CN110286656B - False alarm filtering method and device for tolerance of error data - Google Patents

Abstract

The embodiment of the invention provides a false alarm filtering method and device for tolerance of error data. The method comprises the steps of obtaining time sequence data corresponding to equipment measured by a sensor, and determining a suspected time sequence included in the time sequence data according to a state parameter value corresponding to normal operation of the equipment; according to a preset similarity matching method, calculating the similarity between each suspected time sequence and an alarm time sequence corresponding to a historical true alarm, determining the suspected time sequence with the corresponding similarity higher than a similarity threshold as the true alarm, and calculating the abnormality of each suspected time sequence with the corresponding similarity not higher than the similarity threshold according to a preset abnormality factor detection algorithm; and judging whether the suspected time sequence is a true alarm or not according to the abnormal degree of each corresponding suspected time sequence of which the similarity is not higher than the similarity threshold. The embodiment of the invention can filter out most false alarms caused by error data and improve the alarm accuracy.

Description

False alarm filtering method and device for tolerance of erroneous data

technical field

The present invention relates to the technical field of computers, and in particular, to a false alarm filtering method and device for tolerance of erroneous data.

Background technique

In the industrial field, in order to monitor the running status of the equipment, enterprises will install many sensors on the equipment, and judge whether the equipment is working normally according to the data measured by the sensors. The data measured by the sensor in time sequence is the so-called time series data. Enterprises use the time series data measured by sensors, combined with the state parameters of the equipment during normal operation, to judge the operating state of the equipment according to a certain logic.

However, due to some factors of the sensor itself, such as the sensor may be damaged, or the measurement of the sensor itself is inaccurate, or the data is polluted in the process of receiving and saving sensor data, etc., some of the measured data may be wrong. Based on the error data, it is possible to obtain some "false alarms" by judging the operating status of the equipment. The so-called "false alarm" means that the device is working normally, but the wrong data is not within the range of the state parameters of the device's normal work, so an alarm that the device is not working properly at this time will be obtained. The sensor is continuously generating data, and the erroneous data in these data will also continuously generate false alarms. These false alarms have brought great interference to the production monitoring of enterprises.

Therefore, how to reduce false alarms caused by erroneous data has become an urgent technical problem to be solved in the industry.

SUMMARY OF THE INVENTION

Aiming at the problems existing in the prior art, the embodiments of the present invention provide a false alarm filtering method and device tolerant to erroneous data.

In a first aspect, an embodiment of the present invention provides a false alarm filtering method for tolerance of erroneous data, including:

Acquire the time series data corresponding to the device measured by the sensor, and determine the suspected time series included in the time series data according to the state parameter value corresponding to the normal operation of the device;

According to the preset similarity matching method, the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm is calculated, and the corresponding suspected time series whose similarity is higher than the similarity threshold is determined as a real alarm , calculate the abnormality of each suspected time series whose similarity is not higher than the similarity threshold according to the preset abnormality factor detection algorithm;

Whether the suspected time series is a true alarm is judged according to the abnormality of each suspected time series whose similarity is not higher than the similarity threshold.

In a second aspect, an embodiment of the present invention provides a false alarm filtering device for tolerance of erroneous data, including:

a first processing module, configured to obtain time series data corresponding to the device measured by the sensor, and determine the suspected time series included in the time series data according to the state parameter value corresponding to the normal operation of the device;

The second processing module is configured to calculate the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm according to the preset similarity matching method, and calculate the similarity between the corresponding similarity higher than the similarity threshold. The suspected time series is determined to be a true alarm, and the abnormality of each suspected time series whose corresponding similarity is not higher than the similarity threshold is calculated according to a preset abnormal factor detection algorithm;

The third processing module is configured to judge whether the suspected time series is a true alarm according to the abnormality of each corresponding suspected time series whose similarity is not higher than the similarity threshold.

In a third aspect, an embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the program as described in the first aspect when the processor executes the program The steps of the false alarm filtering method described in erroneous data tolerance.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the false alarm filtering for tolerance of error data as described in the first aspect is implemented steps of the method.

The method and device for filtering false alarms tolerant to false data provided by the embodiments of the present invention filter false alarms caused by false data by matching the suspected time series that may generate alarms with historical true alarms and calculating their abnormality to filter false alarms. False alarms caused by most of the wrong data are eliminated, and the accuracy of alarms is improved.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

FIG. 1 is a schematic flowchart of a false alarm filtering method for tolerance of erroneous data provided by an embodiment of the present invention;

2 is a schematic flowchart of a false alarm filtering method for tolerance of wrong data provided by another embodiment of the present invention;

3 is a schematic flowchart of a false alarm filtering method for tolerance of wrong data provided by another embodiment of the present invention;

4 is a schematic structural diagram of a false-alarm filtering device tolerant to erroneous data provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of a physical structure of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a schematic flowchart of a false alarm filtering method for tolerance of erroneous data provided by an embodiment of the present invention. As shown in FIG. 1 , the embodiment of the present invention provides a “false alarm” for judging the operating state of a device for erroneous data. The following solution includes the following steps:

Step 100: Acquire the time series data corresponding to the device measured by the sensor, and determine the suspected time series included in the time series data according to the state parameter value corresponding to the normal operation of the device;

In order to monitor the operating status of the equipment, enterprises will install various types of sensors on the equipment, and detect various operating parameter values of the equipment in real time according to each sensor. Sensors collect device data in chronological order, and the collected data form time series data.

The execution subject of the process of this embodiment of the method may be a device for executing the false alarm filtering method for tolerance of error data, such as a CPU or a DSP, and the device obtains time series data corresponding to the device measured by the sensor from the sensor. Then, the apparatus compares the time series data with the state parameter values corresponding to the normal operation of the equipment, and determines the suspected time series included in the time series data. The state parameter value corresponding to the normal operation of the device is the data detected by the device without any alarm.

In this embodiment of the method, it is determined whether the data measured by the sensor falls within the normal numerical range by taking the state parameter value of the device as a threshold value during normal operation. The logic of the judgment may be: for example, the status data of the device obtained continuously for one minute is lower than the threshold, then the device may be broken at this time, and an alarm needs to be generated. This one-minute time series data is a suspected time series that may generate an alarm. Taking the state parameter value of the normal operation of each device as the threshold value, filter the time series data obtained by the sensor measurement, filter out the data that does not conform to the alarm logic, and obtain a suspected time series that may generate an alarm. The suspected time series obtained through the threshold filtering of this step is called the suspected time series.

Step 101, according to the preset similarity matching method, calculate the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm, and determine the suspected time series whose corresponding similarity is higher than the similarity threshold. If it is a true alarm, calculate the abnormality of each suspected time series whose corresponding similarity is not higher than the similarity threshold according to the preset abnormality factor detection algorithm;

After obtaining the suspected time series through threshold filtering, the similarity between each suspected time series and the alarm time series corresponding to the historical real alarm can be calculated according to the preset similarity matching method. Wherein, the alarm time series corresponding to the historical real alarms is stored in the historical real alarm database, and each alarm time series stored in the real alarm database is the data that caused the real alarm of the equipment, not the false alarm. In this embodiment of the method, the suspected time series and the alarm time series are calculated according to the similarity matching method, for example, a dynamic time warping algorithm (Dynamic Time Warping, DTW for short) is used to calculate the similarity between the two.

By calculating the similarity, the corresponding suspected time series whose similarity is higher than the similarity threshold are determined as true alarms, that is, if the similarity between a suspected time series and the alarm time series that caused the real alarm is higher than a preset value If the similarity threshold is good, the suspected time series is regarded as a true alarm. Specifically, the similarity between the suspected time series obtained by threshold filtering and the real alarm sequence in history is calculated. If the similarity is high, it means that the suspected time series is very similar to the real alarm in history. The equipment in the state has alarmed, indicating that the suspected time series at this time has a high probability of being a real alarm. The similarity measurement method can use DTW or other time series data measurement methods. The reason for using DTW to calculate the similarity of two time series data series is that the time series data series may be missing, resulting in inconsistent dimensions of the two series, and DTW can tolerate missing data. Based on the idea of dynamic programming, the matching problem of two sequences with inconsistent lengths is well realized, and the similarity of the two sequences is judged according to the matching results.

By calculating the similarity, it is not possible to judge whether it is a false alarm or a true alarm for a suspected time series whose corresponding similarity is not higher than the similarity threshold at this time, so further judgment is required. The abnormality of each corresponding suspected time series whose similarity is not higher than the similarity threshold may be calculated according to a preset abnormality factor detection algorithm, such as a local outlier factor detection algorithm (Local Outlier Factor; LOF for short). By calculating the similarity between the suspected time series and the real alarm, those with high similarity are considered to be real alarms, and those with low similarity are not necessarily not real alarms. The reason is that the suspected time series may not have appeared in history, so it cannot be judged. It is not a true alarm, and it needs to be further calculated to determine its abnormality.

Step 102: Determine whether the suspected time series is a true alarm according to the abnormality of each corresponding suspected time series whose similarity is not higher than the similarity threshold.

For the suspected time series whose corresponding similarity is not higher than the similarity threshold, the corresponding abnormality is calculated according to the LOF algorithm, and whether the suspected time series is a true alarm is judged according to the abnormality.

The false alarm filtering method for tolerance of erroneous data provided by the embodiment of the present invention filters false alarms caused by erroneous data by matching the suspected time series that may generate alarms with historical true alarms and calculating their abnormality. Most false alarms caused by wrong data improve the accuracy of alarms.

The false alarm filtering method for tolerance of error data provided by the embodiment of the present invention filters the false alarms generated by error data based on the similarity matching method of time series data and the abnormal factor detection algorithm, which can filter most of the false alarms generated by error data. The idea of filtering false alarms in this embodiment of the present invention is: if the false alarms are similar to true alarms in history, then alarm, and if the false alarms are similar to false alarms in history, no longer alarm. The time series data similarity matching method can be any suitable method for calculating the similarity. Here, the DTW algorithm used in the real scene is taken as an example. The abnormal factor detection algorithm can be any suitable abnormal factor detection method. Take the LOF algorithm as an example.

FIG. 2 is a schematic flowchart of a false alarm filtering method for tolerance of wrong data provided by another embodiment of the present invention. As shown in FIG. 2 , the method includes the following steps:

Step 200: Acquire the time series data corresponding to the device measured by the sensor, and determine the suspected time series included in the time series data according to the state parameter value corresponding to the normal operation of the device;

Step 201, according to the preset similarity matching method, calculate the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm, and determine the suspected time series whose corresponding similarity is higher than the similarity threshold. If it is a true alarm, calculate the abnormality of each suspected time series whose corresponding similarity is not higher than the similarity threshold according to the preset abnormality factor detection algorithm;

Step 202: According to the abnormality of each suspected time series whose similarity is not higher than the similarity threshold, judge whether the suspected time series is a true alarm, specifically including, if the corresponding similarity is not higher than If the abnormality of the suspected time series of the similarity threshold is lower than the abnormality threshold, the suspected time series is filtered out; if the corresponding similarity is not higher than the abnormality of the suspected time series of the similarity threshold, no If it is lower than the abnormality threshold, the suspected time series is output for manual judgment whether it is a true alarm.

Specifically, when the state value of the device is continuously lower than a certain value, the device may be in an abnormal state, and an alarm needs to be generated at this time, and this value is the threshold used to judge whether the device is working normally. The alarm judgment logic is used to filter the time series data through the alarm judgment logic and the threshold value to find the suspected time series that may generate an alarm.

Match the obtained suspected time series with the real alarm time series in history. The matching method can be DTW or other time series data similarity measurement methods. The suspected time series with high similarity is judged as true alarm, and the time series with low similarity Further judgment is required. However, the filtered suspected time series with low similarity to the historical real alarms may be false alarms or real alarms, and further judgment is required. The outlier detection algorithm LOF or other anomaly detection algorithms can be used to calculate the abnormality of the suspected time series, identify the suspected time series with low abnormality as false alarms, and filter these false alarms. Feed back the obtained suspected time series with an abnormality higher than a certain threshold to the business personnel, and the business personnel will judge whether it is a true alarm, and the suspected time series corresponding to the true alarm will be added to the historical true alarm database as a historical true alarm . If it is not a true alarm, filter it.

In the method provided by this embodiment of the method, the anomaly degree of the filtered suspected time series with low similarity to the historical real alarm is calculated, and a high anomaly degree has a high probability of being a true alarm, and a description of low anomaly degree These sequences have occurred in history and did not generate alarms, so these sequences can be considered false alarms and can be filtered. When calculating the anomaly degree, the suspected time series is regarded as the calculation object. Suppose a suspected time series is represented as S_t={(t_1,v_1),(t_2,v_2),…,(t_n,v_n)}, which means is the value measured by the sensor at the point in time. In the calculation process, we omit the time points and denote each subsequence as (v_1, v_2, ..., v_n) to calculate its anomaly degree.

Further, this embodiment of the method further includes the step of performing jump clearing after acquiring the time series data corresponding to the device measured by the sensor, the step includes: after acquiring the time series data corresponding to the device measured by the sensor, according to the 3σ criterion The step of clearing the time series data by self-jump, so as to delete the data that has jumped in the time series data.

Specifically, some hopping data may appear in the time series data, and these hopping data may interfere with the judgment of false alarms to a certain extent. Therefore, these hopping data need to be deleted. The so-called jump data are data points that produce abnormal changes in velocity and acceleration according to the 3σ criterion. Specifically, through the 3σ criterion, the single point that causes the abnormal speed change and the abnormal acceleration change is found, that is, the jump point. The found jump point is likely to be some wrong data, which will affect the judgment of the suspected time series that may cause an alarm. So it needs to be cleared.

The false alarm filtering method for tolerance of wrong data provided by the embodiment of the present invention filters out the transition points in the data through the 3σ criterion; according to the equipment operating state judgment logic, the suspected time that may generate an alarm is found from the data after filtering the transition points. Sequence; calculate the similarity of time series data between the suspected time series that may generate alarms and the historical real alarms, judge the ones with high similarity as true alarms, and filter those with low similarity; filter the suspected time series with low similarity Calculate the abnormality of the sequence; feed back the time series whose abnormality exceeds a certain threshold to the business personnel to determine whether it is a true alarm.

FIG. 3 is a schematic flowchart of a false alarm filtering method for tolerance of wrong data provided by another embodiment of the present invention. As shown in FIG. 3 , the method includes:

Step 300, input device status data;

Various operating parameter values of the device are collected based on the sensors installed on the device. Sensors collect device data in chronological order, and the collected data form time series data.

Step 301, clearing the jump, that is, filtering out the single point that causes abnormal changes in speed and acceleration;

The step of clearing the time series data by itself according to the 3σ criterion may specifically include: taking the time series data as input, calculating the change speed and change acceleration based on the state parameter values corresponding to the actual operation of the equipment, and sequentially obtaining the average value of the change speed u and standard deviation σ, mean u and standard deviation σ of varying acceleration. According to the 3σ criterion, the data whose change speed and change acceleration fall outside the interval (u-3*σ, u+3*σ) are determined as jumped data in the time series data, and the abnormal point is deleted.

Determine the position of the raw data of the device state by the position of the abnormal point of the changing speed and the changing acceleration. Assuming that the position of the abnormal single point of change speed is in the mth row, then the change speed of this position is calculated from the data measured at the mth time point and the m+1th time point of the equipment status data. Therefore, the m th time point data and the m+1 th time point data in the device status data are marked as the data to be deleted. Suppose the position of the abnormal single point of changing acceleration is in the nth row, then the changing acceleration of this position is measured by the nth time point, the n+1th time point and the n+2th time point of the device status data Therefore, the data at the n+1th time point in the device status data is marked as the data to be deleted. Take the union of the positions of the data points to be deleted, and clear these jumped data points at the corresponding positions of the status data of the original device.

Step 302, threshold filtering, that is, finding the suspected time series through the alarm judgment logic;

According to the pre-provided threshold for abnormal operation of the equipment and the alarm judgment logic, on the basis of filtering out the jump points, it searches for the suspected time series whose continuous time is lower than the threshold. Assuming that the water temperature and pressure measured by the engine for one minute is lower than the threshold s, the equipment is considered to be in failure, and an alarm should be generated at this time. The logic of threshold filtering is to segment the time-series data measured by the sensor at one-minute intervals, and each segment of data is the status data of the device measured in the same minute to determine whether the water temperature and pressure measured in this continuous minute are If it is lower than the threshold s, if it is, consider this time series data as suspected time series data that may generate an alarm, if not, filter it. On the basis of clearing the jump data in the previous steps, the suspected time series that may generate an alarm is searched, and the suspected time series is output.

Step 303, matching the real alarm, that is, calculating the similarity with the historical real alarm;

Take each suspected time series obtained in the previous step as the calculation object, and calculate the similarity with the time series data of real alarms in history. The similarity measurement method can be DTW, which is based on the idea of dynamic programming and solves the problem of template matching with different sequence lengths. An important reason for using DTW is that there may be missing data in the time series, that is, data at certain time points have not been collected. If the traditional similarity calculation method is used, the similarity error calculated for time series with inconsistent lengths may be very large. , the effect of matching with the real police will also be poor. The similarity calculation method based on the DTW algorithm can find sequences that are highly similar to historical true alarms in the suspected time series, and these sequences will be identified as true alarms, that is, step 304 is executed. The suspected time series with low similarity will be used as the input of the next step, that is, self-step 305 .

Step 304, determining that the similarity is high as a true alarm;

Step 305, abnormality filtering, that is, calculating the abnormality degree of the suspected time series with low similarity;

The suspected time series with low matching degree with historical true alarms will be used as the input of this step, and the anomaly degree of each series will be calculated through the anomaly detection algorithm. Taking the local abnormal factor detection algorithm LOF as an example, by setting the parameter k, the local reachability density of each point is calculated by the distance of the k-th nearest neighbor of each point, so as to calculate the local outlier factor of the point, and get the value of each point. abnormality. The value of the abnormality degree is larger than 1, indicating that the sequence is more likely to be an abnormal sequence, that is, the more likely it is to be a true alarm. In this step, take each suspected subsequence as the calculation object, calculate the distance between the sequences, establish the distance matrix M of the suspected time series, use M as the input of the outlier detection algorithm LOF, and obtain the abnormality of all suspected subsequences Degree list, returns a list of anomaly degrees for all suspected time series.

Step 306, abnormal alarm, that is, business personnel determine whether the time series with high abnormality is a real alarm;

According to the abnormal list of suspected time series obtained in step 305, the threshold of abnormal degree is set, the suspected time series below the threshold is filtered, and the suspected time series greater than or equal to the threshold is returned and fed back to the business personnel to determine whether it is a true alarm. If it is, it will be added to the historical real police library, otherwise it will be filtered.

The false alarm filtering method for tolerance of erroneous data provided by the embodiment of the present invention filters out the transition points in the data through the 3σ criterion, matches the true alarms based on the similarity measurement method, and searches for the time series with high abnormality degree through the abnormality detection algorithm. , to judge whether it is a true alarm, and through the false alarm filtering method for tolerance of erroneous data provided by the present invention, the false alarm generated by most of the erroneous data can be filtered.

FIG. 4 is a schematic structural diagram of a false alarm filtering device for error data tolerance provided by an embodiment of the present invention. As shown in FIG. 4 , the device includes a first processing module 401, a second processing module 402, and a third processing module 403, wherein:

The first processing module 401 is used to obtain the time series data corresponding to the device measured by the sensor, and determine the suspected time series included in the time series data according to the state parameter value corresponding to the normal operation of the device; the second processing module 402 is used for According to the preset similarity matching method, the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm is calculated, and the corresponding suspected time series whose similarity is higher than the similarity threshold is determined as a real alarm , calculate the abnormality of each suspected time series whose similarity is not higher than the similarity threshold according to the preset abnormality factor detection algorithm; the third processing module 403 is used to calculate the abnormality of each corresponding similarity not higher than the similarity threshold; The abnormality of the suspected time series with the similarity threshold is determined, and whether the suspected time series is a true alarm is judged.

Specifically, the first processing module 401 uses the alarm logic to find the suspected time series that may cause an alarm in the data filtered by the abnormal single point, and the second processing module 402 compares the suspected time series found by the suspected time series discovery module with the historical real alarms Calculate the similarity of time series data, and determine the suspected time series with high similarity as true alarms. The third processing module 403 uses anomaly detection algorithm to calculate the abnormality of the obtained time series with low similarity, and sets a threshold to filter out the time with low abnormality. Sequence, return suspected time series with high abnormality, and feed these time series back to business personnel.

Further, the third processing module 403 includes: a first unit, configured to filter out the suspected time series if the abnormality degree of the suspected time series whose corresponding similarity is not higher than the similarity degree threshold is lower than the abnormality degree threshold sequence; the second unit is used to output the suspected time series for manual judgment if the abnormality degree of the suspected time series whose similarity is not higher than the similarity threshold value is not lower than the abnormality degree threshold value. For real police.

Still further, the false alarm filtering device for tolerance of wrong data provided by this implementation may also include a fourth processing module for calculating the mean value and standard deviation of the data change speed, and calculating the mean value and standard deviation of the data change acceleration, based on the 3σ criterion. , find the single data points that cause abnormal changes in velocity and acceleration, and filter out these jumping data points.

The false alarm filtering device for tolerance of error data provided by the embodiment of the present invention is specifically used to execute the process of the false alarm filtering method for tolerance of error data provided by the above method embodiments. It will not be repeated here.

The false alarm filtering device for tolerance of erroneous data provided by the embodiment of the present invention filters the single points that cause abnormal data change speed and data change acceleration according to the 3σ criterion, and on this basis, searches for suspected time series that may cause an alarm according to the alarm judgment logic. Match the found suspected time series with the historical real police, then calculate the anomaly degree for the suspected time series with low similarity, return the suspected time series with high anomaly degree value, and filter out all the suspected time series with low anomaly degree The sequence realizes the filtering of false alarms generated by incorrect data, and can filter the false alarms generated by devices due to incorrect data in any type of scenario.

FIG. 5 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. As shown in FIG. 5 , the server may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530, and a communication bus 540 , wherein the processor 510 , the communication interface 520 , and the memory 530 communicate with each other through the communication bus 540 . The processor 510 can call the computer program in the memory 530 to execute the methods provided in the above embodiments, for example, including: acquiring the time series data corresponding to the device measured by the sensor, and determining according to the state parameter value corresponding to the normal operation of the device. The suspected time series included in the time series data; according to the preset similarity matching method, the similarity between each of the suspected time series and the alarm time series corresponding to the historical real alarm is calculated, and the corresponding similarity is higher than The suspected time series of the similarity threshold is determined as a true alarm, and the abnormality of each corresponding suspected time series whose similarity is not higher than the similarity threshold is calculated according to the preset abnormal factor detection algorithm; according to each corresponding similarity The abnormality of the suspected time series not higher than the similarity threshold is used to judge whether the suspected time series is a true alarm.

In addition, the above-mentioned computer program in the memory 530 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Embodiments of the present invention further provide a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, executes the methods provided by the foregoing embodiments, for example, comprising: acquiring data obtained by sensor measurement For the time series data corresponding to the device, according to the state parameter value corresponding to the normal operation of the device, determine the suspected time series included in the time series data; according to the preset similarity matching method, calculate each of the suspected time series and the history The similarity between the alarm time series corresponding to the true alarm, the suspected time series with the corresponding similarity higher than the similarity threshold is determined as the true alarm, and each corresponding similarity is calculated according to the preset abnormal factor detection algorithm. The abnormality of the suspected time series of the similarity threshold; according to the abnormality of each corresponding suspected time series whose similarity is not higher than the similarity threshold, determine whether the suspected time series is a true alarm.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. A method for false alarm filtering for tolerance of erroneous data, comprising:

acquiring time sequence data corresponding to equipment measured by a sensor, and determining a suspected time sequence included in the time sequence data according to a state parameter value corresponding to normal operation of the equipment;

according to a preset similarity matching method, calculating the similarity between each suspected time sequence and an alarm time sequence corresponding to a historical true alarm, determining the suspected time sequence with the corresponding similarity higher than a similarity threshold as the true alarm, and calculating the abnormality of each suspected time sequence with the corresponding similarity not higher than the similarity threshold according to a preset abnormality factor detection algorithm;

and judging whether the suspected time sequence is a true alarm or not according to the abnormal degree of each corresponding suspected time sequence of which the similarity is not higher than the similarity threshold.

2. The method of claim 1, wherein the determining whether the suspected time series is true according to the abnormality degree of each suspected time series whose similarity degree is not higher than the similarity degree threshold comprises:

if the corresponding similarity is not higher than the degree of abnormality of the suspected time sequence of the similarity threshold value and is lower than the degree of abnormality threshold value, filtering the suspected time sequence;

and if the corresponding similarity is not higher than the abnormality degree of the suspected time sequence of the similarity threshold and is not lower than the abnormality degree threshold, outputting the suspected time sequence for manual judgment of whether the suspected time sequence is a true alarm.

3. The method of claim 1 or 2, wherein the obtaining of the timing data corresponding to the device measured by the sensor comprises:

and after time sequence data corresponding to the equipment measured by the sensor is obtained, automatically jumping and clearing the time sequence data according to a 3 sigma criterion so as to delete the data jumping in the time sequence data.

4. The method of claim 3, wherein the step of self-jump clearing the time-series data according to 3 σ criterion comprises:

taking the time sequence data as input, calculating a change speed and a change acceleration based on a state parameter value corresponding to actual operation of the equipment, and calculating to obtain a mean value u and a standard deviation sigma of the change speed, and a mean value u and a standard deviation sigma of the change acceleration;

and determining data of which the change speed and the change acceleration fall outside an interval (u-3 sigma, u +3 sigma) as data of which the jump occurs in the time series data according to a 3 sigma criterion, and deleting a time point of the data of which the jump occurs.

5. The method of claim 1, wherein the similarity matching method is a dynamic time warping algorithm, and the anomaly detection algorithm is a local anomaly detection algorithm.

6. The method of false data tolerant false alarm filtering according to claim 1 or 2, wherein the method further comprises:

and adding the suspected time sequence determined to correspond to the true alarm as a historical true alarm into a historical true alarm database.

7. A false alarm filtering device for fault data tolerance, comprising:

the device comprises a first processing module, a second processing module and a third processing module, wherein the first processing module is used for acquiring time sequence data corresponding to equipment measured by a sensor and determining a suspected time sequence included in the time sequence data according to a state parameter value corresponding to normal operation of the equipment;

the second processing module is used for calculating the similarity between each suspected time sequence and an alarm time sequence corresponding to a historical true alarm according to a preset similarity matching method, determining the suspected time sequence with the corresponding similarity higher than a similarity threshold as the true alarm, and calculating the abnormality of each suspected time sequence with the corresponding similarity not higher than the similarity threshold according to a preset abnormality factor detection algorithm;

and the third processing module is used for judging whether the suspected time sequence is a true alarm or not according to the abnormal degree of each corresponding suspected time sequence, wherein the similarity of each suspected time sequence is not higher than the similarity threshold.

8. The erroneous-data-tolerant false alarm filtering device of claim 7, wherein the third processing module comprises:

the first unit is used for filtering the suspected time sequence if the corresponding similarity is not higher than the abnormality degree of the suspected time sequence of the similarity threshold value and is lower than the abnormality degree threshold value;

and the second unit is used for outputting the suspected time sequence for manual judgment of whether the suspected time sequence is a true alarm or not if the corresponding similarity of the suspected time sequence is not higher than the similarity threshold and is not lower than the abnormality threshold.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the error data tolerant false alarm filtering method according to any of claims 1 to 6 when executing the program.

10. A non-transitory computer readable storage medium, having stored thereon a computer program, which, when being executed by a processor, carries out the steps of the false alarm filtering method for fault data tolerance of any one of claims 1 to 6.

Images