the confidence level not less than setting of the height in the difference accumulation and sequence.
19. method as claimed in claim 11, it is characterised in that methods described also includes：

For each candidate's abnormal data in the time series data to be monitored, according to setting, with candidate's exception number According to corresponding year-on-year threshold value and ring than threshold value, judge whether candidate's abnormal data meets following condition, if so, then should Candidate's abnormal data is as actual abnormal data, otherwise, using candidate's abnormal data as non-abnormal data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.
A kind of 20. operational indicator supervising device, it is characterised in that including：

Data capture unit, for obtaining the data to be monitored of operational indicator to be monitored；

Statistical analysis unit, for each data to be monitored got for the data capture unit, by waiting to supervise to this Control history of the operational indicator at the one or more history same period time points corresponding with the time point where the data to be monitored Monitor sample data and carry out statistical analysis, obtain the upper limit threshold and lower threshold corresponding with the data to be monitored；

Index judging unit, for each data to be monitored got for the data capture unit, according to the statistics Analytic unit analyzes the obtained upper limit threshold and lower threshold corresponding with the data to be monitored, judges the data to be monitored Whether following condition is met：The value of the data to be monitored is not less than corresponding upper limit threshold or not higher than corresponding lower limit threshold Value；

Abnormal determining unit, if for the judged result according to the index judging unit, it is determined that for the data to be monitored Judged result is yes, it is determined that the data to be monitored are candidate's abnormal data.
21. device as claimed in claim 20, it is characterised in that

The statistical analysis unit, specifically for each data to be monitored for operational indicator to be monitored, determine that this is to be monitored History of the operational indicator at the one or more history same period time points corresponding with the time point where the data to be monitored is supervised Control the average value of sample data；And by the average value of the first setting coefficient times, as corresponding with the data to be monitored upper Threshold value is limited, the average value for setting coefficient times by second, as the lower threshold corresponding with the data to be monitored, wherein, institute State the first setting coefficient and be not more than 1 not less than 1, the second setting coefficient.
22. device as claimed in claim 20, it is characterised in that

The statistical analysis unit, specifically for each data to be monitored for operational indicator to be monitored, determine that this is to be monitored History of the operational indicator at the one or more history same period time points corresponding with the time point where the data to be monitored is supervised Control the average value and standard variance of sample data；And the standard variance sum of the average value and the 3rd setting coefficient times is made For the upper limit threshold corresponding with the data to be monitored, the difference of the average value and the standard variance of the 4th setting coefficient times is made For the lower threshold corresponding with the data to be monitored, wherein, the 3rd setting coefficient, the 4th setting coefficient be not small In 0.
23. device as claimed in claim 20, it is characterised in that described device also includes：

Authentication unit is returned, for determining that the data to be monitored are root after candidate's abnormal data in the abnormal determining unit According to setting, corresponding with the data to be monitored year-on-year threshold value and ring than threshold value, judge whether the data to be monitored meet Following condition, if so, then using the data to be monitored as actual abnormal data, otherwise, using the data to be monitored as non-exception Data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.
A kind of 24. operational indicator supervising device, it is characterised in that including：

Data capture unit, for obtaining the time series data to be monitored of operational indicator to be monitored；

Detection of change-point unit, the data capture unit is got for the detection of change-point algorithm based on setting described in wait to supervise Control time series data and carry out detection of change-point, to judge to whether there is height in the time series data to be monitored；

Abnormal determining unit, if for the testing result according to the detection of change-point unit, determine the time series to be monitored Height in data be present, then by it is in the time series data to be monitored, with the height corresponding to time point it is corresponding Data, as candidate's abnormal data in the time series data to be monitored.
25. device as claimed in claim 24, it is characterised in that

The detection of change-point unit, specifically for determining the difference accumulation and sequence corresponding with the time series data to be monitored Row, and judge to whether there is height in the difference accumulation and sequence.
26. device as claimed in claim 25, it is characterised in that

The detection of change-point unit, specifically for determining that the difference of each data in the time series data to be monitored is tired out successively Product and data；And the difference accumulation and data of each data in the time series data to be monitored determined successively, obtain To the difference accumulation and sequence corresponding with the time series data to be monitored.
27. device as claimed in claim 26, it is characterised in that described device also includes sequence of differences determining unit：

The sequence of differences determining unit, for being determined and the time series data phase to be monitored in the detection of change-point unit Before corresponding difference accumulation and sequence, each data and the data in the time series data to be monitored are determined successively The difference data of a reference value, and each data in the time series data to be monitored determined successively and the data The difference data of a reference value, obtain the sequence of differences corresponding with the time series data to be monitored；

The detection of change-point unit is relative with the time series data to be monitored specifically for being determined according to the sequence of differences The difference accumulation and sequence answered.
28. device as claimed in claim 25, it is characterised in that

The detection of change-point unit, specifically for judging with the presence or absence of first derivative from positive number to become in the difference accumulation and sequence It is changed into the state change point of positive number for negative or from negative；If in the presence of, judge it is after the state change point including with this State change point close to point including continuous setting number point first derivative positive negativity whether with the state change point First derivative positive negativity it is identical, if so, then using the state change point as the height in the difference accumulation and sequence.
29. device as claimed in claim 28, it is characterised in that

The detection of change-point unit, be additionally operable to using the state change point as the height in the difference accumulation and sequence it Before, calculate the confidence level of the height in the difference accumulation and sequence；And determine the height in the difference accumulation and sequence Confidence threshold value of the confidence level not less than setting.
30. device as claimed in claim 24, it is characterised in that described device also includes：

Authentication unit is returned, for for each candidate's abnormal data in the time series data to be monitored, according to setting , corresponding with candidate's abnormal data year-on-year threshold value and ring than threshold value, judge candidate's abnormal data whether meet with Lower condition, if so, then using candidate's abnormal data as actual abnormal data, otherwise, using candidate's abnormal data as non-different Regular data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.
A kind of 31. operational indicator supervising device, it is characterised in that including：

Memory, for storing software program and module；

Processor, for the software program and module being stored in by operation in memory, perform following operate：

Obtain the data to be monitored of operational indicator to be monitored；And for each data to be monitored for getting, according to setting, with The data to be monitored corresponding upper limit threshold and lower threshold, judge whether the data to be monitored meet following condition：Should The value of data to be monitored is not less than corresponding upper limit threshold or not higher than corresponding lower threshold；

If the determination result is YES, it is determined that the data to be monitored are candidate's abnormal data；

Wherein, it is to be monitored to this to be that the processor passes through for the upper limit threshold corresponding with the data to be monitored and lower threshold History of the operational indicator at the one or more history same period time points corresponding with the time point where the data to be monitored is supervised Control sample data is carried out obtained by statistical analysis.
32. device as claimed in claim 31, it is characterised in that

The processor, specifically for each data to be monitored for operational indicator to be monitored, determine that the business to be monitored refers to It is marked on the history monitoring sample at the one or more history same period time points corresponding with the time point where the data to be monitored The average value of data；And by the average value of the first setting coefficient times, as the upper limit threshold corresponding with the data to be monitored, The average value for setting coefficient times by second, as the lower threshold corresponding with the data to be monitored, wherein, described first sets Determine coefficient and be not more than 1 not less than 1, the second setting coefficient.
33. device as claimed in claim 31, it is characterised in that

The processor, specifically for each data to be monitored for operational indicator to be monitored, determine that the business to be monitored refers to It is marked on the history monitoring sample at the one or more history same period time points corresponding with the time point where the data to be monitored The average value and standard variance of data；And using the standard variance sum of the average value and the 3rd setting coefficient times as with this The corresponding upper limit threshold of data to be monitored, using the difference of the average value and the standard variance of the 4th setting coefficient times as with this The corresponding lower threshold of data to be monitored, wherein, the 3rd setting coefficient, the 4th setting coefficient are not less than 0.
34. device as claimed in claim 31, it is characterised in that

The processor, be additionally operable to after it is determined that the data to be monitored are candidate's abnormal data, according to setting, with this wait to supervise The corresponding year-on-year threshold value of data and ring are controlled than threshold value, judges whether the data to be monitored meet following condition, if so, then will The data to be monitored are as actual abnormal data, otherwise, using the data to be monitored as non-abnormal data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.
A kind of 35. operational indicator supervising device, it is characterised in that including：

Memory, for storing software program and module；

Processor, for the software program and module being stored in by operation in memory, perform following operate：

Obtain the time series data to be monitored of operational indicator to be monitored；And the detection of change-point algorithm based on setting is waited to supervise to described Control time series data and carry out detection of change-point, to judge to whether there is height in the time series data to be monitored；If in the presence of, Then by it is in the time series data to be monitored, with the height corresponding to time point corresponding data, treated as described Candidate's abnormal data in monitoring period sequence data.
36. device as claimed in claim 35, it is characterised in that

The processor, specifically for determining the difference accumulation and sequence corresponding with the time series data to be monitored, and Judge to whether there is height in the difference accumulation and sequence.
37. device as claimed in claim 36, it is characterised in that

The processor, the difference accumulation sum specifically for determining each data in the time series data to be monitored successively According to；And the difference accumulation and data of each data in the time series data to be monitored determined successively, obtain and institute State time series data to be monitored corresponding difference accumulation and sequence.
38. device as claimed in claim 37, it is characterised in that

The processor, be additionally operable to it is determined that the difference accumulation corresponding with the time series data to be monitored and sequence it Before, the difference data of a reference value of each data and the data in the time series data to be monitored, and root are determined successively According to the difference data of each data in the time series data to be monitored determined successively and a reference value of the data, obtain The sequence of differences corresponding with the time series data to be monitored, with according to the sequence of differences determine with it is described to be monitored when Between the corresponding difference accumulation and sequence of sequence data.
39. device as claimed in claim 36, it is characterised in that

The processor, specifically for judging to be changed into negative from positive number with the presence or absence of first derivative in the difference accumulation and sequence Number or the state change point for being changed into positive number from negative；If in the presence of, judge it is after the state change point including with the state Change point close to point including continuous setting number point first derivative positive negativity whether one with the state change point The positive negativity of order derivative is identical, if so, then using the state change point as the height in the difference accumulation and sequence.
40. device as claimed in claim 39, it is characterised in that

The processor, it is additionally operable to before using the state change point as the height in the difference accumulation and sequence, calculates The confidence level of height in the difference accumulation and sequence；And determine the confidence level of the height in the difference accumulation and sequence not Less than the confidence threshold value of setting.
41. device as claimed in claim 35, it is characterised in that

The processor, each candidate's abnormal data being directed in the time series data to be monitored is additionally operable to, according to setting , corresponding with candidate's abnormal data year-on-year threshold value and ring than threshold value, judge candidate's abnormal data whether meet with Lower condition, if so, then using candidate's abnormal data as actual abnormal data, otherwise, using candidate's abnormal data as non-different Regular data：

Year-on-year amplitude of variation is not less than corresponding ring than amplitude of variation and compares threshold value not less than corresponding threshold value on year-on-year basis and ring.