CN108063698B - Equipment abnormality detection method and device, and storage medium - Google Patents

Equipment abnormality detection method and device, and storage medium Download PDF

Info

Publication number
CN108063698B
CN108063698B CN201711348423.2A CN201711348423A CN108063698B CN 108063698 B CN108063698 B CN 108063698B CN 201711348423 A CN201711348423 A CN 201711348423A CN 108063698 B CN108063698 B CN 108063698B
Authority
CN
China
Prior art keywords
time
domain data
sliding window
abnormal
detected
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201711348423.2A
Other languages
Chinese (zh)
Other versions
CN108063698A (en
Inventor
孙亮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Neusoft Corp
Original Assignee
Neusoft Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Neusoft Corp filed Critical Neusoft Corp
Priority to CN201711348423.2A priority Critical patent/CN108063698B/en
Publication of CN108063698A publication Critical patent/CN108063698A/en
Application granted granted Critical
Publication of CN108063698B publication Critical patent/CN108063698B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network

Abstract

The invention provides a method and a device for detecting equipment abnormity and a storage medium, wherein the method comprises the following steps: the method comprises the steps of adopting a preset time sliding window to slide on a time sequence of time domain data of equipment to be detected, obtaining time domain data and frequency domain data in each time sliding window, inputting the amplitude and the phase of at least one frequency doubling in the frequency domain data into a preset LSTM model, comparing the amplitude and the phase of the same frequency doubling and different frequency doubling, determining abnormal frequency doubling, determining the time sliding window with abnormality according to the amplitude and the phase of the abnormal frequency doubling, further determining the abnormal time period in the time domain data of the equipment to be detected, determining the abnormal time period in the time domain data by comparing the characteristics of each frequency doubling in the frequency domain data in the time sliding window, realizing automatic detection, reducing workload, and improving the accuracy of abnormal detection and the abnormal detection efficiency.

