CN110347544A

CN110347544A - Abnormal intellectual monitoring processing technique

Info

Publication number: CN110347544A
Application number: CN201810307774.7A
Authority: CN
Inventors: 杨文漪; 许必雄; 龚博文; 陈亮; 黄丛蕊; 童杰; 邢国东
Original assignee: Microsoft Technology Licensing LLC
Current assignee: Microsoft Technology Licensing LLC
Priority date: 2018-04-08
Filing date: 2018-04-08
Publication date: 2019-10-18
Also published as: WO2019199457A1

Abstract

Exception intellectual monitoring processing technique disclosed herein, by analyzing multiple being associated property of timeline sequence being abnormal, by numerous timeline sequences being abnormal, it is integrated into the event of one or more topological relation diagram form, so that being conducive to discovery generates abnormal root.In addition, also drastically reducing the quantity of alarm by alarming as unit of event.

Description

Abnormal intellectual monitoring processing technique

Background technique

For monitoring system, a kind of common demand is will be to some indexs (metrics) of product or business It is monitored, to understand whether product or business are in health status, and when occurring abnormal, is able to carry out alarm and goes forward side by side The further analysis of causes of row.

Summary of the invention

There is provided content of the embodiment of the present invention is to further retouch in will be described in detail below with the form introduction simplified The some concepts stated.The content of present invention is not intended to the key features or essential features of mark claimed subject, also not purport In the range for limiting claimed subject.

Exception intellectual monitoring processing technique disclosed herein, by being associated to multiple timeline sequences being abnormal Property analysis, by numerous timeline sequences being abnormal, be integrated into the event of one or more topological relation diagram form, thus Be conducive to discovery and generate abnormal root.In addition, also drastically reducing the number of alarm by alarming as unit of event Amount.

Above description is only the general introduction of disclosed technique scheme, in order to better understand the technological means of the disclosure, And it can be implemented in accordance with the contents of the specification, and in order to allow above and other objects, features, and advantages of the present disclosure can It is clearer and more comprehensible, below the special specific embodiment for lifting the disclosure.

Detailed description of the invention

Fig. 1 is the application example block diagram of one of monitoring data processing unit of the embodiment of the present invention；

Fig. 2 is the visualization form schematic diagram of the timeline sequence of the embodiment of the present invention；

Fig. 3 is the structural schematic diagram of one of event of the embodiment of the present invention；

Fig. 4 is two structural schematic diagram of the event of the embodiment of the present invention；

Fig. 5 is three structural schematic diagram of the event of the embodiment of the present invention；

Fig. 6 is four structural schematic diagram of the event of the embodiment of the present invention；

Fig. 7 is two application example block diagram of the monitoring data processing unit of the embodiment of the present invention；

Fig. 8 is three application example block diagram of the monitoring data processing unit of the embodiment of the present invention；

Fig. 9 is the schematic diagram of the event topological relation figure of the embodiment of the present invention；

Figure 10 is four application example block diagram of the monitoring data processing unit of the embodiment of the present invention；

Figure 11 is the schematic diagram of one of process of monitoring data processing method of the embodiment of the present invention；

Figure 12 is two schematic diagram of the process of the monitoring data processing method of the embodiment of the present invention；

Figure 13 is three schematic diagram of the process of the monitoring data processing method of the embodiment of the present invention；

Figure 14 is four schematic diagram of the process of the monitoring data processing method of the embodiment of the present invention；

Figure 15 is the block diagram of the electronic equipment of the embodiment of the present invention.

Specific embodiment

Exemplary embodiments of the present disclosure are described in more detail below with reference to accompanying drawings.Although showing the disclosure in attached drawing Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure without should be by embodiments set forth here It is limited.On the contrary, these embodiments are provided to facilitate a more thoroughly understanding of the present invention, and can be by the scope of the present disclosure It is fully disclosed to those skilled in the art.

Herein, term " technology " may refer to such as (one or more) system, (one or more) method, computer It is readable instruction, (one or more) module, algorithm, hardware logic (for example, field programmable gate array (FPGA)), dedicated integrated Circuit (ASIC), Application Specific Standard Product (ASSP), system on chip (SOC), complex programmable logic equipment (CPLD) and/or above-mentioned Context and in this document permitted (one or more) other technologies in the whole text.

It is provided on large-scale data service platform perhaps cloud computing platform for being monitored to product or business Monitoring system, which can be monitored analysis to data caused by various product or business in real time, when generation Between line sequence form monitoring data.Wherein, the monitoring of monitoring system is handled generally directed to product or the various indexs of business (metrics) Lai Jinhang, under each index, will include multiple dimensions (dimension), for the monitoring meeting of each dimension Generate corresponding timeline sequence.For example, for the data monitoring of search engine, daily user's usage amount can be with one The index of monitoring may include user's usage amount, user's usage amount of U.S. locations, Asia in the whole world under the index User's usage amount, the dimensions such as user's usage amount of European Region, also can also include user's usage amount, the use at night on daytime Family usage amount, user's usage amount using PC (PC), user's usage amount using mobile terminal etc., in short, index with And dimension is to can according to need flexibly to set.Above-mentioned timeline sequence is actually monitoring at predetermined intervals The sequence for the data pair that time point and monitoring data are constituted, the corresponding dimension of a timeline sequence.

Since the index of monitoring system monitoring is very more, and there is also many dimensions, monitoring system meetings under each index It is monitored to for each dimension, and generates largely timeline sequence corresponding with each dimension.It is past when occurring abnormal It is past to be large number of timeline sequence while abnormal phenomenon occur, it thus can generate a large amount of alarm, meeting severe jamming to prison The guardian of the control system perhaps normal work of user and in face of these a large amount of abnormal or alarms, staff is also very Hardly possible analyzes the root and counte-rplan occurred extremely in a short time.

The embodiment of the present invention is directed to such situation, proposes a kind of technical solution, can be by numerous abnormal timelines The analysis of being associated property of sequence, is integrated into the event of one or more topological relation diagram form, to be conducive to further Analysis and alarm.

Abnormal phenomenon in numerous timeline sequences detected by monitoring system, is often mutually related, root can It can exist only in a small number of timeline sequences.Based on the principle that machine learning mould can be based in technical side of the invention Type analyzes numerous abnormal timeline sequences, digs and closes according to the association gone out between each timeline sequence being abnormal These incidence relations and are integrated into topological diagram by system, consequently facilitating the analysis to abnormal root, and can will be based on abnormal Alarm becomes the alarm based on event, so as to substantially reduce the quantity of alarm.

In embodiments of the present invention, event refers to by the topological relation figure of multiple timeline Sequence compositions being abnormal, Each node in topological relation figure corresponds to the timeline sequence being abnormal, the side between each node correspond to node it Between for anomalous effects contribution degree.

Above-mentioned event can generally belong under an index (metrics), (this between the multiple events analyzed A little events may be corresponding to different indexs, it is also possible to correspond to same index) may also there can be certain relevance. It further include the processing that the relevance between event is further analyzed in the technical solution of the embodiment of invention, and raw At the event topological relation figure for embodying event correlation relationship, each node in figure corresponds to event, side pair between each node It should give a mark in the relevance between event.By event topological relation figure, can further be analyzed from more macroscopical angle Abnormal reason and influence situation.

Concrete application example

As shown in Figure 1, its application example block diagram 100 for one of the monitoring data processing unit of the embodiment of the present invention, In, which can be set on data service platform or cloud computing platform, can be used as platform The processing function of a part of monitoring system or the external execution embodiment of the present invention independently of monitoring system.Above-mentioned monitoring System has real-time monitoring data service platform or data on cloud computing platform and generates timeline sequence, and the monitoring The exception that system can arrange time line sequence identifies.Above-mentioned data service platform or cloud computing platform can be by multiple Server composition, monitoring data processing unit 101 can be set also can be implemented as server therein in the server.

As an example, monitoring data processing unit 101 shown in Fig. 1 is arranged among server 102, server 102 are connect by communication network 104 with user terminal 103, provide various application services, while server for user terminal 103 102 are provided with monitoring system 105, which can be monitored the operation data of service, generate time line sequence Column, and the exception of time line sequence column is identified, the timeline sequence being abnormal can be marked, and can also mark The data point being specifically abnormal in timeline sequence out.The timeline sequence of generation can store the storage in server local In medium, it is stored in except server 102 in database 106.

In addition, as another implementation (not shown in figure 1), above-mentioned monitoring data processing unit 101 can also be with It is embodied as the computer equipments such as desktop computer, laptop, tablet computer, private server, or is set to these meters It calculates in machine equipment, user can be input in the computer equipment using the timeline sequence that exception will occur as monitoring data, be led to Cross the monitoring data processing that the computer equipment executes the embodiment of the present invention.In addition, above-mentioned monitoring data processing unit 101 It can be implemented as portable (or mobile) electronic device of small form factor or be set to portable (or mobile) electronics of small form factor In device.Electronic device may is that for example, cellular phone, personal data for small form factor mentioned here portable (or mobile) Assistant (PDA), personal media player apparatus, wireless network viewing apparatus, personal head-wearing device, dedicated unit or including more than The mixing arrangement of any one of function.

As shown in fig. 1, monitoring data processing unit 101 includes timeline retrieval module 107, timeline sequence spy Levy extraction module 108 and event generation module 109.

Timeline retrieval module 107, for obtaining the multiple timeline sequences being abnormal.Timeline sequence is prison The sequence for surveying the data pair of time point and monitoring data composition, along with the monitoring behavior sustainable growth of monitoring system.Timeline Sequence can be visualized as form as shown in Figure 2, and Fig. 2 is the visualization form signal of the timeline sequence of the embodiment of the present invention Figure 200, the figure are timeline sequence chart of the search engine in the advertising income in some city, and index is income in the figure, right The dimension answered is the city.Thick lines are the normal value of prediction in figure, and hachure is actual monitoring value, and point marked in the figure is different Chang Dian.

Monitoring data processing unit 101 execute monitoring data processing triggering mode, can be by monitoring system 105 come Triggering, can also be triggered by user by actively providing the operation of timeline sequence.As a kind of triggering mode, work as monitoring It is defeated to timeline retrieval module 107 when system detects the presence of timeline sequence in piece at the appointed time and is abnormal The testing result to note abnormalities out is abnormal in the timeslice more with the acquisition of triggered time line retrieval module 107 A timeline sequence, further, in order to carry out comprehensive event analysis, it is available be abnormal in the timeslice it is complete Portion's timeline sequence.In practical applications, monitoring system 105 can be more than preset data fluctuations threshold value in the exception detected And/or Abnormal lasting is more than preset time threshold and/or the timeline sequence being abnormal is more than preset quantity When threshold value, then triggers monitoring data processing unit 101 and execute corresponding processing.

Timeline sequence signature extraction module 108, for carrying out feature extraction to multiple timeline sequences, when generating multiple Between line sequence column feature vector.Specifically, it any multinomial can mention from one in following characteristic element or to carry out feature It takes:

1) dimension relevance.Such as Merger between dimension or membership etc..

2) temporal associativity of timeline sequence occurred extremely in history.For example, two timeline sequences are always simultaneously It is abnormal, or is successively abnormal.

3) the morphological feature relevance between each timeline sequence.In there is abnormal timeline sequence, occur different There are certain relevances, such as change direction, amplitude, shape etc. for the form of the figure fluctuation of normal part.

Event generation module 109, for multiple timeline sequence signature vectors to be input in the first machine learning model It is handled, generates one or more events, event includes by the topological relation of multiple timeline Sequence compositions being abnormal Figure.

Wherein, the training data of first machine learning model can be used the timeline sequence being abnormal in history and make For training data.Wherein, each node in topological relation figure corresponds to the timeline sequence that is abnormal, between each node Side correspond to node between for anomalous effects contribution degree, topological relation figure includes central node, the central node be open up The node of abnormal most serious in relational graph is flutterred, other nodes all directly or indirectly there can be contribution to the exception of central node Degree.It should be noted that the processing by the first machine learning model, multiple timeline sequences being abnormal are likely to form one A event may also will form multiple events, this depends on the relevance between abnormal phenomenon.In addition, involved in each event Timeline sequence can correspond to same index, to more clearly from embody the time line sequence being abnormal under the index Incidence relation between column.

As shown in figure 3, its structural schematic diagram 300 for one of the event of the embodiment of the present invention.The corresponding index of the event For the income of search engine, which includes following dimension: whole nation income, the income of area A to regional C, each area is below There is the income of 5 cities (number is A1-A5, B1-B5, C1-C5 respectively).Node shown in figure is the section being abnormal Point, wherein exception does not occur in the income in regional B and its subordinate city, and the income of city A1, A3 and A4 do not occur different Often, the income of city C1 and C2 is also abnormal without occurring, and therefore, does not embody in the structural schematic diagram of the event of Fig. 3.In figure Each node corresponds to corresponding timeline sequence under respective dimensions, and side corresponds to contribution degree, and unidirectional arrow illustrates exception The contribution direction of influence, wherein the input for abnormal city occur can impact the income in the area belonging to it, eachly The abnormal of the income in area again can impact (such as the equal degradation of income in each area) income in the whole nation, in figure, entirely State's income is center node, i.e., whole nodes all directly or indirectly contributes to the exception of the central node, should Central node is also the node for taking in abnormal most serious.

Example shown in Fig. 3 is once deformed below, if the exception for the income that area A occurs is degradation, And the exception of income that area C occurs is substantial increase, and if the revenue decline that area A occurs amplitude and area C Abnormal phenomenon or abnormal phenomenon may be not present not in the smaller then whole nation income of the roughly the same perhaps difference of the amplitude risen Obviously, then in Fig. 3, whole nation income would not become central node, but will form two separation as shown in Figure 4 and Figure 5 Event.

It as shown in Figure 4 and Figure 5, is the three of two structural schematic diagram 400 of the event of the embodiment of the present invention and event Structural schematic diagram 500, in event shown in Fig. 4, the income of regional A is center node, in event shown in Fig. 5, regional B Income be center node, that is to say, that by the processing of monitoring data processing unit 101, by the income of search engine this Multiple abnormal timeline sequences under index, are integrated into two events and are exported.

As shown in fig. 6, its structural schematic diagram 600 for the event four of the embodiment of the present invention.The corresponding index of the event is Using certain search engine and number of users, the index include following dimension: using total number of users of the search engine, using search The number of users (" 1 number of users of version " is shown as in figure) of Engine Version 1 (is shown as using the number of users of search engine version 2 in figure " version 2 number of users "), in ISO system using the search engine number of users (" ISO system user number " is shown as in figure), Using the number of users (being shown as " Windows system user number " in figure) of the search engine, in ISO system in Windows system Using the number of users (being shown as " version 1&IOS system user number " in figure) of search engine version 1, search is used in ISO system The number of users (" Ban Ben2 &IOS system user number " is shown as in figure) of Engine Version 2 uses search engine in Windows system The number of users (" version 1&Windows system user number " is shown as in figure) of version 1 uses search engine in Windows system The number of users (" Ban Ben2 &Windows system user number " is shown as in figure) of version 2.It is specific with having for dimension each in Fig. 3 Membership difference (there are Mergers between each dimension in Fig. 6), shown in Fig. 6, will form friendship between each dimension The incidence relation of fork, for example, the exception of " version 1&IOS system user number " can be to " 1 number of users of version " and " IOS system user The two nodes impact number ", the exception of " Ban Ben2 &Windows system user number " also can to " version 2 number of users " and " Windows system user number " the two nodes are impacted, are influenced caused by these incidence relations, are finally pooled to conduct The fluctuation abnormal formation of total number of users of central point influences.

By monitoring data processing unit 101 shown in FIG. 1, numerous timeline sequences being abnormal can be closed The analysis of connection property, is integrated into the event of one or more topological relation diagram form, by topological relation figure it can be found that occurring different Incidence relation between normal timeline sequence, and the mutual contribution degree for exception.In addition, meeting in each event There are central node, which shows the dimension of abnormal most serious in the event, and can clearly find each The abnormal conditions of node (each dimension) for the abnormal conditions of the central node contribution degree, it is different so as to be conducive to find The root often occurred.

Into one, as shown in fig. 7, its two application example block diagram for the monitoring data processing unit of the embodiment of the present invention 700.On the basis of Fig. 1, monitoring data processing unit 101 can also improve including alarm module 701, be used for be with event Unit is alarmed.

Type of alarm in the prior art usually finds just to alarm immediately when some timeline sequence is abnormal, and Often an abnormal cause will lead to numerous timeline sequences and be abnormal, and will also generate the warning message of enormous amount, The abnormal personnel of processing are difficult to navigate to abnormal root rapidly in face of huge warning message, seriously affect working efficiency.The present invention In embodiment, after the timeline sequence to note abnormalities, will not alarm immediately, but by monitoring data processing unit 101 into Row analysis processing, after forming one or more event, then is alarmed as unit of event, so as to reduce the number of alarm Amount, the personnel for also allowing processing abnormal, which can be more clear, more targetedly analyzes abnormal cause.

By the processing of above-mentioned monitoring data processing unit, multiple events may be produced, for some event For, it typically belongs under an index.Between multiple events (these events may be corresponding to different indexs, can also Can correspond to same index) may also there can be certain relevance, the relevance between event is analyzed, is equally Aid in determining whether abnormal producing cause and influence.

As shown in figure 8, its three application example block diagram 800 for the monitoring data processing unit of the embodiment of the present invention.? On the basis of Fig. 1, monitoring data processing unit 101 can further include affair character extraction module 801 and event topology Relational graph generation module 802.

Affair character extraction module 801, for multiple events carry out characteristic vector pickup, generate multiple affair characters to Amount.Specifically, can be by one in characteristic element or any multinomial, feature extraction is carried out to multiple events:

1) feature of the corresponding index of event in dimension combined aspects.

The meaning of the feature extraction of this respect is, excavates under different indexs, it is understood that there may be dimension in terms of approximation Relationship, and the event for corresponding to different indexs relates to identical dimension.For example, index A is the turnover, index B is amount of access, Index A and index B includes following dimension: the U.S. is right the corresponding turnover of literary group, since there are the approximations in dimension Property, there may be some connections between the two events.

2) the variation relevance between event on historical record.

Different event is simultaneously or the probability that successively occurs on historical record.For example, there are two events are regular Occur simultaneously, illustrates that there may be biggish relevances between the two events.These features help to shorten between event Relevance search.

Variation characteristic relevance on historical record between different event, for example, actual measured value and prediction normal value it Between the features such as deviation amplitude, bias direction between relevance.

3) the index degree of fitting feature between event.

There may be the connection of some inherences between index, by extracting the feature of this respect, can preferably find Relevance between event.For example, have following calculated relationship between different indexs, total income (revenue)=pageview (triffic) price (CPM, Cost Per Mille) that ÷ 1000 × every thousand pageview generates.In these degree of fitting Incidence relation, and influence whether the relevance between event.

Event topological relation figure generation module 802, for multiple affair character vectors to be input to the second machine learning mould It is handled in type, generates event topological relation figure.In event topological relation figure, each node corresponds to event, Ge Gejie Side corresponds to the relevance marking between event between point.In practical applications, in the topological relation figure of generation, it can show and appoint Relevance marking between two events of anticipating, to provide more comprehensive analysis foundation to analysis personnel.Certainly, if be related to Event number it is very more, can also according to the relevance between event give a mark size be screened, only retain a relevance beat Divide the relevance marking between biggish event two-by-two.

The second above-mentioned machine learning model can be trained based on the training data of the abnormal event of history, the instruction Practicing data can be by the historical data of the monitoring data processing unit generation of Fig. 1.

As shown in figure 9, its schematic diagram 900 for the event topological relation figure of the embodiment of the present invention.Four things involved in figure Part (event 1 to event 4), output result are the topological relation figure that four events are formed, the corresponding section of any two event in figure Side is all established between point, the relevance marking between event two-by-two is had recorded in the side.

It is being multiple events by multiple timeline series processings by the processing of monitoring data processing unit shown in Fig. 8 Afterwards, additionally it is possible to excavation is further analyzed to the incidence relation between event, generates the event topological relation figure of event, thus Abnormal reason can be further analyzed from more macroscopical angle and influences situation.

It as shown in Figure 10, is four application example block diagram 1000 of the monitoring data processing unit of the embodiment of the present invention. With monitoring data processing unit 101 shown in fig. 8 the difference is that, affair character extraction module 1003 in Figure 10 and Event topological relation figure generation module 1004 forms independent monitoring data processing unit.Specifically, as shown in Figure 10, the monitoring Data processing equipment 1001 includes: that event obtains module 1002, affair character extraction module 1003 and event topological relation figure Generation module 1004.Wherein, affair character extraction module 1002 and event topological relation figure generation module 1003 and affair character Function performed by extraction module 801 and event topological relation figure generation module 802 is identical, and event obtains module 1002 For obtaining multiple events, the source of event can be monitoring data processing unit 101 shown in FIG. 1, be also possible to from The event in other monitoring data sources, the content illustrated in the content and form and preceding embodiment of event are identical.

Method process flow example

The monitoring data processing unit of the embodiment of the present invention is described above, performed by above-mentioned monitoring data processing unit Function can be implemented as the monitoring data processing unit being described below.

It as shown in figure 11, is the schematic diagram 1100 of one of the process of monitoring data processing method of the embodiment of the present invention. This method comprises:

S1101: the multiple timeline sequences being abnormal are obtained.Wherein, the monitoring data processing opportunity of being triggered can be Above-mentioned monitoring system detects the presence of timeline sequence in piece at the appointed time and is abnormal, and step S1101 can be specific Are as follows: in response to detecting the presence of output that timeline sequence is abnormal in monitoring system at the appointed time piece as a result, obtaining The multiple timeline sequences being abnormal in the timeslice.The processing of step S1101 can be by above-mentioned monitoring data The timeline retrieval module 107 for managing device 101 executes.

S1102: feature extraction is carried out to multiple timeline sequences, generates multiple timeline sequence signature vectors.

Specifically, can be according to one in following characteristic element or any multinomial, to multiple timeline sequences into Row feature extraction:

1) dimension relevance.Such as Merger between dimension or membership etc..

The processing of step S1102 can be extracted by the timeline sequence signature of above-mentioned monitoring data processing unit 101 Module 108 executes.

S1103: multiple timeline sequence signature vectors being input in the first machine learning model and are handled, and generates one A or multiple events, event include by the topological relation figure of multiple timeline Sequence compositions being abnormal.

The processing of step S1103 can be held by the event generation module 109 of above-mentioned monitoring data processing unit 101 Row.

By monitoring data processing method shown in Figure 11, numerous timeline sequences being abnormal can be associated Property analysis, the event of one or more topological relation diagram form is integrated into, by topological relation figure it can be found that being abnormal Timeline sequence before incidence relation, and it is mutual for abnormal contribution degree.In addition, can exist in each event Central node, which shows the dimension of abnormal most serious in the event, and can clearly find each node The abnormal conditions of (each dimension) for the abnormal conditions of the central node contribution degree, it is different so as to clearly find The root often occurred.

It as shown in figure 12, is two schematic diagram 1200 of the process of the monitoring data processing method of the embodiment of the present invention, On the basis of the process shown in Figure 11, after generating one or more events, the monitoring data processing side of the embodiment of the present invention Method can also include:

S1201: it is alarmed as unit of event.The processing of the step can be by above-mentioned monitoring data processing unit 101 alarm module 501 executes.

In the embodiment of the present invention, after the timeline sequence to note abnormalities, it will not alarm immediately, but it is real through the invention The monitoring data processing method for applying example is analyzed and processed, and after forming one or more event, then is carried out as unit of event Alarm, so as to reduce the quantity of alarm, the personnel for also allowing processing abnormal can be more clear more targetedly to different Normal reason is analyzed.

It as shown in figure 13, is three schematic diagram 1300 of the process of the monitoring data processing method of the embodiment of the present invention, Shown in Figure 11 on the basis of monitoring data processing method, can also include:

S1301: characteristic vector pickup is carried out to multiple events, generates multiple affair character vectors.

Specifically, can be by one in characteristic element or any multinomial, feature extraction is carried out to multiple events:

1) feature of the corresponding index of event in dimension combined aspects.

The meaning of the feature extraction of this respect is, excavates under different indexs, it is understood that there may be dimension in terms of approximation Relationship, and the event for corresponding to different indexs relates to identical dimension.

2) the variation relevance between event on historical record.

3) the index degree of fitting feature between event.

There may be the connection of some inherences between index, by extracting the feature of this respect, can preferably find Relevance between event.

The processing of step S1302 can be by the affair character extraction module 801 of above-mentioned monitoring data processing unit 101 It executes.

S1302: multiple affair character vectors being input in the second machine learning model and are handled, and generates event topology Relational graph.In event topological relation figure, each node corresponds to event, and side corresponds to the pass between event between each node The marking of connection property.In practical applications, in the topological relation figure of generation, the relevance that can be shown between any two event is beaten Point, it, certainly, can also be with if the event number being related to is very more to provide more comprehensive analysis foundation to analysis personnel It is screened according to the size of the relevance marking between event, only retains the pass that relevance is given a mark between biggish event two-by-two The marking of connection property.

The second above-mentioned machine learning model can be trained based on the training data of the abnormal event of history, the instruction Practicing data can be by the historical data of the monitoring data processing method generation of Figure 11.

The processing of step S1302 can be generated by the event topological relation figure of above-mentioned monitoring data processing unit 101 Module 802 executes.

By monitoring data processing method shown in Figure 13, after by multiple timeline series processings being multiple events, also Excavation can be further analyzed to the incidence relation between event, generate the event topological relation figure of event, so as to Abnormal reason is further analyzed from more macroscopical angle and influences situation.

It as shown in figure 14, is four schematic diagram 1400 of the process of the monitoring data processing method of the embodiment of the present invention, Process flow shown in Figure 13 can also be used as independent method flow to execute.As shown in figure 14, this method process includes:

S1401: multiple events are obtained.The source of event can be monitoring data processing unit 101 shown in FIG. 1 or figure Event caused by monitoring data processing method shown in 11 is also possible to the event from other monitoring data sources.The step Rapid processing can obtain module 1002 by the event of the monitoring data processing unit 1001 in Figure 10 and execute.

S1402: characteristic vector pickup is carried out to multiple events, generates multiple affair character vectors.The processing of the step Technical detail is identical as the step S1301 in Figure 13.The processing of step S1402 can be handled by the monitoring data in Figure 10 and be filled Set 1001 execution of affair character extraction module 1002.

S1403: multiple affair character vectors being input in the second machine learning model and are handled, and generates event topology Relational graph.The technical detail of the processing of the step is identical as the step S1302 in Figure 13.The processing of step S1403 can be by The event topological relation figure generation module 1003 of monitoring data processing unit 1001 in Figure 10 executes.

It should be noted that above-mentioned monitoring data processing method, can based on above-mentioned monitoring data processing unit come It realizes, can also be used as method flow and independently realize, either by other softwares or hardware design, implement in the present invention Under the invention thought of example, realized.

It is described above each process of the monitoring data processing unit of the embodiment of the present invention, technical detail and corresponding Technical effect before be directed to monitoring data processing unit introduction in be described in detail, details are not described herein.

The specific implementation example of electronic equipment

In some instances, above-mentioned Fig. 1 to Figure 14 is related to one or more modules or one or more steps or One or more treatment processes can also mutually be tied by software program with hardware circuit by software program, hardware circuit The mode of conjunction is realized.For example, above-mentioned various components or module and one or more steps all can be in system on chip (SoC) it is realized in.SoC can include: IC chip, the IC chip include following one or more: processing unit (such as central processing unit (CPU), microcontroller, microprocessing unit, digital signal processing unit (DSP)), memory, one Or the firmware of multiple communication interfaces, and/or further circuit and optional insertion for executing its function.

It as shown in figure 15, is the structural block diagram 1500 of the electronic equipment of inventive embodiments.Electronic equipment 1500 includes: to deposit Reservoir 1501 and processor 1502.

Memory 1501, for storing program.In addition to above procedure, memory 1501 is also configured to store other Various data are to support the operation on electronic equipment 1500.The example of these data includes for grasping on electronic equipment 1500 The instruction of any application or method of work, contact data, telephone book data, message, picture, video etc..

Memory 1501 can realize by any kind of volatibility or non-volatile memory device or their combination, Such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable is read-only Memory (EPROM), programmable read only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk Or CD.

Memory 1501 is coupled to processor 1502 and includes the instruction being stored thereon, and described instruction is by handling Device 1502 makes electronic equipment execute movement when executing, and as the embodiment of a kind of electronic equipment, which may include:

Obtain the multiple timeline sequences being abnormal；

Feature extraction is carried out to multiple timeline sequences, generates multiple timeline sequence signature vectors；

Multiple timeline sequence signature vectors are input in the first machine learning model and are handled, generate one or more A event, event include by the topological relation figure of multiple timeline Sequence compositions being abnormal.

Wherein it is possible to it is according to one in following characteristic element or any multinomial, multiple timeline sequences are carried out Feature extraction:

Dimension relevance, the temporal associativity of timeline sequence occurred extremely in history, between each timeline sequence Morphological feature relevance.

Wherein, each node in topological relation figure can correspond to the timeline sequence being abnormal, each node it Between side can correspond to the contribution degree between node for anomalous effects, topological relation figure may include central node, in this Heart node is the node of abnormal most serious in topological relation figure, and other nodes all can be directly or indirectly to the different of central node Often with degree of contributing.

Wherein, obtaining the multiple timeline sequences being abnormal may include:

In response to detecting the presence of output that timeline sequence is abnormal in monitoring system at the appointed time piece as a result, Obtain the multiple timeline sequences being abnormal in the timeslice.

It wherein, can also include: to be alarmed as unit of event after generating one or more events.

Wherein, the timeline sequence in each event can correspond to same index.

Wherein, can also include: after generating multiple events

Characteristic vector pickup is carried out to multiple events, generates multiple affair character vectors；

Multiple affair character vectors are input in the second machine learning model and are handled, event topological relation is generated Figure.

Wherein it is possible to it is according to one in following characteristic element or any multinomial, feature is carried out to multiple events and is mentioned It takes:

Variation relevance of the corresponding index of event between the feature, event of dimension combined aspects on historical record with And the index degree of fitting feature between event.

Wherein, in event topological relation figure, each node can correspond to event, and side can correspond between each node Relevance marking between event.

The alternatively embodiment of electronic equipment, above-mentioned movement may include:

Obtain multiple events；

For above-mentioned processing operation, detailed description has been carried out in the embodiment of method and apparatus in front, for The detailed content of above-mentioned processing operation can equally be well applied in electronic equipment 1500, it can by what is mentioned in preceding embodiment Specific processing operation is written in memory 1501 in a manner of program, and is executed by processor 1502.

Further, as shown in figure 15, electronic equipment 1400 can also include: communication component 1403, power supply module 1404, sound Other components such as frequency component 1405, display 1506, chipset 1507.Members are only schematically provided in Figure 15, and unexpectedly Taste electronic equipment 1500 only include component shown in Figure 15.

Communication component 1503 is configured to facilitate the logical of wired or wireless way between electronic equipment 1500 and other equipment Letter.Electronic equipment can access the wireless network based on communication standard, such as WiFi, 2G or 3G or their combination.Show at one In example property embodiment, communication component 1503 receives broadcast singal or broadcast from external broadcasting management system via broadcast channel Relevant information.In one exemplary embodiment, communication component 1503 further includes near-field communication (NFC) module, to promote short distance Communication.For example, radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra wide band can be based in NFC module (UWB) technology, bluetooth (BT) technology and other technologies are realized.

Power supply module 1504 provides electric power for the various assemblies of electronic equipment.Power supply module 1504 may include power supply pipe Reason system, one or more power supplys and other with for electronic equipment generate, manage, and distribute the associated component of electric power.

Audio component 1505 is configured as output and/or input audio signal.For example, audio component 1505 includes a wheat Gram wind (MIC), when electronic equipment is in operation mode, when such as call mode, recording mode, and voice recognition mode, microphone quilt It is configured to receive external audio signal.The received audio signal can be further stored in memory 1501 or via communication Component 1503 is sent.In some embodiments, audio component 1505 further includes a loudspeaker, is used for output audio signal.

Display 1506 includes screen, and screen may include liquid crystal display (LCD) and touch panel (TP).If screen Curtain includes touch panel, and screen may be implemented as touch screen, to receive input signal from the user.Touch panel includes one A or multiple touch sensors are to sense the gesture on touch, slide, and touch panel.Touch sensor can not only sense touching It touches or the boundary of sliding action, but also detects duration and pressure relevant with touch or slide.

Above-mentioned memory 1501, processor 1502, communication component 1503, power supply module 1504, audio component 1505 with And display 1506 can be connect with chipset 1507.Chipset 1507 can be provided in processor 1502 and electronic equipment 1500 Remaining component between interface.In addition, chipset 1507 can also provide the various components in electronic equipment 1500 to storage The communication interface mutually accessed between the access interface and various components of device 1501.

Example clause

A kind of A: method, comprising:

Obtain the multiple timeline sequences being abnormal；

Feature extraction is carried out to the multiple timeline sequence, generates multiple timeline sequence signature vectors；

The multiple timeline sequence signature vector is input in the first machine learning model and is handled, generates one Or multiple events, the event include by the topological relation figure of multiple timeline Sequence compositions being abnormal.

B: according to method described in paragraph A, wherein it is according to one in following characteristic element or any multinomial, it is right The multiple timeline sequence carries out feature extraction:

Dimension relevance, the temporal associativity of the timeline sequence occurred extremely in history, each timeline sequence Between morphological feature relevance.

C: according to method described in paragraph A, wherein each node in the topological relation figure, which corresponds to, to be abnormal Timeline sequence, the side between each node correspond to the contribution degree between node for anomalous effects, the topological relation figure Including central node, which is the node of abnormal most serious in topological relation figure, other nodes all can directly or Being grounded has contribution degree to the exception of central node.

D: according to method described in paragraph A, wherein obtaining the multiple timeline sequences being abnormal includes:

E: according to method described in paragraph A, wherein after generating one or more events, further includes: as unit of event into Row alarm.

F: according to method described in paragraph A, wherein the timeline sequence in each event corresponds to same index.

G: according to method described in paragraph A, wherein after generating multiple events further include:

The multiple affair character vector is input in the second machine learning model and is handled, event topology is generated and closes System's figure.

H: according to method described in paragraph G, wherein it is according to one in following characteristic element or any multinomial, it is right The multiple event carries out feature extraction:

I: according to method described in paragraph G, wherein in the event topological relation figure, each node corresponds to event, respectively Side corresponds to the relevance marking between event between a node.

A kind of J: device, comprising:

Timeline retrieval module, for obtaining the multiple timeline sequences being abnormal；

Timeline sequence signature extraction module generates multiple for carrying out feature extraction to the multiple timeline sequence Timeline sequence signature vector；

Event generation module, for the multiple timeline sequence signature vector to be input in the first machine learning model It is handled, generates one or more events, the event includes by the topology of multiple timeline Sequence compositions being abnormal Relational graph.

K: according to device described in paragraph J, wherein it is according to one in following characteristic element or any multinomial, it is right The multiple timeline sequence carries out feature extraction:

L: according to device described in paragraph J, wherein each node in the topological relation figure, which corresponds to, to be abnormal Timeline sequence, the side between each node correspond to the contribution degree between node for anomalous effects, the topological relation figure Including central node, which is the node of abnormal most serious in topological relation figure, other nodes all can directly or Being grounded has contribution degree to the exception of central node.

M: according to device described in paragraph J, wherein obtaining the multiple timeline sequences being abnormal includes:

N: according to device described in paragraph J, wherein further include:

Alarm module, for being alarmed as unit of event.

O: according to device described in paragraph J, wherein further include:

Affair character extraction module generates multiple affair character vectors for carrying out characteristic vector pickup to multiple events；

Event topological relation figure generation module, for the multiple affair character vector to be input to the second machine learning mould It is handled in type, generates event topological relation figure.

P: according to device described in paragraph O, wherein the affair character extraction module is according in following characteristic element One or any multinomial, feature extraction is carried out to the multiple event:

Q: according to device described in paragraph O, wherein in the event topological relation figure, each node corresponds to event, respectively Side corresponds to the relevance marking between event between a node.

R: a kind of electronic equipment, comprising:

Processing unit；And

Memory is coupled to the processing unit and includes the instruction being stored thereon, and described instruction is by described Reason unit makes the equipment execute movement when executing, and the movement includes:

Obtain the multiple timeline sequences being abnormal；

S: according to electronic equipment described in paragraph R, wherein according to one in following characteristic element or any more , feature extraction is carried out to the multiple timeline sequence:

T: according to electronic equipment described in paragraph R, wherein it is different that each node in the topological relation figure corresponds to generation Normal timeline sequence, the side between each node correspond to the contribution degree between node for anomalous effects, and the topology is closed System's figure includes central node, which is the node of abnormal most serious in topological relation figure, other nodes all can directly or Person has contribution degree to the exception of central node indirectly.

U: according to electronic equipment described in paragraph R, wherein the movement further include:

A kind of V: method, comprising:

Obtain multiple events；

Characteristic vector pickup is carried out to the multiple event, generates multiple affair character vectors；

A kind of W: device, comprising:

Event obtains module, for obtaining multiple events；

Affair character extraction module generates multiple affair characters for carrying out characteristic vector pickup to the multiple event Vector；

X: a kind of electronic equipment, comprising:

Processing unit；And

Obtain multiple events；

Conclusion

It is distinguished between the hardware and software realization of many aspects of system little；Usually (but simultaneously using hardware or software Not always, because in some contexts, the selection between hardware and software can become significant) it is to indicate cost and efficiency tradeoff Design alternative.In the presence of may be implemented processing described herein and/or system and/or other technologies (for example, hardware, software, with And/or firmware) various carrying tools, and preferably carrying tool will be with disposing the processing and/or system and/or other skills The background of art and change.For example, the realization side can choose main hard if realization side determines that speed and accuracy are most important Part and/or firmware carrying tool；If flexibility is most important, which can choose main software realization；Alternatively, furthermore Again alternatively, which can choose some combinations of hardware, software and/or firmware.

Foregoing detailed description is via using block diagram, flow chart and/or example to elaborate the device and/or processing Various embodiments.Include one or more functions and/or operation as this block diagram, flow chart and/or example, It will be appreciated by those skilled in the art that each function and/or operation in this block diagram, flow chart or example can be independent Ground and/or jointly, by the hardware, software, firmware of wide scope, or actually any combination thereof is realized.In a reality It applies in mode, several parts of purport described herein can be via specific integrated circuit (ASIC), field programmable gate array (FPGA), digital signal processor (DSP) or other integrated formats are realized.However, those skilled in the art should recognize It arrives, some aspects of embodiment disclosed herein entirely or partially can be realized equally in integrated circuits, real It is now one or more computer programs for operating on one or more computers (for example, being embodied as operating in one Or more one or more programs in computer system), be embodied as running one on one or more processors A or more program (for example, being embodied as operating in one or more programs on one or more microprocessors) is real It is now firmware, or is actually embodied as any combination thereof, and according to the disclosure, designs circuit and/or write for software And/or the code of firmware is completely in the technology of those skilled in the art.In addition, it should be apparent to those skilled in the art that It is that the mechanism of theme described herein can be distributed as program product in a variety of forms, and the example of theme described herein Exemplary embodiment is applicable in, and unrelated be used to actually execute the certain types of signal bearing medium of the distribution.Signal is held Carry medium example include but is not limited to, below: recordable-type media, as floppy disk, hard disk drive (HDD), the close disk of matter (CD), Digital versatile disc (DVD), digital magnetic tape, computer storage etc.；And transmission type media, such as number and/or analogue communication medium (for example, fiber optic cable, waveguide, wired communications links, wireless communication link etc.).

It should be recognized by those skilled in the art that device and/or processing are described by mode set forth herein, and this Afterwards, it is in the art common for the device described in this way and/or processing being integrated into data processing system using engineering practice. That is, device described herein and/or at least part of processing can be integrated into data processing system via the experiment of reasonable amount In system.Skilled artisan recognize that common data processing system generally includes one of the following or more It is multiple: system unit shell, video display devices, the memory of such as volatile and non-volatile memory, such as micro process The meter of the processor of device and digital signal processor, such as operating system, driver, graphical user interface and application program One or more interactive apparatus of entity, such as touch tablet or touch screen are calculated, and/or including feedback loop and control electricity The control system of motivation is (for example, for sensing the feedback of position and/or the feedback of speed；For moving and/or adjusting component and/or number The control motor of amount).Common data processing system, which can use any suitable commercial, can obtain component to realize, such as usually in number According to those of being found in calculating/communication and/or network communication/computing system.

Theme described herein sometimes illustrates different components in different other components or coupled. It is clear that the framework described in this way is only exemplary, and indeed, it is possible to realize many for obtaining identical function Other frameworks.On conceptual sense, all effectively " it is associated with " for obtaining any arrangement of component of identical function, so that Function is wished in acquisition.Therefore, any two components combined herein to obtain specific function can be seen as " related each other Connection " wishes function so as to obtain, and unrelated with framework or intermediate module.Similarly, any two components associated in this way can be with It is considered and " is operably connected " each other, or " being operatively coupled to ", wish function to obtain, and can so associated Two components, which can also be considered, " to be operatively coupled to " each other, wish function to obtain.The specific example being operatively coupled to Including but not limited to, it can physically cooperate and/or physically interactive component and/or can wirelessly interact and/or wirelessly hand over Mutual component and/or in logic interaction and/or in logic can interactive component.

Background can be directed to for any plural number substantially used herein and/or singular references, those skilled in the art And/or application pluralizes from plural number translation singularization and/or from odd number translation at the appropriate time.For clarity, it is various odd number/ Majority displacement can be illustrated definitely herein.

It will be appreciated by those skilled in the art that in general, it is as used herein, and especially in the appended claims In the term that is used (for example, the main body of the appended claims) be generally intended as " open " wording (for example, wording " packet Include (including) " it should be construed as " including but not limited to ", wording " having (having) " should be construed as " at least having Have ", wording " including (include) " should be construed as " including but not limited to " etc.).Those skilled in the art should also be appreciated that If it is intended to certain amount of introduce claim recitation, then this intention will be stated clearly in the claim, and In the case where no these are enumerated, this intention is not present.For example, claims provided below can be with to help to understand Claim recitation is introduced comprising using introductory phrase "at least one" and " one or more ".However, using this Phrase should not be considered as, and imply that the claim recitation introduced by indefinite article " one (a) " or " one (an) " will include this Jie Any specific rights requirement of claim recitation of continuing is limited to only comprising a this invention enumerated, even if same right is wanted Seek the indefinite article including introductory phrase " one or more " or "at least one" and such as " one (a) " or " one (an) " (for example, " one (a) " or " one (an) " should usually be construed as meaning "at least one" or " one or more ")；Its for It is true using equally being remained for the definite article used to introduce claim recitation.In addition, even if clearly stating specific Quantity introduces claim recitation, those skilled in the art it should also be realized that this enumerate should usually be construed as, until Mean institute's recited number (for example, only enumerate of " two are enumerated " generally means that in the case where no other modifiers less At least two enumerate or two or more are enumerated).Moreover, using similar to " at least one of A, B and C etc. " Those of convention example in, in general, this syntactic structure wishes that those skilled in the art should understand that this in the sense Kind of convention (for example, " system at least one of A, B and C " should include but is not limited to independent A, independent B, Independent C, A and B together, A and C together, B and C together and/or A, B and C system together etc.).Using be similar to " A, In those of the convention of at least one of B or C etc. " example, in general, this syntactic structure wishes those skilled in the art Member is in the sense it should be understood that this convention (for example, " system at least one of A, B or C " should include but unlimited In with independent A, independent B, independent C, A and B together, A and C together, B and C together and/or A, B and C together etc. be System).Those skilled in the art should also be appreciated that, in fact, any adversative of two or more alternative terms is presented Be to be understood as with/phrase (no matter in description, claims, still in the accompanying drawings), it is contemplated that including these terms, A possibility that any of these terms or two terms.For example, phrase " A or B " is to be understood as, including " A " or A possibility that " B " or " A and B ".

" implementation ", " implementation ", " some implementations ", or " other realization sides are directed in this specification The reference of formula " can be it is meant that can be wrapped in conjunction with special characteristic, structure or the characteristic that one or more implementations describe It includes at least some implementations, but is not necessarily included in all implementations.Different " the realizations occurred in foregoing description Mode ", " implementation ", or " some implementations " need not be quoted all for same implementation.

Although using distinct methods and System describe and showing particular exemplary technology, those skilled in the art should Understand, in the case where not departing from claimed theme, various other modifications can be carried out, and can replace equivalent. In addition, many modify so as to adapt to for claimed can be carried out in the case where not departing from central concept described herein Theme introduction specific condition.It is therefore desirable to the theme of protection is not limited to disclosed particular example, but this requirement The theme of protection can also include all realizations fallen into the range of the appended claims and its equivalent.

Although this theme of the dedicated language description of structural features and or methods of action has been used, it is to be understood that appended power Theme defined in sharp claim is not necessarily limited to described specific feature or action.But these specific features and movement are It is disclosed as the illustrative form for realizing the claim.

Unless specifically stated otherwise, otherwise within a context be understood that and be used generally conditional statement (such as " energy ", " can ", " possibility " or " can with ") indicate that particular example includes and other examples do not include special characteristic, element and/or step. Therefore, such conditional statement is generally not intended to imply that requires feature, element for one or more examples in any way And/or step, or one or more examples necessarily include inputting or mentioning for the logic of decision, with or without user Show, whether to include or to execute these features, element and/or step in any specific embodiment.

Unless specifically stated otherwise, it should be understood that joint language (such as phrase " at least one in X, Y or Z ") indicates item, word Language etc. can be any one of X, Y or Z, or combinations thereof.

Any customary description, element or frame should be understood to potentially in flow chart described in described herein and/or attached drawing Expression include the code of one or more executable instructions for realizing logic function specific in the routine or element module, Segment or part.Replacement example is included in the range of example described herein, and wherein each element or function can be deleted, or It is inconsistently executed with sequence shown or discussed, including substantially simultaneously executes or execute in reverse order, this depends on In related function, as those skilled in the art also will be understood that.

It should be emphasized that can to above-mentioned example, many modifications may be made and modification, element therein shows as other are acceptable Example is understood that like that.All such modifications and variations are intended to include herein within the scope of this disclosure and by following right Claim protection.

Those of ordinary skill in the art will appreciate that: realize that all or part of the steps of above-mentioned each method embodiment can lead to The relevant hardware of program instruction is crossed to complete.Program above-mentioned can be stored in a computer readable storage medium.The journey When being executed, execution includes the steps that above-mentioned each method embodiment to sequence；And storage medium above-mentioned include: ROM, RAM, magnetic disk or The various media that can store program code such as person's CD.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention., rather than its limitations；To the greatest extent Pipe present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that: its according to So be possible to modify the technical solutions described in the foregoing embodiments, or to some or all of the technical features into Row equivalent replacement；And these are modified or replaceed, various embodiments of the present invention technology that it does not separate the essence of the corresponding technical solution The range of scheme.

Claims

1. a kind of method, comprising:

Obtain the multiple timeline sequences being abnormal；

The multiple timeline sequence signature vector is input in the first machine learning model and is handled, generates one or more A event, the event include by the topological relation figure of multiple timeline Sequence compositions being abnormal.

It is according to one in following characteristic element or any multinomial 2. according to the method described in claim 1, wherein, it is right The multiple timeline sequence carries out feature extraction:

Dimension relevance, the temporal associativity of the timeline sequence occurred extremely in history, between each timeline sequence Morphological feature relevance.

3. according to the method described in claim 1, wherein, each node in the topological relation figure, which corresponds to, to be abnormal Timeline sequence, the side between each node correspond to the contribution degree between node for anomalous effects, the topological relation figure Including central node, which is the node of abnormal most serious in topological relation figure, other nodes all can directly or Being grounded has contribution degree to the exception of central node.

4. according to the method described in claim 1, wherein, obtaining the multiple timeline sequences being abnormal includes:

In response to detecting the presence of output that timeline sequence is abnormal in monitoring system at the appointed time piece as a result, obtaining The multiple timeline sequences being abnormal in the timeslice.

5. according to the method described in claim 1, wherein, after generating one or more events, further includes: as unit of event into Row alarm.

6. according to the method described in claim 1, wherein, the timeline sequence in each event corresponds to same index.

7. according to the method described in claim 1, wherein, after generating multiple events further include:

The multiple affair character vector is input in the second machine learning model and is handled, event topological relation is generated Figure.

It is according to one in following characteristic element or any multinomial 8. according to the method described in claim 7, wherein, it is right The multiple event carries out feature extraction:

Variation relevance and thing of the corresponding index of event between the feature, event of dimension combined aspects on historical record Index degree of fitting feature between part.

9. according to the method described in claim 7, wherein, in the event topological relation figure, each node corresponds to event, respectively Side corresponds to the relevance marking between event between a node.

10. a kind of device, comprising:

Timeline sequence signature extraction module generates multiple times for carrying out feature extraction to the multiple timeline sequence Line sequence column feature vector；

Event generation module is carried out for the multiple timeline sequence signature vector to be input in the first machine learning model Processing generates one or more events, and the event includes by the topological relation of multiple timeline Sequence compositions being abnormal Figure.

11. device according to claim 10, wherein it is according to one in following characteristic element or any multinomial, Feature extraction is carried out to the multiple timeline sequence:

12. device according to claim 10, wherein each node in the topological relation figure, which corresponds to, to be abnormal Timeline sequence, the side between each node corresponds to the contribution degree between node for anomalous effects, the topological relation Figure includes central node, which is the node of abnormal most serious in topological relation figure, other nodes all can directly or There is contribution degree to the exception of central node indirectly.

13. device according to claim 10, wherein obtaining the multiple timeline sequences being abnormal includes:

14. device according to claim 10, wherein further include:

Alarm module, for being alarmed as unit of event.

15. device according to claim 10, wherein further include:

Event topological relation figure generation module, for the multiple affair character vector to be input in the second machine learning model It is handled, generates event topological relation figure.

16. device according to claim 15, wherein the affair character extraction module is according in following characteristic element One or it is any multinomial, feature extraction is carried out to the multiple event:

17. device according to claim 15, wherein in the event topological relation figure, each node corresponds to event, Side corresponds to the relevance marking between event between each node.

18. a kind of electronic equipment, comprising:

Processing unit；And

Memory is coupled to the processing unit and includes the instruction being stored thereon, and described instruction is single by the processing Member makes the equipment execute movement when executing, and the movement includes:

Obtain the multiple timeline sequences being abnormal；

19. electronic equipment according to claim 18, wherein according to one in following characteristic element or any more , feature extraction is carried out to the multiple timeline sequence:

20. electronic equipment according to claim 18, wherein each node in the topological relation figure, which corresponds to, to be occurred Abnormal timeline sequence, the side between each node correspond to the contribution degree between node for anomalous effects, the topology Relational graph includes central node, which is the node of abnormal most serious in topological relation figure, and other nodes all can be direct Or there is contribution degree to the exception of central node indirectly.

21. electronic equipment according to claim 18, wherein the movement further include: