CN110909306B - Business abnormality detection method and device, electronic equipment and storage equipment - Google Patents
Business abnormality detection method and device, electronic equipment and storage equipment Download PDFInfo
- Publication number
- CN110909306B CN110909306B CN201811081466.3A CN201811081466A CN110909306B CN 110909306 B CN110909306 B CN 110909306B CN 201811081466 A CN201811081466 A CN 201811081466A CN 110909306 B CN110909306 B CN 110909306B
- Authority
- CN
- China
- Prior art keywords
- data
- point
- current service
- baseline
- service point
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Human Resources & Organizations (AREA)
- Strategic Management (AREA)
- Computational Mathematics (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Operations Research (AREA)
- Economics (AREA)
- Pure & Applied Mathematics (AREA)
- Mathematical Physics (AREA)
- Game Theory and Decision Science (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Development Economics (AREA)
- Probability & Statistics with Applications (AREA)
- Algebra (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- Entrepreneurship & Innovation (AREA)
- Marketing (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Debugging And Monitoring (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application discloses a business anomaly detection method, which comprises the following steps: obtaining first data; the first data comprises historical business data; obtaining a baseline containing future trends of the business data according to the first data; predicting whether the current service point is an abnormal point according to at least the baseline. By adopting the method, the problem of false alarm of service detection is solved.
Description
Technical Field
The application relates to the technical field of service monitoring, in particular to a service abnormality detection method, a device, electronic equipment and storage equipment.
Background
In the field of anomaly detection, the existing method is to set a static threshold value to alarm through manual expert knowledge combing. Firstly, a business scene describing the occurrence of the abnormality is established, and the time of the occurrence of the abnormality and the set business abnormality index value are qualitatively described in the scene. When new business data appears, the current business data is compared with a preset business abnormality index value, so that abnormality detection is further carried out.
According to the anomaly detection method provided by the prior art, only the rising and falling trend curves of the current time interval (for example, 5 minutes) can be seen manually when the threshold is set, and the periodicity of the historical data curves and the rising and falling trend of the periodicity cannot be seen, so that the manually set static threshold is inaccurate, and false alarm is often caused.
Disclosure of Invention
The application provides a business anomaly detection method, a business anomaly detection device, electronic equipment and storage equipment, and aims to solve the problem that false alarm occurs in existing business anomaly detection.
The application provides a business anomaly detection method, which comprises the following steps:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point according to at least the baseline.
Optionally, the first data includes: workday data and holiday data.
Optionally, the method further comprises:
denoising the first data to obtain second data;
and obtaining a baseline containing future trends of the business data according to the second data.
Alternatively to this, the method may comprise,
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining the working day baseline and the holiday baseline to obtain the baselines.
Alternatively to this, the method may comprise,
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data curve are subjected to difference value with the average value;
and taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the preset number of future service points of the current service point.
Optionally, obtaining a working day baseline and a holiday baseline according to the combined data includes:
extracting working day data from the combined data, and generating a working day base line by adopting an STL algorithm;
and extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
Obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual errors of the service point and the historical residual errors, the abnormal detection parameters and the feedback adjustment parameters.
Optionally, the determining whether the current service point is an abnormal point at least according to one of the obtained residual error of the service point and the obtained variance of the historical residual error, the abnormality detection parameter and the feedback adjustment parameter includes:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is variance; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
Optionally, the obtaining the abnormality detection parameter according to the baseline includes:
obtaining the variation of the mean and variance of the residual error according to the baseline and the first data;
acquiring a time interval according to the variation of the mean and the variance of the residual error;
obtaining a residual sequence in the time interval according to the baseline and the first data;
determining the confidence level of the time interval;
And carrying out Gaussian treatment on the residual sequence according to the confidence coefficient to obtain an abnormality detection parameter of the time interval.
Optionally, the obtaining a feedback adjustment parameter according to the baseline includes:
and determining feedback regulation parameters according to the percentile of the effective alarms and the percentile of the ineffective alarms in the time interval.
Optionally, the feedback adjustment parameter is determined according to the percentile of the effective alarm and the percentile of the ineffective alarm in the time interval. Comprising the following steps:
determining a percentile x of effective alarms and a percentile y of ineffective alarms in the time interval;
when x > =y, delta=y×exp (y/x-1);
when x > y, delta=x/(1+exp (-y/x));
wherein delta is the feedback adjustment parameter.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error according to the base line;
judging whether the current service point residual is an extreme residual or not;
if yes, determining the service point as an abnormal point.
Optionally, the determining whether the current service point residual is an extreme residual includes:
selecting a window comprising the current time point and a third preset time interval residual error before the current time point from the baseline as a first sliding window;
Selecting a window comprising the current time point and a fourth preset time interval residual error before the current time point from the baseline as a second sliding window;
and judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window.
Optionally, determining whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window includes:
if the following formula is satisfied: 0.499< = 0.5 x erf ((w_1_mean; w_2_mean)/(w_1_std x w_2_std)), then determining the current service point residual as an extreme residual;
wherein W_1_mean is the residual sequence mean of the first sliding window;
w_2_mean is the residual sequence mean of the second sliding window;
w_1_std is the residual sequence variance of the first sliding window;
w_2_std is the residual sequence variance of the second sliding window.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
obtaining a sliding window with the length of the current time point data being a fifth preset time interval according to the baseline;
Calculating the characteristic value of the sliding window;
performing logistic regression detection according to the characteristic value;
and determining whether the service point is an abnormal point according to the result of the logistic regression detection.
The application also provides a business anomaly detection device, which comprises:
a first data obtaining unit configured to obtain first data; the first data comprises historical business data;
the baseline obtaining unit is used for obtaining a baseline containing future trends of the business data according to the first data;
and the abnormal point judging unit is used for predicting whether the current service point is an abnormal point or not at least according to the base line.
The application also provides an electronic device comprising:
a processor; and
and the memory is used for storing a program of the business abnormality detection method, and after the equipment is electrified and runs the program of the business abnormality detection method through the processor, the following steps are executed:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point according to at least the baseline.
The present application also provides a storage device storing a program of a business anomaly detection method, the program being executed by a processor to perform the steps of:
Obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point according to at least the baseline.
Compared with the prior art, the application has the following advantages:
the application provides the device, the electronic equipment and the storage equipment, wherein the baseline containing the future trend of the service data is obtained according to the historical service data, and whether the current service point is an abnormal point or not is predicted according to the baseline, so that the accuracy of prediction is improved, and the problem of false alarm is effectively solved.
Drawings
Fig. 1 is a flowchart of a method for detecting a business anomaly according to a first embodiment of the present application.
Fig. 2 is a schematic diagram of generating a baseline provided in the first embodiment of the present application.
Fig. 3 is a schematic diagram of a business anomaly detection device according to a second embodiment of the present application.
Fig. 4 is a schematic diagram of an electronic device according to a third embodiment of the present application.
Detailed Description
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. The present invention may be embodied in many other forms than those herein described, and those skilled in the art will readily appreciate that the present invention may be similarly embodied without departing from the spirit or essential characteristics thereof, and therefore the present invention is not limited to the specific embodiments disclosed below.
A first embodiment of the present application provides a method for detecting a traffic anomaly, which is described below with reference to fig. 1.
As shown in fig. 1, in step S101, first data is obtained; the first data includes historical business data.
The business data refer to data monitored by a monitoring system, and when the data are monitored to be abnormal, an alarm is given, and the business data comprise transaction amount of an e-commerce platform and the like. The first data also comprises time information corresponding to the service data.
The first data includes: workday data and holiday data. As shown in fig. 1, in step S102, a baseline including future trends of the business data is obtained according to the first data.
Because some noise may exist in the first data, the first data may be denoised to obtain the second data before the baseline is generated using the first data.
When noise, pressure measurement and other abnormal data are filtered out from the first data, a median filtering method, a box diagram and other denoising methods in a time sequence can be adopted.
The step of obtaining a baseline containing future trends of the business data according to the first data comprises the following steps: and obtaining a baseline containing future trends of the business data according to the second data.
The obtaining a baseline containing future trends of the business data according to the second data comprises the following steps:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining the working day baseline and the holiday baseline to obtain the baselines.
As shown in fig. 2, a schematic diagram of a baseline including future trends of business data is obtained from the first data. Firstly, acquiring the values of 100 service points in the future according to the average difference value between the current point (current service point) and 100 service points in the history; combining the data of the curve of the working day/holiday obtained during pretreatment with the values of 100 service points in the future, extracting holiday data from the combined data, moving smoothly to generate a base line, and generating a seasonal and trend curve through STL; meanwhile, working day data are extracted from the combined data, a base line is generated through an STL algorithm, and season and trend curves are stored; combining the baselines to obtain the baselines containing future trends.
Mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points can comprise the following steps:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
and taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the preset number of future service points of the current service point.
Obtaining a working day baseline and a holiday baseline according to the combined data, wherein the working day baseline and the holiday baseline comprise:
extracting working day data from the combined data, and generating a working day base line by adopting an STL algorithm;
And extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
STL is an english abbreviation for standard Template Library standard template library, which contains basic data structures and basic algorithms commonly used in the field of computer science.
The process of deriving a baseline containing future trends in the business data from the second data is described below in connection with specific examples.
1. Calculating an average value of data of a preset number of historical service points aiming at the current service point in the second data: if the preset number is 100, the time point corresponding to the current service point is 10 points, and if 1 service point is arranged every 1 minute, the data of 100 historical service points before 10 points refer to the data of the historical service points corresponding to 100 time points such as 9:59, 9:58, 9:57 … … and the like. The average value is the average value of the data of the 100 historical service points.
2. Compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval: if the first preset time interval is 2 months and the second preset time interval is 1 day, data 2 months before the current service point in the second data are compressed into data of 1 day.
3. The data of a second preset sub-time interval of the preset number aiming at the current service point is taken out from the data of the second preset time interval: data of 100 service points after 10 points 01 are taken out from the data of 1 day.
4. And making a difference between the data of the preset number of service points behind the current service point and the average value: and (3) subtracting the data of 100 service points after the 10 points 01 extracted in the step (3) from the average value to obtain 100 corresponding difference values.
5. And taking the sum of the preset number of historical service point data of the current service point and the corresponding difference value as the preset number of future service point data of the current service point.
6. And combining the preset number of future service point data with the data of the second data to obtain combined data.
7. And extracting workday data from the combined data, and generating a workday baseline by adopting an STL algorithm.
8. And extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
9. And combining the working day baseline and the holiday baseline to obtain the baselines.
As shown in fig. 1, in step S103, it is predicted whether the current service point is an outlier based on the baseline.
Predicting whether the current service point is an abnormal point according to the baseline comprises the following steps:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual errors of the service point and the historical residual errors, the abnormal detection parameters and the feedback adjustment parameters.
In specific implementation, whether the current service point is an abnormal point can be judged according to the current service point residual error, the historical residual error mean value, the variance of the historical residual error, the abnormal detection parameter and the feedback adjustment parameter:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
The abnormality detection parameter may be obtained by:
obtaining the variation of the mean and variance of the residual error according to the baseline and the first data;
acquiring a time interval according to the variation of the mean and the variance of the residual error;
obtaining a residual sequence of the time interval according to the base line and the first data;
Determining the confidence level of the time interval;
and carrying out Gaussian treatment on the residual sequence according to the confidence coefficient to obtain an abnormality detection parameter of the time interval.
And the residual error refers to the difference between the service point data of the base line and the service point data of the corresponding first data curve.
The residual sequence in the time interval refers to a sequence consisting of all residuals in the time interval.
The variance refers to the average value of the sum of squares of the differences between the data of each service point in the time interval and the average value of the data of all service points in the time interval.
Since the tolerance of the traffic to the anomaly is different in different time intervals, different anomaly detection parameters need to be set in different time intervals of a day. The variation of the mean and variance of the residual error can be obtained according to the base line and the first data; the time interval is acquired according to the variation of the mean and variance of the residual, for example, the morning (7 points, 10 points) is taken as one time interval and the (10 points, 12 points) is taken as one time interval according to the variation of the mean and variance of the residual, and the abnormality detection parameters of each time interval are different. The initial value setting is given a confidence interval alpha, which is an initialized abnormality detection interval value obtained according to historical event data, and the residual sequence is subjected to Gaussian and side-by-side arrangement to obtain 5% of quantiles as an abnormality detection parameter n.
The feedback adjustment parameters may be obtained by:
and determining feedback regulation parameters according to the percentile of the effective alarms and the percentile of the ineffective alarms in the time interval.
And determining a feedback regulation parameter according to the percentile of the effective alarm and the percentile of the ineffective alarm in the time interval. Comprising the following steps:
determining a percentile x of effective alarms and a percentile y of ineffective alarms in the time interval;
when x > =y, delta=y×exp (y/x-1);
when x > y, delta=x/(1+exp (-y/x));
wherein delta is the feedback adjustment parameter.
The alarm record can be marked manually, whether the alarm is accurate or not is fed back, and the alarm result is corrected, so that the percentile of effective alarm and the percentile of ineffective alarm are obtained.
Predicting whether the current service point is an abnormal point according to the baseline, and the following steps can be adopted:
obtaining a current service point residual error according to the base line;
judging whether the current service point residual is an extreme residual or not;
if yes, determining the service point as an abnormal point.
The determining whether the current service point residual is an extreme residual includes:
selecting a window comprising the current time point and a third preset time interval residual error before the current time point from the baseline as a first sliding window;
Selecting a window comprising the current time point and a fourth preset time interval residual error before the current time point from the baseline as a first sliding window;
and judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window.
Judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window, comprising:
if the following formula is satisfied: 0.499< = 0.5 x erf ((w_1_mean; w_2_mean)/(w_1_std x w_2_std)), then determining the current service point residual as an extreme residual;
wherein W_1_mean is the residual sequence mean of the first sliding window;
w_2_mean is the residual sequence mean of the second sliding window;
w_1_std is the residual sequence variance of the first sliding window;
w_2_std is the residual sequence variance of the second sliding window.
The first sliding window may be a window of a shorter time interval, for example, the first sliding window w_1 may be a window of the last 5 minutes residual including the current time point, if the current time point is 10 points, the first sliding window may be a window of the 5 minutes residual within (9:55 points, 10 points), and the second sliding window w_2 may be a window of the residual 20 days history of the current time point.
Predicting whether the current service point is an abnormal point according to the baseline comprises the following steps:
obtaining a sliding window with the length of the current time point data being a fifth preset time interval according to the baseline;
calculating the characteristic value of the sliding window;
performing logistic regression detection according to the characteristic value;
and determining whether the service point is an abnormal point according to the result of the logistic regression detection.
The characteristic value refers to a value for logistic regression detection, and comprises: the average value and the variance of the data of the service points of the sliding window in the fifth preset time interval, the data of the last service point of the sliding window, the difference value of the data of the last service point of the sliding window and the data of the last service point of the sliding window, the last time point of the sliding window is the minute of the current day, the last time point of the sliding window is the day of the current month, the last time point of the window is the day of the current week, the last time point of the sliding window is the hour of the current day, and whether the last time point of the sliding window is abnormal or not is judged.
The parameters required for logistic regression testing are trained by: the first data is valued through a sliding window with the length of t, and the data mean value, variance and data of the last service point of the sliding window are calculated in the window interval, wherein the data of the last service point of the sliding window is different from the data of the last service point of the sliding window, the last time point of the sliding window is the minute of the current day, the last time point of the sliding window is the day of the current month, the last time point of the sliding window is the day of the current week, the last time point of the sliding window is the hour of the current day, and whether the last time point of the sliding window is abnormal or not is judged. And carrying out logistic regression parameter training through the generated labels of the characteristics and the data, and storing the trained parameters.
It should be noted that, the above three methods for predicting whether the current service point is an abnormal point according to the baseline may be adopted separately, or may be combined for use, where the effect is the best when combined for use. If the three methods are used simultaneously, when the two methods judge that the current service point is an abnormal point, the current service point is determined to be the abnormal point, and the judged abnormal point is more accurate.
Corresponding to the above provided method for detecting business abnormality, the second embodiment of the present application further provides a device for detecting business abnormality.
As shown in fig. 3, the apparatus includes:
a first data obtaining unit 301 for obtaining first data; the first data comprises historical business data;
a baseline obtaining unit 302, configured to obtain a baseline including a future trend of the business data according to the first data;
an outlier judging unit 303, configured to predict whether the current service point is an outlier at least according to the baseline.
Optionally, the first data includes: workday data and holiday data.
Optionally, the apparatus further includes:
the second data obtaining unit is used for carrying out denoising processing on the first data to obtain second data;
the baseline deriving unit includes: and obtaining a baseline subunit according to the second data, wherein the baseline subunit is used for obtaining a baseline containing future trend of the business data according to the second data.
Optionally, the obtaining the baseline subunit according to the second data includes:
a future service point mapping subunit, configured to map an average difference value of data of a preset number of historical service points for the current service point in the second data onto the preset number of future service points;
a data merging subunit, configured to merge the data of the preset number of future service points with the data of the second data curve to obtain merged data;
a working day and holiday base line obtaining subunit, configured to obtain a working day base line and a holiday base line according to the combined data;
and the base line obtaining subunit is used for combining the working day base line and the holiday base line to obtain the base line.
Optionally, the future service point mapping subunit is specifically configured to:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
The data of the historical service points of the preset number of the current service points in the second data are different from the average value;
and taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the preset number of future service points of the current service point.
Optionally, the workday and holiday baselines obtain subunits, specifically for:
extracting working day data from the combined data, and generating a working day base line by adopting an STL algorithm;
and extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
Optionally, the abnormal point judging unit includes:
a parameter obtaining subunit, configured to obtain, according to the baseline, a current service point residual error, an anomaly detection parameter, and a feedback adjustment parameter;
and the abnormal point judging subunit is used for judging whether the current service point is an abnormal point or not according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormal detection parameter and the feedback regulation parameter.
Optionally, the abnormal point judging subunit is specifically configured to:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
Wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
Optionally, the obtaining the abnormality detection parameter according to the baseline includes:
obtaining the variation of the mean and variance of the residual error according to the baseline and the first data;
acquiring a time interval according to the variation of the mean and the variance of the residual error;
obtaining a residual sequence in the time interval according to the base line and the first data;
determining the confidence level of the time interval;
and carrying out Gaussian treatment on the residual sequence according to the confidence coefficient to obtain an abnormality detection parameter of the time interval.
Optionally, the obtaining a feedback adjustment parameter according to the baseline includes:
and determining feedback regulation parameters according to the percentile of the effective alarms and the percentile of the ineffective alarms in the time interval.
Optionally, the feedback adjustment parameter is determined according to the percentile of the effective alarm and the percentile of the ineffective alarm in the time interval. Comprising the following steps:
determining a percentile x of effective alarms and a percentile y of ineffective alarms in the time interval;
When x > =y, delta=y×exp (y/x-1);
when x > y, delta=x/(1+exp (-y/x));
wherein delta is the feedback adjustment parameter.
Optionally, the abnormal point judging unit includes:
a current service point residual error subunit, configured to obtain a current service point residual error according to the baseline;
an extreme residual judgment subunit, configured to judge whether the current service point residual is an extreme residual;
and the abnormal point determining subunit is used for determining the service point as an abnormal point when the output of the extreme residual error judging subunit is yes.
Optionally, the extreme residual judgment subunit is specifically configured to:
selecting a window comprising the current time point and a third preset time interval residual error before the current time point from the baseline as a first sliding window;
selecting a window comprising the current time point and a fourth preset time interval residual error before the current time point from the baseline as a second sliding window;
and judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window.
Optionally, determining whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window includes:
If the following formula is satisfied: 0.499< = 0.5 x erf ((w_1_mean; w_2_mean)/(w_1_std x w_2_std)), then determining the current service point residual as an extreme residual;
wherein W_1_mean is the residual sequence mean of the first sliding window;
w_2_mean is the residual sequence mean of the second sliding window;
w_1_std is the residual sequence variance of the first sliding window;
w_2_std is the residual sequence variance of the second sliding window.
Optionally, the abnormal point judging unit includes:
obtaining a sliding window with the length of the current time point data being a fifth preset time interval according to the baseline;
calculating the characteristic value of the sliding window;
performing logistic regression detection according to the characteristic value;
and determining whether the service point is an abnormal point according to the result of the logistic regression detection.
It should be noted that, for the detailed description of the service abnormality detection apparatus provided in the second embodiment of the present application, reference may be made to the description related to the first embodiment of the present application, which is not repeated here.
Corresponding to the business anomaly detection method provided by the above, the third embodiment of the present application further provides an electronic device.
As shown in fig. 4, the electronic device includes:
A processor 401; and
a memory 402 for storing a program of a business abnormality detection method, the apparatus being powered on and executing the program of the business abnormality detection method by the processor, performing the steps of:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point according to at least the baseline.
Optionally, the first data includes: workday data and holiday data.
Optionally, the electronic device further performs the following steps:
denoising the first data to obtain second data;
the step of obtaining a baseline containing future trends of the business data according to the first data comprises the following steps: and obtaining a baseline containing future trends of the business data according to the second data.
Optionally, the obtaining a baseline including future trends of the business data according to the second data includes:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
combining the data of the preset number of future service points with the second data to obtain combined data;
Obtaining a working day baseline and a holiday baseline according to the combined data;
combining the working day baseline and the holiday baseline to obtain the baselines.
Optionally, the mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points includes:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
and taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the preset number of future service points of the current service point.
Optionally, obtaining a working day baseline and a holiday baseline according to the combined data includes:
Extracting working day data from the combined data, and generating a working day base line by adopting an STL algorithm;
and extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
and judging whether the current service point is an abnormal point or not according to the current service point residual error, the historical residual error mean value, the variance, the abnormal detection parameter and the feedback adjustment parameter.
Optionally, the determining whether the current service point is an abnormal point according to the current service point residual error, the historical residual error mean, the variance, the abnormal detection parameter and the feedback adjustment parameter includes:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is variance; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
Optionally, the obtaining the abnormality detection parameter according to the baseline includes:
obtaining the variation of the mean and variance of the residual error according to the baseline and the first data;
Acquiring a time interval according to the variation of the mean and the variance of the residual error;
obtaining a residual sequence in the time interval according to the base line and the first data curve;
determining the confidence level of the time interval;
and carrying out Gaussian treatment on the residual sequence according to the confidence coefficient to obtain an abnormality detection parameter of the time interval.
Optionally, the obtaining a feedback adjustment parameter according to the baseline includes:
and determining feedback regulation parameters according to the percentile of the effective alarms and the percentile of the ineffective alarms in the time interval.
Optionally, the feedback adjustment parameter is determined according to the percentile of the effective alarm and the percentile of the ineffective alarm in the time interval. Comprising the following steps:
determining a percentile x of effective alarms and a percentile y of ineffective alarms in the time interval;
when x > =y, delta=y×exp (y/x-1);
when x > y, delta=x/(1+exp (-y/x));
wherein delta is the feedback adjustment parameter.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error according to the base line;
judging whether the current service point residual is an extreme residual or not;
If yes, determining the service point as an abnormal point.
Optionally, the determining whether the current service point residual is an extreme residual includes:
selecting a window comprising the current time point and a third preset time interval residual error before the current time point from the baseline as a first sliding window;
selecting a window comprising the current time point and a fourth preset time interval residual error before the current time point from the baseline as a second sliding window;
and judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window.
Optionally, determining whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window includes:
if the following formula is satisfied: 0.499< = 0.5 x erf ((w_1_mean; w_2_mean)/(w_1_std x w_2_std)), then determining the current service point residual as an extreme residual;
wherein W_1_mean is the residual sequence mean of the first sliding window;
w_2_mean is the residual sequence mean of the second sliding window;
W_1_std is the residual sequence variance of the first sliding window;
w_2_std is the residual sequence variance of the second sliding window.
Optionally, predicting whether the current service point is an outlier according to the baseline includes:
obtaining a sliding window with the length of the current time point data being a fifth preset time interval according to the baseline;
calculating the characteristic value of the sliding window;
performing logistic regression detection according to the characteristic value;
and determining whether the service point is an abnormal point according to the result of the logistic regression detection.
It should be noted that, for the detailed description of the electronic device provided in the third embodiment of the present application, reference may be made to the related description of the first embodiment of the present application, which is not repeated here.
Corresponding to the above provided method for detecting abnormal business, the fourth embodiment of the present application further provides a storage device,
a program storing a business abnormality detection method, the program being executed by a processor to execute the steps of:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point according to at least the baseline.
It should be noted that, for the detailed description of the storage device provided in the fourth embodiment of the present application, reference may be made to the related description of the first embodiment of the present application, which is not repeated here.
While the preferred embodiment has been described, it is not intended to limit the invention thereto, and any person skilled in the art may make variations and modifications without departing from the spirit and scope of the invention, so that the scope of the invention shall be defined by the claims of the present application.
In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer readable media, as defined herein, does not include non-transitory computer readable media (transmission media), such as modulated data signals and carrier waves.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
Claims (12)
1. A business anomaly detection method, comprising:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point or not according to at least the baseline;
wherein the first data includes: workday data and holiday data;
denoising the first data to obtain second data;
obtaining a baseline containing future trends of the business data according to the second data;
the obtaining a baseline containing future trends of the business data according to the second data comprises the following steps:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
Combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining a working day baseline and a holiday baseline to obtain the baselines;
wherein mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points may include the following steps:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the future service points of the preset number of the current service point;
Wherein predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormal detection parameter and the feedback adjustment parameter;
the determining whether the current service point is an abnormal point according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormality detection parameter and the feedback adjustment parameter comprises:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
2. The method of claim 1, wherein deriving a weekday baseline and a holiday baseline from the combined data comprises:
extracting working day data from the combined data, and generating a working day base line by adopting an STL algorithm;
and extracting holiday data from the combined data, and generating a holiday baseline by adopting a mobile smoothing algorithm.
3. The method of claim 1, wherein the deriving anomaly detection parameters from the baseline comprises:
obtaining the variation of the mean and variance of the residual error according to the baseline and the first data;
acquiring a time interval according to the variation of the mean and the variance of the residual error;
obtaining a residual sequence in the time interval according to the baseline and the first data;
determining the confidence level of the time interval;
and carrying out Gaussian treatment on the residual sequence according to the confidence coefficient to obtain an abnormality detection parameter of the time interval.
4. A method according to claim 3, wherein said deriving feedback adjustment parameters from said baseline comprises:
and determining feedback regulation parameters according to the percentile of the effective alarms and the percentile of the ineffective alarms in the time interval.
5. The method of claim 4, wherein determining the feedback adjustment parameter based on the percentile of active alarms and the percentile of inactive alarms within the time interval comprises:
determining a percentile x of effective alarms and a percentile y of ineffective alarms in the time interval;
When x > =y, delta=y×exp (y/x-1);
when x > y, delta=x/(1+exp (-y/x));
wherein delta is the feedback adjustment parameter.
6. The method of claim 1, wherein predicting whether a current service point is an outlier based on the baseline comprises:
obtaining a current service point residual error according to the base line;
judging whether the current service point residual is an extreme residual or not;
if yes, determining the service point as an abnormal point.
7. The method of claim 6, wherein said determining whether said current service point residual is an extreme residual comprises:
selecting a window comprising the current time point and a third preset time interval residual error before the current time point from the baseline as a first sliding window;
selecting a window comprising the current time point and a fourth preset time interval residual error before the current time point from the baseline as a second sliding window;
and judging whether the current service point residual is an extreme residual according to the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window.
8. The method of claim 7, wherein determining whether the current service point residual is an extreme residual based on the residual sequence mean and variance of the first sliding window and the residual sequence mean and variance of the second sliding window comprises:
If the following formula is satisfied: 0.499< = 0.5 x erf ((w_1_mean; w_2_mean)/(w_1_std x w_2_std)), then determining the current service point residual as an extreme residual;
wherein W_1_mean is the residual sequence mean of the first sliding window;
w_2_mean is the residual sequence mean of the second sliding window;
w_1_std is the residual sequence variance of the first sliding window;
w_2_std is the residual sequence variance of the second sliding window.
9. The method of claim 1, wherein predicting whether a current service point is an outlier based on the baseline comprises:
obtaining a sliding window with the length of the current time point data being a fifth preset time interval according to the baseline;
calculating the characteristic value of the sliding window;
performing logistic regression detection according to the characteristic value;
and determining whether the service point is an abnormal point according to the result of the logistic regression detection.
10. A traffic anomaly detection device, characterized by comprising:
a first data obtaining unit configured to obtain first data; the first data comprises historical business data;
the baseline obtaining unit is used for obtaining a baseline containing future trends of the business data according to the first data;
An abnormal point judging unit, configured to predict whether the current service point is an abnormal point according to at least the baseline;
wherein the first data includes: workday data and holiday data;
denoising the first data to obtain second data;
obtaining a baseline containing future trends of the business data according to the second data;
the obtaining a baseline containing future trends of the business data according to the second data comprises the following steps:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining a working day baseline and a holiday baseline to obtain the baselines;
wherein mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points may include the following steps:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
Compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the future service points of the preset number of the current service point;
wherein predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormal detection parameter and the feedback adjustment parameter;
the determining whether the current service point is an abnormal point according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormality detection parameter and the feedback adjustment parameter comprises:
If the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
11. An electronic device, comprising:
a processor; and
and the memory is used for storing a program of the business abnormality detection method, and after the equipment is electrified and runs the program of the business abnormality detection method through the processor, the following steps are executed:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
predicting whether the current service point is an abnormal point or not according to at least the baseline;
wherein the first data includes: workday data and holiday data;
denoising the first data to obtain second data;
obtaining a baseline containing future trends of the business data according to the second data;
the obtaining a baseline containing future trends of the business data according to the second data comprises the following steps:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
Combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining a working day baseline and a holiday baseline to obtain the baselines;
wherein mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points may include the following steps:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the future service points of the preset number of the current service point;
Wherein predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormal detection parameter and the feedback adjustment parameter;
the determining whether the current service point is an abnormal point according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormality detection parameter and the feedback adjustment parameter comprises:
if the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
12. A memory device, characterized in that,
a program storing a business abnormality detection method, the program being executed by a processor to execute the steps of:
obtaining first data; the first data comprises historical business data;
obtaining a baseline containing future trends of the business data according to the first data;
Predicting whether the current service point is an abnormal point or not according to at least the baseline;
wherein the first data includes: workday data and holiday data;
denoising the first data to obtain second data;
obtaining a baseline containing future trends of the business data according to the second data;
the obtaining a baseline containing future trends of the business data according to the second data comprises the following steps:
mapping the average difference value of the data of the preset number of historical service points aiming at the current service point in the second data to a preset number of future service points;
combining the data of the preset number of future service points with the second data to obtain combined data;
obtaining a working day baseline and a holiday baseline according to the combined data;
combining a working day baseline and a holiday baseline to obtain the baselines;
wherein mapping the average difference value of the data of the preset number of historical service points for the current service point in the second data to the future preset number of service points may include the following steps:
calculating the average value of the data of the historical service points of the preset number aiming at the current service point in the second data;
Compressing the data of the historical service points in the first preset time interval before the current service point in the second data to obtain the data of the second preset time interval;
taking out the data of the preset number of service points after the current service point from the data of the second preset time interval;
the data of the historical service points of the preset number of the current service points in the second data are different from the average value;
taking the sum of the data of the preset number of service points behind the current service point and the corresponding difference value as the data of the future service points of the preset number of the current service point;
wherein predicting whether the current service point is an outlier according to the baseline includes:
obtaining a current service point residual error, an abnormality detection parameter and a feedback adjustment parameter according to the base line;
judging whether the current service point is an abnormal point or not according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormal detection parameter and the feedback adjustment parameter;
the determining whether the current service point is an abnormal point according to at least one of the obtained residual error of the service point and the variance of the historical residual error, the abnormality detection parameter and the feedback adjustment parameter comprises:
If the current service point residual meets the formula: (x-mean) > std (n+delta), judging the current service point as an abnormal point;
wherein x is the current service point residual error; mean is the historical residual error mean; std is the variance of the history residual; n is an abnormality detection parameter; delta is a feedback adjustment parameter.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811081466.3A CN110909306B (en) | 2018-09-17 | 2018-09-17 | Business abnormality detection method and device, electronic equipment and storage equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811081466.3A CN110909306B (en) | 2018-09-17 | 2018-09-17 | Business abnormality detection method and device, electronic equipment and storage equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110909306A CN110909306A (en) | 2020-03-24 |
| CN110909306B true CN110909306B (en) | 2023-06-16 |
Family
ID=69813481
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811081466.3A Active CN110909306B (en) | 2018-09-17 | 2018-09-17 | Business abnormality detection method and device, electronic equipment and storage equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110909306B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111523084A (en) * | 2020-04-09 | 2020-08-11 | 京东方科技集团股份有限公司 | Service data prediction method and device, electronic equipment and computer readable storage medium |
| CN111898094B (en) * | 2020-07-06 | 2021-04-06 | 广州市吉华勘测股份有限公司 | Method and device for processing foundation pit monitoring data, electronic equipment and storage medium |
| CN113391982B (en) * | 2021-08-17 | 2021-11-23 | 云智慧（北京）科技有限公司 | Monitoring data anomaly detection method, device and equipment |
| CN115017211A (en) * | 2022-06-15 | 2022-09-06 | 平安国际融资租赁有限公司 | Method and device for determining abnormality detection object, storage medium and computer equipment |
| CN116702081B (en) * | 2023-08-07 | 2023-10-24 | 西安格蒂电力有限公司 | Intelligent inspection method for power distribution equipment based on artificial intelligence |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104731816A (en) * | 2013-12-23 | 2015-06-24 | 阿里巴巴集团控股有限公司 | Method and device for processing abnormal business data |
| CN105406991A (en) * | 2015-10-26 | 2016-03-16 | 上海华讯网络系统有限公司 | Method and system for generating service threshold by historical data based on network monitoring indexes |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
| CN108269189A (en) * | 2017-07-05 | 2018-07-10 | 中国中投证券有限责任公司 | Achievement data monitoring method, device, storage medium and computer equipment |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11310247B2 (en) * | 2016-12-21 | 2022-04-19 | Micro Focus Llc | Abnormal behavior detection of enterprise entities using time-series data |
-
2018
- 2018-09-17 CN CN201811081466.3A patent/CN110909306B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104731816A (en) * | 2013-12-23 | 2015-06-24 | 阿里巴巴集团控股有限公司 | Method and device for processing abnormal business data |
| CN105406991A (en) * | 2015-10-26 | 2016-03-16 | 上海华讯网络系统有限公司 | Method and system for generating service threshold by historical data based on network monitoring indexes |
| CN108269189A (en) * | 2017-07-05 | 2018-07-10 | 中国中投证券有限责任公司 | Achievement data monitoring method, device, storage medium and computer equipment |
| CN107528722A (en) * | 2017-07-06 | 2017-12-29 | 阿里巴巴集团控股有限公司 | Abnormal point detecting method and device in a kind of time series |
Non-Patent Citations (2)
| Title |
|---|
| Claudio Martella等.Visualizing, clustering, and predicting the behavior of museum visitors.《Pervasive and Mobile Computing》.2017,全文. * |
| 刘金钊 ; 周悦芝 ; 张尧学 ; .基于小波分析的云计算在线业务异常负载检测方法.清华大学学报(自然科学版).2017,(05),全文. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110909306A (en) | 2020-03-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110909306B (en) | Business abnormality detection method and device, electronic equipment and storage equipment | |
| CN110888788B (en) | Abnormality detection method, abnormality detection device, computer device, and storage medium | |
| CN107871190B (en) | Service index monitoring method and device | |
| CN110874674B (en) | Abnormality detection method, device and equipment | |
| CN111971942B (en) | Anomaly detection and processing of seasonal data | |
| US7865389B2 (en) | Analyzing time series data that exhibits seasonal effects | |
| US9471544B1 (en) | Anomaly detection in a signal | |
| JP6501982B2 (en) | Failure risk index estimation device and failure risk index estimation method | |
| CN110830450A (en) | Abnormal flow monitoring method, device and equipment based on statistics and storage medium | |
| CN110008080A (en) | Operational indicator method for detecting abnormality, device and electronic equipment based on time series | |
| US20120016886A1 (en) | Determining a seasonal effect in temporal data | |
| US9600391B2 (en) | Operations management apparatus, operations management method and program | |
| AU2016201794B1 (en) | Analyzing equipment degradation for maintaining equipment | |
| CN109684320B (en) | Method and equipment for online cleaning of monitoring data | |
| CN110188793B (en) | Data anomaly analysis method and device | |
| CN111858704A (en) | Data monitoring method and device, electronic equipment and storage medium | |
| CN112766536A (en) | Model training method, device and terminal for calculating road engineering labor unit price | |
| US20240020436A1 (en) | Automated data quality monitoring and data governance using statistical models | |
| JP2020181443A (en) | Abnormality detection apparatus, abnormality detection method, and computer program | |
| CN114328662A (en) | Abnormal data positioning method and device, electronic equipment and storage medium | |
| CN112988536A (en) | Data anomaly detection method, device, equipment and storage medium | |
| CN112291297B (en) | Information data processing method, device, storage medium and electronic equipment | |
| US20230409421A1 (en) | Anomaly detection in computer systems | |
| CN113971132B (en) | Parameter maintenance method and device | |
| US20220108196A1 (en) | Improved computer-implemented event forecasting and information provision |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |