CN112527604A - Deep learning-based operation and maintenance detection method and system, electronic equipment and medium - Google Patents
Deep learning-based operation and maintenance detection method and system, electronic equipment and medium Download PDFInfo
- Publication number
- CN112527604A CN112527604A CN202011499394.1A CN202011499394A CN112527604A CN 112527604 A CN112527604 A CN 112527604A CN 202011499394 A CN202011499394 A CN 202011499394A CN 112527604 A CN112527604 A CN 112527604A
- Authority
- CN
- China
- Prior art keywords
- model
- data
- kpi
- training
- detection method
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012423 maintenance Methods 0.000 title claims abstract description 72
- 238000001514 detection method Methods 0.000 title claims abstract description 69
- 238000013135 deep learning Methods 0.000 title claims abstract description 28
- 238000012549 training Methods 0.000 claims abstract description 74
- 230000002159 abnormal effect Effects 0.000 claims abstract description 60
- 238000012545 processing Methods 0.000 claims abstract description 41
- 238000000605 extraction Methods 0.000 claims abstract description 20
- 238000000034 method Methods 0.000 claims abstract description 13
- 238000004458 analytical method Methods 0.000 claims description 35
- 238000003062 neural network model Methods 0.000 claims description 32
- 238000007637 random forest analysis Methods 0.000 claims description 23
- 238000007477 logistic regression Methods 0.000 claims description 21
- 238000007781 pre-processing Methods 0.000 claims description 11
- 230000009466 transformation Effects 0.000 claims description 11
- 238000012360 testing method Methods 0.000 claims description 8
- 238000000354 decomposition reaction Methods 0.000 claims description 5
- 238000013528 artificial neural network Methods 0.000 claims description 4
- 238000013501 data transformation Methods 0.000 claims description 4
- 238000013473 artificial intelligence Methods 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims description 3
- 230000000694 effects Effects 0.000 abstract description 5
- 239000000284 extract Substances 0.000 abstract description 3
- 238000007636 ensemble learning method Methods 0.000 abstract description 2
- 230000006870 function Effects 0.000 description 5
- 208000018910 keratinopathic ichthyosis Diseases 0.000 description 4
- 238000005457 optimization Methods 0.000 description 3
- 230000007547 defect Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000001914 filtration Methods 0.000 description 2
- 210000002569 neuron Anatomy 0.000 description 2
- 238000005070 sampling Methods 0.000 description 2
- OKTJSMMVPCPJKN-UHFFFAOYSA-N Carbon Chemical compound [C] OKTJSMMVPCPJKN-UHFFFAOYSA-N 0.000 description 1
- 230000005856 abnormality Effects 0.000 description 1
- 230000004913 activation Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 229910021389 graphene Inorganic materials 0.000 description 1
- 238000011423 initialization method Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 210000004205 output neuron Anatomy 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 238000013515 script Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000002194 synthesizing effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3051—Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Biomedical Technology (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computational Linguistics (AREA)
- Biophysics (AREA)
- Data Mining & Analysis (AREA)
- Life Sciences & Earth Sciences (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Quality & Reliability (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Image Analysis (AREA)
Abstract
The invention provides an operation and maintenance detection method, system, electronic equipment and medium based on deep learning, and belongs to the technical field of intelligent operation and maintenance. The operation and maintenance detection method comprises the following steps: acquiring original data; performing feature extraction processing on the original data to form a KPI feature sample set, wherein the KPI feature sample set comprises training data features of each original data; inputting the KPI characteristic sample set into a training model to obtain a weight value, wherein the weight value is configured into a numerical value obtained by the training model through calculating data in the KPI characteristic sample set; and comparing the weight values and judging the detection result of the original data. The method extracts features from original data and forms a KPI feature sample set, further processes a training model for the KPI feature sample set, and finally converts abnormal detection into a binary problem through a deep ensemble learning method, so that the effect of improving the detection accuracy is realized, manual stacking rules are avoided, the operation and maintenance cost is reduced, and the intelligent automatic operation and maintenance efficiency is improved.
Description
Technical Field
The invention belongs to the technical field of intelligent operation and maintenance, and particularly relates to an operation and maintenance detection method and system based on deep learning, electronic equipment and a medium.
Background
In a traditional IT operation and maintenance system, a manual operation and maintenance mode is generally adopted, and the manual operation and maintenance mode refers to that after maintenance personnel log in each server one by one through a communication protocol at a client, relevant maintenance commands are executed on the servers and the servers are checked one by one. In the era of rapid development of the internet IT industry, the labor cost is high, the operation and maintenance efficiency is low, and the manual operation and maintenance mode cannot meet the requirements.
Gradually, people start to use an automatic operation and maintenance mode to perform operation and maintenance, and a common automatic operation and maintenance mode is to install corresponding software programs at a server side and a client side simultaneously to achieve automatic maintenance, but the automatic operation and maintenance reduces repetitive operation and maintenance work through predefined rule scripts, and is slowly not suitable for large environments with various current service types and various KPI abnormal types. Therefore, the automatic operation and maintenance mode based on the artificial designated rule improves the learning cost of operation and maintenance personnel, has high operation and maintenance difficulty and low operation and maintenance efficiency, and the conventional automatic operation and maintenance mode cannot meet the requirements of people on intelligent operation and maintenance at present.
Disclosure of Invention
The invention aims to overcome the defects in the prior art, provides an operation and maintenance detection method, system, electronic equipment and medium based on deep learning, solves the problems of high learning cost, high operation and maintenance difficulty and low operation and maintenance efficiency of operation and maintenance personnel caused by an automatic operation and maintenance mode based on artificial designated rules in the prior art, and overcomes the defect that the conventional automatic operation and maintenance mode cannot meet the requirements of people on intelligent operation and maintenance at present.
In order to achieve the above object, in a first aspect, the present invention provides an operation and maintenance detection method based on deep learning, including the following steps:
step S1: acquiring original data;
step S2: performing feature extraction processing on the original data to form a KPI feature sample set, wherein the KPI feature sample set comprises training data features of each original data;
step S3: inputting the KPI characteristic sample set into a training model to obtain a weight value, wherein the weight value is configured to be a numerical value obtained by the training model through calculation on data in the KPI characteristic sample set;
step S4: and comparing the weight values and judging the detection result of the original data.
Further, before step S2, a raw data preprocessing step S101 is further included: and preprocessing the original data through the steps of missing value processing, abnormal value removing and data transformation.
Further, in step S101: and applying a Grabbs criterion to remove abnormal values of the original data, wherein the abnormal values are new abnormal values or abnormal values of official marks, applying a Z-score or Min-Max standardization criterion to standardize and normalize the original data, obtaining original data characteristics from the original data, and performing mean value method completion on the original data characteristics.
Further, in step S2, a feature extraction process is performed on the original data features of the original data to obtain training data features corresponding to the original data, where the training data features include original value features, wavelet analysis features, statistical features, and fitting features.
Further, the training data features include 64 timing features.
Further, in forming the KPI feature sample set, the following steps are included:
and carrying out iterative processing on the training data characteristics to generate a characteristic subset, wherein the characteristic subset comprises a non-abnormal data characteristic subset and an abnormal data characteristic subset, carrying out undersampling processing on the non-abnormal data characteristic subset, carrying out oversampling processing on the abnormal data characteristic subset, and combining results of the undersampling processing and the oversampling processing to form a KPI characteristic sample set.
Further, the training model comprises a weighting model, and the weighting model is configured to be obtained by synthesizing four models, namely a logistic regression model, a wavelet analysis model, a random forest model and a BilSTM neural network model.
Further, in the logistic regression model, the following steps are included:
step S311, preprocessing data;
step S312, decomposing the training set data STL;
step S313, selecting characteristics;
s314, selecting the first 7 points and all normal points of the abnormal interval of the training set as training samples, wherein all the abnormal points of the abnormal interval are selected for the abnormal interval of the training set with less than 7 points;
step S315, model training, gradient descent solving parameters;
step S316, determining a threshold value;
and step S317, marking the test set.
Further, in the wavelet analysis model, the following steps are included:
s321, performing discrete wavelet transform on the KPI characteristic sample set to obtain a plurality of KPI characteristic sample sequences, and reconstructing the KPI characteristic sample sequences;
step S322, performing 5-level wavelet transformation on the reconstructed KPI characteristic sample sequence to obtain a transformation result, wherein the transformation result comprises a detail part sequence and an approximate part sequence;
step S323, self-defining a time window aiming at the detail part sequence, carrying out wavelet decomposition and reconstruction on the data in the time window, extracting the detail part sequence, and identifying abnormal points on the detail part sequence in the time window by adopting a Grubbs criterion;
in step S324, if the time point of the current time window is in the abnormal point set, the detection of the current time point is determined to be abnormal.
Further, the key parameters in the random forest model include n _ estimators, max _ depth, max _ features, and min _ sample _ leaf.
Further, in the BilSTM neural network model, the following steps are included:
acquiring a KPI (Key performance indicator) feature sample set, and extracting a sample feature vector based on the KPI feature sample set;
carrying out iterative training on the sample feature vector based on a BilSTM neural network model to obtain each parameter of the BilSTM neural network model;
extracting characteristic information based on the BilSTM neural network model;
and importing the characteristic information into a conditional random field to obtain an artificial intelligence model based on a neural network.
Further, the weighting model integrates the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model by applying the following normal distribution formula to obtain a weight value P:
further, the weight values are compared:
setting the weight corresponding to the model with the score less than 0.5 in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model as 0 under the condition that any one model score in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model is more than 0.5;
and under the condition that the scores of the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model are all less than 0.5, defining the model with the highest score in the four models as a prediction model, and setting the weights of the rest three models as 0.
In a second aspect, the present invention provides a system applied to the operation and maintenance detection method, including:
an acquisition unit configured to acquire original data;
a feature extraction unit configured to perform feature extraction processing on the raw data and form a KPI feature sample set;
a training model unit configured to perform processing of a training model on the KPI feature sample set and obtain a weight value;
a comparison unit configured to compare the weight values and judge a detection result of the original data.
In a third aspect, the present invention provides an electronic device, including a processor and a memory, where at least one instruction, at least one program, a code set, or a set of instructions is stored in the memory, and the at least one instruction, the at least one program, the code set, or the set of instructions is loaded and executed by the processor to implement the deep learning based operation and maintenance detection method as described above.
In a fourth aspect, the present invention provides a computer readable storage medium, on which computer instructions are stored, wherein the computer instructions, when executed by a processor, implement the steps of the operation and maintenance detection method as described above.
The invention has the beneficial effects that:
according to the operation and maintenance detection method based on deep learning, provided by the invention, the features are extracted from the original data and a KPI feature sample set is formed, then the KPI feature sample set is processed by a training model, learning is performed from massive events and processing logs through a deep ensemble learning method, then corresponding analysis and decision and rule summarization are performed based on the training model, and finally abnormal detection is converted into a binary problem, so that the effect of improving the detection accuracy is realized, the manual stacking of rules is avoided, the operation and maintenance cost is reduced, and the intelligent automatic operation and maintenance efficiency is improved.
Drawings
The invention is further illustrated by means of the attached drawings, but the embodiments in the drawings do not constitute any limitation to the invention, and for a person skilled in the art, other drawings can be obtained on the basis of the following drawings without inventive effort.
Fig. 1 is a schematic diagram of a flow framework of an operation and maintenance detection method based on deep learning provided in this embodiment 1.
Fig. 2 is a detailed schematic view of a flow framework of the operation and maintenance detection method based on deep learning provided in this embodiment 1.
Fig. 3 is a schematic diagram of an operation and maintenance detection system based on deep learning according to embodiment 2.
Detailed Description
The technical solutions of the present invention will be described clearly and completely with reference to the accompanying drawings, and it should be understood that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of description and simplicity of description, but do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
Example 1:
referring to fig. 1 to 2, the present embodiment provides an operation and maintenance detection method based on deep learning, including the following steps:
step S1: acquiring original data;
step S2: performing feature extraction processing on the original data to form a KPI feature sample set, wherein the KPI feature sample set comprises training data features of each original data;
step S3: inputting the KPI characteristic sample set into a training model to obtain a weight value, wherein the weight value is configured to be a numerical value obtained by the training model through calculation on data in the KPI characteristic sample set;
step S4: and comparing the weight values and judging the detection result of the original data.
It should be noted that the operation and maintenance detection method mainly includes two major aspects, one is feature extraction, and the other is KPI anomaly detection. Extracting training data characteristics corresponding to each original data from the original data including massive events, processing logs and the like through characteristic extraction, and forming a KPI characteristic sample set; and then detecting abnormal points of data in the KPI characteristic sample set, inputting the KPI characteristic sample set into a training model, wherein the training model comprises a plurality of sub-training models, the sub-training models respectively carry out learning analysis on the KPI characteristic sample set from different aspects, weighting the values obtained by respective processing into a weight value, finally comparing the weight value, judging the detection result of the original data, and accordingly converting abnormal detection into a binary problem, so that the effect of improving the detection accuracy is realized, the manual stacking rule is avoided, the operation and maintenance cost is reduced, and the intelligent automatic operation and maintenance efficiency is improved.
In this embodiment, before step S2, a raw data preprocessing step S101 is further included: and preprocessing the original data through the steps of missing value processing, abnormal value removing and data transformation.
As a preferable mode, in step S101: and (3) removing abnormal values of the original data by applying a Grubbs criterion, namely the Grubbs criterion, wherein the abnormal values can be new abnormal values or abnormal values of official marks, selecting a Z-score or Min-Max standardization criterion according to actual conditions, standardizing and normalizing the removed original data, obtaining original data characteristics from the original data, and completing the formed original data characteristics by selecting a mean value method. After the preprocessing of the missing value processing, the abnormal value removing, the data transformation and the like, the feature extraction processing in step S2 is performed on the original data features.
In this embodiment, in step S2, performing feature extraction processing on original data features of the original data to obtain training data features corresponding to the original data, where the training data features include an original value feature, a wavelet analysis feature, a statistical feature, and a fitting feature, and it should be noted that the feature extraction processing selects to perform extraction processing on four different features, namely, the original value feature, the wavelet analysis feature, the statistical feature, and the fitting feature, and extracts 64 time series features in total by adjusting extraction method parameters and a time window size, that is, there are 64 time series features for each training data feature, and the 64 time series features respectively describe the training data feature from 64 dimensions; the 64 time sequence features are used for training a model, and in the detection stage, the historical window data is required to be used for calculating the dimensionality of the 64 time sequence features of the current training data features when each training data feature is obtained.
In this embodiment, in forming the KPI feature sample set, the following steps are included:
carrying out iterative processing on the training data characteristics by adjusting independent variables and dependent variables and using methods such as correlation coefficients, chi-square detection, information gain, mutual information and the like, and iteratively generating characteristic subsets, wherein the characteristic subsets comprise non-abnormal data characteristic subsets and abnormal data characteristic subsets; after the feature subset samples are cleaned, the phenomenon of unbalance of positive and negative samples occurs, so that the non-abnormal data feature subset is subjected to undersampling treatment, namely random sampling treatment, the abnormal data feature subset is subjected to oversampling treatment, and a KPI feature sample set is formed after analysis and treatment by combining the results of the undersampling treatment and the oversampling treatment.
In this embodiment, step S201 is further performed before step S3, in which the KPI feature sample set is subjected to feature preprocessing by means of feature optimization and filtering sampling, and the obtained data is provided to the training model in step S3, where the training model includes a weighting model configured by integrating four models, i.e., a logistic regression model, a wavelet analysis model, a random forest model, and a BiLSTM neural network model. Because the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model are different in performance on different KPIs, in order to enable the anomaly detection result to be more accurate, the four models are comprehensively processed by adopting a weighting processing mode on the basis of the four models.
As a preferable mode, the logistic regression model includes the following steps:
step S311, preprocessing data;
step S312, decomposing the training set data STL;
step S313, selecting characteristics;
s314, selecting the first 7 points and all normal points of the abnormal interval of the training set as training samples, wherein all the abnormal points of the abnormal interval are selected for the abnormal interval of the training set with less than 7 points;
step S315, model training, gradient descent solving parameters;
step S316, determining a threshold value;
and step S317, marking the test set.
As a preferable mode, in the wavelet analysis model, the following steps are included:
s321, performing discrete wavelet transform on the KPI characteristic sample set to obtain a plurality of KPI characteristic sample sequences, and reconstructing the KPI characteristic sample sequences;
step S322, performing 5-level wavelet transformation on the reconstructed KPI characteristic sample sequence to obtain a transformation result, wherein the transformation result comprises a detail part sequence and an approximate part sequence;
step S323, self-defining a time window aiming at the detail part sequence, carrying out wavelet decomposition and reconstruction on the data in the time window, extracting the detail part sequence, and identifying abnormal points on the detail part sequence in the time window by adopting a Grubbs criterion;
in step S324, if the time point of the current time window is in the abnormal point set, the detection of the current time point is determined to be abnormal.
It should be noted that, according to the denoising and filtering characteristics of wavelet analysis and the function of time-frequency multi-resolution analysis thereof, the KPI feature sample set transformed by discrete wavelet is decomposed into a plurality of KPI feature sample sequences, and the KPI feature sample sequences are reconstructed; after 5-level wavelet transformation is carried out on the KPI characteristic sample sequence, a transformation result comprising a detail part sequence and an approximate part sequence is obtained, wherein the right side is the detail part sequence, and the left side is the approximate part sequence; since the outliers are distributed more clearly in the sequence of the detail part, in particular, the outliers are distributed with a greater probability in the high-frequency component of the sequence of the detail part. Therefore, abnormal point detection of time sequence characteristics in KPI characteristic sample sets is converted into abnormal point detection of detail partial sequences.
Then, a time window is customized according to the detail part sequence, wavelet decomposition and reconstruction are carried out on data in the time window by selecting a proper time window, the detail part sequence is extracted, abnormal points on the detail part sequence in the time window are identified by adopting a Grubbs criterion, and if the time point of the current time window is in an abnormal point set, the detection abnormality of the current time point is judged.
Additionally, in the processing of the wavelet analysis model, the selection of wavelet basis functions, signal expansion modes, the number of layers of wavelet decomposition, and the size of the time window will affect the final anomaly detection effect. Therefore, in KPI training, the method takes the highest score of a training set as a target, extracts the best wavelet analysis parameters for each KPI by a grid searching method, and uses the parameters for online detection.
As a preferred mode, the capability of processing high-latitude data by using a random forest model is low in data requirement and strong in robustness, KPI (kernel performance indicator) abnormity can be effectively detected, key parameters in the random forest model comprise n _ estimators, max _ depth, max _ features and min _ sample _ leaf, and the random forest model performs optimization processing on the four key parameters.
As a preferred mode, the BiLSTM neural network model comprises the following steps:
acquiring a KPI (Key performance indicator) feature sample set, and extracting a sample feature vector based on the KPI feature sample set;
carrying out iterative training on the sample feature vector based on a BilSTM neural network model to obtain each parameter of the BilSTM neural network model;
extracting characteristic information based on the BilSTM neural network model;
and importing the characteristic information into a conditional random field to obtain an artificial intelligence model based on a neural network.
It should be noted that the BilSTM neural network model training has the characteristic of strong learning ability, LSTM is an excellent variation of RNN and is suitable for processing the problems related to time sequence data, the BilSTM with a bidirectional structure has better performance, and a many-to-one prediction model constructed by using the BilSTM can be directly used for anomaly detection.
The difficulty of the BilSTM neural network model training lies in the selection of the hyper-parameters, and due to the problem of computing resources, a manual optimization method is selected, so that the training and testing have better performance under the condition of relatively comprehensive data coverage. The main hyper-parameters include the following: the method comprises the following steps of learning rate eta, regularization parameter lambda, the number L of neural network layers, the number of neurons in each hidden layer, the number of learned rounds Epoch, small batch data batch size, the encoding mode of output neurons, cost function selection, weight initialization method, the type of neuron activation function, data participating in a training model and the like.
In this embodiment, since the logistic regression model, the wavelet analysis model, the random forest model, and the BiLSTM neural network model are different in their respective KPIs, in order to make the detection of abnormal data more accurate, the weighting model integrates the logistic regression model, the wavelet analysis model, the random forest model, and the BiLSTM neural network model using the following normal distribution formula, so as to obtain a weight value P:
preferably, the weight values are compared as follows:
setting the weight corresponding to the model with the score less than 0.5 in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model as 0 under the condition that any one model score in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model is more than 0.5;
and under the condition that the scores of the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model are all less than 0.5, defining the model with the highest score in the four models as a prediction model, and setting the weights of the rest three models as 0.
The following examples illustrate:
according to official standards, the total score of the logistic regression model in the test set was 0.693049243;
using the official scoring criteria, the total score of the wavelet analysis model on the test set was 0.649976063. Since wavelet analysis models behave differently on different KPIs, wavelet analysis is not applicable to all KPIs.
According to the official standard, the total score of the random forest model on the test set was 0.701142416, which scored the highest among the four basic algorithms.
The total score of the BilSTM neural network model on the test set was 0.691123881.
The single model score range of the four models is 00.64-0.70, but the comprehensive score reaches 0.771397, so that the detection accuracy is effectively improved and the misjudgment is effectively reduced by the operation and maintenance detection method.
Example 2:
referring to fig. 3, this embodiment 2 provides a system applied to the operation and maintenance detection method in embodiment 1, including:
an acquisition unit configured to acquire original data;
a feature extraction unit configured to perform feature extraction processing on the raw data and form a KPI feature sample set;
a training model unit configured to perform processing of a training model on the KPI feature sample set and obtain a weight value;
a comparison unit configured to compare the weight values and judge a detection result of the original data.
The acquiring unit transmits the acquired original data to the feature extracting unit, the feature extracting unit is responsible for performing feature extraction processing on the original data and forming a KPI feature sample set, the training model unit performs training model processing on the KPI feature sample set and obtains a weight value, and finally, the comparing unit compares the weight value and judges a detection result of the original data.
Example 3:
this embodiment 3 provides an electronic device, which includes a processor and a memory, where the memory stores at least one instruction, at least one program, a code set, or a set of instructions, and the at least one instruction, the at least one program, the code set, or the set of instructions is loaded and executed by the processor to implement the deep learning based operation and maintenance detection method in embodiment 1.
Example 4:
this embodiment 4 provides a computer-readable storage medium, on which computer instructions are stored, wherein the computer instructions, when executed by a processor, implement the steps of the operation and maintenance detection method in embodiment 1.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may take the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.
In a typical configuration, a computer includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
Compared with the prior art, the operation and maintenance detection method based on deep learning provided by the invention has the advantages that the features are extracted from the original data and the KPI feature sample set is formed, the KPI feature sample set is processed by a training model, learning is performed from massive events and processing logs through a deep integration learning method, corresponding analysis and decision and rule summarization are performed based on the training model, and finally, the abnormal detection is converted into the binary problem, so that the effect of improving the detection accuracy is realized, the manual stacking of the rules is avoided, the operation and maintenance cost is reduced, and the intelligent automatic operation and maintenance efficiency is improved.
Finally, it should be emphasized that the present invention is not limited to the above-described embodiments, but only the preferred embodiments of the invention have been described above, and the present invention is not limited to the above-described embodiments, and any modifications, equivalent substitutions, improvements, etc. within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (16)
1. An operation and maintenance detection method based on deep learning is characterized by comprising the following steps:
step S1: acquiring original data;
step S2: performing feature extraction processing on the original data to form a KPI feature sample set, wherein the KPI feature sample set comprises training data features of each original data;
step S3: inputting the KPI characteristic sample set into a training model to obtain a weight value, wherein the weight value is configured to be a numerical value obtained by the training model through calculation on data in the KPI characteristic sample set;
step S4: and comparing the weight values and judging the detection result of the original data.
2. The deep learning-based operation and maintenance detection method according to claim 1, further comprising, before step S2, a raw data preprocessing step S101: and preprocessing the original data through the steps of missing value processing, abnormal value removing and data transformation.
3. The deep learning-based operation and maintenance detection method as claimed in claim 2, wherein in step S101: and applying a Grabbs criterion to remove abnormal values of the original data, wherein the abnormal values are new abnormal values or abnormal values of official marks, applying a Z-score or Min-Max standardization criterion to standardize and normalize the original data, obtaining original data characteristics from the original data, and performing mean value method completion on the original data characteristics.
4. The deep learning-based operation and maintenance detection method according to claim 3, wherein in step S2, feature extraction processing is performed on the raw data features of the raw data to obtain training data features corresponding to the raw data, and the training data features include raw value features, wavelet analysis features, statistical features and fitting features.
5. The deep learning-based operation and maintenance detection method according to claim 4, wherein the training data features include 64 timing features.
6. The deep learning-based operation and maintenance detection method as claimed in claim 5, wherein the method comprises the following steps in forming KPI feature sample sets:
and carrying out iterative processing on the training data characteristics to generate a characteristic subset, wherein the characteristic subset comprises a non-abnormal data characteristic subset and an abnormal data characteristic subset, carrying out undersampling processing on the non-abnormal data characteristic subset, carrying out oversampling processing on the abnormal data characteristic subset, and combining results of the undersampling processing and the oversampling processing to form a KPI characteristic sample set.
7. The deep learning-based operation and maintenance detection method as claimed in any one of claims 1 to 6, wherein the training model comprises a weighting model, and the weighting model is configured by integrating four models, namely a logistic regression model, a wavelet analysis model, a random forest model and a BilSTM neural network model.
8. The deep learning-based operation and maintenance detection method as claimed in claim 7, wherein the logistic regression model comprises the following steps:
step S311, preprocessing data;
step S312, decomposing the training set data STL;
step S313, selecting characteristics;
s314, selecting the first 7 points and all normal points of the abnormal interval of the training set as training samples, wherein all the abnormal points of the abnormal interval are selected for the abnormal interval of the training set with less than 7 points;
step S315, model training, gradient descent solving parameters;
step S316, determining a threshold value;
and step S317, marking the test set.
9. The deep learning-based operation and maintenance detection method as claimed in claim 7, wherein the wavelet analysis model comprises the following steps:
s321, performing discrete wavelet transform on the KPI characteristic sample set to obtain a plurality of KPI characteristic sample sequences, and reconstructing the KPI characteristic sample sequences;
step S322, performing 5-level wavelet transformation on the reconstructed KPI characteristic sample sequence to obtain a transformation result, wherein the transformation result comprises a detail part sequence and an approximate part sequence;
step S323, self-defining a time window aiming at the detail part sequence, carrying out wavelet decomposition and reconstruction on the data in the time window, extracting the detail part sequence, and identifying abnormal points on the detail part sequence in the time window by adopting a Grubbs criterion;
in step S324, if the time point of the current time window is in the abnormal point set, the detection of the current time point is determined to be abnormal.
10. The deep learning-based operation and maintenance detection method as claimed in claim 7, wherein the key parameters in the random forest model include n _ estimators, max _ depth, max _ features and min _ sample _ leaf.
11. The deep learning-based operation and maintenance detection method as claimed in claim 7, wherein the BilSTM neural network model comprises the following steps:
acquiring a KPI (Key performance indicator) feature sample set, and extracting a sample feature vector based on the KPI feature sample set;
carrying out iterative training on the sample feature vector based on a BilSTM neural network model to obtain each parameter of the BilSTM neural network model;
extracting characteristic information based on the BilSTM neural network model;
and importing the characteristic information into a conditional random field to obtain an artificial intelligence model based on a neural network.
12. The deep learning-based operation and maintenance detection method according to any one of claims 8 to 11, wherein the weighting model integrates the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model by applying the following normal distribution formula to obtain a weight value P:
13. the deep learning-based operation and maintenance detection method according to claim 12, wherein the weight values are compared:
setting the weight corresponding to the model with the score less than 0.5 in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model as 0 under the condition that any one model score in the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model is more than 0.5;
and under the condition that the scores of the logistic regression model, the wavelet analysis model, the random forest model and the BilSTM neural network model are all less than 0.5, defining the model with the highest score in the four models as a prediction model, and setting the weights of the rest three models as 0.
14. A system applied to the operation and maintenance detection method according to any one of claims 1 to 13, comprising:
an acquisition unit configured to acquire original data;
a feature extraction unit configured to perform feature extraction processing on the raw data and form a KPI feature sample set;
a training model unit configured to perform processing of a training model on the KPI feature sample set and obtain a weight value;
a comparison unit configured to compare the weight values and judge a detection result of the original data.
15. An electronic device comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a set of codes, or a set of instructions, and the at least one instruction, at least one program, a set of codes, or a set of instructions is loaded and executed by the processor to implement the deep learning based operation and maintenance detection method according to any one of claims 1 to 13.
16. A computer readable storage medium having stored thereon computer instructions, which when executed by a processor, perform the steps of the operation and maintenance detection method according to any one of claims 1 to 13.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011499394.1A CN112527604A (en) | 2020-12-16 | 2020-12-16 | Deep learning-based operation and maintenance detection method and system, electronic equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011499394.1A CN112527604A (en) | 2020-12-16 | 2020-12-16 | Deep learning-based operation and maintenance detection method and system, electronic equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112527604A true CN112527604A (en) | 2021-03-19 |
Family
ID=75001218
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011499394.1A Pending CN112527604A (en) | 2020-12-16 | 2020-12-16 | Deep learning-based operation and maintenance detection method and system, electronic equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112527604A (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113051452A (en) * | 2021-04-12 | 2021-06-29 | 清华大学 | Operation and maintenance data feature selection method and device |
| CN113419465A (en) * | 2021-07-13 | 2021-09-21 | 浙江菲达环保科技股份有限公司 | Data preprocessing method and system for environmental protection system of thermal power generating unit |
| CN113496440A (en) * | 2021-06-28 | 2021-10-12 | 国网上海市电力公司 | User abnormal electricity utilization detection method and system |
| CN113807716A (en) * | 2021-09-23 | 2021-12-17 | 宝信软件(武汉)有限公司 | Network operation and maintenance automation method based on artificial intelligence |
| CN116245406A (en) * | 2023-02-09 | 2023-06-09 | 江苏省工商行政管理局信息中心 | Software operation and maintenance quality evaluation method and system based on operation and maintenance quality management database |
| CN116647586A (en) * | 2023-07-24 | 2023-08-25 | 山东工泵电机有限公司 | Method for realizing remote control of water and fertilizer integrated intelligent pump house by cloud computing |
| CN117331339A (en) * | 2023-12-01 | 2024-01-02 | 南京华视智能科技股份有限公司 | Coating machine die head motor control method and device based on time sequence neural network model |
| CN117874680A (en) * | 2024-01-15 | 2024-04-12 | 北京环宇博亚科技有限公司 | Operation and maintenance management system for fort machine |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105759177A (en) * | 2016-04-26 | 2016-07-13 | 浙江大学城市学院 | Classified-multi-mode-fusion-based distributed grid island detection method |
| CN109976986A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | The detection method and device of warping apparatus |
| CN110033135A (en) * | 2019-04-15 | 2019-07-19 | 北京交通大学 | The train braking system failure prediction method that Multivariate Time Series feature is reinforced |
| CN111507376A (en) * | 2020-03-20 | 2020-08-07 | 厦门大学 | Single index abnormality detection method based on fusion of multiple unsupervised methods |
| CN111860897A (en) * | 2020-08-05 | 2020-10-30 | 青岛特来电新能源科技有限公司 | Abnormity detection method, device, equipment and computer readable storage medium |
| CN111858231A (en) * | 2020-05-11 | 2020-10-30 | 北京必示科技有限公司 | Single index abnormality detection method based on operation and maintenance monitoring |
-
2020
- 2020-12-16 CN CN202011499394.1A patent/CN112527604A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105759177A (en) * | 2016-04-26 | 2016-07-13 | 浙江大学城市学院 | Classified-multi-mode-fusion-based distributed grid island detection method |
| CN109976986A (en) * | 2017-12-28 | 2019-07-05 | 阿里巴巴集团控股有限公司 | The detection method and device of warping apparatus |
| CN110033135A (en) * | 2019-04-15 | 2019-07-19 | 北京交通大学 | The train braking system failure prediction method that Multivariate Time Series feature is reinforced |
| CN111507376A (en) * | 2020-03-20 | 2020-08-07 | 厦门大学 | Single index abnormality detection method based on fusion of multiple unsupervised methods |
| CN111858231A (en) * | 2020-05-11 | 2020-10-30 | 北京必示科技有限公司 | Single index abnormality detection method based on operation and maintenance monitoring |
| CN111860897A (en) * | 2020-08-05 | 2020-10-30 | 青岛特来电新能源科技有限公司 | Abnormity detection method, device, equipment and computer readable storage medium |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113051452A (en) * | 2021-04-12 | 2021-06-29 | 清华大学 | Operation and maintenance data feature selection method and device |
| CN113051452B (en) * | 2021-04-12 | 2022-04-26 | 清华大学 | Operation and maintenance data feature selection method and device |
| CN113496440A (en) * | 2021-06-28 | 2021-10-12 | 国网上海市电力公司 | User abnormal electricity utilization detection method and system |
| CN113496440B (en) * | 2021-06-28 | 2023-12-12 | 国网上海市电力公司 | User abnormal electricity consumption detection method and system |
| CN113419465A (en) * | 2021-07-13 | 2021-09-21 | 浙江菲达环保科技股份有限公司 | Data preprocessing method and system for environmental protection system of thermal power generating unit |
| CN113807716A (en) * | 2021-09-23 | 2021-12-17 | 宝信软件(武汉)有限公司 | Network operation and maintenance automation method based on artificial intelligence |
| CN116245406A (en) * | 2023-02-09 | 2023-06-09 | 江苏省工商行政管理局信息中心 | Software operation and maintenance quality evaluation method and system based on operation and maintenance quality management database |
| CN116245406B (en) * | 2023-02-09 | 2023-09-19 | 江苏省工商行政管理局信息中心 | Software operation and maintenance quality evaluation method and system based on operation and maintenance quality management database |
| CN116647586A (en) * | 2023-07-24 | 2023-08-25 | 山东工泵电机有限公司 | Method for realizing remote control of water and fertilizer integrated intelligent pump house by cloud computing |
| CN117331339A (en) * | 2023-12-01 | 2024-01-02 | 南京华视智能科技股份有限公司 | Coating machine die head motor control method and device based on time sequence neural network model |
| CN117331339B (en) * | 2023-12-01 | 2024-02-06 | 南京华视智能科技股份有限公司 | Coating machine die head motor control method and device based on time sequence neural network model |
| CN117874680A (en) * | 2024-01-15 | 2024-04-12 | 北京环宇博亚科技有限公司 | Operation and maintenance management system for fort machine |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112527604A (en) | Deep learning-based operation and maintenance detection method and system, electronic equipment and medium | |
| CN108737406B (en) | Method and system for detecting abnormal flow data | |
| CN109916628B (en) | Rolling bearing fault diagnosis method based on improved multi-scale amplitude perception permutation entropy | |
| CN112414694B (en) | Equipment multistage abnormal state identification method and device based on multivariate state estimation technology | |
| CN110008082B (en) | Abnormal task intelligent monitoring method, device, equipment and storage medium | |
| CN112149909A (en) | Ship oil consumption prediction method and device, computer equipment and storage medium | |
| CN117592870B (en) | Comprehensive analysis system based on water environment monitoring information | |
| US20240135145A1 (en) | Generation of Realistic Data for Training Of Artificial Neural Networks | |
| CN114048468A (en) | Intrusion detection method, intrusion detection model training method, device and medium | |
| CN116756594A (en) | Method, system, equipment and medium for detecting abnormal points of power grid data | |
| CN115587543A (en) | Federal learning and LSTM-based tool residual life prediction method and system | |
| CN111915595A (en) | Image quality evaluation method, and training method and device of image quality evaluation model | |
| CN116595465A (en) | High-dimensional sparse data outlier detection method and system based on self-encoder and data enhancement | |
| CN110956331A (en) | Method, system and device for predicting operation state of digital factory | |
| CN116627116B (en) | Process industry fault positioning method and system and electronic equipment | |
| CN116662186A (en) | Log playback assertion method and device based on logistic regression and electronic equipment | |
| CN113780084B (en) | Face data amplification method based on generation type countermeasure network, electronic equipment and storage medium | |
| CN115758086A (en) | Method, device and equipment for detecting faults of cigarette cut-tobacco drier and readable storage medium | |
| CN111798237B (en) | Abnormal transaction diagnosis method and system based on application log | |
| Nezamivand Chegini et al. | New Cointegration-Based Feature Extraction Technique for Intelligent Bearing Fault Detection Under Time-Varying Speed | |
| CN115831339B (en) | Medical system risk management and control pre-prediction method and system based on deep learning | |
| CN118013443B (en) | Online real-time vacuum dry pump abnormality detection method based on generation model algorithm | |
| CN112541554B (en) | Multi-mode process monitoring method and system based on time constraint and nuclear sparse representation | |
| CN118606872B (en) | Method and device for detecting abnormality of safety water device | |
| CN117978620B (en) | Abnormality detection method and system for electronic distribution frame |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210319 |
|
| RJ01 | Rejection of invention patent application after publication |