CN108399115A - A kind of O＆M operation detection method, device and electronic equipment - Google Patents
A kind of O＆M operation detection method, device and electronic equipment Download PDFInfo
- Publication number
- CN108399115A CN108399115A CN201810167133.6A CN201810167133A CN108399115A CN 108399115 A CN108399115 A CN 108399115A CN 201810167133 A CN201810167133 A CN 201810167133A CN 108399115 A CN108399115 A CN 108399115A
- Authority
- CN
- China
- Prior art keywords
- period
- abnormal
- subsequence
- change
- sequence
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3024—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a central processing unit [CPU]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Signal Processing (AREA)
- Quality & Reliability (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Mathematical Physics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Environmental & Geological Engineering (AREA)
- Debugging And Monitoring (AREA)
Abstract
An embodiment of the present invention provides a kind of O＆M operation detection method, device and electronic equipments.Method includes：The corresponding sequence of values of parameter value of the default capabilities parameter of target device in the Each point in time within the monitoring period is obtained, the monitoring period is divided into multiple sub-periods；According to subsequence of the sequence of values in each sub-period, change type of the default capabilities parameter in each sub-period is determined；The change type of each sub-period is sorted sequentially in time, obtains change type sequence；It determines in the subsequence set of change type sequence with the presence or absence of the abnormal subsequence for being marked as anomalous variation in preset rule change library；If there is abnormal subsequence in the subsequence set of change type sequence, determine in the monitoring period that there is abnormal O＆M operates.The embodiment of the present invention, the change type sequence based on the performance parameter of target device within the monitoring period operate in the detection monitoring period with the presence or absence of abnormal O＆M, and testing result is more accurate.
Description
Technical field
The present invention relates to system service technical fields, more particularly to a kind of O＆M operation detection method, device and electronics
Equipment.
Background technology
In order to avoid equipment because being lost caused by being operated under abnormality, need monitoring device in operation and maintenance process
In operated with the presence or absence of abnormal O＆M, when finding there is abnormal O＆M to operate alarm so that related service personnel can locate in time
Reason.In the prior art, when monitor include dangerous command in the operational order executed on target device when, judge O＆M operate
It operates and alarms in the presence of abnormal O＆M in the process.
Inventor has found that at least there are the following problems for the prior art in the implementation of the present invention：
May also be able to include dangerous command in normal operating, it is thus possible to abnormal O＆M operation can be mistaken for, therefore
Judging result is not accurate enough.
Invention content
The embodiment of the present invention is designed to provide a kind of O＆M operation detection method, improve during identification O＆M whether
There are the accuracys of abnormal O＆M operation.Specific technical solution is as follows：
In the embodiment of the present invention in a first aspect, providing a kind of O＆M operates detection method, the method includes：
The default capabilities parameter of acquisition target device corresponding sequence of values, monitoring period within the monitoring period are drawn
It is divided into multiple sub-periods；
According to subsequence of the sequence of values in each sub-period, determine the default capabilities parameter in each period of the day from 11 p.m. to 1 a.m
Change type in section；
The change type of each sub-period is sorted sequentially in time, obtains change type sequence；
It determines to whether there is in the subsequence set of the change type sequence and be marked as in preset rule change library
The abnormal subsequence of anomalous variation；
If determining the monitoring period there are the abnormal subsequence in the subsequence set of the change type sequence
It is interior to there is abnormal O＆M operation.
Further, it is advised with the presence or absence of preset variation in the subsequence set of the determination change type sequence
It is then marked as in library after the abnormal subsequence of anomalous variation, further includes：
If determining the variation class there is no the abnormal subsequence in the subsequence set of the change type sequence
Whether type sequence can be split into multiple normal subsequences that normal variation is marked as in the rule change library；
If the change type sequence can not be split into the normal subsequence of multiple normal variations, institute is determined
It states in the monitoring period and there is abnormal O＆M operation.
Further, use following steps by the monitoring Time segments division for multiple sub-periods：
The rate of change between each adjacent two numerical value in the sequence of values is obtained, is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of time point composition；
The rate of change based on each period to be combined that the monitoring period includes will according to default dividing mode
The monitoring Time segments division be multiple sub-periods, the default dividing mode be the adjacent period to be combined the rate of change such as
Fruit meets default similar conditions and is then divided in the same sub-period.
Further, the subsequence according to the sequence of values in each sub-period, determines the default capabilities
Change type of the parameter in each sub-period, including：
According to the rate of change between each adjacent two numerical value in each sub-period, determine the default capabilities parameter each
Change type in a sub-period.
Further, the abnormal subsequence in the preset rule change library is corresponding with abnormal O＆M operation mark；
There is abnormal O＆M in the determination monitoring period to operate, including：
Determine there is what abnormal O＆M operation mark corresponding with existing exception subsequence indicated in the monitoring period
Abnormal O＆M operation.
Further, if there are the abnormal subsequence in the subsequence set of the change type sequence,
It determines in the monitoring period after there is abnormal O＆M operation, further includes：
It obtains in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；
If the review result is there is no the operation of abnormal O＆M, and the sequence of values is corresponding as normal operating
Sequence of values is sent to preset offline grader, for adjusting the rule change library.
In the second aspect of the embodiment of the present invention, a kind of O＆M operation detection device is provided, including：
Retrieval module, the default capabilities parameter for obtaining target device are monitoring corresponding numerical value sequence in the period
Row, the monitoring period are divided into multiple sub-periods；
Type analysis module determines described default for the subsequence according to the sequence of values in each sub-period
Change type of the performance parameter in each sub-period；
Sorting module obtains change type for the change type of each sub-period to sort sequentially in time
Sequence；
Detection module whether there is preset rule change in the subsequence set for determining the change type sequence
The abnormal subsequence of anomalous variation is marked as in library；If in the subsequence set of the change type sequence, there are described different
Normal subsequence determines in the monitoring period that there is abnormal O＆M operates.
Further, the detection module, if being additionally operable to be not present in the subsequence set of the change type sequence
The exception subsequence, determines whether the change type sequence can be split into and multiple is marked in the rule change library
It is denoted as the normal subsequence of normal variation；If the change type sequence can not be split into multiple normal variations
Normal subsequence determines in the monitoring period that there is abnormal O＆M operates.
Further, further include：
Time segments division module, for using following steps by the monitoring Time segments division for multiple sub-periods：
The rate of change between each adjacent two numerical value in the sequence of values is obtained, is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of time point composition；
The rate of change based on each period to be combined that the monitoring period includes will according to default dividing mode
The monitoring Time segments division be multiple sub-periods, the default dividing mode be the adjacent period to be combined the rate of change such as
Fruit meets default similar conditions and is then divided in the same sub-period.
Further, the type analysis module is specifically used for the change according to each adjacent two numerical value in each sub-period
Change rate, determines change type of the default capabilities parameter in each sub-period.
Further, the abnormal subsequence in the preset rule change library is corresponding with abnormal O＆M operation；
The detection module is specifically used for determining in the monitoring period in the presence of corresponding different with existing abnormal subsequence
The abnormal O＆M operation that Chang Yunwei operation marks indicate.
Further, further include
Feedback module, for obtaining in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；And such as
Review result described in fruit be there is no the operation of abnormal O＆M, using the sequence of values as the corresponding sequence of values of normal operating,
It is sent to preset offline grader, for adjusting the rule change library.
In the third aspect of the embodiment of the present invention, a kind of electronic equipment, including processor, communication interface, storage are provided
Device and communication bus, wherein processor, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, realizes any of the above-described O＆M operation detection
Method.
In the fourth aspect of the embodiment of the present invention, a kind of computer readable storage medium is provided, it is described computer-readable
Instruction is stored in storage medium, when run on a computer so that computer executes any of the above-described O＆M behaviour
Make detection method.
At the 5th aspect of the embodiment of the present invention, the embodiment of the present invention additionally provides a kind of computer program including instruction
Product, when run on a computer so that computer executes any of the above-described O＆M operation detection method.
O＆M operation detection method, device and electronic equipment provided in an embodiment of the present invention, can be by mesh in the monitoring period
The time series of the numerical value of the performance parameter of marking device is changed into, and the performance parameter is within the monitoring period in each sub-period
The sequence of change type, and will produce the abnormal O＆M operation that big data is excavated is passed through in the sequence and rule change library
Change type subsequence be compared, operated with the presence or absence of abnormal O＆M to detect in the monitoring period, therefore testing result is more
It is accurate.Certainly, it implements any of the products of the present invention or method does not necessarily require achieving all the advantages described above at the same time.
Description of the drawings
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technology description to be briefly described.
Fig. 1 is a kind of flow diagram that O＆M provided in an embodiment of the present invention operates detection method；
Fig. 2 is another flow diagram that O＆M provided in an embodiment of the present invention operates detection method；
Fig. 3 is a kind of flow diagram of sub-period division methods provided in an embodiment of the present invention；
Fig. 4 is another flow diagram that O＆M provided in an embodiment of the present invention operates detection method；
Fig. 5 is another flow diagram that O＆M provided in an embodiment of the present invention operates detection method；
Fig. 6 is another flow diagram that O＆M provided in an embodiment of the present invention operates detection method；
Fig. 7 a are a kind of structural schematic diagram that O＆M provided in an embodiment of the present invention operates detection device；
Fig. 7 b are another structural schematic diagram that O＆M provided in an embodiment of the present invention operates detection device；
Fig. 7 c are another structural schematic diagram that O＆M provided in an embodiment of the present invention operates detection device；
Fig. 8 is a kind of structural schematic diagram of O＆M provided in an embodiment of the present invention operation detection electronic equipment.
Specific implementation mode
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention is described.
It is shown a kind of flow diagram that O＆M provided in an embodiment of the present invention operates detection method referring to Fig. 1, Fig. 1,
It may comprise steps of：
S110, the default capabilities parameter for obtaining target device are monitoring corresponding sequence of values in the period, the monitoring period
It is divided into multiple sub-periods.
Wherein, default capabilities parameter can be cpu load rate, can also be server access amount, can also be other energy
Enough reflect the parameter of target device performance indicator.It is understood that the variation of the performance parameter of target device can reflect
Whether target device is in abnormality, for example, after cpu load rate rapid increase, long-time stable is constant, and explanation may deposit
In the process not being normally closed, in another example and then rapid decrease after server access amount rapid increase, illustrates to service
There may be abnormal operations in device visit capacity statistic processes.
Include the parameter value of the default capabilities parameter of target device in Each point in time in sequence of values, these when
Between point can be spacedly distributed monitoring the period in, can also be distributed according to actual demand unequal interval monitoring the period in.
The monitoring period can be period including current time, such as nearest one hour, can also be it is past some
Period, such as 13 points to 14 points of some day in the past.Monitoring the period can be divided into according to Fixed Time Interval it is multiple
Sub-period can also be to be divided into multiple sub-periods according to other preset rules.
S120 determines default capabilities parameter in each period of the day from 11 p.m. to 1 a.m according to subsequence of the sequence of values in each sub-period
Change type in section.
Wherein, the change type in a sub-period may include rapid decrease, slowly rise, smooth change, can also
Including sinusoidal fluctuation, index decreased.Specifically, change type of the default capabilities parameter in a certain sub-period can be according to such as
What under type determined：According to preset matching rule, the change type to match with the subsequence in the sub-period is determined, and will
Change type of the change type determined as default capabilities parameter in the sub-period.It is understood that matching rule
It can be configured according to actual demand, for example, the difference of maxima and minima can be no more than to 1% subsequence, if
It is set to the subsequence to match with smooth change.
Illustratively, a subsequence be " 10%, 12%, 15% ", the corresponding sub-period of the subsequence be 2-4s, it is assumed that with
The change type that the subsequence matches is slowly to rise, then can determine default capabilities parameter in 2-3s this sub-period
Change type is slowly to rise.
S130 sorts the change type of each sub-period sequentially in time, obtains change type sequence.
It is understood that in order to facilitate the processing about change type sequence in subsequent step, in change type sequence
Each element, can be indicated with identifier corresponding with change type.Illustratively, change type sequence can be with
For " A, B, C, B ", wherein A are the corresponding identifier of rapid decrease, and B is slowly to rise corresponding identifier, and C is sine wave
Move corresponding identifier.
S140 is determined in the subsequence set of change type sequence with the presence or absence of being marked as in preset rule change library
The abnormal subsequence of anomalous variation.
Wherein, it is marked as the abnormal subsequence of anomalous variation in rule change library, is obtained based on big data association mining
It arrives.
Can be by multiple samples being determined in the sample period of abnormal O＆M operation specifically, in the present embodiment
Sequence of values, offline grader of the input for Mining Association Rules.Offline grader by sample values sequence according to S120,
Method and step in S130 is converted into sample changed type sequence.Using sample changed type sequence as affairs, calculate separately all
The support and confidence level of two item collections made of being arranged by two change types, illustratively, it is assumed that sample changed type sequence
In one share 3 kinds of change types, corresponding label symbol is respectively A, B, C, then calculate separately two item collections { A, B }, { A, C }, B,
A }, { B, C }, { C, A }, the support and confidence level of { C, B }.
For convenience of discussion, first change type that one two item collection of note include is a1, second change type a2, this two
It includes change type subsequence a that the support of item collection, which is all,1a2Sample changed type sequence number, which sets
It includes change type a that reliability, which is all,1Sample changed type sequence in, including change type subsequence a1a2Sample changed
The ratio of type sequence.Illustratively, sample changed type can be calculated as shown in Table 2 each two with reference to shown in table 1
The support and confidence level of item collection.
Table 1
| Sample changed sequence number | Sample changed sequence |
| 1 | " A, B, C " |
| 2 | " A, C, A " |
| 3 | " A, A, C " |
| 4 | " B, A, C " |
| 5 | " B, C, B " |
Table 2
According to the result of calculation of the support and confidence level of each two item collection, support is filtered out in the present embodiment higher than pre-
If minimum support threshold value, and confidence level higher than minimal confidence threshold two item collections as association two item collections, illustratively,
Assuming that result of calculation is as shown in table 2, minimum support threshold value and minimal confidence threshold are respectively 3,80%, then can be by binomial
Collection { A, C } is determined as being associated with two item collections.It is understood that in other embodiments, can also only calculate support or set
Reliability, and filter out higher than default support threshold or be used as two item collections of association higher than two item collections of default confidence threshold value.
In other embodiment, can also three item collections of association, four item collections of association etc. be determined respectively in a similar way.
Binomial is concentrated two change types for including to be formed according to the sequence that binomial is concentrated by binomial collection relevant for institute
Sequence, if the subsequence before be not stored in rule change library as normal subsequence, which is made
It is stored in rule change library for abnormal subsequence.Illustratively, it is assumed that { A, C } be one association two item collections, if AC not by
It is stored in rule change library, is then stored in sequence AC as abnormal subsequence in rule change library as normal subsequence.
The determination method of normal subsequence is referred to the description of the above-mentioned determination method about abnormal subsequence, the two
The difference is that in the normal subsequence of determination, input offline grader is when being determined the sample without abnormal O＆M operation
Sample values sequence in section.Also, after obtaining two item collections of association, concentrate two change types for including according to two binomial
The sequence of sequence composition in item collection, is stored in as normal subsequence in rule change library.It is understood that determine have it is different
May include normal O＆M operation, therefore when progress data mining, may obtain in the sample period of Chang Yunwei operations
Associated subsequence is operated with normal O＆M.In other embodiments, input offline grader can also be to be determined as only wrapping
Sample values sequence in the sample period containing the operation of abnormal O＆M.
If there is abnormal subsequence in the subsequence set of change type sequence, step S150 is executed.
S150 determines in the monitoring period that there is abnormal O＆M operates.
It is understood that abnormal subsequence can be considered as between a kind of abnormal O＆M operation and change type subsequence
Correlation rule, due to the correlation rule by great amount of samples change type sequence carry out data correlation obtain, will
It monitors in the subsequence set of the change type sequence in the period and there is abnormal subsequence, there is abnormal fortune as monitoring in the period
The criterion for tieing up operation, is accurate, reliable.Illustratively, excavation is associated by great amount of samples change type sequence, obtained
One correlation rule " when there is abnormal O＆M operation, the cpu load meeting rapid increase of target device is simultaneously kept for a period of time ",
Then if within the monitoring period, finds cpu load rapid increase and kept for a period of time, then determine the monitoring period memory according to this
It is accurate, reliable in the judgement of abnormal O＆M operation.
The embodiment is selected, the sequence of values of the parameter value of the default capabilities parameter of target device in the period can will be monitored
It is changed into, the sequence of change type of the default capabilities parameter within the monitoring period in each sub-period, and by the sequence and variation
The change type subsequence that the abnormal O＆M operation excavated by big data in rule base will produce is compared, to judge
It monitors in the period and is operated with the presence or absence of abnormal O＆M, therefore judging result is more accurate.
In a kind of optional embodiment, as shown in Fig. 2, if there is no different in the subsequence set of change type sequence
Normal subsequence executes step S161.
S161 determines whether change type sequence can be split into and multiple is marked as normally becoming in rule change library
The normal subsequence changed.
Illustratively, it is assumed that the normal subsequence that normal variation is marked as in rule change library has AB, AC, BD, for
Change type sequence is that " A, B, C, D " can be split into subsequence AC, BD, therefore can be split into multiple in variation rule
The normal subsequence of normal variation is then marked as in library." A, B, C, A " can not be then split into multiple change type sequence
The normal subsequence of normal variation is marked as in rule change library.
If change type sequence can not be split into the normal subsequence of multiple normal variations, step S162 is executed.
S162 determines in the monitoring period that there is abnormal O＆M operates.
It is understood that normal subsequence can be considered as between a kind of normal O＆M operation and change type subsequence
Correlation rule.If the change type sequence in a monitoring period can be split into multiple normal subsequences, illustrate
All changes type sequence in the monitoring period can reasonably be explained using normal operating, therefore in the monitoring period
Abnormal O＆M operation is not deposited again, conversely, then not all change type may be by normal operating progress reasonable dismissal, therefore
There may be the operations of abnormal O＆M in the monitoring period.
The embodiment is selected, can whether can be further split into according to the change type sequence in the monitoring period
Multiple normal sequences are determined in the monitoring period and are operated with the presence or absence of abnormal O＆M, are increased existing in the discovery monitoring period
The probability of abnormal O＆M operation.
In a kind of optional embodiment, it is multiple period of the day from 11 p.m. to 1 a.m that can utilize method as shown in Figure 3 that will monitor Time segments division
Section, specifically includes：
S310 obtains the rate of change between each adjacent two numerical value in sequence of values, as the two neighboring numerical value pair
Answer the rate of change of the period to be combined of time point composition.
Illustratively, first numerical value in sequence of values be 8, corresponding time point be t=1s, second value 10,
Corresponding time point is t=2s, then the numerical value change rate of period [1s, 2s] to be combined is 2s-1。
S320 will be monitored based on the rate of change for monitoring each period to be combined that the period includes according to default dividing mode
Time segments division is multiple sub-periods, and predetermined manner is that the default similar conditions of rate of change satisfaction of adjacent period to be combined are then drawn
Divide in the same sub-period.
Specifically, can be based on the range of the rate of change for each period to be combined that the monitoring period includes, by rate of change
Be divided into it is multigroup, if the rate of change of adjacent period to be combined belongs to same group, when the two are adjacent to be combined
Section is divided into same sub-period.
The embodiment to be selected, can be made in each sub-period, the variation tendency of numerical value is similar to simple even variation,
It reduces and determines change type required calculation amount of the default capabilities parameter in each sub-period in subsequent step.
In an optional implementation manner, as shown in figure 4, S120 can be specifically included：
S121 determines that default capabilities parameter exists according to the rate of change between each adjacent two numerical value in each sub-period
Change type in each sub-period.
In the present embodiment, can using the average value of the rate of change between each adjacent two numerical value in each sub-period as
All sub-periods are divided into a kind of multigroup, every group of change of correspondence by the mean change rate in the sub-period according to mean change rate
Change type.Illustratively, the sub-period by mean change rate less than -10/s is divided into one group, and the corresponding change type of the group is
Rapid decrease, in another example, mean change rate is divided into one group between the sub-period of 1/s to 2/s, the corresponding change type of the group
Slowly to rise.
Specifically, can be grouped using preset clustering algorithm, can also be according to preset packet threshold into
Row grouping.Can be that each numerical value in a sub-period is carried out linear fit by horizontal axis of time shaft, fitting is obtained
The slope of straight line, as the mean change rate in the sub-period.
It is understood that rate of change between numerical value can intuitively, accurately reflect variation tendency, therefore select
The embodiment can relatively accurately determine the change type in each sub-period.
In a kind of optional embodiment, the abnormal subsequence in rule change library can be corresponding with abnormal O＆M operation mark
Know, in the case, as shown in figure 5, S150 can be specifically included：
S151 is determined in the monitoring period and is existed if there is abnormal subsequence in the subsequence set of change type sequence
The abnormal O＆M that abnormal O＆M operation mark corresponding with existing exception subsequence indicates operates.
Illustratively, it is assumed that there is abnormal subsequence " AB " in the change type sequence in the monitoring period, obtain abnormal sub
The corresponding abnormal O＆M operation mark of sequence determines the abnormal O＆M operation that the mark indicates, it is assumed that accidentally to delete, it is determined that
Monitor the abnormal O＆M operation for existing in the period and accidentally deleting.
The embodiment is selected, can further determine existing abnormal O＆M operation.It is understood that determining
Under the premise of going out existing abnormal O＆M operation, operation maintenance personnel more targeted can carry out subsequent processing work.
In a kind of optional embodiment, as shown in fig. 6, after S150, can also include：
S171 is obtained in the monitoring period with the presence or absence of the review result of abnormal O＆M operation.
Illustratively, review result can be operation maintenance personnel by checking that O＆M of the target device within the monitoring period records
It determines, can also be to be audited by computer, the present embodiment does not limit this according to preset review rule
System.
S172, it is if review result is there is no the operation of abnormal O＆M, the sequence of values is corresponding as normal operating
Sequence of values is sent to preset offline grader, for adjusting rule change library.
Wherein, preset offline grader can be the offline grader for creating rule change library, can also be base
Offline grader after creating the offline grader used in rule change library and being improved, the present embodiment are not restricted this.
It is understood that offline grader is excavated for big data to determine the pass between O＆M operation and change type subsequence
Connection rule.In some special circumstances, such as offline grader sample data when carrying out big data excavation is not enough comprehensively, or
Person may cause the correlation rule determined not accurate enough when there is mistakenly sample data in sample data.
The embodiment is selected, the association rule in rule change library can be adjusted in real time by way of checking and feeding back
Then, it finds in time and adjusts inaccurate correlation rule so that the correlation rule in correlation rule library is more accurate, reliable, carries
The high accuracy of testing result.
Referring to Fig. 7 a, Fig. 7 a show a kind of structural representation of O＆M operation detection device provided in an embodiment of the present invention
Figure, may include with lower module：
Retrieval module 701, the default capabilities parameter for obtaining target device are monitoring corresponding numerical value in the period
Sequence, monitoring period are divided into multiple sub-periods；
Type analysis module 702 determines that default capabilities are joined for the subsequence according to sequence of values in each sub-period
Change type of the number in each sub-period；
Sorting module 703 obtains change type sequence for the change type of each sub-period to sort sequentially in time
Row；
Detection module 704 whether there is preset rule change in the subsequence set for determining change type sequence
The abnormal subsequence of anomalous variation is marked as in library；And if existed in the subsequence set of change type sequence abnormal sub
Sequence determines in the monitoring period that there is abnormal O＆M operates.
Further, detection module 704, if there is no different in can be also used for the subsequence set of change type sequence
Normal subsequence determines whether change type sequence can be split into and multiple is marked as normal variation in rule change library
Normal subsequence；If change type sequence can not be split into the normal subsequence of multiple normal variations, when determining monitoring
There is abnormal O＆M in section to operate.
Further, referring to Fig. 7 b, can also include：
Time segments division module 705, for using following steps that will monitor Time segments division as multiple sub-periods：
The rate of change between each adjacent two numerical value in sequence of values is obtained, the time is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of point composition；
Based on the rate of change for monitoring each period to be combined that the period includes the period will be monitored according to default dividing mode
Multiple sub-periods are divided into, default dividing mode is the rate of change of adjacent period to be combined if meeting and presetting similar conditions
It is divided in the same sub-period.
Further, type analysis module 702 can be specifically used for according to each adjacent two numerical value in each sub-period
Rate of change determines change type of the default capabilities parameter in each sub-period.
Further, the abnormal subsequence in preset rule change library can be corresponding with abnormal O＆M operation；
Detection module 704 can be specifically used for determining in the monitoring period in the presence of corresponding different with existing abnormal subsequence
The abnormal O＆M operation that Chang Yunwei operation marks indicate.
Further, referring to Fig. 7 c, can also include：
Feedback module 706, for obtaining in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；And if
Review result is that there is no the operations of abnormal O＆M to be sent to default using sequence of values as the corresponding sequence of values of normal operating
Offline grader, for adjusting rule change library.
The embodiment of the present invention additionally provides a kind of electronic equipment, as shown in figure 8, including processor 801, communication interface 802,
Memory 803 and communication bus 804, wherein processor 801, communication interface 802, memory 803 are complete by communication bus 804
At mutual communication,
Memory 803, for storing computer program；
Processor 801 when for executing the program stored on memory 803, realizes following steps：
The default capabilities parameter of acquisition target device corresponding sequence of values within the monitoring period, monitoring period are divided into
Multiple sub-periods；
According to subsequence of the sequence of values in each sub-period, change of the default capabilities parameter in each sub-period is determined
Change type；
The change type of each sub-period is sorted sequentially in time, obtains change type sequence；
It determines to whether there is in preset rule change library in the subsequence set of change type sequence and is marked as exception
The abnormal subsequence of variation；
If there is abnormal subsequence in the subsequence set of change type sequence, determine in the monitoring period there is abnormal fortune
Dimension operation.
Further, with the presence or absence of quilt in preset rule change library in the subsequence set for determining change type sequence
After the abnormal subsequence of anomalous variation, further include：
If determining that change type sequence whether can there is no abnormal subsequence in the subsequence set of change type sequence
Enough it is split into multiple normal subsequences that normal variation is marked as in rule change library；
If change type sequence can not be split into the normal subsequence of multiple normal variations, determine in the monitoring period
There are the operations of abnormal O＆M.
Further, use following steps that will monitor Time segments division as multiple sub-periods：
The rate of change between each adjacent two numerical value in sequence of values is obtained, the time is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of point composition；
Based on the rate of change for monitoring each period to be combined that the period includes the period will be monitored according to default dividing mode
Multiple sub-periods are divided into, default dividing mode is the rate of change of adjacent period to be combined if meeting and presetting similar conditions
It is divided in the same sub-period.
Further, the subsequence according to sequence of values in each sub-period determines default capabilities parameter in each height
Change type in period, including：
According to the rate of change between each adjacent two numerical value in each sub-period, determine default capabilities parameter in each height
Change type in period.
Further, it determines to whether there is in the subsequence set of change type sequence and be marked in preset rule change library
It is denoted as the abnormal subsequence of anomalous variation, including：
Abnormal subsequence in preset rule change library is corresponding with abnormal O＆M operation mark；
Determine in the monitoring period that there is abnormal O＆M operates, including：
Determine there is the exception that abnormal O＆M operation mark corresponding with existing exception subsequence indicates in the monitoring period
O＆M operates.
Further, if there is abnormal subsequence in the subsequence set of change type sequence, the monitoring period is determined
After the interior O＆M operation in the presence of exception, further include：
It obtains in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；
If review result is that there is no the operations of abnormal O＆M, using sequence of values as the corresponding numerical value sequence of normal operating
Row, are sent to preset offline grader, for adjusting rule change library.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Component
Interconnect, PCI) bus or expanding the industrial standard structure (Extended Industry Standard
Architecture, EISA) bus etc..The communication bus can be divided into address bus, data/address bus, controlling bus etc..For just
It is only indicated with a thick line in expression, figure, it is not intended that an only bus or a type of bus.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory may include random access memory (Random Access Memory, RAM), can also include non-easy
The property lost memory (Non-Volatile Memory, NVM), for example, at least a magnetic disk storage.Optionally, memory may be used also
To be at least one storage device for being located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit,
CPU), network processing unit (Network Processor, NP) etc.；It can also be digital signal processor (Digital Signal
Processing, DSP), it is application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), existing
It is field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic device, discrete
Door or transistor logic, discrete hardware components.
In another embodiment provided by the invention, a kind of computer readable storage medium is additionally provided, which can
It reads to be stored with instruction in storage medium, when run on a computer so that computer executes any in above-described embodiment
O＆M operates detection method.
In another embodiment provided by the invention, a kind of computer program product including instruction is additionally provided, when it
When running on computers so that computer executes any O＆M operation detection method in above-described embodiment.
In the above-described embodiments, can come wholly or partly by software, hardware, firmware or its arbitrary combination real
It is existing.When implemented in software, it can entirely or partly realize in the form of a computer program product.The computer program
Product includes one or more computer instructions.When loading on computers and executing the computer program instructions, all or
It partly generates according to the flow or function described in the embodiment of the present invention.The computer can be all-purpose computer, special meter
Calculation machine, computer network or other programmable devices.The computer instruction can be stored in computer readable storage medium
In, or from a computer readable storage medium to the transmission of another computer readable storage medium, for example, the computer
Instruction can pass through wired (such as coaxial cable, optical fiber, number from a web-site, computer, server or data center
User's line (DSL)) or wireless (such as infrared, wireless, microwave etc.) mode to another web-site, computer, server or
Data center is transmitted.The computer readable storage medium can be any usable medium that computer can access or
It is comprising data storage devices such as one or more usable mediums integrated server, data centers.The usable medium can be with
It is magnetic medium, (for example, floppy disk, hard disk, tape), optical medium (for example, DVD) or semiconductor medium (such as solid state disk
Solid State Disk (SSD)) etc..
It should be noted that herein, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also include other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
There is also other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is all made of relevant mode and describes, identical similar portion between each embodiment
Point just to refer each other, and each embodiment focuses on the differences from other embodiments.Especially for device,
Electronic equipment, computer readable storage medium, computer program product embodiment for, due to its be substantially similar to method reality
Example is applied, so description is fairly simple, the relevent part can refer to the partial explaination of embodiments of method.
Claims (13)
1. a kind of O＆M operates detection method, which is characterized in that the method includes：
The default capabilities parameter of acquisition target device corresponding sequence of values, monitoring period within the monitoring period are divided into
Multiple sub-periods；
According to subsequence of the sequence of values in each sub-period, determine the default capabilities parameter in each sub-period
Change type；
The change type of each sub-period is sorted sequentially in time, obtains change type sequence；
It determines to whether there is in preset rule change library in the subsequence set of the change type sequence and is marked as exception
The abnormal subsequence of variation；
If determining the monitoring period memory there are the abnormal subsequence in the subsequence set of the change type sequence
It is operated in abnormal O＆M.
2. according to the method described in claim 1, it is characterized in that, the determination change type sequence son sequence set
It whether there is in conjunction and be marked as after the abnormal subsequence of anomalous variation in preset rule change library, further include：
If determining the change type sequence there is no the abnormal subsequence in the subsequence set of the change type sequence
Whether row can be split into multiple normal subsequences that normal variation is marked as in the rule change library；
If the change type sequence can not be split into the normal subsequence of multiple normal variations, the prison is determined
It controls in the period and there is abnormal O＆M operation.
3. according to the method described in claim 1, it is characterized in that, using following steps by the monitoring Time segments division to be multiple
Sub-period：
The rate of change between each adjacent two numerical value in the sequence of values is obtained, the time is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of point composition；
The rate of change based on each period to be combined that the monitoring period includes will be described according to default dividing mode
Monitoring Time segments division is multiple sub-periods, if the default dividing mode is full for the rate of change of adjacent period to be combined
The default similar conditions of foot are then divided in the same sub-period.
4. according to the method described in claim 1, it is characterized in that, it is described according to the sequence of values in each sub-period
Subsequence determines change type of the default capabilities parameter in each sub-period, including：
According to the rate of change between each adjacent two numerical value in each sub-period, determine the default capabilities parameter in each height
Change type in period.
5. according to the method described in claim 1, it is characterized in that, abnormal subsequence pair in the preset rule change library
There should be abnormal O＆M operation mark；
There is abnormal O＆M in the determination monitoring period to operate, including：
Determine there is the exception that abnormal O＆M operation mark corresponding with existing exception subsequence indicates in the monitoring period
O＆M operates.
If 6. according to the method described in claim 1, it is characterized in that, the change type sequence son sequence set
There are the abnormal subsequence in conjunction, determines in the monitoring period after there is abnormal O＆M operation, further include：
It obtains in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；
If the review result is that there is no the operations of abnormal O＆M, using the sequence of values as the corresponding numerical value of normal operating
Sequence is sent to preset offline grader, for adjusting the rule change library.
7. a kind of O＆M operates detection device, which is characterized in that described device includes：
Retrieval module, the default capabilities parameter for obtaining target device are monitoring corresponding sequence of values in the period, institute
State monitoring the period be divided into multiple sub-periods；
Type analysis module determines the default capabilities for the subsequence according to the sequence of values in each sub-period
Change type of the parameter in each sub-period；
Sorting module obtains change type sequence for the change type of each sub-period to sort sequentially in time；
Detection module, with the presence or absence of in preset rule change library in the subsequence set for determining the change type sequence
It is marked as the abnormal subsequence of anomalous variation；If in the subsequence set of the change type sequence, there are the exception is sub
Sequence determines in the monitoring period that there is abnormal O＆M operates.
8. device according to claim 7, which is characterized in that the detection module, if being additionally operable to the change type
There is no the abnormal subsequence in the subsequence set of sequence, it is more to determine whether the change type sequence can be split into
A normal subsequence that normal variation is marked as in the rule change library；If the change type sequence can not be by
The normal subsequence for splitting into multiple normal variations determines in the monitoring period that there is abnormal O＆M operates.
9. device according to claim 7, which is characterized in that further include：
Time segments division module, for using following steps by the monitoring Time segments division for multiple sub-periods：
The rate of change between each adjacent two numerical value in the sequence of values is obtained, the time is corresponded to as the two neighboring numerical value
The rate of change of the period to be combined of point composition；
The rate of change based on each period to be combined that the monitoring period includes will be described according to default dividing mode
Monitoring Time segments division is multiple sub-periods, if the default dividing mode is full for the rate of change of adjacent period to be combined
The default similar conditions of foot are then divided in the same sub-period.
10. device according to claim 7, which is characterized in that the type analysis module is specifically used for according to each height
The rate of change of each adjacent two numerical value in period determines change type of the default capabilities parameter in each sub-period.
11. device according to claim 7, which is characterized in that the abnormal subsequence in the preset rule change library
It is corresponding with abnormal O＆M operation；
The detection module is specifically used for the presence of abnormal fortune corresponding with existing exception subsequence in the determining monitoring period
Tie up the abnormal O＆M operation that operation mark indicates.
12. device according to claim 7, which is characterized in that further include：
Feedback module, for obtaining in the monitoring period with the presence or absence of the review result of abnormal O＆M operation；If described multiple
The fruit that comes to an end is that there is no the operations of abnormal O＆M to be sent to pre- using the sequence of values as the corresponding sequence of values of normal operating
If offline grader, for adjusting the rule change library.
13. a kind of electronic equipment, which is characterized in that including processor, communication interface, memory and communication bus, wherein processing
Device, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor when for executing the program stored on memory, realizes any method and steps of claim 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810167133.6A CN108399115B (en) | 2018-02-28 | 2018-02-28 | Operation and maintenance operation detection method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810167133.6A CN108399115B (en) | 2018-02-28 | 2018-02-28 | Operation and maintenance operation detection method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108399115A true CN108399115A (en) | 2018-08-14 |
| CN108399115B CN108399115B (en) | 2021-06-22 |
Family
ID=63096103
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810167133.6A Active CN108399115B (en) | 2018-02-28 | 2018-02-28 | Operation and maintenance operation detection method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108399115B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020093637A1 (en) * | 2018-11-09 | 2020-05-14 | 平安科技（深圳）有限公司 | Device state prediction method and system, computer apparatus and storage medium |
| CN112365558A (en) * | 2020-11-18 | 2021-02-12 | 上海联影医疗科技股份有限公司 | Air correction method, air correction device, computer equipment and storage medium |
| CN112988446A (en) * | 2021-05-19 | 2021-06-18 | 新华三技术有限公司 | Fault root cause detection method and device |
| CN113672446A (en) * | 2020-05-14 | 2021-11-19 | 百度在线网络技术（北京）有限公司 | Monitoring parameter determination method, device, equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009025394A2 (en) * | 2007-08-21 | 2009-02-26 | Panasonic Corporation | Plasma processing device |
| CN101718864A (en) * | 2009-11-13 | 2010-06-02 | 航天东方红卫星有限公司 | System for real-time monitoring abnormal change of satellite telemetry parameters |
| CN102148701A (en) * | 2011-01-14 | 2011-08-10 | 广东商学院 | Trend analysis method and device for monitoring indexes in monitoring system |
| CN107197473A (en) * | 2017-06-15 | 2017-09-22 | 三星电子（中国）研发中心 | A kind of terminal abnormal state determines method and apparatus |
-
2018
- 2018-02-28 CN CN201810167133.6A patent/CN108399115B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009025394A2 (en) * | 2007-08-21 | 2009-02-26 | Panasonic Corporation | Plasma processing device |
| CN101718864A (en) * | 2009-11-13 | 2010-06-02 | 航天东方红卫星有限公司 | System for real-time monitoring abnormal change of satellite telemetry parameters |
| CN102148701A (en) * | 2011-01-14 | 2011-08-10 | 广东商学院 | Trend analysis method and device for monitoring indexes in monitoring system |
| CN107197473A (en) * | 2017-06-15 | 2017-09-22 | 三星电子（中国）研发中心 | A kind of terminal abnormal state determines method and apparatus |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020093637A1 (en) * | 2018-11-09 | 2020-05-14 | 平安科技（深圳）有限公司 | Device state prediction method and system, computer apparatus and storage medium |
| CN113672446A (en) * | 2020-05-14 | 2021-11-19 | 百度在线网络技术（北京）有限公司 | Monitoring parameter determination method, device, equipment and storage medium |
| CN113672446B (en) * | 2020-05-14 | 2023-09-15 | 百度在线网络技术（北京）有限公司 | Monitoring parameter determining method, device, equipment and storage medium |
| CN112365558A (en) * | 2020-11-18 | 2021-02-12 | 上海联影医疗科技股份有限公司 | Air correction method, air correction device, computer equipment and storage medium |
| CN112365558B (en) * | 2020-11-18 | 2023-03-21 | 上海联影医疗科技股份有限公司 | Air correction method, air correction device, computer equipment and storage medium |
| CN112988446A (en) * | 2021-05-19 | 2021-06-18 | 新华三技术有限公司 | Fault root cause detection method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108399115B (en) | 2021-06-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108399115A (en) | A kind of O＆M operation detection method, device and electronic equipment | |
| CN108322347B (en) | Data detection method, device, detection server and storage medium | |
| EP1779592B1 (en) | Supervising arrangement | |
| EP3832479B1 (en) | Production line monitoring method and apparatus, and electronic device and readable storage medium | |
| US11170332B2 (en) | Data analysis system and apparatus for analyzing manufacturing defects based on key performance indicators | |
| Xie et al. | A quality monitoring and decision‐making scheme for automated production processes | |
| US11157346B2 (en) | System and method for binned inter-quartile range analysis in anomaly detection of a data series | |
| CN111656418B (en) | Method for monitoring an industrial automation system and industrial plant monitoring device | |
| US20200026268A1 (en) | Control device and diagnosis system | |
| Abid et al. | Anomaly detection through outlier and neighborhood data in Wireless Sensor Networks | |
| CN105549508B (en) | A kind of alarm method and device merged based on information | |
| CN107077135B (en) | Method and auxiliary system for identifying interference in a device | |
| CN108369416B (en) | Abnormality diagnosis system | |
| JP2020068025A (en) | System and method for anomaly characterization based on joint historical and time-series analysis | |
| CN110889441A (en) | Distance and point density based substation equipment data anomaly identification method | |
| CN111090685A (en) | Method and device for detecting data abnormal characteristics | |
| EP2135144A1 (en) | Machine condition monitoring using pattern rules | |
| CN108304276A (en) | A kind of log processing method, device and electronic equipment | |
| CN114610553A (en) | Intelligent equipment detection system and detection method thereof | |
| Atzmueller et al. | H yp G raphs: an approach for analysis and assessment of graph-based and sequential hypotheses | |
| US20200380474A1 (en) | Monitoring Device and Monitoring System | |
| CN113434823B (en) | Data acquisition task abnormity early warning method and device, computer equipment and medium | |
| Peña et al. | Data-driven gearbox fault severity diagnosis based on concept drift | |
| CN107992408A (en) | A kind of software probe method of software probe | |
| CN115270982A (en) | Switch cabinet fault prediction method based on multi-data neural network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |