CN114595113A - Anomaly detection method and device in application system and anomaly detection function setting method - Google Patents
Anomaly detection method and device in application system and anomaly detection function setting method Download PDFInfo
- Publication number
- CN114595113A CN114595113A CN202210056810.3A CN202210056810A CN114595113A CN 114595113 A CN114595113 A CN 114595113A CN 202210056810 A CN202210056810 A CN 202210056810A CN 114595113 A CN114595113 A CN 114595113A
- Authority
- CN
- China
- Prior art keywords
- time
- data
- series data
- sequence data
- threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/321—Display for diagnostics, e.g. diagnostic result display, self-test user interface
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/323—Visualisation of programs or trace data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
- G06F3/0481—Interaction techniques based on graphical user interfaces [GUI] based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
- G06F3/0482—Interaction with lists of selectable items, e.g. menus
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
- G06F3/0484—Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
- G06F3/04842—Selection of displayed objects or displayed text elements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
- G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
- G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
- G06F3/0484—Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
- G06F3/04847—Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Human Computer Interaction (AREA)
- Quality & Reliability (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Testing And Monitoring For Control Systems (AREA)
- Debugging And Monitoring (AREA)
Abstract
The application discloses an abnormality detection method and device and an abnormality detection function setting method in an application system. The detection method comprises the following steps: acquiring time series data to be detected of an index indicating at least one operating state of an application; fitting the time series data to obtain fitting baseline series data of the index; calculating threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data; and carrying out abnormity detection on the time sequence data according to the threshold sequence data so as to determine whether the running state indicated by the index is abnormal or not. The embodiment of the application avoids the problem of false alarm or missed alarm caused by static threshold values in the prior art, also saves the trouble of manual setting, reduces the cost of threshold value maintenance, and improves the accuracy of abnormal detection.
Description
Technical Field
The present application relates to the field of detection technologies, and in particular, to an anomaly detection method and apparatus in an application system, and an anomaly detection function setting method.
Background
With the development of cloud computing technology, more and more application systems can provide services to the outside through a network (such as the internet). In such a network-based service process, it is necessary to perform numerical collection on various online or offline indexes of an application system to determine whether the service is normal. In maintaining the continuity and stability of the service, the user wants to know various abnormal events in time, for example, the abnormal event that the value of the index exceeds a predetermined threshold. In other words, a user or a technician may maintain service in a timely manner by collecting data in real time and alerting the user when the data value exceeds a predetermined threshold. Thus, if the threshold is set unreasonably, e.g., too high or too low, false or false negatives of an abnormal situation may occur, which may not only degrade the user's experience, but may also significantly damage the user using the service when severe.
Therefore, a technical solution for detecting time series anomalies is needed, which is fast, accurate, highly versatile, and interpretable.
Disclosure of Invention
The embodiment of the application provides an anomaly detection method and device and an anomaly detection function setting method in an application system, so as to solve the defect of low anomaly detection accuracy rate caused by unreasonable threshold setting in the prior art.
In order to achieve the above object, an embodiment of the present application provides an anomaly detection method in an application system, where the application system includes at least one application, and the anomaly detection method includes:
acquiring time series data to be detected of an index indicating at least one operating state of the application;
fitting the time-series data to obtain fitted baseline sequence data of the index;
calculating threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data;
and performing abnormity detection on the time series data according to the threshold series data to determine whether the running state indicated by the index has abnormity.
The embodiment of the present application further provides a method for setting an anomaly detection function, including:
providing an anomaly detection configuration interface, wherein a static threshold setting control or a dynamic threshold setting control is arranged on the anomaly detection configuration interface;
receiving a static threshold configuration parameter or a dynamic threshold configuration parameter input by a user, wherein the static threshold configuration parameter or the dynamic threshold configuration parameter at least comprises an index for abnormal detection;
when a dynamic threshold configuration parameter is input by a user, calculating threshold sequence data for the time sequence data according to the time sequence data of the index; and performing anomaly detection on the time-series data according to the threshold-value series data to determine whether an anomaly exists in the operation state indicated by the index;
and providing an alarm interface, wherein the alarm interface displays an abnormal detection result.
An embodiment of the present application further provides an anomaly detection apparatus in an application system, where the application system includes at least one application, and the anomaly detection apparatus includes:
an acquisition module for acquiring time series data to be detected of an index indicating at least one operation state of the application;
the fitting module is used for performing fitting processing on the time sequence data to obtain fitting baseline sequence data of the index;
a calculation module to calculate threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data;
and the detection module is used for carrying out abnormity detection on the time sequence data according to the threshold sequence data so as to determine whether the running state indicated by the index is abnormal or not.
An embodiment of the present application further provides an electronic device, including:
a memory for storing a program;
and the processor is used for operating the program stored in the memory, and the program executes the abnormality detection method or the abnormality detection function setting method provided by the embodiment of the application when running.
The embodiment of the present application further provides a computer-readable storage medium, on which a computer program executable by a processor is stored, wherein the program, when executed by the processor, implements the abnormality detection method or the abnormality detection function setting method as provided in the embodiment of the present application.
According to the anomaly detection method and device and the anomaly detection function setting method in the application system, fitting processing is carried out according to the acquired time series data to be detected, a fitting baseline sequence is obtained, so that threshold sequence data aiming at the time series data can be calculated according to the fitting baseline data and the time series data, and anomaly detection can be carried out according to the calculated threshold sequence data. Therefore, the threshold data of the data to be detected is calculated based on the acquired data to be detected, so that the dynamic determination of the threshold of the data to be detected is realized, when the whole data to be detected changes, the change can be reflected in the threshold in time, and whether the data to be detected is abnormal is judged by using a new threshold reflecting the whole change, so that the problem of false alarm or false alarm caused by a static threshold in the prior art is solved, the trouble of manual setting is also saved, the cost of maintaining the threshold is reduced, and the accuracy of abnormal detection is improved.
The above description is only an overview of the technical solutions of the present application, and the present application may be implemented in accordance with the content of the description so as to make the technical means of the present application more clearly understood, and the detailed description of the present application will be given below in order to make the above and other objects, features, and advantages of the present application more clearly understood.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the application. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
fig. 1a is a schematic view of an application scenario of an anomaly detection scheme provided in an embodiment of the present application;
FIGS. 1b-1d are schematic views of display pages of an anomaly detection scheme provided in an embodiment of the present application;
FIG. 2 is a flow chart of one embodiment of an anomaly detection method provided herein;
FIG. 3 is a flow chart of another embodiment of an anomaly detection method provided herein;
fig. 4 is a schematic structural diagram of an embodiment of an anomaly detection device provided in the present application;
fig. 5 is a schematic structural diagram of an embodiment of an electronic device provided in the present application.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
Example one
The scheme provided by the embodiment of the application can be applied to any system with the abnormality detection capability, such as a computing system comprising a plurality of servers and the like. Fig. 1a is a schematic view of an application scenario of an anomaly detection scheme provided in an embodiment of the present application, and the scenario shown in fig. 1a is only one example of a principle of the technical scheme of the present application.
With the development of cloud technology, more and more work can be provided to the outside through the internet. In such a network-based service process, it is necessary to perform numerical collection on various online or offline indexes to determine whether the service is normal. In maintaining the continuity and stability of the service, the user wants to know various abnormal events in time, for example, the abnormal event that the value of the index exceeds a predetermined threshold. In other words, a user or a technician may maintain service in a timely manner by collecting data in real time and alerting the user when the data value exceeds a predetermined threshold. Thus, if the threshold is set unreasonably, e.g., too high or too low, false or false negatives of an abnormal situation may occur, which may not only degrade the user's experience, but may also significantly damage the user using the service when severe.
It is common in the prior art to manually set the static threshold based on experience. In other words, the threshold value is set in advance for the abnormality detection function, and is fixed and constant during the abnormality monitoring for the service. Or a warning template of the threshold is used in advance to determine the threshold, but although the threshold determined in this way may change in the abnormal monitoring process of the service, the threshold may change according to the change mode specified by the template, so that the scheme is still a static threshold scheme in nature.
However, in the actual monitoring of an abnormal state of a service, the tasks involved by the service may change in their content due to development and changes, which are reflected in particular in the various indicators specified for monitoring the health state, i.e. the values of these indicators are generally adjusted synchronously with the changes in the health state of the service. However, as described above, the threshold is preset or determined in advance according to some templates, and therefore, in the case where the values of all or even a part of the indexes to be monitored change, if the corresponding threshold is not adjusted in time, it is easy to cause that the data value actually used by the user actually changes as a whole, and the whole is out of the threshold range, thereby causing false alarm.
For example, in the prior art, a static threshold value may be set for each index detected based on the experience of the operation and maintenance personnel. For example, a static threshold may be set for the time-series data of the index, and when the value of the collected time-series data exceeds the set threshold, it is determined as abnormal and an alarm is sent. In addition, in the prior art, a plurality of threshold value templates can be predefined, so that when the service of the user is configured, the threshold value setting of the index related to the service can be completed directly by selecting the preset template.
In addition, in the prior art, a scheme for detecting abnormal values in a time sequence based on feature engineering and a random forest method is also provided, relative to a mode of manually setting a threshold value. Marking positive and negative sample data through a data marking tool; extracting the feature of the abnormal value in the time series by utilizing a plurality of detectors which are commonly used at present to extract the feature; the obtained characteristic sequence and the labeled label can be used for training and testing a random forest model; and obtaining the random forest model meeting the requirements through training. That is, an abnormal value in the time series is identified by the abnormal feature. In addition, similar schemes in the prior art also propose machine learning-based time series anomaly detection schemes. Feature information including statistical features, fitting features and classification features is extracted through feature engineering. In the first statistical layer, a statistical scheme similar to a 3sigma criterion is used for judging, a large number of positive samples are filtered, primary screening of the abnormity is achieved, in the second unsupervised layer, multiple unsupervised joint arbitrations such as Isolation Forest, EWMA and polynomial are used, suspected abnormity is transmitted to the third layer for detection, in the third layer, a supervised layer is arranged, characteristic extraction is conducted on a time sequence, a trained supervised model is loaded, abnormity detection is conducted through a supervised algorithm such as GBDT and XGboost, and finally the abnormity is detected.
The above-mentioned prior art machine learning scheme based on feature engineering, though, circumvents the problems of traditional manual thresholding and maintenance thresholds through the identification of abnormal features. There are some disadvantages, however, such as: the labor cost is increased due to the need of a large amount of data labeling and feature engineering, and the interpretability of the detection result is poor due to the use of a machine-learned black box model. In particular, in these machine learning schemes in the prior art, the abnormal features in the time series are extracted by using feature engineering, and the detection of the time series abnormality is performed by using a supervised model such as a random forest model, GBDT or XGBoost. Therefore, feature engineering is required to extract features of outliers, and particularly, a large amount of data is analyzed to extract valid features or rules therefrom. However, in general, the time series obtained by detecting the index is not only data collected according to days, but more data collected according to hours or even minutes, so that the data volume is huge. The data analysis and feature extraction from the massive time series requires huge manpower.
On the other hand, because time series of the index under different application scenes have different feature expressions, different features need to be mined to represent the index value under the scene aiming at the time series of the different scenes. For example, features extracted for one scene are difficult to apply to other scenes. In addition, with the continuous business expansion and the increase of time series types, the required features will be larger and larger, huge manpower is needed to be continuously spent on the work of feature mining, system maintenance and the like, and the feature engineering will be more and more complicated.
Finally, in the scheme based on the machine learning classification model in the prior art, the model is basically a black box model, and the interpretability is poor. Many times, the user only gets a detection result, i.e. abnormal or normal, and there is little explanation for the detection result. In practical product applications, the interpretability of the test result is also an important item, and the user's need for this interpretability is also very obvious.
In this regard, for example, in a scenario as shown in fig. 1a, the abnormality detection scheme according to an embodiment of the present application may acquire time-series data for a specific detection index from, for example, a server as time-series data to be detected, and input it into an abnormality detection model to perform fitting processing for the time-series data, obtain fitted baseline-series data, and calculate threshold-series data for the time-series data from the fitted baseline-series data and the time-series data, thereby performing abnormality detection for the time-series data from the threshold-series data.
For example, after time-series data for a specific index is collected from, for example, a server, the time-series data may be first subjected to data verification and data preprocessing processing to, for example, verify the reasonableness of data in the obtained time-series data, such as whether a requirement of a data point number is satisfied, whether a breakpoint or a missing value situation exists, whether a data value satisfies a value range constraint, and the like. In the embodiment of the present application, the data preprocessing may include maximum and minimum normalization, null padding, outlier processing, and the like on the acquired time series data.
For example, the normalization process may include normalizing the acquired data value fields to all between [0,1], and the null process may include padding missing values. In particular, in time-series data collected from a server, missing values often occur due to an interruption of data collection, a failure of data storage, or the like, and therefore, missing value padding processing can be performed on the time-series data in which this occurs.
For example, in the case where the time-series data has a missing value from the beginning, the value of the time at which the time-series data has a value for the first time may be used to fill in the missing value of the header in a duplicated manner. In addition, for the missing value case occurring in the time series, the missing value filling may be performed in various ways, such as default value filling, mode filling, average value filling, linear interpolation, and the like, which are set in advance. In addition, for the missing value occurring at the end of the time series, the time series data may be filled with the value of the position where the last data value exists, or a preset default value of the index, or the time series data may be directly regarded as a blank part and the sequence may be truncated from the position where the last data value exists, or the blank part may be reserved to remind the user that the current part of the value has the missing condition.
In addition, in the embodiment of the application, the numerical value exceeding the upper and lower extreme values in the current acquired time series data in the historical data can be replaced by the preset extreme value, so that the influence of the extreme abnormal value on the final overall detection effect in the historical data is avoided being obviously referred to.
After the acquired data is preprocessed, in the embodiment of the present application, the time series data may be first identified periodically, and the sequence data with periodicity may be identified and subjected to periodic sequence decomposition.
For example, time-series data may be first divided into time-series segments having the same length, and then the similarity therebetween may be calculated. A pearson coefficient may be taken to measure similarity in embodiments of the present application. In the embodiment of the present application, the period may be identified by a method such as fourier transform.
After the similarity is determined, the time series decomposition may be performed by using an STL (Seasonal and trending decomposition with local weighted regression) algorithm, so that a periodic series of the current time series may be obtained. The periodic sequence thus obtained by decomposition is subtracted on the basis of the time-series data of the index acquired from the server.
After removing the periodic sequence, in the embodiment of the present application, the baseline data may be fitted by, for example, an EWMA (explicit Weighted Moving-Average) algorithm based on the time-series data thus obtained, for example, formula (1) shown below.
x′i＝βx′i-1+(1-β)xi (1)
Wherein β is a smoothing coefficient, xiIs original time sequence, x'iTo fit the baseline data.
In the embodiment of the present application, the baseline fitting process may be performed by using an MA (Moving-Average Moving Average), an ARMA (Autoregressive Moving Average model), or an ARIMA (differential integrated Moving Average Autoregressive model) method.
Thereafter, a difference sequence of the baseline data and the raw time series data may be calculated, and then a Mean Square Error (MSE) may be calculated for the difference sequence, which may refer to an expectation of the square of the difference between the parameter estimate and the parameter value, and further a standard deviation (STD) may be calculated.
Wherein xiIs original toTime sequence of origin, x'iTo fit to the baseline data, mse is the mean square error of the difference sequence, mean is the mean of the difference sequence, and std represents the standard deviation of the difference sequence.
Finally, threshold sequence data for time series data can be calculated from the mean square error and standard deviation thus obtained.
low_bound＝x′i-(mse+scale*std) (5)
up_bound＝x′i+(mse+scale*std) (6)
Where low _ bound represents the value of the lower threshold sequence, and up _ bound represents the value of the upper threshold sequence, scale represents the scaling factor.
Fig. 1b to fig. 1d are schematic views of display pages of the anomaly detection scheme provided in the embodiment of the present application. As shown in fig. 1b-1d, the anomaly detection scheme according to the embodiment of the present application may first display an anomaly detection configuration interface on, for example, a terminal of a user, where a static threshold setting control or a dynamic threshold setting control may be disposed on the interface. The user can select a static threshold scheme or a dynamic threshold scheme according to the requirement of the user through the control and carry out corresponding parameter setting. For example, as shown in fig. 1b, in the case where the user selects the dynamic threshold scheme, a parameter configuration interface of the dynamic threshold may be displayed on the terminal of the user in the form of a web page or an interface of an application program, in which the user may be allowed to input an index to be detected for an abnormality, which may be one of indexes reflecting an operation state of a certain application or a service used by the user, and may also be allowed to set an initial threshold range and acquire relevant parameters of time-series data of the index, such as an acquisition time interval, a data filtering condition, and the like.
After the time-series data of the index is acquired, the threshold-value series data of the time-series data can be calculated accordingly, and the time-series data acquired in real time is subjected to abnormality detection based on the calculated threshold-value series data, so that it can be determined whether the operation state indicated by the index is normal. The user may view the results of the anomaly detection by web page or at the client after starting the anomaly detection. For example, an alarm management interface as shown in fig. 1c may be displayed for the user, a list of each application or service may be displayed on the interface for the user, and in the case that the user selects to view a certain application or service, an abnormal alarm condition of each index of the application or service, so that the user may view, in addition to the abnormal condition of each index, a processing state for the abnormality, for example, whether a relevant person has already processed, or the like.
In addition, an alarm message such as that shown in fig. 1d may also be pushed to the mobile terminal of the user, so that the user can know an overview of the abnormality occurring in real time through the alarm message shown in fig. 1d in addition to viewing details of the abnormality detection by using the alarm management interface shown in fig. 1 c. For example, in the alert message interface shown in fig. 1d, only the name of the alert message, the alert content, and the alert time, etc., may be included. In particular, in the embodiment of the present application, since the abnormality is detected based on the time-series data acquisition of the index, the alarm name may include information related to the application or service, information of the index, a classification name of the abnormality, and the like, so that the user may intuitively know the cause of the abnormality from the alarm name, so as to perform processing in a timely manner.
Therefore, according to the abnormality detection scheme of the embodiment of the present application, a fitted baseline sequence can be obtained by fitting processing according to acquired time-series data to be detected, so that threshold-value sequence data for the time-series data can be calculated from the fitted baseline data and the time-series data, and abnormality detection can be performed according to the calculated threshold-value sequence data. Therefore, the threshold data of the data to be detected is calculated based on the acquired data to be detected, so that the dynamic determination of the threshold of the data to be detected is realized, when the whole data to be detected changes, the change can be reflected in the threshold in time, and whether the data to be detected is abnormal is judged by using a new threshold reflecting the whole change, so that the problem of false alarm or false alarm caused by a static threshold in the prior art is solved, the trouble of manual setting is also saved, the cost of maintaining the threshold is reduced, and the accuracy of abnormal detection is improved.
The above embodiments are illustrations of technical principles and exemplary application frameworks of the embodiments of the present application, and specific technical solutions of the embodiments of the present application are further described in detail below through a plurality of embodiments.
Example two
Fig. 2 is a flowchart of an embodiment of an anomaly detection method provided in the present application, where an execution subject of the method may be various terminal or server devices with anomaly detection capability, or may be a device or chip integrated on these devices. As shown in fig. 2, the abnormality detection method includes the steps of:
s201, acquiring time series data to be detected of an index indicating at least one running state of an application.
The anomaly detection method provided by the embodiment of the application is suitable for an application system, wherein the application system comprises at least one application. Time-series data for a specific index may be acquired from, for example, a server in step S201. In the embodiment of the present application, the time-series data may be configured by acquiring the detection data from the detection device in real time, or by acquiring the data from the history data stored in the server in time series. Of course, in the embodiment of the present application, it is also possible to perform periodic detection on the obtained time-series data, and perform processing of removing periodicity on the time-series data having periodicity, and it is possible to use the time-series data after removing periodicity as the time-series data to be detected for subsequent processing.
And S202, fitting the time series data to obtain fitted baseline series data of the index.
In step S202, fitting processing may be performed on the time-series data obtained in step S202 to obtain fitted baseline series data. For example, in the embodiment of the present application, the baseline data may be fitted by, for example, an EWMA (explicit Weighted Moving-Average exponential Moving Average) algorithm, for example, formula (1) shown below, based on the time-series data obtained in step S202.
x′i＝βx′i-1+(1-β)xi (1)
Wherein β is a smoothing coefficient, xiIs original time sequence, x'iTo fit the baseline data.
In addition, in the embodiment of the present application, in step S202, the baseline fitting process may be performed by using an MA (Moving-Average Moving Average), an ARMA (Autoregressive Moving Average model), or an ARIMA (difference integrated Moving Average Autoregressive model) method.
And S203, calculating threshold sequence data aiming at the time sequence data according to the fitted baseline sequence data and the time sequence data.
In step S203, a difference may be calculated from the baseline sequence data obtained in step S202 and the time-series data to be detected obtained in step S201. For example, baseline data x 'obtained for fitting in step S202 may be obtained'iAnd time-series data x to be detectediA difference is calculated and the difference thus calculated is used as the respective difference data in the difference sequence.
Thereafter, threshold sequence data may be further calculated from the difference data. For example, in the embodiment of the present application, a Mean Square Error (MSE) may be calculated for the difference sequence, which may refer to an expected value of the square of the difference between the estimated value of the parameter and the parameter value, and a standard deviation (STD) may be further calculated. Finally, threshold sequence data for time series data can be calculated from the mean square error and standard deviation thus obtained.
And S204, carrying out abnormity detection on the time series data according to the threshold value series data so as to determine whether the running state indicated by the index is abnormal.
In step S204, abnormality detection may be performed on the time-series data obtained in step S201 using the threshold-series data obtained in step S203 as a threshold for abnormality detection.
Therefore, according to the abnormality detection method of the embodiment of the present application, a fitting baseline sequence can be obtained by performing fitting processing on acquired time-series data to be detected, so that threshold-value sequence data for the time-series data can be calculated from the fitting baseline data and the time-series data, and abnormality detection can be performed from the calculated threshold-value sequence data. Therefore, the threshold data of the data to be detected is calculated based on the acquired data to be detected, so that the dynamic determination of the threshold of the data to be detected is realized, when the whole data to be detected changes, the change can be reflected in the threshold in time, and whether the data to be detected is abnormal is judged by using a new threshold reflecting the whole change, so that the problem of false alarm or false alarm caused by a static threshold in the prior art is solved, the trouble of manual setting is also saved, the cost of maintaining the threshold is reduced, and the accuracy of abnormal detection is improved.
EXAMPLE III
Fig. 3 is a flowchart of another embodiment of the abnormality detection method provided in the present application, and an execution subject of the method may be various terminal or server devices with abnormality detection capability, or may be a device or chip integrated on these devices. As shown in fig. 3, the anomaly detection method includes the following steps:
s301, acquiring time series data to be detected.
Time-series data for a specific index may be acquired from, for example, a server in step S301. In the embodiment of the present application, the time-series data may be configured by acquiring the detection data from the detection device in real time, or by acquiring the data from the history data stored in the server in time series.
S302, preprocessing is carried out on the time series data.
After time-series data for a specific index is acquired in step S301, various kinds of preprocessing may be performed on the time-series data in step S302. For example, data verification and data preprocessing may be performed to verify the reasonability of data in the acquired time series data, such as whether the requirement of data points is satisfied, whether a breakpoint or missing value condition exists, whether a data value satisfies a value range constraint, and the like. In the embodiment of the present application, the data preprocessing may further include performing maximum and minimum normalization, null padding, outlier processing, and the like on the acquired time series data.
For example, the normalization process may include normalizing the acquired data value fields to all between [0,1], and the null process may include padding missing values. In particular, in time-series data collected from a server, missing values often occur due to an interruption of data collection, a failure of data storage, or the like, and therefore, missing value padding processing can be performed on the time-series data in which this occurs.
For example, in the case where the time-series data has a missing value from the beginning, the value of the time at which the time-series data has a value for the first time may be used to fill in the missing value of the header in a duplicated manner. In addition, for the missing value case occurring in the time series, the missing value filling may be performed in various ways such as default value filling, mode filling, average value filling, linear interpolation, and the like, which are set in advance. In addition, for the missing value occurring at the end of the time series, the time series data may be filled with the value of the position where the last data value exists, or a preset default value of the index, or the time series data may be directly regarded as a blank part and the sequence may be truncated from the position where the last data value exists, or the blank part may be reserved to remind the user that the current part of the value has the missing condition.
In addition, in the embodiment of the application, the numerical value exceeding the upper and lower extreme values in the currently acquired time series data in the historical data can be replaced by the preset extreme value, so that the influence of the extreme abnormal value on the final overall detection effect in the historical data is avoided being obviously referred to.
S303, cycle detection processing. When the cycle is detected, steps S304 and S305 are executed; otherwise, step S306 is executed.
S304, according to the detected period value, time series decomposition processing is carried out on the time series data to obtain the period series data of the time series data.
S305, performing cycle elimination processing on the time-series data according to the cycle-series data.
In the embodiment of the present application, the obtained time-series data may be periodically detected, and the time-series data having periodicity may be subjected to processing for removing periodicity, and the time-series data after removing periodicity may be used as the time-series data to be detected for subsequent processing.
For example, time-series data may be first divided into time-series segments having the same length, and then the similarity therebetween may be calculated. A pearson coefficient may be taken to measure similarity in embodiments of the present application. In the embodiment of the present application, the period may be identified by a method such as fourier transform.
After the similarity is determined, the time series decomposition may be performed by using an STL (Seasonal and trending decomposition with local weighted regression) algorithm, so that a periodic series of the current time series may be obtained. The periodic sequence thus obtained by decomposition is subtracted on the basis of the time-series data of the index acquired from the server.
After the cycle removal processing is performed on the time-series data, the following step S306 is continuously performed.
And S306, fitting the time series data to obtain fitting baseline series data.
In step S306, the fitting process may be performed based on the time-series data after the data preprocessing in step S302 or based on the time-series data after the cycle elimination process in step S305. The baseline data can be fitted, for example, by an EWMA (explicit Weighted Moving-Average Exponentially Weighted Moving Average) algorithm, such as equation (1) shown below.
x′i＝βx′i-1+(1-β)xi (1)
Wherein β is a smoothing coefficient, xiIs original time sequence, x'iTo fit the baseline data.
In addition, in the embodiment of the present application, in step S303, the baseline fitting process may be performed by using an MA (Moving-Average Moving Average), an ARMA (Autoregressive Moving Average model), or an ARIMA (difference integrated Moving Average Autoregressive model) method.
S307, threshold sequence data for the time-series data is calculated from the fitted baseline sequence data and the time-series data.
In step S307, a difference may be calculated from the baseline sequence data obtained by fitting in step S306 and the time-series data to be detected. For example, baseline data x 'obtained for the fitting in step S306 may be obtained'iAnd time-series data x to be detectediA difference is calculated and the difference thus calculated is used as the respective difference data in the difference sequence.
A difference sequence of the baseline data and the raw time series data may be calculated, and then a Mean Square Error (MSE) may be calculated for the difference sequence, which may refer to an expectation of the square of the difference between the parameter estimate and the parameter value, and further a standard deviation (STD) may be calculated.
Wherein xiIs original time sequence, x'iTo fit to the baseline data, mse is the mean square error of the difference sequence, mean is the mean of the difference sequence, and std represents the standard deviation of the difference sequence.
Finally, threshold sequence data for the time series data can be calculated from the mean square error and standard deviation thus obtained.
low_bound＝x′i-(mse+scale*std) (5)
up_bound＝x′i+(mse+scale*std) (6)
Where low _ bound represents the value of the lower threshold sequence, and up _ bound represents the value of the upper threshold sequence, scale represents the scaling factor.
S308, according to the threshold sequence data, abnormality detection is carried out on the time sequence data.
Abnormality detection may be performed for time-series data in step S308 using the threshold-series data obtained in step S307 as a threshold for abnormality detection.
Therefore, according to the abnormality detection method of the embodiment of the present application, a fitting baseline sequence can be obtained by performing fitting processing on acquired time-series data to be detected, so that threshold-value sequence data for the time-series data can be calculated from the fitting baseline data and the time-series data, and abnormality detection can be performed from the calculated threshold-value sequence data. Therefore, the threshold data of the data to be detected is calculated based on the acquired data to be detected, so that the dynamic determination of the threshold of the data to be detected is realized, when the whole data to be detected changes, the change can be reflected in the threshold in time, and whether the data to be detected is abnormal is judged by using a new threshold reflecting the whole change, so that the problem of false alarm or false alarm caused by a static threshold in the prior art is solved, the trouble of manual setting is also saved, the cost of maintaining the threshold is reduced, and the accuracy of abnormal detection is improved.
Example four
Fig. 4 is a schematic structural diagram of an embodiment of an anomaly detection apparatus provided in the present application, which can be used to perform the method steps shown in fig. 2 and fig. 3. As shown in fig. 4, the abnormality detecting device may include: an acquisition module 41, a fitting module 42, a calculation module 43 and a detection module 44.
The obtaining module 41 may be configured to obtain time-series data to be detected.
The acquisition module 41 may acquire time-series data for a specific index from, for example, a server. In the embodiment of the present application, the obtaining module 41 may obtain the detection data from the detection device in real time to construct the time series data, or may obtain the data from the history data stored on the server in time series to construct the time series data.
In addition, the abnormality detection apparatus of the embodiment of the present application may further include a preprocessing module 45, which may be configured to perform preprocessing on the time-series data.
After the acquisition module 41 acquires time-series data for a specific index, the preprocessing module 45 may perform various kinds of preprocessing on the time-series data. For example, data verification and data preprocessing may be performed to verify the reasonability of data in the acquired time series data, such as whether the requirement of data points is satisfied, whether a breakpoint or missing value condition exists, whether a data value satisfies a value range constraint, and the like. In the embodiment of the present application, the data preprocessing may further include performing maximum and minimum normalization, null padding, outlier processing, and the like on the acquired time series data.
For example, the normalization process may include normalizing the acquired data value fields to all between [0,1], and the null process may include padding missing values. In particular, in time-series data collected from a server, missing values often occur due to an interruption of data collection, a failure of data storage, or the like, and therefore, missing value padding processing can be performed on the time-series data in which this occurs.
For example, in the case where the time-series data has a missing value from the beginning, the value of the time at which the time-series data has a value for the first time may be used to fill in the missing value of the header in a duplicated manner. In addition, for the missing value case occurring in the time series, the missing value filling may be performed in various ways such as default value filling, mode filling, average value filling, linear interpolation, and the like, which are set in advance. In addition, for the missing value occurring at the end of the time series, the time series data may be filled with the value of the position where the last data value exists, or a preset default value of the index, or the time series data may be directly regarded as a blank part and the sequence may be truncated from the position where the last data value exists, or the blank part may be reserved to remind the user that the current part of the value has the missing condition.
In addition, in the embodiment of the application, the numerical value exceeding the upper and lower extreme values in the current acquired time series data in the historical data can be replaced by the preset extreme value, so that the influence of the extreme abnormal value on the final overall detection effect in the historical data is avoided being obviously referred to.
Further, in the embodiment of the present application, it is also possible to perform periodic detection on the obtained time-series data, and perform processing of removing periodicity on the time-series data having periodicity, and it is possible to take the time-series data after removing periodicity as the time-series data to be detected of the subsequent processing.
For example, time-series data may be first divided into time-series segments having the same length, and then the similarity therebetween may be calculated. A pearson coefficient may be taken to measure similarity in embodiments of the present application. In the embodiment of the present application, the period may be identified by a method such as fourier transform.
After the similarity is determined, the time series decomposition may be performed by using an STL (Seasonal and trending decomposition using local weighted regression) algorithm, so that a periodic series of the current time series may be obtained. The periodic sequence thus obtained by decomposition is subtracted on the basis of the time-series data of the index acquired from the server.
Fitting module 42 can be configured to perform a fitting process on the time-series data to obtain fitted baseline sequence data.
Fitting module 42 may perform the fitting process based on the time-series data after the data pre-processing by pre-processing module 45. The baseline data can be fitted, for example, by an EWMA (explicit Weighted Moving-Average Exponentially Weighted Moving Average) algorithm, such as equation (1) shown below.
x′i＝βx′i-1+(1-β)xi (1)
Wherein β is a smoothing coefficient, xiIs original time sequence, x'iTo fit the baseline data.
In addition, in the embodiment of the present application, in step S303, baseline fitting processing may be performed by using an MA (Moving-Average Moving Average), an ARMA (Autoregressive Moving Average model), or an ARIMA (differential integrated Moving Average Autoregressive model) method.
The calculation module 43 can be configured to calculate threshold sequence data for the time-series data based on the fitted baseline sequence data and the time-series data.
The calculation module 43 can calculate a difference value according to the baseline sequence data obtained by fitting the fitting module 42 and the time-series data to be detected obtained after data preprocessing by the preprocessing module 42. For example, the obtained baseline data x 'may be fit to the fitting module 42'iAnd time-series data x to be detectediA difference is calculated and the difference thus calculated is used as the respective difference data in the difference sequence.
A difference sequence of the baseline data and the raw time series data may be calculated, and then a Mean Square Error (MSE) may be calculated for the difference sequence, which may refer to an expectation of the square of the difference between the parameter estimate and the parameter value, and further a standard deviation (STD) may be calculated.
Wherein xiIs original time sequence, x'iTo fit to the baseline data, mse is the mean square error of the difference sequence, mean is the mean of the difference sequence, and std represents the standard deviation of the difference sequence.
Finally, threshold sequence data for time series data can be calculated from the mean square error and standard deviation thus obtained.
low_bound＝x′i-(mse+scale*std) (5)
up_bound＝x′i+(mse+scale*std) (6)
Where low _ bound represents the value of the lower threshold sequence, and up _ bound represents the value of the upper threshold sequence, scale represents the scaling factor.
The detection module 44 may be configured to perform anomaly detection on the time-series data according to the threshold-series data.
The detection module 44 may perform abnormality detection on the time-series data obtained by the preprocessing module 45 using the threshold-series data obtained by the calculation module 43 as a threshold for abnormality detection.
Therefore, according to the abnormality detection device of the embodiment of the present application, the fitting baseline sequence can be obtained by performing fitting processing according to the acquired time-series data to be detected, so that the threshold-value sequence data for the time-series data can be calculated from the fitting baseline data and the time-series data, and abnormality detection can be performed according to the calculated threshold-value sequence data. Therefore, the threshold data of the data to be detected is calculated based on the acquired data to be detected, so that the dynamic determination of the threshold of the data to be detected is realized, when the whole data to be detected changes, the change can be reflected in the threshold in time, and whether the data to be detected is abnormal is judged by using a new threshold reflecting the whole change, so that the problem of false alarm or false alarm caused by a static threshold in the prior art is solved, the trouble of manual setting is also saved, the cost of maintaining the threshold is reduced, and the accuracy of abnormal detection is improved.
EXAMPLE five
The internal functions and structure of the abnormality detection apparatus, which can be implemented as an electronic device, are described above. Fig. 5 is a schematic structural diagram of an embodiment of an electronic device provided in the present application. As shown in fig. 5, the electronic device includes a memory 51 and a processor 52.
The memory 51 stores programs. In addition to the above-described programs, the memory 51 may also be configured to store other various data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, contact data, phonebook data, messages, pictures, videos, and so forth.
The memory 51 may be implemented by any type or combination of volatile or non-volatile memory devices, such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.
The processor 52 is not limited to a processor (CPU), but may be a processing chip such as a Graphic Processing Unit (GPU), a Field Programmable Gate Array (FPGA), an embedded neural Network Processor (NPU), or an Artificial Intelligence (AI) chip. And a processor 52, coupled to the memory 51, for executing a program stored in the memory 51, and executing the abnormality detection method of the second or third embodiment.
Further, as shown in fig. 5, the electronic device may further include: communication components 53, power components 54, audio components 55, display 56, and other components. Only some of the components are schematically shown in fig. 5, and it is not meant that the electronic device comprises only the components shown in fig. 5.
The communication component 53 is configured to facilitate wired or wireless communication between the electronic device and other devices. The electronic device may access a wireless network based on a communication standard, such as WiFi, 3G, 4G, or 5G, or a combination thereof. In an exemplary embodiment, the communication component 53 receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 53 further comprises a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
A power supply component 54 provides power to the various components of the electronic device. The power components 54 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for an electronic device.
The audio component 55 is configured to output and/or input audio signals. For example, the audio component 55 includes a Microphone (MIC) configured to receive external audio signals when the electronic device is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal may further be stored in the memory 51 or transmitted via the communication component 53. In some embodiments, audio assembly 55 also includes a speaker for outputting audio signals.
The display 56 includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.
Those of ordinary skill in the art will understand that: all or a portion of the steps of implementing the above-described method embodiments may be performed by hardware associated with program instructions. The program may be stored in a computer-readable storage medium. When executed, the program performs steps comprising the method embodiments described above; and the aforementioned storage medium includes: various media that can store program codes, such as ROM, RAM, magnetic or optical disks.
Finally, it should be noted that: the above embodiments are only used to illustrate the technical solution of the present invention, and not to limit the same; while the invention has been described in detail and with reference to the foregoing embodiments, it will be understood by those skilled in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; and the modifications or the substitutions do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present invention.
Claims (10)
1. An anomaly detection method in an application system, wherein the application system comprises at least one application, and the anomaly detection method comprises the following steps:
acquiring time series data to be detected of an index indicating at least one operating state of the application;
fitting the time-series data to obtain fitted baseline sequence data of the index;
calculating threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data;
and carrying out abnormity detection on the time sequence data according to the threshold sequence data so as to determine whether the running state indicated by the index is abnormal or not.
2. The abnormality detection method according to claim 1, wherein before said fitting process for the time-series data to obtain fitted baseline sequence data of the index, the method further comprises:
performing cycle detection processing on the time sequence data, and performing time sequence decomposition processing on the time sequence data according to the detected cycle value to obtain cycle sequence data of the time sequence data;
and performing cycle elimination processing on the time sequence data according to the cycle sequence data.
3. The abnormality detection method according to claim 2, wherein said cycle detection processing of said time-series data includes:
segmenting the time-series data into a plurality of time-series segments;
calculating the similarity between the time sequence segments;
and when the ratio of the number of the similarity degrees meeting a preset similarity threshold to the total number of the similarity degrees is larger than a preset ratio threshold, determining the length of the time sequence fragment as the period value of the time sequence data.
4. The anomaly detection method of claim 1, wherein said calculating threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data comprises:
calculating difference sequence data of the fitted baseline sequence data and the time sequence data;
calculating a mean square error value and an arithmetic mean value of the difference sequence data;
calculating a standard deviation of the difference sequence data from the arithmetic mean;
calculating the threshold sequence data from the fitted baseline sequence data, the mean square error value, and the standard deviation.
5. The abnormality detection method according to claim 1, wherein the method further comprises:
preprocessing is performed on the time-series data.
6. The abnormality detection method according to claim 5, wherein said preprocessing for said time-series data includes:
verifying the reasonableness of the time series data;
and performing one or more of normalization processing, null value filling processing and abnormal value processing on the time series data passing the verification.
7. An abnormality detection function setting method comprising:
providing an anomaly detection configuration interface, wherein a static threshold setting control or a dynamic threshold setting control is arranged on the anomaly detection configuration interface;
receiving a static threshold configuration parameter or a dynamic threshold configuration parameter input by a user, wherein the static threshold configuration parameter or the dynamic threshold configuration parameter at least comprises an index for abnormal detection;
when a dynamic threshold configuration parameter is input by a user, calculating threshold sequence data for the time sequence data according to the time sequence data of the index; and performing anomaly detection on the time-series data according to the threshold-value series data to determine whether an anomaly exists in the operation state indicated by the index;
and providing an alarm interface, wherein the alarm interface displays an abnormal detection result.
8. The abnormality detection function setting method according to claim 7, wherein the calculating threshold sequence data for the time-series data from the time-series data of the index includes:
fitting the time series data to obtain fitting baseline series data of the index;
threshold sequence data for the time-series data is calculated from the fitted baseline sequence data and the time-series data.
9. An abnormality detection apparatus in an application system, wherein at least one application is included in the application system, and the abnormality detection apparatus comprises:
an acquisition module for acquiring time series data to be detected of an index indicating at least one operating state of the application;
the fitting module is used for performing fitting processing on the time sequence data to obtain fitting baseline sequence data of the index;
a calculation module to calculate threshold sequence data for the time-series data from the fitted baseline sequence data and the time-series data;
and the detection module is used for carrying out abnormity detection on the time sequence data according to the threshold sequence data so as to determine whether the running state indicated by the index is abnormal or not.
10. The abnormality detection device according to claim 9, wherein the abnormality detection device further includes:
the preprocessing module is used for carrying out cycle detection processing on the time sequence data and carrying out time sequence decomposition processing on the time sequence data according to a detected cycle value to obtain cycle sequence data of the time sequence data; and performing cycle elimination processing on the time series data according to the cycle series data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210056810.3A CN114595113A (en) | 2022-01-18 | 2022-01-18 | Anomaly detection method and device in application system and anomaly detection function setting method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210056810.3A CN114595113A (en) | 2022-01-18 | 2022-01-18 | Anomaly detection method and device in application system and anomaly detection function setting method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114595113A true CN114595113A (en) | 2022-06-07 |
Family
ID=81804331
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210056810.3A Pending CN114595113A (en) | 2022-01-18 | 2022-01-18 | Anomaly detection method and device in application system and anomaly detection function setting method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114595113A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116610538A (en) * | 2023-07-21 | 2023-08-18 | 合肥喆塔科技有限公司 | Trending equipment parameter management and control method, system, equipment and storage medium |
| CN117648232A (en) * | 2023-12-11 | 2024-03-05 | 武汉天宝莱信息技术有限公司 | Application program data monitoring method, device and storage medium |
| CN118133321A (en) * | 2024-04-30 | 2024-06-04 | 安徽韬珀信息技术有限公司 | Data asset data safety maintenance system based on data in database |
| CN118171223A (en) * | 2024-05-15 | 2024-06-11 | 国家气象信息中心(中国气象局气象数据中心) | Meteorological health index anomaly monitoring method, device, equipment and storage medium |
-
2022
- 2022-01-18 CN CN202210056810.3A patent/CN114595113A/en active Pending
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116610538A (en) * | 2023-07-21 | 2023-08-18 | 合肥喆塔科技有限公司 | Trending equipment parameter management and control method, system, equipment and storage medium |
| CN117648232A (en) * | 2023-12-11 | 2024-03-05 | 武汉天宝莱信息技术有限公司 | Application program data monitoring method, device and storage medium |
| CN117648232B (en) * | 2023-12-11 | 2024-05-24 | 武汉天宝莱信息技术有限公司 | Application program data monitoring method, device and storage medium |
| CN118133321A (en) * | 2024-04-30 | 2024-06-04 | 安徽韬珀信息技术有限公司 | Data asset data safety maintenance system based on data in database |
| CN118171223A (en) * | 2024-05-15 | 2024-06-11 | 国家气象信息中心(中国气象局气象数据中心) | Meteorological health index anomaly monitoring method, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114595113A (en) | Anomaly detection method and device in application system and anomaly detection function setting method | |
| US10373065B2 (en) | Generating database cluster health alerts using machine learning | |
| CN113518011B (en) | Abnormality detection method and apparatus, electronic device, and computer-readable storage medium | |
| EP2905665B1 (en) | Information processing apparatus, diagnosis method, and program | |
| US8347144B2 (en) | False alarm mitigation | |
| US20210174086A1 (en) | Ar gauge scanner using a mobile device application | |
| US10565080B2 (en) | Discriminative hidden kalman filters for classification of streaming sensor data in condition monitoring | |
| JP6540531B2 (en) | Monitoring device and control method of monitoring device | |
| US20230213926A1 (en) | Abnormal irregularity cause identifying device, abnormal irregularity cause identifying method, and abnormal irregularity cause identifying program | |
| US11568208B2 (en) | Solution for machine learning system | |
| US12007745B2 (en) | Apparatus for predicting equipment damage | |
| DE112019005467T5 (en) | SYSTEM AND METHOD OF DETECTING AND PREDICTING PATTERNS OF ANOMALY SENSOR BEHAVIOR OF A MACHINE | |
| CN112966222A (en) | Time series abnormal data detection method and related equipment | |
| JP6540532B2 (en) | Monitoring device and control method of monitoring device | |
| EP3093770A2 (en) | System and method for the creation and detection of process fingerprints for monitoring in a process plant | |
| CN113948159A (en) | Fault detection method, device and equipment for transformer | |
| CN116470485A (en) | Time-series processing system, method and computer-readable storage medium | |
| CN116048915A (en) | Index abnormality monitoring method and device, electronic equipment and storage medium | |
| CN114357185A (en) | Manufacturing equipment fault monitoring model training method based on knowledge graph | |
| EP4372507A1 (en) | Method and system for hybrid data augmentation for estimating performance degradation in industrial plant | |
| US20230366843A1 (en) | Method and system for monitoring objects and equipment by thermal imaging and data analysis | |
| Sinha et al. | Real-Time Well Constraint Detection Using an Intelligent Surveillance System | |
| CN116627693A (en) | Fault detection method and device in micro-service system | |
| CN116681351A (en) | Quality prediction and root cause analysis system and method for injection molding process | |
| Rigamonti et al. | AN ADVANCED EARLY FAULT DETECTION TOOL FOR PREDICTIVE MAINTENANCE OF A FLEET OF INDUSTRIAL GAS TURBINES |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |