CN114978956B - Method and device for detecting abnormal mutation points of performance of intelligent city network equipment - Google Patents
Method and device for detecting abnormal mutation points of performance of intelligent city network equipment Download PDFInfo
- Publication number
- CN114978956B CN114978956B CN202210386525.8A CN202210386525A CN114978956B CN 114978956 B CN114978956 B CN 114978956B CN 202210386525 A CN202210386525 A CN 202210386525A CN 114978956 B CN114978956 B CN 114978956B
- Authority
- CN
- China
- Prior art keywords
- threshold
- historical time
- time series
- mutation
- model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000035772 mutation Effects 0.000 title claims abstract description 132
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 78
- 238000000034 method Methods 0.000 title claims abstract description 41
- 238000001514 detection method Methods 0.000 claims description 33
- 238000004590 computer program Methods 0.000 claims description 14
- 238000007476 Maximum Likelihood Methods 0.000 claims description 5
- 238000004422 calculation algorithm Methods 0.000 description 17
- 239000011159 matrix material Substances 0.000 description 12
- 230000005856 abnormality Effects 0.000 description 9
- 230000008859 change Effects 0.000 description 8
- 238000009826 distribution Methods 0.000 description 8
- 238000004891 communication Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 3
- 238000013527 convolutional neural network Methods 0.000 description 2
- 238000011156 evaluation Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000000737 periodic effect Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000000354 decomposition reaction Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
- H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a method and a device for detecting abnormal mutation points of intelligent city network equipment performance, wherein the method comprises the following steps: acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold; determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data; fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series; and judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve. The method ensures that the trend item of Prophet can be better fitted, and improves the accuracy of detecting the abnormal performance index.
Description
Technical Field
The invention relates to the technical field of anomaly detection, in particular to a method and a device for detecting abnormal mutation points of performance of intelligent city network equipment.
Background
Large online service systems are typically a complex distributed system consisting of hundreds of modules, e.g., front-end services, caches, businesses, databases, etc. Since failure of the software service directly affects the user experience, the operation and maintenance personnel need to monitor a large number of key performance indexes of the smart city network device level, such as response time and CPU (Central Processing Unit ) usage rate, and ensure that the online service operates normally by ensuring that the performance index values are in a normal range.
Aiming at the problem that the abnormal frequency of the performance index is uncertain in the performance index abnormal detection algorithm, the morphology types of the timing indexes are mixed, such as a mutant sequence, a gradual change sequence, an unstable sequence and the like, and the unified algorithm is not easy to detect the abnormality. Prophet is an open source algorithm which can automatically fit the form of performance indexes, can achieve the effect of fitting a plurality of forms by one algorithm, is a novel method for detecting time sequence abnormality, and can be used for solving the problems. When trend item fitting is performed, the selection of mutation points of the propset algorithm is performed in two ways: the first is automatic selection of algorithm, and the second is manual assignment of mutation point positions. However, the second way of manually specifying the mutation points is not selected automatically by a better algorithm, so that the fitting accuracy of trend terms is not improved. And propset will set 25 potential mutation points equally in the first 80% of the time series data by default, but this way of equally setting the mutation points may ignore some points where mutation is faster. To sum up, an algorithm for automatically solving propset mutation points needs to be designed.
The prior art has a mixed model multi-element time sequence anomaly detection method based on a graph neural network, which comprises the following steps: dividing the multi-element time sequence into a characteristic matrix based on a sliding window, an adjacent matrix and an adjacent matrix based on a fixed window, and respectively preprocessing to obtain a first characteristic matrix, a first adjacent matrix and a second adjacent matrix; constructing a graph convolutional neural network prediction model, and inputting a first feature matrix and a first adjacent matrix to obtain a predicted value; comparing the true value with the true value to judge an abnormal time stamp; constructing a convolutional neural network and a mixed reconstruction model of the attention long-short-term memory network, and inputting a second adjacency matrix to obtain a reconstructed adjacency matrix; comparing to obtain a reconstruction error matrix, and judging an abnormal time sequence according to the element size in the reconstruction error matrix and the element number exceeding a threshold value; an outlier is determined with an outlier timestamp and an outlier timing. The abnormal time stamp and the abnormal time sequence in the multi-element time sequence can be detected, and the abnormal detection granularity, efficiency and detection accuracy of the multi-element time sequence are improved.
The service dependency graph-based anomaly detection method mostly utilizes a certain key performance index to construct a service dependency graph, but the method cannot utilize various performance monitoring indexes to carry out comprehensive and cross-layer anomaly detection. In addition, the service graph-based anomaly detection method has no good application effect on performance index time sequence characteristics with mixed modes such as trend, periodicity and the like.
The prior art also provides a time sequence abnormality detection method of key performance index data, which is used for solving the problems of low detection efficiency and low accuracy of the time sequence data abnormality. Correcting missing values and abnormal values in the acquired time sequence data, extracting features, splicing the data, dividing the spliced data into a training set and a testing set, training on the basis of optimizing an objective function to obtain an abnormal detection model, testing and evaluating to obtain an evaluation standard, and performing time sequence abnormal detection on the data to be detected according to the evaluation standard and the abnormal detection model. According to the method, the abnormal detection of the periodic different time series data is carried out, the characteristics of different dimensions are extracted from the time series data, so that the correlation of the data in different dimensions can be learned by a model, the cost caused by abnormal labeling is reduced, the method is suitable for scenes with uneven positive and negative sample poles, and the detection efficiency is improved.
An anomaly detection method based on performance index time sequence characteristics, such as Prophet and the like, detects anomaly values based on the idea of time sequence decomposition. The method can not fit the mutation points of the abnormal extremum well, which can lead to the problem of inaccurate detection of time sequence abnormality; meanwhile, the performance indexes of the smart city network equipment level have the mixed forms of trend, periodicity and the like, so that the conventional method for detecting the abnormality based on the time sequence performance indexes is poor in applicability.
Disclosure of Invention
The invention provides a method and a device for detecting abnormal points of performance of smart city network equipment, which are used for solving the defect that the abnormal detection method in the prior art is not suitable for performance index time sequence characteristics of a mixed form and is inaccurate in detection, realizing the change of the time sequence index of the fitted mixed form by adopting a Prophet algorithm, and improving the accuracy of abnormal detection.
The invention provides a method for detecting abnormal mutation points of performance of intelligent city network equipment, which comprises the following steps:
acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold;
determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data;
fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series;
and judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
According to the method for detecting the abnormal mutation points of the performance of the intelligent city network equipment, which is provided by the invention, the extremum theory is a GPD model.
According to the method for detecting the abnormal mutation points of the performance of the intelligent city network equipment, which is provided by the invention, the first threshold and the second threshold are obtained according to the historical time series data of the performance index of the intelligent city network equipment based on the extremum theory, and the method comprises the following steps:
acquiring parameters of the GPD model according to the historical time sequence data based on maximum likelihood estimation, and constructing the GPD model according to the parameters;
and calculating the first threshold according to a first initial threshold and a first preset probability corresponding to the first threshold based on the GPD model, and calculating the second threshold according to a second initial threshold and a second preset probability corresponding to the second threshold.
According to the method for detecting the mutation points of the performance abnormality of the smart city network equipment, which is provided by the invention, the mutation points of the Prophet model are determined according to the elements larger than the first threshold value or smaller than the second threshold value in the historical time series data, and the method comprises the following steps:
selecting elements smaller than or equal to the first threshold value and larger than or equal to the first initial threshold value or larger than or equal to the second threshold value and smaller than or equal to the second initial threshold value from the historical time series data, and updating parameters of the GPD model;
updating the first threshold and the second threshold based on the GPD model after parameter updating;
and determining mutation points of the Prophet model according to elements which are larger than the updated first threshold value or smaller than the updated second threshold value in the historical time series data.
According to the method for detecting the abnormal mutation points of the performance of the smart city network equipment, the mutation points of the Prophet model are determined according to the elements larger than the first threshold value or smaller than the second threshold value in the historical time series data:
and if a plurality of elements are continuous in the elements larger than the first threshold value or smaller than the second threshold value in the historical time series data, taking one element in the continuous plurality of elements as a mutation point.
According to the method for detecting the abnormal mutation points of the performance of the smart city network equipment provided by the invention, the fitting of the historical time series data based on the Prophet model according to the mutation points is carried out to obtain a fitting curve of the historical time series, and the method comprises the following steps:
calculating the growth rate of each mutation point based on the Prophet model;
calculating the absolute average value of the growth rates of all the mutation points according to the growth rate of each mutation point;
calculating the standard deviation of the growth rate of each mutation point according to the growth rate of each mutation point and the absolute average value;
adding the absolute value average to the standard deviation of the growth rate of each mutation point, and comparing the addition result with the growth rate of each mutation point;
and updating the growth rate of each mutation point according to the comparison result.
The invention also provides a device for detecting the abnormal mutation points of the intelligent city network equipment, which comprises the following components:
the computing module is used for acquiring a first threshold value and a second threshold value according to historical time series data of the performance index of the smart city network equipment based on the extremum theory; wherein the first threshold is greater than the second threshold;
the determining module is used for determining mutation points of the Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data;
the fitting module is used for fitting the historical time sequence data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time sequence;
and the detection module is used for judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
The invention also provides an electronic device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the method for detecting the abnormal abrupt change point of the performance of the intelligent city network device when executing the program.
The present invention also provides a non-transitory computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements a method for detecting a point of abrupt change in performance abnormality of a smart city network device as described in any one of the above.
The invention also provides a computer program product comprising a computer program which when executed by a processor implements the method for detecting abnormal mutation points of performance of a smart city network device as described in any one of the above.
According to the method and the device for detecting the abnormal mutation points of the performance of the smart city network equipment, the Prophet algorithm is adopted to fit the change of the performance time sequence index of the smart city network equipment in a mixed form, and the abnormal points obtained by solving the abnormal boundary by utilizing the extremum theory are used as the mutation points of the Prophet algorithm, so that the trend item of the Prophet can better utilize the mutation points to perform model fitting, and the accuracy rate of detecting the abnormal performance index is improved.
Drawings
In order to more clearly illustrate the invention or the technical solutions of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are some embodiments of the invention, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic flow chart of a method for detecting abnormal mutation points of intelligent city network equipment performance;
fig. 2 is a schematic diagram of interval division in the method for detecting abnormal performance mutation points of smart city network devices according to the present invention;
fig. 3 is a schematic structural diagram of a device for detecting abnormal performance mutation points of smart city network equipment according to the present invention;
fig. 4 is a schematic structural diagram of an electronic device provided by the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings, and it is apparent that the described embodiments are some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The following describes a method for detecting abnormal mutation points of performance of smart city network equipment according to fig. 1, which comprises the following steps: step 101, acquiring a first threshold and a second threshold according to historical time series data of performance indexes of smart city network equipment based on extremum theory (Extreme Value Theory, EVT); wherein the first threshold is greater than the second threshold;
extremum theory considers that while different things themselves conform to different data distributions, extreme events of different things satisfy the same distribution, which is referred to as extremum distribution.
Performance metrics of the smart city network devices include disk busyness, throughput, packet delay, and packet loss rate. For a limited historical time series data, given a time point a, the historical time series data of the performance index is the data m time before a, expressed as X= { X a-m+1 ，…，x a-1 ，x a [ a-m+1, a ] is taken as i]，x i ＝(i,v i ) The performance index value indicating the i-th time is v i . Based on the extremum distribution (Extreme Value Distribution, EVD), an anomaly threshold z is calculated t So that the performance index value x i >z t The occurrence probability is smaller than the first preset probability q, and then z is called t Is an abnormal maximum threshold, namely a first threshold; calculating an anomaly threshold z b So that the performance index value x i <z b The probability of occurrence is smaller than the second preset probability p, then z is called b Is an abnormally small threshold, i.e., a second threshold.
For streaming performance index data, i.e. x 1 ,…,x n ,x n+1 …, utilize newly added x n+1 The first and second thresholds are iteratively updated such that the thresholds are more accurate.
Step 102, determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data;
if x i <z b Or x i >z t Then indicate x i Belonging to the abnormal range. Wherein, when x i <z b When x is i An outlier value that is below the outlier minimum threshold; when x is i >z t When x is i Is an outlier that exceeds an outlier maximum threshold. The outliers in the historical time series data are stored in outlier set a as mutation points of the propset model.
Step 103, fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series;
the Prophet model is an efficient time sequence prediction model, and curve fitting is carried out on a historical time sequence by utilizing the characteristics of self fitting trend, periodicity and holiday characteristic time sequence data of the Prophet model. The fitting formula of the propset model is as follows:
y(t)＝g(t)+s(t)+h(t)+ε；
where g (t) is a trend term, representing an aperiodic change in time series, s (t) is a period term in units of years, months or weeks, and h (t) is a holiday term, representing whether or not there is a holiday currently. Epsilon represents the error term or the residual term.
However, in the field of abnormal performance index detection, a plurality of correlation algorithms are proposed for sequences such as trend type, periodic type and holiday type. However, the trend term g (t) in propset is a mutation point set based on an equal division strategy, which is not applicable to the case of extreme mutation of performance index. Therefore, in the embodiment, the abnormal value detected based on the extremum theory is used as the mutation point in the Prophet model, so that the accuracy of fitting of the Prophet algorithm on the abnormal time sequence is improved.
And step 104, judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
The fitted curve is a variation curve of the performance index value with time. And comparing the performance index value on the fitting curve corresponding to the current moment with the current performance index value for the current data, and if the difference value between the performance index value and the current performance index value is smaller than a preset threshold value, obtaining that the current data is normal, otherwise, obtaining that the current data is abnormal. And after detecting that the current data is abnormal, carrying out fault loss stopping operation by operation and maintenance personnel.
According to the embodiment, the Prophet algorithm is adopted to fit the change of the performance time sequence index of the mixed-form smart city network equipment, and the abnormal point obtained by solving the abnormal boundary by utilizing the extremum theory is used as the mutation point of the Prophet algorithm, so that the Prophet trend term can better utilize the mutation point to perform model fitting, and the accuracy of performance index abnormal detection is improved.
On the basis of the above embodiment, the extremum theory in this embodiment is a GPD (Generalized Pareto Distribution ) model.
Extremum theory considers that the distribution that the extremum satisfies with respect to the portion of one threshold that is exceeded is called GPD.
On the basis of the foregoing embodiment, the obtaining, based on the extremum theory, the first threshold and the second threshold according to the historical time series data of the performance index of the smart city network device in this embodiment includes: acquiring parameters of the GPD model according to the historical time sequence data based on maximum likelihood estimation, and constructing the GPD model according to the parameters;
there are two distribution parameters of the GPD model, γ and σ. These two parameters may be obtained by maximum likelihood estimation, bringing the calculated values of the two parameters into the GPD model.
And calculating the first threshold according to a first initial threshold corresponding to the first threshold and a first preset probability q based on the GPD model, and calculating the second threshold according to a second initial threshold corresponding to the second threshold and a second preset probability p.
The first initial threshold is an initial value of the first threshold, and the second initial threshold is an initial value of the second threshold. Bringing the first initial threshold and the first preset probability q into the GPD model to obtain a first threshold; and bringing the second initial threshold and the second preset probability p into the GPD model to obtain a second threshold.
On the basis of the foregoing embodiment, in this embodiment, determining the mutation point of the propset model according to the element greater than the first threshold or less than the second threshold in the historical time series data includes: selecting elements smaller than or equal to the first threshold value and larger than or equal to the first initial threshold value or larger than or equal to the second threshold value and smaller than or equal to the second initial threshold value from the historical time series data, and updating parameters of the GPD model; updating the first threshold and the second threshold based on the GPD model after parameter updating;
according to a first threshold z t A first initial threshold t and a second threshold z b And a second initial threshold b for dividing the range of the historical time series data into an abnormal range, an extremum range and a normal range. Wherein the extremum range is further divided into a larger value range and a smaller value range, as shown in fig. 2. For x i The way of updating the GPD model is different from the way of updating the first threshold and the second threshold, depending on the range.
The elements of the abnormal range are taken as mutation points of the Prophet model. If z b ≤x i B or t is less than or equal to x i ≤z t Then indicate x i Belonging to the extremum range. Wherein z is b ≤x i B is a smaller value range and t.ltoreq.x i ≤z t Is a larger range of values. Will x i For updating the maximum point set Y t Or minimum value point set Y b . Y is set to t Or Y b For determining again the parameters in the GPD model. Updating z based on updated GPD model t And z b 。
If b<x i <t indicates x i Belonging to the normal range and will not be used for updating Y t Or Y b Pages are not used to update the GPD model and thus do not affect the threshold z t And z b Is updated according to the update of the update program.
And determining mutation points of the Prophet model according to elements which are larger than the updated first threshold value or smaller than the updated second threshold value in the historical time series data.
Taking the os_linux data in the microservice application system failure discovery dataset as an example. Extracting data of the existing operating system level by analyzing time sequence data of the performance index. And classifying the original data to obtain the disc busyness of the intelligent city network equipment.
The mutation points calculated by the existing Prophet model are shown in table 1, and 11 mutation points are identified. The mutation points obtained by adopting the extremum theory provided in this example are shown in table 2, and 15 mutation points are identified. And fitting the mutation points obtained by the extremum theory to the Prophet model, and improving the fitting effect of the Prophet on the trend term.
TABLE 1 mutation points calculated by Prophet model
TABLE 2 mutation points calculated by extremum theory
According to the embodiment, after the abnormal boundary is obtained based on the extremum theory, the data points in the abnormal range defined by the abnormal boundary are used as the abrupt points, the GPD model is updated according to the data points in the extremum range defined by the abnormal boundary and the initial threshold, so that the abnormal boundary and the abrupt points are automatically updated, the last returned abrupt points are subjected to trend item fitting based on the Prophet model, the fitting accuracy is improved, and the abnormality detection accuracy is further improved.
On the basis of the foregoing embodiments, in this embodiment, the mutation point of the propset model is determined according to the element in the historical time series data that is greater than the first threshold or less than the second threshold: and if a plurality of elements are continuous in the elements larger than the first threshold value or smaller than the second threshold value in the historical time series data, taking one element in the continuous plurality of elements as a mutation point.
And constructing a mutation point list cgpList according to the abnormal point set. Let propset mutation point list be cgpList= { z q1 ,...,,z qn For o mutation points { z } in succession qa ,z qb ,...,z qo In this embodiment, only one mutation point is reserved, e.g., the first element z in the consecutive mutation point is reserved qa . For discontinuous points of mutation, all remained.
The mutation point changepoints of propset are updated with the filtered mutation point list cgpList as a function of propset (changepoints=cgpList). Thereby, the characteristic fitting curve of the Prophet model self fitting trend, periodicity and holiday characteristic time sequence data is utilized to detect abnormal data in the performance index.
Based on the foregoing embodiments, in this embodiment, the fitting the historical time series data according to the mutation points based on the propset model to obtain a fitting curve of the historical time series includes: calculating the growth rate of each mutation point based on the Prophet model; calculating the absolute average value of the growth rates of all the mutation points according to the growth rate of each mutation point; calculating the standard deviation of the growth rate of each mutation point according to the growth rate of each mutation point and the absolute average value; adding the absolute value average to the standard deviation of the growth rate of each mutation point, and comparing the addition result with the growth rate of each mutation point; and updating the growth rate of each mutation point according to the comparison result.
In this embodiment, mutation points of the Prophet model are filtered in the time dimension, and the formula is as follows:
where cR represents the growth rate of any mutation point, m (|cr|) represents the average value of the absolute value |cr| of the growth rate of all mutation points, and std (|cr|) represents the standard deviation of the growth rate of any mutation point.
The device for detecting the abnormal mutation points of the performance of the intelligent city network equipment is described below, and the device for detecting the abnormal mutation points of the performance of the intelligent city network equipment and the method for detecting the abnormal mutation points of the performance of the intelligent city network equipment described below can be correspondingly referred to each other.
As shown in fig. 3, the apparatus includes a calculation module 301, a determination module 302, a fitting module 303, and a detection module 304, wherein:
the computing module 301 is configured to obtain a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network device based on extremum theory; wherein the first threshold is greater than the second threshold;
the determining module 302 is configured to determine a mutation point of the propset model according to an element greater than the first threshold or less than the second threshold in the historical time series data;
the fitting module 303 is configured to fit the historical time series data according to the mutation points based on the propset model, so as to obtain a fitting curve of the historical time series;
the detection module 304 is configured to determine whether current data of the performance index of the smart city network device is abnormal according to the fitted curve.
According to the embodiment, the Prophet algorithm is adopted to fit the change of the performance time sequence index of the mixed-form smart city network equipment, and the abnormal point obtained by solving the abnormal boundary by utilizing the extremum theory is used as the mutation point of the Prophet algorithm, so that the Prophet trend term can better utilize the mutation point to perform model fitting, and the accuracy of performance index abnormal detection is improved.
Fig. 4 illustrates a physical schematic diagram of an electronic device, as shown in fig. 4, which may include: processor 410, communication interface (Communications Interface) 420, memory 430 and communication bus 440, wherein processor 410, communication interface 420 and memory 430 communicate with each other via communication bus 440. Processor 410 may invoke logic instructions in memory 430 to perform a smart city network device performance anomaly mutation point detection method comprising: acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold; determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data; fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series; and judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
Further, the logic instructions in the memory 430 described above may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as a stand-alone product. Based on this understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art or in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, or a smart city network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
In another aspect, the present invention also provides a computer program product, where the computer program product includes a computer program, where the computer program can be stored on a non-transitory computer readable storage medium, and when the computer program is executed by a processor, the computer can execute the method for detecting abnormal mutation points of performance of smart city network devices provided by the methods, and the method includes: acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold; determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data; fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series; and judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
In still another aspect, the present invention further provides a non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor, is implemented to perform the method for detecting a performance anomaly mutation point of a smart city network device provided by the above methods, the method comprising: acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold; determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data; fitting the historical time series data according to the mutation points based on the Prophet model to obtain a fitting curve of the historical time series; and judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve.
The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on this understanding, the above technical solution may be embodied essentially or in a part contributing to the prior art in the form of a software product, which may be stored in a computer readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., comprising several instructions for causing a computer device (which may be a personal computer, a server, or a smart city network device, etc.) to perform the embodiments or the methods described in some parts of the embodiments.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims (8)
1. A method for detecting abnormal mutation points of the performance of smart city network equipment is characterized by comprising the following steps:
acquiring a first threshold and a second threshold according to historical time series data of performance indexes of the smart city network equipment based on an extremum theory; wherein the first threshold is greater than the second threshold;
determining mutation points of a Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data;
fitting the historical time series data according to the mutation points based on the Prophet model, obtaining a fitting curve of the historical time series, taking the mutation points as the mutation points in the Prophet model, and performing model fitting on trend items of the Prophet model;
judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve;
the extremum theory is a GPD model;
the obtaining the first threshold and the second threshold according to the historical time series data of the performance index of the smart city network device based on the extremum theory comprises the following steps:
acquiring parameters of the GPD model according to the historical time sequence data based on maximum likelihood estimation, and constructing the GPD model according to the parameters;
and calculating the first threshold according to a first initial threshold and a first preset probability corresponding to the first threshold based on the GPD model, and calculating the second threshold according to a second initial threshold and a second preset probability corresponding to the second threshold.
2. The method for detecting abnormal mutation points of smart city network device according to claim 1, wherein determining mutation points of a propset model according to elements greater than the first threshold or less than the second threshold in the historical time series data comprises:
selecting elements smaller than or equal to the first threshold value and larger than or equal to the first initial threshold value or larger than or equal to the second threshold value and smaller than or equal to the second initial threshold value from the historical time series data, and updating parameters of the GPD model;
updating the first threshold and the second threshold based on the GPD model after parameter updating;
and determining mutation points of the Prophet model according to elements which are larger than the updated first threshold value or smaller than the updated second threshold value in the historical time series data.
3. The method for detecting abnormal mutation points of smart city network device according to claim 1 or 2, wherein the mutation points of the propset model are determined according to elements greater than the first threshold or less than the second threshold in the historical time series data:
and if a plurality of elements are continuous in the elements larger than the first threshold value or smaller than the second threshold value in the historical time series data, taking one element in the continuous plurality of elements as a mutation point.
4. The method for detecting abnormal mutation points of smart city network device performance according to claim 1 or 2, wherein the fitting the historical time series data based on the propset model according to the mutation points to obtain a fitting curve of the historical time series comprises:
calculating the growth rate of each mutation point based on the Prophet model;
calculating the absolute average value of the growth rates of all the mutation points according to the growth rate of each mutation point;
calculating the standard deviation of the growth rate of each mutation point according to the growth rate of each mutation point and the absolute average value;
adding the absolute value average to the standard deviation of the growth rate of each mutation point, and comparing the addition result with the growth rate of each mutation point;
and updating the growth rate of each mutation point according to the comparison result.
5. A smart city network device performance anomaly mutation point detection device, comprising:
the computing module is used for acquiring a first threshold value and a second threshold value according to historical time series data of the performance index of the smart city network equipment based on the extremum theory; wherein the first threshold is greater than the second threshold;
the determining module is used for determining mutation points of the Prophet model according to elements larger than the first threshold value or smaller than the second threshold value in the historical time series data;
the fitting module is used for fitting the historical time series data according to the mutation points based on the Prophet model, obtaining a fitting curve of the historical time series, taking the mutation points as the mutation points in the Prophet model, and performing model fitting on trend items of the Prophet model;
the detection module is used for judging whether the current data of the performance index of the intelligent city network equipment is abnormal or not according to the fitting curve;
the extremum theory is a GPD model;
the computing module is specifically configured to:
acquiring parameters of the GPD model according to the historical time sequence data based on maximum likelihood estimation, and constructing the GPD model according to the parameters;
and calculating the first threshold according to a first initial threshold and a first preset probability corresponding to the first threshold based on the GPD model, and calculating the second threshold according to a second initial threshold and a second preset probability corresponding to the second threshold.
6. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the smart city network device performance anomaly mutation point detection method of any one of claims 1 to 4 when the program is executed by the processor.
7. A non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the smart city network device performance anomaly mutation point detection method of any one of claims 1 to 4.
8. A computer program product comprising a computer program which, when executed by a processor, implements the smart city network device performance anomaly mutation point detection method of any one of claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210386525.8A CN114978956B (en) | 2022-04-11 | 2022-04-11 | Method and device for detecting abnormal mutation points of performance of intelligent city network equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210386525.8A CN114978956B (en) | 2022-04-11 | 2022-04-11 | Method and device for detecting abnormal mutation points of performance of intelligent city network equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114978956A CN114978956A (en) | 2022-08-30 |
| CN114978956B true CN114978956B (en) | 2024-04-09 |
Family
ID=82977402
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210386525.8A Active CN114978956B (en) | 2022-04-11 | 2022-04-11 | Method and device for detecting abnormal mutation points of performance of intelligent city network equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114978956B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115877268B (en) * | 2023-02-13 | 2023-06-23 | 中节能晶和照明(江西)有限公司 | Positioning monitoring and alarming method for L-N leakage points in intelligent lighting system |
| CN115828055B (en) * | 2023-02-22 | 2023-04-18 | 民航成都物流技术有限公司 | Method and device for monitoring sampling data, computer equipment and storage medium |
| CN116956198B (en) * | 2023-09-18 | 2023-12-26 | 湖南迈格瑞特物联科技有限公司 | Intelligent electricity consumption data analysis method and system based on Internet of things |
| CN117829097B (en) * | 2024-02-29 | 2024-05-28 | 双一力(宁波)电池有限公司 | Battery data processing method and device, electronic equipment and readable storage medium |
Citations (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2001069412A2 (en) * | 2000-03-14 | 2001-09-20 | Speed-Trap.Com Ltd. | Monitoring and modifying services provided over a network |
| WO2018103453A1 (en) * | 2016-12-07 | 2018-06-14 | 华为技术有限公司 | Network detection method and apparatus |
| WO2018121157A1 (en) * | 2016-12-29 | 2018-07-05 | 北京神州绿盟信息安全科技股份有限公司 | Network traffic anomaly detection method and apparatus |
| CN109002904A (en) * | 2018-06-21 | 2018-12-14 | 中南大学 | A kind of medical amount prediction technique of the hospital outpatient based on Prophet-ARMA |
| CN109587001A (en) * | 2018-11-15 | 2019-04-05 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| EP3623964A1 (en) * | 2018-09-14 | 2020-03-18 | Verint Americas Inc. | Framework for the automated determination of classes and anomaly detection methods for time series |
| CN111679949A (en) * | 2020-04-23 | 2020-09-18 | 平安科技（深圳）有限公司 | Anomaly detection method based on equipment index data and related equipment |
| CN112508316A (en) * | 2019-09-16 | 2021-03-16 | 中国科学院信息工程研究所 | Adaptive anomaly determination method and device in real-time anomaly detection system |
| CN112685273A (en) * | 2020-12-29 | 2021-04-20 | 京东数字科技控股股份有限公司 | Anomaly detection method and device, computer equipment and storage medium |
| WO2021129086A1 (en) * | 2019-12-25 | 2021-07-01 | 中兴通讯股份有限公司 | Traffic prediction method, device, and storage medium |
| CN113381902A (en) * | 2020-03-10 | 2021-09-10 | 腾讯科技（深圳）有限公司 | Method, apparatus and computer storage medium for detecting cross-regional network link |
| CN113570396A (en) * | 2021-01-26 | 2021-10-29 | 腾讯科技（深圳）有限公司 | Time series data abnormity detection method, device, equipment and storage medium |
| EP3933701A1 (en) * | 2020-07-02 | 2022-01-05 | Juniper Networks, Inc. | Machine learning pipeline for predictions regarding a network |
| CN113918433A (en) * | 2021-09-27 | 2022-01-11 | 中盈优创资讯科技有限公司 | Adaptive intelligent network equipment performance index abnormity detection device and method |
| CN113949644A (en) * | 2021-10-22 | 2022-01-18 | 山东省计算中心（国家超级计算济南中心） | Method and system for predicting website access amount based on LSTM-prophet |
| CN113962745A (en) * | 2021-10-30 | 2022-01-21 | 重庆长安汽车股份有限公司 | Sales prediction method and system based on prophet model and big data |
| CN114169604A (en) * | 2021-12-06 | 2022-03-11 | 北京达佳互联信息技术有限公司 | Performance index abnormality detection method, abnormality detection device, electronic apparatus, and storage medium |
-
2022
- 2022-04-11 CN CN202210386525.8A patent/CN114978956B/en active Active
Patent Citations (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2001069412A2 (en) * | 2000-03-14 | 2001-09-20 | Speed-Trap.Com Ltd. | Monitoring and modifying services provided over a network |
| WO2018103453A1 (en) * | 2016-12-07 | 2018-06-14 | 华为技术有限公司 | Network detection method and apparatus |
| WO2018121157A1 (en) * | 2016-12-29 | 2018-07-05 | 北京神州绿盟信息安全科技股份有限公司 | Network traffic anomaly detection method and apparatus |
| CN109002904A (en) * | 2018-06-21 | 2018-12-14 | 中南大学 | A kind of medical amount prediction technique of the hospital outpatient based on Prophet-ARMA |
| EP3623964A1 (en) * | 2018-09-14 | 2020-03-18 | Verint Americas Inc. | Framework for the automated determination of classes and anomaly detection methods for time series |
| CN109587001A (en) * | 2018-11-15 | 2019-04-05 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| CN112508316A (en) * | 2019-09-16 | 2021-03-16 | 中国科学院信息工程研究所 | Adaptive anomaly determination method and device in real-time anomaly detection system |
| WO2021129086A1 (en) * | 2019-12-25 | 2021-07-01 | 中兴通讯股份有限公司 | Traffic prediction method, device, and storage medium |
| CN113381902A (en) * | 2020-03-10 | 2021-09-10 | 腾讯科技（深圳）有限公司 | Method, apparatus and computer storage medium for detecting cross-regional network link |
| CN111679949A (en) * | 2020-04-23 | 2020-09-18 | 平安科技（深圳）有限公司 | Anomaly detection method based on equipment index data and related equipment |
| WO2021212752A1 (en) * | 2020-04-23 | 2021-10-28 | 平安科技（深圳）有限公司 | Device index data-based anomaly detection method and apparatus, device, and storage medium |
| EP3933701A1 (en) * | 2020-07-02 | 2022-01-05 | Juniper Networks, Inc. | Machine learning pipeline for predictions regarding a network |
| CN112685273A (en) * | 2020-12-29 | 2021-04-20 | 京东数字科技控股股份有限公司 | Anomaly detection method and device, computer equipment and storage medium |
| CN113570396A (en) * | 2021-01-26 | 2021-10-29 | 腾讯科技（深圳）有限公司 | Time series data abnormity detection method, device, equipment and storage medium |
| CN113918433A (en) * | 2021-09-27 | 2022-01-11 | 中盈优创资讯科技有限公司 | Adaptive intelligent network equipment performance index abnormity detection device and method |
| CN113949644A (en) * | 2021-10-22 | 2022-01-18 | 山东省计算中心（国家超级计算济南中心） | Method and system for predicting website access amount based on LSTM-prophet |
| CN113962745A (en) * | 2021-10-30 | 2022-01-21 | 重庆长安汽车股份有限公司 | Sales prediction method and system based on prophet model and big data |
| CN114169604A (en) * | 2021-12-06 | 2022-03-11 | 北京达佳互联信息技术有限公司 | Performance index abnormality detection method, abnormality detection device, electronic apparatus, and storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 《基于人员红外数据的时间序列组合预测模型研究》;杨霞;《中国优秀硕士学位论文全文数据库信息科技辑》(第12期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114978956A (en) | 2022-08-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114978956B (en) | Method and device for detecting abnormal mutation points of performance of intelligent city network equipment | |
| CN111459778B (en) | Operation and maintenance system abnormal index detection model optimization method, device and storage medium | |
| Wan et al. | Learning and planning in average-reward markov decision processes | |
| CN107871190B (en) | Service index monitoring method and device | |
| WO2017008451A1 (en) | Abnormal load detecting method for cloud computing oriented online service | |
| KR101941854B1 (en) | System and method of estimating load with null data correction | |
| CN111176953B (en) | Abnormality detection and model training method, computer equipment and storage medium | |
| CN113868953B (en) | Multi-unit operation optimization method, device and system in industrial system and storage medium | |
| CN115454778A (en) | Intelligent monitoring system for abnormal time sequence indexes in large-scale cloud network environment | |
| CN112508316B (en) | Self-adaptive abnormality determination method and device in real-time abnormality detection system | |
| CN115878171A (en) | Middleware configuration optimization method, device, equipment and computer storage medium | |
| KR101741248B1 (en) | Method and apparatus for estimating causality among variables | |
| KR101960755B1 (en) | Method and apparatus of generating unacquired power data | |
| CN111523727A (en) | Method for predicting remaining life of battery by considering recovery effect based on uncertain process | |
| CN117111568B (en) | Equipment monitoring method, device, equipment and storage medium based on Internet of things | |
| CN113918433A (en) | Adaptive intelligent network equipment performance index abnormity detection device and method | |
| CN111258854B (en) | Model training method, alarm method based on prediction model and related device | |
| CN116910559A (en) | Index anomaly detection method for intelligent operation and maintenance application of power grid supercomputer center | |
| CN110245844B (en) | Abnormal index detection method and device | |
| CN114760190A (en) | Service-oriented converged network performance anomaly detection method | |
| CN114328078A (en) | Threshold dynamic calculation method and device and computer readable storage medium | |
| CN113988173A (en) | Fault diagnosis method, system, equipment and storage medium based on qualitative trend analysis and five-state Bayesian network | |
| CN110309472B (en) | Offline data-based policy evaluation method and device | |
| CN112231127A (en) | Electronic device and method for analyzing reliability of equipment | |
| CN115001997B (en) | Extreme value theory-based smart city network equipment performance abnormal threshold evaluation method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |