CN111262750A - Method and system for evaluating baseline model - Google Patents
Method and system for evaluating baseline model Download PDFInfo
- Publication number
- CN111262750A CN111262750A CN202010020975.6A CN202010020975A CN111262750A CN 111262750 A CN111262750 A CN 111262750A CN 202010020975 A CN202010020975 A CN 202010020975A CN 111262750 A CN111262750 A CN 111262750A
- Authority
- CN
- China
- Prior art keywords
- baseline
- flow
- value
- historical
- change
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a method for evaluating a baseline model, comprising the steps of: extracting a first baseline and historical flow predicted by the baseline model at each time point within a predetermined historical time period; determining whether a flow change within the predetermined historical period of time is a normal flow change based on the value of the first baseline and the value of the historical flow; determining an evaluation parameter based on the value of the first baseline and the value of the historical flow rate if the flow rate change is the normal flow rate change; and determining whether training of the baseline model is required based on the evaluation parameters.
Description
Technical Field
The invention relates to the field of computer networks, in particular to a method and a system for evaluating a baseline model.
Background
Traffic baselines (also referred to as "baselines") are a common parameter in network traffic monitoring techniques. When the actual network flow is higher than the preset baseline, the network flow monitoring system generates a corresponding alarm to remind a user of abnormal fluctuation of the network flow. For the baseline model for predicting the baseline, when the predicted baseline has a large deviation from the actual data and the change of the actual data is a normal change, it is not feasible to continue using the current model, so it is necessary to determine whether to retrain the model.
One existing scheme is to manually configure a static baseline upper limit or baseline lower limit based on expert experience or historical data statistics, and generate an alarm when the actual flow is higher than the preset baseline upper limit or lower than the preset baseline lower limit. Since the scheme depends on subjective judgment of people, the scheme is difficult to adapt to the normal fluctuation situation of the flow at different time points (such as busy time and idle time), and the event of false alarm or false alarm failure is easy to generate.
Another conventional scheme is to establish corresponding prediction baselines for different time points through various manners such as a historical data statistical method, machine learning (such as a regression algorithm, a time series prediction algorithm, etc.), deep learning (such as a neural network, etc.), and the like. The scheme can generate a dynamic baseline for traffic peaks in busy hours and idle hours. However, when normal flow changes occur, manual intervention is required to retrain the model that predicts the baseline. Therefore, this solution still requires a professional to continuously optimize the model manually.
Disclosure of Invention
In one aspect of the invention, a method for evaluating a baseline model is presented, comprising the steps of: extracting a first baseline and historical flow predicted by the baseline model at each time point within a predetermined historical time period; determining whether a flow change within the predetermined historical period of time is a normal flow change based on the value of the first baseline and the value of the historical flow; determining an evaluation parameter based on the value of the first baseline and the value of the historical flow rate if the flow rate change is the normal flow rate change; and determining whether training of the baseline model is required based on the evaluation parameters.
In another aspect of the invention, a system for evaluating a baseline model is presented, comprising: means for extracting a first baseline predicted by the baseline model and historical flow at each time point within a predetermined historical time period; means for determining whether a change in flow over the predetermined historical period of time is a normal flow change based on the value of the first baseline and the value of the historical flow; means for determining an evaluation parameter based on the value of the first baseline and the value of the historical flow if the flow change is the normal flow change; and means for determining whether training of the baseline model is required based on the evaluation parameters.
In yet another aspect of the present invention, a computer-readable medium is presented, having computer-readable instructions stored thereon, which, when executed by a computer, are capable of performing a method according to embodiments of the present invention.
The embodiment of the invention can evaluate whether the current predicted baseline is applicable or not and decide whether to retrain a new model for predicting the baseline or not according to the evaluation result. Therefore, the embodiment of the invention can automatically obtain the proper baseline based on the normal flow fluctuation, thereby having higher applicability.
The foregoing description is only an overview of the technical solutions of the present invention, and the embodiments of the present invention are described below in order to make the technical means of the present invention more clearly understood and to make the above and other objects, features, and advantages of the present invention more clearly understandable.
Drawings
The above and other objects, features and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description read in conjunction with the accompanying drawings. Several embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:
in the drawings, the same or corresponding reference numerals indicate the same or corresponding parts.
Fig. 1 shows a schematic illustration of a flow according to an embodiment of the invention.
Fig. 2 shows a schematic diagram of a baseline generated by a model of a current prediction baseline in case of normal fluctuations of traffic network traffic according to the prior art.
Fig. 3 shows a schematic diagram of a baseline generated by a model of a new predicted baseline in the event of normal fluctuations in traffic network traffic, according to an embodiment of the invention.
Detailed Description
The principles and spirit of the present invention will be described with reference to a number of exemplary embodiments. It is understood that these embodiments are given solely for the purpose of enabling those skilled in the art to better understand and to practice the invention, and are not intended to limit the scope of the invention in any way. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
The following detailed description of specific embodiments of the invention is provided in connection with the accompanying drawings.
In the scenario of monitoring network traffic, some changes in network traffic are typically caused by some factors. Changes in network traffic caused by these factors may be considered normal network traffic changes. In some embodiments, these factors may include, but are not limited to: the model of the prediction baseline is switched among the operations of monitoring the IP of the whole network, monitoring the independent IP, monitoring the independent network port and the like; models that predict baselines add configuration rules (e.g., test terms); the traffic carrying capacity embodied by the network traffic has changed, etc.
The invention provides a method for evaluating a baseline model. The method may evaluate a model of the current prediction baseline. For example, upon reaching a predetermined self-test period, the method can determine whether a change in network traffic is a normal network traffic change, and thus decide whether to retrain the model that predicts the baseline without manual intervention. Specifically, the method comprises the following steps:
(1) baseline and historical data of the most recently existing predictions are read.
In this step, the most recently predicted baseline and historical data stored over a predetermined period of time in the past may be read when a pre-set self-test period is reached. In some embodiments, the historical data is historical network traffic over a predetermined period of time.
(2) Outliers are detected and deleted in the historical data.
In this step, various abnormal value detection algorithms (such as LOF, isolated forest, etc.) can be used to search for abnormal extreme values in the historical data and delete the abnormal extreme values.
(3) And judging whether the current flow abnormity is normal flow change or not according to the number of the abnormal points.
In this step, the number of abnormal points in a predetermined time period may be counted, and whether the current flow rate is abnormal or not may be determined. Herein, a time point is considered as an abnormal point if the flow value at the time point is higher than the baseline. When the abnormal point is detected, the system for monitoring the flow sends out the alarm information corresponding to the abnormal point. In some embodiments, if the ratio of the number of abnormal points in all the historical data is greater than a set threshold (e.g., 50%), it is determined that the current flow rate change is the normal flow rate change caused by the external factors.
(4) An evaluation parameter is determined based on the predicted baseline and historical data.
After determining that it is a normal flow change, an evaluation parameter may be determined based on the predicted baseline and historical data.
For example, the predetermined time period may include one day with 1440 time points collected during the day, which corresponds to 1440 minutes encompassed by each day. The historical data may be recorded in a list named raw _ value and the predicted baseline in a list named pre _ value. The difference between the data corresponding to each time point (i.e., the value of the predicted baseline) and the actual historical data can be calculated and recorded in a list named delta _ value.
Then, extreme values of deviation caused by abnormal fluctuations in the delta _ value list can be excluded. Since there is random fluctuation in the actual history data, it is necessary to exclude the extreme value of deviation due to random fluctuation. For example, data in delta _ value is sorted from large to small, extreme values at the head and tail are excluded in a certain proportion (e.g., 5%), and the average and standard deviation of the remaining data are calculated. Herein, the mean and standard deviation are used as evaluation parameters.
In some embodiments, a Mean Absolute Percentage Error (MAPE) may also be used as an evaluation parameter. The calculation formula for MAPE is as follows:
wherein, ObervedtIndicating the actual value of the flow at a certain point in time, predictedtDenotes a predicted value of the flow rate at a certain time point, and n denotes a time point (which may be set to time points corresponding to the 1 st to 1440 th minutes of the day)
(5) Model for judging whether retraining of prediction baseline is needed or not based on evaluation parameters
Based on various evaluation parameters, it can be determined whether a model of the predicted baseline needs to be retrained. If the absolute value of the average is higher than the specified average threshold, the predicted baseline is larger or smaller overall, and the model needs to be retrained. If the standard deviation is higher than the specified standard deviation threshold value, the fluctuation of the prediction result of the model is large, the prediction trend has large deviation with the actual result, and the model also needs to be retrained. If the MAPE is above a specified MAPE threshold, the prediction error is too large, and therefore the model also needs to be retrained.
When each evaluation parameter is smaller than the corresponding designated threshold, the prediction result of the baseline is more consistent with the actual historical data, and the model does not need to be retrained. In some embodiments, one or more of these evaluation parameters may be employed to determine whether a model of the prediction baseline needs to be retrained.
(6) Determining a range of training samples
If any one of the evaluation parameters is higher than the corresponding specified threshold, the range of the sample of the training model needs to be determined again.
In some embodiments, the historical data may be sorted by time and old samples (i.e., old historical data) may be removed from the original range of samples, and the ratio of outliers in the retained historical data at all time points is ensured to be greater than a preset ratio (e.g., greater than 75%). Then. The retained historical data may be used as a new sample.
(7) And performing re-model training and replacing the original model.
After obtaining the new samples, the model that predicts the baseline may be trained with the new samples. After training, the new model will be used to predict the baseline.
Fig. 1 shows a schematic illustration of a flow according to an embodiment of the invention. The flow chart illustrates one embodiment of the above method. The procedure used only the mean and standard deviation of the differences as evaluation parameters. When one of the mean and standard deviation exceeds a specified threshold, it is determined that the model needs to be retrained.
Fig. 2 shows a schematic diagram of a baseline (dashed line) generated by a model of a current prediction baseline in case of normal fluctuation of traffic network traffic according to the prior art, and fig. 3 shows a schematic diagram of a baseline (dashed line) generated by a model of a new prediction baseline in case of normal fluctuation of traffic network traffic according to an embodiment of the present invention. Fig. 2 shows the range of actual flow that the baseline predicted by the original model has not been able to meet. Fig. 3 shows the range of actual flow rates that the new model predicts after applying the above method of the present invention.
The invention also provides a system for evaluating a baseline model, which comprises a module capable of executing each step of the method.
Program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user computing device, partly on the user computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device over any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., over the internet using an internet service provider).
Moreover, while the operations of the method of the invention are depicted in the drawings in a particular order, this does not require or imply that the operations must be performed in this particular order, or that all of the illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.
It should be noted that although in the above detailed description several software means/modules and sub-means/modules are mentioned which implement the above described method, such a division is not mandatory. Indeed, the features and functionality of two or more of the devices described above may be embodied in one device/module according to embodiments of the invention. Conversely, the features and functions of one apparatus/module described above may be further divided into embodiments by a plurality of apparatuses/modules.
While the spirit and principles of the invention have been described with reference to several particular embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, nor is the division of aspects, which is for convenience only as the features in such aspects may not be combined to benefit. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.
Claims (15)
1. A method for evaluating a baseline model, comprising the steps of:
extracting a first baseline and historical flow predicted by the baseline model at each time point within a predetermined historical time period;
determining whether a flow change within the predetermined historical period of time is a normal flow change based on the value of the first baseline and the value of the historical flow;
determining an evaluation parameter based on the value of the first baseline and the value of the historical flow rate if the flow rate change is the normal flow rate change; and
determining whether training of the baseline model is required based on the evaluation parameters.
2. The method of claim 1, further comprising:
and detecting abnormal extreme values in the historical flow based on a preset detection method, and deleting the detected abnormal extreme values.
3. The method of claim 1, further comprising:
determining a sample range if it is determined that training the baseline model is required; and
the baseline model is trained using the determined sample range, and a second baseline is predicted.
4. The method of claim 3, the step of determining a sample range if it is determined that training the baseline model is required comprising: old historical traffic in the original sample range is deleted in chronological order to ensure that the ratio of the number of flow anomaly time points to the number of time points in the sample range is higher than a first predetermined ratio.
5. The method of claim 1, wherein the step of determining whether the change in flow over the predetermined historical period of time is a normal change in flow based on the value of the first baseline and the value of the historical flow comprises:
and determining the number of abnormal flow time points in the preset historical time period according to the value of the first baseline and the value of the historical flow, and if the ratio of the number of the abnormal flow time points to the number of the time points is higher than a second preset ratio, judging that the current flow change is normal flow change.
6. The method of claim 1, wherein the evaluation parameter is at least one of a difference mean and a difference standard deviation calculated from the difference of the value of the first baseline and the value of the historical flow rate at each of the time points, and a mean absolute percentage error calculated from the value of the first baseline and the value of the historical flow rate at each of the time points.
7. The method of claim 1, wherein the step of determining whether training of the baseline model is required based on the evaluation parameters comprises: determining that training of the baseline model is required if the evaluation parameter is above a predetermined threshold.
8. A system for evaluating a baseline model, comprising:
means for extracting a first baseline predicted by the baseline model and historical flow at each time point within a predetermined historical time period;
means for determining whether a change in flow over the predetermined historical period of time is a normal flow change based on the value of the first baseline and the value of the historical flow;
means for determining an evaluation parameter based on the value of the first baseline and the value of the historical flow if the flow change is the normal flow change; and
means for determining whether training of the baseline model is required based on the evaluation parameters.
9. The system of claim 1, further comprising:
and the module is used for detecting abnormal extreme values in the historical flow based on a preset detection method and deleting the detected abnormal extreme values.
10. The system of claim 1, further comprising:
means for determining a sample range if it is determined that training of the baseline model is required; and
and a module for training the baseline model using the determined sample range and predicting a second baseline.
11. The system of claim 10, the means for determining a sample range if it is determined that training the baseline model is required further comprising: means for deleting old historical traffic in the original sample range in chronological order to ensure that the proportion of the flow anomaly time point to the time point in the sample range is above a first predetermined proportion.
12. The system of claim 1, wherein the means for determining whether the change in flow over the predetermined historical period of time is a normal change in flow based on the value of the first baseline and the value of the historical flow further comprises:
and determining the number of abnormal flow time points in the preset historical time period according to the value of the first baseline and the value of the historical flow, and if the ratio of the number of the abnormal flow time points to the number of the time points is higher than a second preset ratio, judging that the current flow change is a normal flow change.
13. The system of claim 8, wherein the evaluation parameter is at least one of a difference mean and a difference standard deviation calculated from the difference of the value of the first baseline and the value of the historical flow rate at each of the time points, and a mean absolute percentage error calculated from the value of the first baseline and the value of the historical flow rate at each of the time points.
14. The system of claim 8, wherein the means for determining whether training of the baseline model is required based on the evaluation parameters comprises: means for determining that training of the baseline model is required if the evaluation parameter is above a predetermined threshold.
15. A computer readable medium having computer readable instructions stored thereon which, when executed by a computer, are capable of performing the method of any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010020975.6A CN111262750B (en) | 2020-01-09 | 2020-01-09 | Method and system for evaluating baseline model |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010020975.6A CN111262750B (en) | 2020-01-09 | 2020-01-09 | Method and system for evaluating baseline model |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111262750A true CN111262750A (en) | 2020-06-09 |
| CN111262750B CN111262750B (en) | 2021-08-27 |
Family
ID=70952734
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010020975.6A Active CN111262750B (en) | 2020-01-09 | 2020-01-09 | Method and system for evaluating baseline model |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111262750B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112087350A (en) * | 2020-09-17 | 2020-12-15 | 中国工商银行股份有限公司 | Method, device, system and medium for monitoring network access line flow |
| CN112445842A (en) * | 2020-11-20 | 2021-03-05 | 北京思特奇信息技术股份有限公司 | Abnormal value detection method and system based on time series data |
| CN112712113A (en) * | 2020-12-29 | 2021-04-27 | 广州品唯软件有限公司 | Alarm method and device based on indexes and computer system |
| CN113992496A (en) * | 2020-07-10 | 2022-01-28 | 中国移动通信集团湖北有限公司 | Abnormal operation warning method and device based on quartile algorithm and computing equipment |
| CN114124492A (en) * | 2021-11-12 | 2022-03-01 | 中盈优创资讯科技有限公司 | Network traffic anomaly detection and analysis method and device |
Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7428478B2 (en) * | 2001-08-17 | 2008-09-23 | General Electric Company | System and method for improving accuracy of baseline models |
| CN102355381A (en) * | 2011-08-18 | 2012-02-15 | 网宿科技股份有限公司 | Method and system for predicting flow of self-adaptive differential auto-regression moving average model |
| US8516104B1 (en) * | 2005-12-22 | 2013-08-20 | At&T Intellectual Property Ii, L.P. | Method and apparatus for detecting anomalies in aggregated traffic volume data |
| CN103489034A (en) * | 2013-10-12 | 2014-01-01 | 山东省科学院海洋仪器仪表研究所 | Method and device for predicting and diagnosing online ocean current monitoring data |
| WO2014023245A1 (en) * | 2012-08-09 | 2014-02-13 | 中兴通讯股份有限公司 | Flow prediction method and system and flow monitoring method and system |
| CN104954192A (en) * | 2014-03-27 | 2015-09-30 | 东华软件股份公司 | Network flow monitoring method and device |
| CN105049291A (en) * | 2015-08-20 | 2015-11-11 | 广东睿江科技有限公司 | Method for detecting network traffic anomaly |
| CN106603531A (en) * | 2016-12-15 | 2017-04-26 | 中国科学院沈阳自动化研究所 | Automatic establishing method of intrusion detection model based on industrial control network and apparatus thereof |
| US20170208079A1 (en) * | 2016-01-19 | 2017-07-20 | Qualcomm Incorporated | Methods for detecting security incidents in home networks |
| CN107070683A (en) * | 2016-12-12 | 2017-08-18 | 国网北京市电力公司 | The method and apparatus of data prediction |
| CN107122594A (en) * | 2017-04-10 | 2017-09-01 | 湖南中车时代电动汽车股份有限公司 | A kind of health forecast method and system of new energy vehicle battery |
| CN107888441A (en) * | 2016-09-30 | 2018-04-06 | 全球能源互联网研究院 | A kind of network traffics baseline self study adaptive approach |
| CN108768942A (en) * | 2018-04-20 | 2018-11-06 | 武汉绿色网络信息服务有限责任公司 | A kind of ddos attack detection method and detection device based on adaptive threshold |
| CN108924127A (en) * | 2018-06-29 | 2018-11-30 | 新华三信息安全技术有限公司 | A kind of generation method and device of flow baseline |
| CN109462521A (en) * | 2018-11-26 | 2019-03-12 | 华北电力大学 | A kind of network flow abnormal detecting method suitable for source net load interaction industrial control system |
-
2020
- 2020-01-09 CN CN202010020975.6A patent/CN111262750B/en active Active
Patent Citations (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7428478B2 (en) * | 2001-08-17 | 2008-09-23 | General Electric Company | System and method for improving accuracy of baseline models |
| US8516104B1 (en) * | 2005-12-22 | 2013-08-20 | At&T Intellectual Property Ii, L.P. | Method and apparatus for detecting anomalies in aggregated traffic volume data |
| CN102355381A (en) * | 2011-08-18 | 2012-02-15 | 网宿科技股份有限公司 | Method and system for predicting flow of self-adaptive differential auto-regression moving average model |
| WO2014023245A1 (en) * | 2012-08-09 | 2014-02-13 | 中兴通讯股份有限公司 | Flow prediction method and system and flow monitoring method and system |
| CN103489034A (en) * | 2013-10-12 | 2014-01-01 | 山东省科学院海洋仪器仪表研究所 | Method and device for predicting and diagnosing online ocean current monitoring data |
| CN104954192A (en) * | 2014-03-27 | 2015-09-30 | 东华软件股份公司 | Network flow monitoring method and device |
| CN105049291A (en) * | 2015-08-20 | 2015-11-11 | 广东睿江科技有限公司 | Method for detecting network traffic anomaly |
| US20170208079A1 (en) * | 2016-01-19 | 2017-07-20 | Qualcomm Incorporated | Methods for detecting security incidents in home networks |
| CN107888441A (en) * | 2016-09-30 | 2018-04-06 | 全球能源互联网研究院 | A kind of network traffics baseline self study adaptive approach |
| CN107070683A (en) * | 2016-12-12 | 2017-08-18 | 国网北京市电力公司 | The method and apparatus of data prediction |
| CN106603531A (en) * | 2016-12-15 | 2017-04-26 | 中国科学院沈阳自动化研究所 | Automatic establishing method of intrusion detection model based on industrial control network and apparatus thereof |
| CN107122594A (en) * | 2017-04-10 | 2017-09-01 | 湖南中车时代电动汽车股份有限公司 | A kind of health forecast method and system of new energy vehicle battery |
| CN108768942A (en) * | 2018-04-20 | 2018-11-06 | 武汉绿色网络信息服务有限责任公司 | A kind of ddos attack detection method and detection device based on adaptive threshold |
| CN108924127A (en) * | 2018-06-29 | 2018-11-30 | 新华三信息安全技术有限公司 | A kind of generation method and device of flow baseline |
| CN109462521A (en) * | 2018-11-26 | 2019-03-12 | 华北电力大学 | A kind of network flow abnormal detecting method suitable for source net load interaction industrial control system |
Non-Patent Citations (1)
| Title |
|---|
| 郭炜: "基于动态基线的业务运营支撑网异常流量检测研究", 《 2011年通信与信息技术新进展——第八届中国通信学会学术年会论文集》 * |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113992496A (en) * | 2020-07-10 | 2022-01-28 | 中国移动通信集团湖北有限公司 | Abnormal operation warning method and device based on quartile algorithm and computing equipment |
| CN113992496B (en) * | 2020-07-10 | 2023-11-17 | 中国移动通信集团湖北有限公司 | Abnormal alarm method and device based on quartile algorithm and computing equipment |
| CN112087350A (en) * | 2020-09-17 | 2020-12-15 | 中国工商银行股份有限公司 | Method, device, system and medium for monitoring network access line flow |
| CN112087350B (en) * | 2020-09-17 | 2022-03-18 | 中国工商银行股份有限公司 | Method, device, system and medium for monitoring network access line flow |
| CN112445842A (en) * | 2020-11-20 | 2021-03-05 | 北京思特奇信息技术股份有限公司 | Abnormal value detection method and system based on time series data |
| CN112712113A (en) * | 2020-12-29 | 2021-04-27 | 广州品唯软件有限公司 | Alarm method and device based on indexes and computer system |
| CN112712113B (en) * | 2020-12-29 | 2024-04-09 | 广州品唯软件有限公司 | Alarm method, device and computer system based on index |
| CN114124492A (en) * | 2021-11-12 | 2022-03-01 | 中盈优创资讯科技有限公司 | Network traffic anomaly detection and analysis method and device |
| CN114124492B (en) * | 2021-11-12 | 2023-07-25 | 中盈优创资讯科技有限公司 | Network traffic anomaly detection and analysis method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111262750B (en) | 2021-08-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111262750B (en) | Method and system for evaluating baseline model | |
| US10877863B2 (en) | Automatic prediction system for server failure and method of automatically predicting server failure | |
| US9652316B2 (en) | Preventing and servicing system errors with event pattern correlation | |
| US20190392252A1 (en) | Systems and methods for selecting a forecast model for analyzing time series data | |
| KR102118670B1 (en) | System and method for management of ict infra | |
| KR20190021560A (en) | Failure prediction system using big data and failure prediction method | |
| CN112561736A (en) | Fault diagnosis system and method for relay protection device of intelligent substation | |
| CN105325023A (en) | Method and network device for cell anomaly detection | |
| WO2023065584A1 (en) | Method and apparatus for determining remaining service life of device, and electronic device | |
| CN115794532A (en) | Multi-index intelligent dynamic threshold monitoring method and system | |
| JP2002532799A (en) | Case-based reasoning system and method and apparatus for sensor prediction, especially in technological processes of cement kilns | |
| CN115454778A (en) | Intelligent monitoring system for abnormal time sequence indexes in large-scale cloud network environment | |
| CN116670608A (en) | Hybrid ensemble method for predictive modeling of Internet of things | |
| CN113722134A (en) | Cluster fault processing method, device and equipment and readable storage medium | |
| CN116415126A (en) | Method, device and computing equipment for anomaly detection of doctor blades of paper machine | |
| CN116680146A (en) | Method and device for guaranteeing safe and reliable operation of application software | |
| JP2023547849A (en) | Method or non-transitory computer-readable medium for automated real-time detection, prediction, and prevention of rare failures in industrial systems using unlabeled sensor data | |
| CN111814557A (en) | Action flow detection method, device, equipment and storage medium | |
| CN117114454B (en) | DC sleeve state evaluation method and system based on Apriori algorithm | |
| Wu et al. | Adaptive sequential predictive maintenance policy with nonperiodic inspection for hard failures | |
| CN113123955B (en) | Plunger pump abnormity detection method and device, storage medium and electronic equipment | |
| WO2020044898A1 (en) | Device status monitoring device and program | |
| JP7062505B2 (en) | Equipment management support system | |
| US20230034061A1 (en) | Method for managing proper operation of base station and system applying the method | |
| CN114338351B (en) | Network anomaly root cause determination method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |