CN109034180A - Method for detecting abnormality, device, computer readable storage medium and electronic equipment - Google Patents
Method for detecting abnormality, device, computer readable storage medium and electronic equipment Download PDFInfo
- Publication number
- CN109034180A CN109034180A CN201810552461.8A CN201810552461A CN109034180A CN 109034180 A CN109034180 A CN 109034180A CN 201810552461 A CN201810552461 A CN 201810552461A CN 109034180 A CN109034180 A CN 109034180A
- Authority
- CN
- China
- Prior art keywords
- period
- detected
- abnormal
- point
- vector
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
Abstract
This disclosure relates to a kind of method for detecting abnormality, device, computer readable storage medium and electronic equipment, which comprises the data treated in detection cycle are sampled, and destination sample point data is obtained；Destination sample point data is carried out a point bucket according to default point barrelage to handle, and determines corresponding point of bucket vector of period to be detected；According to corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector of period to be detected, determine the target component between period to be detected and abnormal period, wherein, target component is used to characterize the similarity between period to be detected and abnormal period, corresponding point of bucket vector of abnormal period is by determining after carrying out point bucket processing according to default point barrelage to the sample point data in abnormal period, also, the period to be detected is identical as the duration of abnormal period；According to target component, the abnormality detection result for being directed to the period to be detected is obtained.Therefore, the efficiency and accuracy rate of abnormality detection be can effectively improve, user experience is promoted.
Description
Technical field
This disclosure relates to abnormality detection field, and in particular, to a kind of method for detecting abnormality, computer-readable is deposited device
Storage media and electronic equipment.
Background technique
The development of information technology, so that digitized information management enters more and more industries, however in digitized information
During management, abnormal conditions are easy to appear, are made troubles to the use of user.Therefore, it found the abnormal situation in time then outstanding
It is important.In the prior art, under type such as is generallyd use to carry out abnormality detection:
1, the mode based on Manual definition's threshold value.For example, by setting outlier threshold, when the data of index are higher than the exception
When threshold value, determine that the data of the index are abnormal.But in this approach, accuracy rate, the robustness of threshold value setting are all lower.
2, it is based on outlier detection.In this approach, when the point feature that peels off is unobvious, the efficiency of abnormality detection and accurate
Rate is all relatively low.
3, based on the non supervision model of time series predicting model, i.e., model is established by historical data, passes through prediction
Mode carries out abnormality detection.But in this approach, data to be tested can not be detected using known exception.
Summary of the invention
To solve the above-mentioned problems, the disclosure provide a kind of method for detecting abnormality, device, computer readable storage medium and
Electronic equipment.
To achieve the goals above, according to the disclosure in a first aspect, provide a kind of method for detecting abnormality, the method packet
It includes:
The data treated in detection cycle are sampled, and destination sample point data is obtained；
The destination sample point data is carried out a point bucket according to default point barrelage to handle, and determines the period pair to be detected
That answers divides bucket vector；
According to described corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector of period to be detected, institute is determined
State the target component between period to be detected and the abnormal period, wherein the target component is described to be detected for characterizing
Similarity between period and the abnormal period, corresponding point of bucket vector of the abnormal period is by the abnormal period
What interior sample point data determine after point bucket processing according to the default point barrelage, also, the period to be detected with
The duration of the abnormal period is identical；
According to the target component, the abnormality detection result for being directed to the period to be detected is obtained.
Optionally, described according to described corresponding with known abnormal period point of bucket of corresponding point of bucket vector of period to be detected
Vector determines the target component between the period to be detected and the abnormal period, comprising:
Described corresponding point of bucket vector of period to be detected is mapped to binary vector according to preset mapping ruler, to obtain
Obtain the period to be detected corresponding feature vector；
According to period to be detected corresponding feature vector feature vector corresponding with the abnormal period, determine described in
Target component between period to be detected and the abnormal period, wherein the corresponding feature vector of the abnormal period is to pass through
Corresponding point of bucket vector of the abnormal period is obtained in such a way that the preset mapping ruler is mapped to binary vector
's.
Optionally, the preset mapping ruler is ITQ algorithm.
Optionally, it is described according to period to be detected corresponding feature vector feature corresponding with the abnormal period to
Amount, determines the target component between the period to be detected and the abnormal period, comprising:
Determine the Chinese between the period to be detected corresponding feature vector feature vector corresponding with the abnormal period
Prescribed distance；
The Hamming distance is mapped to preset numerical intervals, and the numerical value that mapping obtains is determined as the target and is joined
Number, wherein more similar between the smaller expression period to be detected and the abnormal period of target component.
Optionally, described that the abnormality detection result for being directed to the period to be detected is obtained according to the target component, including
At least one of below:
When determining that the period to be detected is similar to the abnormal period according to the target component, determine described to be checked
The survey period is abnormal；
It is when determining that the period to be detected is similar to the abnormal period according to the target component, the exception is all
Phase corresponding anomalous event is included in the abnormality detection result in the period to be detected；
When determining that the period to be detected is similar to the abnormal period according to the target component, the target is joined
Number is included in the abnormality detection result in the period to be detected.
Optionally, the method also includes:
When determining that the period to be detected is similar to the abnormal period according to the target component, output with it is described different
Often period corresponding abnormal solution.
According to the second aspect of the disclosure, a kind of abnormal detector is provided, described device includes:
Sampling module, the data for treating in detection cycle are sampled, and destination sample point data is obtained；
First processing module is handled for the destination sample point data to be carried out a point bucket according to default point barrelage, and really
Fixed described corresponding point of bucket vector of period to be detected；
Determining module, for according to described corresponding with known abnormal period point of corresponding point of bucket vector of period to be detected
Bucket vector, determines the target component between the period to be detected and the abnormal period, wherein the target component is used for table
The similarity between the period to be detected and the abnormal period is levied, corresponding point of bucket vector of the abnormal period is by right
What sample point data in the abnormal period determine after point bucket processing according to the default point barrelage, also, it is described
Period to be detected is identical as the duration of the abnormal period；
Second processing module, for obtaining the abnormality detection knot for being directed to the period to be detected according to the target component
Fruit.
Optionally, the determining module includes:
Mapping submodule, for described corresponding point of bucket vector of period to be detected to be mapped to according to preset mapping ruler
Binary vector, to obtain the period to be detected corresponding feature vector；
First determines submodule, for corresponding with the abnormal period according to period to be detected corresponding feature vector
Feature vector, determine the target component between the period to be detected and the abnormal period, wherein the abnormal period pair
The feature vector answered is by the way that corresponding point of bucket vector of the abnormal period is mapped to two according to the preset mapping ruler
What the mode of system vector obtained.
Optionally, the preset mapping ruler is ITQ algorithm.
Optionally, described first determine that submodule includes:
Second determines submodule, for determining that the period to be detected corresponding feature vector is corresponding with the abnormal period
Feature vector between Hamming distance；
Third determines submodule, for the Hamming distance to be mapped to preset numerical intervals, and mapping is obtained
Numerical value is determined as the target component, wherein the target component is smaller to indicate the period to be detected and the abnormal period
Between it is more similar.
Optionally, the Second processing module includes at least one of following:
4th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, determine that the period to be detected is abnormal；
5th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, the corresponding anomalous event of the abnormal period is included in the abnormality detection result in the period to be detected；
6th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, the target component is included in the abnormality detection result in the period to be detected.
Optionally, described device further include:
Output module, for determining that the period to be detected is similar to the abnormal period according to the target component
When, export abnormal solution corresponding with the abnormal period.
According to the third aspect of the disclosure, a kind of computer readable storage medium is provided, computer program is stored thereon with,
The program realizes the step of above-mentioned first aspect any the method when being executed by processor.
According to the fourth aspect of the disclosure, a kind of electronic equipment is provided, comprising:
Memory is stored thereon with computer program；
Processor, for executing the computer program in the memory, to realize any institute of above-mentioned first aspect
The step of stating method.
In the above-mentioned technical solutions, it is sampled by the data treated in detection cycle and bucket is divided to handle, it can be effective
Reduce the data volume in abnormality detecting process.Meanwhile according to described corresponding point of bucket vector of period to be detected and known exception
Corresponding point of bucket vector of period, determines the abnormality detection result in period to be detected, on the one hand, can use known abnormal period
Corresponding data characteristics is treated detection cycle and is carried out abnormality detection, and the efficiency and accuracy rate of abnormality detection are effectively improved, avoid by
In setting outlier threshold deviation or outlier is unobvious influences caused by abnormality detection result.On the other hand, by be detected
Period is compared with the data in abnormal period, can be single with the period with the abnormality detection result in determination period to be detected
Position carries out abnormality detection, and can not only guarantee there is apparent data characteristics, but also can cause to avoid data volume difference to testing result
Influence, be further ensured that the accuracy rate of abnormality detection, promote user experience.
Other feature and advantage of the disclosure will the following detailed description will be given in the detailed implementation section.
Detailed description of the invention
Attached drawing is and to constitute part of specification for providing further understanding of the disclosure, with following tool
Body embodiment is used to explain the disclosure together, but does not constitute the limitation to the disclosure.In the accompanying drawings:
Fig. 1 is the flow chart of the method for detecting abnormality provided according to an embodiment of the present disclosure；
Fig. 2 is determined according to corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector of period to be detected
A kind of flow chart of example implementations of target component between period to be detected and abnormal period；
Fig. 3 is determined to be detected according to period to be detected corresponding feature vector feature vector corresponding with abnormal period
A kind of flow chart of example implementations of target component between period and abnormal period；
Fig. 4 is the block diagram of the abnormal detector provided according to an embodiment of the present disclosure；
Fig. 5 is the block diagram of the determining module of the abnormal detector provided according to the another embodiment of the disclosure；
Fig. 6 is the frame of the first determining submodule of the abnormal detector provided according to the another embodiment of the disclosure
Figure；
Fig. 7 is the block diagram of a kind of electronic equipment shown according to an exemplary embodiment；
Fig. 8 is the block diagram of a kind of electronic equipment shown according to an exemplary embodiment.
Specific embodiment
It is described in detail below in conjunction with specific embodiment of the attached drawing to the disclosure.It should be understood that this place is retouched
The specific embodiment stated is only used for describing and explaining the disclosure, is not limited to the disclosure.
Shown in Fig. 1, for the flow chart of the method for detecting abnormality provided according to an embodiment of the present disclosure.Such as Fig. 1 institute
Show, which comprises
In S11, the data treated in detection cycle are sampled, and obtain destination sample point data.
It is sampled wherein it is possible to treat the data in detection cycle with prefixed time interval, illustratively, the period to be detected
It can be 1 hour, prefixed time interval is 1 minute, then 60 destination sample point datas can be obtained in the period to be detected.
In S12, destination sample point data is subjected to a point bucket according to default point barrelage and is handled, and determines the period pair to be detected
That answers divides bucket vector.
Illustratively, described preset divides barrelage to be 12, and the destination sample point data is carried out a point bucket according to default point barrelage
A kind of embodiment of processing is as follows:
The destination sample point data is grouped according to 5 one group, wherein 5 destination sample point datas are continuous
Sample point data.Each is grouped a corresponding point of bucket, illustratively, destination sample point data a0、a1、a2、a3And a4It is divided to
Divide bucket A0, illustratively, can be by a0、a1、a2、a3And a4Average value as dividing bucket A0Value, other each point of bucket is with same
Mode obtain.Therefore, destination sample point data can be converted into 12 points of buckets through the above way, 12 points of buckets according to
The sequencing of time is formed by vector and is determined as corresponding point of bucket vector of the period to be detected.
In S13, according to corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector of period to be detected, really
Target component between fixed period to be detected and the abnormal period, wherein the target component is described to be detected for characterizing
Similarity between period and the abnormal period, corresponding point of bucket vector of the abnormal period is by the abnormal period
What interior sample point data determine after point bucket processing according to the default point barrelage, also, the period to be detected with
The duration of the abnormal period is identical.
Wherein, the abnormal period can be determined in the following way:
(1) data in history cycle are sampled, obtain history samples point data, wherein history cycle with it is to be checked
The duration for surveying the period is identical.
(2) the history samples point data a point bucket is carried out according to default point barrelage to handle, it is corresponding to obtain history cycle
Divide bucket vector.
(3) determine that each of corresponding point of bucket vector of history cycle divides barrelage according to whether abnormal respectively.
Wherein it is possible to determine each point of barrelage according to whether abnormal by way of manually marking.For example, technical staff can
To divide barrelage according to abnormal mark is carried out this, illustratively, barrelage can be divided according to mark 1 to abnormal, abnormal divide barrelage to non-
According to mark 0.
For another example, this point of barrelage can also be determined according to whether different according to the log error number in the corresponding period according to this point of barrelage
Often.Illustratively, history cycle is 1 hour,, can at interval of the one history samples point data of acquisition in 1 minute in the history cycle
To obtain 60 history samples point datas.Default that barrelage is divided to be 12, then the first point of barrelage is 0-5 points according to the corresponding period
Therefore whether clock can determine this point of barrelage according to abnormal by determining the log error number of the record in first 5 minutes.For example,
A log error number threshold value can be preset, this divide barrelage according to the log error number in the corresponding period be more than the log
When error number threshold value, this point of bucket data exception is determined.Alternatively, it is also possible to divide barrelage wrong according to the access in the corresponding period by this
Accidentally both number or combination carry out comprehensive consideration, and details are not described herein.The second point of barrelage is 5-10 points according to the corresponding period
Clock, other each point of bucket corresponding periods and so on, and evidence can determination be each point of barrelage through the above way respectively
No exception, details are not described herein.
It (4), will be described when each point of barrelage in corresponding point of bucket vector of the history cycle is according to exceptional condition is met
History cycle is determined as abnormal period.
In one embodiment, the exceptional condition divides barrelage for the exception in corresponding point of bucket vector of the history cycle
According to number be more than first threshold.For example, first threshold is 8, then it is abnormal in corresponding point of bucket vector of history cycle to divide bucket
When the number of data is 9, which can be determined as abnormal period.
In another embodiment, the exceptional condition is the continuous abnormal in corresponding point of bucket vector of the history cycle
The number for dividing barrelage evidence is more than second threshold.For example, first threshold is 4, then it is continuous in corresponding point of bucket vector of history cycle
When dividing barrelage according to being 5 of exception, which can be determined as abnormal period.
Optionally, by the above-mentioned means, multiple abnormal periods can be determined.Also, corresponding point of bucket of abnormal period to
Corresponding with the period to be detected point of bucket vector of amount carries out a point bucket in the same way and handles, it is ensured that data divide the consistent of bucket
Property.In addition, can store the history samples point data in the abnormal period when storing to the known abnormal period,
Alternatively or additionally, it also can store corresponding point of bucket vector of the abnormal period, repeated to avoid to abnormal period
The step of dividing bucket to handle, improve the treatment effeciency of abnormality detection.
Therefore, in one embodiment, corresponding with known abnormal period according to corresponding point of bucket vector of period to be detected
Divide bucket vector, can be by the period to be detected when determining the target component between period to be detected and the abnormal period
Corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector is directly calculated, for example, can directly according to
Corresponding point with known abnormal period bucket vector of corresponding point of bucket vector of detection cycle determines at a distance between the two, such as European
Distance, and the distance is determined as the target component between the period to be detected and the abnormal period.
Optionally, it is described according to corresponding with known abnormal period point of bucket of corresponding point of bucket vector of period to be detected to
Amount, determines that a kind of example implementations of the target component between period to be detected and abnormal period are as follows, such as Fig. 2 institute
Show, comprising:
In S21, corresponding point of bucket vector of period to be detected is mapped to binary vector according to preset mapping ruler,
To obtain period to be detected corresponding feature vector.
Optionally, the preset mapping ruler is ITQ (Iterative Quantization, iterative quantization) algorithm.
Wherein it is possible to according to dividing the length of bucket vector to determine the length of the binary vector after mapping, for example, when the length for dividing bucket vector
When longer, for ease of calculation, the length of the binary vector after mapping can be determined as 64, when the length for dividing bucket vector
When shorter, the length of the binary vector after mapping can be determined as 32.Wherein, by ITQ algorithm, can will divide bucket to
Amount is mapped as binary vector, and corresponding quantization error in the mapping process is effectively reduced, and point bucket vector is effectively ensured and turns
The consistency of feature vector after changing binary system into, the precision of the binary vector after improving mapping, to guarantee subsequent true
The accuracy rate of abnormality detection is effectively ensured in the accuracy for the target component made.
In S22, according to period to be detected corresponding feature vector feature vector corresponding with abnormal period, determine to be checked
Survey the target component between period and the abnormal period, wherein the corresponding feature vector of the abnormal period is by by institute
State what corresponding point of bucket vector of abnormal period obtained in such a way that the preset mapping ruler is mapped to binary vector, it can
To guarantee the consistency between feature vector, converting characteristic vector is avoided to have an impact abnormality detection result.
Wherein, when storing to known abnormal period, the corresponding feature of the abnormal period can also directly be stored
Vector, thus, according to period to be detected corresponding feature vector feature vector corresponding with abnormal period, determine week to be detected
When target component between phase and abnormal period, the corresponding feature vector of abnormal period can also be directly acquired, improves abnormal inspection
The efficiency of survey.
Optionally, described according to period to be detected corresponding feature vector feature vector corresponding with abnormal period, it determines
A kind of example implementations of target component between period to be detected and abnormal period are as follows, as shown in Figure 3, comprising:
In S31, the Chinese between period to be detected corresponding feature vector feature vector corresponding with abnormal period is determined
Prescribed distance.Wherein it is determined that the Hamming distance between two vectors is the prior art, details are not described herein.
In S32, Hamming distance is mapped to preset numerical intervals, and the numerical value that mapping obtains is determined as target ginseng
Number, wherein more similar between the smaller expression period to be detected and the abnormal period of target component.
Illustratively, the preset numerical intervals can be [0,1], therefore, Hamming distance is mapped to preset numerical value
Section, which can be, is normalized Hamming distance, so as to be mapped in the range of [0,1].It therefore, can be with
Resulting numerical value is determined as target component after Hamming distance is normalized.Wherein, target component indicates to be detected closer to 0
Period is more similar to abnormal period, that is, the similarity characterized between the period to be detected and the abnormal period is bigger, target
For parameter closer to 1, the similarity characterized between the period to be detected and the abnormal period is smaller.
Therefore, in the above-mentioned technical solutions, the process for calculating Hamming distance is simple, corresponding by the determination period to be detected
Hamming distance between feature vector feature vector corresponding with abnormal period can be effectively reduced really with determining target component
The complexity for the parameter that sets the goal so as to improve data-handling efficiency and computational efficiency, and then improves the efficiency of abnormality detection.
In another embodiment, period to be detected corresponding feature vector spy corresponding with the abnormal period can be determined
The Euclidean distance between vector is levied, and the Euclidean distance is mapped to preset numerical intervals, for example, [0,1].Therefore, may be used
Resulting numerical value after Euclidean distance mapping is determined as target component.Wherein, target component indicates to be checked closer to 0
The survey period is more similar to abnormal period, that is, the similarity characterized between the period to be detected and the abnormal period is bigger, mesh
Parameter is marked closer to 1, the similarity characterized between the period to be detected and the abnormal period is smaller.
In another embodiment, it is corresponding with abnormal period that period to be detected corresponding feature vector can also be directly determined
Cosine similarity between feature vector, and the cosine similarity is determined as the target component.Wherein, cosine similarity
Value range be [- 1,1], cosine similarity indicates that period to be detected and abnormal period are more similar, that is, characterizes closer to 1
Similarity between the period to be detected and the abnormal period is bigger, cosine similarity closer to -1, characterization it is described to
Similarity between detection cycle and the abnormal period is smaller.
It should be noted that above are only the example for determining the target component between period to be detected and the abnormal period
Property implementation, is not defined the disclosure.Other can characterize similar between period to be detected and the abnormal period
The numerical value of degree can also be used as the target component in the disclosure and be calculated, and details are not described herein.
In the above-mentioned technical solutions, by the way that a barrel vector will be divided to be converted into binary feature vector, data can be lowered
When being calculated later according to the feature vector in period to be detected and abnormal period, the meter of data is can be effectively reduced in complexity
Calculation amount, while the computational efficiency of data can be improved, to improve the efficiency and accuracy rate of abnormality detection, promotes user and use body
It tests.
Fig. 1 is gone back to, in S14, according to target component, obtains the abnormality detection result for being directed to the period to be detected.
Optionally, described that the abnormality detection result for being directed to the period to be detected is obtained according to the target component, including
At least one of below:
When determining that the period to be detected is similar to the abnormal period according to the target component, determine described to be checked
The survey period is abnormal；
It is when determining that the period to be detected is similar to the abnormal period according to the target component, the exception is all
Phase corresponding anomalous event is included in the abnormality detection result in the period to be detected；
When determining that the period to be detected is similar to the abnormal period according to the target component, the target is joined
Number is included in the abnormality detection result in the period to be detected.
Illustratively, one parameter threshold can be set for target component.For example, when target component is corresponding for the period to be detected
Feature vector feature vector corresponding with abnormal period between Hamming distance be mapped to obtained by preset numerical intervals [0,1]
Numerical value when, parameter threshold can be 0.3.When target component is less than 0.3, can determine the period to be detected with it is described different
The normal period is similar, determines that the period to be detected is abnormal.For another example, the target component be period to be detected and abnormal period it
Between cosine similarity, at this point, target component can be set to 0.8, when target component is greater than 0.8, can determine it is described to
Detection cycle is similar to the abnormal period, determines that the period to be detected is abnormal.
Hereinafter, with target component between period to be detected corresponding feature vector feature vector corresponding with abnormal period
Hamming distance be mapped to the resulting numerical value of preset numerical intervals [0,1], parameter threshold be 0.3 for be illustrated.
In one embodiment, when storing known abnormal period, can to the corresponding anomalous event of the abnormal period into
Row associated storage.Therefore, when target component is less than 0.3, it can determine that the period to be detected is similar to abnormal period, at this point, can
The corresponding anomalous event of abnormal period to be included in the abnormality detection result in period to be detected.Meanwhile it can be to the exception
Testing result is exported, to prompt user.
In another embodiment, when target component is less than 0.3, it can determine that the period to be detected is similar to abnormal period,
At this point it is possible to target component is included in the abnormality detection result in period to be detected.Meanwhile it can be to the abnormality detection result
It is exported, to prompt user.
Wherein, the abnormality detection result in the period to be detected may include one or more of above-described embodiment, herein
It repeats no more.
In conclusion in the above-mentioned technical solutions, sampled by the data treated in detection cycle and bucket is divided to handle,
The data volume in abnormality detecting process can be effectively reduced.Meanwhile according to described corresponding point of bucket vector of period to be detected and
Corresponding point of bucket vector of the abnormal period known, determines the abnormality detection result in period to be detected, on the one hand, can use known
The corresponding data characteristics of abnormal period is treated detection cycle and is carried out abnormality detection, and the efficiency of abnormality detection and accurate is effectively improved
Rate is avoided as setting outlier threshold deviation or the unobvious influence caused by abnormality detection result of outlier.On the other hand, lead to
Spend the period to be detected is compared with the data in abnormal period, can be with the abnormality detection result in determination period to be detected
Period carries out abnormality detection for unit, can not only guarantee there is apparent data characteristics, but also can be to avoid data volume difference to detection
As a result it is influenced caused by, is further ensured that the accuracy rate of abnormality detection, promote user experience.
Optionally, the method also includes:
When determining that the period to be detected is similar to the abnormal period according to the target component, output with it is described different
Often period corresponding abnormal solution.
It illustratively, can will be for the different of the anomalous event when determining the corresponding anomalous event of each abnormal period
Normal solution is associated with the abnormal period.Therefore, according to the target component determine the period to be detected with it is described
When abnormal period is similar, indicate that a possibility that abnormal period corresponding anomalous event occurs in the period to be detected is larger, at this time
Abnormal solution corresponding with the abnormal period can be exported, formulates solution party in order to which user is directed to the abnormal conditions in time
Case guarantees going on smoothly for work, further promotes user experience.
The disclosure also provides a kind of abnormal detector.Shown in Fig. 4, provided according to an embodiment of the present disclosure
The block diagram of abnormal detector.As shown in figure 4, described device 10 includes:
Sampling module 100, the data for treating in detection cycle are sampled, and destination sample point data is obtained；
First processing module 200 is handled for the destination sample point data to be carried out a point bucket according to default point barrelage, and
Determine corresponding point of bucket vector of the period to be detected；
Determining module 300, for corresponding with known abnormal period according to described corresponding point of bucket vector of period to be detected
The target component divided bucket vector, determine between the period to be detected and the abnormal period, wherein the target component is used
In characterizing the similarity between the period to be detected and the abnormal period, corresponding point of bucket vector of the abnormal period is logical
It crosses and the sample point data in the abnormal period determine after point bucket processing according to the default point barrelage, also,
The period to be detected is identical as the duration of the abnormal period；
Second processing module 400, for obtaining the abnormality detection for being directed to the period to be detected according to the target component
As a result.
Optionally, as shown in figure 5, the determining module 300 includes:
Mapping submodule 301, for reflecting described corresponding point of bucket vector of period to be detected according to preset mapping ruler
Binary vector is penetrated into, to obtain the period to be detected corresponding feature vector；
First determines submodule 302, for according to the period corresponding feature vector to be detected and the abnormal period
Corresponding feature vector determines the target component between the period to be detected and the abnormal period, wherein the exception is all
Phase corresponding feature vector is by mapping corresponding point of bucket vector of the abnormal period according to the preset mapping ruler
It is obtained at the mode of binary vector.
Optionally, the preset mapping ruler is ITQ algorithm.
Optionally, as shown in fig. 6, described first determines that submodule 302 includes:
Second determines submodule 3021, for determining the period to be detected corresponding feature vector and the abnormal period
Hamming distance between corresponding feature vector；
Third determines submodule 3022, for the Hamming distance to be mapped to preset numerical intervals, and will map
To numerical value be determined as the target component, wherein the target component is smaller to indicate the period to be detected and the exception
It is more similar between period.
Optionally, the Second processing module 400 includes at least one of following:
4th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, determine that the period to be detected is abnormal；
5th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, the corresponding anomalous event of the abnormal period is included in the abnormality detection result in the period to be detected；
6th determines submodule, for determining the period to be detected and the abnormal period according to the target component
When similar, the target component is included in the abnormality detection result in the period to be detected.
Optionally, described device 10 further include:
Output module, for determining that the period to be detected is similar to the abnormal period according to the target component
When, export abnormal solution corresponding with the abnormal period.
About the device in above-described embodiment, wherein modules execute the concrete mode of operation in related this method
Embodiment in be described in detail, no detailed explanation will be given here.
Fig. 7 is the block diagram of a kind of electronic equipment 700 shown according to an exemplary embodiment.As shown in fig. 7, the electronics is set
Standby 700 may include: processor 701, memory 702.The electronic equipment 700 can also include multimedia component 703, input/
Export one or more of (I/O) interface 704 and communication component 705.
Wherein, processor 701 is used to control the integrated operation of the electronic equipment 700, to complete above-mentioned abnormality detection side
All or part of the steps in method.Memory 702 is for storing various types of data to support the behaviour in the electronic equipment 700
To make, these data for example may include the instruction of any application or method for operating on the electronic equipment 700, with
And the relevant data of application program, such as contact data, the message of transmitting-receiving, picture, audio, video etc..The memory 702
It can be realized by any kind of volatibility or non-volatile memory device or their combination, such as static random-access is deposited
Reservoir (Static Random Access Memory, abbreviation SRAM), electrically erasable programmable read-only memory
(Electrically Erasable Programmable Read-Only Memory, abbreviation EEPROM), erasable programmable
Read-only memory (Erasable Programmable Read-Only Memory, abbreviation EPROM), programmable read only memory
(Programmable Read-Only Memory, abbreviation PROM), and read-only memory (Read-Only Memory, referred to as
ROM), magnetic memory, flash memory, disk or CD.Multimedia component 703 may include screen and audio component.Wherein
Screen for example can be touch screen, and audio component is used for output and/or input audio signal.For example, audio component may include
One microphone, microphone is for receiving external audio signal.The received audio signal can be further stored in storage
Device 702 is sent by communication component 705.Audio component further includes at least one loudspeaker, is used for output audio signal.I/O
Interface 704 provides interface between processor 701 and other interface modules, other above-mentioned interface modules can be keyboard, mouse,
Button etc..These buttons can be virtual push button or entity button.Communication component 705 is for the electronic equipment 700 and other
Wired or wireless communication is carried out between equipment.Wireless communication, such as Wi-Fi, bluetooth, near-field communication (Near Field
Communication, abbreviation NFC), 2G, 3G or 4G or they one or more of combination, therefore corresponding communication
Component 705 may include: Wi-Fi module, bluetooth module, NFC module.
In one exemplary embodiment, electronic equipment 700 can be by one or more application specific integrated circuit
(Application Specific Integrated Circuit, abbreviation ASIC), digital signal processor (Digital
Signal Processor, abbreviation DSP), digital signal processing appts (Digital Signal Processing Device,
Abbreviation DSPD), programmable logic device (Programmable Logic Device, abbreviation PLD), field programmable gate array
(Field Programmable Gate Array, abbreviation FPGA), controller, microcontroller, microprocessor or other electronics member
Part is realized, for executing above-mentioned method for detecting abnormality.
In a further exemplary embodiment, a kind of computer readable storage medium including program instruction is additionally provided, it should
The step of above-mentioned method for detecting abnormality is realized when program instruction is executed by processor.For example, the computer readable storage medium
It can be the above-mentioned memory 702 including program instruction, above procedure instruction can be executed by the processor 701 of electronic equipment 700
To complete above-mentioned method for detecting abnormality.
Fig. 8 is the block diagram of a kind of electronic equipment 1900 shown according to an exemplary embodiment.For example, electronic equipment 1900
It may be provided as a server.Referring to Fig. 8, electronic equipment 1900 includes processor 1922, and quantity can be one or more
A and memory 1932, for storing the computer program that can be executed by processor 1922.The meter stored in memory 1932
Calculation machine program may include it is one or more each correspond to one group of instruction module.In addition, processor 1922 can
To be configured as executing the computer program, to execute above-mentioned method for detecting abnormality.
In addition, electronic equipment 1900 can also include power supply module 1926 and communication component 1950, the power supply module 1926
It can be configured as the power management for executing electronic equipment 1900, which can be configured as realization electronic equipment
1900 communication, for example, wired or wireless communication.In addition, the electronic equipment 1900 can also include that input/output (I/O) connects
Mouth 1958.Electronic equipment 1900 can be operated based on the operating system for being stored in memory 1932, such as Windows
ServerTM, Mac OS XTM, UnixTM, LinuxTM etc..
In a further exemplary embodiment, a kind of computer readable storage medium including program instruction is additionally provided, it should
The step of above-mentioned method for detecting abnormality is realized when program instruction is executed by processor.For example, the computer readable storage medium
It can be the above-mentioned memory 1932 including program instruction, above procedure instruction can be held by the processor 1922 of electronic equipment 1900
Row is to complete above-mentioned method for detecting abnormality.
The preferred embodiment of the disclosure is described in detail in conjunction with attached drawing above, still, the disclosure is not limited to above-mentioned reality
The detail in mode is applied, in the range of the technology design of the disclosure, a variety of letters can be carried out to the technical solution of the disclosure
Monotropic type, these simple variants belong to the protection scope of the disclosure.
It is further to note that specific technical features described in the above specific embodiments, in not lance
In the case where shield, it can be combined in any appropriate way.In order to avoid unnecessary repetition, the disclosure to it is various can
No further explanation will be given for the combination of energy.
In addition, any combination can also be carried out between a variety of different embodiments of the disclosure, as long as it is without prejudice to originally
Disclosed thought equally should be considered as disclosure disclosure of that.
Claims (10)
1. a kind of method for detecting abnormality, which is characterized in that the described method includes:
The data treated in detection cycle are sampled, and destination sample point data is obtained；
The destination sample point data is carried out a point bucket according to default point barrelage to handle, and determines that the period to be detected is corresponding
Divide bucket vector；
According to described corresponding with known abnormal period point of bucket vector of corresponding point of bucket vector of period to be detected, determine it is described to
Target component between detection cycle and the abnormal period, wherein the target component is for characterizing the period to be detected
With the similarity between the abnormal period, corresponding point of bucket vector of the abnormal period is by the abnormal period
What sample point data determine after point bucket processing according to the default point barrelage, also, the period to be detected with it is described
The duration of abnormal period is identical；
According to the target component, the abnormality detection result for being directed to the period to be detected is obtained.
2. the method according to claim 1, wherein described according to described corresponding point of bucket vector of period to be detected
Corresponding with known abnormal period point of bucket vector determines the target ginseng between the period to be detected and the abnormal period
Number, comprising:
Described corresponding point of bucket vector of period to be detected is mapped to binary vector according to preset mapping ruler, to obtain
State period to be detected corresponding feature vector；
According to period to be detected corresponding feature vector feature vector corresponding with the abnormal period, determine described to be checked
Survey the target component between period and the abnormal period, wherein the corresponding feature vector of the abnormal period is by by institute
State what corresponding point of bucket vector of abnormal period obtained in such a way that the preset mapping ruler is mapped to binary vector.
3. according to the method described in claim 2, it is characterized in that, the preset mapping ruler is ITQ algorithm.
4. according to the method described in claim 2, it is characterized in that, described according to period to be detected corresponding feature vector
Feature vector corresponding with the abnormal period determines the target component between the period to be detected and the abnormal period,
Include:
Determine the Hamming distance between the period to be detected corresponding feature vector feature vector corresponding with the abnormal period
From；
The Hamming distance is mapped to preset numerical intervals, and the numerical value that mapping obtains is determined as the target component,
Wherein, more similar between the smaller expression period to be detected and the abnormal period of the target component.
5. the method according to claim 1, wherein described according to the target component, obtain for it is described to
The abnormality detection result of detection cycle, including at least one of following:
When determining that the period to be detected is similar to the abnormal period according to the target component, the week to be detected is determined
Phase is abnormal；
When determining that the period to be detected is similar to the abnormal period according to the target component, by the abnormal period pair
The anomalous event answered is included in the abnormality detection result in the period to be detected；
When determining that the period to be detected is similar to the abnormal period according to the target component, by the target component packet
It is contained in the abnormality detection result in the period to be detected.
6. method according to any one of claims 1-5, which is characterized in that the method also includes:
When determining that the period to be detected is similar to the abnormal period according to the target component, export all with the exception
Phase corresponding abnormal solution.
7. a kind of abnormal detector, which is characterized in that described device includes:
Sampling module, the data for treating in detection cycle are sampled, and destination sample point data is obtained；
First processing module is handled for the destination sample point data to be carried out a point bucket according to default point barrelage, and determines institute
State corresponding point of bucket vector of period to be detected；
Determining module, for according to described corresponding with known abnormal period point of bucket of corresponding point of bucket vector of period to be detected to
Amount, determines the target component between the period to be detected and the abnormal period, wherein the target component is for characterizing institute
The similarity between period to be detected and the abnormal period is stated, corresponding point of bucket vector of the abnormal period is by described
What sample point data in abnormal period determine after point bucket processing according to the default point barrelage, also, it is described to be checked
It is identical as the duration of the abnormal period to survey the period；
Second processing module, for obtaining the abnormality detection result for being directed to the period to be detected according to the target component.
8. device according to claim 7, which is characterized in that the determining module includes:
Mapping submodule, for by described corresponding point of bucket vector of period to be detected according to preset mapping ruler be mapped to two into
Vector processed, to obtain the period to be detected corresponding feature vector；
First determines submodule, for according to period to be detected corresponding feature vector spy corresponding with the abnormal period
Vector is levied, determines the target component between the period to be detected and the abnormal period, wherein the abnormal period is corresponding
Feature vector is by the way that corresponding point of bucket vector of the abnormal period is mapped to binary system according to the preset mapping ruler
What the mode of vector obtained.
9. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the program is held by processor
The step of any one of claim 1-6 the method is realized when row.
10. a kind of electronic equipment characterized by comprising
Memory is stored thereon with computer program；
Processor, for executing the computer program in the memory, to realize described in any one of claim 1-6
The step of method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810552461.8A CN109034180B (en) | 2018-05-31 | 2018-05-31 | Abnormality detection method, abnormality detection device, computer-readable storage medium, and electronic apparatus |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810552461.8A CN109034180B (en) | 2018-05-31 | 2018-05-31 | Abnormality detection method, abnormality detection device, computer-readable storage medium, and electronic apparatus |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109034180A true CN109034180A (en) | 2018-12-18 |
| CN109034180B CN109034180B (en) | 2020-11-03 |
Family
ID=64611832
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810552461.8A Active CN109034180B (en) | 2018-05-31 | 2018-05-31 | Abnormality detection method, abnormality detection device, computer-readable storage medium, and electronic apparatus |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109034180B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111291131A (en) * | 2019-12-25 | 2020-06-16 | 东软集团股份有限公司 | Data processing method, data processing device, storage medium and electronic equipment |
| CN111310697A (en) * | 2020-02-17 | 2020-06-19 | 硕橙（厦门）科技有限公司 | Equipment operation period detection and health degree analysis method and device and storage medium |
| CN111966677A (en) * | 2020-06-28 | 2020-11-20 | 北京百度网讯科技有限公司 | Data report processing method and device, electronic equipment and storage medium |
| CN113280265A (en) * | 2020-02-20 | 2021-08-20 | 中国石油天然气股份有限公司 | Working condition identification method and device, computer equipment and storage medium |
| CN111966677B (en) * | 2020-06-28 | 2024-04-19 | 北京百度网讯科技有限公司 | Data report processing method and device, electronic equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101441107B1 (en) * | 2013-04-29 | 2014-09-23 | 주식회사 에스원 | Method and apparatus for determining abnormal behavior |
| CN105262647A (en) * | 2015-11-27 | 2016-01-20 | 广州神马移动信息科技有限公司 | Abnormal index detection method and device |
| CN107085548A (en) * | 2016-02-16 | 2017-08-22 | 阿里巴巴集团控股有限公司 | A kind of method, device and electronic equipment for monitoring application program internal memory |
-
2018
- 2018-05-31 CN CN201810552461.8A patent/CN109034180B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101441107B1 (en) * | 2013-04-29 | 2014-09-23 | 주식회사 에스원 | Method and apparatus for determining abnormal behavior |
| CN105262647A (en) * | 2015-11-27 | 2016-01-20 | 广州神马移动信息科技有限公司 | Abnormal index detection method and device |
| CN107085548A (en) * | 2016-02-16 | 2017-08-22 | 阿里巴巴集团控股有限公司 | A kind of method, device and electronic equipment for monitoring application program internal memory |
Non-Patent Citations (1)
| Title |
|---|
| 吴志忠等: "基于用户行为周期的移动设备异常检测方法", 《计算机系统应用》 * |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111291131A (en) * | 2019-12-25 | 2020-06-16 | 东软集团股份有限公司 | Data processing method, data processing device, storage medium and electronic equipment |
| CN111310697A (en) * | 2020-02-17 | 2020-06-19 | 硕橙（厦门）科技有限公司 | Equipment operation period detection and health degree analysis method and device and storage medium |
| CN111310697B (en) * | 2020-02-17 | 2023-03-24 | 硕橙（厦门）科技有限公司 | Equipment operation period detection and health degree analysis method and device and storage medium |
| CN113280265A (en) * | 2020-02-20 | 2021-08-20 | 中国石油天然气股份有限公司 | Working condition identification method and device, computer equipment and storage medium |
| CN113280265B (en) * | 2020-02-20 | 2022-08-05 | 中国石油天然气股份有限公司 | Working condition identification method and device, computer equipment and storage medium |
| CN111966677A (en) * | 2020-06-28 | 2020-11-20 | 北京百度网讯科技有限公司 | Data report processing method and device, electronic equipment and storage medium |
| CN111966677B (en) * | 2020-06-28 | 2024-04-19 | 北京百度网讯科技有限公司 | Data report processing method and device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109034180B (en) | 2020-11-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109034180A (en) | Method for detecting abnormality, device, computer readable storage medium and electronic equipment | |
| CN107861915A (en) | Obtain the method, apparatus and storage medium of threshold value of warning | |
| CN108986822A (en) | Audio recognition method, device, electronic equipment and non-transient computer storage medium | |
| WO2013075420A1 (en) | Method and device for calculating battery electricity quantity, and terminal | |
| CN106598822B (en) | A kind of abnormal deviation data examination method and device for Capacity Assessment | |
| CN110769452B (en) | Base station longitude and latitude anomaly identification method, system, server and storage medium | |
| CN107611507A (en) | Update method, device and the mobile terminal of battery parameter | |
| CN108761105B (en) | Blood coagulation time determination method, electronic device, and storage medium | |
| CN104580906B (en) | A kind of method and device for correcting the rotating camera anglec of rotation | |
| CN114924119B (en) | Clock chip and frequency measuring method | |
| CN109800858A (en) | Data exception detection method, device, readable storage medium storing program for executing and electronic equipment | |
| CN110580217B (en) | Software code health degree detection method, processing method, device and electronic equipment | |
| CN107135230A (en) | A kind of network flow abnormal detecting method and equipment based on INFIGARCH models | |
| CN114777656B (en) | Optical fiber gyroscope screening ring system based on neural network, method and storage medium | |
| US10790688B2 (en) | Method for measuring battery parameters under discharge or charge | |
| CN105910620B (en) | The processing method and processing device of step counting data | |
| CN109739720A (en) | Method for detecting abnormality, device, storage medium and electronic equipment | |
| CN111637975B (en) | Wrist temperature measuring method and device, wearable device and storage medium | |
| CN110580218A (en) | software code complexity detection method and device and electronic equipment | |
| US10054620B2 (en) | Method and data processing arrangement for determining the frequency, amplitude and attenuation of at least one output oscillation in an electrical energy supply network | |
| CN109739940A (en) | On-line analytical processing method, apparatus, storage medium and electronic equipment | |
| CN112802483B (en) | Method, device and storage medium for optimizing intention recognition confidence threshold | |
| US11403544B1 (en) | System, method, and computer program for validating artificial intelligence models | |
| CN114328662A (en) | Abnormal data positioning method and device, electronic equipment and storage medium | |
| TWI292986B (en) | Determining characteristics of communications signals |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |