CN111679949A - Anomaly detection method based on equipment index data and related equipment - Google Patents
Anomaly detection method based on equipment index data and related equipment Download PDFInfo
- Publication number
- CN111679949A CN111679949A CN202010328626.0A CN202010328626A CN111679949A CN 111679949 A CN111679949 A CN 111679949A CN 202010328626 A CN202010328626 A CN 202010328626A CN 111679949 A CN111679949 A CN 111679949A
- Authority
- CN
- China
- Prior art keywords
- data
- time series
- target time
- curve
- trained
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3051—Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/088—Non-supervised learning, e.g. competitive learning
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computing Systems (AREA)
- Health & Medical Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Quality & Reliability (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The invention relates to the technical field of data detection, which is applied to the field of intelligent security and protection, and discloses an anomaly detection method based on equipment index data and related equipment, wherein the method comprises the following steps: acquiring target time sequence data corresponding to the equipment index data; obtaining curve characteristics of target time sequence data by using a trained one-dimensional convolutional neural network model; determining suspicious classification characteristics of the target time sequence data according to the long-term and short-term memory network model; determining residual error characteristics of the target time sequence data according to the suspicious classification characteristics; using a pre-trained encoder model to obtain the dimension reduction characteristics of the target time sequence data; acquiring basic characteristics of target time series data; and inputting the curve characteristics, the suspicious classification characteristics, the residual error characteristics, the dimensionality reduction characteristics and the basic characteristics into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data. In addition, the application also relates to a block chain technology, and the abnormal detection result can be stored in the block chain.
Description
Technical Field
The invention relates to the technical field of data detection, in particular to an anomaly detection method based on equipment index data and related equipment.
Background
With the development of computer technology, a cloud platform composed of a large number of hosts, network switches and other devices is applied in a large scale. In order to ensure that the cloud platform can stably provide services, some index data (such as host CPU utilization rate and memory utilization rate) of the devices of the cloud platform need to be monitored in real time, currently, the monitored index data is a continuous time series data capable of reflecting a change state, a trend or a degree, and the features of the time series data are extracted to perform anomaly detection on the features, but in practice, the extracted features cannot well express the change state, the trend or the degree and the periodicity of the time series data, so that the anomaly detection is not accurate enough.
Therefore, how to improve the accuracy of anomaly detection for equipment index data is a technical problem that needs to be solved urgently.
Disclosure of Invention
In view of the above, it is necessary to provide an abnormality detection method based on equipment index data and a related apparatus, which can improve the accuracy of abnormality detection for the equipment index data.
A first aspect of the present invention provides an abnormality detection method based on device indicator data, the method including:
when an instruction for carrying out abnormity detection on equipment index data is received, target time series data corresponding to the equipment index data is obtained, wherein the target time series data comprises a period of continuous time points and the equipment index data corresponding to the time points;
performing feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained by a triple algorithm, and the curve features are features of a curve formed by equipment index data changing along with time;
according to a pre-trained long-short term memory network model, determining suspicious classification characteristics of the target time sequence data;
determining residual error characteristics of the target time sequence data according to the suspicious classification characteristics;
obtaining the dimensionality reduction characteristic of the target time sequence data by using a pre-trained encoder model;
acquiring basic features of the target time series data;
and inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data.
In a possible implementation manner, before performing feature extraction on the target time-series data by using a trained one-dimensional convolutional neural network model to obtain a curve feature of the target time-series data, the method further includes:
acquiring multiple groups of historical time sequence data corresponding to the equipment index data;
determining a plurality of time series curves according to the plurality of groups of historical time series data, wherein the plurality of time series curves correspond to the plurality of groups of historical time series data one by one;
determining a shape-based distance between any two adjacent time-series curves of the plurality of time-series curves by a similarity algorithm;
mapping a plurality of the shape-based distances to a plurality of similarities between the plurality of time series curves;
determining a plurality of training samples according to a plurality of similarities among the plurality of time series curves;
and training by using a triple algorithm and the training samples to obtain a trained one-dimensional convolutional neural network model.
In a possible implementation manner, the training using the triple algorithm and the plurality of training samples to obtain the trained one-dimensional convolutional neural network model includes:
sequentially inputting the first time series curve, the second time series curve and the third time series curve of the plurality of training samples into an initial one-dimensional convolution neural network model to obtain a first vector, a second vector and a third vector;
performing loss calculation on the first vector, the second vector and the third vector by using a triple algorithm to obtain a loss value;
and updating the network parameters of the initial one-dimensional convolutional neural network model according to the loss value to obtain a trained one-dimensional convolutional neural network model.
In a possible implementation manner, the determining suspicious classification features of the target time-series data according to a pre-trained long-short term memory network model includes:
inputting data before the latest time point in the target time sequence data into a long-term and short-term memory network to obtain predicted data corresponding to the latest time point;
calculating a difference between the predicted data and data at a latest time point in the target time series data;
and determining the absolute value corresponding to the difference value as a suspicious classification characteristic.
In one possible implementation manner, the determining, according to the suspicious classification feature, a residual feature of the target time-series data includes:
determining a standard deviation of the target time series data;
and determining residual error characteristics according to the suspicious classification characteristics and the standard deviation.
In a possible implementation manner, the basic features include basic statistical features, quantile index statistical features, data distribution features, and entropy features corresponding to the degree of data confusion.
In a possible implementation manner, each of the training samples includes a first time series curve, a second time series curve, and a third time series curve, where a similarity between the first time series curve and the second time series curve is greater than a preset similarity, and a similarity between the first time series curve and the third time series curve belongs to a preset similarity interval.
A second aspect of the present invention provides an abnormality detection apparatus based on equipment index data, the apparatus including:
the device comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring target time sequence data corresponding to device index data when receiving an instruction for carrying out abnormity detection on the device index data, and the target time sequence data comprises a continuous time point and the device index data corresponding to the time point;
the extraction module is used for performing feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained through a triple algorithm, and the curve features are features of a curve formed by equipment index data changing along with time;
the determining module is used for determining suspicious classification characteristics of the target time sequence data according to a pre-trained long-short term memory network model;
the determining module is further configured to determine a residual error feature of the target time series data according to the suspicious classification feature;
the acquisition module is further used for acquiring the dimensionality reduction characteristic of the target time sequence data by using a pre-trained encoder model;
the acquisition module is further used for acquiring basic features of the target time series data;
and the input module is used for inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data.
A third aspect of the present invention provides an electronic device comprising a processor and a memory, wherein the processor is configured to implement the method for detecting an abnormality based on device indicator data when executing a computer program stored in the memory.
A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the apparatus index data-based abnormality detection method.
According to the technical scheme, the improved one-dimensional convolutional neural network model can be used for extracting the characteristics of the curve corresponding to the time series data, more comprehensive curve characteristics can be extracted, the change trend of the time series data can be better represented, meanwhile, the characteristics of the time series data are increased by extracting the characteristics of the time series data through the trained long-short term memory network model and the trained encoder model, so that the characteristics of the time series data for anomaly detection are more comprehensive, and the accuracy of anomaly detection is improved.
Drawings
FIG. 1 is a flowchart illustrating a method for detecting an anomaly based on device index data according to an embodiment of the present invention.
FIG. 2 is a functional block diagram of an apparatus for detecting abnormality based on device index data according to a preferred embodiment of the present invention.
Fig. 3 is a schematic structural diagram of an electronic device according to a preferred embodiment of the present invention, which implements an anomaly detection method based on device indicator data.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.
This scheme belongs to wisdom security protection field, can promote the construction in wisdom city through this scheme. The anomaly detection method based on the equipment index data is applied to the electronic equipment, can also be applied to a hardware environment formed by the electronic equipment and a server connected with the electronic equipment through a network, and is executed by the server and the electronic equipment together. Networks include, but are not limited to: a wide area network, a metropolitan area network, or a local area network.
The electronic device is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, and the hardware thereof includes, but is not limited to, a microprocessor, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a Digital Signal Processor (DSP), an embedded device, and the like. The electronic device may also include a network device and/or a user device. The network device includes, but is not limited to, a single network device, a server group consisting of a plurality of network devices, or a Cloud Computing (Cloud Computing) based Cloud consisting of a large number of hosts or network devices, wherein the Cloud Computing is one of distributed Computing, and is a super virtual computer consisting of a group of loosely coupled computers. The user device includes, but is not limited to, any electronic product that can interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device, for example, a personal computer, a tablet computer, a smart phone, a Personal Digital Assistant (PDA), or the like.
Referring to fig. 1, fig. 1 is a flowchart illustrating an anomaly detection method based on device indicator data according to a preferred embodiment of the present invention. The order of the steps in the flowchart may be changed, and some steps may be omitted.
S11, when an instruction for abnormality detection of the equipment index data is received, the electronic equipment acquires target time series data corresponding to the equipment index data, wherein the target time series data comprise a continuous time point and the equipment index data corresponding to the time point.
Wherein the equipment metric data comprises: the device index data has a high or low value at a certain moment, and is generally normal, and if the device index data is to be monitored in real time whether abnormal occurs, the abnormal determination needs to be performed by combining all data (namely target time sequence data) at the current time point and in the previous period. Such as: if the equipment index data at the current time needs to be judged whether to be abnormal or not, all the equipment index data (data sequence data) recorded within 3 hours before the current time point need to be acquired for abnormality judgment, and a more accurate abnormality judgment result can be obtained.
The continuous time point may be a time determined at a preset time interval within a period of time, such as: 3 point 00 min, 3 point 05 min, 3 point 10 min, etc. Each time point may correspond to a piece of equipment index data.
And S12, the electronic equipment performs feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained through a triple algorithm, and the curve features are features of curves formed by the equipment index data changing along with time.
The Convolutional Neural Network (CNN) is a kind of feed-forward Neural network that includes Convolutional calculation and has a depth structure, and the Convolutional Neural network includes a one-dimensional Convolutional Neural network, a two-dimensional Convolutional Neural network, and a three-dimensional Convolutional Neural network. One-dimensional convolutional neural networks are often applied to data processing of sequence classes; two-dimensional convolutional neural networks are often applied to the recognition of image-like texts; the three-dimensional convolutional neural network is mainly applied to medical image and video data identification.
Wherein, the Activation Function (Activation Function) of the one-dimensional convolutional neural network model may be a hyperbolic tangent Function (tanh). Wherein the activation function may be a function running on a neuron of the artificial neural network responsible for mapping an input of the neuron to an output.
The triple Loss algorithm (Triplet Loss) is a Loss function algorithm in deep learning, is used for training samples with small differences, and can realize similarity calculation of the samples.
The purpose of using the triplet algorithm is to make the vectors output by the model of similar curves substantially consistent and make the vectors output by the model of dissimilar curves very different, so that the curve can be represented using the feature vectors output by the model.
As an optional implementation manner, before the step S12, the method further includes:
acquiring multiple groups of historical time sequence data corresponding to the equipment index data;
determining a plurality of time series curves according to the plurality of groups of historical time series data, wherein the plurality of time series curves correspond to the plurality of groups of historical time series data one by one;
determining a shape-based distance between any two adjacent time-series curves of the plurality of time-series curves by a similarity algorithm;
mapping a plurality of the shape-based distances to a plurality of similarities between the plurality of time series curves;
determining a plurality of training samples according to a plurality of similarities among the plurality of time series curves;
and training by using a triple algorithm and the training samples to obtain a trained one-dimensional convolutional neural network model.
Wherein, the value interval of the Shape-Based Distance (SBD) is [0, 2], and the smaller the value of the Shape-Based Distance is, the more similar the two corresponding time series curves are.
Let the curve be x, the curve y, the curve length be m, and the phase deviation be s. The calculation formula of SBD is:
each training sample comprises a first time series curve, a second time series curve and a third time series curve, wherein the similarity between the first time series curve and the second time series curve is greater than a preset similarity, and the similarity between the first time series curve and the third time series curve belongs to a preset similarity interval.
Wherein, a similarity may be preset, such as: 70%, a similarity interval may be preset, such as: [ 40%, 50% ].
Specifically, the training by using the triple algorithm and the plurality of training samples to obtain the trained one-dimensional convolutional neural network model includes:
sequentially inputting the first time series curve, the second time series curve and the third time series curve of the plurality of training samples into an initial one-dimensional convolution neural network model to obtain a first vector, a second vector and a third vector;
performing loss calculation on the first vector, the second vector and the third vector by using a triple algorithm to obtain a loss value;
and updating the network parameters of the initial one-dimensional convolutional neural network model according to the loss value to obtain a trained one-dimensional convolutional neural network model.
Wherein, assume the first vector is f (X)1) The second vector is f (X)2) The third vector is f (X)3) And presetting parameters α, wherein the loss function corresponding to the triple algorithm is as follows:
L(X1,X2,X3)＝max(||f(X1)-f(X2)||2-||f(X1)-f(X3)||2+α,0)；
the training goal is to stabilize the loss value around a very small value, i.e. the training goal formula is:
||f(X1)-f(X2)||2-||f(X1)-f(X3)||2+α≤0；
training makes the difference between the first vector and the second vector as small as possible, and the difference between the second vector and the third vector as large as possible, i.e. the vectors corresponding to two similar time series curves are basically consistent, and the vectors corresponding to two dissimilar time series curves are greatly different. Therefore, the vector output by the trained model can represent the overall characteristics (i.e. curve characteristics) of the input time series curve, and can be used for representing the characteristics of the variation state, trend or degree and periodicity of the time series data.
And S13, the electronic equipment determines suspicious classification characteristics of the target time series data according to a pre-trained long-short term memory network model.
The Long Short-term memory network model is a Long Short-term memory network (LSTM) which is a time cycle neural network and is suitable for processing and predicting important events with very Long intervals and delays in a time sequence.
Specifically, the determining suspicious classification features of the target time series data according to the pre-trained long-short term memory network model includes:
inputting data before the latest time point in the target time sequence data into a long-term and short-term memory network to obtain predicted data corresponding to the latest time point;
calculating a difference between the predicted data and data at a latest time point in the target time series data;
and determining the absolute value corresponding to the difference value as a suspicious classification characteristic.
In this alternative embodiment, the predicted feature values may be obtained by a pre-trained long-short term memory network model and data curves.
Wherein, if the value of the preset data of the long-short term memory network (LSTM) model is Y and the value of the data at the latest time point in the target time sequence data is X, the suspicious classification characteristic is | Y-X |.
And S14, the electronic equipment determines residual error characteristics of the target time series data according to the suspicious classification characteristics.
Specifically, the determining, according to the suspicious classification characteristic, a residual characteristic of the target time series data includes:
determining a standard deviation of the target time series data;
and determining residual error characteristics according to the suspicious classification characteristics and the standard deviation.
Assuming that the standard deviation is σ, if | Y-X | < ═ 3 σ, the value of the residual error feature is 1, and if | Y-X | >3 σ, the value of the residual error feature is 0.
In this optional embodiment, the 3-fold standard deviation is relatively common and is used to screen a numerical value of an abnormal value, if the suspicious classification feature is greater than the 3-fold standard deviation, it may be considered that there is a great possibility that an abnormality occurs, and a residual error feature is set to 0 to be used as a reference in abnormality detection; if the suspicious classification characteristic is less than or equal to 3 times of the standard deviation, the probability of the occurrence of the abnormality is considered to be smaller, and the residual characteristic is set to be 1 to be used as a reference in abnormality detection.
And S15, the electronic equipment acquires the dimension reduction characteristics of the target time series data by using a pre-trained encoder model.
Wherein the encoder (Autoencoders) model may be an artificial neural network model capable of learning to an efficient representation of input data through unsupervised learning. This efficient representation of the input data is called coding (codings), which is typically much smaller in dimension than the input data, making the self-coder useful for dimension reduction.
In the embodiment of the invention, the self-coding model is mainly used for carrying out data dimension reduction processing on the vector and extracting the dimension reduction data characteristics. During the training process, the labels of the input variables X of the encoder layer and the output variables of the decoder layer are also X, so the model tends to learn X. And finally, taking the trained encoder layer as a self-encoding model, wherein the self-encoder model can perform dimensionality reduction on a group of input data vectors to obtain a group of characteristic vectors (dimensionality reduction characteristics), and the group of characteristic vectors can be reduced into the original data vectors input into the self-encoder model through a decoder layer.
And S16, the electronic equipment acquires the basic features of the target time series data.
The basic characteristics comprise basic statistical characteristics, quantile index statistical characteristics, data distribution characteristics and entropy characteristics corresponding to the data chaos degree.
Wherein, the basic statistical characteristics can comprise current values, maximum values, minimum values, mean values and standard deviations; the quantile index statistical features may include 1/100 quantiles, 1/8 quantiles, 1/4 quantiles, 1/2 medians, 3/4 quantiles, 7/8 quantiles, 99/100 quantiles; the data distribution characteristics may include kurtosis and skewness.
S17, inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model by the electronic equipment to obtain an anomaly detection result of the equipment index data.
The anomaly detection result may be two preset values, such as: 0 indicates normal and 1 indicates abnormal.
In the embodiment of the invention, different weights can be set for each type of feature, and the basic feature, the dimension reduction feature, the classification feature, the residual error feature and the curve feature are comprehensively considered, so that the anomaly detection model can output a more accurate anomaly detection result aiming at the equipment index data.
It is emphasized that, in order to further ensure the privacy and security of the anomaly detection result, the anomaly detection result may also be stored in a node of a block chain.
In the method flow described in fig. 1, an improved one-dimensional convolutional neural network model may be used to perform feature extraction on a curve corresponding to time series data, so that more comprehensive curve features can be extracted, and the variation trend of the time series data can be better represented.
Referring to fig. 2, fig. 2 is a functional block diagram of an abnormality detection apparatus based on device index data according to a preferred embodiment of the present invention.
In some embodiments, the device indicator data-based anomaly detection apparatus operates in an electronic device. The abnormality detection apparatus based on the equipment index data may include a plurality of functional modules composed of program code segments. Program code of various program segments in the device index data-based abnormality detection apparatus may be stored in a memory and executed by at least one processor to perform some or all of the steps of the device index data-based abnormality detection method described in fig. 1.
In this embodiment, the abnormality detection apparatus based on the device index data may be divided into a plurality of functional modules according to the functions performed by the abnormality detection apparatus. The functional module may include: the device comprises an acquisition module 201, an extraction module 202, a determination module 203 and an input module 204. The module referred to herein is a series of computer program segments capable of being executed by at least one processor and capable of performing a fixed function and is stored in memory.
The obtaining module 201 is configured to, when an instruction for performing anomaly detection on device index data is received, obtain target time series data corresponding to the device index data, where the target time series data includes a period of continuous time points and device index data corresponding to the time points.
Wherein the equipment metric data comprises: the device index data has a high or low value at a certain moment, and is generally normal, and if the device index data is to be monitored in real time whether abnormal occurs, the abnormal determination needs to be performed by combining all data (namely target time sequence data) at the current time point and in the previous period. Such as: if the equipment index data at the current time needs to be judged whether to be abnormal or not, all the equipment index data (data sequence data) recorded within 3 hours before the current time point need to be acquired for abnormality judgment, and a more accurate abnormality judgment result can be obtained.
An extracting module 202, configured to perform feature extraction on the target time series data by using a trained one-dimensional convolutional neural network model, to obtain a curve feature of the target time series data, where the one-dimensional convolutional neural network model is trained by a triple algorithm, and the curve feature is a feature of a curve formed by changing device index data with time.
The Convolutional Neural Network (CNN) is a kind of feed-forward Neural network that includes Convolutional calculation and has a depth structure, and the Convolutional Neural network includes a one-dimensional Convolutional Neural network, a two-dimensional Convolutional Neural network, and a three-dimensional Convolutional Neural network. One-dimensional convolutional neural networks are often applied to data processing of sequence classes; two-dimensional convolutional neural networks are often applied to the recognition of image-like texts; the three-dimensional convolutional neural network is mainly applied to medical image and video data identification.
Wherein, the Activation Function (Activation Function) of the one-dimensional convolutional neural network model may be a hyperbolic tangent Function (tanh). Wherein the activation function may be a function running on a neuron of the artificial neural network responsible for mapping an input of the neuron to an output.
The triple Loss algorithm (Triplet Loss) is a Loss function algorithm in deep learning, is used for training samples with small differences, and can realize similarity calculation of the samples.
The purpose of using the triplet algorithm is to make the vectors output by the model of similar curves substantially consistent and make the vectors output by the model of dissimilar curves very different, so that the curve can be represented using the feature vectors output by the model.
And the determining module 203 is configured to determine suspicious classification features of the target time series data according to a pre-trained long-term and short-term memory network model.
The Long Short-term memory network model is a Long Short-term memory network (LSTM) which is a time cycle neural network and is suitable for processing and predicting important events with very Long intervals and delays in a time sequence.
The determining module 203 is further configured to determine a residual error feature of the target time series data according to the suspicious classification feature.
Specifically, the determining, according to the suspicious classification characteristic, a residual characteristic of the target time series data includes:
determining a standard deviation of the target time series data;
and determining residual error characteristics according to the suspicious classification characteristics and the standard deviation.
Assuming that the standard deviation is σ, if | Y-X | < ═ 3 σ, the value of the residual error feature is 1, and if | Y-X | >3 σ, the value of the residual error feature is 0.
The obtaining module 201 is further configured to obtain a dimension reduction feature of the target time series data by using a pre-trained encoder model.
The encoder model (Autoencoders) may be an artificial neural network model that can learn an efficient representation of input data through unsupervised learning. This efficient representation of the input data is called coding (codings), which is typically much smaller in dimension than the input data, making the self-coder useful for dimension reduction.
In the embodiment of the invention, the self-coding model is mainly used for carrying out data dimension reduction processing on the vector and extracting the dimension reduction data characteristics. During the training process, the labels of the input variables X of the encoder layer and the output variables of the decoder layer are also X, so the model tends to learn X. And finally, taking the trained encoder layer as a self-encoding model, wherein the self-encoder model can perform dimensionality reduction on a group of input data vectors to obtain a group of characteristic vectors (dimensionality reduction characteristics), and the group of characteristic vectors can be reduced into the original data vectors input into the self-encoder model through a decoder layer.
The obtaining module 201 is further configured to obtain a basic feature of the target time series data.
The basic characteristics comprise basic statistical characteristics, quantile index statistical characteristics, data distribution characteristics and entropy characteristics corresponding to the data chaos degree.
Wherein, the basic statistical characteristics can comprise current values, maximum values, minimum values, mean values and standard deviations; the quantile index statistical features may include 1/100 quantiles, 1/8 quantiles, 1/4 quantiles, 1/2 medians, 3/4 quantiles, 7/8 quantiles, 99/100 quantiles; the data distribution characteristics may include kurtosis and skewness.
An input module 203, configured to input the curve feature, the suspicious classification feature, the residual feature, the dimension reduction feature, and the basic feature into a pre-trained anomaly detection model, so as to obtain an anomaly detection result of the device index data.
The anomaly detection result may be two preset values, such as: 0 indicates normal and 1 indicates abnormal.
In the embodiment of the invention, different weights can be set for each type of feature, and the basic feature, the dimension reduction feature, the classification feature, the residual error feature and the curve feature are comprehensively considered, so that the anomaly detection model can output a more accurate anomaly detection result aiming at the equipment index data.
As an optional implementation manner, the obtaining module 201 is further configured to perform feature extraction on the target time series data by using the trained one-dimensional convolutional neural network model by the extracting module 202, and obtain multiple sets of historical time series data corresponding to device index data before obtaining a curve feature of the target time series data;
the determining module 203 is further configured to determine a plurality of time series curves according to the plurality of sets of historical time series data, where the plurality of time series curves are in one-to-one correspondence with the plurality of sets of historical time series data;
the determining module 203 is further configured to determine a shape-based distance between any two adjacent time-series curves in the plurality of time-series curves through a similarity algorithm;
the apparatus for detecting an abnormality based on device index data may further include:
a mapping module for mapping a plurality of the shape-based distances to a plurality of similarities between the plurality of time series curves;
the determining module 203 is further configured to determine a plurality of training samples according to a plurality of similarities between the plurality of time series curves;
and the training module is used for training by using the triple algorithm and the plurality of training samples to obtain a trained one-dimensional convolutional neural network model.
Wherein, the value interval of the Shape-Based Distance (SBD) is [0, 2], and the smaller the value of the Shape-Based Distance is, the more similar the two corresponding time series curves are.
Let the curve be x, the curve y, the curve length be m, and the phase deviation be s. The calculation formula of SBD is:
each training sample comprises a first time series curve, a second time series curve and a third time series curve, wherein the similarity between the first time series curve and the second time series curve is greater than a preset similarity, and the similarity between the first time series curve and the third time series curve belongs to a preset similarity interval.
Wherein, a similarity may be preset, such as: 70%, a similarity interval may be preset, such as: [ 40%, 50% ].
As an optional implementation manner, the training module performs training by using the triple algorithm and the plurality of training samples, and the manner of obtaining the trained one-dimensional convolutional neural network model specifically includes:
sequentially inputting the first time series curve, the second time series curve and the third time series curve of the plurality of training samples into an initial one-dimensional convolution neural network model to obtain a first vector, a second vector and a third vector;
performing loss calculation on the first vector, the second vector and the third vector by using a triple algorithm to obtain a loss value;
and updating the network parameters of the initial one-dimensional convolutional neural network model according to the loss value to obtain a trained one-dimensional convolutional neural network model.
Wherein the first vector is f (X)1) The second vector is f (X)2) The third vector is f (X)3) And presetting parameters α, wherein the loss function corresponding to the triple algorithm is as follows:
L(X1，X2，X3)＝max(||f(X1)-f(X2)||2-||f(X1)-f(X3)||2+α,0)；
the training goal is to stabilize the loss value around a very small value, i.e. the training goal formula is:
||f(X1)-f(X2)||2-||f(X1)-f(X3)||2+α≤0；
training makes the difference between the first vector and the second vector as small as possible, and the difference between the second vector and the third vector as large as possible, i.e. the vectors corresponding to two similar time series curves are basically consistent, and the vectors corresponding to two dissimilar time series curves are greatly different. Therefore, the vector output by the trained model can represent the overall characteristics (i.e. curve characteristics) of the input time series curve, and can be used for representing the characteristics of the variation state, trend or degree and periodicity of the time series data.
As an optional implementation manner, the determining module 203 determines the suspicious classification features of the target time series data according to a pre-trained long-short term memory network model specifically by:
inputting data before the latest time point in the target time sequence data into a long-term and short-term memory network to obtain predicted data corresponding to the latest time point;
calculating a difference between the predicted data and data at a latest time point in the target time series data;
and determining the absolute value corresponding to the difference value as a suspicious classification characteristic.
In this alternative embodiment, the predicted feature values may be obtained by a pre-trained long-short term memory network model and data curves.
Wherein, if the value of the preset data of the long-short term memory network (LSTM) model is Y and the value of the data at the latest time point in the target time sequence data is X, the suspicious classification characteristic is | Y-X |.
As an optional implementation manner, the determining module 203 determines the residual features of the target time series data according to the suspicious classification features in a specific manner:
determining a standard deviation of the target time series data;
and determining residual error characteristics according to the suspicious classification characteristics and the standard deviation.
Assuming that the standard deviation is σ, if | Y-X | < ═ 3 σ, the value of the residual error feature is 1, and if | Y-X | >3 σ, the value of the residual error feature is 0.
In this optional embodiment, the 3-fold standard deviation is relatively common and is used to screen a numerical value of an abnormal value, if the suspicious classification feature is greater than the 3-fold standard deviation, it may be considered that there is a great possibility that an abnormality occurs, and a residual error feature is set to 0 to be used as a reference in abnormality detection; if the suspicious classification characteristic is less than or equal to 3 times of the standard deviation, the probability of the occurrence of the abnormality is considered to be smaller, and the residual characteristic is set to be 1 to be used as a reference in abnormality detection.
In the anomaly detection device based on the equipment index data described in fig. 2, the improved one-dimensional convolutional neural network model can be used for extracting the characteristics of the curve corresponding to the time series data, so that more comprehensive curve characteristics can be extracted, the variation trend of the time series data can be better represented, and meanwhile, the characteristics of the time series data are increased by extracting the characteristics of the time series data through the trained long and short term memory network model and the trained encoder model, so that the characteristics of the time series data for anomaly detection are more comprehensive, and the accuracy of anomaly detection is improved.
It is emphasized that, in order to further ensure the privacy and security of the anomaly detection result, the anomaly detection result may also be stored in a node of a block chain.
As shown in fig. 3, fig. 3 is a schematic structural diagram of an electronic device according to a preferred embodiment of the method for detecting an abnormality based on device index data according to the present invention. The electronic device 3 comprises a memory 31, at least one processor 32, a computer program 33 stored in the memory 31 and executable on the at least one processor 32, and at least one communication bus 34.
Those skilled in the art will appreciate that the schematic diagram shown in fig. 3 is merely an example of the electronic device 3, and does not constitute a limitation of the electronic device 3, and may include more or less components than those shown, or combine some components, or different components, for example, the electronic device 3 may further include an input/output device, a network access device, and the like.
The electronic device 3 may also include, but is not limited to, any electronic product that can interact with a user through a keyboard, a mouse, a remote controller, a touch panel, or a voice control device, for example, a Personal computer, a tablet computer, a smart phone, a Personal Digital Assistant (PDA), a game machine, an Internet Protocol Television (IPTV), an intelligent wearable device, and the like. The Network where the electronic device 3 is located includes, but is not limited to, the internet, a wide area Network, a metropolitan area Network, a local area Network, a Virtual Private Network (VPN), and the like.
The at least one Processor 32 may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a transistor logic device, a discrete hardware component, etc. The processor 32 may be a microprocessor or the processor 32 may be any conventional processor or the like, and the processor 32 is a control center of the electronic device 3 and connects various parts of the whole electronic device 3 by various interfaces and lines.
The memory 31 may be used to store the computer program 33 and/or the module/unit, and the processor 32 may implement various functions of the electronic device 3 by running or executing the computer program and/or the module/unit stored in the memory 31 and calling data stored in the memory 31. The memory 31 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data) created according to the use of the electronic device 3, and the like. In addition, the memory 31 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a flash memory Card (FlashCard), at least one disk storage device, a flash memory device, and the like.
With reference to fig. 1, the memory 31 of the electronic device 3 stores a plurality of instructions to implement a method for anomaly detection based on device indicator data, and the processor 32 can execute the plurality of instructions to implement:
when an instruction for carrying out abnormity detection on equipment index data is received, target time series data corresponding to the equipment index data is obtained, wherein the target time series data comprises a period of continuous time points and the equipment index data corresponding to the time points;
performing feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained by a triple algorithm, and the curve features are features of a curve formed by equipment index data changing along with time;
according to a pre-trained long-short term memory network model, determining suspicious classification characteristics of the target time sequence data;
determining residual error characteristics of the target time sequence data according to the suspicious classification characteristics;
obtaining the dimensionality reduction characteristic of the target time sequence data by using a pre-trained encoder model;
acquiring basic features of the target time series data;
and inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data.
Specifically, the processor 32 may refer to the description of the relevant steps in the embodiment corresponding to fig. 1 for a specific implementation method of the instruction, which is not described herein again.
In the electronic device 3 described in fig. 3, the improved one-dimensional convolutional neural network model may be used to perform feature extraction on the curve corresponding to the time series data, so as to extract more comprehensive curve features, and to better represent the variation trend of the time series data, and meanwhile, the trained long and short term memory network model and the encoder model are used to extract the features of the time series data, so as to increase the features of the time series data, so that the features of the time series data for performing anomaly detection are more comprehensive, and thus the accuracy of anomaly detection is improved.
The integrated modules/units of the electronic device 3 may be stored in a computer-readable storage medium if they are implemented in the form of software functional units and sold or used as separate products. Based on such understanding, all or part of the flow of the method according to the embodiments of the present invention may also be implemented by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method embodiments may be implemented. Wherein the computer program code may be in source code form, object code form, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying said computer program code, recording medium, U-disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM).
Further, the computer usable storage medium may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function, and the like; the storage data area may store data created according to the use of the blockchain node, and the like.
The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
In the embodiments provided in the present invention, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.
The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned. Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the system claims may also be implemented by one unit or means in software or hardware. The terms second, etc. are used to denote names, but not any particular order.
Finally, it should be noted that the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions may be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims (10)
1. An anomaly detection method based on equipment index data, characterized in that the method comprises:
when an instruction for carrying out abnormity detection on equipment index data is received, target time series data corresponding to the equipment index data is obtained, wherein the target time series data comprises a period of continuous time points and the equipment index data corresponding to the time points;
performing feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained by a triple algorithm, and the curve features are features of a curve formed by equipment index data changing along with time;
according to a pre-trained long-short term memory network model, determining suspicious classification characteristics of the target time sequence data;
determining residual error characteristics of the target time sequence data according to the suspicious classification characteristics;
obtaining the dimensionality reduction characteristic of the target time sequence data by using a pre-trained encoder model;
acquiring basic features of the target time series data;
and inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data.
2. The method of claim 1, wherein before the feature extraction of the target time series data by using the trained one-dimensional convolutional neural network model to obtain the curve feature of the target time series data, the method further comprises:
acquiring multiple groups of historical time sequence data corresponding to the equipment index data;
determining a plurality of time series curves according to the plurality of groups of historical time series data, wherein the plurality of time series curves correspond to the plurality of groups of historical time series data one by one;
determining a shape-based distance between any two adjacent time-series curves of the plurality of time-series curves by a similarity algorithm;
mapping a plurality of the shape-based distances to a plurality of similarities between the plurality of time series curves;
determining a plurality of training samples according to a plurality of similarities among the plurality of time series curves;
and training by using a triple algorithm and the training samples to obtain a trained one-dimensional convolutional neural network model.
3. The method of claim 2, wherein the training using the triple algorithm and the plurality of training samples to obtain the trained one-dimensional convolutional neural network model comprises:
sequentially inputting the first time series curve, the second time series curve and the third time series curve of the plurality of training samples into an initial one-dimensional convolution neural network model to obtain a first vector, a second vector and a third vector;
performing loss calculation on the first vector, the second vector and the third vector by using a triple algorithm to obtain a loss value;
and updating the network parameters of the initial one-dimensional convolutional neural network model according to the loss value to obtain a trained one-dimensional convolutional neural network model.
4. The method of claim 1, wherein the determining suspicious classification features of the target time series data according to a pre-trained long-short term memory network model comprises:
inputting data before the latest time point in the target time sequence data into a long-term and short-term memory network to obtain predicted data corresponding to the latest time point;
calculating a difference between the predicted data and data at a latest time point in the target time series data;
and determining the absolute value corresponding to the difference value as a suspicious classification characteristic.
5. The method according to any one of claims 1 to 4, wherein the determining residual features of the target time series data according to the suspicious classification features comprises:
determining a standard deviation of the target time series data;
and determining residual error characteristics according to the suspicious classification characteristics and the standard deviation.
6. The method according to any one of claims 1 to 4, wherein the basic features comprise basic statistical features, quantile index statistical features, data distribution features and entropy features corresponding to the degree of data chaos.
7. The method according to any one of claims 1 to 4, wherein each of the training samples comprises a first time series curve, a second time series curve and a third time series curve, wherein the similarity between the first time series curve and the second time series curve is greater than a preset similarity, and the similarity between the first time series curve and the third time series curve belongs to a preset similarity interval.
8. An apparatus for detecting an abnormality based on equipment index data, the apparatus comprising:
the device comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring target time sequence data corresponding to device index data when receiving an instruction for carrying out abnormity detection on the device index data, and the target time sequence data comprises a continuous time point and the device index data corresponding to the time point;
the extraction module is used for performing feature extraction on the target time sequence data by using a trained one-dimensional convolutional neural network model to obtain curve features of the target time sequence data, wherein the one-dimensional convolutional neural network model is trained through a triple algorithm, and the curve features are features of a curve formed by equipment index data changing along with time;
the determining module is used for determining suspicious classification characteristics of the target time sequence data according to a pre-trained long-short term memory network model;
the determining module is further configured to determine a residual error feature of the target time series data according to the suspicious classification feature;
the acquisition module is further used for acquiring the dimensionality reduction characteristic of the target time sequence data by using a pre-trained encoder model;
the acquisition module is further used for acquiring basic features of the target time series data;
and the input module is used for inputting the curve feature, the suspicious classification feature, the residual error feature, the dimensionality reduction feature and the basic feature into a pre-trained anomaly detection model to obtain an anomaly detection result of the equipment index data.
9. An electronic device, comprising a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the method for detecting an abnormality based on device indicator data according to any one of claims 1 to 7.
10. A computer-readable storage medium storing at least one instruction which, when executed by a processor, implements a method for anomaly detection based on device indicator data according to any one of claims 1 to 7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010328626.0A CN111679949A (en) | 2020-04-23 | 2020-04-23 | Anomaly detection method based on equipment index data and related equipment |
| PCT/CN2020/118881 WO2021212752A1 (en) | 2020-04-23 | 2020-09-29 | Device index data-based anomaly detection method and apparatus, device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010328626.0A CN111679949A (en) | 2020-04-23 | 2020-04-23 | Anomaly detection method based on equipment index data and related equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111679949A true CN111679949A (en) | 2020-09-18 |
Family
ID=72433805
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010328626.0A Pending CN111679949A (en) | 2020-04-23 | 2020-04-23 | Anomaly detection method based on equipment index data and related equipment |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN111679949A (en) |
| WO (1) | WO2021212752A1 (en) |
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112131274A (en) * | 2020-09-22 | 2020-12-25 | 平安科技（深圳）有限公司 | Method, device and equipment for detecting time series abnormal points and readable storage medium |
| CN112380098A (en) * | 2020-11-19 | 2021-02-19 | 平安科技（深圳）有限公司 | Time sequence abnormity detection method and device, computer equipment and storage medium |
| CN112633412A (en) * | 2021-01-05 | 2021-04-09 | 南方电网深圳数字电网研究院有限公司 | Abnormal electricity consumption detection method, equipment and storage medium |
| CN113127716A (en) * | 2021-04-29 | 2021-07-16 | 南京大学 | Sentiment time sequence anomaly detection method based on saliency map |
| CN113286128A (en) * | 2021-06-11 | 2021-08-20 | 上海兴容信息技术有限公司 | Method and system for detecting target object |
| CN113516556A (en) * | 2021-05-13 | 2021-10-19 | 支付宝(杭州)信息技术有限公司 | Method and system for predicting or training model based on multi-dimensional time series data |
| WO2021212752A1 (en) * | 2020-04-23 | 2021-10-28 | 平安科技（深圳）有限公司 | Device index data-based anomaly detection method and apparatus, device, and storage medium |
| CN113722176A (en) * | 2021-07-30 | 2021-11-30 | 银清科技有限公司 | Self-adaptive abnormal performance index determining method and device |
| CN113782187A (en) * | 2021-09-10 | 2021-12-10 | 平安国际智慧城市科技股份有限公司 | Index data processing method, related device and medium |
| CN114580656A (en) * | 2022-05-06 | 2022-06-03 | 北京航空航天大学杭州创新研究院 | Single-class comparison learning-based time sequence abnormity detection method and related device |
| CN114978956A (en) * | 2022-04-11 | 2022-08-30 | 北京邮电大学 | Method and device for detecting abnormal performance mutation points of network equipment in smart city |
| CN115062706A (en) * | 2022-06-17 | 2022-09-16 | 中国电信股份有限公司 | Forest fire monitoring method and device, storage medium and electronic equipment |
| CN115134246A (en) * | 2021-03-22 | 2022-09-30 | 中国移动通信集团河南有限公司 | Network performance index monitoring method, device, equipment and storage medium |
| EP4117229A1 (en) * | 2021-07-05 | 2023-01-11 | Bull SAS | Method for detecting anomaly(-ies) in a blockchain network and blockchain network implementing such a method |
| WO2023169274A1 (en) * | 2022-03-08 | 2023-09-14 | 阿里巴巴（中国）有限公司 | Data processing method and device, and storage medium and processor |
| CN117035297A (en) * | 2023-08-02 | 2023-11-10 | 瀚能科技有限公司 | Campus intelligent task allocation method and system based on big data |
| CN117077871A (en) * | 2023-10-17 | 2023-11-17 | 山东理工昊明新能源有限公司 | Method and device for constructing energy demand prediction model based on big data |
| CN117938555A (en) * | 2024-03-25 | 2024-04-26 | 衢州海易科技有限公司 | Log sequence and parameter anomaly detection method and system for cloud platform of Internet of vehicles |
Families Citing this family (32)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113878214B (en) * | 2021-12-08 | 2022-03-25 | 苏芯物联技术(南京)有限公司 | Welding quality real-time detection method and system based on LSTM and residual distribution |
| CN114285728B (en) * | 2021-12-27 | 2024-02-02 | 中国电信股份有限公司 | Predictive model training method, traffic prediction device and storage medium |
| CN114371678A (en) * | 2022-01-11 | 2022-04-19 | 升发智联(北京)科技有限责任公司 | Equipment safety production early warning method, system, equipment and storage medium |
| CN114580467B (en) * | 2022-02-22 | 2023-11-17 | 国网山东省电力公司信息通信公司 | Power data anomaly detection method and system based on data enhancement and Tri-Training |
| CN114358443B (en) * | 2022-03-09 | 2022-06-24 | 深圳市信润富联数字科技有限公司 | Average material removal rate prediction method, device, electronic device and storage medium |
| CN115037642B (en) * | 2022-03-30 | 2023-11-21 | 武汉烽火技术服务有限公司 | Method and device for identifying flow bottleneck |
| CN114936746B (en) * | 2022-04-13 | 2023-04-07 | 舒氏集团有限公司 | Quality analysis method for wear-resistant, illumination-resistant, tensile and shrinkage-free warning tape corona composite film |
| CN114493059B (en) * | 2022-04-19 | 2022-07-05 | 西安石油大学 | Personnel management and control method and system based on machine learning |
| CN114580982B (en) * | 2022-05-07 | 2022-08-05 | 昆仑智汇数据科技(北京)有限公司 | Method, device and equipment for evaluating data quality of industrial equipment |
| CN114896307B (en) * | 2022-06-30 | 2022-09-27 | 北京航空航天大学杭州创新研究院 | Time series data enhancement method and device and electronic equipment |
| CN115526241A (en) * | 2022-09-13 | 2022-12-27 | 成都飞机工业（集团）有限责任公司 | Real-time abnormity detection method, device, equipment and medium for aviation hydraulic pump station |
| CN115358355B (en) * | 2022-10-24 | 2023-01-24 | 广东电网有限责任公司佛山供电局 | Method and device for judging main transformer oil temperature gauge and top layer oil temperature abnormity |
| CN115514620B (en) * | 2022-11-15 | 2023-03-10 | 阿里云计算有限公司 | Anomaly detection method and cloud network platform |
| CN115659243B (en) * | 2022-12-22 | 2023-04-28 | 四川九通智路科技有限公司 | Infrastructure risk monitoring method and monitoring system based on MEMS |
| CN115687032B (en) * | 2023-01-03 | 2023-03-21 | 北京安录国际技术有限公司 | Server operation and maintenance data supervision method and system |
| CN115758226B (en) * | 2023-01-06 | 2023-06-02 | 之江实验室 | Abnormality detection method and device, storage medium and electronic equipment |
| CN115759885B (en) * | 2023-01-09 | 2023-04-18 | 佰聆数据股份有限公司 | Material sampling inspection method and device based on distributed material supply |
| CN116203298B (en) * | 2023-01-31 | 2024-04-02 | 赛福凯尔(绍兴)医疗科技有限公司 | Power protection method and system based on magnetic coupling digital isolator |
| CN116306937B (en) * | 2023-03-22 | 2023-11-10 | 中航信移动科技有限公司 | Rule extraction method, medium and device based on time sequence offline data |
| CN116383749A (en) * | 2023-04-07 | 2023-07-04 | 北京华云星地通科技有限公司 | Hot mirror temperature anomaly detection method and system |
| CN116893336B (en) * | 2023-07-11 | 2024-04-02 | 宁夏隆基电气有限公司 | High-low voltage switching device and method thereof |
| CN116703485B (en) * | 2023-08-04 | 2023-10-20 | 山东创亿智慧信息科技发展有限责任公司 | Advertisement accurate marketing method and system based on big data |
| CN116862116A (en) * | 2023-09-05 | 2023-10-10 | 国网天津市电力公司营销服务中心 | Intelligent early warning method and system for preventing electricity larceny, electronic equipment and storage medium |
| CN116881646B (en) * | 2023-09-06 | 2023-11-21 | 山东奥晶生物科技有限公司 | Stevioside production monitoring data management system |
| CN116957634B (en) * | 2023-09-19 | 2023-11-21 | 贵昌集团有限公司 | Information intelligent acquisition processing method for electronic commerce platform |
| CN117060409B (en) * | 2023-10-13 | 2023-12-29 | 国网甘肃省电力公司白银供电公司 | Automatic detection and analysis method and system for power line running state |
| CN117455666A (en) * | 2023-10-16 | 2024-01-26 | 厦门国际银行股份有限公司 | Transaction technical index prediction method, device and equipment based on neural network |
| CN117609881B (en) * | 2023-11-29 | 2024-04-30 | 阿童木(广州)智能科技有限公司 | Metal overlap detection method and system based on artificial intelligence |
| CN117648232B (en) * | 2023-12-11 | 2024-05-24 | 武汉天宝莱信息技术有限公司 | Application program data monitoring method, device and storage medium |
| CN117590223B (en) * | 2024-01-18 | 2024-04-30 | 南京飞腾电子科技有限公司 | Online monitoring system and method for circuit breaker |
| CN117782588B (en) * | 2024-02-28 | 2024-05-24 | 江苏国茂减速机股份有限公司 | Intelligent fault detection method for speed reducer |
| CN117972757A (en) * | 2024-03-25 | 2024-05-03 | 贵州大学 | Method and system for realizing safety analysis of mine data based on cloud platform |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106203533B (en) * | 2016-07-26 | 2019-09-20 | 厦门大学 | Deep learning face verification method based on combined training |
| CN106901723A (en) * | 2017-04-20 | 2017-06-30 | 济南浪潮高新科技投资发展有限公司 | A kind of electrocardiographic abnormality automatic diagnosis method |
| CN109035488A (en) * | 2018-08-07 | 2018-12-18 | 哈尔滨工业大学（威海） | Aero-engine time series method for detecting abnormality based on CNN feature extraction |
| CN110008079A (en) * | 2018-12-25 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Monitor control index method for detecting abnormality, model training method, device and equipment |
| CN110991504A (en) * | 2019-11-22 | 2020-04-10 | 齐鲁工业大学 | MOTCN-AE-based multi-dimensional time sequence abnormal value detection method and system |
| CN111679949A (en) * | 2020-04-23 | 2020-09-18 | 平安科技（深圳）有限公司 | Anomaly detection method based on equipment index data and related equipment |
-
2020
- 2020-04-23 CN CN202010328626.0A patent/CN111679949A/en active Pending
- 2020-09-29 WO PCT/CN2020/118881 patent/WO2021212752A1/en active Application Filing
Cited By (27)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021212752A1 (en) * | 2020-04-23 | 2021-10-28 | 平安科技（深圳）有限公司 | Device index data-based anomaly detection method and apparatus, device, and storage medium |
| CN112131274A (en) * | 2020-09-22 | 2020-12-25 | 平安科技（深圳）有限公司 | Method, device and equipment for detecting time series abnormal points and readable storage medium |
| CN112131274B (en) * | 2020-09-22 | 2024-01-19 | 平安科技（深圳）有限公司 | Method, device, equipment and readable storage medium for detecting abnormal points of time sequence |
| CN112380098A (en) * | 2020-11-19 | 2021-02-19 | 平安科技（深圳）有限公司 | Time sequence abnormity detection method and device, computer equipment and storage medium |
| CN112380098B (en) * | 2020-11-19 | 2024-03-19 | 平安科技（深圳）有限公司 | Timing sequence abnormality detection method and device, computer equipment and storage medium |
| CN112633412A (en) * | 2021-01-05 | 2021-04-09 | 南方电网深圳数字电网研究院有限公司 | Abnormal electricity consumption detection method, equipment and storage medium |
| CN112633412B (en) * | 2021-01-05 | 2024-05-14 | 南方电网数字平台科技(广东)有限公司 | Abnormal electricity utilization detection method, abnormal electricity utilization detection equipment and storage medium |
| CN115134246A (en) * | 2021-03-22 | 2022-09-30 | 中国移动通信集团河南有限公司 | Network performance index monitoring method, device, equipment and storage medium |
| CN115134246B (en) * | 2021-03-22 | 2023-07-21 | 中国移动通信集团河南有限公司 | Network performance index monitoring method, device, equipment and storage medium |
| CN113127716A (en) * | 2021-04-29 | 2021-07-16 | 南京大学 | Sentiment time sequence anomaly detection method based on saliency map |
| CN113127716B (en) * | 2021-04-29 | 2023-07-28 | 南京大学 | Emotion time sequence anomaly detection method based on saliency map |
| CN113516556A (en) * | 2021-05-13 | 2021-10-19 | 支付宝(杭州)信息技术有限公司 | Method and system for predicting or training model based on multi-dimensional time series data |
| CN113286128A (en) * | 2021-06-11 | 2021-08-20 | 上海兴容信息技术有限公司 | Method and system for detecting target object |
| EP4117229A1 (en) * | 2021-07-05 | 2023-01-11 | Bull SAS | Method for detecting anomaly(-ies) in a blockchain network and blockchain network implementing such a method |
| CN113722176A (en) * | 2021-07-30 | 2021-11-30 | 银清科技有限公司 | Self-adaptive abnormal performance index determining method and device |
| CN113782187B (en) * | 2021-09-10 | 2023-06-27 | 深圳平安智慧医健科技有限公司 | Index data processing method, related equipment and medium |
| CN113782187A (en) * | 2021-09-10 | 2021-12-10 | 平安国际智慧城市科技股份有限公司 | Index data processing method, related device and medium |
| WO2023169274A1 (en) * | 2022-03-08 | 2023-09-14 | 阿里巴巴（中国）有限公司 | Data processing method and device, and storage medium and processor |
| CN114978956A (en) * | 2022-04-11 | 2022-08-30 | 北京邮电大学 | Method and device for detecting abnormal performance mutation points of network equipment in smart city |
| CN114978956B (en) * | 2022-04-11 | 2024-04-09 | 北京邮电大学 | Method and device for detecting abnormal mutation points of performance of intelligent city network equipment |
| CN114580656A (en) * | 2022-05-06 | 2022-06-03 | 北京航空航天大学杭州创新研究院 | Single-class comparison learning-based time sequence abnormity detection method and related device |
| CN115062706A (en) * | 2022-06-17 | 2022-09-16 | 中国电信股份有限公司 | Forest fire monitoring method and device, storage medium and electronic equipment |
| CN117035297A (en) * | 2023-08-02 | 2023-11-10 | 瀚能科技有限公司 | Campus intelligent task allocation method and system based on big data |
| CN117035297B (en) * | 2023-08-02 | 2024-04-19 | 瀚能科技有限公司 | Campus intelligent task allocation method and system based on big data |
| CN117077871B (en) * | 2023-10-17 | 2024-02-02 | 山东理工昊明新能源有限公司 | Method and device for constructing energy demand prediction model based on big data |
| CN117077871A (en) * | 2023-10-17 | 2023-11-17 | 山东理工昊明新能源有限公司 | Method and device for constructing energy demand prediction model based on big data |
| CN117938555A (en) * | 2024-03-25 | 2024-04-26 | 衢州海易科技有限公司 | Log sequence and parameter anomaly detection method and system for cloud platform of Internet of vehicles |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2021212752A1 (en) | 2021-10-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111679949A (en) | Anomaly detection method based on equipment index data and related equipment | |
| CN111783875A (en) | Abnormal user detection method, device, equipment and medium based on cluster analysis | |
| CN109583332B (en) | Face recognition method, face recognition system, medium, and electronic device | |
| CN111461168A (en) | Training sample expansion method and device, electronic equipment and storage medium | |
| JP6812086B2 (en) | Training method for reticulated pattern removal system, reticulated pattern removal method, equipment, equipment and media | |
| WO2021174875A1 (en) | Face feature vector dynamic adjustment method and related device | |
| WO2023273628A1 (en) | Video loop recognition method and apparatus, computer device, and storage medium | |
| CN111739016B (en) | Target detection model training method and device, electronic equipment and storage medium | |
| CN111785384A (en) | Abnormal data identification method based on artificial intelligence and related equipment | |
| WO2019119396A1 (en) | Facial expression recognition method and device | |
| CN111639487A (en) | Classification model-based field extraction method and device, electronic equipment and medium | |
| CN112257578A (en) | Face key point detection method and device, electronic equipment and storage medium | |
| CN113298152B (en) | Model training method, device, terminal equipment and computer readable storage medium | |
| CN113570391B (en) | Community division method, device, equipment and storage medium based on artificial intelligence | |
| CN115222443A (en) | Client group division method, device, equipment and storage medium | |
| CN111858891A (en) | Question-answer library construction method and device, electronic equipment and storage medium | |
| CN111639360A (en) | Intelligent data desensitization method and device, computer equipment and storage medium | |
| CN112529888B (en) | Face image evaluation method, device, equipment and medium based on deep learning | |
| CN113705468A (en) | Digital image identification method based on artificial intelligence and related equipment | |
| CN112036439B (en) | Dependency relationship classification method and related equipment | |
| WO2021174923A1 (en) | Concept word sequence generation method, apparatus, computer device, and storage medium | |
| CN114723652A (en) | Cell density determination method, cell density determination device, electronic apparatus, and storage medium | |
| CN112184059A (en) | Scoring analysis method and device, electronic equipment and storage medium | |
| CN111679959A (en) | Computer performance data determination method and device, computer equipment and storage medium | |
| CN114241411B (en) | Counting model processing method and device based on target detection and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40031267 Country of ref document: HK |
|
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |