CN110262950A - Abnormal movement detection method and device based on many index - Google Patents
Abnormal movement detection method and device based on many index Download PDFInfo
- Publication number
- CN110262950A CN110262950A CN201910425881.4A CN201910425881A CN110262950A CN 110262950 A CN110262950 A CN 110262950A CN 201910425881 A CN201910425881 A CN 201910425881A CN 110262950 A CN110262950 A CN 110262950A
- Authority
- CN
- China
- Prior art keywords
- index
- timing
- indices
- many
- series data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 29
- 208000012661 Dyskinesia Diseases 0.000 title claims abstract description 10
- 238000003062 neural network model Methods 0.000 claims abstract description 44
- 238000000034 method Methods 0.000 claims abstract description 26
- 230000002159 abnormal effect Effects 0.000 claims abstract description 22
- 238000012549 training Methods 0.000 claims description 40
- 238000013527 convolutional neural network Methods 0.000 claims description 24
- 239000011159 matrix material Substances 0.000 claims description 15
- 230000000750 progressive effect Effects 0.000 claims description 6
- 230000004075 alteration Effects 0.000 claims description 5
- 238000004590 computer program Methods 0.000 claims description 4
- 238000012545 processing Methods 0.000 claims description 4
- 230000000694 effects Effects 0.000 abstract description 8
- 238000010586 diagram Methods 0.000 description 12
- 238000013528 artificial neural network Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 4
- 230000004044 response Effects 0.000 description 3
- 101100063432 Caenorhabditis elegans dim-1 gene Proteins 0.000 description 2
- 101000773151 Homo sapiens Thioredoxin-like protein 4B Proteins 0.000 description 2
- 102100030273 Thioredoxin-like protein 4B Human genes 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 238000000714 time series forecasting Methods 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000013211 curve analysis Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010191 image analysis Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 230000001953 sensory effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000003319 supportive effect Effects 0.000 description 1
- 230000003442 weekly effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Biomedical Technology (AREA)
- Molecular Biology (AREA)
- Biophysics (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Image Analysis (AREA)
Abstract
This specification embodiment provides a kind of abnormal movement detection method and device based on many index, method includes: the time series data for obtaining many index of the system in current time period first, then according to the time series data of many index, generate timing image, the timing image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve, finally using the timing image as the input of neural network model trained in advance, it is whether abnormal that system in current time period is obtained by the output of the neural network model, many index can effectively be merged, better detection effect is provided.
Description
Technical field
This specification one or more embodiment is related to computer field, more particularly to the detection of the unusual fluctuation based on many index
Method and apparatus.
Background technique
Along with the fast development of multiple business in emerging industry, big companies some at this stage play a supportive role in bottom
System platform quantity just reach it is hundreds of, code, database and the configuration change etc. of these platforms weekly reached it is thousands of, any one
The carelessness of link, mistake, all may cause system risk, bring massive losses to company.
Intelligent monitoring provides and problem alarm ability is occurring, help sensory perceptual system failure as a kind of detection means.It is logical
Normal time series forecasting is as a kind of effective monitoring means, one of project as industry research, when be based on many index into
When row unusual fluctuation detects, many index usually can not be effectively merged, so that detection effect is bad.
Accordingly, it would be desirable to there is improved plan, when carrying out unusual fluctuation detection based on many index, can effectively merge more
Item index, provides better detection effect.
Summary of the invention
This specification one or more embodiment describes a kind of abnormal movement detection method and device based on many index, energy
It is enough effectively to merge many index, better detection effect is provided.
In a first aspect, providing a kind of abnormal movement detection method based on many index, method includes:
Obtain the time series data of many index of the system in current time period；
According to the time series data of many index, timing image is generated, the timing image includes a plurality of timing curve,
The corresponding Xiang Zhibiao of every timing curve；
Using the timing image as the input of neural network model trained in advance, pass through the neural network model
Whether output obtains system in current time period abnormal.
In a kind of possible embodiment, the when ordinal number of many index for obtaining the system in current time period
According to, comprising:
The number of data, every preset time period at the beginning of many index of system in acquisition current time period
According to the data of, finish time.
In a kind of possible embodiment, the time series data according to many index generates timing image, packet
It includes:
The many index is sorted according to preset rules；
According to the time series data of indices in many index, the corresponding timing curve of indices is generated；
The corresponding timing curve of indices is added in piece image in ranked order, obtains timing image.
It is further, described that many index sorts according to preset rules, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index point
For first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers to
The possible value of target is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, to the time series data of the second class index
It averages, according to the corresponding average value of indices, many index is sorted.
Further, it is corresponding to generate indices for the time series data according to indices in many index
Timing curve, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index point
For first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers to
The possible value of target is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, after taking logarithm with the time series data of the index
Value is ordinate, obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is obtained for the second class index in indices using the time as horizontal axis
To the corresponding timing curve of the index.
In a kind of possible embodiment, the neural network model includes convolutional neural networks CNN, the CNN's
Convolution kernel includes the matrix of N row N column, wherein and N >=2.
Further, the element of a wherein column for the matrix is all 1, remaining element is all 0.
Further, the element of wherein a line of the matrix is all 1, remaining element is all 0.
In a kind of possible embodiment, the neural network model is trained in the following way:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked event
Hinder section；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, whether it regard subgraph as the neural network mould extremely
The sample label of type is trained the neural network model.
It is further, described that the training is divided into multiple subgraphs with timing image, comprising:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along that time shaft intercepted length is the length of window
One subgraph；
Initial position is updated according to preset progressive window, is opened from the training with the initial position of timing image
Begin, is the second subgraph of the length of window along time shaft intercepted length.
Second aspect, provides a kind of alteration detecting device based on many index, and device includes:
Acquiring unit, the time series data of many index for obtaining the system in current time period；
Generation unit, the time series data of many index for being obtained according to the acquiring unit generate timing image, institute
Stating timing image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve；
Detection unit, the timing image for generating the generation unit is as neural network model trained in advance
Whether abnormal input obtains system in current time period by the output of the neural network model.
The third aspect provides a kind of computer readable storage medium, is stored thereon with computer program, when the calculating
When machine program executes in a computer, enable computer execute first aspect method.
Fourth aspect provides a kind of calculating equipment, including memory and processor, and being stored in the memory can hold
Line code, when the processor executes the executable code, the method for realizing first aspect.
The method and apparatus provided by this specification embodiment, the system in acquisition current time period is multinomial first
The time series data of index generates timing image then according to the time series data of many index, and the timing image includes more
Timing curve, the corresponding Xiang Zhibiao of every timing curve, finally using the timing image as the neural network trained in advance
Whether abnormal the input of model obtains system in current time period by the output of the neural network model.Therefore
Unusual fluctuation detection processing is carried out by image recognition, can effectively merge many index, better detection effect is provided.
Detailed description of the invention
In order to illustrate the technical solution of the embodiments of the present invention more clearly, required use in being described below to embodiment
Attached drawing be briefly described, it should be apparent that, drawings in the following description are only some embodiments of the invention, for this
For the those of ordinary skill of field, without creative efforts, it can also be obtained according to these attached drawings others
Attached drawing.
Fig. 1 is the implement scene schematic diagram of one embodiment that this specification discloses；
Fig. 2 shows the abnormal movement detection method flow charts based on many index according to one embodiment；
Fig. 3 shows the convolution kernel schematic diagram according to one embodiment；
Fig. 4 shows the convolution kernel schematic diagram according to another embodiment；
Fig. 5 is a kind of schematic diagram trained with timing image that this specification embodiment provides；
Fig. 6 shows subgraph schematic diagram after the cutting according to another embodiment；
Fig. 7 shows the failure subgraph schematic diagram according to another embodiment；
Fig. 8 shows the schematic block diagram of the alteration detecting device based on many index according to one embodiment.
Specific embodiment
With reference to the accompanying drawing, the scheme provided this specification is described.
Fig. 1 is the implement scene schematic diagram of one embodiment that this specification discloses.The implement scene is related to based on multinomial
The unusual fluctuation of index detects.In the embodiment, using depth convolutional neural networks (convolutional neural networks,
CNN) model is as unusual fluctuation identification model, wherein is related to the training process to depth CNN model, and utilizes trained depth
Spend the prediction process of CNN model.It is understood that need to construct training set in the training process of depth CNN model,
Be exactly timing image and system whether Yi Chang corresponding relationship, timing image can be time sequence image data, according to many index
Time series data can be generated the timing image including a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve.Utilize instruction
During the prediction for the depth CNN model perfected, also to be generated according to the time series data of many index includes a plurality of timing curve
Timing image, whether every timing curve corresponding Xiang Zhibiao abnormal by trained depth CNN model output system,
The result for namely whether needing to alarm.Wherein, either in the training process, or during prediction, in timing image
In a plurality of timing curve to guarantee certain sequence, that is to say, that sequence of many index in timing image can not arbitrarily change
Become, will pass through trained depth CNN model, according to the correlation between many index, whether output system is abnormal.
Fig. 2 shows the abnormal movement detection method flow charts based on many index according to one embodiment, and this method can be with base
In application scenarios shown in FIG. 1.As shown in Fig. 2, the abnormal movement detection method in the embodiment based on many index includes following step
It is rapid: step 21, to obtain the time series data of many index of the system in current time period；Step 22, according to the multinomial finger
Target time series data generates timing image, and the timing image includes a plurality of timing curve, and every timing curve corresponding one refers to
Mark；Step 23, using the timing image as the input of neural network model trained in advance, pass through the neural network model
Output whether obtain in current time period system abnormal.The specific executive mode of above each step is described below.
First in step 21, the time series data of many index of the system in current time period is obtained.It is understood that
It is in this specification embodiment, to obtain the time series data of indices, that is to say, that obtain indices when multiple
Carve corresponding data (i.e. index value).Wherein, above-mentioned many index specifically includes which index this specification embodiment does not limit
It is fixed, for example, can be, but not limited to comprising response time, handling capacity, resource utilization etc..
In one example, obtain current time period in system many index at the beginning of data, every
Data, the data of finish time of preset time period.For example, the time series data of many index obtained can be as shown in Table 1.
Table one: the time series data list of many index
| Index name | Time point | Index value |
| Dim1 | 2018-01-01 00:00:00 | 50 |
| Dim1 | 2018-01-01 00:01:00 | 56 |
| … | … | … |
| Dim2 | 2018-01-01 00:00:00 | 98 |
| Dim2 | 2018-01-01 00:01:00 | 108 |
| … | … | … |
| Dim_N | 2018-01-01 00:00:00 | 502 |
| … | … | … |
Referring to table one, one shares N number of index, each index from the outset between to end time, 1 data per minute, total M
Data.
Then timing image is generated according to the time series data of many index in step 22, the timing image includes
A plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve.It is understood that individually dividing with common each timing curve
Analysis is different, in this specification embodiment, by generating the timing image comprising a plurality of timing curve, by timing image analysis
To determine that whether extremely system, is conducive to merge multi objective, provides better detection effect.
In one example, many index is sorted according to preset rules；Referred to according to items in many index
Target time series data generates the corresponding timing curve of indices；By the corresponding timing curve of indices by suitable after sequence
Sequence is added in piece image, obtains timing image.For example, the horizontal axis of timing curve represents the time, the longitudinal axis represents index value, will
The corresponding timing curve of indices in ranked order, is sequentially overlaid in piece image along y direction, obtains timing
Image.
Further, the described many index sorts according to preset rules can be in the following way: according to described
The many index is divided into first kind index and by the possibility value of indices and the relationship of preset threshold in many index
Two class indexs；The possibility value of the first kind index is all larger than preset threshold, and the possibility value of the second class index is small
In preset threshold；It averages after taking logarithm to the time series data of the first kind index, to the timing of the second class index
Data are averaged, and according to the corresponding average value of indices, many index is sorted.
Wherein, above-mentioned preset threshold can be 1, and above-mentioned first kind index can have exhausted for response time, handling capacity etc.
The index of logarithm, for example, the response time is 1ms, above-mentioned second class index can have relative value for resource utilization etc.
Index, for example, resource utilization be 30%.
It should be noted that in other words, being sorted and being advised using different timing curves using different index ordering rules
Then, it but substantially only has modified and puts in order, be considered as consistent with this programme.
Further, it is corresponding to generate indices for the time series data according to indices in many index
Timing curve, can be in the following way: according to the possibility value of indices in many index and the pass of preset threshold
System, is divided into first kind index and the second class index for many index；The possibility value of the first kind index is all larger than pre-
If threshold value, the possibility value of the second class index is respectively less than preset threshold；For the first kind index in indices, with when
Between be horizontal axis, the value after taking logarithm using the time series data of the index obtains the corresponding timing curve of the index as ordinate；For
The second class index in indices, using the time series data of the index as ordinate, it is corresponding to obtain the index using the time as horizontal axis
Timing curve.
Finally in step 23, using the timing image as the input of neural network model trained in advance, by described
Whether the output of neural network model obtains system in current time period abnormal.It is understood that above-mentioned neural network mould
Type can be various image recognition models, such as can use the structure of ResNet.
In one example, the neural network model includes convolutional neural networks CNN, and the convolution kernel of the CNN includes N
The matrix of row N column, wherein N >=2.
For above-mentioned convolution kernel, in addition to common 3*3 convolution kernel, this specification embodiment also proposed level
(horizontal) convolution kernel, vertical (vertical) convolution kernel.
Horizontal (horizontal) convolution kernel, the element of wherein a line of matrix are all 1, remaining element is all 0.For example,
Convolution kernel shown in the b in a or Fig. 3 in Fig. 3, convolution kernel are the images of a 4*4, each cell indicates pixel,
It is used as and is inputted using every row, for example be all 1 pixel in Fig. 3.
The element of vertically (vertical) convolution kernel, a wherein column for matrix is all 1, remaining element is all 0.For example, Fig. 4
In a or Fig. 4 in b shown in convolution kernel, convolution kernel is the image of a 4*4, each cell indicates pixel, is used
Each column is used as input, for example 1 pixel is all in Fig. 4.
It is understood that being directed to different abnormality detection scenes, different convolution kernels can be used.
In one example, the neural network model is trained in the following way: being obtained comprising a plurality of timing curve
Training timing image, the training timing image includes marked fault section；The training timing image is drawn
It is divided into multiple subgraphs；According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；Described in subgraph is used as
The sample characteristics of neural network model, by subgraph whether the sample label extremely as the neural network model, to the mind
It is trained through network model.
Fig. 5 is a kind of schematic diagram trained with timing image that this specification embodiment provides.The N number of index that will acquire
Time series data takes log, and horizontal axis is time, 0 corresponding initial time, horizontal axis maximum value corresponding termination time, after index is according to log is taken
Average value size sequence, generate timing image shown in fig. 5.Referring to Fig. 5, which includes two timing curves, in rectangle frame
In be not meet expected curve caused by occurring as failure to fluctuate.
Further, described that the training is divided into multiple subgraphs with timing image, it can be in the following way: according to
Subgraph number to be obtained, determines the length of window of each subgraph；Since the training is with the coordinate origin of timing image, along when
Between axis intercepted length be the length of window the first subgraph；Initial position is updated according to preset progressive window, from institute
The initial position for stating training timing image starts, and is the second subgraph of the length of window along time shaft intercepted length.
For example, construction includes the training set of multiple subgraphs in the following way:
Select length of window M and progressive window B, wherein length of window M < image length, by the trained used time shown in fig. 5
Sequence image is many subgraphs along horizontal axis cutting, such as: M=10 (length of each subgraph is 10000/10=1000), B=500,
The subgraph then obtained after cutting can be as shown in Figure 6.
If subgraph contains fault time point, which is flagged as abnormal subgraph, and corresponding relationship can be with
As shown in Table 2.
Table two: subgraph whether be abnormal subgraph mapping table
| Subgraph serial number | Whether abnormal subgraph |
| 1 | 0 |
| 2 | 0 |
Obviously, the subgraph comprising fault time point is exactly failure subgraph, for example, being exactly failure shaped like subgraph as Fig. 7
Subgraph.
After being trained by above-mentioned subgraph to neural network model, so that it may utilize the neural network model root after training
Judge whether system is abnormal according to timing image, thus successfully by time series forecasting Task Switching at image recognition tasks.
The method provided by this specification embodiment obtains many index of the system in current time period first
Time series data generates timing image, the timing image includes a plurality of timing then according to the time series data of many index
Curve, the corresponding Xiang Zhibiao of every timing curve, finally using the timing image as neural network model trained in advance
Whether abnormal input obtains system in current time period by the output of the neural network model.Therefore by figure
As identifying to carry out unusual fluctuation detection processing, many index can be effectively merged, better detection effect is provided.
According to the embodiment of another aspect, a kind of alteration detecting device based on many index is also provided, which is used for
Execute the abnormal movement detection method based on many index that this specification embodiment provides.Fig. 8 shows the base according to one embodiment
In the schematic block diagram of the alteration detecting device of many index.As shown in figure 8, the device 800 includes:
Acquiring unit 81, the time series data of many index for obtaining the system in current time period；
Generation unit 82, the time series data of many index for being obtained according to the acquiring unit 81 generate timing diagram
Picture, the timing image include a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve；
Detection unit 83, the timing image for generating the generation unit 82 is as neural network mould trained in advance
Whether abnormal the input of type obtains system in current time period by the output of the neural network model.
Optionally, as one embodiment, the acquiring unit 81, specifically for obtaining the system in current time period
Many index at the beginning of data, the data of every preset time period, the data of finish time.
Optionally, as one embodiment, the generation unit 82 includes:
Sorting subunit, for many index to sort according to preset rules；
Subelement is generated, for the time series data according to indices in many index, it is corresponding to generate indices
Timing curve；
It is superimposed subelement, the corresponding timing curve of indices for generating the generation subelement, by the row
Laminated structure after the sequence of sequence subelement obtains timing image into piece image.
Further, the sorting subunit, is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index point
For first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers to
The possible value of target is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, to the time series data of the second class index
It averages, according to the corresponding average value of indices, many index is sorted.
Further, the generation subelement, is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index point
For first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers to
The possible value of target is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, after taking logarithm with the time series data of the index
Value is ordinate, obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is obtained for the second class index in indices using the time as horizontal axis
To the corresponding timing curve of the index.
Optionally, as one embodiment, the neural network model includes convolutional neural networks CNN, the volume of the CNN
Product core includes the matrix of N row N column, wherein and N >=2.
Further, the element of a wherein column for the matrix is all 1, remaining element is all 0.
Further, the element of wherein a line of the matrix is all 1, remaining element is all 0.
Optionally, as one embodiment, described device further include:
Training unit, for being trained in the following way to the neural network model:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked event
Hinder section；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, whether it regard subgraph as the neural network mould extremely
The sample label of type is trained the neural network model.
Further, the training unit is used to the training being divided into multiple subgraphs with timing image, comprising:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along that time shaft intercepted length is the length of window
One subgraph；
Initial position is updated according to preset progressive window, is opened from the training with the initial position of timing image
Begin, is the second subgraph of the length of window along time shaft intercepted length.
The device provided by this specification embodiment, first acquiring unit 81 obtain the system in current time period
The time series data of many index, then generation unit 82 generates timing image according to the time series data of many index, described
Timing image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve, and last detection unit 83 is by the timing diagram
As the input as neural network model trained in advance, current time period is obtained by the output of the neural network model
Whether interior system is abnormal.Therefore unusual fluctuation detection processing is carried out by image recognition, it can effectively merge multinomial finger
Mark, provides better detection effect.
According to the embodiment of another aspect, a kind of computer readable storage medium is also provided, is stored thereon with computer journey
Sequence enables computer execute method described in conjunction with Figure 2 when the computer program executes in a computer.
According to the embodiment of another further aspect, a kind of calculating equipment, including memory and processor, the memory are also provided
In be stored with executable code, when the processor executes the executable code, realize method described in conjunction with Figure 2.
Those skilled in the art are it will be appreciated that in said one or multiple examples, function described in the invention
It can be realized with hardware, software, firmware or their any combination.It when implemented in software, can be by these functions
Storage in computer-readable medium or as on computer-readable medium one or more instructions or code transmitted.
Above-described specific embodiment has carried out further the purpose of the present invention, technical scheme and beneficial effects
It is described in detail, it should be understood that being not intended to limit the present invention the foregoing is merely a specific embodiment of the invention
Protection scope, all any modification, equivalent substitution, improvement and etc. on the basis of technical solution of the present invention, done should all
Including within protection scope of the present invention.
Claims (22)
1. a kind of abnormal movement detection method based on many index, which comprises
Obtain the time series data of many index of the system in current time period；
According to the time series data of many index, timing image is generated, the timing image includes a plurality of timing curve, and every
Timing curve corresponds to a Xiang Zhibiao；
Using the timing image as the input of neural network model trained in advance, pass through the output of the neural network model
Whether abnormal obtain system in current time period.
2. the method for claim 1, wherein timing of many index for obtaining the system in current time period
Data, comprising:
Obtain current time period in system many index at the beginning of data, the data of every preset time period,
The data of finish time.
3. the method for claim 1, wherein time series data according to many index generates timing image,
Include:
The many index is sorted according to preset rules；
According to the time series data of indices in many index, the corresponding timing curve of indices is generated；
The corresponding timing curve of indices is added in piece image in ranked order, obtains timing image.
4. method as claimed in claim 3, wherein described that many index sorts according to preset rules, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, many index is divided into
A kind of index and the second class index；The possibility value of the first kind index is all larger than preset threshold, the second class index
Possible value is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, flat is asked to the time series data of the second class index
Mean value sorts many index according to the corresponding average value of indices.
5. method as claimed in claim 3, wherein the time series data according to indices in many index, it is raw
At the corresponding timing curve of indices, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, many index is divided into
A kind of index and the second class index；The possibility value of the first kind index is all larger than preset threshold, the second class index
Possible value is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, the value after logarithm is taken to be with the time series data of the index
Ordinate obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is somebody's turn to do for the second class index in indices using the time as horizontal axis
The corresponding timing curve of index.
6. the method for claim 1, wherein the neural network model includes convolutional neural networks CNN, the CNN
Convolution kernel include N row N column matrix, wherein N >=2.
7. method as claimed in claim 6, wherein the element of a wherein column for the matrix is all 1, remaining element is all 0.
8. method as claimed in claim 6, wherein the element of wherein a line of the matrix is all 1, remaining element is all 0.
9. the method for claim 1, wherein the neural network model is trained in the following way:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked faulty section
Between；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, by subgraph whether extremely as the neural network model
Sample label is trained the neural network model.
10. method as claimed in claim 9, wherein described that the training is divided into multiple subgraphs with timing image, packet
It includes:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along the first son that time shaft intercepted length is the length of window
Figure；
Initial position, since the training initial position of timing image, edge are updated according to preset progressive window
Time shaft intercepted length is the second subgraph of the length of window.
11. a kind of alteration detecting device based on many index, described device include:
Acquiring unit, the time series data of many index for obtaining the system in current time period；
Generation unit, the time series data of many index for being obtained according to the acquiring unit generate timing image, when described
Sequence image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve；
Detection unit, the timing image for generating the generation unit is as the defeated of neural network model trained in advance
Enter, whether obtain system in current time period by the output of the neural network model abnormal.
12. device as claimed in claim 11, wherein the acquiring unit, specifically for obtaining in current time period
Data, the data of finish time of data, every preset time period at the beginning of many index of system.
13. device as claimed in claim 11, wherein the generation unit includes:
Sorting subunit, for many index to sort according to preset rules；
Subelement is generated, for the time series data according to indices in many index, when generation indices are corresponding
Overture line；
It is superimposed subelement, the corresponding timing curve of indices for generating the generation subelement, by sequence
Laminated structure after unit sequence obtains timing image into piece image.
14. device as claimed in claim 13, wherein the sorting subunit is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, many index is divided into
A kind of index and the second class index；The possibility value of the first kind index is all larger than preset threshold, the second class index
Possible value is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, flat is asked to the time series data of the second class index
Mean value sorts many index according to the corresponding average value of indices.
15. device as claimed in claim 13, wherein the generation subelement is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, many index is divided into
A kind of index and the second class index；The possibility value of the first kind index is all larger than preset threshold, the second class index
Possible value is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, the value after logarithm is taken to be with the time series data of the index
Ordinate obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is somebody's turn to do for the second class index in indices using the time as horizontal axis
The corresponding timing curve of index.
16. device as claimed in claim 11, wherein the neural network model includes convolutional neural networks CNN, described
The convolution kernel of CNN includes the matrix of N row N column, wherein and N >=2.
17. device as claimed in claim 16, wherein the element of a wherein column for the matrix is all 1, remaining element is all
0。
18. device as claimed in claim 16, wherein the element of wherein a line of the matrix is all 1, remaining element is all
0。
19. device as claimed in claim 11, wherein described device further include:
Training unit, for being trained in the following way to the neural network model:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked faulty section
Between；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, by subgraph whether extremely as the neural network model
Sample label is trained the neural network model.
20. device as claimed in claim 19, wherein the training unit is for the training to be divided into timing image
Multiple subgraphs, comprising:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along the first son that time shaft intercepted length is the length of window
Figure；
Initial position, since the training initial position of timing image, edge are updated according to preset progressive window
Time shaft intercepted length is the second subgraph of the length of window.
21. a kind of computer readable storage medium, is stored thereon with computer program, when the computer program in a computer
When execution, computer perform claim is enabled to require the method for any one of 1-10.
22. a kind of calculating equipment, including memory and processor, executable code, the processing are stored in the memory
When device executes the executable code, the method for any one of claim 1-10 is realized.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910425881.4A CN110262950A (en) | 2019-05-21 | 2019-05-21 | Abnormal movement detection method and device based on many index |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910425881.4A CN110262950A (en) | 2019-05-21 | 2019-05-21 | Abnormal movement detection method and device based on many index |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110262950A true CN110262950A (en) | 2019-09-20 |
Family
ID=67915041
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910425881.4A Pending CN110262950A (en) | 2019-05-21 | 2019-05-21 | Abnormal movement detection method and device based on many index |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110262950A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111696660A (en) * | 2020-05-13 | 2020-09-22 | 平安科技（深圳）有限公司 | Artificial intelligence-based patient grouping method, device, equipment and storage medium |
| CN113743607A (en) * | 2021-09-15 | 2021-12-03 | 京东科技信息技术有限公司 | Training method of anomaly detection model, anomaly detection method and device |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2012008176A1 (en) * | 2010-07-12 | 2012-01-19 | 株式会社日立国際電気 | Monitoring system and method of monitoring |
| CN107943677A (en) * | 2017-10-13 | 2018-04-20 | 东软集团股份有限公司 | Application performance monitoring method, device, readable storage medium storing program for executing and electronic equipment |
| CN108681496A (en) * | 2018-05-09 | 2018-10-19 | 北京奇艺世纪科技有限公司 | Prediction technique, device and the electronic equipment of disk failure |
| CN109032829A (en) * | 2018-07-23 | 2018-12-18 | 腾讯科技（深圳）有限公司 | Data exception detection method, device, computer equipment and storage medium |
| CN109213034A (en) * | 2018-08-27 | 2019-01-15 | 硕橙（厦门）科技有限公司 | Equipment health degree monitoring method, device, computer equipment and readable storage medium storing program for executing |
| CN109390056A (en) * | 2018-11-05 | 2019-02-26 | 平安科技（深圳）有限公司 | Health forecast method, apparatus, terminal device and computer readable storage medium |
-
2019
- 2019-05-21 CN CN201910425881.4A patent/CN110262950A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2012008176A1 (en) * | 2010-07-12 | 2012-01-19 | 株式会社日立国際電気 | Monitoring system and method of monitoring |
| CN107943677A (en) * | 2017-10-13 | 2018-04-20 | 东软集团股份有限公司 | Application performance monitoring method, device, readable storage medium storing program for executing and electronic equipment |
| CN108681496A (en) * | 2018-05-09 | 2018-10-19 | 北京奇艺世纪科技有限公司 | Prediction technique, device and the electronic equipment of disk failure |
| CN109032829A (en) * | 2018-07-23 | 2018-12-18 | 腾讯科技（深圳）有限公司 | Data exception detection method, device, computer equipment and storage medium |
| CN109213034A (en) * | 2018-08-27 | 2019-01-15 | 硕橙（厦门）科技有限公司 | Equipment health degree monitoring method, device, computer equipment and readable storage medium storing program for executing |
| CN109390056A (en) * | 2018-11-05 | 2019-02-26 | 平安科技（深圳）有限公司 | Health forecast method, apparatus, terminal device and computer readable storage medium |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111696660A (en) * | 2020-05-13 | 2020-09-22 | 平安科技（深圳）有限公司 | Artificial intelligence-based patient grouping method, device, equipment and storage medium |
| CN111696660B (en) * | 2020-05-13 | 2023-07-25 | 平安科技（深圳）有限公司 | Patient grouping method, device, equipment and storage medium based on artificial intelligence |
| CN113743607A (en) * | 2021-09-15 | 2021-12-03 | 京东科技信息技术有限公司 | Training method of anomaly detection model, anomaly detection method and device |
| CN113743607B (en) * | 2021-09-15 | 2023-12-05 | 京东科技信息技术有限公司 | Training method of anomaly detection model, anomaly detection method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110292775B (en) | Method and device for acquiring difference data | |
| CN109299344A (en) | The generation method of order models, the sort method of search result, device and equipment | |
| JP2024023651A5 (en) | Computer systems and computer programs for machine learning | |
| CN109885452A (en) | Method for monitoring performance, device and terminal device | |
| CN110490237B (en) | Data processing method and device, storage medium and electronic equipment | |
| CN111553485A (en) | View display method, device, equipment and medium based on federal learning model | |
| CN111160329A (en) | Root cause analysis method and device | |
| Mills et al. | A machine learning approach for determining the validity of traceability links | |
| CN109743286A (en) | A kind of IP type mark method and apparatus based on figure convolutional neural networks | |
| CN110262950A (en) | Abnormal movement detection method and device based on many index | |
| CN111367782A (en) | Method and device for automatically generating regression test data | |
| US20130013244A1 (en) | Pattern based test prioritization using weight factors | |
| CN111191239B (en) | Process detection method and system for application program | |
| CN114465875B (en) | Fault processing method and device | |
| CN113824580A (en) | Network index early warning method and system | |
| Kusa et al. | Vombat: A tool for visualising evaluation measure behaviour in high-recall search tasks | |
| CN110716778A (en) | Application compatibility testing method, device and system | |
| US20170293660A1 (en) | Intent based clustering | |
| CN111277427A (en) | Data center network equipment inspection method and system | |
| CN115718741A (en) | Automatic cleaning method and device for health data, electronic equipment and storage medium | |
| CN113392086B (en) | Medical database construction method, device and equipment based on Internet of things | |
| CN111881266B (en) | Response method and device | |
| CN114066438A (en) | Model-based monitoring data display method, device, equipment and storage medium | |
| JP6840204B1 (en) | Business support system and method | |
| US9665795B2 (en) | Method and apparatus for identifying root cause of defect using composite defect map |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200930 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200930 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190920 |