CN110874674A

CN110874674A - Anomaly detection method, device and equipment

Info

Publication number: CN110874674A
Application number: CN201810994706.2A
Authority: CN
Inventors: 冯阳
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Group Holding Ltd
Priority date: 2018-08-29
Filing date: 2018-08-29
Publication date: 2020-03-10
Anticipated expiration: 2038-08-29
Also published as: CN110874674B

Abstract

The application provides an anomaly detection method, an anomaly detection device and anomaly detection equipment, wherein the method comprises the following steps: acquiring an initial monitoring threshold value, and carrying out anomaly detection on service data according to the initial monitoring threshold value; adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value; and carrying out anomaly detection on the service data according to the target monitoring threshold. According to the technical scheme, the monitoring threshold value does not need to be manually set by operation and maintenance personnel, the monitoring threshold value is automatically adjusted, and the alarm accuracy is improved.

Description

Anomaly detection method, device and equipment

Technical Field

The present application relates to the field of internet technologies, and in particular, to a method, an apparatus, and a device for detecting an anomaly.

Background

The automatic anomaly detection aims at finding out the abnormal fluctuation of the service data, and is an important link of an intelligent monitoring system, the abnormal detection needs to monitor a great number of service data, for example, the service data can be data such as request number, rejection number, response time, volume of transaction, order form and the like, and the detection of the abnormal fluctuation of the service data is an important guarantee of service stability. For example, a monitoring threshold may be preset, and when the service data (for example, the monitoring threshold is a request number threshold, and the service data is a request number generated every minute) is greater than the monitoring threshold, it is detected that the service data is abnormal, and an alarm may be generated to the operation and maintenance personnel, and the operation and maintenance personnel may analyze the reason of the abnormality.

In the above manner, usually, an operation and maintenance person sets a monitoring threshold manually, the accuracy of the monitoring threshold is limited by the experience of the operation and maintenance person, and the monitoring threshold cannot be adjusted automatically, and once the accuracy of the monitoring threshold is low, the number of alarms of the service data is large, but the accuracy of the anomaly detection is low, or the number of alarms of the service data is small, but the false alarm of the anomaly detection is serious.

Disclosure of Invention

The application provides an anomaly detection method, which comprises the following steps:

acquiring an initial monitoring threshold value, and carrying out anomaly detection on service data according to the initial monitoring threshold value;

adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value; and carrying out anomaly detection on the service data according to the target monitoring threshold.

acquiring service data of a current time point;

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

and carrying out anomaly detection on the service data according to the characteristic value.

acquiring service data of a current time point;

performing anomaly detection on the service data by adopting a plurality of detection strategies to obtain a detection result of each detection strategy; the detection result of each detection strategy is that the service data is abnormal or not abnormal;

if the detection results of the at least two detection strategies are that the service data are abnormal, determining that the final detection result of the service data is that the service data are abnormal; and if the detection result of one detection strategy is that the service data is abnormal, determining that the final detection result of the service data is that the service data is not abnormal.

The application provides an anomaly detection device, the device includes:

the acquisition module is used for acquiring an initial monitoring threshold value;

the detection module is used for carrying out abnormity detection on the service data according to the initial monitoring threshold value;

the acquisition module is further configured to adjust the initial monitoring threshold according to an anomaly detection result of the initial monitoring threshold to obtain a target monitoring threshold;

and the detection module is also used for carrying out abnormity detection on the service data according to the target monitoring threshold value.

The application provides an anomaly detection device, the device includes:

the acquisition module is used for acquiring the service data of the current time point;

the generating module is used for generating a data set according to the service data of the current time point;

a determination module for determining statistical characteristics of the data set;

the determining module is further configured to determine a feature value corresponding to the statistical feature;

and the detection module is used for carrying out abnormity detection on the service data according to the characteristic value.

The application provides an anomaly detection device, the device includes:

the detection module is used for carrying out anomaly detection on the service data by adopting a plurality of detection strategies to obtain a detection result of each detection strategy; the detection result of each detection strategy is that the service data is abnormal or the service data is not abnormal;

the determining module is used for determining that the final detection result of the service data is abnormal if the detection results of the at least two detection strategies are abnormal;

and if the detection result of one detection strategy is that the service data is abnormal, determining that the final detection result of the service data is that the service data is not abnormal.

The application provides an anomaly detection device, including:

a processor and a machine-readable storage medium having stored thereon a plurality of computer instructions, the processor when executing the computer instructions performs:

The application provides an anomaly detection device, including:

acquiring service data of a current time point;

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

The application provides an anomaly detection device, including:

acquiring service data of a current time point;

Based on the technical scheme, in the embodiment of the application, the monitoring threshold value does not need to be manually set by operation and maintenance personnel, and can be automatically adjusted, so that the accuracy of the monitoring threshold value is higher, the problems that the alarm number of the service data is more, but the accuracy of the abnormal detection is lower are solved, and the problems that the alarm number of the service data is less, but the report missing of the abnormal detection is more serious are solved. The abnormal detection can be carried out according to the trend of the historical service data, the abnormal service data can be automatically detected, and the accuracy of alarming is improved.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments of the present application or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art according to the drawings of the embodiments of the present application.

FIG. 1 is a flow chart of an anomaly detection method in one embodiment of the present application;

FIGS. 2A-2C are schematic diagrams of traffic data curves in an embodiment of the present application;

FIG. 3 is a flow chart of an anomaly detection method in another embodiment of the present application;

FIG. 4 is a flow chart of an anomaly detection method in another embodiment of the present application;

fig. 5 is a configuration diagram of an abnormality detection device according to an embodiment of the present application;

fig. 6 is a configuration diagram of an abnormality detection device according to another embodiment of the present application;

fig. 7 is a configuration diagram of an abnormality detection device according to another embodiment of the present application.

Detailed Description

The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein is meant to encompass any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present application. Depending on the context, moreover, the word "if" as used may be interpreted as "at … …" or "when … …" or "in response to a determination".

The first embodiment is as follows:

an embodiment of the present application provides an anomaly detection method, configured to detect whether a service data (which may also be referred to as a service index) is abnormal, as shown in fig. 1, which is a schematic flow diagram of the method, and the method includes:

step 101, obtaining an initial monitoring threshold, and performing anomaly detection on the service data according to the initial monitoring threshold, that is, detecting whether the service data is anomalous according to the initial monitoring threshold.

The initial monitoring threshold may be configured empirically, may be determined based on a confidence interval, or may be determined based on a specific parameter, and the obtaining manner of the initial monitoring threshold is not limited.

In one example, taking the determination of the initial monitoring threshold based on the confidence interval as an example, the obtaining of the initial monitoring threshold may include, but is not limited to: obtaining a confidence interval, wherein the confidence interval comprises a plurality of confidence values; a partial confidence value is selected from the plurality of confidence values for the confidence interval, and an initial monitoring threshold is determined based on the partial confidence value.

For example, a confidence interval may be empirically configured, and may include a plurality of confidence values, such as confidence value 5, confidence value 6 …, confidence value 24, confidence value 25, etc., without limitation.

All confidence values within the confidence interval may then be ranked and a partial confidence value selected from all confidence values based on the ranking result. For example, the confidence values in the confidence intervals are sorted in a normal distribution manner (which may also be referred to as a normal distribution manner or a gaussian distribution manner), and the sorting manner is not limited. Then, selecting N confidence values with the highest ranking; the value of N may be configured empirically, such as 3, 4, 5% of the total number of confidence values in the confidence interval, and the like, which is not limited herein.

After selecting the partial confidence value from all confidence values, an initial monitoring threshold may be determined using the partial confidence value, e.g., the initial monitoring threshold may be the mean of the partial confidence values. For example, after selecting the confidence value 10, the confidence value 11, and the confidence value 12 from all the confidence values, then the mean 11 of the confidence values 10, 11, and 12 may be determined and the mean 11 determined as the initial monitoring threshold.

In an example, the initial monitoring threshold may be an upper monitoring threshold, or may also be a lower monitoring threshold, or may be a combination of multiple monitoring thresholds, and since the processing flow of each monitoring threshold is the same, in this embodiment, the description is given by taking the example that the initial monitoring threshold is an upper monitoring threshold. For example, the initial monitoring threshold is 11, and when the service data is greater than the initial monitoring threshold 11, it is detected that the service data is abnormal, an alarm may be generated to the operation and maintenance personnel, and the operation and maintenance personnel may analyze the reason of the abnormality.

In one example, different time intervals may correspond to different initial monitoring thresholds, as different time intervals may be more tolerant of anomalies. For example, time interval a (e.g., 9 am to 5 am) corresponds to confidence interval a, and an initial monitoring threshold a is determined based on confidence interval a; based on this, for the service data in the time interval a, if the service data is greater than the initial monitoring threshold a, it indicates that the service data is abnormal, and if the service data is not greater than the initial monitoring threshold a, it indicates that the service data is not abnormal. The time interval B (such as 9 o 'clock later to 11 o' clock later) corresponds to a confidence interval B, and an initial monitoring threshold value B is determined based on the confidence interval B; based on this, for the service data in the time interval B, if the service data is greater than the initial monitoring threshold B, it is indicated that the service data is abnormal, and if the service data is not greater than the initial monitoring threshold B, it is indicated that the service data is not abnormal. The time interval C (such as 11 o 'clock later to 9 o' clock earlier on the next day) corresponds to the confidence interval C, and the initial monitoring threshold C is determined based on the confidence interval C; based on this, for the service data in the time interval C, if the service data is greater than the initial monitoring threshold C, it is indicated that the service data is abnormal, and if the service data is not greater than the initial monitoring threshold C, it is indicated that the service data is not abnormal.

Further, since the processing flow of the monitoring threshold value for each time interval is the same, in this embodiment, the description will be given by taking an example in which the initial monitoring threshold value is an initial monitoring threshold value for one time interval.

In an example, after the initial monitoring threshold is obtained, anomaly detection may be performed on the service data according to the initial monitoring threshold, for example, if the service data is greater than the initial monitoring threshold, it is indicated that the service data is abnormal, an alarm may be generated to operation and maintenance personnel, and otherwise, it is indicated that the service data is not abnormal.

And step 102, adjusting the initial monitoring threshold according to the abnormal detection result of the initial monitoring threshold to obtain a target monitoring threshold. Specifically, the feedback adjustment coefficient may be determined according to the abnormality detection result of the initial monitoring threshold, and the initial monitoring threshold may be adjusted according to the feedback adjustment coefficient to obtain the target monitoring threshold.

In one example, determining the feedback adjustment factor based on the anomaly detection result of the initial monitoring threshold may include, but is not limited to: determining effective service data and ineffective service data according to the abnormal detection result of the initial monitoring threshold, selecting first service data from the effective service data, and selecting second service data from the ineffective service data; and determining a feedback adjustment coefficient according to the first service data and the second service data.

In one example, the first service data is selected from the valid service data, which may include but is not limited to: sequencing all effective service data, and selecting the effective service data at a first position from the sequenced effective service data as first service data; in addition, the selecting the second service data from the invalid service data may include, but is not limited to: and sequencing all the invalid service data, and selecting the invalid service data at the second position from the sequenced invalid service data as second service data.

For example, when the service data is detected to be abnormal according to the initial monitoring threshold, an alarm may be generated for the abnormal service data, such as the service data A1-the service data a100, and the operation and maintenance staff may analyze whether the service data A1-the service data a100 is abnormal service data, which is not limited to this analysis process. If the analysis result is abnormal service data, such as the service data A1-the service data a60, the service data A1-the service data a60 are determined to be valid service data (i.e., valid alarm), and if the analysis result is not abnormal service data, such as the service data a 61-the service data a100, are not abnormal service data, the service data a 61-the service data a100 are determined to be invalid service data (i.e., invalid alarm).

The service data a 1-service data a60 are sorted, for example, sorted in descending order (when the service data a1 is greater than the service data a2, the service data a1 is sorted in front), or sorted in descending order (when the service data a1 is greater than the service data a2, the service data a2 is sorted in front), and the M1 th effective service data (i.e., the effective service data at the first position) is selected from the sorted effective service data, and the M1 th effective service data (e.g., the service data a20) is used as the first service data. The value of M1 may be configured according to experience, such as 10, 11, and 12, and M% (e.g., 40%, 45%, etc.) of the total amount of valid service data, and the value of M1 is not limited.

The service data a 61-the service data a100 are sorted, for example, sorted in the descending order (when the service data a61 is greater than the service data a62, the service data a61 is sorted in the front), or sorted in the descending order (when the service data a61 is greater than the service data a62, the service data a62 is sorted in the front), and the M2 th invalid service data (i.e., the invalid service data at the second position) is selected from the sorted invalid service data, and the M2 th invalid service data (e.g., the service data a80) is used as the second service data. The value of M2 may be configured according to experience, such as 20, 21, and 22, and n% (e.g., 50%, 55%, etc.) of the total amount of invalid service data, and the value of M2 is not limited.

Then, a feedback adjustment coefficient may be determined according to the first traffic data and the second traffic data, for example, when the first traffic data is x and the second traffic data is y, if x < ═ y, the feedback adjustment coefficient may be y × exp (y/x-1), or if x > y, the feedback adjustment coefficient may be x/(1+ exp (-y/x)).

Of course, y × exp (y/x-1) and x/(1+ exp (-y/x)) are just an example of the feedback adjustment coefficient, and the determination method of the feedback adjustment coefficient is not limited as long as the feedback adjustment coefficient is related to the first service data x and the second service data y, for example, the feedback adjustment coefficient may also be (x + y)/2, x/2+ y, x/2+ y/3, and the like.

Wherein, when y × exp (y/x-1) and x/(1+ exp (-y/x)) are adopted as feedback regulation coefficients, the method takes relevant ideas of logistic regression into consideration, and can ensure that: when the values of the first service data x and the second service data y are larger, the change of the feedback adjustment coefficient is smaller, and when the values of the first service data x and the second service data y are smaller, the change of the feedback adjustment coefficient is larger. Therefore, the feedback adjusting coefficient determined based on y x exp (y/x-1) and x/(1+ exp (-y/x)) can reflect the change of the initial monitoring threshold value, and the obtained target monitoring threshold value is more accurate when the feedback adjusting coefficient is adopted to adjust the initial monitoring threshold value.

In an example, when the initial monitoring threshold is adjusted according to the feedback adjustment coefficient to obtain the target monitoring threshold, the sum of the feedback adjustment coefficient and the initial monitoring threshold may be determined as the target monitoring threshold.

And 103, performing anomaly detection on the service data according to the target monitoring threshold. That is, after the target monitoring threshold is obtained, the anomaly detection is performed on the service data according to the target monitoring threshold, that is, whether the service data is abnormal or not is detected, and the anomaly detection is not performed on the service data according to the initial monitoring threshold.

In one example, the anomaly detection of the traffic data according to the target monitoring threshold may include, but is not limited to: if the service data is greater than the target monitoring threshold, it indicates that the service data is abnormal, and an alarm may be generated to operation and maintenance personnel, and if the service data is not greater than the target monitoring threshold, it indicates that the service data is not abnormal. Or, the anomaly detection may be performed on the service data according to the service data residual and the target monitoring threshold. Of course, other methods may also be used to perform anomaly detection on the service data, and the anomaly detection method is not limited as long as the target monitoring threshold can be used to perform anomaly detection on the service data.

In an example, taking the example of performing anomaly detection on the service data according to the service data residual and the target monitoring threshold, the process of performing anomaly detection on the service data may include the following steps:

step 1031, determining a data set, wherein the data set comprises predicted business data of a plurality of time points.

In one example, determining the data set may include, but is not limited to, the following: acquiring historical service data, and predicting service data of a plurality of time points behind the current time point; then, processing the historical service data and the service data of the plurality of time points, and determining the processed service data as predicted service data; the predicted traffic data may then be added to the data set.

Of course, the above manner is only an example of determining the data set, and is not limited thereto. For example, after obtaining historical traffic data, the historical traffic data may be determined to be predicted traffic data and the predicted traffic data may be added to the data set. Alternatively, after predicting the service data at a plurality of time points subsequent to the current time point, the service data at the plurality of time points may be determined as predicted service data, and the predicted service data may be added to the data set. Or after predicting the service data of a plurality of time points after the current time point, processing the service data of the plurality of time points, determining the processed service data as predicted service data, and adding the predicted service data into the data set.

The following describes how to determine a data set in conjunction with a specific application scenario. In this application scenario, a data set is taken as an example of a baseline, and the baseline may include predicted service data at a plurality of time points.

Firstly, acquiring historical service data, such as all service data in the past 24 hours; carrying out data preprocessing on historical service data, filtering invalid historical service data, and remaining valid historical service data; the remaining historical service data are formed into a curve according to the time sequence, where the abscissa is time and the ordinate is the value of the historical service data, as shown in fig. 2A, which is a schematic diagram of the curve of the service data.

The data preprocessing is performed on the historical service data, and may include but is not limited to: and filtering abnormal data such as noise, pressure measurement and the like in the historical service data, for example, filtering the abnormal data such as the noise, the pressure measurement and the like by adopting a median filtering mode, a box diagram denoising mode and the like, wherein the data preprocessing mode is not limited.

Then, traffic data of a plurality of time points subsequent to the current time point may be predicted. Specifically, a difference between the service data of the current time point and the average of the service data of M (e.g., 50) time points before the current time point may be determined, and further, the difference may be mapped to N (e.g., 100) time points after the current time point, so as to obtain the service data of N time points after the current time point.

For example, after the service data a of the current time point is obtained, the service data of 50 time points before the current time point are determined, and the average value B of the service data of the 50 time points is determined. A difference C between the service data a and the average B at the current time point is determined (i.e., the difference C is the service data a-average B), and further, the service data at 100 time points after the current time point is determined to be the service data a plus the difference C.

Then, the service data at 100 time points are combined into a straight line, the abscissa is time, the ordinate is the service data at the 100 time points, and the curve of the historical service data (as shown in fig. 2A) and the service data at the 100 time points are combined to obtain a new curve, which is shown in fig. 2B. Further, fitting the curve shown in fig. 2B, and smoothing the curve after fitting, without limitation to the manner of fitting and smoothing, to finally obtain the curve shown in fig. 2C.

In the above embodiment, when the curve is fitted and the fitted curve is smoothed, a workday and a holiday can be distinguished, and for the business data of the workday, the curve can be fitted and the fitted curve can be smoothed by using an STL (temporal sequential decomposition) algorithm; for the business data of the holidays, fitting processing can be carried out on the curve through a smoothing algorithm, and the curve after fitting processing is carried out smoothing processing.

Further, after obtaining the curve shown in fig. 2C (this curve may also be referred to as a baseline), the traffic data at each time point in the curve may be the predicted traffic data at the time point, and the predicted traffic data at each time point in the curve may be the predicted traffic data in the data set.

Step 1032, determining a service data residual at the current time point according to the actual service data at the current time point and the predicted service data corresponding to the current time point in the data set, where the service data residual may be a difference between the actual service data at the current time point and the predicted service data at the current time point.

For example, assuming that the current time point is time point a (which may not be the same as the current time point in step 1041, for example, time point a is the 10 th time point after the current time point in step 1041), after the service data of time point a is acquired, for convenience of distinction, this service data may be referred to as actual service data. In addition, predicted traffic data (e.g., traffic data a plus difference C) from time point a may be queried from the data set. Then, a difference between the actual traffic data of the time point a and the predicted traffic data of the time point a may be determined, and this difference may be determined as a traffic data residual of the time point a.

Step 1033, performing anomaly detection on the actual service data according to the service data residual and the target monitoring threshold, that is, performing anomaly detection on the actual service data at the current time point according to the service data residual corresponding to the actual service data at the current time point and the target monitoring threshold.

In one example, the anomaly detection of the actual traffic data according to the traffic data residual and the target monitoring threshold may include, but is not limited to: and carrying out anomaly detection on the actual service data at the current time point according to the service data residual error, the historical residual error mean value, the historical residual error variance and the target monitoring threshold value. Of course, the above manner is only an example of performing anomaly detection on actual service data, and is not limited thereto, as long as the anomaly detection can be performed on the actual service data according to the service data residual and the target monitoring threshold.

Specifically, if the difference between the residual error of the service data and the mean value of the historical residual error is greater than the product of the variance of the historical residual error and the target monitoring threshold, it may be determined that the actual service data at the current time point is abnormal; or, if the difference between the residual of the service data and the mean of the historical residual is not greater than the product of the variance of the historical residual and the target monitoring threshold, it may be determined that no abnormality occurs in the actual service data at the current time point.

Before the above steps, a history residual mean value and a history residual variance may be determined, the history residual mean value may be a mean value (may be referred to as a history residual mean value) between the traffic data residuals at a plurality of time points (e.g., T time points) before the current time point, and the history residual variance may be a variance (may be referred to as a history residual variance) between the traffic data residuals at a plurality of time points before the current time point.

For example, assuming that the current time point is time point a, for each of T time points before time point a, the actual service data of the time point and the predicted service data of the time point in the data set may be determined, and the difference between the actual service data of the time point and the predicted service data of the time point is determined as the service data residual of the time point, so that the service data residuals of the T time points are obtained in total. Then, the mean value between the T time points of the traffic data residuals is determined as the historical residual mean value, and the variance between the T time points of the traffic data residuals is determined as the historical residual variance.

Through the processing, the service data residual error of the current time point, the historical residual error mean value and the historical residual error variance of a plurality of time points before the current time point and the target monitoring threshold value can be obtained; further, if the difference between the residual error of the service data and the mean value of the historical residual error is greater than the product of the variance of the historical residual error and the target monitoring threshold value, determining that the actual service data at the current time point is abnormal, and generating an alarm for operation and maintenance personnel; and if the difference between the service data residual error and the historical residual error mean value is not greater than the product of the historical residual error variance and the target monitoring threshold value, determining that the actual service data at the current time point is not abnormal.

In one example, in the process of performing anomaly detection on the service data according to the target monitoring threshold, the target monitoring threshold may also be adjusted. In order to adjust the target monitoring threshold, the target monitoring threshold may be updated to the initial monitoring threshold, and then step 101 to step 104 are performed, except that the initial monitoring threshold in step 101 is the target monitoring threshold to be updated, and other procedures are the same and are not described herein again.

In summary, at intervals, the current target monitoring threshold may be updated to the initial monitoring threshold, the feedback adjustment coefficient is determined again, and the initial monitoring threshold is adjusted according to the feedback adjustment coefficient to obtain a new target monitoring threshold, so that the target monitoring threshold may be continuously adjusted, thereby dynamically updating the target monitoring threshold and ensuring that the target monitoring threshold and the anomaly detection result are more accurate.

In an example, the execution sequence is only an example given for convenience of description, and in practical applications, the execution sequence between steps may also be changed, and the execution sequence is not limited. In other embodiments, the steps of the respective methods are not necessarily performed in the order shown and described herein, and the methods may include more or less steps than those described herein. Moreover, a single step described in this specification may be broken down into multiple steps for description in other embodiments; multiple steps described in this specification may be combined into a single step in other embodiments.

Example two:

an embodiment of the present application provides an anomaly detection method, configured to detect whether a service data (which may also be referred to as a service indicator) is anomalous, as shown in fig. 3, which is a schematic flow diagram of the method, and the method includes:

step 301, acquiring the service data of the current time point, that is, the actual service data of the current time point.

Step 302, generating a data set according to the service data at the current time point. The data set may include traffic data of time points within a first time window (e.g., traffic data of all time points within the first time window), and the current time point is the last time point within the first time window.

The length of the first time window may be configured empirically, for example, the length is N, which means that N time points are included in the first time window, for example, the length N is 5. Thus, the data set may include traffic data for N time points within a first time window, the current time point being the last time point of the N time points, and the other time points being N-1 time points before the current time point.

For example, assuming that the length of the first time window is 5 minutes, each minute corresponds to a time point, and the current time point is 2018.8.2-10:00, the data set may sequentially include service data 1 at time points 2018.8.2-09:56, service data 2 at time points 2018.8.2-09:57, service data 3 at time points 2018.8.2-09:58, service data 4 at time points 2018.8.2-09:59, and service data 5 at time points 2018.8.2-10: 00.

Step 303, determine the statistical characteristics of the data set.

Wherein, the statistical characteristics may include, but are not limited to, one or any combination of the following: a mean value of traffic data at time points (e.g., all time points) within the first time window; a variance of traffic data for time points (e.g., all time points) within the first time window; the service data of the current time point; a difference between the traffic data of the current time point and the traffic data of a designated time point (e.g., a time point previous to the current time point); the current time point is the fourth minute of the day; the current time point is the day of the month; the current time point is the day of the week; the current time point is the hour of the day.

Of course, the above is only an example of the statistical feature, and the content of the statistical feature is not limited.

For example, the statistical characteristics of the data set may include: the average value of the service data 1, the service data 2, the service data 3, the service data 4 and the service data 5; variance of service data 1, service data 2, service data 3, service data 4, and service data 5; service data 5; difference of service data 5 and service data 4; the 600 th minute of the day; day 2 of this month; day 4 of the week; the 10 th hour of the day.

At step 304, a feature value corresponding to the statistical feature is determined.

In one example, determining the feature value corresponding to the statistical feature may include, but is not limited to, the following: and querying a mapping table through the statistical characteristics to obtain a characteristic value corresponding to the statistical characteristics.

In one example, a mapping table may be generated in advance, where the mapping table is used to record a corresponding relationship between a statistical characteristic and a characteristic value, so that after the statistical characteristic of a data set is obtained, the mapping table may be queried according to the statistical characteristic of the data set to obtain the characteristic value corresponding to the statistical characteristic.

And 305, performing anomaly detection on the service data at the current time point according to the characteristic value.

Specifically, if the eigenvalue is a first eigenvalue (for example, 1, and the first eigenvalue 1 indicates that an anomaly occurs), it is determined that the service data at the current time point is anomalous; or, if the characteristic value is a second characteristic value (e.g., 0, and the second characteristic value 0 indicates that no abnormality occurs), determining that no abnormality occurs in the service data at the current time point.

In the above embodiment, the mapping table may be configured empirically or trained according to historical service data, and the generation manner of the mapping table is not limited, and the following example is taken to train the mapping table according to historical service data. Further, the process of training the mapping table according to the historical service data may include, but is not limited to: the historical service data is divided into a plurality of second time windows, the lengths of different second time windows are the same, and the length of the second time window is the same as that of the first time window; the statistical characteristic of the second time window and the characteristic value of the second time window are determined, and the corresponding relation between the statistical characteristic (i.e. the statistical characteristic of the second time window) and the characteristic value (i.e. the characteristic value of the second time window) is recorded in the mapping table.

Wherein, the statistical characteristics may include, but are not limited to, one or any combination of the following: the average value of the service data of all time points in the second time window; variance of traffic data for all time points within a second time window; service data of the last time point in the second time window; a difference between the service data of the last time point within the second time window and the service data of the penultimate time point within the second time window; the last time point within the second time window is the first minute of the day; the last time point within the second time window is the day of the month; the last time point within the second time window is the day of the week; the last time point within the second time window is the hours of the day.

For example, assuming that the length of the second time window is 5 minutes, each minute corresponds to a time point, and the historical traffic data includes all traffic data between the time points 2018.7.1-00: 01-2018.7.31-24: 00, the historical traffic data may be divided into a plurality of second time windows, each of which includes 5 traffic data. For example, the second time window 1 may include traffic data at time points 2018.7.1-00:01, traffic data at time points 2018.7.1-00:02, traffic data at time points 2018.7.1-00:03, traffic data at time points 2018.7.1-00:04, and traffic data at time points 2018.7.1-00: 05. The second time window 2 may include service data at time points 2018.7.1-00:02, service data at time points 2018.7.1-00:03, service data at time points 2018.7.1-00:04, service data at time points 2018.7.1-00:05, and service data at time points 2018.7.1-00: 06. The second time window 3 may include service data at time point 2018.7.1-00:03, service data at time point 2018.7.1-00:04, service data at time point 2018.7.1-00:05, service data at time point 2018.7.1-00:06, service data at time point 2018.7.1-00: 07.

By analogy, taking length 5 as a sliding window, the historical service data is divided into a plurality of second time windows, each second time window corresponds to service data of 5 consecutive time points, and for each second time window, taking second time window 1 as an example, the statistical characteristics may include: the mean value of all the service data in the second time window 1; variance of all traffic data within the second time window 1; service data at time points 2018.7.1-00: 05; difference of service data at time point 2018.7.1-00:05 and service data at time point 2018.7.1-00: 04; the 5 th minute of the day; day 1 of this month; day 7 of the week; hour 1 of the day.

For each second time window, taking the second time window 1 as an example, the characteristic value of the second time window 1 may also be determined, for example, if all the service data of the second time window 1 are not abnormal, the characteristic value of the second time window 1 is determined to be the second characteristic value; and if any one or more of the service data in the second time window 1 is abnormal, determining that the characteristic value of the second time window 1 is the first characteristic value.

Further, for each second time window, after the statistical characteristic and the characteristic value of the second time window are obtained, the corresponding relationship between the statistical characteristic and the characteristic value may be recorded in the mapping table.

Based on the technical scheme, in the embodiment of the application, the monitoring threshold value does not need to be manually set by operation and maintenance personnel, the service data at the current time point can be detected by utilizing the statistical characteristics of the data set where the service data at the current time point is located, the problems that the alarm number of the service data is large, but the accuracy rate of abnormal detection is low are solved, and the problems that the alarm number of the service data is small, but the report missing of the abnormal detection is serious are solved. Moreover, abnormal service data can be automatically detected, and the accuracy of alarming is improved.

Example three:

an embodiment of the present application provides an anomaly detection method, configured to detect whether a service data (which may also be referred to as a service indicator) is anomalous, as shown in fig. 4, which is a schematic flow diagram of the method, and the method includes:

step 401, acquiring the service data at the current time point, that is, the actual service data at the current time point.

Step 402, performing anomaly detection on the service data at the current time point by using a plurality of detection strategies (such as three or more detection strategies) to obtain a detection result of each detection strategy; the detection result of each detection strategy may be that the service data is abnormal or the service data is not abnormal.

Step 403, if the detection results of the at least two detection strategies are that the service data is abnormal, it can be determined that the final detection result of the service data is that the service data is abnormal; if the detection result of one detection strategy is that the service data is abnormal, or the detection results of all the detection strategies are that the service data is not abnormal, it can be determined that the final detection result of the service data is that the service data is not abnormal.

In this embodiment, a plurality of detection strategies (e.g., three or more detection strategies) may be adopted to perform anomaly detection on the service data at the current time point, so as to obtain a detection result of each detection strategy; therefore, when only one detection result of the detection strategy is that the service data is abnormal, or the detection results of all the detection strategies are that the service data is not abnormal, the final detection result of the service data can be determined that the service data is not abnormal; when the detection results of the at least two detection strategies are that the service data is abnormal, the final detection result of the service data is determined to be that the service data is abnormal, and therefore the detection accuracy is improved.

In one example, the detection strategies described above may include, but are not limited to: a threshold detection strategy, a feature detection strategy, and a residual detection strategy, which are just a few examples of the detection strategies, and are not limited thereto.

When the detection policy is a threshold detection policy, the threshold detection policy may be adopted to perform anomaly detection on the service data. Specifically, an initial monitoring threshold value can be obtained, and anomaly detection is performed on the service data according to the initial monitoring threshold value; then, adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value (for example, determining a feedback adjustment coefficient according to the abnormal detection result of the initial monitoring threshold value; and carrying out anomaly detection on the service data of the current time point according to the target monitoring threshold value.

Determining a feedback adjustment coefficient according to the anomaly detection result of the initial monitoring threshold may include, but is not limited to: determining effective service data and ineffective service data according to the abnormal detection result of the initial monitoring threshold, selecting first service data from the effective service data, and selecting second service data from the ineffective service data; then, a feedback adjustment coefficient is determined according to the first service data and the second service data.

Performing anomaly detection on the service data at the current time point according to the target monitoring threshold, which may include but is not limited to: determining a data set, wherein the data set can comprise predicted business data of a plurality of time points; then, according to the actual service data of the current time point and the corresponding predicted service data of the current time point in the data set, determining the service data residual error of the current time point; then, the actual service data at the current time point may be subjected to anomaly detection according to the service data residual and the target monitoring threshold.

Determining a data set may include, but is not limited to: acquiring historical service data, and predicting service data of a plurality of time points behind the current time point; then, processing the historical service data and the service data of the plurality of time points, and determining the processed service data as predicted service data; the predicted traffic data is then added to the data set, so that the data set is obtained.

Performing anomaly detection on the actual service data at the current time point according to the service data residual and the target monitoring threshold, which may include but is not limited to: and carrying out anomaly detection on the actual service data at the current time point according to the service data residual error, the historical residual error mean value, the historical residual error variance and the target monitoring threshold value.

When the detection policy is a threshold detection policy, reference may be made to the implementation of the first embodiment for a process of performing anomaly detection on the service data by using the threshold detection policy, and details are not repeated here.

When the detection strategy is a feature detection strategy, the feature detection strategy can be adopted to perform anomaly detection on the service data. Specifically, a data set may be generated according to the service data at the current time point, and the statistical characteristics of the data set may be determined; and then, determining a characteristic value corresponding to the statistical characteristic, and performing anomaly detection on the service data at the current time point according to the characteristic value. Further, the data set may include, but is not limited to: service data of a time point in a first time window, wherein the current time point is the last time point in the first time window; moreover, the statistical features may include, but are not limited to, one or any combination of the following: a mean value of the service data of the time point within the first time window; a variance of traffic data for a time point within a first time window; service data of a current time point; the difference between the service data at the current time point and the service data at the specified time point; the current time point is the third minute of the day; the current time point is the day of the month; the current time point is the day of the week; the current time point is the hours of the day.

Determining a feature value corresponding to the statistical feature may include, but is not limited to: querying a mapping table through the statistical characteristic to obtain a characteristic value corresponding to the statistical characteristic; the mapping table may be used to record the corresponding relationship between the statistical characteristic and the characteristic value. To generate the mapping table, the following method may also be adopted: the historical service data is divided into a plurality of second time windows, the lengths of different second time windows are the same, and the length of the second time window is the same as that of the first time window; determining the statistical characteristics of the second time window and the characteristic value of the second time window; and recording the corresponding relation between the statistical characteristics and the characteristic values in the mapping table.

Performing anomaly detection on the service data at the current time point according to the feature value, which may include but is not limited to: if the characteristic value is the first characteristic value, determining that the service data at the current time point is abnormal; if the characteristic value is the second characteristic value, it may be determined that the service data at the current time point is not abnormal.

When the detection policy is the feature detection policy, reference may be made to the implementation of the second embodiment for a process of performing anomaly detection on the service data by using the feature detection policy, and details are not repeated here.

When the detection strategy is a residual detection strategy, the residual detection strategy can be adopted to perform anomaly detection on the service data. Specifically, a third time window and a fourth time window are determined, wherein the third time window and the fourth time window both comprise current time points, and the length of the fourth time window is greater than that of the third time window; determining a first mean value according to the service data residual error of each time point in the third time window, and determining a second mean value and a variance according to the service data residual error of each time point in the fourth time window; and carrying out anomaly detection on the service data according to the first mean value, the second mean value and the variance.

In one example, a data set may also be determined, which may include predicted traffic data for a plurality of time points; then, the service data residual of each time point can be determined according to the actual service data of each time point in the third time window and the corresponding predicted service data of the time point in the data set; in addition, the service data residual of each time point in the fourth time window may be determined according to the actual service data of the time point and the corresponding predicted service data of the time point in the data set.

The following describes a process of performing anomaly detection on service data by using a residual error detection strategy, with reference to a specific embodiment. When the residual error detection strategy is adopted to detect the abnormity of the service data, a data set is determined firstly, wherein the data set comprises predicted service data of a plurality of time points; for example, historical service data may be obtained, and service data of a plurality of time points subsequent to the current time point may be predicted; processing the historical service data and the service data of the plurality of time points, and determining the processed service data as predicted service data; adding the predicted service data to a data set; the specific determination method can be seen in step 1041.

Then, two time windows are selected, which are respectively called a third time window and a fourth time window, wherein the third time window and the fourth time window both comprise the current time point, and the length of the fourth time window is greater than that of the third time window. The length of the third time window may be configured empirically, for example, the length is W, which means that W time points are included in the third time window, for example, W is 5. The length of the fourth time window may be configured empirically, where the length is S, which means that S time points are included in the fourth time window, and S is 10000 or the like, where S may be much larger than W.

Wherein, among the W time points included in the third time window, the current time point may be the last time point among the W time points, and the other time points may be W-1 time points before the current time point. Further, among the S time points included in the fourth time window, the current time point may be the last time point among the S time points, and the other time points may be S-1 time points before the current time point.

For each time point in the third time window, a service data residual at the time point, that is, a difference between actual service data and predicted service data, may be determined according to the actual service data at the time point and the predicted service data corresponding to the time point in the data set; then, an average value of the service data residuals of each time point in the third time window is determined, and a first average value is obtained. For each time point in the fourth time window, a service data residual at the time point, that is, a difference between actual service data and predicted service data, may be determined according to the actual service data at the time point and the predicted service data corresponding to the time point in the data set; then, determining a mean value of the service data residuals of each time point in the fourth time window to obtain a second mean value, and determining a variance of the service data residuals of each time point in the fourth time window.

Furthermore, anomaly detection can be performed on the service data according to the first mean value, the second mean value and the variance. For example, assuming the first mean is W1, the second mean is W2, and the variance is S: if it is

If yes, the abnormal business data can be determined, and if yes, the abnormal business data can be determined

If not, it can be determined that the service data is not abnormal. Where erf represents the error function. Of course, the above is only an example, and the detection method is not limited as long as the anomaly detection is performed on the traffic data according to the first mean, the second mean and the variance.

Based on the same application concept as the method, an embodiment of the present application further provides an abnormality detection apparatus, as shown in fig. 5, which is a structural diagram of the apparatus, and the apparatus may include:

an obtaining module 501, configured to obtain an initial monitoring threshold; a detection module 502, configured to perform anomaly detection on the service data according to the initial monitoring threshold; the obtaining module 501 is further configured to adjust the initial monitoring threshold according to an anomaly detection result of the initial monitoring threshold, so as to obtain a target monitoring threshold; the detection module 502 is further configured to perform anomaly detection on the service data according to the target monitoring threshold.

The obtaining module 501 adjusts the initial monitoring threshold according to the abnormal detection result of the initial monitoring threshold, and when obtaining the target monitoring threshold, the obtaining module is specifically configured to: determining a feedback regulation coefficient according to an abnormal detection result of the initial monitoring threshold; and adjusting the initial monitoring threshold value according to the feedback adjustment coefficient to obtain a target monitoring threshold value.

The detecting module 502 is specifically configured to, when performing anomaly detection on service data according to the target monitoring threshold: determining a data set, wherein the data set comprises predicted service data of a plurality of time points; determining a service data residual error of the current time point according to actual service data of the current time point and corresponding predicted service data of the current time point in the data set; and carrying out anomaly detection on the actual service data according to the service data residual and the target monitoring threshold.

The detection module 502 is specifically configured to, when determining the data set: acquiring historical service data, and predicting service data of a plurality of time points behind the current time point; processing the historical service data and the service data of the plurality of time points; determining the processed service data as predicted service data; adding the predicted traffic data to the data set.

Based on the same concept as the above method, the present embodiment also provides an abnormality detection apparatus, including: a processor and a machine-readable storage medium; the machine-readable storage medium has stored thereon a plurality of computer instructions, which when executed by the processor, perform the following: acquiring an initial monitoring threshold value, and carrying out anomaly detection on service data according to the initial monitoring threshold value; adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value; and carrying out anomaly detection on the service data according to the target monitoring threshold.

The present embodiments also provide a machine-readable storage medium having stored thereon computer instructions that, when executed, perform the following: acquiring an initial monitoring threshold, and performing anomaly detection on service data according to the initial monitoring threshold; adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value; and carrying out anomaly detection on the service data according to the target monitoring threshold.

Based on the same application concept as the method, an embodiment of the present application further provides an abnormality detection apparatus, as shown in fig. 6, which is a structural diagram of the apparatus, and the apparatus may include:

an obtaining module 601, configured to obtain service data of a current time point;

a generating module 602, configured to generate a data set according to the service data at the current time point;

a determining module 603 configured to determine statistical characteristics of the data set;

the determining module 603 is further configured to determine a feature value corresponding to the statistical feature;

a detecting module 604, configured to perform anomaly detection on the service data according to the feature value.

The data set comprises traffic data of time points within a first time window, and the current time point is the last time point within the first time window;

wherein the statistical characteristics comprise one or any combination of the following: a mean value of the service data of the time point within the first time window; a variance of traffic data for a point in time within the first time window; service data of a current time point; the difference between the service data at the current time point and the service data at the specified time point; the current time point is the third minute of the day; the current time point is the day of the month; the current time point is the day of the week; the current time point is the hours of the day.

Based on the same concept as the above method, the present embodiment also provides an abnormality detection apparatus, including: a processor and a machine-readable storage medium; the machine-readable storage medium has stored thereon a plurality of computer instructions, which when executed by the processor, perform the following: acquiring service data of a current time point; generating a data set according to the service data of the current time point; determining statistical characteristics of the data set; determining a feature value corresponding to the statistical feature; and carrying out anomaly detection on the service data according to the characteristic value.

The present embodiments also provide a machine-readable storage medium having stored thereon computer instructions that, when executed, perform the following: acquiring service data of a current time point; generating a data set according to the service data of the current time point; determining statistical characteristics of the data set; determining a feature value corresponding to the statistical feature; and carrying out anomaly detection on the service data according to the characteristic value.

Based on the same application concept as the method, an embodiment of the present application further provides an abnormality detection apparatus, as shown in fig. 7, which is a structural diagram of the apparatus, and the apparatus may include:

an obtaining module 701, configured to obtain service data of a current time point;

a detection module 702, configured to perform anomaly detection on the service data by using multiple detection strategies to obtain a detection result of each detection strategy; the detection result of each detection strategy is that the service data is abnormal or the service data is not abnormal;

a determining module 703, configured to determine that a final detection result of the service data is that the service data is abnormal if detection results of the at least two detection strategies are that the service data is abnormal;

The detection policy includes a threshold detection policy, and the detection module 702 is specifically configured to, when performing anomaly detection on the service data by using the threshold detection policy: acquiring an initial monitoring threshold value, and carrying out anomaly detection on service data according to the initial monitoring threshold value; adjusting the initial monitoring threshold according to the abnormal detection result of the initial monitoring threshold to obtain a target monitoring threshold; and carrying out anomaly detection on the service data of the current time point according to the target monitoring threshold.

The detection policy includes a feature detection policy, and the detection module 702 is specifically configured to, when performing anomaly detection on the service data by using the feature detection policy: generating a data set according to the service data of the current time point; determining statistical characteristics of the data set; determining a feature value corresponding to the statistical feature; and carrying out anomaly detection on the service data according to the characteristic value.

The detection strategy includes a residual detection strategy, and the detection module 702 is specifically configured to, when performing the anomaly detection on the service data by using the residual detection strategy:

determining a third time window and a fourth time window, wherein the third time window and the fourth time window both comprise a current time point, and the length of the fourth time window is greater than that of the third time window;

determining a first mean value according to the service data residual error of each time point in the third time window, and determining a second mean value and a variance according to the service data residual error of each time point in the fourth time window;

and carrying out anomaly detection on the service data according to the first mean value, the second mean value and the variance.

Based on the same concept as the above method, the present embodiment also provides an abnormality detection apparatus, including: a processor and a machine-readable storage medium; the machine-readable storage medium has stored thereon a plurality of computer instructions, which when executed by the processor, perform the following: acquiring service data of a current time point; performing anomaly detection on the service data by adopting a plurality of detection strategies to obtain a detection result of each detection strategy; the detection result of each detection strategy is that the service data is abnormal or not abnormal; if the detection results of the at least two detection strategies are that the service data are abnormal, determining that the final detection result of the service data is that the service data are abnormal; and if the detection result of one detection strategy is that the service data is abnormal, determining that the final detection result of the service data is that the service data is not abnormal.

The present embodiments also provide a machine-readable storage medium having stored thereon computer instructions that, when executed, perform the following: acquiring service data of a current time point; performing anomaly detection on the service data by adopting a plurality of detection strategies to obtain a detection result of each detection strategy; the detection result of each detection strategy is that the service data is abnormal or not abnormal; if the detection results of the at least two detection strategies are that the service data are abnormal, determining that the final detection result of the service data is that the service data are abnormal; and if the detection result of one detection strategy is that the service data is abnormal, determining that the final detection result of the service data is that the service data is not abnormal.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may take the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

Furthermore, these computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An anomaly detection method, characterized in that it comprises:

adjusting the initial monitoring threshold value according to the abnormal detection result of the initial monitoring threshold value to obtain a target monitoring threshold value;

and carrying out anomaly detection on the service data according to the target monitoring threshold.

2. The method of claim 1, wherein obtaining an initial monitoring threshold comprises:

obtaining a confidence interval, wherein the confidence interval comprises a plurality of confidence values;

selecting a partial confidence value from a plurality of confidence values for the confidence interval;

and determining the initial monitoring threshold according to the partial confidence value.

3. The method according to claim 1, wherein the adjusting the initial monitoring threshold according to the anomaly detection result of the initial monitoring threshold to obtain a target monitoring threshold comprises:

determining a feedback regulation coefficient according to an abnormal detection result of the initial monitoring threshold;

and adjusting the initial monitoring threshold value according to the feedback adjustment coefficient to obtain a target monitoring threshold value.

4. The method of claim 3,

the determining a feedback adjustment coefficient according to the abnormal detection result of the initial monitoring threshold includes:

determining effective service data and ineffective service data according to the abnormal detection result;

selecting first service data from the effective service data;

selecting second service data from the invalid service data;

and determining a feedback adjustment coefficient according to the first service data and the second service data.

5. The method of claim 4,

selecting first service data from the valid service data comprises: sequencing the effective service data, and selecting the effective service data at a first position from the sequenced effective service data as first service data;

selecting second service data from the invalid service data comprises: and sequencing the invalid service data, and selecting the invalid service data at the second position from the sequenced invalid service data as second service data.

6. The method of claim 3, wherein the adjusting the initial monitoring threshold according to the feedback adjustment factor to obtain a target monitoring threshold comprises:

and determining the sum of the feedback adjusting coefficient and the initial monitoring threshold as a target monitoring threshold.

7. The method of claim 1,

the abnormal detection of the service data according to the target monitoring threshold value comprises the following steps:

determining a data set, wherein the data set comprises predicted service data of a plurality of time points;

determining a service data residual error of the current time point according to actual service data of the current time point and corresponding predicted service data of the current time point in the data set;

and carrying out anomaly detection on the actual service data according to the service data residual and the target monitoring threshold.

8. The method of claim 7, wherein the determining the set of data comprises:

acquiring historical service data, and predicting service data of a plurality of time points behind the current time point;

processing the historical service data and the service data of the plurality of time points;

determining the processed service data as predicted service data;

adding the predicted traffic data to the data set.

9. The method of claim 7, wherein the performing anomaly detection on actual traffic data according to the traffic data residual and a target monitoring threshold comprises:

and carrying out anomaly detection on the actual service data according to the service data residual error, the historical residual error mean value, the historical residual error variance and the target monitoring threshold value.

10. The method of claim 9,

the performing anomaly detection on the actual service data according to the service data residual error, the historical residual error mean value, the historical residual error variance and the target monitoring threshold value comprises:

if the difference between the service data residual and the historical residual mean value is larger than the product of the historical residual variance and the target monitoring threshold, determining that the actual service data is abnormal;

and if the difference between the service data residual and the historical residual mean value is not greater than the product of the historical residual variance and the target monitoring threshold, determining that the actual service data is not abnormal.

11. An anomaly detection method, characterized in that it comprises:

acquiring service data of a current time point;

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

12. The method of claim 11, wherein the data set comprises traffic data for time points within a first time window, and wherein the current time point is a last time point within the first time window; wherein the statistical characteristics comprise one or any combination of the following:

a mean value of the service data of the time point within the first time window; a variance of traffic data for a point in time within the first time window; service data of a current time point; the difference between the service data at the current time point and the service data at the specified time point; the current time point is the third minute of the day; the current time point is the day of the month; the current time point is the day of the week; the current time point is the hours of the day.

13. The method of claim 11,

the determining a feature value corresponding to the statistical feature includes:

querying a mapping table through the statistical characteristics to obtain a characteristic value corresponding to the statistical characteristics;

the mapping table is used for recording the corresponding relation between the statistical characteristics and the characteristic values.

14. The method of claim 13, further comprising:

dividing historical service data into a plurality of second time windows, wherein the lengths of different second time windows are the same, and the length of the second time window is the same as that of the first time window;

determining the statistical characteristics of the second time window and the characteristic values of the second time window;

and recording the corresponding relation between the statistical characteristics and the characteristic values in the mapping table.

15. The method of claim 11,

the performing anomaly detection on the service data according to the feature value comprises:

if the characteristic value is a first characteristic value, determining that the service data is abnormal;

and if the characteristic value is a second characteristic value, determining that the service data is not abnormal.

16. An anomaly detection method, characterized in that it comprises:

acquiring service data of a current time point;

17. The method of claim 16, wherein the detection policy comprises a threshold detection policy, and wherein performing anomaly detection on the traffic data using the threshold detection policy comprises:

and carrying out anomaly detection on the service data of the current time point according to the target monitoring threshold.

18. The method according to claim 17, wherein the adjusting the initial monitoring threshold according to the anomaly detection result of the initial monitoring threshold to obtain a target monitoring threshold comprises:

19. The method of claim 18,

selecting first service data from the effective service data;

selecting second service data from the invalid service data;

20. The method of claim 17, wherein the performing anomaly detection on the traffic data at the current time point according to the target monitoring threshold comprises:

21. The method of claim 20, wherein the determining the set of data comprises:

determining the processed service data as predicted service data;

adding the predicted traffic data to the data set.

22. The method of claim 20, wherein the performing anomaly detection on actual traffic data according to the traffic data residual and a target monitoring threshold comprises:

and carrying out anomaly detection on the actual service data at the current time point according to the service data residual error, the historical residual error mean value, the historical residual error variance and the target monitoring threshold value.

23. The method of claim 16, wherein the detection policy comprises a feature detection policy, and performing anomaly detection on the service data by using the feature detection policy comprises:

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

24. The method of claim 23, wherein the data set comprises traffic data for time points within a first time window, and wherein the current time point is a last time point within the first time window; wherein the statistical characteristics comprise one or any combination of the following:

25. The method of claim 23,

26. The method of claim 25, further comprising:

27. The method of claim 16, wherein the detection strategy comprises a residual detection strategy, and wherein performing anomaly detection on the traffic data using the residual detection strategy comprises:

28. The method of claim 27, further comprising:

determining a service data residual error of each time point according to the actual service data of each time point in the third time window and the corresponding predicted service data of the time point in the data set;

and determining a service data residual error of each time point according to the actual service data of each time point in the fourth time window and the corresponding predicted service data of the time point in the data set.

29. An abnormality detection apparatus, characterized in that the apparatus comprises:

30. The apparatus of claim 29,

the acquisition module adjusts the initial monitoring threshold according to the abnormal detection result of the initial monitoring threshold, and is specifically used for:

31. The apparatus according to claim 29, wherein the detecting module is specifically configured to, when performing anomaly detection on the service data according to the target monitoring threshold:

32. An abnormality detection apparatus, characterized in that the apparatus comprises:

33. The apparatus of claim 32, wherein the data set comprises traffic data for time points within a first time window, and wherein the current time point is a last time point within the first time window; wherein the statistical characteristics comprise one or any combination of the following:

34. An abnormality detection apparatus, characterized in that the apparatus comprises:

35. The apparatus of claim 34,

the detection strategy comprises a threshold detection strategy, and the detection module is specifically configured to, when performing anomaly detection on the service data by using the threshold detection strategy:

36. The apparatus of claim 34,

the detection strategy comprises a feature detection strategy, and the detection module is specifically configured to, when performing anomaly detection on the service data by using the feature detection strategy:

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

37. The apparatus of claim 34,

the detection strategy comprises a residual error detection strategy, and the detection module is specifically configured to, when performing anomaly detection on the service data by using the residual error detection strategy:

38. An abnormality detection apparatus characterized by comprising:

39. An abnormality detection apparatus characterized by comprising:

acquiring service data of a current time point;

generating a data set according to the service data of the current time point;

determining statistical characteristics of the data set;

determining a feature value corresponding to the statistical feature;

40. An abnormality detection apparatus characterized by comprising:

acquiring service data of a current time point;