CN112699163A - Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium - Google Patents
Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium Download PDFInfo
- Publication number
- CN112699163A CN112699163A CN202011556994.7A CN202011556994A CN112699163A CN 112699163 A CN112699163 A CN 112699163A CN 202011556994 A CN202011556994 A CN 202011556994A CN 112699163 A CN112699163 A CN 112699163A
- Authority
- CN
- China
- Prior art keywords
- time
- past
- preset time
- predetermined time
- key performance
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
- G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
Abstract
The application provides a time series abnormity detection method, a time series abnormity detection device, electronic equipment and a storage medium, wherein the time series abnormity detection method comprises the following steps: performing time sequence decomposition on the acquired time sequence data of the key performance indexes within the past first preset time and the past second preset time, and extracting to obtain corresponding first residual errors; calculating to obtain an upper inner limit threshold and a lower inner limit threshold of the corresponding boxplot based on the first residual error; performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and extracting to obtain a corresponding second residual error; and carrying out anomaly detection on the second residual error according to the boxplot method and the upper and lower inner threshold values of the boxplot to obtain a corresponding anomaly detection result. The time series abnormity detection method, the time series abnormity detection device, the electronic equipment and the storage medium are relatively simple, the detection accuracy is relatively ideal, and the time series abnormity detection method and the time series abnormity detection device can be used for detecting the time series abnormity in real time.
Description
Technical Field
The present disclosure relates to the field of time sequence anomaly detection technologies, and in particular, to a time sequence anomaly detection method and apparatus, an electronic device, and a storage medium.
Background
At present, time series abnormity detection modes are various, but most of the time series data abnormity detection modes suitable for key performance indexes are complex, or the detection accuracy rate is not ideal enough, and the time series data abnormity detection method cannot be used for real-time abnormity detection of the time series data.
Disclosure of Invention
An object of the embodiments of the present application is to provide a time series anomaly detection method, device, electronic device, and storage medium, which are relatively simple, have an ideal detection accuracy, and can be used for performing real-time anomaly detection on time series data.
In a first aspect, an embodiment of the present application provides a time series anomaly detection method, including:
acquiring time series data of key performance indexes in first past preset time and second past preset time;
performing time sequence decomposition on the time sequence data of the key performance indexes in the first past preset time and the second past preset time, and extracting to obtain corresponding first residual errors;
calculating an upper inner limit threshold value and a lower inner limit threshold value of the corresponding box diagram based on the first residual error;
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and extracting to obtain a corresponding second residual error;
and carrying out anomaly detection on the second residual error according to a boxplot method and an upper inner limit threshold value and a lower inner limit threshold value of the boxplot to obtain a corresponding anomaly detection result.
In the implementation process, the time series abnormality detection method of the embodiment of the application performs time series decomposition on the acquired time series data of the key performance indexes within the first past predetermined time and the second past predetermined time, extracts the corresponding first residual, and calculates the upper and lower inner limit thresholds of the corresponding boxplot; and then time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, corresponding second residual errors are extracted, and then abnormality detection is carried out on the second residual errors according to the box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain corresponding abnormality detection results.
Further, the extracting a corresponding first residual by performing time-series decomposition on the time-series data of the key performance indicator in the first past predetermined time and the second past predetermined time includes:
performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
extracting corresponding first residual errors from the corresponding first trend, the first period and the first residual errors;
the time sequence decomposition of the time sequence data of the key performance indexes in the past target preset time and the past third preset time is carried out, and a corresponding second residual error is extracted, and the method comprises the following steps:
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
and extracting corresponding second residual errors from the corresponding second trend, the second period and the second residual errors.
In the implementation process, the method carries out time sequence decomposition on the time sequence data of the key performance indexes in the first preset time and the second preset time in the past, extracts the corresponding first residual error, eliminates the trend and the period of the time sequence data of the key performance indexes, and can better extract the corresponding first residual error; meanwhile, time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and the corresponding second residual is extracted, so that the trend and the period of the time sequence data of the key performance indexes are eliminated, the corresponding second residual can be well extracted, and the accuracy of abnormal detection of the time sequence data of the key performance indexes can be improved.
Further, the target predetermined time is equal to the first predetermined time, and the unit of the target predetermined time and the first predetermined time is an hour.
In the implementation process, the target preset time is equal to the first preset time, and the unit of the target preset time and the first preset time is small, so that the effect of abnormality detection of the time series data of the key performance index is better, and meanwhile, real-time abnormality detection of the time series data can be better realized.
Further, the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the unit of the second predetermined time is day.
In the implementation process, the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the second predetermined time is day, so that the effect of abnormality detection of the time-series data of the key performance index can be better.
In a second aspect, an embodiment of the present application provides a time series abnormality detection apparatus, including:
the acquisition module is used for acquiring time series data of key performance indexes in first past preset time and second past preset time;
the extraction module is used for performing time sequence decomposition on the time sequence data of the key performance indexes in the first preset time and the second preset time in the past to extract a corresponding first residual error;
the calculation module is used for calculating an upper inner limit threshold value and a lower inner limit threshold value of the corresponding box diagram based on the first residual error;
the extraction module is further used for performing time sequence decomposition on the time sequence data of the key performance indexes within the past target preset time and the past third preset time, and extracting to obtain a corresponding second residual error;
and the abnormality detection module is used for carrying out abnormality detection on the second residual error according to a box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain a corresponding abnormality detection result.
In the implementation process, the time series abnormality detection device according to the embodiment of the application performs time series decomposition on the acquired time series data of the key performance indexes within the first past predetermined time and the second past predetermined time, extracts a corresponding first residual, and calculates an upper inner limit threshold and a lower inner limit threshold of a corresponding boxplot; and then time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, corresponding second residual errors are extracted, and then abnormality detection is carried out on the second residual errors according to the box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain corresponding abnormality detection results.
Further, the extraction module is specifically configured to:
performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
extracting corresponding first residual errors from the corresponding first trend, the first period and the first residual errors;
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
and extracting corresponding second residual errors from the corresponding second trend, the second period and the second residual errors.
In the implementation process, the device carries out time sequence decomposition on the time sequence data of the key performance indexes in the first preset time and the second preset time in the past, extracts the corresponding first residual error, eliminates the trend and the period of the time sequence data of the key performance indexes, and can better extract the corresponding first residual error; meanwhile, time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and the corresponding second residual is extracted, so that the trend and the period of the time sequence data of the key performance indexes are eliminated, the corresponding second residual can be well extracted, and the accuracy of abnormal detection of the time sequence data of the key performance indexes can be improved.
Further, the target predetermined time is equal to the first predetermined time, and the unit of the target predetermined time and the first predetermined time is an hour.
In the implementation process, the target preset time is equal to the first preset time, and the unit of the target preset time and the first preset time is small, so that the effect of abnormality detection of the time series data of the key performance index is better, and meanwhile, real-time abnormality detection of the time series data can be better realized.
Further, the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the unit of the second predetermined time is day.
In the implementation process, the third predetermined time is equal to the second predetermined time in the device, and the unit of the third predetermined time and the unit of the second predetermined time is day, so that the effect of abnormality detection of the time-series data of the key performance indexes can be better.
In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, where the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the above time-series abnormality detection method.
In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the computer program implements the time-series anomaly detection method described above.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and that those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.
Fig. 1 is a schematic flowchart of a time series anomaly detection method according to an embodiment of the present application;
fig. 2 is a schematic flowchart of step S120 according to a first embodiment of the present application;
fig. 3 is a schematic flowchart of step S140 according to a first embodiment of the present application;
fig. 4 is a block diagram of a time-series abnormality detection apparatus according to a second embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only for distinguishing the description, and are not to be construed as indicating or implying relative importance.
At present, time series abnormity detection modes are various, but most of the time series data abnormity detection modes suitable for key performance indexes are complex, or the detection accuracy rate is not ideal enough, and the time series data abnormity detection method cannot be used for real-time abnormity detection of the time series data.
In view of the above problems in the prior art, the present application provides a method and an apparatus for detecting time series anomalies, an electronic device, and a storage medium, which are relatively simple, have an ideal detection accuracy, and can be used for performing real-time anomaly detection on time series data.
Example one
Referring to fig. 1, fig. 1 is a schematic flow chart of a time series anomaly detection method provided in the embodiment of the present application. The time series abnormality detection method described below in the embodiment of the present application can be applied to a server.
The time series abnormity detection method of the embodiment of the application comprises the following steps:
in step S110, time series data of the key performance indicators in the first predetermined time period and the second predetermined time period are acquired.
In this embodiment, the first predetermined time may be an hour, six hours, a day, etc., and the first predetermined time in the past may be an hour in the past, six hours in the past, a day in the past, etc.; the second predetermined time may be three days, five days, seven days, etc., and the second predetermined time in the past may be three days in the past, five days in the past, seven days in the past, etc.
Typically, the first predetermined time is not equal to the second predetermined time.
Step S120, performing time series decomposition on the time series data of the key performance indicators within the first past predetermined time and the second past predetermined time, and extracting a corresponding first residual.
And step S130, calculating an upper inner limit threshold value and a lower inner limit threshold value of the corresponding boxcar based on the first residual error.
In this embodiment, the upper and lower inner threshold values of the box plot may be calculated by calculating 1/4 quantiles and 3/4 quantiles of the box plot based on the first residuals; then calculating an upper limit threshold value of the box chart, wherein the upper limit threshold value of the box chart is 3/4 quantiles +1.5 (3/4 quantiles-1/4 quantiles); and then calculating a lower internal threshold value of the box plot, wherein the lower internal threshold value of the box plot is 1/4 quantiles-1.5 (3/4 quantiles-1/4 quantiles).
Step S140, performing time sequence decomposition on the time series data of the key performance indicators within the past target predetermined time and the past third predetermined time, and extracting to obtain a corresponding second residual error.
In the present embodiment, the target predetermined time may be one hour, six hours, one day, etc., and the past target predetermined time may be within the past one hour, the past six hours, or the past one day, etc.; the third predetermined time may be three days, five days, seven days, etc., and the third predetermined time may be three days in the past, five days in the past, seven days in the past, etc.
Typically, the target predetermined time is not equal to the third predetermined time; the target preset time can be equal to or unequal to the first preset time; the second predetermined time may be equal to or different from the third predetermined time.
Alternatively, the target predetermined time may include the current time point.
And S150, performing abnormity detection on the second residual error according to the boxplot method and the upper and lower inner threshold values of the boxplot to obtain a corresponding abnormity detection result.
In this embodiment, the data exceeding the upper inner limit of the box plot is abnormal data, that is, the data greater than the upper inner limit threshold of the box plot is abnormal data; data that exceeds the lower inner limit of the boxplot are anomalous data, i.e., data that is less than the lower inner limit threshold of the boxplot are anomalous data.
According to the time series abnormity detection method, time series data of key performance indexes in the past first preset time and the past second preset time are subjected to time series decomposition, corresponding first residual errors are extracted, and an upper inner limit threshold value and a lower inner limit threshold value of a corresponding box diagram are calculated; and then time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, corresponding second residual errors are extracted, and then abnormality detection is carried out on the second residual errors according to the box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain corresponding abnormality detection results.
Referring to fig. 2, fig. 2 is a schematic flowchart of step S120 provided in the embodiment of the present application.
As an alternative implementation manner, the method for detecting time series abnormality in the embodiment of the present application, in which the step S120 performs time series decomposition on the time series data of the key performance indicator in the first past predetermined time and the second past predetermined time, and extracts a corresponding first residual, may include the following steps:
step S121, performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
step S122, extracting a corresponding first residual from the corresponding first trend, the first period, and the first residual.
Referring to fig. 3, fig. 3 is a schematic flowchart of step S140 provided in the embodiment of the present application.
As an optional implementation manner, the method for detecting time series abnormality in the embodiment of the present application, in step S140, performing time series decomposition on the time series data of the key performance indicators in the past target predetermined time and the past third predetermined time, and extracting a corresponding second residual, may include the following steps:
step S141, time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
step S142, extracting the corresponding second residual error from the corresponding second trend, second period, and second residual error.
In the process, the method carries out time sequence decomposition on the time sequence data of the key performance indexes in the first preset time and the second preset time in the past, extracts the corresponding first residual error, eliminates the trend and the period of the time sequence data of the key performance indexes, and can better extract the corresponding first residual error; meanwhile, time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and the corresponding second residual is extracted, so that the trend and the period of the time sequence data of the key performance indexes are eliminated, the corresponding second residual can be well extracted, and the accuracy of abnormal detection of the time sequence data of the key performance indexes can be improved.
As an alternative embodiment, the target predetermined time is equal to the first predetermined time, and the unit of the target predetermined time and the first predetermined time is an hour.
Specifically, the target predetermined time and the first predetermined time may be one hour.
In the process, the target preset time is equal to the first preset time, and the unit of the target preset time and the first preset time is small, so that the anomaly detection effect of the time series data of the key performance index is better, and meanwhile, the real-time anomaly detection of the time series data can be better realized.
As an alternative embodiment, the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the second predetermined time is day.
Specifically, the third predetermined time and the second predetermined time may be seven days.
In the above process, the third predetermined time is equal to the second predetermined time in the method, and the unit of the third predetermined time and the second predetermined time is day, so that the effect of abnormality detection of the time-series data of the key performance index can be better.
Example two
In order to implement the corresponding method of the above embodiments to achieve the corresponding functions and technical effects, a time series abnormality detection apparatus is provided below.
Referring to fig. 4, fig. 4 is a block diagram of a time-series abnormality detection apparatus according to an embodiment of the present application.
The time series abnormality detection apparatus of the embodiment of the present application includes:
an obtaining module 210, configured to obtain time series data of key performance indicators within a first past predetermined time and a second past predetermined time;
the extraction module 220 is configured to perform time sequence decomposition on the time sequence data of the key performance indicators within a first past predetermined time and a second past predetermined time, and extract a corresponding first residual error;
a calculating module 230, configured to calculate, based on the first residual, an upper inner threshold and a lower inner threshold of the corresponding boxcar graph;
the extraction module 220 is further configured to perform time sequence decomposition on the time sequence data of the key performance indicators within the past target predetermined time and the past third predetermined time, and extract a corresponding second residual error;
and an anomaly detection module 240, configured to perform anomaly detection on the second residual error according to a boxchart method and an upper inner threshold and a lower inner threshold of the boxchart, so as to obtain a corresponding anomaly detection result.
The time series abnormity detection device of the embodiment of the application carries out time series decomposition on the acquired time series data of the key performance indexes in the first past preset time and the second past preset time, extracts the corresponding first residual error, and calculates the upper limit threshold value and the lower limit threshold value of the corresponding boxplot; and then time sequence decomposition is carried out on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, corresponding second residual errors are extracted, and then abnormality detection is carried out on the second residual errors according to the box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain corresponding abnormality detection results.
As an optional implementation manner, the extracting module 220 may be specifically configured to:
performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
extracting corresponding first residual errors from the corresponding first trend, the first period and the first residual errors;
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
and extracting the corresponding second residual error from the corresponding second trend, the second period and the second residual error.
The time-series abnormality detection apparatus may implement the time-series abnormality detection method according to the first embodiment. The alternatives in the first embodiment are also applicable to the present embodiment, and are not described in detail here.
The rest of the embodiments of the present application may refer to the contents of the first embodiment, and in this embodiment, details are not repeated.
EXAMPLE III
An embodiment of the present application provides an electronic device, which includes a memory and a processor, where the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the above time series abnormality detection method.
Alternatively, the electronic device may be a server.
In addition, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the method for detecting time series anomalies is implemented.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative, and for example, the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
In addition, functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
The above description is only an example of the present application and is not intended to limit the scope of the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
Claims (10)
1. A time series abnormality detection method is characterized by comprising:
acquiring time series data of key performance indexes in first past preset time and second past preset time;
performing time sequence decomposition on the time sequence data of the key performance indexes in the first past preset time and the second past preset time, and extracting to obtain corresponding first residual errors;
calculating an upper inner limit threshold value and a lower inner limit threshold value of the corresponding box diagram based on the first residual error;
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time, and extracting to obtain a corresponding second residual error;
and carrying out anomaly detection on the second residual error according to a boxplot method and an upper inner limit threshold value and a lower inner limit threshold value of the boxplot to obtain a corresponding anomaly detection result.
2. The method according to claim 1, wherein the extracting a corresponding first residual by performing time-series decomposition on time-series data of key performance indicators in a first past predetermined time and a second past predetermined time includes:
performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
extracting corresponding first residual errors from the corresponding first trend, the first period and the first residual errors;
the time sequence decomposition of the time sequence data of the key performance indexes in the past target preset time and the past third preset time is carried out, and a corresponding second residual error is extracted, and the method comprises the following steps:
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
and extracting corresponding second residual errors from the corresponding second trend, the second period and the second residual errors.
3. The time-series abnormality detection method according to claim 1, characterized in that the target predetermined time is equal to the first predetermined time, and the unit of the target predetermined time and the first predetermined time is an hour.
4. The time-series abnormality detection method according to claim 1 or 3, characterized in that the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the second predetermined time is a day.
5. A time-series abnormality detection device characterized by comprising:
the acquisition module is used for acquiring time series data of key performance indexes in first past preset time and second past preset time;
the extraction module is used for performing time sequence decomposition on the time sequence data of the key performance indexes in the first preset time and the second preset time in the past to extract a corresponding first residual error;
the calculation module is used for calculating an upper inner limit threshold value and a lower inner limit threshold value of the corresponding box diagram based on the first residual error;
the extraction module is further used for performing time sequence decomposition on the time sequence data of the key performance indexes within the past target preset time and the past third preset time, and extracting to obtain a corresponding second residual error;
and the abnormality detection module is used for carrying out abnormality detection on the second residual error according to a box diagram method and an upper inner limit threshold value and a lower inner limit threshold value of the box diagram to obtain a corresponding abnormality detection result.
6. The time-series abnormality detection apparatus according to claim 5, wherein the extraction module is specifically configured to:
performing time sequence decomposition on time sequence data of the key performance indexes in a first past preset time and a second past preset time to obtain a corresponding first trend, a first period and a first residual error;
extracting corresponding first residual errors from the corresponding first trend, the first period and the first residual errors;
performing time sequence decomposition on the time sequence data of the key performance indexes in the past target preset time and the past third preset time to obtain a corresponding second trend, a second period and a second residual error;
and extracting corresponding second residual errors from the corresponding second trend, the second period and the second residual errors.
7. The time-series abnormality detection apparatus according to claim 5, characterized in that the target predetermined time is equal to the first predetermined time, and the unit of the target predetermined time and the first predetermined time is an hour.
8. The time-series abnormality detection apparatus according to claim 5 or 7, characterized in that the third predetermined time is equal to the second predetermined time, and the unit of the third predetermined time and the second predetermined time is a day.
9. An electronic device, comprising a memory for storing a computer program and a processor for executing the computer program to cause the electronic device to execute the time-series abnormality detection method according to any one of claims 1 to 4.
10. A computer-readable storage medium, characterized in that it stores a computer program which, when executed by a processor, implements the time-series abnormality detection method according to any one of claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011556994.7A CN112699163B (en) | 2020-12-25 | 2020-12-25 | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011556994.7A CN112699163B (en) | 2020-12-25 | 2020-12-25 | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112699163A true CN112699163A (en) | 2021-04-23 |
| CN112699163B CN112699163B (en) | 2022-06-28 |
Family
ID=75510172
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011556994.7A Active CN112699163B (en) | 2020-12-25 | 2020-12-25 | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112699163B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113780238A (en) * | 2021-09-27 | 2021-12-10 | 京东科技信息技术有限公司 | Multi-index time sequence signal abnormity detection method and device and electronic equipment |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019231659A1 (en) * | 2018-05-29 | 2019-12-05 | Microsoft Technology Licensing, Llc | Data anomaly detection |
| CN110750429A (en) * | 2019-09-06 | 2020-02-04 | 平安科技（深圳）有限公司 | Abnormity detection method, device, equipment and storage medium of operation and maintenance management system |
| CN110851338A (en) * | 2019-09-23 | 2020-02-28 | 平安科技（深圳）有限公司 | Abnormality detection method, electronic device, and storage medium |
| CN111324639A (en) * | 2020-02-11 | 2020-06-23 | 京东数字科技控股有限公司 | Data monitoring method and device and computer readable storage medium |
| CN111338878A (en) * | 2020-02-21 | 2020-06-26 | 平安科技（深圳）有限公司 | Anomaly detection method and device, terminal device and storage medium |
| CN111563022A (en) * | 2020-05-12 | 2020-08-21 | 中国民航信息网络股份有限公司 | Centralized storage monitoring method and device |
| CN111860897A (en) * | 2020-08-05 | 2020-10-30 | 青岛特来电新能源科技有限公司 | Abnormity detection method, device, equipment and computer readable storage medium |
-
2020
- 2020-12-25 CN CN202011556994.7A patent/CN112699163B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019231659A1 (en) * | 2018-05-29 | 2019-12-05 | Microsoft Technology Licensing, Llc | Data anomaly detection |
| CN110750429A (en) * | 2019-09-06 | 2020-02-04 | 平安科技（深圳）有限公司 | Abnormity detection method, device, equipment and storage medium of operation and maintenance management system |
| CN110851338A (en) * | 2019-09-23 | 2020-02-28 | 平安科技（深圳）有限公司 | Abnormality detection method, electronic device, and storage medium |
| CN111324639A (en) * | 2020-02-11 | 2020-06-23 | 京东数字科技控股有限公司 | Data monitoring method and device and computer readable storage medium |
| CN111338878A (en) * | 2020-02-21 | 2020-06-26 | 平安科技（深圳）有限公司 | Anomaly detection method and device, terminal device and storage medium |
| CN111563022A (en) * | 2020-05-12 | 2020-08-21 | 中国民航信息网络股份有限公司 | Centralized storage monitoring method and device |
| CN111860897A (en) * | 2020-08-05 | 2020-10-30 | 青岛特来电新能源科技有限公司 | Abnormity detection method, device, equipment and computer readable storage medium |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113780238A (en) * | 2021-09-27 | 2021-12-10 | 京东科技信息技术有限公司 | Multi-index time sequence signal abnormity detection method and device and electronic equipment |
| CN113780238B (en) * | 2021-09-27 | 2024-04-05 | 京东科技信息技术有限公司 | Abnormality detection method and device for multi-index time sequence signal and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112699163B (en) | 2022-06-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9940184B2 (en) | Anomaly detecting method, and apparatus for the same | |
| CN108616545B (en) | Method and system for detecting network internal threat and electronic equipment | |
| CN113114530B (en) | Network element health state detection method and equipment | |
| CN110501631B (en) | Online intermittent fault detection and diagnosis method | |
| CN112257755B (en) | Method and device for analyzing running state of spacecraft | |
| CN109145595A (en) | A kind of user's unusual checking system, method, equipment and storage medium | |
| CN108549914B (en) | Abnormal SER/SOE event identification method based on Apriori algorithm | |
| CN112699163B (en) | Time series abnormality detection method, time series abnormality detection device, electronic device, and storage medium | |
| CN112508910A (en) | Defect extraction method and device for multi-classification defect detection | |
| CN113992340B (en) | User abnormal behavior identification method, device, equipment and storage medium | |
| US20080288213A1 (en) | Machine condition monitoring using discontinuity detection | |
| CN114528190A (en) | Single index abnormality detection method and device, electronic equipment and readable storage medium | |
| CN112463564B (en) | Method and device for determining associated index influencing host state | |
| CN117314020A (en) | Wetland carbon sink data monitoring system of plankton | |
| JP2009110262A (en) | Filter device, filtering method for filter device and filtering program | |
| Janczura et al. | Machine condition change detection based on data segmentation using a three-regime, α-stable Hidden Markov Model | |
| CN115987594A (en) | Abnormity detection method, device and equipment for network security log | |
| CN114662977A (en) | Method and system for detecting abnormity of motion state of offshore drilling platform and electronic equipment | |
| CN112214934B (en) | Suspension system life prediction method based on multiple sensors and related device | |
| CN113660228A (en) | Dangerous user detection method and device and server | |
| CN115146304A (en) | Method and device for detecting file leakage behavior | |
| CN112437921A (en) | System and method for network attack detection based on rapid unsupervised identification of recurring signal patterns | |
| Che et al. | An efficient intrusion detection approach based on hidden markov model and rough set | |
| CN111209567A (en) | Method and device for judging perceptibility of improving robustness of detection model | |
| CN116881672B (en) | Fault detection model training method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |