CN115618247A

CN115618247A - Abnormality detection method, abnormality detection device, electronic apparatus, and storage medium

Info

Publication number: CN115618247A
Application number: CN202211173396.0A
Authority: CN
Inventors: 邵钟飞; 冯裕祺
Original assignee: Clp Jinxin Software Shanghai Co ltd
Current assignee: Clp Jinxin Software Shanghai Co ltd
Priority date: 2022-09-26
Filing date: 2022-09-26
Publication date: 2023-01-17

Abstract

The application provides an abnormality detection method, an abnormality detection device, an electronic apparatus, and a storage medium, the method including: predicting target prediction data in a second target time interval according to first target data of the target object in the first target time interval, wherein the second target time interval is positioned after the first target time interval and is continuous with the first target time interval; detecting whether the target object has data abnormality in a second target time period based on the influence of the emergency according to the clustering result of the target prediction data and the second target data, wherein the second target data is actual data of the target object in the second target time period; the first target time interval is a first time interval, the second target time interval is a burst time interval corresponding to the burst event, and/or the first target time interval is a second time interval including the first time interval and the burst time interval, and the second target time interval is a third time interval which is located after the burst time interval and is continuous with the burst time interval. According to the method and the device, data prediction and clustering can be combined to carry out anomaly detection, and burst risks can be better dealt with.

Description

Abnormality detection method, abnormality detection device, electronic apparatus, and storage medium

Technical Field

The present application relates to the field of data processing technologies, and in particular, to an anomaly detection method and apparatus, an electronic device, and a storage medium.

Background

In the time series prediction scenario, the method is often influenced by various emergencies. And whether the time series data are abnormal or not is necessary to judge whether the emergency event causes the abnormality or not, and relevant decisions can be made in advance by detecting the abnormality of the time series data, so that the loss is avoided. At present, in the market, a corresponding detection mode is lacked for whether the time series data are abnormal or not due to the emergency.

Disclosure of Invention

The embodiment of the application provides an anomaly detection method, an anomaly detection device, electronic equipment and a storage medium, and aims to solve the problems that whether time series data are abnormal or not due to an emergency in the prior art lacks a corresponding detection mode and cannot make a relevant decision in advance.

In a first aspect, an embodiment of the present application provides an anomaly detection method, including:

predicting target prediction data of a target object in a second target time interval according to first target data of the target object in a first target time interval, wherein a data value of the target object dynamically changes based on time change, and the second target time interval is located after the first target time interval and is continuous with the first target time interval;

detecting whether the target object has data abnormality in the second target time period based on the influence of an emergency or not according to the clustering result of the target prediction data and second target data, wherein the second target data are actual data corresponding to the target object in the second target time period;

wherein the first target period and the second target period are the following: the first target time interval is a first time interval, the second target time interval is a burst time interval corresponding to the burst event, and/or the first target time interval is a second time interval, and the second target time interval is a third time interval which is located after the burst time interval and is continuous with the burst time interval; the first period is a period that is located before and continuous with the burst period, and the second period is a period that includes the first period and the burst period.

In a second aspect, an embodiment of the present application provides an abnormality detection apparatus, including:

the prediction module is used for predicting target prediction data of a target object in a second target time interval according to first target data of the target object in a first target time interval, wherein the data value of the target object dynamically changes based on time change, and the second target time interval is positioned after the first target time interval and is continuous with the first target time interval;

the detection module is used for detecting whether the target object has data abnormality in the second target time period based on the influence of an emergency or not according to the clustering result of the target prediction data and second target data, wherein the second target data are actual data corresponding to the target object in the second target time period;

In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a computer program stored on the memory and executable on the processor, and when executed by the processor, the computer program implements the steps of the abnormality detection method according to the first aspect.

In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the abnormality detection method according to the first aspect.

According to the technical scheme of the embodiment of the application, the target prediction data of the target object in the second target time period is predicted according to the first target data of the target object in the first target time period, the target prediction data obtained through prediction and the actual data corresponding to the second target time period are clustered, whether the target object is abnormal in the second target time period based on the influence of the emergency is detected according to the clustering result, the data prediction and data clustering combined mode can be adopted, whether the emergency influences the target object and causes the data abnormality of the target object, a judgment strategy of the data abnormality is provided, help can be provided for decision making in the time series data prediction field, the emergency risk can be better met, and loss is reduced.

Drawings

FIG. 1 is a schematic diagram of an anomaly detection method provided in an embodiment of the present application;

FIG. 2 is a schematic diagram illustrating a method for predicting target prediction data of a target object in a second target period according to an embodiment of the present disclosure;

fig. 3 is a schematic diagram illustrating a method for detecting whether a target object has data anomaly in a second target period according to an embodiment of the present application;

FIG. 4 is a flowchart illustrating an embodiment of an anomaly detection method according to the present disclosure;

FIG. 5 is a schematic diagram of an anomaly detection apparatus provided in an embodiment of the present application;

fig. 6 shows a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some, but not all, embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

It should be appreciated that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the present application. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

In various embodiments of the present application, it should be understood that the sequence numbers of the following processes do not mean the execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

The method is used for combining data prediction and data clustering under a time series data prediction scene to detect whether the emergency can affect a time series object or not and cause the time series object to have data abnormity, can provide help for decision making in the time series data prediction field such as finance and energy, better cope with emergency risks and reduce loss.

In order to facilitate understanding of the present application, a method for detecting an anomaly disclosed in the embodiments of the present application is first introduced, and the solution provided in the present application is used for detecting data anomalies caused by different types of emergencies (e.g., wars and natural disasters) in a time series data prediction scenario, such as a stock price prediction scenario, a futures trading prediction scenario, and an industrial production data prediction scenario. Referring to fig. 1, the method includes:

step 101, according to first target data corresponding to a target object in a first target time interval, predicting target prediction data corresponding to the target object in a second target time interval, wherein a data value corresponding to the target object dynamically changes based on time change, and the second target time interval is located after the first target time interval and is continuous with the first target time interval.

The anomaly detection method provided by the embodiment of the application is applied to electronic equipment for installing detection application, the electronic equipment acquires first target data corresponding to a target object in a first target time period aiming at the target object of which the data value dynamically changes based on time change, and the target object can be a stock price, an oil price or other time series objects, such as industrial production data (power consumption and the like). The first target data includes a plurality of time parameters and a data value corresponding to each time parameter. The first target data may be provided by a user, and is actual data corresponding to the first target time period, and the user in this embodiment may be a security company, a bank, or another financial institution, or may be an institution that provides industrial production data. When the user provides data, the user interacts with the electronic equipment through the equipment on the user side, so that the electronic equipment acquires the data. For example, a computer on the user side interacts with a server for abnormality detection, so that the server can acquire corresponding data.

The first target time interval is a first time interval, the second target time interval is a burst time interval corresponding to a burst event, and/or the first target time interval is a second time interval, and the second target time interval is a third time interval which is located after the burst time interval and is continuous with the burst time interval; the first period is a period that is located before and continuous with the burst period, and the second period is a period that includes the first period and the burst period.

The first target period in this embodiment may be a first period and/or a second period, and correspondingly, the second target period may be a burst period and/or a third period, where the second target period is a burst period when the first target period is the first period, and the second target period is the third period when the first target period is the second period.

For the first period, the first period is continuous with and before the burst period, specifically, an initial time of the first period is a preset initial time point, an end time of the first period is an initial time of the burst period, the first period is continuous with the burst period in time, and the first period matches the burst period, that is, data corresponding to the burst period can be predicted based on the data corresponding to the first period. The second time interval includes a first time interval and a burst time interval, an initial time of the second time interval is a preset initial time point, an end time of the second time interval is an end time of the burst time interval and is an initial time of the third time interval, the second time interval and the third time interval are consecutive in time, and the second time interval and the third time interval are matched, that is, data corresponding to the third time interval can be predicted based on data corresponding to the second time interval. The third period is located after the burst period and is continuous with the burst period.

The first time period, the second time period and the third time period are described below by way of example, the burst time period is from 1/2/2022 to 10/2/2022, the preset initial time point is from 1/2022, the first time period is from 1/2022 to 1/31/2022, the third time period is after the burst time period and may be from 11/2022/2 to 28/2022/2/2022, and the second time period is from 1/2022 to 10/2022/2.

After first target data corresponding to a target object in a first target time period is acquired, the first target data is used as input data, target prediction data corresponding to a second target time period continuous with the first target time period are predicted by a detection application, and target prediction data corresponding to the second target time period is predicted on the basis of the existing first target data by the detection application.

Step 102, detecting whether the target object has data abnormality in the second target time period based on the influence of the emergency according to the clustering result of the target prediction data and the second target data, wherein the second target data is actual data corresponding to the target object in the second target time period.

After target prediction data corresponding to a second target time period is obtained, clustering is carried out on the target prediction data and actual data (second target data) of the target object corresponding to the second target time period, a clustering result is obtained, and then whether data abnormality occurs in the target object in the second target time period based on the influence of the emergency is detected based on the clustering result. And if the detection result is yes, determining that the target object has data abnormality in the second target time period based on the influence of the emergency.

The second target data is actual historical data of the target object in the second target time period and can be provided by a user, the target prediction data is prediction data of the target object in the second target time period, a clustering result is obtained by clustering the prediction data and the actual data, and whether data abnormality occurs in the target object in the second target time period can be determined based on the clustering result.

For the situation that the first target time interval is a first time interval and the second target time interval is a burst time interval, whether the target object has data abnormality in the burst time interval based on the influence of the burst event can be detected based on the clustering result of the predicted data and the actual data corresponding to the burst time interval; for the situation that the first target time interval is a second time interval and the second target time interval is a third time interval, whether the target object has data abnormality in the third time interval based on the influence of the emergency can be detected based on the clustering result of the predicted data and the actual data corresponding to the third time interval; for the case that the first target time interval is a first time interval and a second time interval, and the second target time interval is a burst time interval and a third time interval, whether the target object has data abnormality in the burst time interval based on the influence of the burst event can be detected based on the clustering result of the predicted data and the actual data corresponding to the burst time interval; and detecting whether the target object has data abnormality in the third time period based on the influence of the emergency based on the clustering result of the predicted data and the actual data corresponding to the third time period.

In order to determine whether the influence of the emergency event ends at the occurrence period or continues for a while, it is necessary to detect whether the target object has data abnormality in the emergency period and the third period based on the influence of the emergency event.

The method provided by this embodiment is described below by using a specific application scenario, data of a stock price or an electric power consumption provided by a user in a first time period is obtained, data of the stock price or the electric power consumption in an emergency time period corresponding to an emergency (such as a war or a natural disaster) is predicted according to the obtained data, and then the predicted data and actual data corresponding to the emergency time period are clustered to detect whether data abnormality occurs in the emergency time period based on the influence of the emergency.

According to the implementation process, the target prediction data corresponding to the target object in the second target time period is predicted according to the first target data corresponding to the target object in the first target time period, the target prediction data obtained through prediction and the actual data corresponding to the second target time period are clustered, whether the target object is abnormal in the second target time period based on the influence of the emergency is detected according to the clustering result, the fact that whether the emergency influences the target object and causes the data abnormality of the target object can be detected in a mode of combining data prediction and data clustering, a judgment strategy of the data abnormality is provided, help can be provided for decision making in the time series data prediction field, emergency risks can be better dealt with, and losses are reduced.

Describing the process of predicting the target prediction data corresponding to the second target time interval, when predicting the target prediction data corresponding to the target object in the second target time interval according to the first target data corresponding to the target object in the first target time interval, as shown in fig. 2, the method includes the following steps:

step 201, in the history data corresponding to the target object, acquiring the corresponding first target data based on the first target time period.

Step 202, according to the first target data and the target influence factor corresponding to the target object, model training is carried out, and a target prediction model is determined.

Step 203, inputting the time parameter corresponding to the second target time interval into the target prediction model, and obtaining target prediction data corresponding to the second target time interval output by the target prediction model.

When predicting target prediction data corresponding to a target object in a second target time period, firstly, in history data corresponding to the target object, acquiring corresponding first target data based on a first target time period, specifically: and based on the starting and ending time corresponding to the first target time period, determining the matched starting and ending time in the time period corresponding to the historical data, further intercepting the corresponding data from the historical data, and determining the corresponding data as the first target data. After the first target data are obtained, model training is carried out according to the first target data and target influence factors corresponding to target objects, and a target prediction model is determined, wherein the target prediction model is used for carrying out data prediction based on time parameters.

The target influence factor includes at least one of a holiday influence factor and a period influence factor, and the target influence factor is determined by a user, specifically, the user selects whether to consider the target influence factor during model training, and if so, the user is required to determine specific content corresponding to the target influence factor. And if the user selects not to consider the target influence factor when carrying out model training, the target influence factor is zero.

The holiday impact factor may understand the impact of holidays on the data value of the target object, and accordingly, the cycle impact factor may understand the impact of a cycle effect on the data value of the target object. The influence factors corresponding to different holidays can be differentiated, and the cycle influence factor can include at least one of a year effect influence factor, a month effect influence factor and a cycle effect influence factor, and of course, other types of influence factors can also be included.

When model training is performed according to the first target data and the target influence factor corresponding to the target object, initial model parameters may be determined based on the target influence factor, then model training is performed based on the first target data, model parameters are adjusted continuously in the process of model training until the model training is completed, and a target prediction model is determined. The initial model parameters change based on the change of the content corresponding to the target influence factor, and the target prediction model may be a Prophet model or other models.

By using the first target data corresponding to the first target time interval as a training sample for model training and determining the target prediction model, the target prediction data corresponding to the second target time interval can be predicted based on the target prediction model, so that the data in a specific time interval can be predicted based on the model.

Introducing a process of determining a target prediction model when a first target time interval is a first time interval and/or a second time interval, performing model training according to the first target data and a target influence factor corresponding to the target object, and determining the target prediction model, including:

under the condition that the first target time interval is the first time interval, performing model training according to first data corresponding to the first time interval and the target influence factor to determine a first prediction model;

under the condition that the first target time interval is the second time interval, performing model training according to second data corresponding to the second time interval and the target influence factor to determine a second prediction model;

under the condition that the first target time interval is the first time interval and the second time interval, performing model training according to first data corresponding to the first time interval and the target influence factor, and determining a first prediction model; and/or performing model training and determining a second prediction model according to second data corresponding to the second time interval and the target influence factor.

And aiming at the condition that the first target time interval is the first time interval, acquiring first data corresponding to the first time interval provided by a user, carrying out model training based on the first data and a target influence factor corresponding to a target object, and determining a first prediction model, wherein the target prediction model at the moment is the first prediction model.

And aiming at the condition that the first target time interval is a second time interval, acquiring second data corresponding to the second time interval provided by a user, performing model training based on the second data and a target influence factor corresponding to a target object, and determining a second prediction model, wherein the target prediction model at the moment is the second prediction model.

For the situation that the first target time interval is the first time interval and the second time interval, performing model training according to first data and a target influence factor corresponding to the first time interval to determine a first prediction model, and performing model training according to second data and a target influence factor corresponding to the second time interval to determine a second prediction model; the method may further include performing model training and determining the first prediction model only according to first data and a target influence factor corresponding to a first time period, or performing model training and determining the second prediction model only according to second data and a target influence factor corresponding to a second time period. That is, in this case, one or two models may be trained, and in the case of training one model, if only the first prediction model is determined, prediction data corresponding to the burst period and/or the third period may be predicted based on the first prediction model; if only the second prediction model is determined, the prediction data corresponding to the burst period and/or the third period may be predicted based on the second prediction model.

Wherein the first target data comprises first data and/or second data and the target prediction model comprises a first prediction model and/or a second prediction model.

Optionally, when the time parameter corresponding to the second target time period is input into the target prediction model, and target prediction data corresponding to the second target time period output by the target prediction model is acquired, the method includes:

when the second target time interval is the burst time interval, inputting the time parameter corresponding to the burst time interval into the first prediction model, and acquiring first prediction data corresponding to the burst time interval;

when the second target time interval is the third time interval, inputting the time parameter corresponding to the third time interval into the second prediction model to obtain second prediction data corresponding to the third time interval;

when the second target time interval is the burst time interval and the third time interval, inputting the time parameter corresponding to the burst time interval into the first prediction model to obtain first prediction data corresponding to the burst time interval, and inputting the time parameter corresponding to the third time interval into the second prediction model to obtain second prediction data corresponding to the third time interval, or inputting the time parameter corresponding to the burst time interval and the time parameter corresponding to the third time interval into the first prediction model to obtain first prediction data corresponding to the burst time interval and second prediction data corresponding to the third time interval, or inputting the time parameter corresponding to the burst time interval and the time parameter corresponding to the third time interval into the second prediction model to obtain first prediction data corresponding to the burst time interval and second prediction data corresponding to the third time interval.

For the case that the first target time interval is the first time interval, the second target time interval is the burst time interval, the first prediction model at this time is used for predicting data corresponding to the burst time interval, and the time parameter corresponding to the burst time interval may be input into the first prediction model to obtain the first prediction data corresponding to the burst time interval.

For the case that the first target time interval is the second time interval, and the second target time interval is the third time interval, at this time, the second prediction module is configured to predict data corresponding to the third time interval, and may input the time parameter corresponding to the third time interval into the second prediction model, so as to obtain second predicted data corresponding to the third time interval.

For the case that the first target time interval is a first time interval and a second time interval, and the second target time interval is a protruding time interval and a third time interval, if the first prediction model is determined based on only the first data corresponding to the first time interval, the time parameter corresponding to the burst time interval and the time parameter corresponding to the third time interval may be respectively input to the first prediction model to obtain first prediction data corresponding to the burst time interval and second prediction data corresponding to the third time interval; if the second prediction model is determined only based on the second data corresponding to the second time period, the time parameter corresponding to the burst time period and the time parameter corresponding to the third time period may be respectively input into the second prediction model to obtain the first prediction data corresponding to the burst time period and the second prediction data corresponding to the third time period; if the first prediction model is determined based on the first data corresponding to the first time period and the second prediction model is determined based on the second data corresponding to the second time period, the time parameter corresponding to the burst time period may be input to the first prediction model to obtain the first prediction data corresponding to the burst time period, and the time parameter corresponding to the third time period may be input to the second prediction model to obtain the second prediction data corresponding to the third time period.

The target prediction model comprises a first prediction model and/or a second prediction model, and the target prediction data comprises first prediction data and/or second prediction data.

In the case where the first prediction model and the second prediction model are determined, since the first prediction model is determined by model training based on the first data corresponding to the first period, the prediction data corresponding to the burst period continuous to the first period can be predicted based on the first prediction model; accordingly, since the second prediction model makes the model training determination based on the second data corresponding to the second period, it is possible to predict the prediction data corresponding to the third period consecutive to the second period based on the second prediction model.

In the implementation process of the application, the actual data in the first target time period is used as a training sample for model training, the target prediction model is determined, the time parameter corresponding to the second target time period is used as model input and is input into the target prediction model, and the target prediction model outputs the prediction data corresponding to the second target time period, so that the prediction data in the specific time period can be obtained by adopting a model prediction mode.

It should be noted that, in this embodiment, the time length corresponding to the third time period is a preset time length, that is, the size of the time window corresponding to the third time period is a set value, the time window corresponding to the third time period is used as a time parameter corresponding to the third time period, and the time parameter is input into the prediction model, so as to implement prediction of prediction data corresponding to the time window. For example, the size of the time window may be 5 days, 10 days, 15 days, or other time lengths, and the time length corresponding to the third time period may be adjusted according to actual requirements, or may be adjusted according to the length of the burst time period.

Referring to the process of detecting whether data is abnormal based on the clustering result, when detecting whether the target object is abnormal based on the influence of the emergency in the second target time period according to the clustering result of the target prediction data and the second target data, as shown in fig. 3, the method includes the following steps:

step 301, after clustering the target prediction data and the second target data and obtaining a target clustering result, determining whether the target prediction data and the second target data are clustered into the same category based on the target clustering result.

Step 302, determining that no data abnormality occurs in the target object in the second target period when the target prediction data and the second target data are aggregated into the same category.

Step 303, determining that data abnormality occurs in the target object in the second target period when the target prediction data and the second target data are gathered into different categories.

After clustering target prediction data corresponding to a second target time interval with actual data (second target data) corresponding to the second target time interval to obtain a target clustering result, detecting whether the target object has data abnormality in the second target time interval based on the influence of the emergency based on the target clustering result, so as to detect whether the emergency has influence on the target object and cause the data abnormality of the target object in the second target time interval.

When detecting whether the target object has data abnormality in a second target period based on the influence of the emergency based on the target clustering result, specifically, determining whether target prediction data and second target data are clustered into the same category based on the target clustering result, and if the target object can be clustered into the same category, determining that the target object has no data abnormality in the second target period; and if the target objects are not gathered into the same category, determining that the target objects have data abnormality in a second target time period.

In the present embodiment, as an example, a Toeplitz Inverse Covariance-Based Clustering (TICC) mode is used, and the target prediction data and the second target data are clustered. Of course, the method is not limited to the above-mentioned TICC method, and other clustering methods may be used for clustering.

The following describes a process of performing detection based on a clustering result when the second target period is the burst period and/or the third period. When determining whether the target prediction data and the second target data are grouped into the same category based on the target clustering result, the method includes:

determining whether first prediction data corresponding to the burst period and actual data corresponding to the burst period are clustered into the same category or not based on a first clustering result obtained by clustering the first prediction data corresponding to the burst period and the actual data corresponding to the burst period when the second target period is the burst period;

determining whether second predicted data corresponding to the third time interval and actual data corresponding to the third time interval are clustered into the same category based on a second clustering result obtained by clustering the second predicted data corresponding to the third time interval and the actual data corresponding to the third time interval when the second target time interval is the third time interval;

determining whether the first prediction data and actual data corresponding to the burst period are clustered into the same category based on the first clustering result in the case that the second target period is the burst period and the third period; determining whether the second prediction data and actual data corresponding to the third period are grouped into the same category based on the second clustering result.

For the situation that the first target time interval is the first time interval and the second target time interval is the burst time interval, clustering first prediction data corresponding to the burst time interval and actual data corresponding to the burst time interval to obtain a first clustering result, determining whether the first prediction data and the actual data corresponding to the burst time interval are clustered into the same category according to the first clustering result, if the first prediction data and the actual data corresponding to the burst time interval are not clustered into the same category, determining that the target object has data abnormality in the burst time interval, and if the first prediction data and the actual data corresponding to the burst time interval are clustered into the same category, determining that the target object has no data abnormality in the burst time interval.

For the cases that the first target time interval is the second time interval and the second target time interval is the third time interval, clustering second prediction data corresponding to the third time interval and actual data corresponding to the third time interval to obtain a second clustering result, determining whether the second prediction data and the actual data corresponding to the third time interval are clustered into the same class according to the second clustering result, if the second prediction data and the actual data corresponding to the third time interval are not clustered into the same class, determining that the target object has data abnormality in the third time interval, and if the second prediction data and the actual data corresponding to the third time interval are clustered into the same class, determining that the target object has no data abnormality in the third time interval.

For the case that the first target time interval is the first time interval and the second time interval, and the second target time interval is the burst time interval and the third time interval, whether the first predicted data and the actual data corresponding to the burst time interval are aggregated into the same category or not may be determined according to the first clustering result, if not, it is determined that the target object has data abnormality in the burst time interval, otherwise, it is determined that the target object has no data abnormality in the burst time interval, correspondingly, it may be determined whether the second predicted data and the actual data corresponding to the third time interval are aggregated into the same category or not according to the second clustering result, if not, it is determined that the target object has data abnormality in the third time interval, otherwise, it is determined that the target object has no data abnormality in the third time interval.

The target prediction data comprises first prediction data and/or second prediction data, and the target clustering result comprises a first clustering result and/or a second clustering result.

In the implementation process of the application, the predicted data and the actual data are clustered, whether the predicted data and the actual data belong to the same category or not is detected according to the clustering result, and whether the target object has data abnormality in a specific time period or not can be judged in a data clustering mode.

In an embodiment of the present application, in a case that it is determined that a data abnormality occurs in the target object in the burst period based on an influence of the burst event, it is detected whether the data abnormality occurs in the third period based on an influence of the burst event based on a clustering result obtained by clustering second predicted data corresponding to the third period and actual data corresponding to the third period.

Before detecting whether the target object has a data abnormality in the third period based on the influence of the emergency, it is necessary to determine that the target object has a data abnormality in the emergency period based on the influence of the emergency. That is, first prediction data corresponding to the burst period may be predicted based on first data corresponding to the first period, the first prediction data may be clustered with actual data corresponding to the burst period, and in a case where it is determined that the target object has a data abnormality based on an influence of the burst event in the burst period based on a clustering result, whether the target object has a data abnormality based on an influence of the burst event in the third period may be detected based on a clustering result of second prediction data corresponding to the third period and actual data corresponding to the third period. And if the target object is determined not to have data abnormality in the burst time period based on the influence of the emergency, ending the flow. That is, the occurrence of the data abnormality of the target object in the burst period is a precondition for detecting whether the data abnormality of the target object occurs in the third period.

In the case that it is determined that the target object has data abnormality in the emergency period, continuing to detect whether the target object has data abnormality in the third period, it may be determined whether the influence of the emergency event is ended immediately after the emergency event occurs or continues for a while.

In an embodiment of the present application, the method further includes:

and when the target object has data abnormality in the second target time period based on the influence of the emergency, outputting prompt information indicating that the second target time period is an abnormal time period.

When it is determined that the target object has data abnormality in the second target time period based on the influence of the emergency, prompt information may be output to indicate the second target time period as the abnormal time period, so as to implement outputting the abnormal time period, so that a user can know the influence of the emergency on the target object based on the output abnormal time period, and further, the user can better cope with the emergency risk, so as to reduce the loss.

Wherein, when outputting the prompt information indicating that the second target time interval is an abnormal time interval, the method comprises:

under the condition that the target object has data abnormity in the burst period, outputting first prompt information indicating that the burst period is an abnormal period;

when the target object has data abnormality in the third time period, outputting second prompt information indicating that the third time period is an abnormal time period;

when the target object has data abnormality in the burst period and the third period, outputting first prompt information indicating that the burst period is an abnormal period and second prompt information indicating that the third period is an abnormal period.

When the target object has data abnormality only in the burst period, outputting first prompt information, wherein the first prompt information may include the burst period and is used for indicating that the burst period is the abnormal period; outputting second prompt information when the target object has data abnormality only in the third time period, wherein the second prompt information can comprise the third time period and is used for indicating that the third time period is an abnormal time period; and under the condition that the target object has data abnormality in the burst period and the third period, outputting first prompt information and second prompt information for indicating that the burst period and the third period are abnormal periods.

By generating and outputting the prompt information based on the first detection result of whether the target object has data abnormality in the burst period and the second detection result of whether the target object has data abnormality in the third period, the abnormal period can be output, so that a user can know the influence of the burst event on the target object based on the output abnormal period, and the user can better deal with the burst risk and reduce the loss.

It should be noted that in this embodiment, the starting time of the first time period is the same as the starting time of the second time period, and both are preset initial time points; if the starting time of the first time interval is not the preset initial time point, and the time for acquiring the data is not aligned, the first predicted data corresponding to the burst time interval, which is predicted based on the first data corresponding to the first time interval, has no comparability with the actual data corresponding to the burst time interval. Specifically, the actual data corresponding to the burst period is temporally continuous with the actual data corresponding to the period before the burst period, the starting time corresponding to the data is a preset initial time point, and when the first predicted data corresponding to the burst period is predicted, the data before the burst period needs to be acquired, so that the starting time corresponding to the first data needs to be guaranteed to be the preset initial time point. Accordingly, if the starting time of the second data is different from the preset initial time point, the second prediction data is not comparable to the actual data corresponding to the third time period, and therefore it is required to ensure that the starting time of the second data is the same as the preset initial time point.

The method for detecting an abnormality provided by the present application is described below by using a specific example, and as shown in fig. 4, the method includes the following steps:

step 401, obtaining first data corresponding to the target object in a first time period, performing model training according to the first data and a target influence factor corresponding to the target object, and determining a first prediction model.

Step 402, inputting the time parameter corresponding to the burst period into the first prediction model, and obtaining first prediction data corresponding to the burst period output by the first prediction model.

And step 403, clustering the first prediction data and the actual data corresponding to the burst interval to obtain a first clustering result.

And step 404, detecting whether the target object has data abnormity in the burst time period based on the influence of the emergency event based on the first clustering result. If yes, go to step 405, otherwise, end the process.

Step 405, performing model training according to second data corresponding to the target object in a second time period and the target influence factor corresponding to the target object, and determining a second prediction model.

And step 406, inputting the time parameter corresponding to the third time interval into the second prediction model, and acquiring second prediction data corresponding to the third time interval output by the second prediction model.

And 407, clustering the second prediction data and the actual data corresponding to the third time interval to obtain a second clustering result.

And step 408, detecting whether the target object has data exception in the third time interval based on the influence of the emergency based on the second clustering result. If yes, go to step 409, otherwise go to step 410.

And step 409, outputting first prompt information indicating that the burst time interval is an abnormal time interval and second prompt information indicating that the third time interval is an abnormal time interval.

And step 410, outputting first prompt information indicating that the burst time interval is an abnormal time interval.

According to the implementation process, data prediction and data clustering are combined to perform anomaly detection, a detection mode for detecting whether a target object is influenced by an emergency or not is provided, help can be provided for decision making in the time series prediction fields such as finance and energy, emergency risks can be better dealt with, and loss is reduced.

The above is an overall implementation flow of the anomaly detection method provided in the embodiment of the present application, and target prediction data of a target object in a second target time period is predicted according to first target data of the target object in a first target time period, the target prediction data obtained through prediction and actual data corresponding to the second target time period are clustered, and whether data anomaly occurs in the second target time period based on the influence of an emergency is detected according to a clustering result.

Further, by generating and outputting the prompt information, the abnormal time period can be output, so that a user can know the influence of the emergency on the target object based on the output abnormal time period, and the user can better deal with the emergency risk to reduce the loss.

Clustering the predicted data and the actual data, and determining that the target object has data abnormality in the burst period and/or the third period when the predicted data and the actual data do not belong to the same category, so as to detect whether the target object has data abnormality based on the comparison result of the predicted data and the actual data; by determining training samples to perform model training to determine a prediction model and acquiring prediction data based on the determined prediction model, the data of a target object in a specific time period can be predicted based on the model.

An embodiment of the present application further provides an anomaly detection apparatus, as shown in fig. 5, including:

a predicting module 501, configured to predict, according to first target data of a target object in a first target time period, target prediction data of the target object in a second target time period, where a data value of the target object dynamically changes based on a time change, and the second target time period is subsequent to and continuous with the first target time period;

a detecting module 502, configured to detect, according to a clustering result of the target prediction data and second target data, whether a data anomaly occurs in the target object in the second target time period based on an influence of an emergency, where the second target data is actual data corresponding to the target object in the second target time period;

Optionally, the prediction module comprises:

the first obtaining sub-module is used for obtaining corresponding first target data based on the first target time period in historical data corresponding to the target object;

the first determining submodule is used for carrying out model training according to the first target data and the target influence factor corresponding to the target object to determine a target prediction model;

and the second obtaining submodule is used for inputting the time parameter corresponding to the second target time interval into the target prediction model and obtaining target prediction data which is output by the target prediction model and corresponds to the second target time interval.

Optionally, the detection module includes:

a second determining sub-module, configured to determine whether the target prediction data and the second target data are aggregated into the same category based on a target clustering result after the target prediction data and the second target data are clustered to obtain the target clustering result;

a third determining sub-module, configured to determine that no data anomaly has occurred in the target object in the second target period when the target prediction data and the second target data are aggregated into the same category;

a fourth determining sub-module, configured to determine that a data anomaly occurs in the target object in the second target period when the target prediction data and the second target data are aggregated into different categories.

Optionally, the first determining sub-module includes:

a first determining unit, configured to perform model training according to first data corresponding to the first time period and the target impact factor when the first target time period is the first time period, and determine a first prediction model;

a second determining unit, configured to perform model training according to second data corresponding to the second time interval and the target impact factor when the first target time interval is the second time interval, and determine a second prediction model;

a third determining unit, configured to, when the first target time interval is the first time interval and the second time interval, perform model training according to first data corresponding to the first time interval and the target impact factor, and determine a first prediction model; and/or performing model training and determining a second prediction model according to second data corresponding to the second time interval and the target influence factor.

Optionally, the second obtaining sub-module includes:

a first obtaining unit, configured to, when the second target time interval is the burst time interval, input a time parameter corresponding to the burst time interval into the first prediction model, and obtain first prediction data corresponding to the burst time interval;

a second obtaining unit, configured to, when the second target time interval is the third time interval, input a time parameter corresponding to the third time interval into the second prediction model, and obtain second prediction data corresponding to the third time interval;

a third obtaining unit, configured to, if the second target time interval is the burst time interval and the third time interval, input a time parameter corresponding to the burst time interval into the first prediction model to obtain first prediction data corresponding to the burst time interval, input a time parameter corresponding to the third time interval into the second prediction model to obtain second prediction data corresponding to the third time interval, or input a time parameter corresponding to the burst time interval and a time parameter corresponding to the third time interval into the first prediction model to obtain first prediction data corresponding to the burst time interval and second prediction data corresponding to the third time interval, or input a time parameter corresponding to the burst time interval and a time parameter corresponding to the third time interval into the second prediction model to obtain first prediction data corresponding to the burst time interval and second prediction data corresponding to the third time interval.

Optionally, the second determining sub-module includes:

a first processing unit, configured to, when the second target time interval is the burst time interval, determine whether first prediction data corresponding to the burst time interval and actual data corresponding to the burst time interval are grouped into the same category based on a first clustering result obtained by clustering the first prediction data corresponding to the burst time interval and the actual data corresponding to the burst time interval;

a second processing unit, configured to, when the second target time interval is the third time interval, determine whether or not the second prediction data and the actual data corresponding to the third time interval are grouped into the same category based on a second clustering result obtained by clustering the second prediction data corresponding to the third time interval and the actual data corresponding to the third time interval;

a third processing unit, configured to determine, based on the first clustering result, whether the first prediction data and actual data corresponding to the burst period are clustered into the same class when the second target period is the burst period and the third period; determining whether the second prediction data and actual data corresponding to the third period are grouped into the same category based on the second clustering result.

Optionally, in a case that it is determined that the target object has data abnormality in the burst period based on the influence of the emergency, detecting whether the target object has data abnormality in the third period based on the influence of the emergency based on a clustering result obtained by clustering second predicted data corresponding to the third period and actual data corresponding to the third period.

For the device embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, refer to the partial description of the method embodiment.

An embodiment of the present application further provides an electronic device, including: the processor, the memory, and the computer program stored in the memory and capable of running on the processor, where the computer program is executed by the processor to implement the processes of the above-mentioned embodiment of the anomaly detection method, and can achieve the same technical effects, and are not described herein again to avoid repetition.

For example, fig. 6 shows a schematic physical structure diagram of an electronic device. As shown in fig. 6, the electronic device may include: a processor (processor) 610, a communication Interface (Communications Interface) 620, a memory (memory) 630 and a communication bus 640, wherein the processor 610, the communication Interface 620 and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call logic instructions in the memory 630, and the processor 610 is configured to perform the following steps: predicting target prediction data of a target object in a second target time interval according to first target data of the target object in a first target time interval, wherein a data value of the target object dynamically changes based on time change, and the second target time interval is positioned after the first target time interval and is continuous with the first target time interval; detecting whether the target object has data abnormality in the second target time period based on the influence of an emergency according to the clustering result of the target prediction data and second target data, wherein the second target data is actual data corresponding to the target object in the second target time period; wherein the first target period and the second target period are the following: the first target time interval is a first time interval, the second target time interval is a burst time interval corresponding to the burst event, and/or the first target time interval is a second time interval, and the second target time interval is a third time interval which is located after the burst time interval and is continuous with the burst time interval; the first period is a period that is located before and continuous with the burst period, and the second period is a period that includes the first period and the burst period. The processor 610 may also perform other aspects of the embodiments of the present application and will not be further described herein.

In addition, the logic instructions in the memory 630 may be implemented in software functional units and stored in a computer readable storage medium when the logic instructions are sold or used as independent products. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application.

The embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when being executed by a processor, the computer program implements each process of the above-mentioned abnormality detection method embodiment, and can achieve the same technical effect, and in order to avoid repetition, details are not repeated here. The computer-readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or apparatus that comprises the element.

Through the description of the foregoing embodiments, it is clear to those skilled in the art that the method of the foregoing embodiments may be implemented by software plus a necessary general hardware platform, and certainly may also be implemented by hardware, but in many cases, the former is a better implementation. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal (such as a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present application.

While the present embodiments have been described with reference to the accompanying drawings, the present embodiments are not limited to the above-described embodiments, which are merely illustrative and not restrictive, and it will be apparent to those of ordinary skill in the art that many more modifications and variations can be made without departing from the spirit and scope of the invention as defined in the appended claims.

Those of ordinary skill in the art would appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed in the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one type of logical functional division, and other divisions may be realized in practice, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. An abnormality detection method characterized by comprising:

predicting target prediction data of a target object in a second target time interval according to first target data of the target object in a first target time interval, wherein a data value of the target object dynamically changes based on time change, and the second target time interval is positioned after the first target time interval and is continuous with the first target time interval;

detecting whether the target object has data abnormality in the second target time period based on the influence of an emergency according to the clustering result of the target prediction data and second target data, wherein the second target data is actual data corresponding to the target object in the second target time period;

2. The method of claim 1, wherein predicting target prediction data of the target object at a second target time period according to first target data of the target object at the first target time period comprises:

acquiring corresponding first target data based on the first target time period in historical data corresponding to the target object;

performing model training according to the first target data and the target influence factor corresponding to the target object, and determining a target prediction model;

and inputting the time parameter corresponding to the second target time interval into the target prediction model, and acquiring target prediction data corresponding to the second target time interval output by the target prediction model.

3. The method of claim 1, wherein the detecting whether the target object has data anomaly in the second target period based on the influence of the emergency according to the clustering result of the target prediction data and the second target data comprises:

clustering the target prediction data and the second target data to obtain a target clustering result, and then determining whether the target prediction data and the second target data are clustered into the same category based on the target clustering result;

determining that no data anomaly has occurred in the target object for the second target period if the target prediction data and the second target data are aggregated into the same category;

determining that a data abnormality occurs in the target object in the second target period in a case where the target prediction data and the second target data are aggregated into different categories.

4. The method of claim 2, wherein the performing model training to determine a target prediction model according to the first target data and a target impact factor corresponding to the target object comprises:

5. The method according to claim 4, wherein the inputting the time parameter corresponding to the second target time interval into the target prediction model and obtaining the target prediction data corresponding to the second target time interval output by the target prediction model comprises:

6. The method of claim 3, wherein the determining whether the target prediction data and the second target data are grouped into the same category based on the target clustering result comprises:

when the second target time interval is the third time interval, determining whether second prediction data corresponding to the third time interval and actual data corresponding to the third time interval are clustered into the same category based on a second clustering result of clustering the second prediction data corresponding to the third time interval and the actual data corresponding to the third time interval;

determining whether the first prediction data and actual data corresponding to the burst period are clustered into the same category based on the first clustering result in the case that the second target period is the burst period and the third period; and determining whether the second prediction data and the actual data corresponding to the third time interval are aggregated into the same category or not based on the second clustering result.

7. The method according to any one of claims 1 to 6, wherein in a case where it is determined that the target object has data abnormality during the burst period based on the influence of the burst event, it is detected whether the target object has data abnormality during the third period based on a clustering result obtained by clustering second predicted data corresponding to the third period and actual data corresponding to the third period.

8. An abnormality detection device characterized by comprising:

the detection module is used for detecting whether the target object has data abnormality in the second target time period based on the influence of an emergency according to the clustering result of the target prediction data and the second target data, wherein the second target data is actual data corresponding to the target object in the second target time period;

9. An electronic device comprising a processor, a memory and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implementing the steps of the anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the anomaly detection method according to any one of claims 1 to 7.