CN110619406A

CN110619406A - Method and device for determining business abnormity

Info

Publication number: CN110619406A
Application number: CN201810631324.3A
Authority: CN
Inventors: 张晶晶; 王超; 方有轩; 朱青
Original assignee: Medium Shift Information Technology Co Ltd; China Mobile Communications Group Co Ltd
Current assignee: Medium Shift Information Technology Co Ltd; China Mobile Communications Group Co Ltd
Priority date: 2018-06-19
Filing date: 2018-06-19
Publication date: 2019-12-27

Abstract

The application provides a method and a device for determining business abnormity, which are used for improving the accuracy of judging the business abnormity. The method comprises the following steps: determining a model matched with first service statistical data in at least one model according to the attribute of the first service statistical data, wherein the first service statistical data is data obtained by counting data belonging to a first service, each model in the at least one model corresponds to data with one attribute, and each model in the at least one model is obtained according to data obtained by counting historical service data with the attribute of each model; obtaining a prediction result of the first business statistical data according to the matched model; and if the prediction result meets a preset condition, determining that the first service is abnormal.

Description

Method and device for determining business abnormity

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method and an apparatus for determining a service exception.

Background

In actual work, it is generally determined whether the corresponding service is normally developed by determining service data. For example, if the china mobile headquarters wants to know the operation conditions of the services of each branch company, the service data of each province needs to be counted to obtain statistical data, and whether the corresponding service is abnormal or not can be determined according to the statistical data. One of the service data is, for example, data included in the complaint service, and the statistical data is, for example, the number of occurrences of the complaint event determined according to the data included in the complaint service.

Currently, to determine whether a service is abnormal, a threshold corresponding to statistical data of the service may be set according to human experience, and if the current statistical data is greater than or equal to the threshold, the service is determined to be abnormal. In this method, the threshold value is usually set by a person based on the maximum value of the previous data obtained for the traffic statistic, but the value of the traffic statistic may be increasing, that is, even if the current value of the statistic exceeds the maximum value of the previous traffic statistic, the current value of the statistic is actually normal. However, when the method is used to determine the current traffic statistical data, since the threshold is fixed, the value of the current statistical data exceeding the maximum value of the previous traffic statistical data is easily determined as an abnormal value, and further the traffic corresponding to the current statistical data is determined as an abnormal value, that is, the method has low accuracy in determining the traffic abnormal value.

Disclosure of Invention

The embodiment of the application provides a method and a device for determining abnormal business, which are used for improving the accuracy of judging whether the business is abnormal or not.

In a first aspect, a method for determining a service exception is provided, including:

determining a model matched with first service statistical data in at least one model according to the attribute of the first service statistical data, wherein the first service statistical data is data obtained by counting data belonging to a first service, each model in the at least one model corresponds to data with one attribute, and each model in the at least one model is obtained according to data obtained by counting historical service data with the attribute of each model;

obtaining a prediction result of the first business statistical data according to the matched model;

and if the prediction result meets a preset condition, determining that the first service is abnormal.

Compared with the method for judging whether the service is abnormal by directly utilizing the threshold value in the prior art, the prediction result in the embodiment of the application is obtained according to the data for counting the historical service data, the change conditions of the historical service data are different, and the obtained prediction result is also different, namely, the change condition of the prediction result in the embodiment of the application is consistent with the change condition of the data for counting the historical service data, so that the prediction result is more reasonable, and the judgment accuracy is improved. Meanwhile, multiple models can be established according to historical service data with different attributes, that is, the method provided by the embodiment of the application can be suitable for determining abnormal conditions of service data with multiple attributes, and the application range is wide.

Optionally, the data obtained by performing statistics on the historical service data with the attribute of each model includes at least one of:

the number of times of occurrence of the second service in each of the set at least two time periods,

a length of time it takes to process the second traffic within each of the at least two time periods respectively,

the second service is directed to setting a respective number of occurrences of the object in each of the at least two time periods, and,

a respective ratio of a number of times that the second service is respectively processed for each of the at least two time periods to a respective number of occurrences for each of the at least two time periods;

wherein the second service is a service having an attribute of each of the models.

The various data obtained by counting the historical service data provided in the embodiment of the application belong to index data commonly used in the service evaluation process, the practicability is high, and the various data obtained by counting the historical service data have various corresponding models, that is, the method provided in the embodiment of the application can be applied to determining abnormal conditions of service data with various attributes, and the application range is wide.

Optionally, obtaining the at least one model comprises:

obtaining a first statistical data set comprising a respective number of occurrences of the second traffic in each of the at least two time periods or a respective length of time it takes to process the second traffic in each of the at least two time periods;

obtaining a first ratio of the number of occurrences in each time period in the first statistical data set to an average of all the number of occurrences in the at least two time periods, or obtaining a second ratio of the duration spent processing the second service in each time period in the first statistical data set to an average of all the spent durations in the at least two time periods;

and obtaining the at least one model according to the obtained first ratio and the first statistic data set, or obtaining the at least one model according to the obtained second ratio and the first statistic data set.

According to the embodiment of the application, the corresponding model is obtained according to the first ratio of the occurrence times in each time period to the average occurrence times of all the occurrence times, or the second ratio of the duration spent respectively processing the second service in each time period to the average duration spent of all the duration spent, the model obtaining method is simple, a new model obtaining method is provided, and the obtained model can be used for predicting the occurrence times in the corresponding time period, or is suitable for predicting the duration spent respectively processing the second service in the corresponding time period.

Optionally, obtaining the at least one model comprises:

obtaining the respective occurrence times of the second service in each time period of the at least two time periods for a set object;

according to the occurrence times of the second service for the set object in each time period of the at least two time periods, obtaining the difference value of the occurrence times of the second service for the set object in each two adjacent time periods of the at least two time periods;

and obtaining the at least one model according to the obtained difference and the reference occurrence number set.

According to the method and the device, the corresponding model is obtained according to the occurrence frequency of the set object in the time period, the occurrence frequency of the set object in the corresponding time period can be predicted according to the model, and the method for obtaining the model is enriched.

Optionally, obtaining the at least one model comprises:

obtaining a corresponding ratio of the number of times that the second service is respectively processed in each of the at least two time periods to the respective number of occurrences in each of the at least two time periods;

obtaining classification information according to all ratios of corresponding ratios of the times of processing the second service in each of the at least two time periods respectively to the respective times of occurrence in each of the at least two time periods, wherein the classification information is used for indicating whether the ratios are normal or abnormal;

and obtaining the at least one model according to the classification information.

According to the embodiment of the application, the corresponding model is obtained according to the corresponding ratio of the times of respectively processing the second service in each time period to the times of respectively generating the second service in each time period in at least two time periods, so that the method for obtaining the model is enriched, and meanwhile, the model can directly judge whether the ratio is abnormal or not, so that the model is simple and convenient to use, and the method for obtaining the model is enriched.

Optionally, the preset condition includes that a difference between the prediction result and the first service statistical data is greater than a preset difference, and/or a dispersion between the prediction result and the first service statistical data is greater than a preset dispersion.

Judging whether the service is abnormal according to the difference value between the prediction result and the first service statistical data, wherein the calculation process is simple, and the calculation amount of a device for determining the service abnormality can be relatively reduced; whether the business is abnormal or not is judged according to the dispersion of the prediction result and the first business statistical data, and the trend of the difference between the prediction result and the first business statistical data can be seen, so that the method is more accurate compared with a mode of directly judging by using the difference; whether the business is abnormal or not is judged according to the difference value and the dispersion of the prediction result and the first business statistical data, namely the prediction result and the first business statistical data are abnormal only if two conditions are simultaneously met, the condition of false alarm of a device for determining the business abnormality can be relatively reduced, and the accuracy of determining the business abnormality can be improved.

In a second aspect, an apparatus for determining a traffic anomaly is provided, including:

the model base maintenance sub-module is used for determining a model matched with first business statistical data in at least one model according to the attribute of the first business statistical data, wherein the first business data is obtained by counting data belonging to a first business, each model in the at least one model corresponds to data with one attribute, each model in the at least one model is obtained according to data obtained by counting historical business data with the attribute of each model, and the model base maintenance sub-module is used for obtaining a prediction result of the first business statistical data according to the matched model;

and the fault hidden danger warning submodule is used for determining that the first service is abnormal if the prediction result meets a preset condition.

Optionally, the model library maintenance sub-module is further configured to:

In a third aspect, an apparatus for determining a traffic anomaly is provided, including:

at least one processor, and

a memory communicatively coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method according to the first aspect and any one of the alternatives by executing the instructions stored by the memory.

In a fourth aspect, a computer-readable storage medium is provided, which stores computer instructions that, when executed on a computer, cause the computer to perform the method of the first aspect and any of the alternatives.

Due to the adoption of the technical scheme, the embodiment of the application has at least the following technical effects:

the change condition of the prediction result in the embodiment of the application is consistent with the change condition of the data for counting the historical service data, so that the prediction result is more reasonable, and the judgment accuracy is improved.

Drawings

Fig. 1 is a flowchart of a method for determining a service exception according to an embodiment of the present application;

fig. 2 is a flowchart of a method for determining a service exception according to an embodiment of the present application;

FIG. 3 is an architecture diagram of a system for determining business anomalies according to an embodiment of the present application;

fig. 4 is a flowchart illustrating operation of the hidden fault risk early warning module shown in fig. 3 according to an embodiment of the present application;

fig. 5 is a block diagram of an apparatus for determining a service anomaly according to an embodiment of the present application;

fig. 6 is a block diagram of an apparatus for determining a service anomaly according to an embodiment of the present application.

Detailed Description

For a better understanding of the technical solutions provided by the embodiments of the present application, the following detailed description will be made with reference to the drawings and specific embodiments.

The technical scheme provided by the embodiment of the application is described in the following with the accompanying drawings of the specification.

Referring to fig. 1, an embodiment of the present application provides a method for determining a traffic anomaly, which may be performed by a device for determining a traffic anomaly. The device for determining the abnormal service may be implemented by a server, where the server may be an entity server or a cloud server, and the present disclosure is not limited specifically. For example, the server may be a server provided by a china mobile main company for monitoring the services of other branch companies. The flow of the method is described below.

S101, determining a model matched with first business statistical data in at least one model according to attributes of the first business statistical data, wherein the first business statistical data are data obtained by counting data belonging to a first business, each model in the at least one model corresponds to data with one attribute, and each model in the at least one model is obtained according to data obtained by counting historical business data with the attributes of each model;

s102, obtaining a prediction result of the first business statistical data according to the matched model;

s103, if the prediction result meets a preset condition, determining that the first service is abnormal.

Herein, data obtained by counting traffic data is referred to as statistical data to distinguish it from traffic data.

Before starting to execute S101, the device for determining the traffic anomaly directly executes S101 if at least one model is obtained, and needs to obtain at least one model if at least one model is not obtained before. Each model in the at least one model is obtained according to statistical data obtained by performing statistics on historical business data with the attribute of each model.

The attribute of the model may be actually understood as an attribute of service data corresponding to the model, and the historical service data refers to service data generated before a statistical time starting point of a statistical time period of the first service statistical data, for example, if the first service statistical data is the number of times of occurrence of the first service counted in 1 month and 2 days of 2018, the statistical time period is 1 month and 2 days of 2018, and the statistical time starting point is 0 point of 1 month and 2 days of 2018, the historical service data refers to service data generated before 1 month and 2 days of 2018, and the statistical data of the generated service data before the statistical time starting point of the statistical time period of the first service statistical data is statistical data obtained by performing statistics on the historical service data. Each model of the at least one model corresponds to business data of an attribute, i.e., to statistical data of the business data having the attribute. For example, the attribute of the service data may include at least one of a type of a service corresponding to the service data, a generation time of the service data, and an object corresponding to the service data, and may also include other attributes. The service type includes, for example, a consultation service or a complaint service, the generation time of the service data refers to the data in which the service data is specifically located, for example, a complaint service occurs from 8 am to 9 am on 3/2/2018, which is the generation time of the service data, and the object corresponding to the service data refers to the object generating the service data, for example, some service data are service data generated by a china mobile quarterly province division company, and the object corresponding to the service data is a china mobile quarterly province division company.

The historical service data is counted, and various different statistical data can be obtained according to different contents targeted by the statistics. The statistical data obtained by performing statistics on historical traffic data is described below.

As a first embodiment, the historical service data is counted, and the obtained statistical data is the number of times of occurrence of the second service in each of at least two set time periods.

Specifically, the second service is a service having an attribute of each model, and the second service may be different for different models, for example, the attribute of the service data related to the model is a type of the service data, the type of the service includes a consultation service and a complaint service, and then the obtained model according to the types of the different services includes a consultation service model and a complaint service model, for the complaint service model, the second service is a complaint service, and for the consultation service model, the second service is a consultation service. At least two time periods may include two time periods, or may include a plurality of time periods, the more the time periods are, the more the number of the obtained statistical data is, the more the number of the time periods are specifically counted, and the determination may be made according to the need of actually obtaining the model. The at least two time segments may be discontinuous in time, or may be continuous in time for easier later detection of the regularity of the continuous variation of the statistical data. The time length of each time segment may be the same, or the time lengths of different time segments may be different, or the time lengths of some time segments may be the same, while the time lengths of the remaining time segments are different. However, in order to reduce the difficulty of analyzing the statistical data, the time duration of each of the at least two time periods may be the same, because if the time durations of the different time periods included in the at least two time periods are not all the same or different, the statistical data and the time duration of the time period need to be analyzed, which may increase the difficulty of analyzing the statistical data. For example, each time period is 1 hour, and a day can be divided into 24 time periods. The number of times of occurrence of the second service in a time period refers to the number of times of occurrence of the second service in the time period.

The total duration of the at least two time periods can be understood as a statistical period, and when the statistical data is obtained, the same statistical period is used, the shorter the duration of the time periods is, the fewer the number of the corresponding at least two time periods is, and the longer the duration of the time periods is, the greater the number of the corresponding at least two time periods is.

For example, the first statistical service data is the counted occurrence number of complaint services within 1 month and 4 days of 2018. Taking an example that the statistical period is 3 days, and the duration of each time period is 2 hours, the day includes 12 time periods (specifically, the first time period is 0 to 2 o 'clock, the second time period is 2 to 4 o' clock, and so on). For example, the occurrence frequency of the complaint service in the statistical period is counted, wherein 1 and 3 days in 2018 are the first day, 1 and 2 days in 2018 are the second day, and 1 day in 2018 are the third day. For example, if the number of occurrence of the complaint service from 0 to 2 on 1, 3 and 2018 is 0, the result is marked as 0, and so on, and the obtained statistical data is shown in the following table 1:

TABLE 1

As a second embodiment, the historical traffic data is counted to obtain statistical data as the time taken to process the second traffic in each of the at least two time periods.

For the description of the at least two time periods and the second service, reference may be made to the foregoing contents, which are not described herein again. The second service may occur zero times, one time or multiple times within a time period. The second service occurs multiple times in a time period, and the second service occurring in the time period may be partially processed, for example, once, or the second service occurring in the time period may not be processed, or the second service occurring in the time period may be completely processed. The processing of the second service may be performed by a worker or may be performed by a terminal device, and is not particularly limited herein. The length of time it takes to process the second traffic that occurred within the time period is the length of time it takes to process the second traffic within the time period.

For example, the time taken to process the second service within a time period may refer to the total time taken to process the second service within the time period. For example, the duration of each of the at least two time periods is 1 hour, if 1 day is taken as a statistical period, 24 time periods exist in one day, statistics determines that consulting services of the division of Sichuan province in China take place 5 times in a first time period (8 o 'clock to 9 o' clock earlier), the consulting services processed at 8 o 'clock to 9 o' clock take place 4 times, and the duration of processing the consulting services for 4 times is respectively: 30 minutes, 20 minutes, 40 minutes and 30 minutes, the total time period for processing the 4 counsel services is 2 hours, and the total time period taken for processing the second service in the first time period is 2 hours, which is the time period taken for processing the second service in the first time period. The at least two time periods comprise 24 time periods, and the statistical data is the total time taken to process the second traffic in each of the 24 time periods.

Alternatively, the time duration taken to process the second service in a time period may be an average time duration taken to process the second service once in the time period, wherein the average time duration is obtained by dividing the total time duration taken to process all the second services occurring in the time period by the number of times the second service is processed in the time period. For example, the second service is telephone consultation service, 1 day is taken as a statistical period, and the duration of each time period in the statistical period is 1 hour, then the statistical period includes 24 time periods, it is statistically determined that 10 times of telephone consultation service occur between 8 o 'clock and 9 o' clock earlier in the division of mobile tetrahydric province of china, and the staff finishes processing all the 10 telephone consultation services occurring in the time period, that is, 10 times of telephone consultation service are processed in the time period, and the total duration of processing the 10 telephone consultation services is 60 minutes, then the average time taken for processing one telephone consultation service in the time period from 8 o 'clock to 9 o' clock is 6 minutes. Obviously, if the average duration is adopted, the size of the statistical data can be relatively reduced compared with the total duration, so that the difficulty of data processing at the later stage of the device for determining the abnormal service is reduced.

As a third embodiment, the historical traffic data is counted, and the obtained statistical data is the number of times of occurrence of the second traffic for the setting object in each of at least two time periods.

For the description of the at least two time periods and the second service, etc., reference may be made to the foregoing contents, which are not described herein again. The setting object refers to an object where the second business occurs, and the setting object may be a unit, for example, XX china mobile business hall in XX district XX province, or may also be an individual, for example, three employees in XX china mobile business hall in XX district XX province. When the historical service data is counted, it may be that a certain service is counted as a whole, or it may be that a certain service of an individual object is counted, then, the aforementioned counting of the number of occurrences of the second service in each of the set at least two time periods may be regarded as a whole counting of the second service, and the counting of the number of occurrences of the second service in each of the set at least two time periods may be regarded as an individual counting of a certain service of an individual object.

For example, if 1 day is taken as a statistical period and the duration of each time period in the statistical period is 1 hour, the statistical period includes 24 time periods, it is determined statistically that the telephone consultation service occurs 8 times when the XX chinese mobile business hall in the XX district of XX province is 8 to 9 o' clock earlier.

As a fourth embodiment, the historical service data is counted, and the obtained statistical data is a corresponding ratio of the number of times that the second service is respectively processed in each of the at least two time periods to the number of times that the second service respectively occurs in each of the at least two time periods.

Specifically, for the descriptions of the second service, the at least two time periods, the occurrence times, and the like, reference may be made to the foregoing contents, and details are not described here again. The number of times of processing the second service in a time period refers to the number of times of processing the second service in the time period, that is, the second service may not occur in a time period, the second service may occur once in a time period, or the second service may occur multiple times in a time period, for example, the second service occurs multiple times in a time period, a worker may not process the second service occurring in the time period, that is, the number of times of processing is 0, the worker may partially process the second service occurring in the time period, that is, process some of the multiple times, or the worker may completely process the second service occurring in the time period, that is, the number of times of processing is the same as the number of times of occurrence of the second service occurring in the time period, and the number of times of processing the second service by the worker in the time period, dividing the number of times of the second service occurring in the period of time into the corresponding ratio in the period of time.

For example, if 1 day is taken as a statistical period and the duration of each time period in the statistical period is 1 hour, the statistical period includes 24 time periods, it is statistically determined that consultation services of the china mobile sichuan province company occur 8 times in the first time period (8 am to 9 am), the number of times of consultation services processed by the staff of the china mobile sichuan province company in the first time period is 4 times, and the ratio between 8 am and 9 am is 4/8 ═ 0.5.

The above lists only some statistical data that may be obtained by performing statistics on historical service data, and in practice, other statistical data may also be obtained by performing statistics on historical service data, and the details are not limited.

Specifically, the historical service data is counted to obtain several kinds of statistical data, wherein the statistical data relates to how to count the historical service data. The device for determining the abnormal service through the reintroduction value of the manual statistics is used for counting the historical service data, in order to reduce the workload of a statistic staff, the device for determining the abnormal service is used for counting, or the device for determining the abnormal service is used for sending the counted data to the device for determining the abnormal service after the terminal equipment is used for counting, the data processing amount of the device for determining the abnormal service can be reduced by sending the data to the device for determining the abnormal service through the terminal equipment, or the data is manually imported into the device for determining the abnormal service after the terminal equipment is acquired, and the staff can further calibrate the accuracy of the historical service data in the manual importing process. The specific method for counting the historical traffic data is not particularly limited herein.

In summary, referring to fig. 2, the device for determining a service abnormality obtains data obtained by counting historical service data, and in order to further improve the accuracy of determining a service abnormality, the device for determining a service abnormality preprocesses the data obtained by counting the historical service data. For simplicity of description, in fig. 2 and the following description, data obtained by counting historical traffic data is referred to as historical statistical data.

Specifically, the preprocessing may be understood as determining whether the historical statistical data contains unreasonable data, and if so, deleting the unreasonable data in the historical statistical data. Unreasonable historical statistical data are deleted, the influence of the unreasonable historical statistical data on the final judgment result can be avoided, and the accuracy of judging the service abnormity is improved.

The method for judging the reasonability of the historical statistical data comprises the steps that the device for determining the abnormal business stores a judgment rule in advance, wherein the judgment rule can be manually set in advance, and after the historical statistical data is obtained, the device for determining the abnormal business automatically configures the corresponding judgment rule for the historical statistical data or manually configures the corresponding judgment rule for the historical statistical data. And when the device for determining the abnormal service obtains the historical statistical data, judging the historical statistical data according to the judgment rule, and if the data in the historical statistical data does not accord with the judgment rule, determining that the data is unreasonable by the device for determining the abnormal service.

After the historical statistical data is filtered, different models can be obtained according to the historical statistical data. The method used to obtain different models from different historical statistics may also vary. The following describes several different methods for obtaining the corresponding model from the above statistical data. Of course, in practice, the method for obtaining the corresponding model from the historical statistical data is not limited to the method provided herein.

And obtaining a periodic traffic model according to the occurrence times of the second service in each set time period of the at least two time periods. The periodic traffic model is one of the at least one model, and a method for obtaining the periodic traffic model is described as follows.

Specifically, the respective occurrence times of the second service in each of the at least two set time periods are obtained, then a first ratio of the occurrence times in each time period to an average occurrence time of all the occurrence times of the at least two time periods is obtained, and then the periodic traffic model is obtained according to a first statistical data set and the first ratio, where the first statistical data set is the respective occurrence times of the second service in each of the at least two time periods. The average number of occurrences is the sum of all the numbers of occurrences over a plurality of time periods divided by the number of time periods, and the first ratio is the number of occurrences over each time period divided by the average number of occurrences.

In order to facilitate processing, the embodiment of the present application converts a corresponding processing procedure into a matrix operation procedure. Of course, there may be many specific processing methods in the actual processing process, and the processing process of matrix form operation will be described below.

Specifically, the respective occurrence number of the second service in each of the at least two set time periods is obtained, a first matrix is obtained according to the respective occurrence number of the second service in each of the at least two set time periods, each row vector in the first matrix is divided by an average value of all data included in each row vector, then a second matrix is obtained, a third matrix is obtained according to a median of each column vector of the second matrix, and then a periodic traffic model is obtained according to the third matrix, the first matrix and a weight coefficient, wherein one row of the first matrix is the respective occurrence number of the second service in each of the at least two time periods in a day, wherein the median is the number that is arranged from small to large for each column vector and is located in the middle, and if each column vector includes an even number, the median is the arithmetic mean of the two numbers located in the middle, the form of the first matrix is limited herein only for convenience of processing, and in fact, the form of the first matrix may be various.

The first matrix H1 can be obtained according to the data in table 1 above, and the first matrix H1 specifically includes:

the data for each row in the first matrix H1 is then obtained as the average of all the data included in each row vector, 5.33, 5.92 and 5.08 respectively.

Then, dividing the first row of the first matrix by 5.33, the second row of the first matrix by 5.92, and the third row of the first matrix by 5.08 to obtain a second matrix H2, where the second matrix H2 specifically is:

then, taking the median of the second matrix H2 to obtain a third matrix S1, the third matrix S1 is:

[0 0 0 0.20 0.94 1.86 1.35 2.20 2.17 0.98 1.69 0]

taking the first row vector in the first matrix H1 as the reference vector, and then multiplying by the third matrix S1 to obtain the first basic prediction matrix S2, although the reference vector may also be selected from any row in the first matrix H1, here, only the first row vector in the first matrix H1 is taken as an example, and specifically, the S2 is:

[0 0 1 1 5 10 6 14 14 5 8 0]*S1

the first basic prediction matrix S2 obtains a daily periodic traffic model by a one-time exponential smoothing method, where the daily periodic traffic model is one of periodic traffic models and is used to determine an anomaly of statistical data of the first service for which the total statistical time is day. The first-order exponential smoothing method may be understood as adding one data in the first basic prediction matrix S2 to the real data of the previous time segment, and multiplying the result by (1-K) to obtain a daily cycle traffic model, where the real data of the previous time segment refers to statistical data of the previous time segment of the time segment corresponding to the first traffic data, for example, if the time segment corresponding to the first traffic statistical data is 3/2018, the corresponding previous time segment is 3/2/2018, where K is a weight coefficient whose value is set according to human experience, and usually, the value range of K is (0, 1).

The model comparison in the embodiment of the present application is suitable for counting historical traffic data with a short total time, for example, determining the anomaly of traffic data within 1 day, because the traffic condition within a short time is not changed much, the median in the second matrix H2 can be directly selected as the reference of the change condition of the second matrix H2. However, if the historical traffic data with a longer total time is counted, the median is not necessarily good for representing the variation of the second matrix H2, so in order to obtain a higher accuracy of the obtained model, a fourth matrix may be formed according to the median of the second matrix H2 and the average of the data included in the column vectors, and the fourth matrix is used for representing the variation of the second matrix H2. Then multiplying the fourth matrix by the corresponding row vector in the first matrix H1 to obtain a second basic prediction matrix S2, then a second basic prediction matrix S2 is subjected to a quadratic exponential smoothing method to obtain a periodic traffic model, wherein, the quadratic exponential smoothing method can be understood as adding one data in the first basic prediction matrix S2 to the real data of the previous time slot, and then multiplying the added data by (1-K) × (1-R), K and R are weighting coefficients, the values of K and R may be the same or different, usually the values of K and R are set according to human experience, the real data of the last time period refers to statistical data of a previous time period of a time period corresponding to the first service data, initial values of the two weight coefficients can be set manually, and the value ranges of K and R are (0, 1). For example, to obtain a monthly periodic traffic model, which is one of periodic traffic models, for determining an abnormality of statistical data of the first traffic whose statistical total time is month, the monthly periodic traffic model is obtained by using a quadratic exponential smoothing method for the second basic prediction matrix S2.

And obtaining a cycle duration model according to the duration spent by the second service in each of at least two time periods respectively for processing the second service, wherein the cycle duration model is one of at least one model, and the method for obtaining the cycle duration model is specifically similar to the method for obtaining the cycle traffic model in the foregoing, but the data obtained by counting the historical service data adopted by the cycle duration model and the cycle traffic model are different. Specifically, the method for obtaining the day period duration model is similar to the method for obtaining the day period traffic model, and the method for obtaining the month period duration model is similar to the method for obtaining the month period traffic model. However, when the periodic time length model is obtained, the data obtained by counting the selected historical service data is generally corresponding historical service statistical data screened by a random forest method, and meanwhile, the corresponding row vector in the first matrix H1 is also generally screened by the random forest method. The data which has the greatest influence on the model can be screened out through a random forest method, so that a more accurate period duration model can be obtained.

And obtaining an object traffic model according to the respective occurrence times of the second traffic for the set object in each of the at least two time periods. The specific method for obtaining the object traffic model comprises the steps of obtaining the occurrence frequency of a second service in each time period of at least two time periods for a set object, obtaining the difference value of the occurrence frequency of the second service in each two adjacent time periods of the set object in the at least two time periods according to the occurrence frequency of the second service in each time period of the at least two time periods for the set object, and obtaining the object traffic model according to the obtained difference value and a reference occurrence frequency set.

The number of times of occurrence of the second service for the setting object in a period of time is generally relatively stable, that is, the difference between the number of times of occurrence of adjacent time periods is relatively stable, so that the object traffic model can be obtained according to the difference between the adjacent time periods. Specifically, when at least two time periods are multiple, the occurrence times corresponding to the multiple time periods are counted, multiple occurrence times can be obtained, then the difference value between the occurrence times in every two adjacent time periods is obtained, then multiple difference values can be obtained, and then the object traffic model is obtained according to the selected reference occurrence time set and the corresponding difference value, wherein the reference occurrence time set is a set of all data of the occurrence times of the set object in each of the at least two time periods.

Similarly, for convenience of processing, the process of obtaining the object traffic model is converted into a matrix operation process, which is described below. The method comprises the steps of firstly obtaining the occurrence frequency of a second service in each of at least two time periods for a set object, and obtaining a fifth matrix according to data of all the occurrence frequencies, wherein one row of the fifth matrix is the occurrence frequency in each of the at least two time periods, and one column of the fifth matrix represents the occurrence frequency in the same time period in a statistical cycle. And subtracting the data in the same row in two adjacent columns of the fifth matrix to obtain a corresponding difference value, so as to obtain a difference value matrix according to the difference value, and then obtaining an object traffic model according to the difference value matrix and the fifth matrix.

For example, taking the XX china mobile business hall with the XX province as the setting object, the statistical data of the number of times of the second business in the past 4 months of the setting object is shown in the following table 2, where one month is taken as the statistical cycle, and the length of the time period is 10 days (the set time periods are 1 to 10 days, 10 to 20 days, and 20 to 30 days, respectively).

TABLE 2

	1-10	10-20	20-30
				The first month	195	89	214
Second month of February	194	85	207
				The third month	190	88	204
The fourth month	191	80	211

Then, according to table 2, the corresponding fifth matrix is obtained as:

and then obtaining a difference matrix according to the fifth matrix as follows:

and then, obtaining an object traffic model by an exponential smoothing method for the difference matrix, namely adding the data in the difference matrix and the real data of the previous time period, and multiplying by (1-K) or (1-K) × (1-R). The K and the R both represent weight coefficients, values of the K and the R may be the same or different, and a value range of the K and the R is (0,1), where the real data of the last time period refers to statistical data of a time period before a time period corresponding to the first service data.

And obtaining a cycle percentage model according to the corresponding ratio of the times of respectively processing the second service in each of the at least two time periods to the times of respectively generating the second service in each of the at least two time periods, wherein the method for obtaining the cycle percentage model is as follows.

Specifically, a corresponding ratio of the number of times that the second service is respectively processed in each of the at least two time periods to the number of times that the second service occurs in each of the at least two time periods is obtained, and classification information is obtained according to all ratios of the corresponding ratios of the number of times that the second service is respectively processed in each of the at least two time periods to the number of times that the second service occurs in each of the at least two time periods, the classification information being used for indicating whether the ratio is normal or abnormal, and a cycle percentage model is obtained according to the classification information.

The classification information may be a classifier, and the specific form of the classification information is not limited herein. When the classification information is the classifier, the process of obtaining the classifier is that the ratios corresponding to a plurality of time periods are obtained, a plurality of ratios can be obtained, the classifier is obtained by training by taking the ratios as samples, and the classifier can directly judge whether the input ratio is abnormal or normal. There are many ways to train the classifier, and the method is not particularly limited herein. When the statistics of the total time is different, the application range of the obtained corresponding cycle percentage model is different. When obtaining a cycle percentage model, the time length of each of the at least two time segments should be the same.

For example, if the time length of the time period is 1 day, the obtained ratio represents that the number of times of processing the second service in one day is divided by the number of times of occurrence of the second service in one day, the statistical period is 1 day, and the statistical total time is 10 days, then 10 ratios can be obtained, and a daily period percentage model is obtained according to the 10 ratios, where the daily period percentage model is adapted to determine whether the ratio of the number of times of occurrence of the first service processed for one day to the first service processed for that day is abnormal. Or for example, the time length of the time period is 1 day, the statistical period is 3 months, the obtained ratio represents the number of times of processing the second service every day in the three months divided by the number of times of occurrence of the second service every day in the three months, and a monthly cycle percentage model is obtained according to the ratio data, and the monthly cycle percentage model is adapted to judge whether the ratio of the number of times of processing the second service every month to the number of times of occurrence of the second service every month is abnormal.

The periodic traffic model, the object traffic model, the periodic percentage model and the periodic duration model described above belong to at least one model, and at least one model may include models other than the above models, which is not particularly limited herein. The means for determining traffic anomalies may obtain only one of the models, or a plurality of models, of the preceding. When the device for determining the abnormal service only obtains one model, the device for determining the abnormal service has small calculation amount, but the application range is relatively small, wherein the application range refers to the abnormality of the service data with several attributes which can be determined by the device for determining the abnormal service; when the device for determining the traffic anomaly obtains a plurality of models, the device for determining the traffic anomaly is large in calculation amount, but the application range is wider, and generally, at least one model includes all the models in order to determine more traffic data. When at least one model comprises a plurality of models, the device for determining the business anomaly may obtain a plurality of models simultaneously or obtain corresponding models sequentially. The device for determining the abnormal business obtains a plurality of models simultaneously, the device for determining the abnormal business reduces the time for obtaining the models, but the requirement on the data processing capacity of the device for determining the abnormal business is higher, and if the corresponding models are obtained in sequence, the requirement on the data processing capacity of the device for determining the abnormal business is lower.

After the means for determining the business anomaly obtains the at least one model, the means for determining the business anomaly may then perform a process for determining an anomaly of the first business data. First, the device for determining the service abnormality acquires the first service statistical data, wherein the specific method for acquiring may refer to the content discussed above, and is not described herein again. The first service statistical data can be understood as the first service statistical data to be judged whether the first service statistical data is abnormal or not.

And after the first service statistical data are obtained, determining a model matched with the first service statistical data in at least one model according to the attribute of the first service statistical data.

Because each model corresponds to data of one attribute, the model matching the first business statistics can be determined according to the attributes corresponding to the first business statistics. For example, the first traffic statistic is data for characterizing traffic duration, and the cycle duration class model is matched with the first traffic statistic. The determining of the attribute of the first service statistical data may be performed by the device for determining the service anomaly obtaining statistical data with different attributes in advance, for example, provinces corresponding to specific data, and then matching the attribute with the attribute of the model in the device for determining the service anomaly according to an intelligent matching algorithm, so as to screen out a model that can be matched with the first service statistical data, where the intelligent matching algorithm is various and is not limited herein.

However, it is possible that more than one model may be matched by the first traffic statistic, and further matching may be required to determine which model matches the first traffic statistic more closely. For example, a prediction result may be obtained by using a model that can be matched with partial data or all data in the data obtained by counting the historical service data, a model with the prediction result closest to the data obtained by counting the historical service data is selected as a model finally matched with the first service statistical data, if the prediction result is not specific data, the accuracy of whether the data obtained by counting the historical service data is abnormal is determined, and the model with the highest accuracy is selected as the model finally matched with the first service statistical data.

In some special cases, if it is possible that the first service statistical data cannot be matched with all models in the device for determining the service abnormality, the models may be manually specified, and parameters in the models may be manually set, where the parameters of the models may be manually set by referring to historical service data corresponding to the first service statistical data. The manual configuration model is a supplement to the automatic configuration model, and the flexibility of model optimization can be improved.

After the model corresponding to the first service statistical data is matched, a prediction result of the first service statistical data can be obtained according to the matched model.

Specifically, after the device for determining the abnormal service screens out the model corresponding to the first service statistical data, the optimal parameters of the model are further obtained according to the characteristics of the first service statistical data. One way to obtain the optimal parameters of the optimal model is as follows.

And traversing the alternative parameters by using the matched model, and then judging the optimal parameter in the alternative parameters according to the average absolute percentage error. The candidate parameters refer to all parameters that can be taken by the model within the empirical value range.

Specifically, one parameter of the alternative parameters is selected as the parameter of the matched model, then the data obtained by counting the historical service data according to the model with the parameter is processed, part of data in the data obtained by counting the historical service data can be processed, or the data obtained by counting all the historical service data can be selected to be processed to obtain the prediction result of the corresponding parameter after the processing, then calculating according to the prediction result to obtain the average absolute percentage error of the matched model in different parameters, and repeating the steps, after each parameter in the alternative parameters is substituted into the matched model, the average absolute percentage error of the matched model under different parameters is obtained, and finally, the parameter corresponding to the matched model with the minimum average absolute percentage error is selected as the optimal parameter for processing the first service statistical data. The average absolute percentage error is obtained by dividing the absolute value of the difference between the prediction result and the historical service data by the historical service data.

For example, two data among the data obtained by statistics of the historical traffic data are 3 and 4, and the prediction results obtained by substituting the matched models of the first parameters are 2 and 5, the average absolute percentage error of the matched models of the corresponding first parameters is (1/3+ 1/4)/2. The results of the matched model in different parameters are evaluated by adopting the average absolute percentage error, so that the situation that the positive error and the negative error are offset can be avoided, and a more accurate evaluation result of the model can be obtained.

After the optimal parameters of the matched model are obtained, the optimal parameters can be substituted into the matched model, and then a prediction result of the first business statistical data is obtained. The content of the prediction results obtained by different models is also different. For example, the prediction result obtained by the periodic percentage model is directly whether the first service statistical data is abnormal or normal, and the prediction result obtained by the periodic traffic model is the prediction data corresponding to the specific first service statistical data.

For example, the daily cycle traffic model is:

[0 0 1 1 5 10 6 14 14 5 8 0]*S1*K

the optimal parameter K of the matched model is 0.9, and the finally obtained today's service prediction result is as follows:

[0 0 1 1 5 10 6 14 14 5 8 0]*S1*0.9

and finally, the device for determining the abnormal service judges whether the first service is abnormal according to whether the prediction result meets a preset condition, and if the prediction result meets the preset condition, the device for determining the abnormal service determines that the first service is abnormal. The preset conditions corresponding to different prediction results are different.

Specifically, the result obtained according to the periodic traffic model, the object traffic model, and the periodic time length model is used as the prediction data, and the preset condition to be satisfied may be that a difference between the prediction result and the first traffic statistical data is greater than a preset difference, or that a dispersion between the prediction result and the first traffic statistical data is greater than a preset dispersion, and that a difference between the prediction result and the first traffic statistical data is greater than a preset difference. The dispersion of the prediction result and the first service statistical data can be represented by a standard deviation, and the specific content of the dispersion is not limited herein.

Judging whether the service is abnormal according to the difference value between the prediction result and the first service statistical data, wherein the calculation process is simple, and the calculation amount of a device for determining the service abnormality can be relatively reduced; whether the business is abnormal or not is judged according to the dispersion of the prediction result and the first business statistical data, and the trend of the difference between the prediction result and the first business statistical data can be seen, so that the method is more accurate compared with a mode of directly judging by using the difference; referring to fig. 2, when the dispersion of the prediction result and the first service statistical data is greater than the preset dispersion, and the difference between the prediction result and the first service statistical data is greater than the preset difference, it is determined that the first service is abnormal, and the preset condition is compared with the other two preset conditions.

Or, if the prediction result obtained according to the cycle percentage model is that the first service statistical data is abnormal or normal, the corresponding preset condition is that the first service statistical data is abnormal, and if the prediction result meets the preset condition, the first service is determined to be abnormal.

After the first service abnormality is determined, an alarm prompt may be output directly on the device determining the service abnormality. Or a device for determining the abnormal service may be connected to a server corresponding to the service, the device for determining the abnormal service determines a first service server corresponding to the first service statistical data, and an alarm prompt is output to the first service server, so that a worker corresponding to the first service server pays attention to the improvement of the quality of the first service, and the like.

For example, the device for determining the business abnormality is a server of a head office, the server is connected with each server of the branch office, when the server of the head office determines that the first business of the branch office of the Sichuan province is abnormal, the alarm prompt can be directly sent to the server of the branch office of the Sichuan province, so that the staff of the branch office of the Sichuan province can know the abnormal condition of the first business, further improve the situation and the like. The alarm prompt may be in the form of pop-up window text, or may be an audible and visual alarm, or may be in the form of pop-up window text combined with an audible and visual alarm, and the text is not limited specifically.

The prediction result in the embodiment of the present application is obtained according to the data obtained by counting the historical service data, and compared with a method for judging whether the service is abnormal by directly using a threshold in the prior art, the method for judging whether the service is abnormal or not in the embodiment of the present application has different change conditions of the historical service data and different obtained prediction results, and further judges whether the service is abnormal or not according to whether the prediction result meets a preset condition or not, that is, the change condition of the prediction result in the embodiment of the present application is consistent with the change condition of the data obtained by counting the historical service data, so that the prediction result is more reasonable, and the accuracy of the judgment is improved.

On the basis of the above-described method for determining a service anomaly, an embodiment of the present application further provides a system for determining a service anomaly, please refer to fig. 3, where the system includes a data quality checking module, a fault hidden danger early warning module, and a fault hidden danger association comprehensive diagnosis module. The system for determining traffic anomalies is described in detail below. The method for determining a service anomaly described above may be performed by the hidden fault warning module in the system for determining a service anomaly in fig. 3.

The data quality checking module is used for checking the quality according to the judged first service statistical data and deleting unreasonable data in the first service statistical data;

the fault hidden danger early warning module is used for obtaining at least one model according to the statistical data, determining a model matched with the first business statistical data in the at least one model according to the attribute of the first business statistical data, obtaining a prediction result according to the matched model, and determining that the first business is abnormal if the prediction result meets a preset condition;

and the fault hidden danger association comprehensive diagnosis module is used for determining an abnormal first service abnormality according to an association rule, wherein the association rule is a condition for judging the service abnormality and is different from a preset condition.

The judgment rule, the statistical data, the first service statistical data, the at least one model and the prediction condition refer to the contents described above, and are not described herein again. The fault hidden danger association comprehensive diagnosis module is used for further judging whether the abnormal first service is abnormal or not according to the association rule, wherein the association rule is a judgment condition for establishing and configuring channels and services by utilizing the understanding of service personnel on the relationship between the services.

The data quality checking module can be realized through a server or a Personal Computer (PC), and the fault hidden danger early warning module can be realized through the server, for example, through a physical server or a cloud server. Or, the data quality checking module and the fault risk early warning module may also be implemented by the same server, for example, may be implemented by a server of a head office company. The fault risk association comprehensive diagnosis module may be implemented by a server, for example, an entity server, or a cloud server, for example, a server of a provincial company. In a word, the data quality checking module, the fault hidden danger early warning module and the fault hidden danger correlation comprehensive diagnosis module can be communicated with each other.

The process of obtaining the model by the fault risk early warning module in the system shown in fig. 3 can refer to the foregoing contents, and the following mainly describes the operation flow of the system in fig. 3 with reference to fig. 4.

Specifically, the hidden trouble warning module configures scheduling rules (including selecting a model in a model library, configuring model parameters, pre-analyzing the model, running time of the model, running frequency of the model, and the like) corresponding to provinces, channels, and services, runs a model task according to the scheduling rules, and can be equivalent to the aforementioned method for determining a model matched with the first service statistical data in at least one model according to the attributes of the first service statistical data, and determining the requirements of the matched model on the quality rules of the data.

Then, the data quality checking module checks whether the province, channel and business data in the first business statistical data passes the checking (if the province, channel and business quality rules are not configured, the quality checking is passed by default), checks whether the first business statistical data passes the checking, and can understand whether the attribute of the first business statistical data is matched with the matched model and whether the first business statistical data meets the quality rule requirement of the matched model.

And then, the fault hidden danger early warning module operates the model to obtain a prediction result, the relation between the prediction result and a preset condition is judged by combining the prediction condition, if the prediction result meets the preset condition, the first service is determined to be abnormal, an alarm prompt is output, the generated alarm prompt is inserted into an alarm operation result table, and meanwhile, the alarm prompt is sent to the fault hidden danger correlation comprehensive diagnosis module.

After the fault hidden danger associated comprehensive diagnosis module receives service abnormality warning prompts for many times, operation and maintenance personnel or provinces and companies can feed back the situation of false warning to the fault hidden danger early warning module, when the number of false warning reaches a set threshold, the accuracy of a matched model is low, the fault hidden danger early warning module is triggered to perform automatic model optimization, the optimization process of the model can further obtain the content of the optimal parameters of the model according to the characteristics of the first service statistical data, and the details are not repeated here.

On the basis of the foregoing method for determining a traffic anomaly, please refer to fig. 5, which provides an apparatus for determining a traffic anomaly, including:

a model base maintenance submodule 501, configured to determine, according to an attribute of first service statistical data, a model that matches the first service statistical data in at least one model, where the first service data is data obtained by performing statistics on data belonging to a first service, each model in the at least one model corresponds to data of one attribute, each model in the at least one model is obtained according to data obtained by performing statistics on historical service data having the attribute of each model, and is configured to obtain a prediction result of the first service statistical data according to the matched model;

and the hidden trouble warning submodule 502 is configured to determine that the first service is abnormal if the prediction result meets a preset condition.

Optionally, the data obtained by performing statistics on the historical service data with the attribute of each model includes at least one of the following:

the length of time it takes respectively to process the second traffic in each of the at least two time periods,

the second service is associated with a respective number of occurrences of the setting object in each of at least two time periods, and,

the corresponding ratio of the number of times that the second service is respectively processed in each of the at least two time periods to the respective number of occurrences in each of the at least two time periods;

wherein the second service is a service having an attribute of each model.

Optionally, the model library maintenance sub-module 501 is further configured to:

obtaining a first statistical data set comprising the respective number of occurrences of the second traffic in each of the at least two time periods or the respective length of time taken to process the second traffic in each of the at least two time periods;

obtaining a first ratio of the number of occurrences in each time period in the first statistical data set to an average of all the number of occurrences in the at least two time periods, or obtaining a second ratio of the duration spent processing the second service in each time period in the first statistical data set to an average of the durations spent in all the at least two time periods;

and obtaining at least one model according to the obtained first ratio and the first statistic data set, or obtaining at least one model according to the obtained second ratio and the first statistic data set.

acquiring the occurrence times of a second service in each time period of at least two time periods aiming at a set object;

according to the occurrence times of the second service in each time period of the at least two time periods for the set object, obtaining the difference value of the occurrence times of the second service in each two adjacent time periods of the at least two time periods for the set object;

and obtaining at least one model according to the obtained difference and the reference occurrence number set.

acquiring the corresponding ratio of the times of the second service respectively processing the second service in each of at least two time periods to the times of occurrence respectively in each of at least two time periods;

obtaining classification information according to all ratios of corresponding ratios of the times of the second service respectively processed in each of the at least two time periods to the respective times of occurrence in each of the at least two time periods, wherein the classification information is used for indicating whether the ratios are normal or abnormal;

and obtaining at least one model according to the classification information.

As an embodiment, the hidden fault danger early warning module in fig. 3 may be implemented by the model base maintenance sub-module 501 and the hidden fault danger warning sub-module 502 in fig. 5.

On the basis of the method for determining the business anomaly, the device for determining the business anomaly is provided, and comprises the following steps:

at least one processor 601, and

a memory 602 communicatively coupled to the at least one processor 601;

wherein the memory 602 stores instructions executable by the at least one processor, the at least one processor 601 implements the method as shown in fig. 1 and in any of the embodiments by executing the instructions stored by the memory 602.

In fig. 6, one processor 601 is taken as an example, but the number of processors 601 is not limited in the actual processing.

As an embodiment, the model library maintenance sub-module 501 and the hidden fault trouble warning sub-module 502 in fig. 5 may be implemented by the processor 601 in fig. 6.

As another embodiment, the hidden trouble warning module in fig. 3 may be implemented by the processor 601 in fig. 6.

On the basis of the method for determining a traffic anomaly described above, a computer-readable storage medium is provided, on which computer instructions are stored, which, when run on a computer, cause the computer to perform the method as shown in fig. 1 and in any of the embodiments.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all alterations and modifications as fall within the scope of the application.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims

1. A method for determining traffic anomalies, comprising:

2. The method of claim 1, wherein the data statistically derived from historical traffic data having attributes of each of the models comprises at least one of:

3. The method of claim 2, wherein obtaining the at least one model comprises:

4. The method of claim 2, wherein obtaining the at least one model comprises:

5. The method of claim 2, wherein obtaining the at least one model comprises:

6. The method according to any one of claims 1 to 4, wherein the predetermined condition includes that a difference between the predicted result and the first service statistical data is greater than a predetermined difference, and/or that a dispersion between the predicted result and the first service statistical data is greater than a predetermined dispersion.

7. An apparatus for determining traffic anomalies, comprising:

8. The apparatus of claim 7, wherein the data obtained by counting the historical traffic data having the attributes of each model comprises at least one of:

9. The apparatus of claim 8, wherein the model library maintenance submodule is further operable to:

10. The apparatus of claim 8, wherein the model library maintenance submodule is further operable to:

11. The apparatus of claim 8, wherein the model library maintenance submodule is further operable to:

12. The apparatus of claim 8, wherein the predetermined condition includes that a difference between the predicted result and the first traffic statistic is greater than a predetermined difference, and/or that a dispersion of the predicted result and the first traffic statistic is greater than a predetermined dispersion.

13. An apparatus for determining traffic anomalies, comprising:

at least one processor, and

a memory communicatively coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing the method of any one of claims 1-6 by executing the instructions stored by the memory.

14. A computer-readable storage medium having stored thereon computer instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1-6.