Description

Equipment abnormality detection method and device, and storage medium
Technical Field
The invention relates to the technical field of Internet of things, in particular to a method and a device for detecting equipment abnormity and a storage medium.
Background
Currently, the internet of things refers to a huge network formed by combining various information sensing devices, which acquire various required information such as any object or process needing monitoring, connection and interaction in real time, and the internet. The purpose of the Internet of things is to realize connection between objects, objects and people and between objects and people and a network, and facilitate identification, management and control. Therefore, it is necessary to manage and monitor the states of the devices in the internet of things in real time and detect whether the devices are abnormal.
At present, a method for detecting whether equipment in the internet of things is abnormal mainly includes obtaining a frequency spectrogram of each equipment, comparing some parameters in the frequency spectrogram with corresponding abnormal parameters, and judging whether the equipment is abnormal. The anomaly detection method needs to summarize the anomaly parameters by depending on human experience, and is large in workload, poor in anomaly detection accuracy and low in detection efficiency due to incomplete summarization, and is not suitable for mass equipment.
Disclosure of Invention
The present invention is directed to solving, at least to some extent, one of the technical problems in the related art.
Therefore, the first purpose of the invention is to provide an equipment abnormality detection method, which is used for solving the problems of poor accuracy and low efficiency of abnormality detection of equipment of the internet of things in the prior art.
A second object of the present invention is to provide a device abnormality detection apparatus.
A third object of the present invention is to provide another device abnormality detection apparatus.
A fourth object of the invention is to propose a non-transitory computer-readable storage medium.
A fifth object of the invention is to propose a computer program product.
In order to achieve the above object, an embodiment of a first aspect of the present invention provides an apparatus anomaly detection method, including:
acquiring time domain data of equipment to be detected, wherein the time domain data represents a time sequence of data sent by the equipment to be detected; the device to be detected is a device for periodically sending data;
adopting a preset time sliding window to slide on the time sequence to obtain time domain data in each time sliding window;
converting the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
and inputting the frequency domain data in each time sliding window into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
Further, the step of inputting the frequency domain data in each time sliding window into a preset LSTM model to obtain an abnormal time period in the time domain data of the device to be detected includes:
generating at least one frequency multiplication amplitude sequence and phase sequence according to the frequency domain data in each time sliding window;
and inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
Further, the abnormal time period is a time sliding window in which an abnormality exists in the corresponding frequency domain data, or a time interval in which an abnormality exists in the time sliding window.
Further, when the abnormal time period is a time sliding window where the corresponding frequency domain data is abnormal, the method further includes, after the frequency domain data in each time sliding window is input into a preset LSTM model and the abnormal time period in the time domain data of the device to be detected is obtained:
for each time interval in the time domain data, acquiring a plurality of time sliding windows comprising the time interval; the length of the time interval is equal to the step length of each sliding of the time sliding window;
acquiring the number of abnormal time sliding windows in the plurality of time sliding windows;
and when the ratio of the number to the total number of the time sliding windows including the time interval is greater than a preset ratio, determining the time interval as the time interval with abnormality.
Further, before acquiring the time domain data of the device to be detected, the method further includes:
obtaining an initial LSTM model;
obtaining sample data of a device to be detected, wherein the sample data comprises: the time domain data sample of the equipment to be detected, and abnormal time periods and non-abnormal time periods in the time domain data sample;
and training the initial LSTM model by adopting the sample data to obtain the preset LSTM model.
The equipment anomaly detection method provided by the embodiment of the invention comprises the steps of adopting a preset time sliding window to slide on a time sequence of time domain data of equipment to be detected, acquiring the time domain data and frequency domain data in each time sliding window, inputting the amplitude and phase of at least one frequency doubling in the frequency domain data into a preset LSTM model, comparing the amplitude and phase of the same frequency doubling and different frequency doubling, determining the abnormal time sliding window according to the amplitude and phase of the abnormal frequency doubling, and further determining the abnormal time period in the time domain data of the equipment to be detected, so that the abnormal time period in the time domain data is determined by comparing the characteristics of each frequency doubling in the frequency domain data in the time sliding window, the automatic detection is realized, the workload is reduced, and the accuracy of the anomaly detection and the anomaly detection efficiency are improved.
In order to achieve the above object, a device abnormality detection apparatus according to a second embodiment of the present invention includes:
the acquisition module is used for acquiring time domain data of the equipment to be detected, and the time domain data represents a time sequence of data transmission of the equipment to be detected; the device to be detected is a device for periodically sending data;
the acquisition module is further configured to slide on the time sequence by using a preset time sliding window to acquire time domain data in each time sliding window;
the transformation module is used for transforming the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
and the input module is used for inputting the frequency domain data in each time sliding window into a preset LSTM model and acquiring the abnormal time period in the time domain data of the equipment to be detected.
Further, the input module is specifically configured to,
generating at least one frequency multiplication amplitude sequence and phase sequence according to the frequency domain data in each time sliding window;
and inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
Further, the abnormal time period is a time sliding window in which an abnormality exists in the corresponding frequency domain data, or a time interval in which an abnormality exists in the time sliding window.
Further, the device further comprises: a determination module;
the obtaining module is further configured to obtain, for each time interval in the time domain data, a plurality of time sliding windows including the time interval when the abnormal time period is a time sliding window in which the corresponding frequency domain data is abnormal; the length of the time interval is equal to the step length of each sliding of the time sliding window;
the obtaining module is further configured to obtain the number of time sliding windows with an exception in the plurality of time sliding windows;
the determining module is used for determining the time interval as the abnormal time interval when the ratio of the number to the total number of the time sliding windows including the time interval is larger than a preset ratio.
Further, the device further comprises: a training module;
the acquisition module is further used for acquiring an initial LSTM model;
the obtaining module is further configured to obtain sample data of the device to be tested, where the sample data includes: the time domain data sample of the equipment to be detected, and abnormal time periods and non-abnormal time periods in the time domain data sample;
and the training module is used for training the initial LSTM model by adopting the sample data to obtain the preset LSTM model.
The device anomaly detection device provided by the embodiment of the invention adopts the preset time sliding window to slide on the time sequence of the time domain data of the device to be detected, so as to obtain the time domain data and the frequency domain data in each time sliding window, inputs the amplitude and the phase of at least one frequency doubling in the frequency domain data into the preset LSTM model, compares the amplitude and the phase between the same frequency doubling and different frequency doubling, determines the abnormal time sliding window according to the amplitude and the phase of the abnormal frequency doubling, and further determines the abnormal time period in the time domain data of the device to be detected, thereby determining the abnormal time period in the time domain data by comparing the characteristics of each frequency doubling in the frequency domain data in the time sliding window, realizing automatic detection, reducing the workload, and improving the accuracy of anomaly detection and the anomaly detection efficiency.
In order to achieve the above object, a device abnormality detection apparatus according to a third embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the device abnormality detection method as described above when executing the program.
To achieve the above object, a fourth aspect of the present invention provides a non-transitory computer-readable storage medium, wherein instructions of the storage medium, when executed by a processor, implement the method as described above.
To achieve the above object, a fifth aspect of the present invention provides a computer program product, wherein when executed by an instruction processor of the computer program product, a device anomaly detection method is performed, and the method includes:
acquiring time domain data of equipment to be detected, wherein the time domain data represents a time sequence of data sent by the equipment to be detected; the device to be detected is a device for periodically sending data;
adopting a preset time sliding window to slide on the time sequence to obtain time domain data in each time sliding window;
converting the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
and inputting the frequency domain data in each time sliding window into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
The foregoing and/or additional aspects and advantages of the present invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:
fig. 1 is a schematic flowchart of an apparatus anomaly detection method according to an embodiment of the present invention;
fig. 2 is a schematic flow chart of another method for detecting device abnormality according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a time series of time domain data and a sliding of a time sliding window over the time series;
fig. 4 is a schematic structural diagram of an apparatus anomaly detection device according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of another apparatus abnormality detection device according to an embodiment of the present invention;
fig. 6 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are illustrative and intended to be illustrative of the invention and are not to be construed as limiting the invention.
A device abnormality detection method and apparatus, and a storage medium according to an embodiment of the present invention are described below with reference to the drawings.
Fig. 1 is a schematic flow chart of an apparatus anomaly detection method according to an embodiment of the present invention. As shown in fig. 1, the apparatus abnormality detection method includes the steps of:
s101, acquiring time domain data of equipment to be detected, wherein the time domain data represents a time sequence of data sent by the equipment to be detected; the device to be detected is a device which periodically transmits data.
The execution main body of the equipment abnormality detection method provided by the invention is an equipment abnormality detection device, and the equipment abnormality detection device can be hardware equipment arranged in the Internet of things or software installed in the hardware equipment.
In this embodiment, the device to be detected may be an information sensing device, such as a sensor, that sends data according to a certain period in the internet of things. Sensors such as temperature sensors, pressure sensors, etc. The information sensing device generally sends data at a certain period, and if the data is not sent at the certain period, for example, the data is not sent within a period of time, or the data is not sent at a certain period, it indicates that the information sensing device is abnormal. The time domain data of the device to be detected can be a time sequence formed by a plurality of time points of data sent by the device to be detected. Taking a temperature sensor as an example, if the temperature sensor transmits data once per second, when the temperature sensor is not abnormal, the time domain data of the temperature sensor may be a time series composed of time points such as 1 hour, 1 minute, 1 second, 1 minute, 2 seconds, 1 hour, 1 minute, 3 seconds, 1 minute, 4 seconds, and the like. If the temperature sensor is abnormal, for example, the time point of 1 hour, 1 minute and 2 seconds is less in the time sequence, or the time point of 1 hour, 1 minute and 2 seconds is modified to 1 hour, 1 minute and 2.1 seconds, etc., the abnormal condition of the temperature sensor and the abnormal time period can be detected by the equipment abnormality detection method of the present invention. It should be noted that the device abnormality detection method provided by the present invention is suitable for detecting the state of a device that periodically transmits data.
In this embodiment, the mode of acquiring the time domain data of the device to be detected by the device abnormality detection apparatus may be directly acquiring the time domain data from the device to be detected, or acquiring the time domain data from hardware devices in which the time domain data of each device is stored in the internet of things.
S102, sliding on the time sequence by adopting a preset time sliding window to obtain time domain data in each time sliding window.
In this embodiment, the step size of the time sliding window needs to be much smaller than the step size of the time sequence, for example, smaller than one fiftieth of the step size of the time sequence. For example, in the case where the time series includes N time points, that is, the step size of the time series is N, the step size M of the time sliding window needs to be much smaller than N.
S103, converting the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency.
In this embodiment, the frequency domain data includes: amplitude and phase at each frequency and corresponding frequency. When the waveform corresponding to the time domain data is a sine wave and the frequency of the sine wave is a first frequency, the time domain data in the time sliding window is transformed, the amplitude of the obtained frequency domain data on the first frequency is a nonzero value, and the amplitude of the obtained frequency domain data on other frequencies is a zero value. When the time domain data is the time domain data of the temperature sensor mentioned in step 101, the waveform corresponding to the time domain data is not a single sine wave, but is a combination of sine waves of multiple frequencies, the time domain data in the time sliding window is transformed, and the amplitude of the obtained frequency domain data is nonzero at multiple frequencies. In this embodiment, the time domain data of the device to be detected that is not abnormal and the time domain data of the device to be detected that is abnormal are both formed by combining sine waves of a plurality of frequencies. However, if the time domain data of the device to be detected is different, the corresponding frequency domain data is different, that is, the frequency with the amplitude value of non-zero value is different, or the amplitude values on the same frequency are different, so that the frequency domain data of the device to be detected can be analyzed to determine whether the device to be detected is abnormal. The frequency domain data mentioned in this embodiment may be part of the above mentioned frequency domain data, such as the amplitude and phase at a specific frequency, for example, the amplitude and phase of 0.5 times frequency, the amplitude and phase of 1 time frequency, the amplitude and phase of 2 times frequency, the amplitude and phase of 4 times frequency, and so on.
The method for the device anomaly detection apparatus to transform the time domain data in each time sliding window to obtain the frequency domain data may specifically be fourier transform, fast fourier transform, laplace transform, or the like, and is not specifically limited here and may be selected as needed.
And S104, inputting the frequency domain data in each time sliding window into a preset LSTM model, and acquiring abnormal time periods in the time domain data of the device to be detected.
The input of the preset LSTM model may be frequency domain data in each time sliding window, and the output may be a result of determining whether the time sliding window is abnormal. Further, before step 101, the method may further include: obtaining an initial LSTM model; obtaining sample data of a device to be detected, wherein the sample data comprises: the method comprises the following steps that time domain data samples of equipment to be detected, abnormal time periods and non-abnormal time periods in the time domain data samples are detected; and training the initial LSTM model by adopting the sample data to obtain a preset LSTM model. In addition, the sample data may further include: the length of the time sliding window.
The abnormal time period may be a time period corresponding to the abnormal time sliding window, or a time interval in which an abnormality exists in the time sliding window. Specifically, the process of the device anomaly detection apparatus executing step 104 may specifically be that at least one frequency-doubled amplitude sequence and phase sequence are generated according to the frequency domain data in each time sliding window; and inputting the amplitude sequence and the phase sequence of various frequency doubling into a preset LSTM model to obtain the abnormal time period in the time domain data of the equipment to be detected.
Specifically, the process of training the initial LSTM model by the device anomaly detection apparatus may specifically be (1) acquiring an anomaly time period and a normal time period in time domain data of the device to be detected in advance; sliding the time sliding window on an abnormal time period of the time domain data to obtain an abnormal time sliding window; and adopting the time sliding window to slide on the normal time period of the time domain data to obtain a normal time sliding window, and transforming the time domain data in each time sliding window to obtain abnormal frequency domain data and normal frequency domain data. For example, for the same time sliding window, the amplitude of the 1-time multiplier is N1, the amplitude of the 2-time multiplier is N2, and the relationship between the amplitudes of the 1-time multiplier and the 2-time multiplier is N1/N2; the amplitude of the 1 frequency multiplication in the abnormal frequency domain data is N3, the amplitude of the 2 frequency multiplication is N4, and the relation between the amplitudes of the 1 frequency multiplication and the 2 frequency multiplication is N3/N4; that is, the amplitude and phase at a particular frequency in the normal frequency domain data are different from the amplitude and phase at a particular frequency in the abnormal frequency domain data for the same time sliding window. (2) Acquiring at least one frequency multiplication amplitude sequence and phase sequence in the abnormal frequency domain data according to the abnormal frequency domain data; acquiring at least one frequency multiplication amplitude sequence and phase sequence in the normal frequency domain data according to the normal frequency domain data; and training the initial LSTM model according to at least one frequency doubling amplitude sequence and phase sequence in the abnormal frequency domain data and at least one frequency doubling amplitude sequence and phase sequence in the normal frequency domain data, so that the trained LSTM model can determine whether the time sliding window is abnormal or not according to at least one frequency doubling amplitude sequence and phase sequence in the frequency domain data in the time sliding window.
Specifically, the process of determining the abnormal time period in the time domain data of the device to be detected by the device abnormality detection apparatus according to the frequency domain data in each time sliding window may specifically be (1) generating at least one frequency-doubled amplitude sequence and phase sequence according to the frequency domain data in each time sliding window; (2) inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model, obtaining frequency multiplication with abnormal amplitude or phase, determining which time sliding window the frequency multiplication amplitude or phase comes from according to the frequency multiplication amplitude and phase, determining the time sliding window as the abnormal time sliding window, and determining the time period corresponding to the time sliding window in the time domain data of the device to be detected as the abnormal time period. For example, the LSTM model may analyze a single data, for example, a change in amplitude of 1-fold frequency, and may compare relationships between different data at the same time, for example, a relationship between 1-fold frequency and 2-fold frequency amplitudes, to determine frequency-doubled with an anomaly in various frequency-doubled amplitude sequences and phase sequences, and determine a time sliding window with an anomaly according to the amplitude and phase of the frequency-doubled frequency, thereby determining an anomaly time period.
The following examples are given. Supposing that the time domain data of the equipment to be detected is x1,x2,...,xN，x1，x2Wait for the time point, x, at which the device to be detected transmits data1,x2,...,xNAnd sending a time sequence consisting of a plurality of time points of data for the equipment to be detected. And constructing a time sliding window of M steps, wherein M < N, transforming the time domain data positioned in the time sliding window by Fast Fourier Transformation (FFT), and extracting frequency domain data, for example, comprising 0.5 multiplied frequency amplitude and phase, 1 multiplied frequency amplitude and phase, 2 multiplied frequency amplitude and phase and 4 multiplied frequency amplitude and phase. And sliding the time sliding window to the right by M/K steps, wherein K can be odd numbers such as 5, 7, 9 and the like, converting the time domain data in the time sliding window into frequency domain data by using FFT again, and extracting amplitude and phase characteristics. This process is repeated until the time sliding window has slid to the end of the time domain data, so that the amplitude and phase within the multiple time sliding windows can be obtained. And respectively combining the amplitude and the phase of 0.5 frequency doubling, the amplitude and the phase of 1 frequency doubling, the amplitude and the phase of 2 frequency doubling and the amplitude and the phase of 4 frequency doubling in each time sliding window to obtain 8 groups of data, wherein each group of data is a sequence, and the 8 groups of data comprise a 0.5 frequency doubling amplitude sequence, a 0.5 frequency doubling phase sequence, a 1 frequency doubling amplitude sequence, a 1 frequency doubling phase sequence, a 2 frequency doubling amplitude sequence, a 2 frequency doubling phase sequence, a 4 frequency doubling amplitude sequence and a 4 frequency doubling phase sequence. The obtained 8 groups of data are input into a long-short Term Memory network model (LSTM) as input data for anomaly detection.
For example, assume that the step length of the time sequence of the time domain data of the device to be detected is 10000, i.e. the time domain data includes 10000 time points; the step size of the time sliding window is 100, that is, 100 time points can be included in the time sliding window; the step size of each time of the time sliding window is 100/5 ═ 20, that is, each time of 20 time points, the sliding times of the time sliding window can be (10000-. Correspondingly, the amount of data included in each set of data may be 496, for example, 496 amplitudes may be included in a 0.5-times-multiplied amplitude sequence.
The equipment anomaly detection method provided by the embodiment of the invention comprises the steps of adopting a preset time sliding window to slide on a time sequence of time domain data of equipment to be detected, acquiring the time domain data and frequency domain data in each time sliding window, inputting the amplitude and phase of at least one frequency doubling in the frequency domain data into a preset LSTM model, comparing the amplitude and phase of the same frequency doubling and different frequency doubling, determining the abnormal time sliding window according to the amplitude and phase of the abnormal frequency doubling, and further determining the abnormal time period in the time domain data of the equipment to be detected, so that the abnormal time period in the time domain data is determined by comparing the characteristics of each frequency doubling in the frequency domain data in the time sliding window, the automatic detection is realized, the workload is reduced, and the accuracy of the anomaly detection and the anomaly detection efficiency are improved.
Fig. 2 is a schematic flowchart of another method for detecting device abnormality according to an embodiment of the present invention. As shown in fig. 2, in a case where the device to be detected is frequently abnormal, the detected abnormal time period may be a continuous long time period, which may cause the device abnormality detection apparatus to be unable to accurately locate the time point when the device to be detected is abnormal, and in order to accurately locate the time point or the time period when the device to be detected is abnormal, the accuracy and the stability of device abnormality detection are further improved, on the basis of the embodiment shown in fig. 1, after step 104, the method may further include the following steps:
s105, aiming at each time interval in the time domain data, acquiring a plurality of time sliding windows comprising the time interval; the length of the time interval is equal to the step length of each sliding of the time sliding window.
Fig. 3 is a schematic diagram of a time sequence of time domain data and a sliding of a time sliding window on the time sequence. In fig. 3, each small segment of the time series identifies a time interval, and each time sliding window comprises 5 time intervals, that is, during the sliding of the time sliding window, the step size of each sliding is one time interval.
And S106, acquiring the number of the abnormal time sliding windows in the plurality of time sliding windows.
For example, for the fifth time interval, in the process of sliding the time sliding window, the time sliding windows including the time interval are time sliding window 1, time sliding window 2, time sliding window 3, time sliding window 4 and time sliding window 5 in fig. 3. According to the position of the abnormal time period in step 104 in the embodiment shown in fig. 1, it may be determined whether the 5 time sliding windows are abnormal, and the number of abnormal time sliding windows in the 5 time sliding windows is obtained, for example, if the time sliding window 1 and the time sliding window 2 are abnormal, and the time sliding window 3, the time sliding window 4, and the time sliding window 5 are not abnormal, the number of abnormal time sliding windows in the 5 time sliding windows is 2.
S107, when the ratio of the number of the abnormal time sliding windows to the total number of the time sliding windows including the time interval is larger than a preset ratio, determining the time interval as the abnormal time interval.
For example, assume that the preset ratio is 0.5. In the above example, if the total number of time sliding windows including the fifth time interval is 5, where the number of abnormal time sliding windows is 2, the ratio of the number of abnormal time sliding windows to the total number of time sliding windows including the fifth time interval is 0.4, and 0.4 is less than 0.5, the fifth time interval is determined to be the normal time interval.
If the time sliding windows 1, 2 and 3 are abnormal and the time sliding windows 4 and 5 are not abnormal in the 5 time sliding windows including the fifth time interval, the ratio of the number of the abnormal time sliding windows to the total number of the time sliding windows including the fifth time interval is 0.6, and 0.6 is greater than 0.5, the fifth time interval can be determined to be the abnormal time interval.
In this embodiment, for each time interval in each time sliding window, according to the state of each time sliding window including the time interval, whether the time interval is abnormal or not may be determined, so as to reduce the length of the time period in which the abnormality occurs, avoid the long time period in which the detected abnormal time period may be continuous, accurately position the time point in which the abnormality occurs in the device to be detected under the condition that the abnormality frequently occurs in the device to be detected, and further improve the accuracy and stability of the device abnormality detection.
The equipment abnormity detection method of the embodiment of the invention comprises the steps of adopting a preset time sliding window to slide on a time sequence of time domain data of equipment to be detected, acquiring the time domain data and frequency domain data in each time sliding window, inputting the amplitude and phase of at least one frequency doubling in the frequency domain data into a preset LSTM model, comparing the amplitude and phase of the same frequency doubling and different frequency doubling, determining the abnormal time sliding window according to the amplitude and phase of the abnormal frequency doubling, aiming at each time interval in each time sliding window, determining whether the time interval is abnormal according to the state of each time sliding window comprising the time interval, thereby reducing the length of the time interval in which the abnormity occurs, avoiding the abnormal time interval obtained by detection possibly being a continuous long time interval, and accurately positioning the time point in which the equipment to be detected is abnormal under the condition that the equipment to be detected frequently occurs abnormity, the accuracy and the stability of equipment abnormity detection are further improved.
Fig. 4 is a schematic structural diagram of an apparatus anomaly detection device according to an embodiment of the present invention. As shown in fig. 4, includes: an acquisition module 41, a transformation module 42 and an input module 43.
The acquiring module 41 is configured to acquire time domain data of a device to be detected, where the time domain data represents a time sequence of data transmission of the device to be detected; the device to be detected is a device for periodically sending data;
the obtaining module 41 is further configured to slide on the time sequence by using a preset time sliding window, and obtain time domain data in each time sliding window;
a transformation module 42, configured to transform the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
and the input module 43 is configured to input the frequency domain data in each time sliding window into a preset LSTM model, and acquire an abnormal time period in the time domain data of the device to be detected.
The device abnormality detection device provided by the invention can be hardware equipment arranged in the internet of things or software installed in the hardware equipment. In this embodiment, the device to be detected may be an information sensing device, such as a sensor, that sends data according to a certain period in the internet of things. Sensors such as temperature sensors, pressure sensors, etc. The information sensing device generally sends data at a certain period, and if the data is not sent at the certain period, for example, the data is not sent within a period of time, or the data is not sent at a certain period, it indicates that the information sensing device is abnormal. The time domain data of the device to be detected can be a time sequence formed by a plurality of time points of data sent by the device to be detected. Taking a temperature sensor as an example, if the temperature sensor transmits data once per second, when the temperature sensor is not abnormal, the time domain data of the temperature sensor may be a time series composed of time points such as 1 hour, 1 minute, 1 second, 1 minute, 2 seconds, 1 hour, 1 minute, 3 seconds, 1 minute, 4 seconds, and the like. If the temperature sensor is abnormal, for example, the time point of 1 hour, 1 minute and 2 seconds is less in the time sequence, or the time point of 1 hour, 1 minute and 2 seconds is modified to 1 hour, 1 minute and 2.1 seconds, etc., the abnormal condition of the temperature sensor and the abnormal time period can be detected by the equipment abnormality detection method of the present invention. It should be noted that the device abnormality detection method provided by the present invention is suitable for detecting the state of a device that periodically transmits data.
In this embodiment, the mode of acquiring the time domain data of the device to be detected by the device abnormality detection apparatus may be directly acquiring the time domain data from the device to be detected, or acquiring the time domain data from hardware devices in which the time domain data of each device is stored in the internet of things.
In this embodiment, the frequency domain data includes: amplitude and phase at each frequency and corresponding frequency. When the waveform corresponding to the time domain data is a sine wave and the frequency of the sine wave is a first frequency, the time domain data in the time sliding window is transformed, the amplitude of the obtained frequency domain data on the first frequency is a nonzero value, and the amplitude of the obtained frequency domain data on other frequencies is a zero value. When the time domain data is the time domain data of the temperature sensor mentioned in step 101, the waveform corresponding to the time domain data is not a single sine wave, but is a combination of sine waves of multiple frequencies, the time domain data in the time sliding window is transformed, and the amplitude of the obtained frequency domain data is nonzero at multiple frequencies. In this embodiment, the time domain data of the device to be detected that is not abnormal and the time domain data of the device to be detected that is abnormal are both formed by combining sine waves of a plurality of frequencies. However, if the time domain data of the device to be detected is different, the corresponding frequency domain data is different, that is, the frequency with the amplitude value of non-zero value is different, or the amplitude values on the same frequency are different, so that the frequency domain data of the device to be detected can be analyzed to determine whether the device to be detected is abnormal. The frequency domain data mentioned in this embodiment may be part of the above mentioned frequency domain data, such as the amplitude and phase at a specific frequency, for example, the amplitude and phase of 0.5 times frequency, the amplitude and phase of 1 time frequency, the amplitude and phase of 2 times frequency, the amplitude and phase of 4 times frequency, and so on.
The input of the preset LSTM model may be frequency domain data in each time sliding window, and the output may be a result of determining whether the time sliding window is abnormal. Further, on the basis of the above embodiment, the apparatus may further include: a training module;
the acquisition module is further used for acquiring an initial LSTM model;
the obtaining module is further configured to obtain sample data of the device to be tested, where the sample data includes: the time domain data sample of the equipment to be detected, and abnormal time periods and non-abnormal time periods in the time domain data sample;
and the training module is used for training the initial LSTM model by adopting the sample data to obtain the preset LSTM model.
The abnormal time period may be a time period corresponding to the abnormal time sliding window, or a time interval in which an abnormality exists in the time sliding window. Specifically, the input module 43 is specifically configured to generate at least one frequency-doubled amplitude sequence and phase sequence according to the frequency domain data in each time sliding window; and inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
Specifically, the process of training the initial LSTM model by the device anomaly detection apparatus may specifically be (1) acquiring an anomaly time period and a normal time period in time domain data of the device to be detected in advance; sliding the time sliding window on an abnormal time period of the time domain data to obtain an abnormal time sliding window; and adopting the time sliding window to slide on the normal time period of the time domain data to obtain a normal time sliding window, and transforming the time domain data in each time sliding window to obtain abnormal frequency domain data and normal frequency domain data. For example, for the same time sliding window, the amplitude of the 1-time multiplier is N1, the amplitude of the 2-time multiplier is N2, and the relationship between the amplitudes of the 1-time multiplier and the 2-time multiplier is N1/N2; the amplitude of the 1 frequency multiplication in the abnormal frequency domain data is N3, the amplitude of the 2 frequency multiplication is N4, and the relation between the amplitudes of the 1 frequency multiplication and the 2 frequency multiplication is N3/N4; that is, the amplitude and phase at a particular frequency in the normal frequency domain data are different from the amplitude and phase at a particular frequency in the abnormal frequency domain data for the same time sliding window. (2) Acquiring at least one frequency multiplication amplitude sequence and phase sequence in the abnormal frequency domain data according to the abnormal frequency domain data; acquiring at least one frequency multiplication amplitude sequence and phase sequence in the normal frequency domain data according to the normal frequency domain data; and training the initial LSTM model according to at least one frequency doubling amplitude sequence and phase sequence in the abnormal frequency domain data and at least one frequency doubling amplitude sequence and phase sequence in the normal frequency domain data, so that the trained LSTM model can determine whether the time sliding window is abnormal or not according to at least one frequency doubling amplitude sequence and phase sequence in the frequency domain data in the time sliding window.
Specifically, the process of determining the abnormal time period in the time domain data of the device to be detected by the device abnormality detection apparatus according to the frequency domain data in each time sliding window may specifically be (1) generating at least one frequency-doubled amplitude sequence and phase sequence according to the frequency domain data in each time sliding window; (2) inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model, obtaining frequency multiplication with abnormal amplitude or phase, determining which time sliding window the frequency multiplication amplitude or phase comes from according to the frequency multiplication amplitude and phase, determining the time sliding window as the abnormal time sliding window, and determining the time period corresponding to the time sliding window in the time domain data of the device to be detected as the abnormal time period. For example, the LSTM model may analyze a single data, for example, a change in amplitude of 1-fold frequency, and may compare relationships between different data at the same time, for example, a relationship between 1-fold frequency and 2-fold frequency amplitudes, to determine frequency-doubled with an anomaly in various frequency-doubled amplitude sequences and phase sequences, and determine a time sliding window with an anomaly according to the amplitude and phase of the frequency-doubled frequency, thereby determining an anomaly time period.
The following examples are given. Supposing that the time domain data of the equipment to be detected is x1,x2,...,xNAnd constructing a time sliding window of M steps, wherein M < N, transforming the time domain data in the time sliding window by Fast Fourier Transform (FFT), and extracting frequency domain data, for example, comprising 0.5 multiplied amplitude and phase, 1 multiplied amplitude and phase, 2 multiplied amplitude and phase, and 4 multiplied amplitude and phase. And sliding the time sliding window to the right by M/K steps, wherein K can be odd numbers such as 5, 7, 9 and the like, converting the time domain data in the time sliding window into frequency domain data by using FFT again, and extracting amplitude and phase characteristics. This process is repeated until the time sliding window has slid to the end of the time domain data, so that the amplitude and phase within the multiple time sliding windows can be obtained. Respectively combining the amplitude and phase of 0.5 frequency doubling, the amplitude and phase of 1 frequency doubling, the amplitude and phase of 2 frequency doubling and the amplitude and phase of 4 frequency doubling in each time sliding window to obtain 8 groups of data, wherein each group of data is a sequence, and the 8 groups of data are a 0.5 frequency doubling amplitude sequence and a 0.5 frequency doubling phase sequenceThe frequency multiplication device comprises a frequency multiplication device and a frequency multiplication device, wherein the frequency multiplication device comprises a 1 frequency multiplication amplitude sequence, a 1 frequency multiplication phase sequence, a 2 frequency multiplication amplitude sequence, a 2 frequency multiplication phase sequence, a 4 frequency multiplication amplitude sequence and a 4 frequency multiplication phase sequence. The obtained 8 groups of data are input into a Long Short-Term Memory network model (LSTM) as input data for anomaly detection.
The device anomaly detection device provided by the embodiment of the invention adopts the preset time sliding window to slide on the time sequence of the time domain data of the device to be detected, so as to obtain the time domain data and the frequency domain data in each time sliding window, inputs the amplitude and the phase of at least one frequency doubling in the frequency domain data into the preset LSTM model, compares the amplitude and the phase between the same frequency doubling and different frequency doubling, determines the abnormal time sliding window according to the amplitude and the phase of the abnormal frequency doubling, and further determines the abnormal time period in the time domain data of the device to be detected, thereby determining the abnormal time period in the time domain data by comparing the characteristics of each frequency doubling in the frequency domain data in the time sliding window, realizing automatic detection, reducing the workload, and improving the accuracy of anomaly detection and the anomaly detection efficiency.
In order to accurately locate the abnormal time point or time period of the equipment to be detected, and further improve the accuracy and stability of the equipment abnormality detection, in combination with fig. 5, on the basis of the embodiment shown in fig. 4, the apparatus may further include: a determination module 44;
when the abnormal time period is a time sliding window in which the corresponding frequency domain data is abnormal, the obtaining module 41 is further configured to obtain, for each time interval in the time domain data, a plurality of time sliding windows including the time interval; the length of the time interval is equal to the step length of each sliding of the time sliding window;
the obtaining module 41 is further configured to obtain the number of time sliding windows with an exception in the plurality of time sliding windows;
the determining module 44 is configured to determine that the time interval is an abnormal time interval when a ratio of the number to the total number of time sliding windows including the time interval is greater than a preset ratio.
Fig. 3 is a schematic diagram of a time sequence of time domain data and a sliding of a time sliding window on the time sequence. In fig. 3, each small segment of the time series identifies a time interval, and each time sliding window comprises 5 time intervals, that is, during the sliding of the time sliding window, the step size of each sliding is one time interval. For example, for the fifth time interval, in the process of sliding the time sliding window, the time sliding windows including the time interval are time sliding window 1, time sliding window 2, time sliding window 3, time sliding window 4 and time sliding window 5 in fig. 3. According to the position of the abnormal time period in step 104 in the embodiment shown in fig. 1, it may be determined whether the 5 time sliding windows are abnormal, and the number of abnormal time sliding windows in the 5 time sliding windows is obtained, for example, if the time sliding window 1 and the time sliding window 2 are abnormal, and the time sliding window 3, the time sliding window 4, and the time sliding window 5 are not abnormal, the number of abnormal time sliding windows in the 5 time sliding windows is 2.
For example, assume that the preset ratio is 0.5. In the above example, if the total number of time sliding windows including the fifth time interval is 5, where the number of abnormal time sliding windows is 2, the ratio of the number of abnormal time sliding windows to the total number of time sliding windows including the fifth time interval is 0.4, and 0.4 is less than 0.5, the fifth time interval is determined to be the normal time interval.
If the time sliding windows 1, 2 and 3 are abnormal and the time sliding windows 4 and 5 are not abnormal in the 5 time sliding windows including the fifth time interval, the ratio of the number of the abnormal time sliding windows to the total number of the time sliding windows including the fifth time interval is 0.6, and 0.6 is greater than 0.5, the fifth time interval can be determined to be the abnormal time interval.
In this embodiment, for each time interval in each time sliding window, according to the state of each time sliding window including the time interval, whether the time interval is abnormal or not may be determined, so as to reduce the length of the time period in which the abnormality occurs, avoid the long time period in which the detected abnormal time period may be continuous, accurately position the time point in which the abnormality occurs in the device to be detected under the condition that the abnormality frequently occurs in the device to be detected, and further improve the accuracy and stability of the device abnormality detection.
The device anomaly detection device of the embodiment of the invention acquires time domain data and frequency domain data in each time sliding window by adopting a preset time sliding window to slide on a time sequence of time domain data of a device to be detected, inputs the amplitude and the phase of at least one frequency doubling in the frequency domain data into a preset LSTM model, compares the amplitude and the phase of the same frequency doubling and different frequency doubling, determines the abnormal time sliding window according to the amplitude and the phase of the abnormal frequency doubling, and can determine whether the time interval is abnormal or not according to the state of each time sliding window comprising the time interval aiming at each time interval in each time sliding window, thereby reducing the length of the time interval in which the abnormality occurs, avoiding that the detected abnormal time interval can be a continuous longer time interval, and accurately positioning the time point in which the device to be detected has the abnormality under the condition that the device to be detected frequently has the abnormality, the accuracy and the stability of equipment abnormity detection are further improved.
In order to implement the above embodiment, the present invention further provides another apparatus abnormality detecting device, including:
a memory, a processor, and a computer program stored on the memory and executable on the processor.
The processor implements the device abnormality detection method provided in the above-described embodiment when executing the program.
In order to achieve the above embodiments, the present invention also provides a non-transitory computer-readable storage medium having stored thereon a computer program characterized in that the program implements the device abnormality detection method as described above when executed by a processor.
To implement the above embodiments, the present invention also provides a computer program product, which when executed by an instruction processor performs a device anomaly detection method, the method comprising:
acquiring time domain data of equipment to be detected, wherein the time domain data represents a time sequence of data sent by the equipment to be detected; the device to be detected is a device for periodically sending data;
adopting a preset time sliding window to slide on the time sequence to obtain time domain data in each time sliding window;
converting the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
and inputting the frequency domain data in each time sliding window into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
FIG. 6 illustrates a block diagram of an exemplary computer device suitable for use to implement embodiments of the present application. The computer device 72 shown in fig. 6 is only an example and should not bring any limitation to the function and scope of use of the embodiments of the present application.
As shown in FIG. 6, the computer device 72 is in the form of a general purpose computing device. The components of the computer device 72 may include, but are not limited to: one or more processors or processing units 76, a system memory 28, and a bus 18 that couples various system components including the system memory 28 and the processing unit 76.
Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. These architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, to name a few.
Computer device 72 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer device 72 and includes both volatile and nonvolatile media, removable and non-removable media.
Memory 28 may include computer system readable media in the form of volatile Memory, such as Random Access Memory (RAM) 30 and/or cache Memory 62. The computer device 72 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 64 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 6, commonly referred to as a "hard drive"). Although not shown in FIG. 6, a disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a Compact disk Read Only memory (CD-ROM), a Digital versatile disk Read Only memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 18 by one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the application.
A program/utility 40 having a set (at least one) of program modules 32 may be stored, for example, in memory 28, such program modules 32 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination thereof may comprise an implementation of a network environment. Program modules 32 generally perform the functions and/or methodologies of the embodiments described herein.
The computer device 72 may also communicate with one or more external devices 74 (e.g., keyboard, pointing device, display 54, etc.), with one or more devices that enable a user to interact with the computer system/server 72, and/or with any devices (e.g., network card, modem, etc.) that enable the computer system/server 72 to communicate with one or more other computing devices. Such communication may be through an input/output (I/O) interface 52. Also, the computer device 72 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public Network such as the Internet via the Network adapter 20. As shown, the network adapter 20 communicates with the other modules of the computer device 72 over the bus 18. It should be appreciated that although not shown, other hardware and/or software modules may be used in conjunction with the computer device 72, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.
The processing unit 76 executes various functional applications and data processing, such as implementing the methods mentioned in the previous embodiments, by executing programs stored in the system memory 28.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing steps of a custom logic function or process, and alternate implementations are included within the scope of the preferred embodiment of the present invention in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present invention.
The logic and/or steps represented in the flowcharts or otherwise described herein, e.g., an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.
In addition, functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.
The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention, and that variations, modifications, substitutions and alterations can be made to the above embodiments by those of ordinary skill in the art within the scope of the present invention.

Claims (8)

1. An apparatus abnormality detection method characterized by comprising:
acquiring time domain data of equipment to be detected, wherein the time domain data represents a time sequence of data sent by the equipment to be detected; the device to be detected is a device for periodically sending data;
adopting a preset time sliding window to slide on the time sequence to obtain time domain data in each time sliding window;
converting the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
inputting the frequency domain data in each time sliding window into a preset LSTM model, and acquiring abnormal time periods in the time domain data of the equipment to be detected;
before the time domain data of the device to be detected is obtained, the method further comprises the following steps:
obtaining an initial LSTM model;
obtaining sample data of a device to be detected, wherein the sample data comprises: the time domain data sample of the equipment to be detected, and abnormal time periods and non-abnormal time periods in the time domain data sample;
and training the initial LSTM model by adopting the sample data to obtain the preset LSTM model.
2. The method according to claim 1, wherein the step of inputting the frequency domain data in each time sliding window into a preset LSTM model to obtain an abnormal time period in the time domain data of the device to be detected comprises:
generating at least one frequency multiplication amplitude sequence and phase sequence according to the frequency domain data in each time sliding window;
and inputting various frequency multiplication amplitude sequences and phase sequences into a preset LSTM model to obtain abnormal time periods in the time domain data of the equipment to be detected.
3. The method according to claim 1 or 2, wherein the abnormal time period is a time sliding window in which an abnormality exists in the corresponding frequency domain data, or a time interval in which an abnormality exists in the time sliding window.
4. The method according to claim 1, wherein when the abnormal time period is a time sliding window where the corresponding frequency domain data is abnormal, the method further comprises, after inputting the frequency domain data in each time sliding window into a preset LSTM model and obtaining the abnormal time period in the time domain data of the device to be detected:
for each time interval in the time domain data, acquiring a plurality of time sliding windows comprising the time interval; the length of the time interval is equal to the step length of each sliding of the time sliding window;
acquiring the number of abnormal time sliding windows in the plurality of time sliding windows;
and when the ratio of the number to the total number of the time sliding windows including the time interval is greater than a preset ratio, determining the time interval as the time interval with abnormality.
5. An apparatus abnormality detection device characterized by comprising:
the acquisition module is used for acquiring time domain data of the equipment to be detected, and the time domain data represents a time sequence of data transmission of the equipment to be detected; the device to be detected is a device for periodically sending data;
the acquisition module is further configured to slide on the time sequence by using a preset time sliding window to acquire time domain data in each time sliding window;
the transformation module is used for transforming the time domain data in each time sliding window to obtain frequency domain data in each time sliding window; the frequency domain data includes: at least one of amplitude and phase of the multiplied frequency;
the input module is used for inputting the frequency domain data in each time sliding window into a preset LSTM model and acquiring an abnormal time period in the time domain data of the equipment to be detected;
the apparatus may further comprise: a training module;
the acquisition module is further used for acquiring an initial LSTM model;
the obtaining module is further configured to obtain sample data of the device to be tested, where the sample data includes: the time domain data sample of the equipment to be detected, and abnormal time periods and non-abnormal time periods in the time domain data sample;
and the training module is used for training the initial LSTM model by adopting the sample data to obtain the preset LSTM model.
6. The apparatus of claim 5, further comprising: a determination module;
the obtaining module is further configured to obtain, for each time interval in the time domain data, a plurality of time sliding windows including the time interval when the abnormal time period is a time sliding window in which the corresponding frequency domain data is abnormal; the length of the time interval is equal to the step length of each sliding of the time sliding window;
the obtaining module is further configured to obtain the number of time sliding windows with an exception in the plurality of time sliding windows;
the determining module is used for determining the time interval as the abnormal time interval when the ratio of the number to the total number of the time sliding windows including the time interval is larger than a preset ratio.
7. An apparatus abnormality detection device characterized by comprising:
memory, processor and computer program stored on the memory and executable on the processor, characterized in that the processor implements the device anomaly detection method according to any one of claims 1 to 4 when executing the program.
8. A non-transitory computer-readable storage medium having stored thereon a computer program, wherein the program, when executed by a processor, implements the device anomaly detection method according to any one of claims 1-4.
CN201711348423.2A 2017-12-15 2017-12-15 Equipment abnormality detection method and device, and storage medium Active CN108063698B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711348423.2A CN108063698B (en) 2017-12-15 2017-12-15 Equipment abnormality detection method and device, and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711348423.2A CN108063698B (en) 2017-12-15 2017-12-15 Equipment abnormality detection method and device, and storage medium

Publications (2)

Publication Number Publication Date
CN108063698A CN108063698A (en) 2018-05-22
CN108063698B true CN108063698B (en) 2020-05-12

Family

ID=62139121

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711348423.2A Active CN108063698B (en) 2017-12-15 2017-12-15 Equipment abnormality detection method and device, and storage medium

Country Status (1)

Country Link
CN (1) CN108063698B (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108960303B (en) * 2018-06-20 2021-05-07 哈尔滨工业大学 Unmanned aerial vehicle flight data anomaly detection method based on LSTM
CN109034867B (en) * 2018-06-21 2022-10-25 腾讯科技（深圳）有限公司 Click traffic detection method and device and storage medium
CN109739720B (en) * 2018-12-04 2022-08-02 东软集团股份有限公司 Abnormality detection method, abnormality detection device, storage medium, and electronic apparatus
CN110595525B (en) * 2019-09-03 2020-12-15 精英数智科技股份有限公司 Method, device, system and medium for monitoring abnormality of downhole sensor
CN110516659A (en) * 2019-09-10 2019-11-29 哈工大机器人（山东）智能装备研究院 The recognition methods of ball-screw catagen phase, device, equipment and storage medium
US11349859B2 (en) * 2019-11-26 2022-05-31 International Business Machines Corporation Method for privacy preserving anomaly detection in IoT
CN111178456B (en) * 2020-01-15 2022-12-13 腾讯科技（深圳）有限公司 Abnormal index detection method and device, computer equipment and storage medium
CN111291096B (en) * 2020-03-03 2023-07-28 腾讯科技（深圳）有限公司 Data set construction method, device, storage medium and abnormal index detection method
CN111860569A (en) * 2020-06-01 2020-10-30 国网浙江省电力有限公司宁波供电公司 Power equipment abnormity detection system and method based on artificial intelligence
CN111858680B (en) * 2020-08-01 2022-10-25 西安交通大学 System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time
CN113096670A (en) * 2021-03-30 2021-07-09 北京字节跳动网络技术有限公司 Audio data processing method, device, equipment and storage medium
CN114089033B (en) * 2022-01-24 2022-04-26 天津安力信通讯科技有限公司 Abnormal signal detection method and system based on spectrum analysis
CN115099371B (en) * 2022-08-24 2022-11-29 广东粤港澳大湾区硬科技创新研究院 LSTM anomaly detection method, device, equipment and storage medium

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN202414914U (en) * 2011-12-27 2012-09-05 阳西县电梯配件有限公司 Elevator safety detection device based on characteristic signals
US10649449B2 (en) * 2013-03-04 2020-05-12 Fisher-Rosemount Systems, Inc. Distributed industrial performance monitoring and analytics
CN105205112A (en) * 2015-09-01 2015-12-30 西安交通大学 System and method for excavating abnormal features of time series data
US10318886B2 (en) * 2015-10-30 2019-06-11 Citrix Systems, Inc. Anomaly detection with K-means clustering and artificial outlier injection
CN107361773B (en) * 2016-11-18 2019-10-22 深圳市臻络科技有限公司 For detecting, alleviating the device of Parkinson's abnormal gait
CN107179476B (en) * 2017-06-08 2020-01-10 华北电力大学 Distribution network fault distance measurement method
CN110477910A (en) * 2019-08-14 2019-11-22 深圳先进技术研究院 Epileptic seizure prediction device, terminal device and computer readable storage medium

Also Published As

Publication number Publication date
CN108063698A (en) 2018-05-22

Similar Documents

Publication Publication Date Title
CN108063698B (en) Equipment abnormality detection method and device, and storage medium
CN108196986B (en) Equipment abnormality detection method and device, computer equipment and storage medium
Harley et al. Scale transform signal processing for optimal ultrasonic temperature compensation
TW463113B (en) Method and apparatus for analyzing measurements
EP3117226B1 (en) Digital frequency response analysis system and method useful for power supplies
US20190311297A1 (en) Anomaly detection and processing for seasonal data
EP2135144B1 (en) Machine condition monitoring using pattern rules
JP2019135467A (en) Failure diagnosis system
CN113886470A (en) Method, device and equipment for processing time series data
CN114047378A (en) Signal voltage detection method, system, equipment and server
CN109009051A (en) Method for measuring heart rate, device, equipment and storage medium
JP6251486B2 (en) Method and apparatus for detecting an envelope
US20150149122A1 (en) Handheld data collector and analyzer system
US8762080B2 (en) Computer component detection system and method
JP6225079B2 (en) Air conditioner operation detection method and system
US20090138218A1 (en) Correlating power consumption with cpu activity
US9537690B1 (en) Method and apparatus for extraction of baseband waveform from amplitude modulated signal via time domain sampling
CN111601224A (en) Microphone performance testing method and device and electronic equipment
CN110873811A (en) Processor-implemented system and method
CN117077066B (en) Waveform abnormality detection method, waveform abnormality detection device, electronic device and storage medium
JP5788358B2 (en) Electronic device and abnormality detection method for electronic device
McLean et al. Nyquist—overcoming the limitations
US20170139796A1 (en) Bus interface card detection system and method for detecting bus interface card
CN110308300B (en) Rotating speed measuring method and device fusing multiple characteristic data
CN113925472B (en) Method and device for acquiring quantitative index of arterial pressure wave conduction velocity

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant