CN113347201B - Abnormality detection method, abnormality detection system and computing device - Google Patents
Abnormality detection method, abnormality detection system and computing device Download PDFInfo
- Publication number
- CN113347201B CN113347201B CN202110710402.0A CN202110710402A CN113347201B CN 113347201 B CN113347201 B CN 113347201B CN 202110710402 A CN202110710402 A CN 202110710402A CN 113347201 B CN113347201 B CN 113347201B
- Authority
- CN
- China
- Prior art keywords
- state information
- abnormal state
- abnormal
- abnormality
- current
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0677—Localisation of faults
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
Abstract
The invention discloses an abnormality detection method, which is executed in a computing device to perform abnormality detection on a plurality of devices of a plurality of types, the method comprising the steps of: acquiring an index data set corresponding to each device from a first data storage device, wherein the index data set comprises index data corresponding to one or more indexes; determining an abnormality judgment rule corresponding to each index of each device based on the abnormality configuration information table; judging whether each index data of each device is abnormal according to the corresponding abnormality judgment rule, and generating corresponding current abnormal state information when determining that the index data is abnormal; and carrying out merging processing on the current abnormal state information, and storing the merged abnormal state information. The invention also discloses a corresponding abnormality detection system and a corresponding computing device.
Description
Technical Field
The present invention relates to the field of internet of things, and in particular, to an anomaly detection method, an anomaly detection system, and a computing device.
Background
At present, abnormality detection for the internet of things equipment is usually realized based on Prometaus (an open source monitoring system). The basic principle of Prometheus is that by regularly grabbing index data of target components through Prometheus Daemon, all the grabbed target components need to provide Prometheus Daemon interfaces of corresponding Http services to realize the regular grabbing. Prometaus stores all the captured data locally, cleans and sorts the data by a certain rule, and stores the cleaned result into a new time sequence. According to the technical scheme, prometheus is required to be deployed, the alarm cannot be processed after the alarm is generated, closed-loop management cannot be performed on the alarm, a sound alarm notification system is lacked, and the alarm information cannot be automatically eliminated.
Therefore, an abnormality detection method and system are needed to solve the problems in the above technical solutions.
Disclosure of Invention
Accordingly, the present invention provides an anomaly detection method, anomaly detection system, and computing device to solve or at least alleviate the above-identified problems.
According to an aspect of the present invention, there is provided an abnormality detection method executed in a computing device to perform abnormality detection for a plurality of devices of a plurality of types, the method including the steps of: acquiring an index data set corresponding to each device from a first data storage device, wherein the index data set comprises index data corresponding to one or more indexes; determining an abnormality judgment rule corresponding to each index of each device based on the abnormality configuration information table; judging whether each index data of each device is abnormal according to the corresponding abnormality judgment rule, and generating corresponding current abnormal state information when determining that the index data is abnormal; and carrying out merging processing on the current abnormal state information, and storing the merged abnormal state information.
Optionally, in the anomaly detection method according to the present invention, the step of performing the merging process on the current anomaly state information includes: judging whether the abnormal state information which is the same as the current abnormal state information in abnormal type, same in position and unresolved exists or not; if so, ignoring the current abnormal state information and generating an ignore record log; if the abnormal state information does not exist, enterprise information of the equipment corresponding to the current abnormal state information is determined, and the current abnormal state information is combined into an abnormal state information list corresponding to the enterprise information.
Optionally, in the abnormality detection method according to the present invention, if there is no abnormality state information that is the same as the abnormality type of the current abnormality state information, the same location, and not solved, the method further includes the step of: judging whether an neglect rule set for the abnormal state information with the same type and the same position as the current abnormal state information exists or not; if an neglect rule exists, neglecting the current abnormal state information and generating an neglect record log; if the neglect rule does not exist, determining enterprise information corresponding to the current abnormal state information, and merging the current abnormal state information into an abnormal state information list corresponding to the enterprise information.
Optionally, in the abnormality detection method according to the present invention, after merging the current abnormal state information into an abnormal state information list corresponding to the enterprise information, the method further includes the steps of: and acquiring one or more pieces of abnormal state information with highest abnormal level in the current abnormal state information list, and displaying the abnormal state information as key points.
Optionally, in the abnormality detection method according to the present invention, further comprising the step of: judging whether each piece of abnormal state information in the current abnormal state information list accords with the abnormal grade upgrading condition, and if so, re-acquiring one or more pieces of abnormal state information with highest abnormal grade in the current abnormal state information list to be used as key display abnormal state information.
Optionally, in the anomaly detection method according to the present invention, the step of performing the merging process on the current anomaly state information includes: transmitting the current abnormal state information to a message queue server; and carrying out merging processing on the current abnormal state information based on the message queue server, and sending the merged abnormal state information to the second data storage device.
Optionally, in the abnormality detection method according to the present invention, after generating the corresponding current abnormality state information, the method further includes the steps of: and sending the current abnormal state information to one or more client applications so that a user can view the current abnormal state information.
Optionally, in the anomaly detection method according to the present invention, acquiring the index data set corresponding to each device from the first data storage device includes: and acquiring an index data set corresponding to each device from the first data storage device at intervals of a preset time period.
Optionally, in the abnormality detection method according to the present invention, further comprising the step of: and in the next time period, judging whether the index data corresponding to the abnormal state information accords with an abnormal judgment rule of the next time period, and if not, deleting the abnormal state information.
Optionally, in the abnormality detection method according to the present invention, further comprising the step of: acquiring a plurality of pieces of abnormal state information corresponding to a plurality of pieces of equipment, and determining an abnormal type corresponding to each piece of abnormal state information; performing exception analysis and statistics based on the exception type corresponding to each piece of exception state information, and generating an exception statistics page; and sending the abnormal statistical page to an operation and maintenance platform so as to display the abnormal statistical page on the operation and maintenance platform.
Optionally, in the abnormality detection method according to the present invention, further comprising the step of: acquiring abnormal state information corresponding to one or more devices under each enterprise, and determining an abnormal type corresponding to each piece of abnormal state information; generating an abnormality diagnosis page corresponding to the enterprise based on the abnormality type corresponding to each piece of abnormality state information, wherein the abnormality diagnosis page comprises a corresponding abnormality state information list; and sending the abnormality diagnosis page to an enterprise client corresponding to the enterprise so as to display the abnormality diagnosis page on the enterprise client.
Optionally, in the anomaly detection method according to the present invention, the device includes a hardware class device and a software class device.
Optionally, in the anomaly detection method according to the present invention, the anomaly configuration information table includes a plurality of anomaly main classes, each of the anomaly main classes corresponds to one type of device, and each of the anomaly main classes includes one or more anomaly subclasses, each of the anomaly subclasses corresponds to one of the indexes, respectively.
According to an aspect of the present invention, there is provided an abnormality detection system adapted to perform abnormality detection for a plurality of devices of a plurality of types, including: a first data storage device adapted to store an index data set corresponding to each device, the index data set comprising index data corresponding to one or more indices; and an anomaly detection server, coupled to the first data storage device, adapted to perform the method as described above.
Optionally, in the abnormality detection system according to the present invention, further comprising: the second data storage device is suitable for storing the abnormal state information after the merging processing; and the message queue server is respectively connected with the abnormality detection server and the second data storage device, and is suitable for acquiring current abnormal state information from the abnormality detection server, carrying out combination processing on the current abnormal state information and sending the combined abnormal state information to the second data storage device.
According to one aspect of the invention, there is provided a computing device comprising: at least one processor; a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions comprising instructions for performing the anomaly detection method as described above.
According to an aspect of the present invention, there is provided a readable storage medium storing program instructions that, when read and executed by a computing device, cause the computing device to perform the abnormality detection method as described above.
According to the technical scheme of the invention, the method and the system for detecting the abnormality are provided, the index data of the equipment are collected and stored based on the required indexes, the index data corresponding to the equipment can be directly obtained from a time sequence database when the abnormality detection is carried out on various types of equipment, and the abnormality can be detected by locating the abnormality judgment rule corresponding to the index according to the abnormality configuration information table established in advance, so that the abnormality detection efficiency of the equipment is improved. In addition, the invention is beneficial to improving the working efficiency when the abnormality is processed subsequently by merging and neglecting the current abnormal state information.
In addition, the invention also realizes the automatic defect elimination processing of the original abnormal state by judging whether the abnormal state information accords with the abnormal judgment rule of the next time period. In addition, the abnormal state information is analyzed and counted, and an abnormal counting page is generated and sent to the operation and maintenance platform for display. Therefore, a technician can conveniently view and process the abnormality through the abnormality statistics page displayed by the operation and maintenance platform.
The foregoing description is only an overview of the present invention, and is intended to be implemented in accordance with the teachings of the present invention in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present invention more readily apparent.
Drawings
To the accomplishment of the foregoing and related ends, certain illustrative aspects are described herein in connection with the following description and the annexed drawings, which set forth the various ways in which the principles disclosed herein may be practiced, and all aspects and equivalents thereof are intended to fall within the scope of the claimed subject matter. The above, as well as additional objects, features, and advantages of the present disclosure will become more apparent from the following detailed description when read in conjunction with the accompanying drawings. Like reference numerals generally refer to like parts or elements throughout the present disclosure.
FIG. 1 shows a schematic diagram of an anomaly detection system 100 in accordance with one embodiment of the present invention;
FIG. 2 shows a schematic diagram of a computing device 200 according to one embodiment of the invention; and
FIG. 3 illustrates a flow chart of an anomaly detection method 300 according to one embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
FIG. 1 shows a schematic diagram of an anomaly detection system 100 in accordance with one embodiment of the present invention. According to the abnormality detection method 300 of the present invention, abnormality detection can be performed for a plurality of devices of various types in the environment of the internet of things.
As shown in fig. 1, the anomaly detection system 100 includes a first data storage device 110, an anomaly detection server 120, a message queue server 130, and a second data storage device 140. The anomaly detection server 120 is communicatively connected to the first data storage device 110 and the message queue server 130, respectively, and may be connected to a network by wired or wireless means, for example. Also, the anomaly detection server 120 is communicatively connected to the second data storage device 140 via the message queue server 130.
According to the system 100 of the present invention, the collected index data of the plurality of devices of the plurality of types is uploaded and stored in the first data storage device 110 by collecting one or more kinds of index data of each device. Here, the first data storage device 110 may store therein an index data set corresponding to each device, the index data set including index data corresponding to one or more indexes associated with the device. The abnormality detection server 120 may acquire a corresponding index data set for each device from the first data storage device 110, so that one or more index data corresponding to the device included in the index data set can be acquired.
In addition, an abnormality configuration information table including abnormality types corresponding to each index and corresponding abnormality judgment rules is previously established in the abnormality detection server 120. In this way, the abnormality detection server 120 can determine whether each index data is abnormal according to the index data of the apparatus, according to the abnormality determination rule corresponding to the index in the abnormality configuration information table, to determine whether the apparatus has an abnormal state. Upon determining that the index data is abnormal, current abnormal state information corresponding to the index of the device may be generated.
In one embodiment, the first data storage device 110 may be a time series database. The index data is time-series data with a time stamp, so that the index data can be stored in the time series database based on time sequence. In one embodiment, the first data storage device 110 may be implemented as a Cassandra, which is a distributed NoSQL database system.
In addition, the abnormality detection server 120 may perform merging processing on the current abnormal state information and store the merged abnormal state information. In one embodiment, the current abnormal state information generated by the abnormality detection server 120 may be transmitted to the message queue server 130, the current abnormal state information is combined based on the message queue server 130, and the combined abnormal state information is transmitted to the second data storage device 140. Here, the second data storage device 140 may be a non-time series database for storing the abnormal state information after the merging process.
In one embodiment, the anomaly detection server 120 is connected to the message queue server 130, and may send each piece of generated current anomaly state information to the message queue server 130, perform merging processing on the current anomaly state information based on the message queue server 130, and send the merged anomaly state information to the second data storage device 140 connected to the message queue server 130. Here, the second data storage device 140 is a non-time series data storage device.
In one embodiment, the message queue server may be implemented as Kafka, but the present invention is not limited to the specific type of message queue server.
In one embodiment, as shown in FIG. 1, the system 100 further includes an operation and maintenance platform 125 coupled to the anomaly detection server 120. The anomaly detection server 120 can also analyze and count the anomaly state information after generating the corresponding current anomaly state information. Specifically, by acquiring a plurality of pieces of abnormal state information corresponding to a plurality of pieces of equipment, determining an abnormal type corresponding to each piece of abnormal state information, performing abnormal analysis and statistics based on the abnormal type corresponding to each piece of abnormal state information, and generating an abnormal statistics page. The anomaly statistics page may then be sent to the operation and maintenance platform 125 to present the anomaly statistics page at the operation and maintenance platform 125. Therefore, a technician can conveniently view and process the abnormality through the abnormality statistics page displayed by the operation and maintenance platform.
In one embodiment, as shown in FIG. 1, system 100 also includes one or more enterprise clients 150 connected to anomaly detection server 120. Abnormality detection server 120 may also feed back the enterprise's device abnormal state to the enterprise client for each enterprise's device used after generating the corresponding current abnormal state information. Specifically, abnormal state information corresponding to one or more devices under each enterprise is obtained, and an abnormal type corresponding to each piece of abnormal state information is determined. An abnormality diagnosis page corresponding to the enterprise is generated based on the abnormality type corresponding to each piece of abnormality state information, the abnormality diagnosis page comprises an abnormality state information list corresponding to the enterprise, and the abnormality state information list can comprise abnormality state information of one or more devices used by the enterprise. The anomaly diagnosis page may then be sent to the enterprise client 150 corresponding to the enterprise, such that the anomaly diagnosis page is presented at the enterprise client 150. In this way, enterprise personnel may view the abnormal status of devices used by the enterprise by logging into enterprise client 150.
In an embodiment of the present invention, the anomaly detection server 120 is adapted to perform an anomaly detection method. The abnormality detection method 300 of the present invention will be described in detail below.
In one embodiment, the anomaly detection server 120 of the present invention may be implemented as a computing device such that the anomaly detection method of the present invention may be performed in the computing device.
FIG. 2 illustrates a block diagram of a computing device 200 according to one embodiment of the invention. As shown in FIG. 2, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between the processor 204 and the system memory 206.
Depending on the desired configuration, the processor 204 may be any type of processing including, but not limited to: a microprocessor (UP), a microcontroller (UC), a digital information processor (DSP), or any combination thereof. Processor 204 may include one or more levels of cache, such as a first level cache 210 and a second level cache 212, a processor core 214, and registers 216. The example processor core 214 may include an Arithmetic Logic Unit (ALU), a Floating Point Unit (FPU), a digital signal processing core (DSP core), or any combination thereof. The example memory controller 218 may be used with the processor 204, or in some implementations, the memory controller 218 may be an internal part of the processor 204.
Depending on the desired configuration, system memory 206 may be any type of memory including, but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 106 may include an operating system 220, one or more applications 222, and program data 224. The application 222 is in effect a plurality of program instructions for instructing the processor 204 to perform a corresponding operation. In some implementations, the application 222 can be arranged to cause the processor 204 to operate with the program data 224 on an operating system.
Computing device 200 may also include a storage interface bus 234. Storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to base configuration 202 via bus/interface controller 230. At least a portion of the operating system 220, applications 222, and data 224 may be stored on removable storage 236 and/or non-removable storage 238 and loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204 when the computing device 200 is powered up or the application 222 is to be executed.
Computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to basic configuration 202 via bus/interface controller 230. The example output device 242 includes a graphics processing unit 248 and an audio processing unit 250. They may be configured to facilitate communication with various external devices, such as a display or speakers, via one or more a/V ports 252. The example peripheral interface 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication via one or more I/O ports 258 and external devices such as input devices (e.g., keyboard, mouse, pen, voice input device, touch input device) or other peripherals (e.g., printer, scanner, etc.). The example communication device 246 may include a network controller 260 that may be arranged to facilitate communication with one or more other computing devices 262 over a network communication link via one or more communication ports 264.
The network communication link may be one example of a communication medium. Communication media may typically be embodied by computer readable instructions, data structures, program modules, and may include any information delivery media in a modulated data signal, such as a carrier wave or other transport mechanism. A "modulated data signal" may be a signal that has one or more of its data set or changed in such a manner as to encode information in the signal. By way of non-limiting example, communication media may include wired media such as a wired network or special purpose network, and wireless media such as acoustic, radio Frequency (RF), microwave, infrared (IR) or other wireless media. The term computer readable media as used herein may include both storage media and communication media.
In computing device 200 according to the present invention, application 222 includes a plurality of program instructions that perform anomaly detection method 300, which may instruct processor 204 to perform anomaly detection method 300 of the present invention, so that computing device 200 detects the anomaly status of the plurality of devices by performing anomaly detection method 300 of the present invention.
FIG. 3 illustrates a flow chart of an anomaly detection method 300 according to one embodiment of the present invention. Method 300 is suitable for execution in an anomaly detection server 120 (e.g., computing device 200 previously described). According to the abnormality detection method 300 of the present invention, abnormality detection can be performed for a plurality of devices of various types in the environment of the internet of things.
As shown in fig. 3, the method 300 begins at step S310.
In step S310, an index data set corresponding to each device currently is obtained from the first data storage device 110, where the index data set includes index data corresponding to one or more indexes.
Here, the first data storage device 110 may be a time series database. In one embodiment, the first data storage device 110 may be implemented as a Cassandra, which is a distributed NoSQL database system.
It should be noted that, before executing step S310, the present invention establishes an index encoding list for multiple types of devices in the internet of things environment in advance, where the index encoding list encodes related indexes of the multiple types of devices, and each type of device associates one or more indexes. Each item in the index coding list comprises related information of an index, wherein the related information comprises information such as equipment type, index code (identification), index name, acquisition source, acquisition period, on-site data retention time length, whether a data center is returned or not and the like corresponding to the index.
In addition, before performing step S310, the present invention pre-determines a plurality of devices to be detected, which may include a plurality of devices of various types, which may be deployed at different locations and may be used by one or more enterprises. Here, the specific deployment location and the enterprise to which the plurality of devices to be detected belong are not limited by the present invention. By gathering the index data for these devices, the index data may be uploaded to the first data storage device 110. Specifically, according to an actual abnormality detection requirement, one or more index data of each device may be collected based on one or more indexes corresponding to the device required by the abnormality detection server 120 when detecting an abnormality of the device, and the collected index data of a plurality of devices of a plurality of types may be uploaded and stored in the first data storage device 110. The index data is time-series data with a time stamp, so that the index data can be stored in the time series database based on time sequence.
Thus, for each device, the corresponding index data or index data may be acquired from the first data storage device 110, in other words, each device corresponds to one index data set, and the index data set corresponding to each device may be acquired from the first data storage device, so as to acquire the index data or index data corresponding to the device included in the index data set.
In one embodiment, the devices include two major types, hardware-class devices and software-class devices. The hardware devices include various types of hardware devices, including, for example, server devices (including one or more servers) and sensor devices (including one or more sensors). The software-like device includes one or more application programs. Each device corresponds to one or more metrics, for example, the metrics corresponding to the server may include metrics such as disk space occupancy, CPU utilization, memory occupancy, and the like.
Subsequently, in step S320, an abnormality judgment rule corresponding to each index of each device is determined based on the abnormality configuration information table.
In one embodiment, the anomaly detection server 120 has previously established an anomaly configuration information table including an anomaly type corresponding to each index and a corresponding anomaly determination rule. Specifically, the abnormal configuration information table includes a plurality of abnormal main classes, where each abnormal main class corresponds to one type of device, and the abnormal main classes include, for example, server class abnormality, sensor class abnormality. Each exception master class may include one or more exception subclasses, each corresponding to a respective one of the indicators. In other words, the exception configuration information table covers a plurality of device types, each device type corresponding to one or more exception subclasses, each exception subclass corresponding to one of the indicators, respectively. In this way, by acquiring the index data of the apparatus, it can be judged whether or not the apparatus has an abnormal condition in the abnormal subclass corresponding to the index.
For example, the server abnormality may include abnormal subclasses such as insufficient disk space occupancy rate, high CPU usage rate, high memory occupancy rate, etc., where an index corresponding to the insufficient disk space occupancy rate is the disk space occupancy rate, and by acquiring relevant data (index data) of the disk space occupancy rate of the server, it may be determined whether the server has an abnormal situation of the insufficient disk space occupancy rate.
In one embodiment, the anomaly configuration information table includes a configuration item corresponding to each anomaly sub-class, and the configuration item may include an identification code corresponding to the anomaly sub-class, an anomaly main class, product information, an index, an anomaly determination rule, an anomaly level (priority), a detection mode, and the like. In this way, the abnormality subclass corresponding to the index of the device can be determined from the abnormality configuration information table, and further, the corresponding abnormality judgment rule can be determined from the configuration item corresponding to the abnormality subclass.
For example, sensor class anomalies may include abnormal subclasses of sensor loosening, sensor offline, poor sensor signal quality, sensor damage, and the like. In the configuration items corresponding to the sensor damage abnormal subclasses, the identification code is 0207, the abnormal main class is the sensor class, the product information is RH605, the index is synchronous acquisition current, the abnormal judgment rule is that the current value exceeds 40mA for 3 times continuously, and the abnormal class is the measuring point class.
Subsequently, in step S330, it is determined whether each index data of each device is abnormal according to the corresponding abnormality determination rule. And generating current abnormal state information corresponding to the index of the device when it is determined that the index data is abnormal. Thus, after abnormality detection is performed on each index data of each device, one or more pieces of current abnormality state information can be generated.
Specifically, for each index data, an abnormal subclass corresponding to the index and an abnormal judgment rule corresponding to the abnormal subclass may be determined according to the abnormal configuration information table, and then, whether the index data of the device meets the condition in the abnormal judgment rule is judged, so as to determine whether the device has an abnormal condition in the abnormal subclass corresponding to the index. When the index data of the equipment accords with the conditions in the abnormality judgment rule, determining that the index data is abnormal, wherein the equipment has abnormal conditions in abnormal subclasses corresponding to the indexes; otherwise, if the index data of the device does not meet the conditions in the abnormality judgment rule, it is determined that the index data is normal, and the device does not have an abnormality in the abnormality subclass corresponding to the index.
It should be noted that according to an embodiment of the present invention, the index data of each device may be collected based on a predetermined time period, and the index data of a plurality of devices collected based on the predetermined time period may be stored in the first data storage device 110. In this way, the abnormality detection server 120 may acquire the index data set corresponding to the device acquired at the current time period from the first data storage device 110 at every predetermined time period, and detect whether the index data of the device at the current time period is abnormal according to the index data of the current time period. In addition, in different time periods, the abnormality judgment rule corresponding to each index can be updated and adjusted. It is understood that the current abnormal state information corresponding to the index of the device generated in step S330 is abnormal state information generated after determining that the index data is abnormal based on the current abnormality determination rule for the current time period. And the abnormality determination rule may be changed in the next time period.
Based on the above, in the next time period, the invention can re-judge whether the index data corresponding to the abnormal state information accords with the abnormal judgment rule corresponding to the index in the next time period, and if so, the abnormal state information is kept continuously. If the abnormal judgment rule of the next time period is not met, deleting the abnormal state information, thereby realizing automatic defect elimination processing of the original abnormality.
Finally, in step S340, the merging process is performed on each piece of current abnormal state information, and the abnormal state information after the merging process is stored.
In one embodiment, the anomaly detection server 120 is connected to the message queue server 130, and may send each piece of generated current anomaly state information to the message queue server, perform merging processing on the current anomaly state information based on the message queue server, and send the merged anomaly state information to the second data storage device 140 connected to the message queue server 130. Here, the second data storage device 140 is a non-time series data storage device. In one embodiment, the message queue server may be implemented as Kafka, but the present invention is not limited to the specific type of message queue server.
According to one embodiment, the method for merging each piece of current abnormal state information specifically includes the following steps:
for each piece of current abnormal state information, judging whether the abnormal state information which is the same as the current abnormal state information in abnormal type, same in position and not solved exists. Here, the exception type includes an exception main type and an exception sub type, and the exception type is the same, that is, the exception main type and the exception sub type are both the same. Location refers to the deployment location of the device.
If so, the current abnormal state information is ignored, and a corresponding ignore record log is generated.
If not, determining enterprise information to which the device corresponding to the current abnormal state information belongs, and judging whether one or more pieces of unprocessed abnormal state information corresponding to the enterprise information exist or not, wherein the one or more pieces of abnormal state information can be stored in an abnormal state information list corresponding to the enterprise information. If so, the current abnormal state information is merged into an abnormal state information list corresponding to the enterprise information.
According to one embodiment, if there is no abnormality state information that is the same as the abnormality type of the current abnormality state information, is the same in location, and has not been solved, it is further determined whether there is an neglect rule set by the user for the abnormality state information that is the same in location as the abnormality type of the current abnormality state information. If the neglect rule exists, the current abnormal state information is ignored, and a corresponding neglect record log is generated. It should be noted that, when the user processes the abnormal state information, a corresponding ignore rule may be set for the abnormal state information, so that when the abnormal state information of the same type and the same position is processed, the abnormal state information is ignored based on the set ignore rule.
If the neglect rule does not exist, the enterprise information corresponding to the current abnormal state information is determined, and the current abnormal state information is combined into an abnormal state information list corresponding to the enterprise information.
According to one embodiment, after merging the current abnormal state information into the abnormal state information list corresponding to the enterprise information, one or more pieces of abnormal state information with the highest abnormal level in the current abnormal state information list are obtained and used as key display abnormal state information for key display, and corresponding merged record logs are generated.
In addition, whether each piece of abnormal state information in the current abnormal state information list accords with the abnormal grade upgrading condition can be further judged, and if so, one or more pieces of abnormal state information with the highest abnormal grade in the current abnormal state information list is obtained again to be used as key display abnormal state information so as to be key displayed.
It should be appreciated that by merging and ignoring the current exception status information, it is advantageous to improve the efficiency of work in subsequent processing of exceptions.
According to one embodiment, after generating the corresponding current abnormal state information, the current abnormal state information may also be sent to one or more client applications, so that the user can view the current abnormal state information through the client applications to make corresponding processing. Here, the client application may be implemented as, for example, a mail application, an operation and maintenance application, various instant messaging applications, and the like. It should be noted that the invention is not limited to the specific type of client application.
According to one embodiment, after the corresponding current abnormal state information is generated, analysis and statistics may also be performed with respect to the abnormal state information.
Specifically, by acquiring a plurality of pieces of abnormal state information corresponding to a plurality of devices, an abnormal type corresponding to each piece of abnormal state information is determined, where the abnormal type includes an abnormal main type and an abnormal sub type. And carrying out exception analysis and statistics based on the exception type corresponding to each piece of exception state information, and generating an exception statistics page. The anomaly statistics page may then be sent to an operation and maintenance platform 125 connected to the anomaly detection server 120 to present the anomaly statistics page at the operation and maintenance platform 125. Therefore, a technician can conveniently view and process the abnormality through the abnormality statistics page displayed by the operation and maintenance platform.
According to one embodiment, after generating the corresponding current abnormal state information, the abnormal state of the device of the enterprise may also be fed back to the enterprise client for the device used by each enterprise.
Specifically, abnormal state information corresponding to one or more devices under each enterprise is obtained, and an abnormal type corresponding to each piece of abnormal state information is determined. Here, the exception type includes an exception main type and an exception sub type. An abnormality diagnosis page corresponding to the enterprise is generated based on the abnormality type corresponding to each piece of abnormality state information, and the abnormality diagnosis page includes an abnormality state information list corresponding to the enterprise. The anomaly diagnosis page may then be sent to the enterprise client 150 corresponding to the enterprise, such that the anomaly diagnosis page is presented at the enterprise client 150. In this way, enterprise personnel may view the abnormal status of devices used by the enterprise through the enterprise client.
It can be seen that, according to the method 300 of the present invention, index data of a device is collected and stored based on a required index, and when abnormality detection is performed on multiple types of devices, index data corresponding to the device can be directly obtained from a time sequence database, and an abnormality can be detected by locating an abnormality judgment rule corresponding to the index according to a pre-established abnormality configuration information table, so that it is beneficial to improve the abnormality detection efficiency of the device. In addition, the invention is beneficial to improving the working efficiency when the abnormality is processed subsequently by merging and neglecting the current abnormal state information. In addition, the invention also realizes the automatic defect elimination processing of the original abnormal state by judging whether the abnormal state information accords with the abnormal judgment rule of the next time period. In addition, the abnormal state information is analyzed and counted, and an abnormal counting page is generated and sent to the operation and maintenance platform for display. Therefore, a technician can conveniently view and process the abnormality through the abnormality statistics page displayed by the operation and maintenance platform.
A4. the method as described in A2 or A3, wherein after merging the current abnormal state information into an abnormal state information list corresponding to enterprise information, further comprising the steps of: and acquiring one or more pieces of abnormal state information with highest abnormal level in the current abnormal state information list, and displaying the abnormal state information as key points.
The method as set forth in A5, A4, further comprising the steps of: judging whether each piece of abnormal state information in the current abnormal state information list accords with the abnormal grade upgrading condition, and if so, re-acquiring one or more pieces of abnormal state information with highest abnormal grade in the current abnormal state information list to be used as key display abnormal state information.
A6, the method of any one of A1-A5, wherein the step of merging the current abnormal state information comprises the following steps: transmitting the current abnormal state information to a message queue server; and carrying out merging processing on the current abnormal state information based on the message queue server, and sending the merged abnormal state information to the second data storage device.
A7. the method according to any of the claims A1-A6, wherein after generating the respective current abnormal state information, further comprising the step of: and sending the current abnormal state information to one or more client applications so that a user can view the current abnormal state information.
A12, the method of any of A1-a10, wherein the devices comprise hardware-class devices and software-class devices.
A13. the method of any of A1-a11, wherein the exception configuration information table includes a plurality of exception main classes, each exception main class corresponding to a type of device, and each exception main class includes one or more exception subclasses, each exception subclass corresponding to a respective one of the indicators.
B15, the system of B14, further comprising: the second data storage device is suitable for storing the abnormal state information after the merging processing; and the message queue server is respectively connected with the abnormality detection server and the second data storage device, and is suitable for acquiring current abnormal state information from the abnormality detection server, carrying out combination processing on the current abnormal state information and sending the combined abnormal state information to the second data storage device.
The various techniques described herein may be implemented in connection with hardware or software or, alternatively, with a combination of both. Thus, the methods and apparatus of the present invention, or certain aspects or portions of the methods and apparatus of the present invention, may take the form of program code (i.e., instructions) embodied in tangible media, such as removable hard drives, U-drives, floppy diskettes, CD-ROMs, or any other machine-readable storage medium, wherein, when the program is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention.
In the case of program code execution on programmable computers, the mobile terminal will generally include a processor, a storage medium readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. Wherein the memory is configured to store program code; the processor is configured to execute the anomaly detection method of the present invention in accordance with instructions in the program code stored in the memory.
By way of example, and not limitation, readable media comprise readable storage media and communication media. The readable storage medium stores information such as computer readable instructions, data structures, program modules, or other data. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Combinations of any of the above are also included within the scope of readable media.
In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system, or other apparatus. Various general-purpose systems may also be used with examples of the invention. The required structure for a construction of such a system is apparent from the description above. In addition, the present invention is not directed to any particular programming language. It will be appreciated that the teachings of the present invention described herein may be implemented in a variety of programming languages, and the above description of specific languages is provided for disclosure of enablement and best mode of the present invention.
In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be construed as reflecting the intention that: i.e., the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.
Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in a device as described in this embodiment, or alternatively may be located in one or more devices different from the devices in this example. The modules in the foregoing examples may be combined into one module or may be further divided into a plurality of sub-modules.
Those skilled in the art will appreciate that the modules in the apparatus of the embodiments may be adaptively changed and disposed in one or more apparatuses different from the embodiments. The modules or units or components of the embodiments may be combined into one module or unit or component and, furthermore, they may be divided into a plurality of sub-modules or sub-units or sub-components. Any combination of all features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be used in combination, except insofar as at least some of such features and/or processes or units are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Furthermore, those skilled in the art will appreciate that while some embodiments described herein include some features but not others included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.
Furthermore, some of the embodiments are described herein as methods or combinations of method elements that may be implemented by a processor of a computer system or by other means of performing the functions. Thus, a processor with the necessary instructions for implementing the described method or method element forms a means for implementing the method or method element. Furthermore, the elements of the apparatus embodiments described herein are examples of the following apparatus: the apparatus is for carrying out the functions performed by the elements for carrying out the objects of the invention.
As used herein, unless otherwise specified the use of the ordinal terms "first," "second," "third," etc., to describe a general object merely denote different instances of like objects, and are not intended to imply that the objects so described must have a given order, either temporally, spatially, in ranking, or in any other manner.
While the invention has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of the above description, will appreciate that other embodiments are contemplated within the scope of the invention as described herein. Furthermore, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter. Accordingly, many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is defined by the appended claims.
Claims (12)
1. An anomaly detection method executed in a computing device to perform anomaly detection for multiple devices of multiple types in an internet of things environment, the method comprising the steps of:
acquiring an index data set corresponding to each device from a first data storage device at intervals of a preset time period, wherein the index data set comprises index data corresponding to one or more indexes, the first data storage device is a time sequence database, and the index data is time sequence data with a time tag;
determining an abnormality judgment rule corresponding to each index of each device based on the abnormality configuration information table, wherein the abnormality judgment rule corresponding to each index can be updated and adjusted in different time periods;
judging whether each index data of each device is abnormal according to the corresponding abnormality judgment rule, and generating corresponding current abnormal state information when determining that the index data is abnormal; and
merging the current abnormal state information, and storing the merged abnormal state information;
the step of merging the current abnormal state information comprises the following steps:
judging whether the abnormal state information which is the same as the current abnormal state information in abnormal type, same in position and unresolved exists or not;
If so, ignoring the current abnormal state information and generating an ignore record log;
if not, judging whether an neglect rule set for the abnormal state information with the same type and the same position as the current abnormal state information exists or not;
if an neglect rule exists, neglecting the current abnormal state information and generating an neglect record log;
if the neglect rule does not exist, determining enterprise information corresponding to the current abnormal state information, and merging the current abnormal state information into an abnormal state information list corresponding to the enterprise information;
judging whether index data corresponding to the abnormal state information accords with an abnormal judgment rule of the next time period or not in the next time period, and deleting the abnormal state information if the index data does not accord with the abnormal judgment rule;
and acquiring one or more pieces of abnormal state information with highest abnormal level in the current abnormal state information list, and displaying the abnormal state information as key points.
2. The method of claim 1, further comprising the step of:
judging whether each piece of abnormal state information in the current abnormal state information list accords with the abnormal grade upgrading condition, and if so, re-acquiring one or more pieces of abnormal state information with highest abnormal grade in the current abnormal state information list to be used as key display abnormal state information.
3. The method of claim 1, wherein the step of merging the current abnormal state information comprises:
transmitting the current abnormal state information to a message queue server;
and carrying out merging processing on the current abnormal state information based on the message queue server, and sending the merged abnormal state information to the second data storage device.
4. The method of claim 1, wherein after generating the corresponding current abnormal state information, further comprising the steps of:
and sending the current abnormal state information to one or more client applications so that a user can view the current abnormal state information.
5. The method of claim 1, further comprising the step of:
acquiring a plurality of pieces of abnormal state information corresponding to a plurality of pieces of equipment, and determining an abnormal type corresponding to each piece of abnormal state information;
performing exception analysis and statistics based on the exception type corresponding to each piece of exception state information, and generating an exception statistics page;
and sending the abnormal statistical page to an operation and maintenance platform so as to display the abnormal statistical page on the operation and maintenance platform.
6. The method of claim 1, further comprising the step of:
Acquiring abnormal state information corresponding to one or more devices under each enterprise, and determining an abnormal type corresponding to each piece of abnormal state information;
generating an abnormality diagnosis page corresponding to the enterprise based on the abnormality type corresponding to each piece of abnormality state information, wherein the abnormality diagnosis page comprises a corresponding abnormality state information list;
and sending the abnormality diagnosis page to an enterprise client corresponding to the enterprise so as to display the abnormality diagnosis page on the enterprise client.
7. The method of any of claims 1-6, wherein the devices comprise hardware-class devices and software-class devices.
8. The method of any one of claim 1 to 6, wherein,
the abnormal configuration information table comprises a plurality of abnormal main classes, each abnormal main class corresponds to one type of equipment, each abnormal main class comprises one or more abnormal subclasses, and each abnormal subclass corresponds to one index respectively.
9. An abnormality detection system adapted to perform abnormality detection for a plurality of devices of a plurality of types, comprising:
a first data storage device adapted to store an index data set corresponding to each device, the index data set comprising index data corresponding to one or more indices; and
An anomaly detection server coupled to the first data storage device and adapted to perform the method of any one of claims 1-8.
10. The system of claim 9, further comprising:
the second data storage device is suitable for storing the abnormal state information after the merging processing; and
the message queue server is respectively connected with the abnormality detection server and the second data storage device, and is suitable for acquiring current abnormal state information from the abnormality detection server, carrying out combination processing on the current abnormal state information, and sending the combined abnormal state information to the second data storage device.
11. A computing device, comprising:
at least one processor; and
a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions comprising instructions for performing the anomaly detection method of any one of claims 1-8.
12. A readable storage medium storing program instructions which, when read and executed by a computing device, cause the computing device to perform the anomaly detection method of any one of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110710402.0A CN113347201B (en) | 2021-06-25 | 2021-06-25 | Abnormality detection method, abnormality detection system and computing device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110710402.0A CN113347201B (en) | 2021-06-25 | 2021-06-25 | Abnormality detection method, abnormality detection system and computing device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113347201A CN113347201A (en) | 2021-09-03 |
| CN113347201B true CN113347201B (en) | 2023-08-18 |
Family
ID=77478750
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110710402.0A Active CN113347201B (en) | 2021-06-25 | 2021-06-25 | Abnormality detection method, abnormality detection system and computing device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113347201B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115442209B (en) * | 2022-06-22 | 2024-02-02 | 北京车网科技发展有限公司 | Fault detection method and device, electronic equipment and storage medium |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH0579799A (en) * | 1991-09-24 | 1993-03-30 | Mitsubishi Heavy Ind Ltd | Controller with safety mechanism |
| JPH08279978A (en) * | 1995-04-07 | 1996-10-22 | Sharp Corp | Picture storage and communication equipment |
| JP2004041709A (en) * | 2002-05-16 | 2004-02-12 | Olympus Corp | Capsule medical care device |
| JP2004051056A (en) * | 2002-07-24 | 2004-02-19 | Mitsubishi Electric Corp | Electronic controller for automobile |
| JP2004325227A (en) * | 2003-04-24 | 2004-11-18 | Denso Corp | Abnormal sound inspection method |
| CN106908752A (en) * | 2017-03-17 | 2017-06-30 | 广东电网有限责任公司电力科学研究院 | The electric energy metrical abnormality diagnostic method and system of a kind of feature based packet |
| CN109284251A (en) * | 2018-08-14 | 2019-01-29 | 平安普惠企业管理有限公司 | Blog management method, device, computer equipment and storage medium |
| CN109918248A (en) * | 2019-03-06 | 2019-06-21 | 苏州浪潮智能科技有限公司 | A kind of hardware detection method, system and relevant apparatus |
| CN110348839A (en) * | 2019-05-31 | 2019-10-18 | 口碑(上海)信息技术有限公司 | Monitor processing method, the apparatus and system of device status data |
| CN110927495A (en) * | 2019-12-06 | 2020-03-27 | 张彩东 | Abnormity monitoring method for electric power metering terminal equipment |
| CN111327601A (en) * | 2020-01-21 | 2020-06-23 | 广东电网有限责任公司广州供电局 | Abnormal data response method, system, device, computer equipment and storage medium |
| CN111400294A (en) * | 2020-03-12 | 2020-07-10 | 时时同云科技(成都)有限责任公司 | Data anomaly monitoring method, device and system |
| CN111708665A (en) * | 2020-05-29 | 2020-09-25 | 苏州浪潮智能科技有限公司 | Method, device, equipment and medium for comprehensively monitoring storage cluster system |
| CN111897705A (en) * | 2020-07-06 | 2020-11-06 | 上海泛微网络科技股份有限公司 | Service state processing method, service state processing device, model training method, model training device, equipment and storage medium |
-
2021
- 2021-06-25 CN CN202110710402.0A patent/CN113347201B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JPH0579799A (en) * | 1991-09-24 | 1993-03-30 | Mitsubishi Heavy Ind Ltd | Controller with safety mechanism |
| JPH08279978A (en) * | 1995-04-07 | 1996-10-22 | Sharp Corp | Picture storage and communication equipment |
| JP2004041709A (en) * | 2002-05-16 | 2004-02-12 | Olympus Corp | Capsule medical care device |
| JP2004051056A (en) * | 2002-07-24 | 2004-02-19 | Mitsubishi Electric Corp | Electronic controller for automobile |
| JP2004325227A (en) * | 2003-04-24 | 2004-11-18 | Denso Corp | Abnormal sound inspection method |
| CN106908752A (en) * | 2017-03-17 | 2017-06-30 | 广东电网有限责任公司电力科学研究院 | The electric energy metrical abnormality diagnostic method and system of a kind of feature based packet |
| CN109284251A (en) * | 2018-08-14 | 2019-01-29 | 平安普惠企业管理有限公司 | Blog management method, device, computer equipment and storage medium |
| CN109918248A (en) * | 2019-03-06 | 2019-06-21 | 苏州浪潮智能科技有限公司 | A kind of hardware detection method, system and relevant apparatus |
| CN110348839A (en) * | 2019-05-31 | 2019-10-18 | 口碑(上海)信息技术有限公司 | Monitor processing method, the apparatus and system of device status data |
| CN110927495A (en) * | 2019-12-06 | 2020-03-27 | 张彩东 | Abnormity monitoring method for electric power metering terminal equipment |
| CN111327601A (en) * | 2020-01-21 | 2020-06-23 | 广东电网有限责任公司广州供电局 | Abnormal data response method, system, device, computer equipment and storage medium |
| CN111400294A (en) * | 2020-03-12 | 2020-07-10 | 时时同云科技(成都)有限责任公司 | Data anomaly monitoring method, device and system |
| CN111708665A (en) * | 2020-05-29 | 2020-09-25 | 苏州浪潮智能科技有限公司 | Method, device, equipment and medium for comprehensively monitoring storage cluster system |
| CN111897705A (en) * | 2020-07-06 | 2020-11-06 | 上海泛微网络科技股份有限公司 | Service state processing method, service state processing device, model training method, model training device, equipment and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| Integrating Human Rights Conflicts in COVID-19 Pandemic Prevention and Control;汪习根;王文静;QIAN Chuijun;;The Journal of Human Rights(第03期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113347201A (en) | 2021-09-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20200319951A1 (en) | Tuning Context-Aware Rule Engine for Anomaly Detection | |
| CN108763038B (en) | Alarm data management method and device, computer equipment and storage medium | |
| CN110908883B (en) | User portrait data monitoring method, system, equipment and storage medium | |
| US8886660B2 (en) | Method and apparatus for tracking a change in a collection of web documents | |
| CN112491611A (en) | Fault location system, method, apparatus, electronic device and computer readable medium | |
| CN109684322B (en) | Data processing system and method for automatic maritime affair auditing | |
| CN113347201B (en) | Abnormality detection method, abnormality detection system and computing device | |
| CN112612680A (en) | Message warning method, system, computer equipment and storage medium | |
| CN115357629A (en) | Processing method, system, electronic device and storage medium for financial data stream | |
| CN104765672A (en) | Error code monitoring method, device and equipment | |
| CN112256548B (en) | Abnormal data monitoring method and device, server and storage medium | |
| JP7412938B2 (en) | Information analysis device, information analysis method, information analysis system and program | |
| CN113342625A (en) | Data monitoring method and system | |
| CN112214517A (en) | Stream data processing method and device, electronic device and storage medium | |
| CN114387123B (en) | Data acquisition management method | |
| CN114996080A (en) | Data processing method, device, equipment and storage medium | |
| CN114155467A (en) | Garbage can overflow detection method and device and electronic equipment | |
| CN113656452A (en) | Method and device for detecting abnormal index of call chain, electronic equipment and storage medium | |
| CN115222181A (en) | Robot operation state monitoring system and method | |
| CN110825592A (en) | Method and computing device for generating alarm content | |
| CN112508207A (en) | Fault detection method, device, equipment and storage medium | |
| CN111835566A (en) | System fault management method, device and system | |
| WO2020221656A1 (en) | Method, apparatus and system for acquiring digitized data of factory | |
| CN111966394A (en) | ETL-based data analysis method, device, equipment and storage medium | |
| CN115333916B (en) | Network element alarm information processing method, device and storage medium in communication network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |