CN115248754A - Abnormity monitoring method and device and electronic equipment - Google Patents

Abstract

The invention provides an anomaly monitoring method and device and electronic equipment. The method comprises the following steps: and performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on the monitored object to obtain a first feature matrix, wherein the ith row and the jth column of the first feature matrix represent actual monitoring index values of the jth monitoring index under the ith monitoring time sequence. And inputting the first characteristic matrix into a prediction model to obtain a second characteristic matrix, wherein the ith row and the jth column in the second characteristic matrix represent prediction monitoring index values, the prediction model is obtained by taking a first sample characteristic matrix of a monitored object as input and a second sample characteristic matrix as output training, and the first sample characteristic matrix is a previous sample relative to the second sample characteristic matrix. And calculating a third characteristic matrix, wherein the ith row and the jth column in the third characteristic matrix represent residual values of the actual monitoring index value and the predicted monitoring index value. And taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content to alarm the abnormality.

Description

Abnormity monitoring method and device and electronic equipment

Technical Field

The present disclosure relates to the field of artificial intelligence technologies, and in particular, to an anomaly monitoring method and apparatus, and an electronic device.

Background

The current common anomaly detection modes of the service system mainly comprise a threshold detection method and an average detection method. In the former, an expert analyzes the service index data in a targeted manner, a threshold boundary is defined, and if the threshold is exceeded, an abnormality is determined. The latter averages a plurality of historical service index data, and finally delimitates the degree of dispersion by time granularity difference, if the degree of dispersion is higher than a certain standard, the abnormity is determined.

In practical application, the service data of many service systems have tidal changes, and the anomaly measure of the threshold detection method and the average detection is fixed, so that the accuracy is low when anomaly detection is performed on service index data with trend or discreteness. In view of the above, an anomaly detection scheme applicable to tidal changes of traffic data is currently being continued.

Disclosure of Invention

The embodiment of the invention aims to provide an anomaly monitoring method, an anomaly monitoring device and electronic equipment, which can realize more accurate anomaly detection on a data system with tidal changes.

In order to achieve the above object, the embodiments of the present invention are implemented as follows:

in a first aspect, an anomaly monitoring method is provided, including:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index under the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, wherein the feature value of the ith row and the jth column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

In a second aspect, an abnormality monitoring apparatus is provided, including:

the characteristic extraction module is used for extracting the characteristics of a plurality of monitoring indexes of a plurality of monitoring time sequences from the monitored object to obtain a first characteristic matrix, wherein the characteristic value of the ith row and the jth column in the first characteristic matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence;

the prediction module is used for inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

a residual error calculation module, configured to perform residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, where a feature value in an ith row and an ith column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of a jth monitoring index at an ith monitoring timing;

and the abnormity alarm module is used for taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormity alarm aiming at the monitored object.

In a third aspect, an electronic device is provided that includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being executed by the processor to:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents the predicted monitoring index value of the jth monitoring index under the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, a second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, wherein the feature value of the ith row and the jth column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, the computer program, when executed by a processor, implementing the steps of:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, wherein the feature value of the ith row and the jth column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

The scheme of the embodiment of the invention designs a characteristic matrix structure expressed by monitoring time sequence and monitoring indexes, and predicts the actual value monitoring characteristic matrix of the monitored object through a prediction model to obtain a predicted monitoring characteristic matrix. The prediction model is obtained by training a gradient direction of a sample feature matrix at a previous time relative to a gradient direction of a sample feature matrix at a later time, and has an anomaly prediction capability for each monitoring index at a future time by taking a feature sequence of data tide changes of a monitoring object as a factor. Therefore, residual calculation is carried out on the actual monitoring characteristic matrix and the prediction monitoring characteristic matrix, and the abnormal condition of a certain monitoring index of the monitored object in a certain monitoring time sequence can be reflected in advance through the residual value in the residual characteristic matrix, so that the alarm is carried out as early as possible to reduce the loss.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a schematic flowchart of an anomaly monitoring method according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a first feature matrix of the anomaly monitoring method according to the embodiment of the present invention.

Fig. 3 is a schematic diagram of a second feature matrix of the anomaly monitoring method according to the embodiment of the present invention.

Fig. 4 is a schematic structural diagram of an abnormality monitoring apparatus according to an embodiment of the present invention.

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present specification without any inventive step should fall within the scope of protection of the present specification.

As mentioned above, the anomaly detection methods of the current common service systems mainly include a threshold detection method and an average detection method. In the former, an expert analyzes the service index data in a targeted manner, a threshold boundary is defined, and if the threshold is exceeded, an abnormality is determined. The latter averages a plurality of historical service index data, and finally delimitates the degree of dispersion by time granularity difference, if the degree of dispersion is higher than a certain standard, the abnormity is determined. It can be seen that the anomaly measure for the threshold detection method and the mean detection is fixed. In practical application, service data of a plurality of service systems can have tidal changes, the abnormal detection standard of the service index data also needs to be adjusted in response, and it is obvious that accurate abnormal identification cannot be provided through the existing threshold detection method and the average detection method. To this end, the present application is directed to an anomaly detection scheme suitable for data systems with tidal variations.

Fig. 1 is a flowchart of an anomaly monitoring method according to an embodiment of the present invention, including the following steps:

s102, performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on the monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence.

It should be understood that the monitoring timing and the monitoring index can be flexibly set according to the actual monitoring requirement, and are not specifically limited herein.

And S104, inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents the predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes the first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting.

It should be understood that, in this step, the prediction model obtains a second feature matrix of a next time window based on the first feature matrix of a certain time window, and a predicted monitoring index value of a jth monitoring index at an ith monitoring time sequence in the second feature matrix, that is, a prediction result of an actual monitoring index value of the jth monitoring index at the ith monitoring time sequence corresponding to the prediction model.

Here, the prediction model may be trained in a supervised manner, so that the prediction model learns to obtain the capability of predicting the value of each monitoring index in the next time window. In particular, the predictive model has a base

In the training process, after the first sample characteristic matrix is input into the prediction model, a training result given by the prediction model is obtained, the training result is close to the second sample characteristic matrix, therefore, the error between the training result and the second sample characteristic matrix can be calculated based on the loss function, and the parameters of the prediction model are adjusted with the aim of reducing the error, so that the training effect is achieved.

It should be understood that the specific implementation of the prediction model is not exclusive and is not specifically limited herein.

And S106, performing residual error calculation on the first characteristic matrix and the second characteristic matrix to obtain a third characteristic matrix, wherein the characteristic value of the ith row and the jth column in the third characteristic matrix represents the residual error value between the actual monitoring index value and the predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence.

And S108, taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm contents to perform abnormal alarm aiming at the monitored object.

It should be understood that, since the eigenvalue of the third eigen matrix is a residual value between the actual monitoring index value and the predicted monitoring index value, when the eigenvalue of the third eigen matrix exceeds a predetermined residual threshold corresponding to a certain belonged monitoring index, it can be determined as an abnormal eigenvalue. Different monitoring indexes are provided with the same or different preset residual threshold, and the data types of the actual monitoring indexes can be flexibly set.

Obviously, based on the result of the feature matrix of the present application, if there is an abnormal feature value in the third feature matrix of the monitored object, the monitoring index corresponding to the abnormal feature value is an abnormal monitoring index, the monitoring time sequence corresponding to the abnormal feature value is abnormal finding time, and the abnormal problem of the monitored object can be clearly located by alarming the monitoring index and the monitoring time sequence corresponding to the abnormal feature value.

The method of the embodiment of the invention designs a characteristic matrix structure expressed by monitoring time sequence and monitoring indexes, and predicts the actual value monitoring characteristic matrix of the monitored object through a prediction model to obtain a predicted monitoring characteristic matrix. The prediction model is obtained by training a gradient direction of a sample feature matrix at a previous time relative to a gradient direction of a sample feature matrix at a later time, and has an anomaly prediction capability for each monitoring index at a future time by taking a feature sequence of data tide changes of a monitoring object as a factor. Therefore, residual calculation is carried out on the actual monitoring characteristic matrix and the prediction monitoring characteristic matrix, and the abnormal condition of a certain monitoring index of the monitored object in a certain monitoring time sequence can be reflected in advance through the residual value in the residual characteristic matrix, so that the alarm is carried out as early as possible to reduce the loss.

On the basis of actual situation, in order to more accurately find out the abnormal problem of the monitored object, the method of the embodiment of the invention can extract the characteristics of a plurality of monitoring indexes of a plurality of monitoring time sequences for the monitored object based on different time granularities; each time granularity corresponds to a first feature matrix, a second feature matrix and a third feature matrix. And the short-term abnormal problem, the medium-term abnormal problem and the long-term problem of the monitored object can be found by carrying out abnormal detection at different time granularities.

The following provides an exemplary description of the method according to the embodiment of the present invention in conjunction with an actual application scenario.

In the application scenario, the VPN is used as a monitoring object, and anomaly detection is performed on 21 monitoring indexes.

The monitoring index of the VPN can be represented by the following fields:

for the fields, acquiring a time sequence data set to be predicted of a certain APN, and carrying out normalization processing on non-proportional data to obtain D _mn (m is the time sequence; n is the number of fields, in this case n is 21). D _mn Any one of the row vectors X _t (t ∈ m) indicates the normalized value of each monitoring field under the APN at time t. Namely: x _t ＝(x ₁ ,x ₂ ……x ₂₁ ). To D _mn Is calculated by

N rows and n columns, width is the three-dimensional tensor of T, which is the time sequence of construction, and has the value of m-max (omega). Then pair

Each element of

The following definitions are made:

since the data in this example are given at the granularity of hours, for

Respectively taking the different omega, respectively,taking at omega (omega) ₁ ＝2，ω ₂ ＝6，ω ₃ = 12) represent the degree of influence of the problem in the range of 2 hours, 6 hours, 12 hours, i.e., short, medium, and long periods, respectively, of the channels plotted by the matrix of the above short, medium, and long periods. Thus, a 4-dimensional Tensor (Tensor, input data type in deep learning) of n × n × c × T is constructed, wherein n represents a field to be predicted; c is the number of channels 3, i.e. 3 ω; t is the constructed time sequence.

Here, a short cycle time granularity of 2.5 hours is taken as an example. For convenience of understanding, fig. 2 shows a characteristic matrix related to VPN short-period data in an image manner, where a vertical coordinate represents a monitoring time sequence (2.5 hour granularity), a horizontal coordinate represents each monitoring index field, and a larger gray level of a characteristic value represents a larger data value.

According to the feature matrix structure shown in fig. 2, feature extraction is performed on the time sequence data set to be predicted in the VPN in one day, so as to obtain a first feature matrix R _n+1 。

Then, R is put into _n+1 Inputting the predicted R into a ConvLSTM model of the feedforward long-short term memory network to obtain the predicted R of the ConvLSTM model _n+1 Second feature matrix P after one day _n+1 。

The ConvLSTM model may extract information in a two-dimensional matrix by convolution. Here, mselos (mean square error loss function), which plays a limiting role in constructing the ConvLSTM model, can be used as a loss function of the present model. ConvLSTM performs one-step convolution calculation on the data, and then the original 'corresponding bits' need to be multiplied on the model to be two-dimensional convolution so as to extract relevant information between adjacent pixels in the picture. In this example, using hour data for 30 days, a time window size of 24 hours was set (one day after the predicted result). Inputting the constructed time sequence matrix into a ConvLSTM deep learning network for training. Training will produce a prediction model for the sequence, and prediction is performed by the model to obtain prediction data P of the next time window _n+1 。

Then, for R _n+1 And P _n+1 Performing residual error to obtain a third bit shown in FIG. 3And (5) characterizing the matrix. As can be seen from fig. 3, the band with a larger color depth is a data index with a larger residual value. Through the graph 3, the number of times of successful requests of the 2 nd field for excluding the user reason can be determined one day ahead (the pre-stored time window of the prediction model is 1 day), the success rate of switching the 19 th field S1 is determined, the success rate of the requests of the 21 st field tau is abnormal, and the corresponding monitoring time sequence is associated for alarming.

According to the characteristic that errors between fields before prediction are mutually independent, the application scene reduces the interference of errors existing in data to a prediction result by constructing a time sequence correlation matrix in advance. Meanwhile, in order to predict multi-index time series data and consider the relevance between related indexes, convLSTM is adopted for prediction. ConvLSTM combines the image convolution and the LSTM neural network, extracts the time sequence characteristics in the time sequence data matrix, improves the accuracy of Internet of things index monitoring, finds problems before users, and reduces the phenomenon of multi-report or missing report. In practical application, the data of the short time span, the medium time span and the long time span can be respectively calculated, and the predicted result can directly define the alarm level according to the prediction of the short time span, the medium time span and the long time span, so that the method has strong guiding significance for the subsequent processing of events.

In addition, corresponding to the abnormality monitoring method shown in fig. 1, an embodiment of the present invention further provides an abnormality monitoring apparatus. Fig. 4 is a schematic structural diagram of an anomaly monitoring apparatus 400 according to an embodiment of the present invention, including:

the feature extraction module 410 is configured to perform feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, where feature values of an ith row and a jth column in the first feature matrix represent actual monitoring index values of a jth monitoring index at an ith monitoring time sequence;

the prediction module 420 is configured to input the first feature matrix to a prediction model to obtain a second feature matrix, where feature values of an ith row and a jth column in the second feature matrix represent predicted monitoring index values of a jth monitoring index at an ith monitoring timing, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample with respect to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

a residual calculation module 430, configured to perform residual calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, where a feature value in an ith row and an ith column in the third feature matrix represents a residual value between an actual monitoring index value and a predicted monitoring index value of a jth monitoring index at an ith monitoring timing;

the anomaly alarm module 440 takes the monitoring time sequence and the monitoring index corresponding to the anomaly eigenvalue in the third eigen matrix as alarm content, so as to perform anomaly alarm for the monitored object.

The device of the embodiment of the invention designs a characteristic matrix structure expressed by monitoring time sequence and monitoring indexes, and predicts the actual value monitoring characteristic matrix of the monitored object through a prediction model to obtain a predicted monitoring characteristic matrix. The prediction model is obtained by training a gradient direction of a sample feature matrix at a previous time relative to a gradient direction of a sample feature matrix at a later time, and has an anomaly prediction capability for each monitoring index at a future time by taking a feature sequence of data tide changes of a monitoring object as a factor. Therefore, residual calculation is carried out on the actual monitoring characteristic matrix and the prediction monitoring characteristic matrix, and the abnormal condition of a certain monitoring index of the monitored object in a certain monitoring time sequence can be reflected in advance through the residual value in the residual characteristic matrix, so that the alarm is carried out as early as possible to reduce the loss.

In practical application, in order to accurately find out the abnormal problem of the monitored object, the feature extraction of a plurality of monitoring indexes of a plurality of monitoring time sequences can be carried out on the monitored object according to at least two time granularities; each time granularity corresponds to a first feature matrix, a second feature matrix and a third feature matrix.

Then, according to each time granularity, respectively alarming abnormity of the monitored object

Optionally, the abnormal eigenvalue in the third eigen matrix is an eigenvalue whose value reaches a preset residual threshold corresponding to the monitoring index. Different monitoring indexes are provided with the same or different preset residual error thresholds.

Optionally, the feature extraction module 410 performs feature extraction of multiple monitoring indexes of multiple monitoring time sequences on the monitored object specifically according to at least two time granularities; each time granularity corresponds to a first feature matrix, a second feature matrix and a third feature matrix.

Optionally, the monitoring object is a VPN, and the monitoring index includes at least one of: the success rate of the attach request for excluding the user reason, the success times of the attach request, the success rate of the attach request, the success times of the attach success, the average attach delay, the average delay of the bearer establishment, the success times of the bearer establishment request, the success times of the bearer deletion request, the success rate of the bearer deletion request, the success times of the X2 handover request between enbs, the success rate of the X2 handover between enbs, the paging success rate, the paging times, the success times of the PDN connection request, the success times of the S1 handover request, the S1 handover success rate, the tau request success rate and the tau request success times.

Based on the service characteristics of the VPN, feature extraction can be performed on the monitored object based on the 2-hour granularity, the 6-hour granularity and the 12-hour granularity.

Optionally, the prediction model is a feedforward long-short term memory network ConvLSTM model.

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present specification. Referring to fig. 5, at a hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The Memory may include a Memory, such as a Random-Access Memory (RAM), and may further include a non-volatile Memory, such as at least 1 disk Memory. Of course, the electronic device may also include hardware required for other services.

The processor, the network interface, and the memory may be connected to each other via an internal bus, which may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, an EISA (Extended Industry Standard Architecture) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one double-headed arrow is shown in FIG. 5, but this does not indicate only one bus or one type of bus.

And the memory is used for storing programs. In particular, the program may include program code comprising computer operating instructions. The memory may include both memory and non-volatile storage and provides instructions and data to the processor. The processor reads the corresponding computer program from the nonvolatile memory into the memory and then runs the computer program, and the abnormity monitoring device is formed on a logic level. Correspondingly, the processor executes the program stored in the memory, and is specifically configured to perform the following operations:

and performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on the monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence.

Inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting.

And residual error calculation is carried out on the first characteristic matrix and the second characteristic matrix to obtain a third characteristic matrix, wherein the characteristic value of the ith row and the jth column in the third characteristic matrix represents the residual error value between the actual monitoring index value and the predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence.

And taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

The above-mentioned exception monitoring method disclosed in the embodiment of fig. 1 in this specification can be applied to a processor, or implemented by a processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or instructions in the form of software. The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components. The various methods, steps, and logic blocks disclosed in the embodiments of the present invention may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in connection with the embodiments of the present invention may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in a memory, and a processor reads information in the memory and completes the steps of the method in combination with hardware of the processor.

It should be understood that the electronic device of the embodiment of the present invention may enable the abnormality monitoring apparatus to implement steps and functions corresponding to those in the method shown in fig. 1. Since the principle is the same, the detailed description is omitted here.

Of course, besides the software implementation, the electronic device in this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, and may also be hardware or logic devices.

Furthermore, an embodiment of the present invention also provides a computer-readable storage medium storing one or more programs, the one or more programs including instructions.

When executed by a portable electronic device including a plurality of application programs, the instructions may enable the portable electronic device to perform the steps of the abnormality monitoring method shown in fig. 1, including:

and performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on the monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence.

Inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting.

And residual error calculation is carried out on the first characteristic matrix and the second characteristic matrix to obtain a third characteristic matrix, wherein the characteristic value of the ith row and the jth column in the third characteristic matrix represents the residual error value between the actual monitoring index value and the predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence.

And taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

As will be appreciated by one skilled in the art, embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

The above description is only an example of the present specification, and is not intended to limit the present specification. Various modifications and alterations to this description will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification. Moreover, all other embodiments obtained by a person skilled in the art without making any inventive step shall fall within the scope of protection of this document.

Claims (10)

1. An anomaly monitoring method, comprising:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index under the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, wherein the feature value of the ith row and the jth column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm contents to perform abnormal alarm aiming at the monitored object.

2. The method of claim 1,

and the abnormal characteristic value in the third characteristic matrix is a characteristic value of which the value reaches a preset residual error threshold corresponding to the monitoring index.

3. The method of claim 2,

different monitoring indexes are provided with the same or different preset residual error thresholds.

4. The method of claim 1,

the method for extracting the characteristics of a plurality of monitoring indexes of a plurality of monitoring time sequences for a monitored object comprises the following steps:

according to at least two time granularities, carrying out feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object; and each time granularity corresponds to a first characteristic matrix, a second characteristic matrix and a third characteristic matrix.

5. The method of claim 4,

the monitoring object is a VPN, and the monitoring index comprises at least one of the following: the success rate of the attachment request excluding the user reason, the success times of the attachment request, the success rate of the attachment, the success times of the attachment, the average attachment time delay, the average time delay of the bearer establishment, the success times of the bearer establishment request, the success rate of the bearer establishment request, the success times of the bearer deletion request, the success times of the X2 handover request between enbs, the success rate of the X2 handover between enbs, the paging success rate, the paging times, the success times of PDN connection request, the success times of the S1 handover request, the success rate of the S1 handover, the success rate of the tau request and the success times of the tau request.

6. The method of claim 5,

the at least two time particle sizes include a 2 hour particle size, a 6 hour particle size, and a 12 hour particle size.

7. The method according to any one of claims 1 to 6,

the prediction model is a feedforward long-short term memory network ConvLSTM model.

8. An anomaly monitoring device, comprising:

the characteristic extraction module is used for extracting the characteristics of a plurality of monitoring indexes of a plurality of monitoring time sequences for the monitored object to obtain a first characteristic matrix, wherein the characteristic value of the ith row and the jth column in the first characteristic matrix represents the actual monitoring index value of the jth monitoring index under the ith monitoring time sequence;

the prediction module is used for inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

a residual error calculation module, configured to perform residual error calculation on the first feature matrix and the second feature matrix to obtain a third feature matrix, where a feature value in an ith row and an ith column in the third feature matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of a jth monitoring index at an ith monitoring timing;

and the abnormity alarm module is used for taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormity alarm aiming at the monitored object.

9. An electronic device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is executed by the processor to:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index at the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents the predicted monitoring index value of the jth monitoring index under the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, a second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first characteristic matrix and the second characteristic matrix to obtain a third characteristic matrix, wherein the characteristic value of the ith row and the jth column in the third characteristic matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index in the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

10. A computer-readable storage medium having a computer program stored thereon, the computer program when executed by a processor implementing the steps of:

performing feature extraction on a plurality of monitoring indexes of a plurality of monitoring time sequences on a monitored object to obtain a first feature matrix, wherein the feature value of the ith row and the jth column in the first feature matrix represents the actual monitoring index value of the jth monitoring index under the ith monitoring time sequence;

inputting the first feature matrix into a prediction model to obtain a second feature matrix, wherein the feature value of the ith row and the jth column in the second feature matrix represents a predicted monitoring index value of the jth monitoring index at the ith monitoring time sequence, the prediction model takes a first sample feature matrix of the monitored object as input, the second sample feature matrix of the monitored object is obtained by output training, the first sample feature matrix is a previous sample relative to the second sample feature matrix, the first sample feature matrix and the first feature matrix have the same feature value representation setting, and the second sample feature matrix and the second feature matrix have the same feature value representation setting;

performing residual error calculation on the first characteristic matrix and the second characteristic matrix to obtain a third characteristic matrix, wherein the characteristic value of the ith row and the jth column in the third characteristic matrix represents a residual error value between an actual monitoring index value and a predicted monitoring index value of the jth monitoring index in the ith monitoring time sequence;

and taking the monitoring time sequence and the monitoring index corresponding to the abnormal characteristic value in the third characteristic matrix as alarm content so as to carry out abnormal alarm aiming at the monitored object.

Images