CN110491106A

CN110491106A - Data early warning method, device and the computer equipment of knowledge based map

Info

Publication number: CN110491106A
Application number: CN201910661958.8A
Authority: CN
Inventors: 柳洋
Original assignee: OneConnect Smart Technology Co Ltd
Current assignee: OneConnect Smart Technology Co Ltd
Priority date: 2019-07-22
Filing date: 2019-07-22
Publication date: 2019-11-22
Anticipated expiration: 2039-07-22
Also published as: CN110491106B; WO2021012745A1

Abstract

This application discloses data early warning method, device, computer equipment and the storage mediums of a kind of knowledge based map, which comprises generates the first data function that first data change over time；According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained function H (t)；First time length when function H (t) is not equal to m on a timeline and the second time span when equal to m are obtained, and calculates the normal data time accounting；If the normal data time accounting is greater than default accounting threshold value, from include the mandatory member knowledge mapping in obtain and be associated with member with what the mandatory member had a direct connection relational；The second data of association member are obtained, and judge whether second data are abnormal；If second data exception generates warning information, and encloses the second data of the association member in the warning information.To realize the accuracy for improving early warning.

Description

Data early warning method, device and the computer equipment of knowledge based map

Technical field

This application involves computer field is arrived, data early warning method, the dress of a kind of knowledge based map are especially related to It sets, computer equipment and storage medium.

Background technique

Every aspect in today's society has the needs of early warning mostly, how to obtain accurate early warning the result is that people institute It pursues but is difficult to realize.Traditional technology can only generally be collected the data of a main body, analyze, and obtain whether need Want the conclusion of early warning.However in real production and living, main body be not it is isolated, a main body will receive strong association relationship Main body influence, therefore the data for only analyzing single main body carry out early warning analysis, and the early warning conclusion obtained is inaccurate.Therefore Traditional technology lacks comprehensively accurate early warning scheme.

Summary of the invention

The main purpose of the application is the data early warning method for providing a kind of knowledge based map, device, computer equipment And storage medium, it is intended to improve the accuracy of early warning.

In order to achieve the above-mentioned object of the invention, the application proposes a kind of data early warning method of knowledge based map, including with Lower step:

The first data that mandatory member is obtained using preset data acquisition technology carry out at noise reduction first data Reason, and the first data function that first data change over time is generated according to the first data after noise reduction process；

According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t), is obtained Function H (t) is taken, wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, E (t) difference functions of the function changed over time for first data function and the normal data,For the difference The differentiation function of function against time, min refer to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value；

Obtain the function H (t) on a timeline not equal to m when first time length and the second time when equal to m Length, and according to formula: normal data time accounting=first time length/(the first time length+described second Time span), calculate the normal data time accounting；

Judge whether the normal data time accounting is greater than default accounting threshold value；

If the normal data time accounting is greater than default accounting threshold value, transferred from preset knowledge mapping library including The knowledge mapping of the mandatory member, and obtained and the mandatory member from the knowledge mapping including the mandatory member There is the association member of direct connection relational；

The second data of the association member are obtained, and algorithm is judged according to preset data exception, judge described second Whether data are abnormal；

If second data exception generates warning information, and encloses the association member in the warning information The second data.

Further, first data that mandatory member is obtained using preset data acquisition technology, to described first Data carry out the step of noise reduction process, include:

Using the Scrapy frame of Python, the first data of mandatory member are crawled in default website；

The numerical value of first data is formed into specified numerical value group, and uses preset formula:Calculate the population variance of m-th of numerical value in the specified numerical value groupWherein N is described specified The sum of numerical value in numerical value group, Am are m-th of numerical value of the specified numerical value group, and B is the average value of the specified numerical value group；

Judge the population varianceWhether preset variance threshold values are respectively less than；

If the population variancePreset variance threshold values are not respectively less than, then by the population varianceNot less than default Corresponding first data of variance threshold values as noise and be removed processing.

Further, described according to formula:

H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) obtains function H (t), wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, and E (t) is institute The difference functions for the function that the first data function and the normal data change over time are stated,For the difference functions pair The differentiation function of time, min refer to minimum value function, and t is the time, before m is preset the step of being greater than 0 error parameter value, Include:

Obtain the inverse function F of first data function^-1(y), wherein F (t) is the first data function, and y is described first Data；

According to formula:Time numerical value L is calculated, and judges whether the time numerical value L is greater than Preset time threshold, wherein p is preset parameter value, and p is greater than 0；

If the time numerical value L is greater than preset time threshold, generating function H (t) acquisition instruction.

Further, described according to formula:Time numerical value L is calculated, and judges the time Before the step of whether numerical value L is greater than preset time threshold, and wherein p is preset parameter value, and p is greater than 0, comprising:

Historical data identical with the type of first data is obtained from preset database, wherein the history number Risk data threshold value is described in, the risk data threshold value, which refers to, is divided into normal data and abnormal number for the historical data According to line of demarcation；

The risk data threshold value is set by the numerical value of the parameter value p.

Further, if the normal data time accounting is greater than default accounting threshold value, from preset knowledge graph Spectrum transfers the knowledge mapping including the mandatory member in library, and obtains from the knowledge mapping including the mandatory member With the mandatory member have direct connection relational the step of being associated with member before, comprising:

Initial solid is identified from the specify information collected in advance using preset knowledge mapping the build tool, wherein institute It states specify information and at least describes the mandatory member, the initial solid includes at least the mandatory member；

Duplicate removal processing is carried out to the initial solid, to obtain final entity；

From the relationship extracted in the specify information between final entity, to form triple, and according to described three Tuple generates the knowledge mapping including the mandatory member.

Further, second data for obtaining the association member, and algorithm is judged according to preset data exception, Judge second data whether Yi Chang step, comprising:

The second data of the association member are obtained, and extract greatest measure and minimum value from second data；

Time point that the greatest measure occurs is judged whether within the first preset time range, and judgement is described most Whether the time point that fractional value occurs is within the second preset time range；

If the time point that the greatest measure occurs is within the first preset time range, and the minimum value occurs Time point within the second preset time range, then determine that second data are normal.

Further, if second data exception, warning information is generated, and enclose in the warning information The step of the second data of the association member, include:

If second data exception, the knowledge node according to the knowledge mapping including the mandatory member is mutual Influence relationship obtains second data to the effect tendency of the mandatory member；

Warning information is generated, and encloses second data for being associated with member and second number in the warning information According to the effect tendency to the mandatory member.

The application provides a kind of data early warning device of knowledge based map, comprising:

First data function generation unit, for obtaining the first number of mandatory member using preset data acquisition technology According to first data progress noise reduction process, and at any time according to the first data generation first data after noise reduction process Between the first data function for changing；

Function H (t) generation unit, for according to formula:

H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) obtains function H (t), wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, and E (t) is institute The difference functions for the function that the first data function and the normal data change over time are stated,For the difference functions pair The differentiation function of time, min refer to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value；

Normal data time accounting acquiring unit, for obtain the function H (t) on a timeline not equal to m when the One time span and the second time span when equal to m, and according to formula: normal data time accounting=first time is long Degree/(the first time length+second time span), calculates the normal data time accounting；

Default accounting threshold decision unit, for judging whether the normal data time accounting is greater than default accounting threshold Value；

Knowledge mapping transfers unit, if being greater than default accounting threshold value for the normal data time accounting, from default Knowledge mapping library in transfer the knowledge mapping including the mandatory member, and from the knowledge graph including the mandatory member It is obtained in spectrum and is associated with member with what the mandatory member had a direct connection relational；

Second data determining unit, for obtaining the second data of the association member, and according to preset data exception Judge algorithm, judges whether second data are abnormal；

Warning information generation unit generates warning information, and believe in the early warning if being used for second data exception The second data of the association member are enclosed in breath.

The application provides a kind of computer equipment, including memory and processor, and the memory is stored with computer journey The step of sequence, the processor realizes any of the above-described the method when executing the computer program.

The application provides a kind of computer readable storage medium, is stored thereon with computer program, the computer program The step of method described in any of the above embodiments is realized when being executed by processor.

Data early warning method, device, computer equipment and the storage medium of the knowledge based map of the application, described in generation The first data function that first data change over time；According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained function H (t)；The function H (t) is not obtained on a timeline not First time length when equal to m and the second time span when equal to m, and calculate the normal data time accounting；Sentence Whether the normal data time accounting of breaking is greater than default accounting threshold value；If the normal data time accounting is greater than default accounting Threshold value then obtains the pass for having direct connection relational with the mandatory member from the knowledge mapping including the mandatory member The person of being unified into；The second data of the association member are obtained, and algorithm is judged according to preset data exception, judge second number According to whether abnormal；If second data exception generates warning information, and encloses described be associated in the warning information The second data of member.To realize the accuracy for improving early warning.

Detailed description of the invention

Fig. 1 is the flow diagram of the data early warning method of the knowledge based map of one embodiment of the application；

Fig. 2 is the structural schematic block diagram of the data early warning device of the knowledge based map of one embodiment of the application；

Fig. 3 is the structural schematic block diagram of the computer equipment of one embodiment of the application.

The embodiments will be further described with reference to the accompanying drawings for realization, functional characteristics and the advantage of the application purpose.

Specific embodiment

It is with reference to the accompanying drawings and embodiments, right in order to which the objects, technical solutions and advantages of the application are more clearly understood The application is further elaborated.It should be appreciated that specific embodiment described herein is only used to explain the application, not For limiting the application.

Referring to Fig.1, the embodiment of the present application provides a kind of data early warning method of knowledge based map, comprising the following steps:

First data, drop in S1, the first data that mandatory member is obtained using preset data acquisition technology It makes an uproar processing, and generates the first data function that first data change over time according to the first data after noise reduction process；

S2, according to formula:

S3, obtain first time length when the function H (t) is not equal to m on a timeline and when equal to m second when Between length, and according to formula: normal data time accounting=first time length/(the first time length+described Two time spans), calculate the normal data time accounting；

S4, judge whether the normal data time accounting is greater than default accounting threshold value；

If S5, the normal data time accounting are greater than default accounting threshold value, transferred from preset knowledge mapping library Knowledge mapping including the mandatory member, and obtain from the knowledge mapping including the mandatory member and specified with described Member has the association member of direct connection relational；

S6, the second data for obtaining the association member, and judge algorithm according to preset data exception, judge described the Whether two data are abnormal；

If S7, second data exception, generate warning information, and enclose described be associated in the warning information The second data of member.

As described in above-mentioned steps S1, the first data of mandatory member are obtained using preset data acquisition technology, to described First data carry out noise reduction process, and generate that first data change over time according to the first data after noise reduction process the One data function.Wherein first data can be by internet, mobile Internet, and Internet of Things obtains, can to include picture, Data including video, text information are handled to obtain, can be (a kind of distributed, fault-tolerant using the Storm of open source Real time computation system) data processing is carried out, the Scrapy frame of Python can also be used, is crawled in default website, To obtain the first data of mandatory member.Wherein the first data can be any form of data, for example, data on flows, finance Data etc..And noise reduction process is carried out, to guarantee that data are more acurrate.And described the is generated according to the first data after noise reduction process The first data function that one data change over time, it is whether abnormal to the first data of subsequent analysis.

As described in above-mentioned steps S2, according to formula:

H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) obtains function H (t), wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, and E (t) is institute The difference functions for the function that the first data function and the normal data change over time are stated,For the difference functions pair The differentiation function of time, min refer to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value.To according to public affairs Formula obtains function H (t), to characterize the laminating degree for the function that the first data function and normal data change over time.If the The laminating degree of one data function and the function that normal data changes over time is small, shows that first data are normal, conversely, institute State the first data exception.

As described in above-mentioned steps S3, obtain the function H (t) on a timeline not equal to m when first time length and The second time span when equal to m, and according to formula: normal data time accounting=first time length/(described first Time span+second time span), calculate the normal data time accounting.Wherein, when function H (t) value is m When, it indicates that the numerical value of the first data is excessive, is in abnormality；When function H (t) value is not m, the first data are being indicated just Often, it is in normal condition, calculates normal data time accounting accordingly.So as to judge institute by normal data time accounting State whether the first data are in abnormality.

As described in above-mentioned steps S4, judge whether the normal data time accounting is greater than default accounting threshold value.If described Normal data time accounting is greater than default accounting threshold value, shows that first data are generally normal, therefore, it is determined that described the One data are normal；If the normal data time accounting is not more than default accounting threshold value, show first data generally Abnormal, therefore, it is determined that first data exception.

As described in above-mentioned steps S5, if the normal data time accounting is greater than default accounting threshold value, know from preset Know in spectrum library and transfer the knowledge mapping including the mandatory member, and from the knowledge mapping including the mandatory member It obtains and is associated with member with what the mandatory member had a direct connection relational.If the normal data time accounting is greater than default accounting Threshold value shows that first data are normal.But in order to more accurately analyze data, obtain accurate early warning conclusion, the application Also the data of association member are analyzed.Wherein, multiple knowledge mappings are prestored in preset knowledge mapping library.It is described to know Know a series of a variety of different figures that map is explicit knowledge's development process and structural relation, describes knowledge with visualization technique Resource and its carrier, excavation, analysis, building, drafting and explicit knowledge and connecting each other between them, by multiple knowledge nodes Correlation between (or knowledge agent, main body) and knowledge node is constituted.Accordingly, from described including the mandatory member Knowledge mapping in obtain and be associated with member with what the mandatory member had a direct connection relational.Wherein it is associated with member and is designated as Member, knowledge mapping are related, for example, when mandatory member is a server in server cluster, association member be, for example, with The database server etc. that the server is established direct links；When mandatory member is nature human agent, the association member The for example, lineal relative of nature human agent.

As described in above-mentioned steps S6, the second data of the association member are obtained, and are judged according to preset data exception Algorithm judges whether second data are abnormal.Wherein the second data of the person of being associated to can be obtained by any way, Such as obtained from network by data acquisition technology, it can also directly be transferred from database.Preset data exception judgement Algorithm can be identical as the aforementioned method for judging whether the first data are abnormal, or other judgment methods, such as: from institute It states and extracts greatest measure and minimum value in the second data；Judge whether the time point that the greatest measure occurs is default first Within time range, and judge the time point of the minimum value appearance whether within the second preset time range；If institute The time point of greatest measure appearance is stated within the first preset time range, and the time point that the minimum value occurs is the Within two preset time ranges, then determine whether second data are normal.To judge whether second data are abnormal.

As described in above-mentioned steps S7, if second data exception, warning information is generated, and in the warning information Enclose the second data of the association member.If second data exception, although the first data are in normal condition, by Mandatory member may be influenced in the second data of association member.Therefore warning information is still generated, and in the warning information Enclose the second data of the association member.

In one embodiment, first data that mandatory member is obtained using preset data acquisition technology are right First data carry out the step S1 of noise reduction process, include:

S101, the Scrapy frame using Python crawl the first data of mandatory member in default website；

S102, the numerical value of first data is formed into specified numerical value group, and uses preset formula:Calculate the population variance of m-th of numerical value in the specified numerical value groupWherein N is described specified The sum of numerical value in numerical value group, Am are m-th of numerical value of the specified numerical value group, and B is the average value of the specified numerical value group；

S103, judge the population varianceWhether preset variance threshold values are respectively less than；

If S104, the population variancePreset variance threshold values are not respectively less than, then by the population varianceIt is not small As noise and processing is removed in corresponding first data of preset variance threshold values.

Noise reduction process is carried out using preset noise reduction algorithm as described above, realizing, to obtain specified data.Wherein adopt Include with the first data that preset data acquisition technology obtains mandatory member, using the Scrapy frame of Python pre- If carrying out crawling information in website, wherein the Scrapy frame of the Python specifically includes that engine, scheduler, downloading Device, crawler, project pipeline, downloader middleware, crawler middleware, scheduling middleware etc..Specifically crawl process include: engine from A link is taken out in scheduler is used for next crawl；Link is packaged into a request and is transmitted to downloader by engine；Downloading Device gets off resource downloading；Crawler parses entity, gives entity pipeline and is further processed.Due in the numerical value that crawls There may be inexact data, the application uses preset formula:Calculate the specified numerical value group The population variance of middle than the m-th dataJudge the population varianceWhether preset variance threshold values are respectively less than；If described total Body variancePreset variance threshold values are not respectively less than, then by the population varianceNot less than the first of preset variance threshold values Data are as noise and are removed processing.To avoid the problem that noise data bring data processing misalignment.

In one embodiment, described according to formula:

H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) obtains function H (t), wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, and E (t) is institute The difference functions for the function that the first data function and the normal data change over time are stated,For the difference functions pair The differentiation function of time, min refer to minimum value function, and t is the time, m be the preset error parameter value for being greater than 0 step S2 it Before, comprising:

S11, the inverse function F for obtaining first data function^-1(y), wherein F (t) is the first data function, and y is described First data；

S12, according to formula:Time numerical value L is calculated, and whether judges the time numerical value L Greater than preset time threshold, wherein p is preset parameter value, and p is greater than 0；

If S13, the time numerical value L are greater than preset time threshold, generating function H (t) acquisition instruction.

As described above, realizing generating function H (t) acquisition instruction.Consumption is calculated in order to reduce, the application also uses in advance The mode of processing judges whether first data are normal in advance, and in the situation for judging that first data may be abnormal Under, generating function H (t) acquisition instruction.Specifically, the inverse function F of first data function is obtained^-1(y), wherein F (t) is the One data function, y are first data；According to formula:Time numerical value L is calculated, and judges institute State whether time numerical value L is greater than preset time threshold, wherein p is preset parameter value, and p is greater than 0；If the time numerical value L Greater than preset time threshold, then it represents that first data may be abnormal, accordingly generates function H (t) acquisition instruction.

In one embodiment, described according to formula:Time numerical value L is calculated, and is judged Whether the time numerical value L is greater than preset time threshold, and wherein p is preset parameter value, and p is greater than before 0 step S12, Include:

S111, historical data identical with the type of first data is obtained from preset database, wherein described Describe risk data threshold value in historical data, the risk data threshold value refer to by the historical data be divided into normal data with The line of demarcation of abnormal data；

S112, the risk data threshold value is set by the numerical value of the parameter value p.

The risk data threshold value is set by the numerical value of the parameter value p as described above, realizing.The wherein parameter Value p is used to measure first data with the presence or absence of abnormal suspicion.Due to history identical with the type of first data Data have obtained accurate conclusion, the specific value including dangerous feelings data threshold in the historical data, therefore the application Also using in the way of historical data, both data being made to be fully used again, more by setting the numerical value of the parameter value p It is set to the mode of the risk data threshold value, the setting of the parameter value p is made more to have foundation, it is more acurrate.

In one embodiment, if the normal data time accounting is greater than default accounting threshold value, from default Knowledge mapping library in transfer the knowledge mapping including the mandatory member, and from the knowledge graph including the mandatory member It is obtained in spectrum before having the step S5 for being associated with member of direct connection relational with the mandatory member, comprising:

S41, initial solid is identified from the specify information collected in advance using preset knowledge mapping the build tool, Described in specify information at least describe the mandatory member, the initial solid includes at least the mandatory member；

S42, duplicate removal processing is carried out to the initial solid, to obtain final entity；

S43, from the relationship extracted in the specify information between final entity, to form triple, and according to institute It states triple and generates the knowledge mapping including the mandatory member.

As described above, realizing the building knowledge mapping including the mandatory member.Wherein preset knowledge mapping The build tool can be any means, appoint for example existing SPSS, Sci2 Tools, Ucinet NetDraw, Pajek, VOSviewer etc. is repeated no more since above-mentioned tool is existing knowledge mapping the build tool.The wherein entity It is the knowledge node in knowledge mapping, initial solid refers to the knowledge node without duplicate removal processing.Identify initial solid Process is for example are as follows: word segmentation processing is carried out to specify information, so that the word sequence being made of multiple words is obtained, the word sequence is defeated Enter preset sentence structure model, to obtain initial solid in the word sequence.Duplicate removal is carried out to the initial solid again Processing, to obtain final entity.The process of duplicate removal processing is for example are as follows: carries out synonym judgement to all initial solids, will belong to A vocabulary in the synonymous phrase is replaced in the initial solid of same synonymous phrase.It is extracted from the specify information again Relationship between final entity out, to form triple, and generating described according to the triple includes the mandatory member Knowledge mapping.Wherein triple for example refers to the relationship between two entities.Wherein, described to be extracted from the specify information The method of relationship between final entity is for example: the specify information being inserted in preset sentence structure, to pass through institute's predicate Sentence structure comes out the word retrieval of the relationship between stating multiple entities.

In one embodiment, second data for obtaining the association member, and according to preset data exception Judge algorithm, judge second data whether Yi Chang step S6, comprising:

S601, the second data for obtaining the association member, and greatest measure and minimum are extracted from second data Numerical value；

S602, judge time point that the greatest measure occurs whether within the first preset time range, and judgement Whether the time point that the minimum value occurs is within the second preset time range；

If the time point that S603, the greatest measure occur is within the first preset time range, and the minimum number It is worth the time point occurred within the second preset time range, then determines that second data are normal.

Algorithm is judged according to preset data exception as described above, realizing, judges whether second data are abnormal.This Application judges that the time point of the greatest measure appearance is using greatest measure and minimum value is extracted from second data It is no within the first preset time range, and judge time point that the minimum value occurs whether in the second preset time model Mode within enclosing judges whether second data are abnormal.Wherein, due to the second data (such as flow quantity) be with when Between fluctuating change, it is general to have periodically, therefore should to respectively appear in first default for the maxima and minima of the second data Within time range and within the second preset time range.Therefore, if the time point that the greatest measure occurs presets first Within time range, and the time point that the minimum value occurs within the second preset time range, then determine described the Two data are normal.If the time point that the greatest measure occurs is not within the first preset time range or the minimum number It is worth the time point occurred not within the second preset time range, then determines second data exception.Further, it is not examining Consider computing resource expend in the case where, it is described judge second data whether Yi Chang method can also with judge described first Whether abnormal data method be identical.

In one embodiment, if second data exception, warning information is generated, and believe in the early warning Enclosed in breath it is described association member the second data step S7, include:

If S701, second data exception, according to the knowledge section of the knowledge mapping including the mandatory member The relationship that influences each other is put, obtains second data to the effect tendency of the mandatory member；

S702, warning information is generated, and encloses in the warning information the second data of the association member and described Effect tendency of second data to the mandatory member.

As described above, realizing the second data for enclosing the association member in the warning information and second number According to the effect tendency to the mandatory member.Since knowledge mapping above-mentioned not only includes mandatory member and be associated with member, also It include mandatory member and the relationship that influences each other for being associated with member.Accordingly, warning information is generated, and attached in the warning information Effect tendency of the second data and second data of the upper association member to the mandatory member.Further, in institute The influence formula that record has the person of being associated to the mandatory member in knowledge mapping is stated to obtain then according to the influence formula Influence numerical value of the second data of the association member to the mandatory member is taken, and encloses the shadow in the warning information Ring numerical value.

The data early warning method of the knowledge based map of the application generates the first number that first data change over time According to function；According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained Function H (t)；Obtain the function H (t) on a timeline not equal to m when first time length and the second time when equal to m Length, and calculate the normal data time accounting；Judge whether the normal data time accounting is greater than default accounting threshold Value；If the normal data time accounting is greater than default accounting threshold value, from the knowledge mapping including the mandatory member Middle acquisition is associated with member with what the mandatory member had a direct connection relational；Obtain the second data of the association member, and root Algorithm is judged according to preset data exception, judges whether second data are abnormal；If second data exception, generate pre- Alert information, and second data for being associated with member are enclosed in the warning information.The accurate of early warning is improved to realize Property.

Referring to Fig. 2, the embodiment of the present application provides a kind of data early warning device of knowledge based map, comprising:

First data function generation unit 10, for obtaining the first number of mandatory member using preset data acquisition technology According to first data progress noise reduction process, and at any time according to the first data generation first data after noise reduction process Between the first data function for changing；

Function H (t) generation unit 20, for according to formula:

Normal data time accounting acquiring unit 30, for obtain the function H (t) on a timeline not equal to m when First time length and the second time span when equal to m, and according to formula: the normal data time accounting=first time Length/(the first time length+second time span), calculates the normal data time accounting；

Default accounting threshold decision unit 40, for judging whether the normal data time accounting is greater than default accounting threshold Value；

Knowledge mapping transfers unit 50, if being greater than default accounting threshold value for the normal data time accounting, from pre- If knowledge mapping library in transfer the knowledge mapping including the mandatory member, and from the knowledge including the mandatory member It is obtained in map and is associated with member with what the mandatory member had a direct connection relational；

Second data determining unit 60, for obtaining the second data of the association member, and it is different according to preset data Often judge algorithm, judges whether second data are abnormal；

Warning information generation unit 70 generates warning information, and in the early warning if being used for second data exception The second data of the association member are enclosed in information.

As described in said units 10, the first data of mandatory member are obtained using preset data acquisition technology, to described First data carry out noise reduction process, and generate that first data change over time according to the first data after noise reduction process the One data function.Wherein first data can be by internet, mobile Internet, and Internet of Things obtains, can to include picture, Data including video, text information are handled to obtain, can be (a kind of distributed, fault-tolerant using the Storm of open source Real time computation system) data processing is carried out, the Scrapy frame of Python can also be used, is crawled in default website, To obtain the first data of mandatory member.Wherein the first data can be any form of data, for example, data on flows, finance Data etc..And noise reduction process is carried out, to guarantee that data are more acurrate.And described the is generated according to the first data after noise reduction process The first data function that one data change over time, it is whether abnormal to the first data of subsequent analysis.

As described in said units 20, according to formula:

As described in said units 30, obtain the function H (t) on a timeline not equal to m when first time length and The second time span when equal to m, and according to formula: normal data time accounting=first time length/(described first Time span+second time span), calculate the normal data time accounting.Wherein, when function H (t) value is m When, it indicates that the numerical value of the first data is excessive, is in abnormality；When function H (t) value is not m, the first data are being indicated just Often, it is in normal condition, calculates normal data time accounting accordingly.So as to judge institute by normal data time accounting State whether the first data are in abnormality.

As described in said units 40, judge whether the normal data time accounting is greater than default accounting threshold value.If described Normal data time accounting is greater than default accounting threshold value, shows that first data are generally normal, therefore, it is determined that described the One data are normal；If the normal data time accounting is not more than default accounting threshold value, show first data generally Abnormal, therefore, it is determined that first data exception.

As described in said units 50, if the normal data time accounting is greater than default accounting threshold value, know from preset Know in spectrum library and transfer the knowledge mapping including the mandatory member, and from the knowledge mapping including the mandatory member It obtains and is associated with member with what the mandatory member had a direct connection relational.If the normal data time accounting is greater than default accounting Threshold value shows that first data are normal.But in order to more accurately analyze data, obtain accurate early warning conclusion, the application Also the data of association member are analyzed.Wherein, multiple knowledge mappings are prestored in preset knowledge mapping library.It is described to know Know a series of a variety of different figures that map is explicit knowledge's development process and structural relation, describes knowledge with visualization technique Resource and its carrier, excavation, analysis, building, drafting and explicit knowledge and connecting each other between them, by multiple knowledge nodes Correlation between (or knowledge agent, main body) and knowledge node is constituted.Accordingly, from described including the mandatory member Knowledge mapping in obtain and be associated with member with what the mandatory member had a direct connection relational.Wherein it is associated with member and is designated as Member, knowledge mapping are related, for example, when mandatory member is a server in server cluster, association member be, for example, with The database server etc. that the server is established direct links；When mandatory member is nature human agent, the association member The for example, lineal relative of nature human agent.

As described in said units 60, the second data of the association member are obtained, and are judged according to preset data exception Algorithm judges whether second data are abnormal.Wherein the second data of the person of being associated to can be obtained by any way, Such as obtained from network by data acquisition technology, it can also directly be transferred from database.Preset data exception judgement Algorithm can be identical as the aforementioned method for judging whether the first data are abnormal, or other judgment methods, such as: from institute It states and extracts greatest measure and minimum value in the second data；Judge whether the time point that the greatest measure occurs is default first Within time range, and judge the time point of the minimum value appearance whether within the second preset time range；If institute The time point of greatest measure appearance is stated within the first preset time range, and the time point that the minimum value occurs is the Within two preset time ranges, then determine whether second data are normal.To judge whether second data are abnormal.

As described in said units 70, if second data exception, warning information is generated, and in the warning information Enclose the second data of the association member.If second data exception, although the first data are in normal condition, by Mandatory member may be influenced in the second data of association member.Therefore warning information is still generated, and in the warning information Enclose the second data of the association member.

In one embodiment, the first data function generation unit, comprising:

First data crawl subelement, for the Scrapy frame using Python, crawl finger in default website Determine the first data of member；

Variance computation subunit for the numerical value of first data to be formed specified numerical value group, and uses preset public affairs Formula:Calculate the population variance of m-th of numerical value in the specified numerical value groupWherein N is the finger The sum of numerical value in fixed number value group, Am are m-th of numerical value of the specified numerical value group, and B is being averaged for the specified numerical value group Value；

Variance threshold values judgment sub-unit, for judging the population varianceWhether preset variance threshold values are respectively less than；

Subelement is denoised, if being used for the population variancePreset variance threshold values are not respectively less than, then by the totality side DifferenceThe first data corresponding not less than preset variance threshold values are as noise and are removed processing.

In one embodiment, described device, comprising:

Inverse function acquiring unit, for obtaining the inverse function F of first data function^-1(y), wherein F (t) is the first number According to function, y is first data；

Time numerical value L computing unit, for according to formula:Time numerical value L is calculated, and is judged Whether the time numerical value L is greater than preset time threshold, and wherein p is preset parameter value, and p is greater than 0；

Generating function H (t) acquisition instruction unit generates if being greater than preset time threshold for the time numerical value L Function H (t) acquisition instruction.

In one embodiment, described device, comprising:

Historical data acquiring unit, for obtaining go through identical with the type of first data from preset database History data, wherein describing risk data threshold value in the historical data, the risk data threshold value refers to the historical data It is divided into the line of demarcation of normal data and abnormal data；

Parameter value setting unit, for setting the risk data threshold value for the numerical value of the parameter value p.

In one embodiment, described device, comprising:

Initial solid recognition unit, for using preset knowledge mapping the build tool from the specify information collected in advance Identify initial solid, wherein the specify information at least describes the mandatory member, the initial solid includes at least institute State mandatory member；

Final solid element is obtained, for carrying out duplicate removal processing to the initial solid, to obtain final entity；

Knowledge mapping generation unit, for from the relationship extracted in the specify information between final entity, thus shape The knowledge mapping including the mandatory member is generated at triple, and according to the triple.

In one embodiment, second data determining unit 60, comprising:

Numerical value extracts subelement, for obtaining the second data of the association member, and extracts from second data Greatest measure and minimum value；

Numerical value judgment sub-unit, for judging the time point of the greatest measure appearance whether in the first preset time range Within, and judge the time point of the minimum value appearance whether within the second preset time range；

The normal subelement of the second data is determined, if the time point for greatest measure appearance is in the first preset time model Within enclosing, and the minimum value occur time point within the second preset time range, then determine second data Normally.

In one embodiment, the warning information generation unit 70, comprising:

Effect tendency obtains subelement, if being used for second data exception, according to described including the mandatory member The knowledge node of knowledge mapping influence each other relationship, obtain second data to the effect tendency of the mandatory member；

Warning information subelement is generated, for generating warning information, and encloses described be associated in the warning information Effect tendency of the second data and second data of member to the mandatory member.

The data early warning device of the knowledge based map of the application generates the first number that first data change over time According to function；According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained Function H (t)；Obtain the function H (t) on a timeline not equal to m when first time length and the second time when equal to m Length, and calculate the normal data time accounting；Judge whether the normal data time accounting is greater than default accounting threshold Value；If the normal data time accounting is greater than default accounting threshold value, from the knowledge mapping including the mandatory member Middle acquisition is associated with member with what the mandatory member had a direct connection relational；Obtain the second data of the association member, and root Algorithm is judged according to preset data exception, judges whether second data are abnormal；If second data exception, generate pre- Alert information, and second data for being associated with member are enclosed in the warning information.The accurate of early warning is improved to realize Property.

Referring to Fig. 3, a kind of computer equipment is also provided in the embodiment of the present invention, which can be server, Its internal structure can be as shown in the figure.The computer equipment includes that the processor, memory, network connected by system bus connects Mouth and database.Wherein, the processor of the Computer Design is for providing calculating and control ability.The storage of the computer equipment Device includes non-volatile memory medium, built-in storage.The non-volatile memory medium be stored with operating system, computer program and Database.The internal memory provides environment for the operation of operating system and computer program in non-volatile memory medium.The meter The database of machine equipment is calculated for storing data used in the data early warning method of knowledge based map.The network of the computer equipment Interface is used to communicate with external terminal by network connection.To realize that one kind is based on when the computer program is executed by processor The data early warning method of knowledge mapping.

Above-mentioned processor executes the data early warning method of above-mentioned knowledge based map, comprising the following steps: using preset Data acquisition technology obtains the first data of mandatory member, carries out noise reduction process to first data, and according to noise reduction process The first data afterwards generate the first data function that first data change over time；According to formula: H (t)=min (G (t), M), whereinE (t)=F (t)-f (t) is obtained function H (t), and wherein F (t) is first data Function, f (t) are the function that preset normal data changes over time, and E (t) is first data function and the criterion numeral According to the difference functions of the function changed over time,For the difference functions time differential function, min refers to minimum value Function, t are the time, m be it is preset be greater than 0 error parameter value；Obtain the function H (t) on a timeline not equal to m when First time length and the second time span when equal to m, and according to formula: the normal data time accounting=first time Length/(the first time length+second time span), calculates the normal data time accounting；Described in judgement Whether normal data time accounting is greater than default accounting threshold value；If the normal data time accounting is greater than default accounting threshold value, The knowledge mapping including the mandatory member is then transferred from preset knowledge mapping library, and from described including the mandatory member Knowledge mapping in obtain and be associated with member with what the mandatory member had a direct connection relational；Obtain the second of the association member Data, and algorithm is judged according to preset data exception, judge whether second data are abnormal；If second data are different Often, then warning information is generated, and encloses the second data of the association member in the warning information.

In one embodiment, first data that mandatory member is obtained using preset data acquisition technology are right First data carry out the step of noise reduction process, comprising: using the Scrapy frame of Python, climb in default website Take the first data of mandatory member；The numerical value of first data is formed into specified numerical value group, and uses preset formula:Calculate the population variance of m-th of numerical value in the specified numerical value groupWherein N is described specified The sum of numerical value in numerical value group, Am are m-th of numerical value of the specified numerical value group, and B is the average value of the specified numerical value group； Judge the population varianceWhether preset variance threshold values are respectively less than；If the population varianceIt is not respectively less than preset side Poor threshold value, then by the population varianceThe first data corresponding not less than preset variance threshold values are as noise and gone Except processing.

In one embodiment, described according to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained function H (t), and wherein F (t) is first data function, f (t) function changed over time for preset normal data, E (t) be first data function and the normal data at any time Between the difference functions of function that change,For the difference functions time differential function, min refers to minimum value function, t For the time, m is before preset the step of being greater than 0 error parameter value, comprising: obtains the inverse function of first data function F^-1(y), wherein F (t) is the first data function, and y is first data；According to formula:It calculates Time numerical value L, and judge whether the time numerical value L is greater than preset time threshold, wherein p is preset parameter value, and p is greater than 0；If the time numerical value L is greater than preset time threshold, generating function H (t) acquisition instruction.

In one embodiment, described according to formula:Time numerical value L is calculated, and is judged Before the step of whether the time numerical value L is greater than preset time threshold, and wherein p is preset parameter value, and p is greater than 0, packet It includes: historical data identical with the type of first data is obtained from preset database, wherein in the historical data Describe risk data threshold value, the risk data threshold value, which refers to, is divided into normal data and abnormal data for the historical data Line of demarcation；The risk data threshold value is set by the numerical value of the parameter value p.

In one embodiment, if the normal data time accounting is greater than default accounting threshold value, from default Knowledge mapping library in transfer the knowledge mapping including the mandatory member, and from the knowledge graph including the mandatory member In spectrum obtain with the mandatory member have direct connection relational the step of being associated with member before, comprising: use preset knowledge Map construction tool identifies initial solid from the specify information collected in advance, wherein the specify information at least describes institute Mandatory member is stated, the initial solid includes at least the mandatory member；Duplicate removal processing is carried out to the initial solid, to obtain Take final entity；From the relationship extracted in the specify information between final entity, to form triple, and according to described Triple generates the knowledge mapping including the mandatory member.

In one embodiment, second data for obtaining the association member, and according to preset data exception Judge algorithm, judge second data whether Yi Chang step, comprising: obtain it is described association member the second data, and from Greatest measure and minimum value are extracted in second data；Judge whether the time point that the greatest measure occurs is pre- first If within time range, and judging the time point of the minimum value appearance whether within the second preset time range；If The time point that the greatest measure occurs is within the first preset time range, and the time point that the minimum value occurs exists Within second preset time range, then determine that second data are normal.

In one embodiment, if second data exception, warning information is generated, and believe in the early warning The step of the second data of the association member are enclosed in breath, comprising: if second data exception, according to described including institute The knowledge node for stating the knowledge mapping of mandatory member influences each other relationship, obtains second data to the shadow of the mandatory member The trend of sound；Warning information is generated, and encloses second data for being associated with member and second number in the warning information According to the effect tendency to the mandatory member.

It will be understood by those skilled in the art that structure shown in figure, only part relevant to application scheme is tied The block diagram of structure does not constitute the restriction for the computer equipment being applied thereon to application scheme.

The computer equipment of the application generates the first data function that first data change over time；According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) is obtained function H (t)；Obtain institute State function H (t) on a timeline not equal to m when first time length and the second time span when equal to m, and calculate institute State normal data time accounting；Judge whether the normal data time accounting is greater than default accounting threshold value；If the normal number It is greater than default accounting threshold value according to time accounting, then obtains from the knowledge mapping including the mandatory member and specified with described Member has the association member of direct connection relational；The second data of the association member are obtained, and according to preset data exception Judge algorithm, judges whether second data are abnormal；If second data exception, generates warning information, and described The second data of the association member are enclosed in warning information.To realize the accuracy for improving early warning.

One embodiment of the application also provides a kind of computer readable storage medium, is stored thereon with computer program, calculates The data early warning method of knowledge based map is realized when machine program is executed by processor, comprising the following steps: use preset number According to acquisition technique obtain mandatory member the first data, to first data carry out noise reduction process, and according to noise reduction process after The first data generate the first data function that first data change over time；

According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t), is obtained Function H (t) is taken, wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, E (t) difference functions of the function changed over time for first data function and the normal data,For the difference The differentiation function of function against time, min refer to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value；It obtains First time length when the function H (t) is not equal to m on a timeline and the second time span when equal to m, and according to public affairs Formula: normal data time accounting=first time length/(the first time length+second time span), meter Calculate the normal data time accounting；Judge whether the normal data time accounting is greater than default accounting threshold value；If described Normal data time accounting is greater than default accounting threshold value, then transfers from preset knowledge mapping library including the mandatory member's Knowledge mapping, and acquisition and the mandatory member have direct connection relational from the knowledge mapping including the mandatory member Association member；The second data for obtaining the association member, and judge algorithm according to preset data exception, judge described the Whether two data are abnormal；If second data exception generates warning information, and encloses the pass in the warning information The second data for the person of being unified into.

The computer readable storage medium of the application generates the first data function that first data change over time； According to formula: H (t)=min (G (t), m), whereinE (t)=F (t)-f (t) obtains function H (t)；Obtain the function H (t) on a timeline not equal to m when first time length and the second time span when equal to m, And calculate the normal data time accounting；Judge whether the normal data time accounting is greater than default accounting threshold value；If The normal data time accounting is greater than default accounting threshold value, then obtains from the knowledge mapping including the mandatory member Member is associated with what the mandatory member had a direct connection relational；The second data of the association member are obtained, and according to default Data exception judge algorithm, judge whether second data abnormal；If second data exception, early warning letter is generated Breath, and second data for being associated with member are enclosed in the warning information.To realize the accuracy for improving early warning.

Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer In read/write memory medium, the computer program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, Any reference used in provided herein and embodiment to memory, storage, database or other media, Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms, Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double speed are according to rate SDRAM (SSRSDRAM), enhancing Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..

It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row His property includes, so that the process, device, article or the method that include a series of elements not only include those elements, and And further include other elements that are not explicitly listed, or further include for this process, device, article or method institute it is intrinsic Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including being somebody's turn to do There is also other identical elements in the process, device of element, article or method.

The foregoing is merely preferred embodiment of the present application, are not intended to limit the scope of the patents of the application, all utilizations Equivalent structure or equivalent flow shift made by present specification and accompanying drawing content is applied directly or indirectly in other correlations Technical field, similarly include in the scope of patent protection of the application.

Claims

1. a kind of data early warning method of knowledge based map characterized by comprising

The first data that mandatory member is obtained using preset data acquisition technology carry out noise reduction process to first data, And the first data function that first data change over time is generated according to the first data after noise reduction process；

According to formula: H (t)=min (G (t), m), whereinIt obtains Function H (t), wherein F (t) is first data function, and f (t) is the function that preset normal data changes over time, E (t) For the difference functions for the function that first data function and the normal data change over time,For the difference letter Number time differential functions, min refer to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value；

Obtain the function H (t) on a timeline not equal to m when first time length and the second time span when equal to m, And according to formula: normal data time accounting=first time length/(the first time length+second time Length), calculate the normal data time accounting；

If the normal data time accounting is greater than default accounting threshold value, transfer from preset knowledge mapping library including described The knowledge mapping of mandatory member, and acquisition has directly with the mandatory member from the knowledge mapping including the mandatory member Meet the association member of connection relationship；

The second data of the association member are obtained, and algorithm is judged according to preset data exception, judge second data It is whether abnormal；

If second data exception generates warning information, and encloses in the warning information the of the association member Two data.

2. the data early warning method of knowledge based map according to claim 1, which is characterized in that described using preset The step of data acquisition technology obtains the first data of mandatory member, carries out noise reduction process to first data, comprising:

The numerical value of first data is formed into specified numerical value group, and uses preset formula:It calculates The population variance of m-th of numerical value in the specified numerical value groupWherein N is the sum of the numerical value in the specified numerical value group, Am For m-th of numerical value of the specified numerical value group, B is the average value of the specified numerical value group；

If the population variancePreset variance threshold values are not respectively less than, then by the population varianceNot less than preset side Corresponding first data of poor threshold value are as noise and are removed processing.

3. the data early warning method of knowledge based map according to claim 1, which is characterized in that described according to formula:

H (t)=min (G (t), m), whereinIt obtains function H (t), Wherein F (t) is first data function, and f (t) is the function that changes over time of preset normal data, and E (t) is described the The difference functions for the function that one data function and the normal data change over time,It is the difference functions to the time Differentiation function, min refers to minimum value function, and t is the time, before m is preset the step of being greater than 0 error parameter value, comprising:

Obtain the inverse function F of first data function^-1(y), wherein F (t) is the first data function, and y is first data；

According to formula:Time numerical value L is calculated, and it is default to judge whether the time numerical value L is greater than Time threshold, wherein p be preset parameter value, p be greater than 0；

4. the data early warning method of knowledge based map according to claim 3, which is characterized in that described according to formula:Time numerical value L is calculated, and judges whether the time numerical value L is greater than preset time threshold, Before the step of middle p is preset parameter value, and p is greater than 0, comprising:

Historical data identical with the type of first data is obtained from preset database, wherein in the historical data Describe risk data threshold value, the risk data threshold value, which refers to, is divided into normal data and abnormal data for the historical data Line of demarcation；

5. the data early warning method of knowledge based map according to claim 1, which is characterized in that if described normal Data time accounting is greater than default accounting threshold value, then transfers the knowledge including the mandatory member from preset knowledge mapping library Map, and the pass for having direct connection relational with the mandatory member is obtained from the knowledge mapping including the mandatory member Before the step of person of being unified into, comprising:

Initial solid is identified from the specify information collected in advance using preset knowledge mapping the build tool, wherein the finger Determine information and at least describe the mandatory member, the initial solid includes at least the mandatory member；

From the relationship extracted in the specify information between final entity, to form triple, and according to the triple Generate the knowledge mapping including the mandatory member.

6. the data early warning method of knowledge based map according to claim 1, which is characterized in that described to obtain the pass The second data for the person of being unified into, and algorithm is judged according to preset data exception, judge second data whether Yi Chang step, Include:

Judge that time point that the greatest measure occurs whether within the first preset time range, and judges the minimum number It is worth the time point occurred whether within the second preset time range；

If the time point that the greatest measure occurs within the first preset time range, and the minimum value occur when Between o'clock within the second preset time range, then determine that second data are normal.

7. the data early warning method of knowledge based map according to claim 1, which is characterized in that if described second Data exception then generates warning information, and the step of enclosing in the warning information the second data of the association member, packet It includes:

If second data exception, influenced each other according to the knowledge node of the knowledge mapping including the mandatory member Relationship obtains second data to the effect tendency of the mandatory member；

Warning information is generated, and encloses the second data and second data pair of the association member in the warning information The effect tendency of the mandatory member.

8. a kind of data early warning device of knowledge based map characterized by comprising

First data function generation unit is right for obtaining the first data of mandatory member using preset data acquisition technology First data carry out noise reduction process, and generate first data according to the first data after noise reduction process and change over time The first data function；

Function H (t) generation unit, for according to formula:

H (t)=min (G (t), m), whereinIt obtains function H (t), Wherein F (t) is first data function, and f (t) is the function that changes over time of preset normal data, and E (t) is described the The difference functions for the function that one data function and the normal data change over time,It is the difference functions to the time Differentiation function, min refers to minimum value function, and t is the time, m be it is preset be greater than 0 error parameter value；

Normal data time accounting acquiring unit, for obtain the function H (t) on a timeline not equal to m when first when Between length and the second time span when equal to m, and according to formula: normal data time accounting=first time length/ (the first time length+second time span), calculates the normal data time accounting；

Knowledge mapping transfers unit, if being greater than default accounting threshold value for the normal data time accounting, knows from preset Know in spectrum library and transfer the knowledge mapping including the mandatory member, and from the knowledge mapping including the mandatory member It obtains and is associated with member with what the mandatory member had a direct connection relational；

Second data determining unit for obtaining the second data of the association member, and judges according to preset data exception Algorithm judges whether second data are abnormal；

Warning information generation unit generates warning information, and in the warning information if being used for second data exception Enclose the second data of the association member.

9. a kind of computer equipment, including memory and processor, the memory are stored with computer program, feature exists In the step of processor realizes any one of claims 1 to 7 the method when executing the computer program.

10. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the computer program The step of method described in any one of claims 1 to 7 is realized when being executed by processor.