CN111338878A - Anomaly detection method and device, terminal device and storage medium - Google Patents
Anomaly detection method and device, terminal device and storage medium Download PDFInfo
- Publication number
- CN111338878A CN111338878A CN202010108336.5A CN202010108336A CN111338878A CN 111338878 A CN111338878 A CN 111338878A CN 202010108336 A CN202010108336 A CN 202010108336A CN 111338878 A CN111338878 A CN 111338878A
- Authority
- CN
- China
- Prior art keywords
- historical
- data
- time period
- periodic
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/22—Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
- G06F11/26—Functional testing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
- G06F11/3419—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment by assessing time
Abstract
The application is applicable to the technical field of computers, and provides an abnormality detection method, an abnormality detection device, a terminal and a storage medium, wherein the method comprises the following steps: acquiring index data of a monitoring index at the current moment; acquiring periodic components corresponding to the current moment from the periodic components corresponding to the historical moments respectively; calculating a residual error value of the index data according to the periodic component; when the residual error value is not in the range of the residual error threshold value, judging that the monitoring index at the current moment is abnormal; the process of acquiring the periodic components corresponding to the respective historical times includes: denoising the first time sequence data of the monitoring index in the past preset time period through a convolution denoising self-encoder, and outputting second time sequence data in the past preset time period; and decomposing the second time series data to obtain periodic components respectively corresponding to the historical moments. And the first time sequence data is subjected to noise reduction, the problem of noise interference in the period component decomposition process is solved, and the detection precision of abnormal detection is improved.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to an anomaly detection method and apparatus, a terminal device, and a storage medium.
Background
And the abnormity detection equipment is used for detecting abnormal data deviating from the normal monitoring numerical value in the operation and maintenance monitoring index so as to prompt operation and maintenance personnel to carry out fault prevention and troubleshooting. At present, most of anomaly detection is based on an S-H-ESD algorithm or a statistical algorithm, and has higher robustness in most scenes, but for operation and maintenance monitoring indexes with a large amount of noise, the calculation of confidence intervals of the models is interfered badly, and the detection accuracy of the anomaly detection model is reduced.
Content of application
The embodiment of the application provides an anomaly detection method and device, terminal equipment and a storage medium, and can solve the problem of low detection precision of an existing anomaly detection model.
In a first aspect, an embodiment of the present application provides an anomaly detection method, including:
acquiring index data of a monitoring index at the current moment;
acquiring periodic components of the historical moments corresponding to the current moment from the periodic components corresponding to the historical moments respectively;
calculating a residual error value of the index data according to the periodic component;
when the residual error value is not within the range of the residual error threshold value, judging that the monitoring index at the current moment is abnormal;
wherein, the process of obtaining the periodic components corresponding to the historical moments includes:
denoising first time sequence data of a monitoring index in a past preset time period through a convolution denoising self-encoder, and outputting second time sequence data in the past preset time period, wherein the preset time period comprises a plurality of historical moments;
and decomposing the second time sequence data of each historical moment in the preset time period to obtain the periodic components corresponding to each historical moment.
According to the method and the device, the index data of the monitoring index are obtained in real time, the residual error is calculated by combining the periodic components at the corresponding historical moments, and the abnormal condition is determined according to the threshold interval of the residual error, so that online real-time abnormal detection is realized; the first time sequence data are denoised by the convolution denoising self-encoder, the problem of noise interference in the periodic component decomposition process is solved, the periodic component and the residual threshold range are more accurate, the comparison result of the index data and the residual value obtained by calculation of the periodic component and the residual value and the residual threshold range is more accurate, and the detection precision of abnormal detection is improved.
In a second aspect, an embodiment of the present application provides an abnormality detection apparatus, including:
the first acquisition module is used for acquiring index data of the monitoring index at the current moment;
the second acquisition module is used for acquiring the periodic component of the historical moment corresponding to the current moment from the periodic components corresponding to the historical moments respectively;
the calculation module is used for calculating a residual error value of the index data according to the periodic component;
the judging module is used for judging that the monitoring index at the current moment is abnormal when the residual error value is not in the range of the residual error threshold value;
the device further comprises:
the noise reduction module is used for carrying out noise reduction on first time sequence data of a monitoring index in a past preset time period through a convolution noise reduction self-encoder and outputting second time sequence data in the past preset time period, wherein the preset time period comprises a plurality of historical moments;
and the decomposition module is used for decomposing the second time sequence data of each historical moment in the preset time period to obtain the periodic components corresponding to each historical moment.
In a third aspect, an embodiment of the present application provides a terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the abnormality detection method described in any one of the above first aspects when executing the computer program.
In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored, and the computer program, when executed by a processor, implements the abnormality detection method according to any one of the first aspect.
In a fifth aspect, an embodiment of the present application provides a computer program product, which, when running on a terminal device, causes the terminal device to execute the abnormality detection method according to any one of the above first aspects.
It is understood that the beneficial effects of the second aspect to the fifth aspect can be referred to the related description of the first aspect, and are not described herein again.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or the prior art descriptions will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive exercise.
Fig. 1 is a schematic flowchart of an anomaly detection method according to an embodiment of the present application;
FIG. 2 is a schematic flow chart diagram illustrating an anomaly detection method according to another embodiment of the present application;
FIG. 3 is a schematic flow chart diagram illustrating an anomaly detection method according to another embodiment of the present application;
FIG. 4 is a schematic flow chart diagram illustrating an anomaly detection method according to another embodiment of the present application;
FIG. 5 is a schematic flow chart diagram illustrating an anomaly detection method according to another embodiment of the present application;
fig. 6 is a schematic structural diagram of an abnormality detection apparatus according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
Detailed Description
In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular system structures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.
It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It should also be understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
As used in this specification and the appended claims, the term "if" may be interpreted contextually as "when", "upon" or "in response to" determining "or" in response to detecting ". Similarly, the phrase "if it is determined" or "if a [ described condition or event ] is detected" may be interpreted contextually to mean "upon determining" or "in response to determining" or "upon detecting [ described condition or event ]" or "in response to detecting [ described condition or event ]".
Furthermore, in the description of the present application and the appended claims, the terms "first," "second," "third," and the like are used for distinguishing between descriptions and not necessarily for describing or implying relative importance.
Reference throughout this specification to "one embodiment" or "some embodiments," or the like, means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," or the like, in various places throughout this specification are not necessarily all referring to the same embodiment, but rather "one or more but not all embodiments" unless specifically stated otherwise. The terms "comprising," "including," "having," and variations thereof mean "including, but not limited to," unless expressly specified otherwise.
As introduced in the related background art, most of the current anomaly detection is based on an S-H-ESD algorithm or a statistical algorithm, and for an operation and maintenance monitoring index with a large amount of noise, the large amount of noise may cause adverse interference on a periodic component of decomposed monitoring index data, so that the periodic component obtained by decomposing the monitoring index data is inaccurate, thereby affecting the accuracy of a calculation result of a confidence interval (residual threshold range), and finally causing the reduction of the detection accuracy of the anomaly detection.
Therefore, an anomaly detection method is needed to remove a large amount of noise in the time series data of the monitoring index and realize online real-time detection, and improve the detection precision.
The monitoring index may refer to a system monitoring index, such as load (average number of threads in a running queue in a specific time interval), CPU utilization, disk space usage, disk I/O (input/output) usage, memory usage, network traffic, and the like, or may refer to a monitoring index of a Function calculation process, such as a region dimension index (monitoring measurement on the overall usage of Function calculation resources in a certain area), a Service dimension index (monitoring measurement on the usage of a certain Service resource), a Function dimension index (monitoring measurement on the usage of a certain Function resource), and the like. It should be understood that the above monitoring indexes are only used for illustration, and the embodiments of the present application do not limit the specific types of the monitoring indexes.
The method includes the steps that model parameters of an anomaly detection model are updated regularly, specifically, a periodic component and a residual threshold range of the model can be updated through first time series data of monitoring indexes in a past preset time period, the updated periodic component and residual threshold range are used as reference values of online real-time anomaly detection, a large amount of noise may exist in the first time series data in the model updating process, and noise reduction is achieved on the first time series data through a convolution noise reduction self-encoder.
The embodiment of the application provides an anomaly detection method, which can be applied to terminal equipment and can also be an independent application program, and the application program can realize the processes of acquiring monitoring index data, reducing noise of the monitoring index data, acquiring residual values of the monitoring index data and determining the anomaly condition of the monitoring index according to the residual values. The terminal device may be a computing device such as a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a desktop computer, an independent server, and a cluster server, for example, and the specific type of the terminal device is not limited in this embodiment of the present application.
Fig. 1 shows a schematic flow chart of an anomaly detection method provided by the present application, which can be applied to the above-mentioned terminal device by way of example and not limitation.
S101, index data of the monitoring index at the current moment is obtained.
The index data is an index value acquired by the terminal equipment in real time.
And S102, acquiring the periodic component of the historical time corresponding to the current time from the periodic components corresponding to the historical times respectively.
The historical moments are the same historical period moments in the past preset time period, and the period component is obtained by calculating the monitoring index data of the same historical period moment. For example, if the past preset time period is the past 2 weeks and the current time is 3 pm today, the cycle component corresponding to 3 pm today is the cycle component of the historical cycle time of 3 pm afternoon obtained by calculating the sequence formed by the index data of 3 pm each day in 2 weeks.
The process of acquiring the periodic components corresponding to the respective historical times includes S1021 and S1022.
S1021, denoising first time sequence data of a monitoring index in a past preset time period through a convolution denoising self-encoder, and outputting second time sequence data in the past preset time period, wherein the preset time period comprises a plurality of historical moments;
the first time series data is time series data which is high in saturation and periodic in time stamp composition of all index data collected in a past preset time period, and may or may not contain a large amount of noise. It should be understood that the anomaly detection method of the embodiment of the present application can be applied to time series data containing a large amount of noise, and can also be applied to time series data not containing a large amount of noise.
The convolutional noise reduction self-encoder is a self-encoder which comprises an encoder and a decoder and has a symmetric structure of convolutional layer-self-coding algorithm-deconvolution layer.
S1022, decomposing the second time series data of each historical time in the preset time period, and obtaining the periodic components corresponding to each historical time.
The second time series data is the time series data from which the noise in the first time series data is removed, and the series of index data of the same period history time in the second time series data is decomposed into a trend component (trendsomplement), a period component (local component) and a remainder (remaining component) by the STL algorithm. For example, if the same historical cycle time is 3 pm, the series of index data collected at 3 pm every day in the second time series data is decomposed into a trend component, a cycle component, and a remainder of the historical cycle time of 3 pm.
The noise of the first time sequence data of the monitoring index is reduced through the convolution noise reduction self-encoder, noise in the first time sequence data is reduced, accordingly, adverse interference of the noise to the process that the periodic component is decomposed from the time sequence data when the model parameters of the abnormal detection model are updated is reduced, the residual error threshold range obtained by updating the model is more accurate, and accordingly the abnormal detection has higher detection precision.
And S103, calculating a residual error value of the index data according to the periodic component.
The periodic component is used as an expected value (which can be understood as a standard value) corresponding to the index data at the historical time, and the index data acquired in real time at the current time deviates from the periodic component, so that the deviation degree needs to be calculated. Specifically, a difference between the index data and the periodic component is calculated, and the difference is a residual value or a deviation degree.
And S104, judging that the monitoring index at the current moment is abnormal when the residual value is not in the range of the residual threshold value.
The residual threshold range includes a threshold range composed of a plurality of differences between the index data of each historical time in the second time series data and the periodic data of the corresponding historical time obtained by decomposing the second time series data. It should be understood that in other embodiments, the residual threshold range may be a self-setting range value.
If the residual value between the index data at the current moment and the periodic component corresponding to the historical moment is not in the residual threshold range, indicating that the index data of the monitoring index at the current moment exceeds the allowable deviation range from the periodic component, namely that the monitoring index at the current moment is abnormal.
According to the method and the device, the index data of the monitoring index are obtained in real time, the residual error is calculated by combining the periodic components at the corresponding historical moments, and the abnormal condition is determined according to the threshold interval of the residual error, so that online real-time abnormal detection is realized; the first time sequence data are denoised by the convolution denoising self-encoder, the problem of noise interference in the periodic component decomposition process is solved, the periodic component and the residual threshold range are more accurate, the comparison result of the index data and the residual value obtained by calculation of the periodic component and the residual value and the residual threshold range is more accurate, and the detection precision of abnormal detection is improved.
On the basis of the embodiment shown in fig. 1, fig. 2 shows a schematic flow chart of another abnormality detection method provided in the embodiment of the present application, and as shown in fig. 2, step S1021 specifically includes steps S201 to S203. It should be noted that the steps that are the same as those in the embodiment of fig. 1 are not repeated herein, please refer to the foregoing description.
S201, inputting the first time sequence data into the convolution noise reduction self-encoder;
s202, carrying out multilayer hidden layer coding on the first time sequence data through a coder in the convolutional denoising self-coder to obtain a low-dimensional feature vector;
s203, performing multilayer hidden layer decoding on the low-dimensional feature vector through a decoder in the convolutional denoising autoencoder, and outputting second time series data of the monitoring index.
In this embodiment, the low-dimensional feature vector is an implicit feature from an implicit layer in the encoder, which is lower in dimension than the input of the encoder (first timing data) and the output of the decoder (second timing data). The multi-layer hidden layer of the encoder is a multi-layer convolution layer, namely an input layer, and the multi-layer hidden layer of the decoder is a multi-layer deconvolution layer, namely an output layer.
Specifically, if phi denotes the encoder and psi denotes the decoder, X → F, psi: F → X, and F wX + b, where X in phi: X → F is the first time sequence data containing noise, X in psi: F → X is the second time sequence data obtained after denoising, F is the low-dimensional feature vector, and w and b are the implicit parameters updated from the implicit layer in the coding model. By encoding the first time sequence data into the low-dimensional feature vector, when the model parameter is updated by adopting the first time sequence data in the preset time period, the noise in the first time sequence data is removed, the adverse effect of the noise on the periodic component decomposition process is reduced, the hidden layer features are concentrated, and the anomaly detection model has better performance.
On the basis of the embodiment shown in fig. 1, the convolutional denoising autoencoder is obtained by training according to time series data of a monitoring index containing preset noise.
In this embodiment, in order that the convolutional noise reduction self-encoder can well simulate the noise of the first timing data in the noise reduction process, the timing data added with the preset noise is adopted as the training sample during the training of the convolutional noise reduction self-encoder. The predetermined noise may be gaussian noise conforming to gaussian distribution (normal distribution), i.e. x to N (μ, σ)2) Where x is Gaussian noise, including but not limited to 0-valued noise and high-valued noiseAnd sound, so that the convolution noise reduction self-encoder can be applied to noise reduction of monitoring index time sequence data of various monitoring scenes.
On the basis of the embodiment shown in fig. 1, fig. 3 shows a schematic flow chart of another abnormality detection method provided in the embodiment of the present application, and as shown in fig. 3, step S1022 specifically includes steps S301 to S303. It should be noted that the steps that are the same as those in the embodiment of fig. 1 are not repeated herein, please refer to the foregoing description.
S301, generating a periodic subsequence corresponding to each historical moment according to the second time sequence data of each historical moment in the preset time period;
s302, performing smooth regression on each periodic subsequence to obtain a smooth result corresponding to each periodic subsequence;
and S303, removing the low-pass quantity in each smoothing result to obtain the periodic component corresponding to each historical moment.
The period subsequence is a subsequence formed by sample points at the same position in each period in the second time series data. For example, the time length of the second time series data is 2 weeks, and the period is 1 day, and the index data corresponding to the same time every day is the sample points at the same position in the same period. By way of example and not limitation, the second time series data is data in the first 14 days, and the data at 10 o ' clock each day is grouped into a periodic subsequence (A, B, …, N, where data a is data at 10 o ' clock on the first day, data B is data at 10 o ' clock on the second day, and so on to data N on the last day).
In this embodiment, the second time series data is decomposed into periodic components by an STL (secure-random decomposition procedure based on receive) algorithm. The STL algorithm decomposes the time series data Yv into a trend component (tend component), a periodic component (periodic component), and a remainder (remainderiscomponent) based on the loses: yv is Tv + Sv + Rv, and v is 1 to N. In the embodiment, an inner loop is adopted to perform trend fitting and calculation of the periodic component, and the periodic component of each historical time obtained by decomposing the second time series data is used as an expected value of the monitoring index at the corresponding time.
For example, n: (in the second time series data)p) A periodic subsequence, using LOESS (q ═ n)n(s)D ═ 1) performing smooth regression on each periodic subsequence, i.e. each periodic subsequence extends forward and backward for one period respectively, and obtaining a smooth result
v＝-n(p)+1～-N+n(p)Where n(s) is the smoothing parameter of the LOESS smoothing regression, and k represents the kth pass in the inner loop; extracting smoothing results
Medium low flux
v is 1 to N: for the smooth result
Sequentially making n: (p)、n(p) Moving average (moving average) of the results obtained in step 3, and lost (q ═ n) was used again to obtain an average resultn(l)D ═ 1) performing a smooth regression on the averaged results; removing smoothing results
Medium low flux
Obtaining periodic components
On the basis of the embodiment shown in fig. 1, fig. 4 shows a schematic flow chart of another abnormality detection method provided in the embodiment of the present application, and as shown in fig. 4, steps S401 to S403 are further included before step S104. It should be noted that the steps that are the same as those in the embodiment of fig. 1 are not repeated herein, please refer to the foregoing description.
S401, acquiring a history residual value of second time sequence data of each history moment in the preset time period;
the history residual value is a difference value between the second time series data of each history time and the periodic component of the corresponding history time.
S402, calculating the mean value and the standard deviation of all the historical residual values based on normal distribution;
the normal distribution is x to N (mu, sigma)2) μ is the mean and σ is the standard deviation.
And S403, based on the n-sigma principle, determining the residual error threshold range according to the average value, the standard value and the preset n value of the historical residual error values.
The value of n is a positive integer, for example, n-sigma is 3-sigma, 3 is n value, and sigma is standard deviation sigma. The residual threshold range may be (μ -n σ, μ + n σ). And when the residual value is not in the residual threshold range, namely the residual value is smaller than mu-n sigma or larger than mu + n sigma, judging that the monitoring index at the current moment is abnormal. And when the residual value is within the residual threshold range, judging that the monitoring index at the current moment is normal.
The residual threshold range is determined through the historical residual value and the n-sigma principle, so that the residual threshold range is automatically adjusted according to a plurality of historical residual values in a preset time period, the anomaly detection at the current moment is more consistent, and the online real-time anomaly detection of the operation and maintenance monitoring index is realized.
On the basis of the embodiment shown in fig. 4, the present application provides another embodiment of an anomaly detection method. The step S401 specifically includes a step S4011. It should be noted that the steps that are the same as those in the embodiment of fig. 4 are not repeated herein, please refer to the foregoing description.
S4011, according to the periodic component of each historical time within the preset time period, calculating a historical residual value between the second time series data of each historical time and the periodic component of the corresponding historical time.
In this embodiment, the periodic component is obtained by decomposing the second time series data, a difference exists between the second time series data and the periodic component, the difference is a difference allowed by the monitoring index at the corresponding time, and an error exists in a result of directly comparing the difference with a residual value of the index data, so that a historical residual value at each historical time needs to be calculated, a residual threshold range is determined by all historical residual values, and an error of a direct comparison result is reduced.
On the basis of the embodiment shown in fig. 1, fig. 5 is a schematic flow chart of another abnormality detection method provided in the embodiment of the present application, and as shown in fig. 5, steps S501 to S504 are further included before step S1021. It should be noted that the steps that are the same as those in the embodiment of fig. 1 are not repeated herein, please refer to the foregoing description.
S501, acquiring third time sequence data of the monitoring indexes in the preset time period;
the third time sequence data is all time sequence data of the monitoring indexes in a preset time period.
S502, converting the third time sequence data into frequency domain data through fast Fourier transform;
and the third time sequence data is time domain data, and corresponding frequency domain data is obtained after fast Fourier transform.
S503, searching an amplitude component corresponding to the target frequency in the frequency domain data;
the target frequency is a frequency corresponding to a certain time within a preset time period in the third time series data, and the amplitude component is an amplitude corresponding to the frequency at the time. The higher the amplitude component is, the larger the ratio of the principal component of the wave representing the frequency in the third time-series data is.
S504, when the number of the target frequencies of which the amplitude components are larger than a first preset value is larger than a second preset value, the third time sequence data is used as the first time sequence data.
The first preset value is a reference value of the amplitude component, and the second preset value is a reference value of the target frequency quantity. In order to ensure that the time series data meets the requirement of high saturation and periodicity, the time series data needs to be screened, when the number of target frequencies with amplitude components larger than the first preset value reaches a second preset value, the saturation of the third time series data is high, and the third time series data is originally data formed by all index data according to a timestamp, so the third time series data has periodicity.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
Fig. 6 shows a block diagram of an abnormality detection apparatus 600 provided in the embodiment of the present application, corresponding to the abnormality detection method described in the above embodiment, and only the relevant parts of the embodiment of the present application are shown for convenience of description.
Referring to fig. 6, the apparatus includes:
a first obtaining module 601, configured to obtain index data of a monitoring index at a current time;
a second obtaining module 602, configured to obtain, from the periodic components respectively corresponding to the historical moments, a periodic component of the historical moment corresponding to the current moment;
a calculating module 603, configured to calculate a residual value of the index data according to the periodic component;
a determining module 604, configured to determine that the monitoring indicator at the current moment is abnormal when the residual value is not within the residual threshold range;
the device further comprises:
the noise reduction module 6021 is configured to perform noise reduction on the first time series data of the monitoring index in a past preset time period by using a convolution noise reduction self-encoder, and output second time series data in the past preset time period, where the preset time period includes a plurality of historical moments;
a decomposition module 6022, configured to decompose the second time series data at each historical time in the preset time period, so as to obtain the periodic components corresponding to each historical time.
It should be noted that, for the information interaction, execution process, and other contents between the above-mentioned devices/units, the specific functions and technical effects thereof are based on the same concept as those of the embodiment of the method of the present application, and specific reference may be made to the part of the embodiment of the method, which is not described herein again.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions. Each functional unit and module in the embodiments may be integrated in one processing unit, or each unit may exist alone physically, or two or more units are integrated in one unit, and the integrated unit may be implemented in a form of hardware, or in a form of software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application. The specific working processes of the units and modules in the system may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
Fig. 7 is a schematic structural diagram of a terminal device according to an embodiment of the present application. As shown in fig. 7, the terminal device 7 of this embodiment includes: at least one processor 70 (only one shown in fig. 7), a memory 71, and a computer program 72 stored in the memory 71 and executable on the at least one processor 70, the processor 70 implementing the steps in any of the various anomaly detection method embodiments described above when executing the computer program 72.
The terminal device 7 may be a desktop computer, a notebook, a palm computer, a cloud server, or other computing devices. The terminal device may include, but is not limited to, a processor 70, a memory 71. Those skilled in the art will appreciate that fig. 7 is only an example of the terminal device 7, and does not constitute a limitation to the terminal device 7, and may include more or less components than those shown, or combine some components, or different components, for example, and may further include input/output devices, network access devices, and the like.
The Processor 70 may be a Central Processing Unit (CPU), and the Processor 70 may be other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The memory 71 may in some embodiments be an internal storage unit of the terminal device 7, such as a hard disk or a memory of the terminal device 7. In other embodiments, the memory 71 may also be an external storage device of the terminal device 7, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the terminal device 7. Further, the memory 71 may also include both an internal storage unit and an external storage device of the terminal device 7. The memory 71 is used for storing an operating system, an application program, a BootLoader (BootLoader), data, and other programs, such as program codes of the computer program. The memory 71 may also be used to temporarily store data that has been output or is to be output.
The embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the computer program implements the steps in the above-mentioned method embodiments.
The embodiments of the present application provide a computer program product, which when running on a mobile terminal, enables the mobile terminal to implement the steps in the above method embodiments when executed.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium and can implement the steps of the embodiments of the methods described above when the computer program is executed by a processor. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer readable medium may include at least: any entity or device capable of carrying computer program code to a photographing apparatus/terminal apparatus, a recording medium, computer Memory, Read-Only Memory (ROM), random-access Memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium. Such as a usb-disk, a removable hard disk, a magnetic or optical disk, etc. In certain jurisdictions, computer-readable media may not be an electrical carrier signal or a telecommunications signal in accordance with legislative and patent practice.
In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and reference may be made to the related descriptions of other embodiments for parts that are not described or illustrated in a certain embodiment.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus/network device and method may be implemented in other ways. For example, the above-described apparatus/network device embodiments are merely illustrative, and for example, the division of the modules or units is only one logical division, and there may be other divisions when actually implementing, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not implemented. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not substantially depart from the spirit and scope of the embodiments of the present application and are intended to be included within the scope of the present application.
Claims (10)
1. An anomaly detection method, characterized in that it comprises:
acquiring index data of a monitoring index at the current moment;
acquiring periodic components of the historical moments corresponding to the current moment from the periodic components corresponding to the historical moments respectively;
calculating a residual error value of the index data according to the periodic component;
when the residual error value is not within the range of the residual error threshold value, judging that the monitoring index at the current moment is abnormal;
wherein, the process of obtaining the periodic components corresponding to the historical moments includes:
denoising first time sequence data of a monitoring index in a past preset time period through a convolution denoising self-encoder, and outputting second time sequence data in the past preset time period, wherein the preset time period comprises a plurality of historical moments;
and decomposing the second time sequence data of each historical moment in the preset time period to obtain the periodic components corresponding to each historical moment.
2. The abnormality detection method according to claim 1, wherein said denoising, by a convolution denoising autoencoder, first time series data of a monitoring index in a past preset time period and outputting second time series data in the past preset time period comprises:
inputting the first time series data into the convolution noise reduction self-encoder;
carrying out multilayer hidden layer coding on the first time sequence data through a coder in the convolutional denoising self-coder to obtain a low-dimensional feature vector;
and performing multilayer hidden layer decoding on the low-dimensional feature vector through a decoder in the convolutional noise reduction self-encoder, and outputting the second time sequence data.
3. The anomaly detection method according to claim 1, wherein said convolutional noise reduction self-encoder is trained on time series data containing a monitoring index of a preset noise.
4. The abnormality detection method according to claim 1, wherein said decomposing the second time-series data of each of the historical times within the preset time period to obtain the periodic components corresponding to each of the historical times includes:
generating a periodic subsequence corresponding to each historical moment according to the second time sequence data of each historical moment in the preset time period;
performing smooth regression on each periodic subsequence to obtain a smooth result corresponding to each periodic subsequence;
and removing the low-pass quantity in each smoothing result to obtain the periodic component corresponding to each historical moment.
5. The abnormality detection method according to claim 1, wherein before determining that there is an abnormality in the monitoring index at a current time when the residual value is not within a residual threshold range, the method further comprises:
acquiring a history residual value of second time sequence data of each history moment in the preset time period;
calculating the mean value and the standard deviation of all the historical residual values based on normal distribution;
and determining the residual error threshold range according to the mean value and the standard value of the historical residual error values and a preset n value based on an n-sigma principle.
6. The abnormality detection method according to claim 5, wherein said obtaining the history residual value of the second time series data at each history time within the preset time period includes:
and according to the periodic component of each historical moment in the preset time period, calculating a historical residual value between the second time sequence data of each historical moment and the periodic component of the corresponding historical moment.
7. The abnormality detection method according to claim 1, wherein before said denoising by the convolution denoising autoencoder of the first time-series data of the monitoring index in the past preset time period, further comprising:
acquiring third time sequence data of the monitoring index in the preset time period;
converting the third time series data into frequency domain data by fast Fourier transform;
searching an amplitude component corresponding to the target frequency in the frequency domain data;
and when the number of the target frequencies of which the amplitude components are larger than a first preset value is larger than a second preset value, taking the third time sequence data as the first time sequence data.
8. An abnormality detection device characterized by comprising:
the first acquisition module is used for acquiring index data of the monitoring index at the current moment;
the second acquisition module is used for acquiring the periodic component of the historical moment corresponding to the current moment from the periodic components corresponding to the historical moments respectively;
the calculation module is used for calculating a residual error value of the index data according to the periodic component;
the judging module is used for judging that the monitoring index at the current moment is abnormal when the residual error value is not in the range of the residual error threshold value;
the device further comprises:
the noise reduction module is used for carrying out noise reduction on first time sequence data of a monitoring index in a past preset time period through a convolution noise reduction self-encoder and outputting second time sequence data in the past preset time period, wherein the preset time period comprises a plurality of historical moments;
and the decomposition module is used for decomposing the second time sequence data of each historical moment in the preset time period to obtain the periodic components corresponding to each historical moment.
9. A terminal device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the method according to any of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1 to 7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010108336.5A CN111338878A (en) | 2020-02-21 | 2020-02-21 | Anomaly detection method and device, terminal device and storage medium |
| PCT/CN2020/119304 WO2021164267A1 (en) | 2020-02-21 | 2020-09-30 | Anomaly detection method and apparatus, and terminal device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010108336.5A CN111338878A (en) | 2020-02-21 | 2020-02-21 | Anomaly detection method and device, terminal device and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111338878A true CN111338878A (en) | 2020-06-26 |
Family
ID=71185453
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010108336.5A Pending CN111338878A (en) | 2020-02-21 | 2020-02-21 | Anomaly detection method and device, terminal device and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN111338878A (en) |
| WO (1) | WO2021164267A1 (en) |
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111880998A (en) * | 2020-07-30 | 2020-11-03 | 平安科技（深圳）有限公司 | Service system anomaly detection method and device, computer equipment and storage medium |
| CN112199252A (en) * | 2020-09-30 | 2021-01-08 | 中国民航信息网络股份有限公司 | Abnormity monitoring method and device and electronic equipment |
| CN112256748A (en) * | 2020-09-25 | 2021-01-22 | 北京五八信息技术有限公司 | Abnormity detection method and device, electronic equipment and storage medium |
| CN112380098A (en) * | 2020-11-19 | 2021-02-19 | 平安科技（深圳）有限公司 | Time sequence abnormity detection method and device, computer equipment and storage medium |
| CN112559962A (en) * | 2020-11-20 | 2021-03-26 | 中国石油天然气股份有限公司 | Digital signal noise reduction method and device |
| CN112637021A (en) * | 2020-12-31 | 2021-04-09 | 中国建设银行股份有限公司 | Dynamic flow monitoring method and device based on linear regression algorithm |
| CN112668661A (en) * | 2020-12-31 | 2021-04-16 | 新奥数能科技有限公司 | Identification method and device for photovoltaic power abnormal data |
| CN112699163A (en) * | 2020-12-25 | 2021-04-23 | 创新奇智(青岛)科技有限公司 | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium |
| WO2021164267A1 (en) * | 2020-02-21 | 2021-08-26 | 平安科技（深圳）有限公司 | Anomaly detection method and apparatus, and terminal device and storage medium |
| CN113342502A (en) * | 2021-06-30 | 2021-09-03 | 招商局金融科技有限公司 | Method and device for diagnosing performance of data lake, computer equipment and storage medium |
| CN113568950A (en) * | 2021-07-29 | 2021-10-29 | 北京字节跳动网络技术有限公司 | Index detection method, device, equipment and medium |
| CN114095194A (en) * | 2020-08-24 | 2022-02-25 | 北京天元创新科技有限公司 | Abnormal flow detection method and device |
| CN114553681A (en) * | 2022-03-08 | 2022-05-27 | 中国人民解放军国防科技大学 | Equipment state abnormity detection method and device and computer equipment |
| CN114812796A (en) * | 2022-04-22 | 2022-07-29 | 中国人民解放军63811部队 | Equipment condition evaluation method and related equipment |
| CN115098345A (en) * | 2022-08-25 | 2022-09-23 | 广州简悦信息科技有限公司 | Data anomaly detection method, electronic device and readable storage medium |
| CN115757068A (en) * | 2022-11-17 | 2023-03-07 | 中电云数智科技有限公司 | Process log acquisition and automatic noise reduction method and system based on eBPF |
Families Citing this family (32)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113899963A (en) * | 2021-08-30 | 2022-01-07 | 科华数据股份有限公司 | Alternating current system interference electricity detection method and device and terminal equipment |
| CN113722192B (en) * | 2021-09-07 | 2023-10-27 | 北京奇艺世纪科技有限公司 | Alarm grading method and device, electronic equipment and storage medium |
| CN113792088A (en) * | 2021-09-10 | 2021-12-14 | 阳光电源股份有限公司 | Fault detection method and device for photovoltaic string and storage medium |
| CN113987008B (en) * | 2021-10-12 | 2023-11-21 | 中冶南方工程技术有限公司 | Blast furnace slag peel falling judgment method, terminal equipment and storage medium |
| CN114235387A (en) * | 2021-11-08 | 2022-03-25 | 三一重能股份有限公司 | High-speed shaft rotating speed oscillation detection method and device and operation machine |
| CN114035226B (en) * | 2021-11-12 | 2023-10-20 | 东北石油大学 | Microseism data noise suppression method and system based on noise semantic correlation depth migration noise removal self-coding network |
| CN114301803B (en) * | 2021-12-24 | 2024-03-08 | 北京百度网讯科技有限公司 | Network quality detection method and device, electronic equipment and storage medium |
| CN115840895A (en) * | 2021-12-31 | 2023-03-24 | 江苏常胜电器(淮安)有限公司 | Electronic device temperature protection system |
| CN114500004A (en) * | 2022-01-05 | 2022-05-13 | 北京理工大学 | Anomaly detection method based on conditional diffusion probability generation model |
| CN114527491B (en) * | 2022-01-05 | 2023-06-30 | 浙江时空道宇科技有限公司 | Method, device, equipment and storage medium for monitoring code deviation data of navigation system |
| CN114036032A (en) * | 2022-01-10 | 2022-02-11 | 北京搜狐互联网信息服务有限公司 | Real-time program monitoring method and device |
| CN115158399B (en) * | 2022-06-14 | 2023-10-17 | 通号城市轨道交通技术有限公司 | Time sequence signal abnormality detection method and system |
| CN115314412B (en) * | 2022-06-22 | 2023-09-05 | 北京邮电大学 | Operation-and-maintenance-oriented type self-adaptive index prediction and early warning method and device |
| CN115292659B (en) * | 2022-08-02 | 2023-03-21 | 成都毅创空间科技有限公司 | Intelligent household time sequence data abnormity detection method |
| CN116303485A (en) * | 2022-09-08 | 2023-06-23 | 上海数禾信息科技有限公司 | Business index display method, device, computer equipment and storage medium |
| CN115733498B (en) * | 2023-01-10 | 2023-06-16 | 北京四维纵横数据技术有限公司 | Time sequence data compression method, device, computer equipment and medium |
| CN115792476B (en) * | 2023-02-06 | 2023-04-25 | 石家庄科林电气股份有限公司 | Charging pile rectifying module abnormality early warning method, device, terminal and storage medium |
| CN115994248B (en) * | 2023-03-24 | 2023-06-20 | 青岛精锐机械制造有限公司 | Data detection method and system for valve faults |
| CN116089777B (en) * | 2023-04-10 | 2023-06-23 | 北京智蚁杨帆科技有限公司 | Intelligent new energy settlement method and system based on intelligent information matching |
| CN116257745B (en) * | 2023-05-10 | 2023-08-15 | 杭州致成电子科技有限公司 | Load current extreme abnormality data processing method and device |
| CN116609440B (en) * | 2023-05-22 | 2023-11-28 | 浙江嘉宇工程管理有限公司 | Intelligent acceptance management method and system for building engineering quality based on cloud edge cooperation |
| CN116340851B (en) * | 2023-05-30 | 2023-07-28 | 西安高商智能科技有限责任公司 | Production quality detection system of propulsion motor |
| CN116448188B (en) * | 2023-06-13 | 2023-08-18 | 西安高商智能科技有限责任公司 | Abnormal state monitoring and early warning system for freight winch |
| CN116595426B (en) * | 2023-07-17 | 2023-09-26 | 济南大陆机电股份有限公司 | Industrial Internet of things data intelligent acquisition management system |
| CN116738351B (en) * | 2023-08-10 | 2023-11-21 | 重庆华悦生态环境工程研究院有限公司深圳分公司 | Drainage facility detection method and device |
| CN116777305B (en) * | 2023-08-18 | 2023-11-10 | 河北思极科技有限公司 | Power data quality improving method and device, electronic equipment and storage medium |
| CN116975768B (en) * | 2023-09-22 | 2023-12-19 | 山东爱福地生物股份有限公司 | Data anomaly detection method for fertilizer safety production |
| CN117216706B (en) * | 2023-11-09 | 2024-02-09 | 国网浙江省电力有限公司杭州供电公司 | Power distribution network data anomaly tracing method, system, computer equipment and medium |
| CN117273547B (en) * | 2023-11-17 | 2024-01-30 | 建平慧营化工有限公司 | Production equipment operation data processing method based on edge calculation |
| CN117422345B (en) * | 2023-12-18 | 2024-03-12 | 泰安金冠宏食品科技有限公司 | Oil-residue separation quality assessment method and system |
| CN117421538B (en) * | 2023-12-18 | 2024-03-15 | 中铁建工集团第二建设有限公司 | Detail waterproof data regulation and optimization method |
| CN117743836A (en) * | 2024-02-21 | 2024-03-22 | 聊城市产品质量监督检验所 | Abnormal vibration monitoring method for bearing |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106685750B (en) * | 2015-11-11 | 2019-12-24 | 华为技术有限公司 | System anomaly detection method and device |
| US10628435B2 (en) * | 2017-11-06 | 2020-04-21 | Adobe Inc. | Extracting seasonal, level, and spike components from a time series of metrics data |
| CN107958672A (en) * | 2017-12-12 | 2018-04-24 | 广州酷狗计算机科技有限公司 | The method and apparatus for obtaining pitch waveform data |
| CN108182452B (en) * | 2017-12-29 | 2018-11-20 | 哈尔滨工业大学（威海） | Aero-engine fault detection method and system based on grouping convolution self-encoding encoder |
| CN109977098A (en) * | 2019-03-08 | 2019-07-05 | 北京工商大学 | Non-stationary time-series data predication method, system, storage medium and computer equipment |
| CN110456332B (en) * | 2019-08-12 | 2022-08-05 | 哈尔滨工程大学 | Underwater acoustic signal enhancement method based on automatic encoder |
| CN110750429A (en) * | 2019-09-06 | 2020-02-04 | 平安科技（深圳）有限公司 | Abnormity detection method, device, equipment and storage medium of operation and maintenance management system |
| CN111338878A (en) * | 2020-02-21 | 2020-06-26 | 平安科技（深圳）有限公司 | Anomaly detection method and device, terminal device and storage medium |
-
2020
- 2020-02-21 CN CN202010108336.5A patent/CN111338878A/en active Pending
- 2020-09-30 WO PCT/CN2020/119304 patent/WO2021164267A1/en active Application Filing
Cited By (22)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021164267A1 (en) * | 2020-02-21 | 2021-08-26 | 平安科技（深圳）有限公司 | Anomaly detection method and apparatus, and terminal device and storage medium |
| CN111880998A (en) * | 2020-07-30 | 2020-11-03 | 平安科技（深圳）有限公司 | Service system anomaly detection method and device, computer equipment and storage medium |
| CN114095194A (en) * | 2020-08-24 | 2022-02-25 | 北京天元创新科技有限公司 | Abnormal flow detection method and device |
| CN112256748A (en) * | 2020-09-25 | 2021-01-22 | 北京五八信息技术有限公司 | Abnormity detection method and device, electronic equipment and storage medium |
| CN112256748B (en) * | 2020-09-25 | 2023-06-30 | 北京五八信息技术有限公司 | Abnormality detection method and device, electronic equipment and storage medium |
| CN112199252A (en) * | 2020-09-30 | 2021-01-08 | 中国民航信息网络股份有限公司 | Abnormity monitoring method and device and electronic equipment |
| CN112380098A (en) * | 2020-11-19 | 2021-02-19 | 平安科技（深圳）有限公司 | Time sequence abnormity detection method and device, computer equipment and storage medium |
| CN112380098B (en) * | 2020-11-19 | 2024-03-19 | 平安科技（深圳）有限公司 | Timing sequence abnormality detection method and device, computer equipment and storage medium |
| CN112559962A (en) * | 2020-11-20 | 2021-03-26 | 中国石油天然气股份有限公司 | Digital signal noise reduction method and device |
| CN112559962B (en) * | 2020-11-20 | 2023-12-26 | 中国石油天然气股份有限公司 | Digital signal noise reduction method and device |
| CN112699163A (en) * | 2020-12-25 | 2021-04-23 | 创新奇智(青岛)科技有限公司 | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium |
| CN112668661A (en) * | 2020-12-31 | 2021-04-16 | 新奥数能科技有限公司 | Identification method and device for photovoltaic power abnormal data |
| CN112637021A (en) * | 2020-12-31 | 2021-04-09 | 中国建设银行股份有限公司 | Dynamic flow monitoring method and device based on linear regression algorithm |
| CN113342502A (en) * | 2021-06-30 | 2021-09-03 | 招商局金融科技有限公司 | Method and device for diagnosing performance of data lake, computer equipment and storage medium |
| CN113568950A (en) * | 2021-07-29 | 2021-10-29 | 北京字节跳动网络技术有限公司 | Index detection method, device, equipment and medium |
| CN114553681B (en) * | 2022-03-08 | 2024-02-02 | 中国人民解放军国防科技大学 | Device state abnormality detection method and device and computer device |
| CN114553681A (en) * | 2022-03-08 | 2022-05-27 | 中国人民解放军国防科技大学 | Equipment state abnormity detection method and device and computer equipment |
| CN114812796A (en) * | 2022-04-22 | 2022-07-29 | 中国人民解放军63811部队 | Equipment condition evaluation method and related equipment |
| CN115098345B (en) * | 2022-08-25 | 2022-12-23 | 广州简悦信息科技有限公司 | Data anomaly detection method, electronic device and readable storage medium |
| CN115098345A (en) * | 2022-08-25 | 2022-09-23 | 广州简悦信息科技有限公司 | Data anomaly detection method, electronic device and readable storage medium |
| CN115757068A (en) * | 2022-11-17 | 2023-03-07 | 中电云数智科技有限公司 | Process log acquisition and automatic noise reduction method and system based on eBPF |
| CN115757068B (en) * | 2022-11-17 | 2024-03-05 | 中电云计算技术有限公司 | Process log acquisition and automatic noise reduction method and system based on eBPF |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2021164267A1 (en) | 2021-08-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111338878A (en) | Anomaly detection method and device, terminal device and storage medium | |
| CN110750429A (en) | Abnormity detection method, device, equipment and storage medium of operation and maintenance management system | |
| CN107357764B (en) | Data analysis method, electronic device, and computer storage medium | |
| CN112668661A (en) | Identification method and device for photovoltaic power abnormal data | |
| CN113048920B (en) | Method and device for measuring flatness of industrial structural part and electronic equipment | |
| CN111858369A (en) | Memory monitoring method, device, equipment and storage medium | |
| CN111507483A (en) | Rework board detection apparatus, method, and computer-readable storage medium | |
| CN112463564B (en) | Method and device for determining associated index influencing host state | |
| CN115705413A (en) | Method and device for determining abnormal log | |
| CN111367779A (en) | Computer performance index abnormity judgment method | |
| CN112906967A (en) | Desulfurization system slurry circulating pump performance prediction method and device | |
| CN115358914B (en) | Data processing method and device for visual detection, computer equipment and medium | |
| CN115934484B (en) | Diffusion model data enhancement-based anomaly detection method, storage medium and apparatus | |
| CN112187266A (en) | Nonlinear correction method and device for analog-to-digital converter and electronic equipment | |
| CN116226770A (en) | Time sequence data anomaly detection method and device | |
| CN114692987A (en) | Time sequence data analysis method, device, equipment and storage medium | |
| CN114118177B (en) | Bit plane noise reduction method and system based on singular spectrum analysis and storage medium | |
| CN114152454A (en) | Mechanical equipment fault diagnosis method based on CEEMDAN-CSE model and establishment method of model | |
| CN113824995A (en) | Data transmission method and device for robot, electronic device and storage medium | |
| CN113360359A (en) | Index abnormal data tracing method, device, equipment and storage medium | |
| CN111563078A (en) | Data quality detection method and device based on time sequence data and storage device | |
| CN117609928B (en) | Pollutant emission amount anomaly identification method and device based on power data | |
| CN112861120A (en) | Identification method, device and storage medium | |
| CN110929957A (en) | Optimization method and device for comprehensive energy system | |
| CN117073806B (en) | Sewage treatment ectopic monitoring method and system based on artificial intelligence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40032342 Country of ref document: HK |
|
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |