CN108965039A

CN108965039A - A kind of alarm method and electronic equipment based on traffic monitoring

Info

Publication number: CN108965039A
Application number: CN201710357982.3A
Authority: CN
Inventors: 陈爱明; 蔺绍祝
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2017-05-19
Filing date: 2017-05-19
Publication date: 2018-12-07
Anticipated expiration: 2037-05-19
Also published as: CN108965039B

Abstract

The embodiment of the invention discloses a kind of alarm method and electronic equipment based on traffic monitoring, the described method includes: obtaining the sampled data that current monitor point reports, obtain the sampled value of destination sample point, alarm label is obtained by the sampled value and preset fluctuation trajectory line set of the destination sample point, is sent a warning message according to the alarm label.Method shown in the present embodiment carries out the alarm of abnormal destination sample point based on the alarm label, and the alarm label includes derailing label outFlag and fluctuation mutation label violentFlag, so as to the characteristic for taking into account global disengaging history, part is acutely mutated, so that service operation either local anomaly, or global abnormal, can be monitored and arrive；It in the anomaly statistics stage, solves the burr for some sampled point that conventional monitoring systems cannot solve and the brought accidentally alarm harassing and wrecking of non-real exception, while alarm can be restrained, reduce the pressure to operation system, O&M team.

Description

Alarm method based on flow monitoring and electronic equipment

Technical Field

The present invention relates to the field of communications technologies, and in particular, to an alarm method based on traffic monitoring and an electronic device.

Background

With the development of network communication, in order to manage and control data in a communication process and optimize and limit the communication process, traffic monitoring needs to be performed on the communication process to realize efficient transmission of data.

For flow monitoring, the prior art has different algorithms in different application scenarios, which can be roughly as follows, such as traffic flow monitoring, and a flow monitoring algorithm based on a DSP method with single lane flow monitoring; for the traffic monitoring of network traffic, a very mature traffic monitoring algorithm based on prediction model estimation and steady state congestion rate solution is provided; for the traffic monitoring of internet traffic, the most common method is to manually configure a fluctuation threshold, a historical same-proportion and ring-proportion method, and the like.

By analyzing each flow monitoring scheme provided by the prior art, a plurality of defects of the method in a cloud service system can be found, for example, for a flow monitoring algorithm based on a DSP method, original data information is completely lost after data signal processing, and service characteristics are separated; the method for estimating and solving the steady state congestion rate based on the prediction model for monitoring the network flow has the problems that the model storage wastes space, more time is consumed for calculating the steady state congestion rate in the cloud service, different service characteristics are completely different, and more congestion rate formulas exist, so that the problem that the selection of the congestion rate formula not only consumes time, but also results in the calculation of completely different results in different congestion rates, the monitoring accuracy is influenced, and more problems of false alarms, lost alarms and the like are caused. For manually configuring the fluctuation threshold value and the historical homonymy and identity-ring ratio method, the reasonable threshold value can be configured by completely depending on experienced personnel, which consumes great labor input and does not necessarily receive reasonable effect, and the method is not preferable in a cloud service system; and the historical proportion and the ring proportion have high requirements on the storage of the sampling data, and the complete historical sampling data needs to be stored, otherwise, the increase rate, the decrease rate and other related parameters of the proportion and the ring proportion cannot be calculated.

Disclosure of Invention

The embodiment of the invention provides a flow monitoring-based alarm method and electronic equipment, which improve algorithm efficiency, reduce space waste and solve the problem of false alarm.

A first aspect of an embodiment of the present invention provides an alarm method based on traffic monitoring, including:

acquiring sampling data reported by a current monitoring point;

acquiring a sampling value of a target sampling point, wherein the target sampling point is any sampling point in the sampling data;

acquiring an alarm tag through a sampling value of the target sampling point and a preset fluctuation track line set, wherein the fluctuation track line set comprises a fluctuation track line obtained by training a preset target sample data set and a fluctuation rate sequence, and the fluctuation rate sequence is a sequence formed by the fluctuation rate of any sampling point included in the target sample data set;

and sending alarm information according to the alarm tag.

A second aspect of an embodiment of the present invention provides an electronic device, including:

the first acquisition unit is used for acquiring sampling data reported by a current monitoring point;

the second acquisition unit is used for acquiring a sampling value of a target sampling point, and the target sampling point is any sampling point in the sampling data;

a third obtaining unit, configured to obtain an alarm tag through a sampling value of the target sampling point and a preset fluctuation trajectory line set, where the fluctuation trajectory line set includes a fluctuation trajectory line obtained by training a preset target sample data set and a fluctuation rate sequence, and the fluctuation rate sequence is a sequence formed by the fluctuation rates of any sampling point included in the target sample data set;

and the sending unit is used for sending alarm information according to the alarm tag.

A third aspect of an embodiment of the present invention provides an electronic device, including:

one or more processor units, a storage unit, a bus system, and one or more programs, the processor units and the storage unit being connected by the bus system;

wherein the one or more programs are stored in the storage unit, the one or more programs comprising instructions which, when executed by the electronic device, cause the electronic device to perform the method as provided by the first aspect of embodiments of the present invention.

A fourth aspect of embodiments of the present invention provides a computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device, cause the electronic device to perform the method as provided by the first aspect of embodiments of the present invention.

The embodiment of the invention discloses an alarm method based on flow monitoring and an electronic device, wherein the method comprises the following steps: acquiring sampling data reported by a current monitoring point, acquiring a sampling value of a target sampling point, acquiring an alarm tag through the sampling value of the target sampling point and a preset fluctuation track line set, and sending alarm information according to the alarm tag. The method shown in this embodiment alarms an abnormal target sampling point based on the alarm tag, and the alarm tag includes an off-track tag outFlag and a fluctuating abrupt change tag violentFlag, so that the characteristics of global deviation history and local abrupt change can be considered, and service operation can be monitored whether the local abnormality or the global abnormality is present; in the abnormal statistics stage, the problem of false alarm disturbance caused by the fact that burrs of a certain sampling point which cannot be solved by a traditional monitoring system are not really abnormal is solved, meanwhile, the alarm can be converged, and the pressure on an operation system and an operation and maintenance team is reduced.

Drawings

Fig. 1 is a schematic structural diagram of an embodiment of an electronic device provided in the present invention;

fig. 2 is a schematic structural diagram of an embodiment of a communication system provided in the present invention;

FIG. 3 is a block diagram of a processor unit according to an embodiment of the present invention;

FIG. 4 is a flowchart illustrating steps of an embodiment of an alarm method based on traffic monitoring according to the present invention;

FIG. 5 is a flowchart illustrating steps of an alarm method based on traffic monitoring according to another embodiment of the present invention;

fig. 6 is a schematic structural diagram of an embodiment of an electronic device provided in the present invention.

Detailed Description

In order to better understand the embodiments of the present invention, a specific structure of an electronic device capable of implementing the traffic monitoring alarm method provided in the embodiments of the present invention is described below with reference to fig. 1:

the electronic device includes an input unit 105, a processor unit 103, an output unit 101, a communication unit 107, a storage unit 104, a radio frequency circuit 108, and the like.

These components communicate over one or more buses. Those skilled in the art will appreciate that the configuration of the electronic device shown in fig. 1 is not intended to limit the present invention, and may be a bus or star configuration, and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.

In the embodiment of the present invention, the electronic device includes, but is not limited to, a server, a smart terminal, and the like.

The electronic device includes:

an output unit 101 for outputting an image to be displayed.

Specifically, the output unit 101 includes, but is not limited to, an image output unit and an audio output unit.

The image output unit is used for outputting characters, pictures and/or videos. The image output unit may include a Display panel, for example, a Display panel configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), a Field Emission Display (FED), and the like. Alternatively, the image output unit may include a reflective display, such as an electrophoretic (electrophoretic) display, or a display using an Interferometric Modulation (Light) technique.

In one embodiment of the present invention, the image output unit includes a filter and an amplifier for filtering and amplifying the video output from the processor unit 103. The sound output unit includes a digital-to-analog converter for converting the audio signal output from the processor unit 103 from a digital format to an analog format.

And the processor unit 103 is used for executing corresponding codes, processing the received information and generating and outputting a corresponding interface.

Specifically, the processor unit 103 is a control center of the electronic device, connects various parts of the whole electronic device by using various interfaces and lines, and executes various functions of the electronic device and/or processes data by running or executing software programs and/or modules stored in the storage unit and calling data stored in the storage unit. The processor unit 103 may be composed of an Integrated Circuit (IC), for example, a single packaged IC, or a plurality of packaged ICs connected with the same or different functions.

For example, the Processor Unit 103 may include only a Central Processing Unit (CPU), or a combination of a Graphics Processor (GPU), a Digital Signal Processor (DSP), and a control chip (e.g., baseband chip) in the communication Unit. In the embodiment of the present invention, the CPU may be a single operation core, or may include multiple operation cores.

A memory unit 104 for storing code and data, the code for execution by the processor unit 103.

Specifically, the storage unit 104 may be used to store software programs and modules, and the processor unit 103 executes various functional applications of the electronic device and implements data processing by running the software programs and modules stored in the storage unit 104. The storage unit 104 mainly includes a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required for at least one function, such as a sound playing program, an image playing program, and the like; the data storage area may store data (such as audio data, a phonebook, etc.) created according to the use of the electronic device, and the like.

In an embodiment of the invention, the Memory unit 104 may include a volatile Memory, such as a non-volatile dynamic Random Access Memory (NVRAM), a Phase Change Random Access Memory (PRAM), a Magnetoresistive Random Access Memory (MRAM), and the like, and may further include a non-volatile Memory, such as at least one disk Memory, an Electrically erasable programmable Read-Only Memory (EEPROM), and a flash Memory device, such as a flash Memory or a flash Memory (NOR flash Memory) or a flash Memory.

The non-volatile memory stores an operating system and application programs executed by the processor unit 103. The processor unit 103 loads operating programs and data from the non-volatile memory into memory and stores digital content in mass storage devices. The operating system includes various components and/or drivers for controlling and managing conventional system tasks, such as memory management, storage device control, power management, etc., as well as facilitating communication between various hardware and software components.

In the embodiment of the present invention, the operating system may be an Android system developed by Google, an iOS system developed by Apple, a Windows operating system developed by Microsoft, or an embedded operating system such as Vxworks.

The application programs include any application installed on the electronic device including, but not limited to, browser, email, instant messaging service, word processing, keyboard virtualization, Widget (Widget), encryption, digital rights management, voice recognition, voice replication, positioning (e.g., functions provided by the global positioning system), music playing, and so forth.

An input unit 105 for enabling user interaction with the electronic device and/or information input into the electronic device.

For example, the input unit 105 may receive numeric or character information input by a user to generate a signal input related to user setting or function control. In the embodiment of the present invention, the input unit 105 may be a touch screen, other human-computer interaction interfaces, such as an entity input key, a microphone, and other external information capturing devices, such as a camera.

The touch screen disclosed by the embodiment of the invention can collect the operation actions touched or approached by the user. For example, the user can use any suitable object or accessory such as a finger, a stylus, etc. to operate on or near the touch screen, and drive the corresponding connection device according to a preset program. Alternatively, the touch screen may include two parts, a touch detection device and a touch controller. The touch detection device detects touch operation of a user, converts the detected touch operation into an electric signal and transmits the electric signal to the touch controller; the touch controller receives the electrical signal from the touch sensing device and converts it to touch point coordinates, which are fed to the processor unit 103.

The touch controller can also receive and execute commands sent by the processor unit 103. In addition, the touch screen can be realized by various types such as a resistive type, a capacitive type, an infrared ray, a surface acoustic wave and the like.

In other embodiments of the present invention, the physical input keys used by the input unit 105 may include, but are not limited to, one or more of a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a track ball, a mouse, a joystick, etc. The input unit 105 in the form of a microphone may collect speech input by a user or the environment and convert it into commands in the form of electrical signals executable by the processor unit 103.

In some other embodiments of the present invention, the input unit 105 may also be various sensing devices, such as hall devices, for detecting physical quantities of the electronic device, such as force, moment, pressure, stress, position, displacement, speed, acceleration, angle, angular velocity, number of rotations, rotation speed, and time of change of operating state, and converting the physical quantities into electric quantities for detection and control. Other sensing devices may include gravity sensors, three-axis accelerometers, gyroscopes, electronic compasses, ambient light sensors, proximity sensors, temperature sensors, humidity sensors, pressure sensors, heart rate sensors, fingerprint identifiers, and the like.

A communication unit 107 for establishing a communication channel through which the electronic device connects to a remote server and downloads media data from the remote server. The communication unit 107 may include a Wireless Local Area Network (wlan) module, a bluetooth module, a baseband module, and other communication modules, and a Radio Frequency (RF) circuit corresponding to the communication module, and is configured to perform wlan communication, bluetooth communication, infrared communication, and/or cellular communication system communication, such as Wideband Code Division Multiple Access (W-CDMA) and/or High Speed Downlink Packet Access (HSDPA) for example. The communication module is used for controlling communication of each component in the electronic equipment and can support direct memory access.

In different embodiments of the present invention, the various communication modules in the communication unit 107 are generally in the form of Integrated Circuit chips (Integrated Circuit chips), and can be selectively combined without including all the communication modules and corresponding antenna groups. For example, the communication unit 107 may comprise only a baseband chip, a radio frequency chip and a corresponding antenna to provide communication functions in a cellular communication system. The electronic device may be connected to a Cellular Network or the internet via a wireless communication connection established by the communication unit 107, such as a wireless local area Network access or a WCDMA access. In some alternative embodiments of the present invention, the communication module, such as the baseband module, in the communication unit 107 may be integrated into the processor unit 103, typically as the APQ + MDM family of platforms provided by the high-pass (Qualcomm) corporation.

And the radio frequency circuit 108 is used for receiving and sending signals in the process of information transceiving or conversation. For example, after receiving downlink information of the base station, the downlink information is processed by the processor unit 103; in addition, the data for designing uplink is transmitted to the base station. Generally, the radio frequency circuitry 108 includes well-known circuitry for performing these functions, including but not limited to an antenna system, a radio frequency transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a Codec (Codec) chipset, a Subscriber Identity Module (SIM) card, memory, and so forth. In addition, the radio frequency circuitry 108 may also communicate with networks and other devices via wireless communications.

The wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), High Speed Uplink Packet Access (HSUPA), long term Evolution (long term Evolution), LTE, e-mail, Short Message Service (SMS), and the like.

A power supply 109 for powering the various components of the electronic device to maintain operation thereof. As a general understanding, the power supply 109 may be a built-in battery, such as a common lithium ion battery, a nickel metal hydride battery, and the like, and also includes an external power supply for directly supplying power to the electronic device, such as an AC adapter, and the like. In some embodiments of the invention, the power supply 109 may be more broadly defined and may include, for example, a power management system, a charging system, a power failure detection circuit, a power converter or inverter, a power status indicator (e.g., a light emitting diode), and any other components associated with power generation, management, and distribution of an electronic device.

Based on the electronic device shown in fig. 1, the following describes in detail a specific structure of the communication system provided in this embodiment with reference to fig. 2:

the communication system shown in the present embodiment includes an electronic device 210 and at least one client device 220;

the detailed structure of the electronic device 210 is shown in fig. 1, and is not limited in this embodiment.

In this embodiment, a specific structure of the client device 220 is not limited, as long as the electronic device 210 can perform data interaction with the client device 220, so that the electronic device 210 can perform traffic monitoring on the client device 220, and the electronic device 210 can alert an abnormal sampling point when it is determined that the client device 220 can alert the abnormal sampling point.

For a better understanding of the embodiments of the present invention, alternative structures of the processor unit 103 that can implement the methods shown in the embodiments of the present invention are described below:

it should be clear that, the description of the structure of the processor unit 103 in this embodiment is an optional example, and is not limited, as long as the alarm method based on traffic monitoring shown in this embodiment can be successfully executed by the processor unit 103 shown in this embodiment.

The specific structure of the processor unit 103 can be seen in fig. 3, wherein fig. 3 is a schematic structural diagram of an embodiment of the processor unit provided by the present invention.

As shown in fig. 3, to solve the problem of real-time monitoring of cloud service based charging traffic, the processor unit 103 specifically includes a periodic task module 301 and a real-time task module 302.

The regular task module 301 is configured to train the upward fluctuation trajectory and the downward fluctuation trajectory of the current monitoring point periodically, and determine a fluctuation rule of the current monitoring point.

Wherein, the monitoring point is the analysis dimension of the service charging system.

For example, to analyze the traffic charging situation of each domain name, each domain name is used as a monitoring point, and a unique identifier is allocated in the charging system and is recorded as domain _ id.

The real-time task module 302 is configured to learn, in real time, a derailment label and a fluctuation sudden change label of a current sampling point according to the upward fluctuation trajectory line, the downward fluctuation trajectory line and a fluctuation rule of the current monitoring point, using data as a drive, perform anomaly statistical analysis according to the two indexes, and send an alarm in time for an anomaly sampling time point meeting an alarm condition according to an alarm policy.

Based on fig. 1 to fig. 3, a detailed description is given below, with reference to fig. 4, of how the periodic task module 301 specifically trains the upward fluctuation trajectory and the downward fluctuation trajectory of the current monitoring point periodically to determine the fluctuation rule of the current monitoring point, where fig. 4 is a flowchart illustrating steps of an embodiment of the warning method based on flow monitoring according to the present invention.

It should be clear that, as shown in fig. 4, the example that the periodic task module 301 executes the alarm method based on flow monitoring is taken as an example for illustration, and is not limited thereto, in a specific execution process, the method shown in this embodiment may be executed by any module included in the processor unit, and a module used for executing the method shown in this embodiment may be the module already shown in fig. 3, or may also be a module not shown in fig. 3, and is not limited in this embodiment.

As shown in fig. 4, the alarm method based on traffic monitoring specifically includes:

step 401, pulling an original sample data set to the client device.

Specifically, the periodic task module 301 shown in this embodiment automatically pulls the original sample data set ModelDataTmp corresponding to the sampling database according to the specified data path, the sample time tag, and the current monitoring point identifier id.

Optionally, the sampling database shown in this embodiment may be stored on the client device, or may also be stored on the electronic device, which is not limited in this embodiment as long as the original sample data set is stored in the sampling database.

The present embodiment exemplifies that the sampling database is stored on the client device.

The embodiment can perform statistical analysis on the original sample data set model datatmp;

analyzing the original sample data set ModelDataTmp to obtain the following data:

one, determine the data type data _ type of the original sample data set model datatmp.

Optionally, if it is determined that the original sample data set ModelDataTmp is ratio data, such as a success rate, a source return rate, and the like, it is determined that the data type data _ type is a specified value 1.

Optionally, if it is determined that the original sample data set ModelDataTmp is non-rate data, such as a flow rate, an online user number, and the like, it is determined that the data type data _ type is a specified value-1.

The other one is that the sampling granularity m _ factor of the original sample data set ModeldataTmp is determined;

for example, if the sampling granularity m _ factor is 5, it represents sampling once every 5 minutes, and if the sampling granularity m _ factor is 1, it represents sampling once every minute.

And the other one is to determine the fluctuation rate calculation delay M of the original sample data set ModeldataTmp₀And the number threshold N of the burr points₀。

In this embodiment, the fluctuation ratio calculation delay M₀And the threshold value N of the number of the burr points₀Determining by the sampling granularity m _ factor;

for example, if the sampling granularity M _ factor is 5, the value M is taken₀＝3、N₀If the sampling granularity M _ factor is 1, the value M is taken₀＝5、N₀＝4。

In another mode, a preset initial sample size minimum Min is obtained₀Max of initial sample size₀；

This embodiment is applied to the minimum value Min of the initial sample size₀And the maximum value Max of the initial sample size₀The specific value of (A) is not limited, for example, taking day as a statistical unit, a default value Min is set₀＝7、Max₀And (3) performing track training by using the sample data book module for at least 7 days and at most 30 days, otherwise, not performing the regular task module.

Calculating whether the sample size N contained in the original sample data set ModldDataTmp meets an interval [ Min₀,Max₀]；

If the original sample data set MoThe sample size N contained in delDataTmp is in the interval [ Min₀,Max₀]If the sample size N included in the original sample data set ModelDataTmp is not in the interval [ Min ], the module continues to perform the subsequent steps to perform the trajectory training, and if the sample size N included in the original sample data set ModelDataTmp is not in the interval [ Min ]₀,Max₀]And the module terminates execution, so that subsequent steps are not performed for trajectory training.

Step 402, preprocessing each sample in the initial sample data set model datatmp to obtain a preprocessed sample data set.

The step 402 shown in this embodiment is an optional step, and in other embodiments, the step 402 shown in this embodiment may not be executed. The embodiment takes the execution of the step 402 as an example for illustration.

The present embodiment may perform preprocessing on each sample in the initial sample data set ModelDataTmp by at least one of the following manners:

one preprocessing mode is data reduction;

specifically, in the process of actually applying the method shown in this embodiment, if there are special services, the data is reported after being expanded and/or reduced by a certain multiple, and in this case, the data needs to be restored according to an agreement.

More specifically, the client device 220 and the electronic device 210 may contract data in advance, so that the electronic device 210 can restore data according to the predetermined contract.

The other preprocessing mode is missing data completion;

specifically, in the process of actually applying the method shown in this embodiment, the original sample data set ModelDataTmp may have a situation that a certain sampling point has a service fault, a machine fault, or other reasons, and data cannot be reported normally, and this situation needs to be completed.

More specifically, the electronic device shown in the embodimentUsing forward moving average, with a moving step of N₀。

E.g., an arbitrary sample, with the arbitrary sample being samp_kFor example, if samp_kIf data loss occurs at the sampling point i, the supplementing method is as followsOther sampling points are analogized in this way, and are not described in detail.

The other pretreatment mode is burr positioning and smoothing;

specifically, in this embodiment, the samples included in the initial sample data set ModelDataTmp are scanned one by one through a sliding window, and if a mutation subsequence is found, it is determined whether the length l of the mutation subsequence exceeds N₀；

If l > N₀If the fluctuation mutation subsequence is the normal subsequence, the window slides forwards to continue scanning;

if l is less than or equal to N₀If the wave mutation subsequence is a burr, the wave mutation subsequence is smoothed.

In the embodiment, the fluctuation mutation subsequence is smoothed by a dynamic sliding window scanning method;

specifically, the moving step length is N by using a forward moving average method₀Firstly, smoothing the first sampling point of the fluctuation mutation subsequence, and then, next point, thus ensuring that each sampling point is processed by processed data and avoiding the phenomenon of pseudo-smoothing.

As can be seen, in this embodiment, any sample that is subjected to the preprocessing in the initial sample data set model datatmp is set in the preprocessed sample data set, so that all samples in the preprocessed sample data set are preprocessed.

And 403, acquiring a target sample data set of the current monitoring point.

Specifically, in this embodiment, the target sample data set is obtained according to the preprocessed sample data set, and the target sample data set shown in this embodiment is an optimal sample pool.

It can be seen that, through step 403 shown in this embodiment, learning of the optimal sample pool can be performed, so that trends in all samples in the optimal sample pool are the most consistent, and fluctuations are the most gradual.

The following describes the specific process of optimal sample pool learning in detail:

specifically, the target sample data set agorivamppool shown in this embodiment may include an optimal sample BestSamp;

the acquisition process of the optimal sample BestSamp is explained in detail as follows:

according to the training set: and (3) test set: dividing the preprocessed sample data set ModelData according to the principle that the verification set is 1:1:1, namely selecting the preprocessed sample data set ModelDataThe samples are selected as candidate setOne sample is the most likely candidate sample for which no drastic mutation fluctuation has occurred.

Specifically, a fluctuation rate accumulated difference pool is created, where the fluctuation rate accumulated difference pool includes a fluctuation rate accumulated difference corresponding to any sample of the N samples included in the preprocessed sample data set model data;

the calculation formula of the fluctuation rate accumulated difference corresponding to any sample of the N samples included in the preprocessed sample data set model data is as follows:

wherein k is 1,2, …, and N represents any sample included in the preprocessed sample data set ModelData; i is 1,2, …, n denotes arbitrary sampling points; VolatySeq_kRepresenting a sequence of wave rates;

more specifically, the volatility sequence VolatySeq is calculated by the following formula_k；

Wherein, X_k(i) Representing an arbitrary sample.

Selecting a candidate set Candidamp from the volatility accumulation difference pool, wherein the candidate set Candidamp comprises the volatility accumulation difference poolA sample is obtained;

in particular, what the candidate set CandidAmp includesThe fluctuation rate cumulative difference corresponding to each sample is the smallest of N fluctuation rate cumulative differences included in the fluctuation rate cumulative difference poolAnd (4) respectively.

More specifically, in this embodiment, the N fluctuation rate accumulated differences included in the fluctuation rate accumulated difference pool may be sorted from small to large, and then it is determined that the sorting is performed beforeSamples corresponding to the cumulative difference of the individual fluctuation rates are determined and ranked firstThe sample corresponding to each fluctuation ratio accumulated difference is located in the candidate set candidasm.

In the case that the candidate set Candidamp is determined, the sample with the most consistent trend is further selected from the candidate set Candidamp, and a 1:1 principle is adopted, namely, the candidate set Candidamp hasSelecting samples from the candidate set CandidampFor the samples with the most consistent trend, the selection method is to maximize the cumulative sum of the correlation coefficients of the candidate set.

From there areSelecting samples from the candidate set CandidampThe specific process of the sample with the most consistent trend is as follows:

firstly, a sample exhaustion method is adopted to carry out sample grouping on a candidate set CandidAmp, and each group of samples hasA sample is thenA combination of species, correspondinglyA correlation matrix.

According to the symmetry of the correlation matrix and the all-1 property of the main diagonal line, all the upper parts of the main diagonal line are used in the process of calculating the cumulative sum of the correlation coefficientsElemental, therefore, this step is fromThe largest of the cumulative sum of the phase relation numbers and summr (j) is selectedAnd the corresponding sample is the optimal sample BestSamp.

Wherein the correlation coefficient is defined as follows:

where X, Y are the sampling sequence of any two samples.

The correlation coefficient is accumulated and defined as: SUM (j) ═ SUM (R)_u)。

Wherein,represents any one sample combination; r_u＝{r₁,r₂,…,r_PDenotes all elements above the main diagonal of the correlation matrix for any set of samples, and

optionally, the method shown in this embodiment may further support manual customization of the experience sample to dynamically update the target sample data set agorsamppool, and as can be seen, if the method supports manual customization of the experience sample to dynamically update, the target sample data set agorsamppool may include the optimal sample BestSamp and the customized experience sample defedsamp;

the specific determination process of the best sample BestSamp is shown in the above, and details are not described here, and how to determine the custom experience sample defindedsamp is described in detail below:

receiving a new sample manually input, the present embodiment may perform preprocessing on the new sample, where the preprocessing mode may adopt the mode of preprocessing each sample in the initial sample data set ModelDataTmp shown in step 402, and details are not specifically described in this step.

Compared with the preprocessing mode shown in step 402, the preprocessing mode for the new sample shown in this step is different in that it needs to be determined whether the new sample meets a preset condition, where the preset condition is whether the new sample has no data missing;

if the new sample is judged not to meet the preset condition, it is indicated that the new sample has data missing, the process of restoring the data shown in the step 402 is not executed, and the new sample with the data missing is directly controlled not to enter the target sample data set agoris samppool.

If the preset condition is satisfied, it indicates that the new sample has no data missing, and the process of restoring the data shown in step 402 may be performed.

In this step, for the new sample k satisfying the preset condition, the following process is further performed:

specifically, the fluctuation rate sequence VolatySeq of the new sample k of the preset condition is calculated_kSimultaneously calculating the fluctuation rate confidence interval sequence ConfSeq ═ mu-3 delta, mu +3 delta of the candidate set Candidamp]。

Wherein μ ═ MEAN { CVolatySeq } represents a MEAN sequence of the candidate set fluctuation rate sequences;

the above-mentionedIs its corresponding standard deviation sequence;

the CVolatySeq is a fluctuation rate sequence set of the candidate set CandiSamp.

More specifically, the present invention is to provide a novel,volatySeq for the new sample fluctuation rate sequence_kAnd judging with the confidence interval sequence ConfSeq, wherein the specific process of the judgment is as follows: if VolatySeq_k(i) E.confseq (i), i ═ 1,2, …, n, then the new sample k satisfies the condition, is a custom experience sample, and can enter the target sample data set AgoriSampPool.

As can be seen, the target sample data set agori samppool shown in this embodiment includes the optimal sample BestSamp and the custom empirical sample DefindSamp.

And 404, acquiring a fluctuation rate sequence of the target sample data set.

Specifically, in this embodiment, the fluctuation rate sequence is obtained based on the target sample data set agorsamppool, where the fluctuation rate sequence includes an upward fluctuation rate sequence and a downward fluctuation rate sequence.

The following describes in detail how to obtain the upward fluctuation rate sequence:

specifically, the upward fluctuation rate sequence VolatryUp is determined according to the upward fluctuation rates of all sampling points in the target sample data set AgoriSampPool by calculating the upward fluctuation rates of all sampling points in the target sample data set AgoriSampPool;

more specifically, the upward fluctuation rate sequence vollaryup is a sequence formed by the upward fluctuation rates of all sampling points included in the target sample data set.

Any sampling point i, i ═ M in the target sample data set AgoriSampPool₀+1,M₀+2, …, n, i-M at sample point i where all samples are taken on the target sample dataset AgoriSampPool₀The sampled values are respectively marked as X_i、

Namely the X_iTo be at the same timeSample value at sample point i of all samples comprised by a sample data set, said sample valueAt sample points i-M for all samples included in the sample data set₀The sampled value of (a).

Definition max_i＝MAX(X_i)，min_i＝MIN(X_i)，

For upward fluctuation ratio, defined as: if it is notThenIf it is notOrder toIf it isThenIf it isThen volatyup (i) ═ max_i|。

In short, the present embodiment may calculate the upward fluctuation rate sequence voltyup (i) according to the sixth formula;

the sixth formula is:

it can be seen that the calculation of the upward fluctuation rate sequence is performed by the sixth formula.

The following describes in detail how to obtain the downward fluctuation rate sequence:

specifically, determining a VolatryDown sequence according to the downward fluctuation rates of all sampling points in the target sample data set AgoriSampPool by calculating the downward fluctuation rates of all sampling points in the target sample data set AgoriSampPool;

more specifically, the sequence of downward fluctuation rates vollarywown is a sequence formed by the downward fluctuation rates of all the sampling points included in the target sample data set.

For downward fluctuation ratio, defined as: if it is notThen

If it is notOrder toIf it isThenIf it isThen volatydown (i) ═ min_i|。

For sample point i ═ 1,2, …, M₀The upward and downward fluctuation rate sequence adopts the interval of M₀Length M₀A continuous fluctuation rate sequence of +1 is defined by moving average forward;

i.e. when i is less than or equal to M₀When the temperature of the water is higher than the set temperature,

in short, the present embodiment may calculate the downward fluctuation rate sequence VolatryDown according to the seventh formula;

the seventh formula is:

and determining the fluctuation rate sequence according to the determined upward fluctuation rate sequence VolatryUp and the downward fluctuation rate sequence VolatryDown, namely the fluctuation rate sequence comprises the upward fluctuation rate sequence VolatryUp and the downward fluctuation rate sequence VolatryDown.

Optionally, the calculated fluctuation rate sequence may cause a glitch or a fractional phagocytosis in an extreme case, such as a sampling data with a data value close to 0.

In order to avoid the glitch phenomenon or the phagocytosis phenomenon of the decimal, the method shown in this embodiment may perform a preprocessing on the fluctuation rate sequence.

The specific process of preprocessing the fluctuation rate sequence is explained in detail as follows:

the method for preprocessing the fluctuation rate sequence is a smoothing process through a sliding window as shown in step 402, and a detailed description of the smoothing process through a dynamic sliding window scanning method is shown in step 402, that is, the method is thatUsing forward moving average method for the fluctuation rate sequence, wherein the moving step length is N₀Firstly, smoothing the first sampling point of the fluctuation rate sequence, and then, carrying out the next point until all the sampling points contained in the fluctuation rate sequence are processed.

In this embodiment, a confidence interval smoothing method may also be used to preprocess the fluctuation rate sequence, and the efficiency of the preprocessing process can be improved by using the confidence interval smoothing method, so that the overall efficiency of the method shown in this embodiment is greatly improved;

specifically, for the up-fluctuation rate sequence, let μ_U＝MEAN{VolatyUp}，The confidence interval is Conf_U＝[μ_U-3δ_U,μ_U+3δ_U]The scan sequence volatyup (i), i ═ 1,2, …, n.

If at a certain point U_iAppears at VolatyUp (U)_i) Conf not in the confidence interval_UIn the interior, use U_iFront at most N₀Smoothing the mean value of the points;

if U is present_iIs the first and second points, the integral mean value mu is used_UAnd (4) smoothing. Thereafter, if VolatyUp (U)_i) If > 1, the conversion is to VolatyUp (U)_i)＝MIN{|1-α₀|,μ_U+3δ_U}。

For the downward fluctuation rate sequence, let μ be similar to the processing method for the upward fluctuation rate sequence_D＝MEAN{VolatyDown}，The confidence interval is Conf_D＝[μ_D-3δ_D,μ_D+3δ_D]The scan sequence volatydown (i), i ═ 1,2, …, n;

if at a certain point D_iAppears at VolatyDown (D)_i) Conf not in the confidence interval_DIn, use D_iFront at most N₀Smoothing the mean value of the points;

if D is_iThe first and second points are the integral mean value mu_DAnd (4) smoothing. Thereafter, if VolatyDown (D)_i) If > 1, the conversion is VolatyDown (D)_i)＝MIN{|1-α₀|,μ_D+3δ_D}。

Wherein, α₀To initialize the accuracy of the algorithm, the value is usually α without special requirements₀＝95％。

It should be clear that the present embodiment is specific to the accuracy α of the initialization algorithm₀The description of the values of (a) is an optional example and not limiting.

And step 405, clustering the fluctuation rate sequence.

Step 405 shown in this embodiment is an optional step, and whether to execute the step is not limited in this embodiment.

Specifically, the step can be selectively executed according to the sensitivity requirements of different services, for example, for charging services with stronger sensitivity, each sampling point can be provided with a unique rule value, and the step does not need to be executed;

and part of the business is not high in sensitivity requirement, and a rule value can be configured in a time slot, so that storage space can be saved, and the calculation of the wave motion trajectory line set can be carried out in the subsequent step based on the clustered fluctuation rate sequence obtained in the step.

For the case of requiring fluctuation rate sequence clustering, that is, the requirement for service sensitivity is not high, and an application scenario with a rule value can be configured in a time slot, the K-mean clustering algorithm is adopted in this embodiment.

Specifically, for randomly selecting K sample points, the time period is divided by using the intersection point of each clustered class boundary and the initial sample data set, and the rule value corresponding to the time period uses the class center value corresponding to the class.

And respectively clustering the upward fluctuation rate sequence and the downward fluctuation rate sequence by using the K-mean, and updating the non-clustered fluctuation rate sequence by using a clustered rule value.

Therefore, the fluctuation rule of the current monitoring point can be obtained: the upward fluctuation rule VolatyUp and the downward fluctuation rule VolatyDown are stored to provide a basis for the real-time monitoring task to carry out fluctuation mutation judgment.

Step 406, training the target sample data set and the fluctuation rate sequence to obtain a fluctuation trajectory line set.

Specifically, the fluctuation rate sequence shown in this step may be the fluctuation rate sequence that has not undergone the clustering process, as shown in step 404, and the fluctuation rate sequence may also be the fluctuation rate sequence that has undergone the clustering process, as shown in step 405.

The fluctuation trajectory line set shown in this embodiment includes an upward fluctuation trajectory line obtained by training the target sample data set and the upward fluctuation rate sequence, and the fluctuation trajectory line set further includes a downward fluctuation trajectory line obtained by training the target sample data set and the downward fluctuation rate sequence.

The following is a detailed description of a specific process of how to obtain the upward fluctuation trajectory line:

firstly, an upward fluctuation track line value CurveUp is obtained, and the upward fluctuation track line OrbitUp can be obtained according to the obtained upward fluctuation track line value CurveUp.

Specifically, first, a value at a sampling point i is taken for each sample in the sample data set agorsiamppool, and then an average value is taken to obtain an average curve value sampmean (i) ═ MEAN { agorsiamppool (i) };

secondly, calculating the upward fluctuation track line value CurveUp according to an eighth formula;

the eighth formula is: curveup (i) sampmean (i) [1+ volatyup (i) ].

Optionally, in order to ensure elastic fluctuation of the service, the minimum N is set for the upward fluctuation trajectory line value currveup₀·α₀The distance is adjusted to α₀，N₀·α₀For detailed description, please refer to the above description, which is not repeated.

If any sampling point i in the sample data set AgoriSampPool is determinedAdjusting the upward fluctuation trajectory line value currveup according to a tenth formula to obtain an adjusted upward fluctuation trajectory line value volatyup (i), wherein α₀And said N₀Is a preset threshold, and the tenth formula is CurveUp (i) ═ CurveUp (i) · [1+ α ]₀]。

Therefore, the adjusted upward fluctuation trajectory line value currveup can effectively guarantee the elastic fluctuation of the service.

Optionally, the upward fluctuation track line value currveup obtained in this embodiment is a discrete value of a fluctuation curve, and has a very strong sawtooth phenomenon, and for this reason, the method shown in this embodiment may perform polynomial curve fitting on the upward fluctuation track line value currveup, so that this unfriendly phenomenon may be removed.

Specifically, making a polyter for the upward fluctuation trajectory line value CurveUp₀And (4) fitting the order polynomial to obtain a corresponding polynomial coefficient, then reversely solving a corresponding fitting value, and recording as an upward fluctuation fitting value Fitup.

Wherein, the polyOrder₀For the preset fitting polynomial order, this embodiment applies to the fitting polynomial order polyOrder₀The specific numerical value of (A) is not limited as long as the polynomial order polyOrder through the fitting₀And removing the sawtooth phenomenon of the upward fluctuation trajectory line value CurveUp.

The result obtained by a large number of tests can satisfy most services with a 9 th order polynomial and can obtain a very good effect, so the embodiment uses the fitted polynomial order polyOrder₀The example is given as 9;

it is to be understood that a polynomial order plorder using said fitting₀The description of removing the aliasing of the upward fluctuation trajectory value currveup is an optional example, and is not limited, and in other embodiments, curve fitting manners such as sine and fourier may also be adopted.

In this embodiment, in order to obtain higher fitting efficiency, the polynomial order plorer adopting the fitting is used in this embodiment₀The sawtooth phenomenon of removing the upward fluctuating trajectory line value CurveUp is exemplified.

After the FitUp is obtained, in order to ensure the practical significance of the service, such as the non-0 processing of the flow value, extreme exception processing is carried out, for example, if a certain point FitUp (i) < 0 appears, N before and after the sampling point of i are used₀The average of the points replaces the value of the i point.

Optionally, the FitUp may be made to be minimum N₀·α₀Adjusting the distance to obtain a fitting value of a fluctuation curve, and taking the minimum N₀·α₀The detailed process of the distance adjustment is shown in the above, and is not described in detail.

Calculating the upward fluctuation trajectory OrbitUp according to a twelfth formula and the upward fluctuation trajectory line value CurveUp;

the twelfth formula is: orbitup (i) ═ 1+ N₀·α₀)·MEAN{FitUp(i),CurveUp(i)}。

Therefore, the upward fluctuation trajectory OrbitUp of the current monitoring point can be obtained through the above method, and the obtained upward fluctuation trajectory OrbitUp ensures reasonable fluctuation of the service, that is, the service real-time sampling value can have small amplitude fluctuation within corresponding precision, so as to reduce false alarm.

The following is a detailed description of a specific process of how to obtain the downward fluctuation trajectory:

firstly, a downward fluctuation curve value CurveDown is obtained, and the downward trajectory line CurveDown can be obtained according to the obtained downward fluctuation curve value CurveDown.

Specifically, a downward fluctuation trajectory line value CurveDown is calculated according to a ninth formula;

wherein the ninth formula is: curvedown (i) MIN {0, sampmean (i) · [ 1-volatywown (i) ] }, wherein the volatywown (i) is the downward fluctuation rate sequence.

Optionally, in order to ensure the elastic fluctuation of the service, the minimum N is made for the downward fluctuation trajectory line value CurveDown₀·α₀The distance is adjusted to α₀，N₀·α₀For detailed description, please refer to the above description, which is not repeated.

If any sampling point i in the sample data set AgoriSampPool is determinedAdjusting the downward fluctuation trajectory line value CurveDown according to an eleventh formula to obtain an adjusted downward fluctuation trajectory line value VolatyDown (i);

the eleventh formula is:

CurveDown(i)＝CurveDown(i)·[1-α₀]。

therefore, the adjusted downward fluctuation trajectory line value volaydown (i) can effectively guarantee the elastic fluctuation of the service.

Optionally, the downward fluctuation trajectory line value volaydown (i) obtained in this embodiment is a discrete value of a fluctuation curve with a very strong sawtooth phenomenon, and for this reason, the method shown in this embodiment may perform polynomial curve fitting on the downward fluctuation trajectory line value volaydown (i), so as to remove the unfriendly phenomenon.

Specifically, do the polyter for the VolatyDown (i) of the downward fluctuation trace line₀And (4) performing order polynomial fitting to obtain a corresponding polynomial coefficient, reversely solving a corresponding fitting value, and recording as a downward fluctuation fitting value FitDown.

The polynomial order of the fitting is PolyOrder₀For detailed description, please refer to the above description, which is not repeated in this step.

After the FitDown is obtained, in order to ensure the practical significance of the service, for example, the traffic value is not 0 processed, the extreme exception handling is performed, and for the specific processing procedure of the FitDown, please refer to the processing procedure of the FitUp shown above in detail, which is not described in detail.

Calculating the downward fluctuation trajectory line value OrbitDown according to a thirteenth formula and the downward fluctuation trajectory line value OrbitDown;

wherein the thirteenth formula is:

OrbitDown(i)＝(1-N₀·α₀)·MEAN{FitDown(i),CurveDown(i)}。

therefore, the downward fluctuation trajectory OrbitDown of the current monitoring point can be obtained through the above steps, and the obtained downward fluctuation trajectory OrbitDown ensures reasonable fluctuation of the service, that is, the service real-time sampling value can have small amplitude fluctuation within corresponding precision, so as to reduce false alarm.

As can be seen, with the embodiment shown in fig. 4, the electronic device can acquire the fluctuating trajectory line set of the alarm for traffic monitoring, and the method shown in this embodiment has the following beneficial effects:

the method has the advantages that the original sample data set can be processed to obtain the optimal target sample data set, so that the overall horizontal representativeness of the target sample data set is fully utilized, after the discrete value of the corresponding curve is obtained, curve fitting is carried out on the corresponding curve, unfriendly phenomena such as shaking, burrs, sawteeth and the like are avoided to the maximum, the trajectory line is enabled to be attractive, and the service has a reasonable elastic fluctuation interval;

the embodiment can fully consider the time complexity and the space complexity, improve the algorithm efficiency as much as possible, and reduce the space waste, for example, the symmetry of a correlation matrix and the full 1 property of main diagonal elements are utilized to reduce the calculation time by more than 2 times; in the curve fitting stage, through deep analysis of the characteristics of various curves, the most appropriate polynomial fitting is selected, the efficiency is improved, and the existence of the optimal solution is ensured; in the aspect of space complexity, the invention only needs to store the fluctuation trajectory line set and the fluctuation rate sequence without storing complete historical data, that is, the method shown in this embodiment calculates once in one period, and then the historical data can be separated after the calculation is completed, compared with the prior art, if the traffic volume increases, the number of the responsible services of each responsible person of the operation and maintenance team also rises, and the reasonable application of the manual value configured for each monitoring point cannot be ensured, increasing the human input is an undesirable way, not only the cost is increased, but also the growth speed of the traffic is far higher than the human input speed, the embodiment of the invention does not depend on empirical values as much as possible, but can simultaneously support manual intervention, does not depend on mathematical models, directly processes sampling data, and does not study which model each monitoring point conforms to. The method shown in the embodiment does not depend on complete historical data, saves storage space, greatly reduces algorithm space complexity, does not depend on empirical values, reduces manpower input, and improves accuracy and efficiency of flow monitoring.

In addition, the method carries out preprocessing on the original sample data set by introducing a dynamic sliding window scanning method, dynamically scans sampling sequences, backtracks and searches mutation points and fallback points, starts from local, and then expands to global, so as to process the jitter phenomenon caused by each burr abnormality of all sequences and solve the problem of false alarm of sensitive services; on the basis, the embodiment of the invention selects the target sample data set comprising the optimal sample from the batch of original sample data sets by means of the optimal sample pool dynamic learning algorithm, and then supports manual customization of the empirical sample to optimize the sample pool, so as to determine the target sample data set which most represents the current monitoring point, thereby solving the problem of false alarm.

Based on fig. 1 to fig. 3, a detailed description is given below, with reference to fig. 5, on how the real-time task module 302 specifically implements an abnormal sampling alarm by using data as a driver according to the fluctuation rules of the upward fluctuation trajectory, the downward fluctuation trajectory, and the current monitoring point, where fig. 5 is a flowchart of steps of another embodiment of the alarm method based on flow monitoring provided by the present invention.

It should be clear that, as shown in fig. 5, the real-time task module 302 is taken to perform the alarm method based on flow monitoring as an example, without limitation, in a specific execution process, the method shown in this embodiment may be performed by any module included in the processor unit, and a module used for performing the method shown in this embodiment may be the module already shown in fig. 3, or may also be a module not shown in fig. 3, which is not limited in this embodiment.

As shown in fig. 5, the alarm method based on traffic monitoring specifically includes:

step 501, pulling an original sample data set to the client device.

Step 502, preprocessing each sample in the initial sample data set ModelDataTmp to obtain a preprocessed sample data set.

And 503, acquiring a target sample data set of the current monitoring point.

And 504, acquiring a fluctuation rate sequence of the target sample data set.

And 505, clustering the fluctuation rate sequence.

Step 506, training the target sample data set and the fluctuation rate sequence to obtain a fluctuation trajectory line set.

Specifically, the specific execution process of step 501 to step 506 shown in this embodiment is please refer to the specific execution process of step 401 to step 406 shown in fig. 4 in detail, which is not described in detail in this embodiment.

Step 507, the client device reports the sampled data to the electronic device.

And step 508, acquiring the sampling data reported by the client equipment.

Specifically, the real-time task module 302 is driven by data, and once the client device serving as a monitoring point reports sampled data, the sampled data is monitored in real time.

And 509, acquiring a sampling value of the target sampling point.

And the target sampling point is any sampling point in the sampling data.

And step 510, acquiring an alarm tag through the sampling value of the target sampling point and the fluctuation trajectory set.

For a detailed description of the fluctuation trace line set, please refer to fig. 4, which is not described in detail in this embodiment.

Specifically, the alarm tag shown in this embodiment includes an off-track tag outFlag and a fluctuating mutation tag violentFlag;

the following is a detailed description of how to obtain the derailment flag outFlag:

specifically, in this embodiment, it has been predefined that if the derailment flag outFlag is equal to 1, the target sampling point is derailed, and if the derailment flag is equal to 0, the target sampling point is within the fluctuation trajectory, and is in a normal trajectory.

More specifically, the derailment tag outFlag is calculated according to a first formula;

the first formula is:

wherein i ═ 1,2, …, n denotes the target sampling point, said samp (i) is the sampling value of the target sampling point, said orbitup (i) is the value of the upward fluctuation trace line included in the set of fluctuation trace lines corresponding to the target sampling point, and said orbitdown (i) is the value of the downward fluctuation trace line included in the set of fluctuation trace lines corresponding to the target sampling point.

The following is a detailed description of how to obtain the fluctuating mutation tag violentFlag:

specifically, in this embodiment, it is predetermined that the target sampling point undergoes a sudden fluctuation if the sudden fluctuation flag violentFlag is equal to 1, and that the target sampling point normally fluctuates if the sudden fluctuation flag violentFlag is equal to 0.

More specifically, whether the target sampling point is less than or equal to M is judged₀；

If the target sampling point is less than or equal to M₀Then M is the first within the preset statistical period₀Determining the fluctuating mutation tag violentFlag to be 0 in each target sampling point;

if the target sampling point is larger than M₀Calculating the fluctuation rate gamma of the target sampling point according to a third formula_i；

The third formula is:wherein, the samp (i) is a sampling value of the target sampling point;

calculating the fluctuation rate upper limit value up _ limit of the target sampling point according to a fourth formula;

the fourth formula is: up _ limit MIN {1, | volatyup (i) · (1+ N)₀·α₀) L, wherein the VolatyUp (i) is the upward volatility sequence, N₀α is the preset burr point number threshold value₀Is a preset initial algorithm precision value;

calculating a lower limit value down _ limit of the fluctuation rate of the target sampling point according to a fifth formula;

the fifth formula is: down _ limit MIN {1, | volatydown (i) · (1-N)₀·α₀) Wherein, the VolatyDown (i) is the downward fluctuation rate sequence.

Calculating a fluctuating mutation tag violentFlag according to a second formula;

the second formula is:

wherein, said γ is_iThe fluctuation rate of the target sampling point is obtained, the up _ limit is the upper limit value of the fluctuation rate of the target sampling point, and the down _ limit is the lower limit value of the fluctuation rate of the target sampling point;

the following describes a specific process for generating the alarm tag:

based on the above, if the derailment tag outFlag and the fluctuating mutation tag violentFlag are generated, the derailment tag outFlag and the fluctuating mutation tag violentFlag are stored in the index result pool.

Counting the derailment tag outFlag and the fluctuating mutation tag violentFlag in the index result pool;

if N is continuous₀If the derailment tag outFlag of each target sampling point is equal to 1, generating the alarm tag alarmFlag, where N is₀For preset hairAnd (4) a threshold value of the number of the puncture points.

And/or the presence of a gas in the gas,

if M is continuous₀If the fluctuating mutation tag violentFlag of each target sampling point is equal to 1, generating the alarm tag alarmFlag, wherein M is₀And calculating the time delay for the preset fluctuation rate.

Wherein the alarm tag

Step 511, sending the alarm tag alarmFlag to the client device.

Specifically, after each abnormal statistic, the alarm tag alarmFlag is found to be 1, and an alarm is immediately sent to the client device under the condition that the alarm is not sent at the current time.

The embodiment does not limit the specific manner of sending the alarm.

Optionally, in the operating system, according to a humanized design, there is a default time period for not sending an alarm, for example, when there is no manual intervention, the default setting is 00-05 am, and 23-00 night belongs to the time period for not sending an alarm, which is called a self-help alarm mask and is marked as NotAlarmTime, but there is a part of particularly sensitive services, and the configuration is supported for manual intervention, and then the NotAlarmTime is updated by a manual value.

And if the target sampling point belongs to NotAlarmmTime, setting the alarm tag alarmFlag to be 0, namely, not sending the alarm, and not carrying out abnormal statistics and an alarm sending stage.

For detailed description of the beneficial effects of the method shown in this embodiment, please refer to fig. 4, and the same beneficial effects are not described in detail.

Executing the method shown in fig. 5, the alarm tag can be obtained based on the derailment tag outFlag and the fluctuating sudden change tag violentFlag, and the characteristics of global deviation history and local severe sudden change can be taken into consideration through the derailment tag outFlag and the fluctuating sudden change tag violentFlag, so that the service operation can be monitored whether being locally abnormal or globally abnormal; in the abnormal statistics stage, the problem of false alarm disturbance caused by the fact that burrs of a certain sampling point which cannot be solved by a traditional monitoring system are not really abnormal is solved, meanwhile, the alarm can be converged, and the pressure on an operation system and an operation and maintenance team is reduced.

The structure of the electronic device provided in this embodiment is described below with reference to fig. 6, and the electronic device shown in fig. 6 is used to execute the alarm method based on traffic monitoring shown in the above embodiment, and please refer to the above embodiment in detail, and details of the execution process are not repeated in this embodiment.

As shown in fig. 6, the electronic apparatus includes:

a fourth obtaining unit 601, configured to obtain the target sample data set of the current monitoring point;

optionally, the fourth obtaining unit 601 is further configured to obtain an initial sample data set of the current monitoring point;

preprocessing any sample in the initial sample data set in a preprocessing mode to obtain a preprocessed sample data set;

the pretreatment mode is at least one of the following modes:

restoring data, supplementing missing data through a moving average method, and smoothing any sampling point included in a burr subsequence included in the initial sample data set;

and acquiring the target sample data set according to the preprocessed sample data set.

A fifth obtaining unit 602, configured to obtain a fluctuation rate sequence of the target sample data set, where the fluctuation rate sequence includes an upward fluctuation rate sequence and a downward fluctuation rate sequence, the upward fluctuation rate sequence is a sequence formed by upward fluctuation rates of all sampling points included in the target sample data set, and the downward fluctuation rate sequence is a sequence formed by downward fluctuation rates of all sampling points included in the target sample data set;

optionally, the fifth obtaining unit 602 is configured to calculate an upward fluctuation rate sequence volatyup (i) according to a sixth formula;

the sixth formula is:

wherein i is any sample point included in the sample data set, and max_i＝MAX(X_i) Said X is_iIs the sample value of any sample included in the sample data set at sample point iThe above-mentionedAt sample point i-M for any sample included in said sample data set₀A sampled value of (A), said M₀And calculating the time delay for the preset fluctuation rate.

Optionally, the fifth obtaining unit 602 is configured to calculate an upward fluctuation rate sequence volaydown (i) according to a seventh formula;

the seventh formula is:

wherein i is any sampling point included in the sample data set, and min is_i＝MIN(X_i) Said X is_iIs the sample value of any sample included in the sample data set at sample point iThe above-mentionedAt sample point i-M for any sample included in said sample data set₀A sampled value of (A), said M₀And calculating the time delay for the preset fluctuation rate.

A sixth obtaining unit 603, configured to train the target sample data set and the fluctuation rate sequence to obtain the fluctuation trajectory line set, where the fluctuation trajectory line set includes an upward fluctuation trajectory line obtained by training the target sample data set and the upward fluctuation rate sequence, and the fluctuation trajectory line set further includes a downward fluctuation trajectory line obtained by training the target sample data set and the downward fluctuation rate sequence.

Optionally, the sixth obtaining unit 603 is further configured to take a value at sampling point i for each sample in the sample data set agoris samppool, and then average the values to obtain an average curve value sampmean (i) ═ MEAN { agoris samppool (i);

calculating an upward fluctuation trajectory line value CurveUp according to an eighth formula, wherein the eighth formula is as follows: (ii) curveup (i) sampmean (i) [1+ volatyup (i) ], wherein the volatyup (i) is the upward fluctuation rate sequence;

calculating the upward fluctuation trajectory OrbitUp according to the upward fluctuation trajectory line value CurveUp;

calculating a downward fluctuation trajectory line value CurveDown according to a ninth formula, wherein the ninth formula is as follows: curvedown (i) MIN {0, sampmean (i) · [ 1-volatywown (i) ] }, wherein the volatywown (i) is the downward volatility sequence;

and calculating the downward fluctuation trajectory OrbitDo according to the downward fluctuation trajectory line value CurveDow. wn

The above-mentionedThe sixth obtaining unit 603 is further configured to determine any sampling point i in the sample data set agori samppoolAdjusting the upward fluctuation trajectory line value currveup according to a tenth formula to obtain an adjusted upward fluctuation trajectory line value volatyup (i), wherein α₀And said N₀Is a preset threshold value; the tenth formula is:

CurveUp(i)＝CurveUp(i)·[1+α₀]；

adjusting the downward fluctuation track line value CurveDown according to an eleventh formula to obtain an adjusted downward fluctuation track line value VolatyDown (i);

the eleventh formula is:

CurveDown(i)＝CurveDown(i)·[1-α₀]。

optionally, the sixth obtaining unit 603 is further configured to calculate the upward fluctuation trajectory OrbitUp according to a twelfth formula and the upward fluctuation trajectory line value currveup, where the twelfth formula is: orbitup (i) ═ 1+ N₀·α₀)·MEAN{FitUp(i),CurveUp(i)}；

The calculating the downward fluctuation trajectory OrbitDown according to the downward fluctuation trajectory line value CurveDown comprises:

the thirteenth formula is:

OrbitDown(i)＝(1-N₀·α₀)·MEAN{FitDown(i),CurveDown(i)}。

a first obtaining unit 604, configured to obtain sampling data reported by a current monitoring point;

a second obtaining unit 605, configured to obtain a sampling value of a target sampling point, where the target sampling point is any sampling point in the sampling data;

a third obtaining unit 606, configured to obtain an alarm tag through a sampling value of the target sampling point and a preset fluctuation trajectory line set, where the fluctuation trajectory line set includes a fluctuation trajectory line obtained by training a preset target sample data set and a fluctuation rate sequence, and the fluctuation rate sequence is a sequence formed by the fluctuation rate of any sampling point included in the target sample data set;

the third obtaining unit 606 is further configured to calculate an derailment tag outFlag according to a first formula;

the first formula is:

wherein i ═ 1,2, …, n denotes the target sampling point, said samp (i) is the sampling value of the target sampling point, said orbitup (i) is the value of the upward fluctuating trajectory line comprised by the set of fluctuating trajectory lines corresponding to the target sampling point, said orbitdown (i) is the value of the downward fluctuating trajectory line comprised by the set of fluctuating trajectory lines corresponding to the target sampling point;

if N is continuous₀Generating the alarm tag if the derailment tag outFlag of each target sampling point is equal to 1, wherein N is₀The number of the glitches is a preset threshold value.

Optionally, the third obtaining unit 606 is further configured to calculate a fluctuating mutation tag violentFlag according to a second formula;

the second formula is:

wherein, said γ is_iIs the targetThe fluctuation rate of the sampling point, wherein up _ limit is the fluctuation rate upper limit value of the target sampling point, and down _ limit is the fluctuation rate lower limit value of the target sampling point;

if M is continuous₀Generating the alarm tag if the fluctuating mutation tag violentFlag of each target sampling point is equal to 1, wherein M is₀And calculating the time delay for the preset fluctuation rate.

Optionally, the third obtaining unit 606 is further configured to determine whether the target sampling point is less than or equal to M₀；

the fifth formula is: down _ limit MIN {1, | volatydown (i) · (1-N)₀·α₀)|}，Wherein the VolatyDown (i) is the downward fluctuation rate sequence.

A sending unit 607, configured to send alarm information according to the alarm tag.

The beneficial effects of the electronic device shown in this embodiment for executing the alarm method based on traffic monitoring shown in the above embodiment are shown in the above embodiment for details, and are not described in detail in this embodiment.

Based on the electronic device shown in fig. 1, the electronic device shown in this embodiment further includes one or more programs, where the one or more programs are stored in the storage unit, and the one or more programs include instructions, and when the instructions are executed by the electronic device, the electronic device executes the method described in the foregoing embodiment, and a specific execution process is not described again.

The electronic device shown in this embodiment further includes a computer-readable storage medium storing one or more programs, where the one or more programs include instructions, and when the instructions are executed by the electronic device, the electronic device executes the method according to the foregoing embodiment, and a specific execution process is not described in detail.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.

Claims

1. An alarm method based on flow monitoring is characterized by comprising the following steps:

acquiring sampling data reported by a current monitoring point;

and sending alarm information according to the alarm tag.

2. The method of claim 1, wherein before the obtaining of the alarm tag from the sample values of the target sample points and the preset set of fluctuation trajectory lines, the method further comprises:

acquiring the target sample data set of the current monitoring point;

acquiring a fluctuation rate sequence of the target sample data set, wherein the fluctuation rate sequence comprises an upward fluctuation rate sequence and a downward fluctuation rate sequence, the upward fluctuation rate sequence is a sequence formed by upward fluctuation rates of all sampling points included in the target sample data set, and the downward fluctuation rate sequence is a sequence formed by downward fluctuation rates of all sampling points included in the target sample data set;

training the target sample data set and the fluctuation rate sequence to obtain the fluctuation trajectory set, wherein the fluctuation trajectory set comprises an upward fluctuation trajectory obtained by training the target sample data set and the upward fluctuation rate sequence, and the fluctuation trajectory set further comprises a downward fluctuation trajectory obtained by training the target sample data set and the downward fluctuation rate sequence.

3. The method according to claim 1 or 2, wherein the obtaining of the alarm tag through the sampling values of the target sampling points and the preset set of fluctuation trajectory lines comprises:

calculating an out-of-orbit tag outFlag according to a first formula;

the first formula is:

4. The method of claim 3, wherein the obtaining an alarm tag from the sample values of the target sample points and a preset set of fluctuation trajectory lines comprises:

the second formula is:

5. The method according to claim 4, wherein before calculating the mutation by fluctuation tag violentFlag according to the second formula, the method further comprises:

judging whether the target sampling point is less than or equal to M₀；

6. The method of claim 1, further comprising:

acquiring an initial sample data set of the current monitoring point;

preprocessing all samples in the initial sample data set in a preprocessing mode to obtain a preprocessed sample data set;

the pretreatment mode is at least one of the following modes:

7. The method of claim 2, wherein said obtaining a sequence of fluctuation rates of the sample data set comprises:

calculating a VolatyUp (i) of the upward fluctuation rate according to a sixth formula;

the sixth formula is:

wherein i is any sample point included in the sample data set, and max_i＝MAX(X_i) Said X is_iSample values at sample point i for all samples comprised in the sample data set, the sample valuesThe above-mentionedAt sample points i-M for all samples included in the sample data set₀A sampled value of (A), said M₀And calculating the time delay for the preset fluctuation rate.

8. The method of claim 2, wherein said obtaining a sequence of fluctuation rates of the sample data set comprises:

calculating a VolatyDown (i) sequence of upward fluctuation rate according to a seventh formula;

the seventh formula is:

wherein i is any sampling point included in the sample data set, and min is_i＝MIN(X_i) Said X is_iSample values at sample point i for all samples comprised in the sample data set, the sample valuesThe above-mentionedAt sample points i-M for all samples included in the sample data set₀A sampled value of (A), said M₀And calculating the time delay for the preset fluctuation rate.

9. The method of claim 2, wherein training the sample data set and the sequence of fluctuation rates to obtain the set of fluctuation trajectory lines comprises:

taking the value of a sampling point i for each sample in the sample data set agorivamppool, and averaging to obtain an average curve value sampmean (i) ═ MEAN { agorivamppool (i);

and calculating the downward fluctuation trajectory OrbitDo according to the downward fluctuation trajectory line value CurveDow.

10. The method of claim 9, further comprising:

if any sampling point i in the sample data set AgoriSampPool is determinedAdjusting the upward fluctuation trajectory line value currveup according to a tenth formula to obtain an adjusted upward fluctuation trajectory line value volatyup (i), wherein α₀And said N₀Is a preset threshold value; the tenth formula is:

CurveUp(i)＝CurveUp(i)·[1+α₀]；

the eleventh formula is:

CurveDown(i)＝CurveDown(i)·[1-α₀]。

11. the method according to claim 9 or 10, wherein said calculating said upward fluctuation trajectory OrbitUp from said upward fluctuation trajectory value CurveUp comprises:

the twelfth formula is: orbitup (i) ═ 1+ N₀·α₀)·MEAN{FitUp(i),CurveUp(i)}；

the thirteenth formula is:

OrbitDown(i)＝(1-N₀·α₀)·MEAN{FitDown(i),CurveDown(i)}。

12. an electronic device, comprising:

13. The electronic device of claim 12, further comprising:

a fourth obtaining unit, configured to obtain the target sample data set of the current monitoring point;

a fifth obtaining unit, configured to obtain a fluctuation rate sequence of the target sample data set, where the fluctuation rate sequence includes an upward fluctuation rate sequence and a downward fluctuation rate sequence, the upward fluctuation rate sequence is a sequence formed by upward fluctuation rates of all sampling points included in the target sample data set, and the downward fluctuation rate sequence is a sequence formed by downward fluctuation rates of all sampling points included in the target sample data set;

a sixth obtaining unit, configured to train the target sample data set and the fluctuation rate sequence to obtain the fluctuation trajectory line set, where the fluctuation trajectory line set includes an upward fluctuation trajectory line obtained by training the target sample data set and the upward fluctuation rate sequence, and the fluctuation trajectory line set further includes a downward fluctuation trajectory line obtained by training the target sample data set and the downward fluctuation rate sequence.

14. An electronic device, comprising:

wherein the one or more programs are stored in the storage unit, the one or more programs comprising instructions which, when executed by the electronic device, cause the electronic device to perform the method of any of claims 1-11.

15. A computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device, cause the electronic device to perform the method of any of claims 1-11.