CN115658774A - Time sequence data threshold value abnormity detection method, device and related equipment - Google Patents
Time sequence data threshold value abnormity detection method, device and related equipment Download PDFInfo
- Publication number
- CN115658774A CN115658774A CN202211413195.3A CN202211413195A CN115658774A CN 115658774 A CN115658774 A CN 115658774A CN 202211413195 A CN202211413195 A CN 202211413195A CN 115658774 A CN115658774 A CN 115658774A
- Authority
- CN
- China
- Prior art keywords
- data
- threshold
- difference
- time
- threshold value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims description 20
- 238000000034 method Methods 0.000 claims abstract description 40
- 238000012545 processing Methods 0.000 claims abstract description 21
- 230000002159 abnormal effect Effects 0.000 claims abstract description 19
- 238000004364 calculation method Methods 0.000 claims abstract description 11
- 230000008569 process Effects 0.000 claims description 19
- 230000005856 abnormality Effects 0.000 claims description 12
- 238000010606 normalization Methods 0.000 claims description 11
- 238000012216 screening Methods 0.000 claims description 8
- 238000004590 computer program Methods 0.000 claims description 2
- 238000004891 communication Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The application discloses a method, a device and related equipment for detecting time sequence data threshold abnormity, wherein the method comprises the following steps: comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data, wherein the target threshold value difference comprises two numerical values; comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data; and determining the time period with abnormal threshold value based on the adjacent threshold value difference of each data in the time sequence data. According to the method and the device, all the calculations can be executed by using the basic interface of the database in the cloud database, and all data with abnormal threshold values do not need to be downloaded locally, so that the processing efficiency is improved.
Description
Technical Field
The present application relates to the field of data anomaly detection technologies, and in particular, to a method and an apparatus for detecting a time series data threshold anomaly, and a related device.
Background
In a scenario of performing threshold detection on data, when it is necessary to find out which time periods of the data exceed the threshold, a common practice is to search for all data records exceeding the threshold in a database, download each data record to the local, and obtain each time interval in which the data are located after further processing. When the number of data records exceeding the threshold is large, the downloading process consumes much time and the processing efficiency is low.
Disclosure of Invention
In view of this, the present application provides a method, an apparatus, and a related device for detecting a threshold anomaly of time series data, so as to obtain a time period in which the threshold anomaly exists and improve processing efficiency.
In order to achieve the above object, a first aspect of the present application provides a method for detecting a threshold anomaly of time series data, including:
comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data, wherein the target threshold value difference comprises two numerical values;
comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data;
and determining a time period with abnormal threshold value based on the adjacent threshold value difference of each data in the time sequence data.
Preferably, the preset threshold comprises a maximum threshold; the process of comparing each data in the time sequence data to be detected with a preset threshold value to obtain the target threshold value difference of each data comprises the following steps:
subtracting a preset threshold value from each data in the time sequence data to be detected to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
Preferably, the preset threshold comprises a minimum threshold; the process of comparing each data in the time sequence data to be detected with a preset threshold value to obtain the target threshold value difference of each data comprises the following steps:
subtracting each data in the time sequence data to be detected from a preset threshold value to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
Preferably, the step of comparing the target threshold difference of each data in the time series data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data includes:
subtracting the target threshold difference of the previous data of the data from the target threshold difference of each data in the time sequence data to obtain the adjacent threshold difference of each data;
wherein, it is assumed that data of data preceding the first data in the time series data is data smaller than the maximum threshold.
Preferably, the process of determining the time period in which the threshold anomaly exists based on the adjacent threshold difference of each data in the time series data comprises:
screening initial data with adjacent threshold differences equal to a first difference from the time sequence data, and screening termination data with state differences equal to a second difference from the time sequence data, wherein the first difference is the maximum value of each adjacent threshold difference, and the second difference is the minimum value of each adjacent threshold difference;
based on the time point of each start data and the time point of each end data, a time period in which a threshold abnormality exists is determined.
Preferably, the process of determining the time period in which the threshold abnormality exists based on the time point of each start data and the time point of each end data includes:
for each start datum:
determining the time point of the initial data as an initial point, and judging whether termination data with the time point behind the initial point exists or not;
if so, taking the time of the termination data with the time after the starting point and the closest distance to the starting point as a termination point;
if not, determining the time point of the last item of data of the time sequence data as a termination point;
determining a time period between the start point and the end point as a time period in which a threshold anomaly exists.
Preferably, the step of normalizing the candidate threshold difference of each data to obtain the target threshold difference of each data includes:
the target threshold difference is calculated using the following equation:
y i ＝x i /|x i |
wherein, y i A target threshold difference, x, for the ith data in the time series data i And the candidate threshold value is the candidate threshold value of the ith item in the time series data.
A second aspect of the present application provides a time series data threshold value abnormality detection apparatus, including:
the threshold difference calculation unit is used for comparing each data in the time sequence data to be detected with a preset threshold to obtain a target threshold difference of each data, and the target threshold difference comprises two numerical values;
an adjacent value difference unit, configured to compare a target threshold difference of each piece of data in the time series data with a target threshold difference of a previous piece of data of the piece of data, to obtain an adjacent threshold difference of each piece of data;
and the time period determining unit is used for determining the time period with abnormal threshold values based on the adjacent threshold value difference of each data in the time sequence data.
A third aspect of the present application provides a time series data threshold value abnormality detection apparatus, including: a memory and a processor;
the memory is used for storing programs;
the processor is configured to execute the program, and implement each step of the above-mentioned time series data threshold value abnormality detection method.
A fourth aspect of the present application provides a storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the time series data threshold anomaly detection method as described above.
According to the technical scheme, each piece of data in the time sequence data to be detected is compared with a preset threshold value to obtain the target threshold value difference of the data. Wherein the target threshold difference comprises two values reflecting whether the data has a threshold anomaly. Then, the target threshold difference of each data in the time series data is compared with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of the data. The adjacent threshold difference reflects the jump condition of the target threshold difference of each data in the time sequence data. And finally, determining a time period with abnormal threshold values based on the adjacent threshold value difference of each data in the time sequence data. All the calculations can be executed on the cloud database by using the basic interface of the database, and all the data with abnormal threshold values do not need to be downloaded locally, so that the processing efficiency is improved.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the embodiments or the prior art descriptions will be briefly described below, it is obvious that the drawings in the following description are only the embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
FIG. 1 is a schematic diagram of a method for detecting threshold anomalies in time series data according to an embodiment of the present disclosure;
FIG. 2 illustrates timing data disclosed by an embodiment of the present application;
FIG. 3 illustrates another timing data disclosed in an embodiment of the present application;
FIG. 4 is a schematic diagram of an apparatus for detecting threshold anomalies in time series data according to an embodiment of the present disclosure;
fig. 5 is a schematic diagram of a time series data threshold anomaly detection device disclosed in the embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The method for detecting the threshold abnormality of the time series data provided by the embodiment of the application is described below. Referring to fig. 1, a method for detecting a threshold anomaly of time series data according to an embodiment of the present application may include the following steps:
step S101, comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data.
Wherein the target threshold difference comprises two values. Illustratively, the target threshold difference may include a with a larger value and B with a smaller value, and if a certain item of data in the time series data exceeds the preset threshold, the target threshold difference of the item of data is a; and if a certain item of data in the time sequence data does not exceed the preset threshold value, obtaining that the target threshold value difference of the item of data is B.
For example, referring to fig. 2, assuming that the time series data to be detected includes 10 data from time point 0 to time point 9, which are x (0) to x (9), respectively, and the preset threshold is the maximum threshold T, for the ith data x (i), x (i) is compared with T, so as to obtain the target threshold difference of the data x (i). For example, the target threshold differences of data x (1), x (2), x (3), x (4), x (7), and x (8) that exceed the threshold line are regarded as a, and the target threshold differences of data x (0), x (5), x (6), and x (9) that do not exceed the threshold line are regarded as B.
Step S102, comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data.
The adjacent threshold difference represents a jump condition of the target threshold difference of the adjacent data. Illustratively, in the time series data shown in fig. 2, the adjacent threshold difference of the data x (i) is obtained by comparing the target threshold difference of the data x (i) with the target threshold difference of the data x (i-1). Specifically, the adjacent threshold difference of the data x (1) is obtained by comparing a target threshold difference a of the data x (1) with a target threshold difference B of the data x (0), and the adjacent threshold difference of the data x (1) includes a forward jump because the values of a and B are not equal and a is greater than B; the adjacent threshold difference of the data x (2) is obtained by comparing the target threshold difference A of the data x (2) with the target threshold difference A of the data x (1), and the adjacent threshold difference of the data x (2) does not contain any jump because the target threshold difference of the data x (2) and the data x (1) is also A; the adjacent threshold difference of the data x (5) is obtained by comparing a target threshold difference B of the data x (5) with a target threshold difference A of the data x (4), and the adjacent threshold difference of the data x (5) comprises a negative jump because the values of A and B are not equal and A is greater than B; and so on. Since there is no other data in front of the first item of data x (0), it can be assumed that the data in front of the data x (0) is data that does not exceed the preset threshold, that is, the target threshold difference of the data in front of x (0) is B.
Step S103, based on the adjacent threshold difference of each data in the time series data, determining the time period with abnormal threshold.
For example, a time period between a start point and an end point may be determined as a time period in which a threshold abnormality exists, with a time point of an adjacent threshold difference including a positive-going jump as a start point, and a time point of an adjacent threshold difference including a negative-going jump as an end point.
According to the technical scheme, each piece of data in the time sequence data to be detected is compared with a preset threshold value to obtain the target threshold value difference of the data. Wherein the target threshold difference comprises two values reflecting whether the data has a threshold anomaly. Then, the target threshold difference of each data in the time series data is compared with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of the data. The adjacent threshold difference reflects a jump condition of a target threshold difference of each data in the time series data. And finally, determining a time period with abnormal threshold values based on the adjacent threshold value difference of each data in the time sequence data. All the calculations can be executed on the cloud database by using the basic interface of the database, and all the data with abnormal threshold values do not need to be downloaded locally, so that the processing efficiency is improved.
In some embodiments of the present application, the preset threshold mentioned in step S101 includes a maximum threshold, and when the data in the time series data is greater than the maximum threshold, the threshold is considered to be abnormal. Fig. 2 and 3 illustrate the case where the preset threshold is the maximum threshold. Step S101 is a process of comparing each data in the time series data to be detected with a preset threshold to obtain a target threshold difference of each data, and may include:
s1, subtracting a preset threshold value from each data in the time sequence data to be detected to obtain a candidate threshold value difference of each data.
And S2, carrying out normalization processing on the candidate threshold difference of each data to obtain the target threshold difference of each data.
In some embodiments of the present application, the preset threshold mentioned in step S101 includes a minimum threshold, and when the data in the time series data is less than the minimum threshold, the threshold is considered to be abnormal. Step S101 is a process of comparing each data in the time series data to be detected with a preset threshold to obtain a target threshold difference of each data, and may include:
s1, subtracting each data in the time sequence data to be detected from a preset threshold value to obtain a candidate threshold value difference of each data.
And S2, carrying out normalization processing on the candidate threshold difference of each data to obtain the target threshold difference of each data.
In some embodiments of the application, the step of performing normalization processing on the candidate threshold difference of each data in S2 to obtain the target threshold difference of each data may include:
the target threshold difference is calculated using the following equation:
y i ＝x i /|x i |
wherein x is i Target threshold difference, x, for the ith data in the time series data i Is a candidate threshold value of the ith data in the time series data.
Through the normalization process, the target threshold difference in the time series data is converted into 1 or-1, and then, the adjacent threshold difference only comprises 2 or-1, so that the subsequent calculation is facilitated.
In some embodiments of the present application, the step S102 of comparing the target threshold difference of each data in the time series data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data may include:
and subtracting the target threshold difference of the previous data of the data from the target threshold difference of each data in the time sequence data to obtain the adjacent threshold difference of each data.
Wherein, it is assumed that data of data preceding the first item of data in the time series data is data smaller than the maximum threshold.
In the time series data shown in FIG. 2, the neighbor threshold difference for data x (i) is equal to the target threshold difference for data x (i) minus the target threshold difference for data x (i-1).
In some embodiments of the present application, the step S103 of determining a time period in which the threshold anomaly exists based on the adjacent threshold difference of each data in the time series data may include:
s1, screening starting data with adjacent threshold difference equal to a first difference from the time sequence data, and screening ending data with state difference equal to a second difference from the time sequence data.
Wherein, the first difference is the maximum value of each adjacent threshold difference, namely contains the forward jump; the second difference is the minimum of the adjacent threshold differences, i.e. contains a negative transition.
And S2, determining a time period with threshold abnormity based on the time point of each initial data and the time point of each termination data.
In the time-series data shown in fig. 2, data x (1) and x (7) are start data, and data x (5) and x (9) are end data. Based on the two start data and the two end data, it is possible to find a period of time from time point 1 to time point 5, and from time point 7 to time point 9 in which the threshold abnormality exists.
In some embodiments of the application, the step S2 of determining, based on the time point of each start data and the time point of each end data, a time period in which the threshold anomaly exists may include:
for each start datum:
s21, determining the time point of the initial data as an initial point, and judging whether termination data with the time point behind the initial point exists or not; if yes, executing S22; if not, executing S23.
And S22, taking the time of the termination data with the time after the starting point and the closest distance to the starting point as a termination point. S24 is performed.
And S23, determining the time point of the last item of data of the time sequence data as a termination point.
And S24, determining the time period between the starting point and the ending point as the time period with the abnormal threshold value.
Illustratively, in the time-series data shown in fig. 3, the start data includes data x (1) and x (7), and the end data includes only data x (5), that is, there is no end data after the start data x (7), then the second time period in which the threshold abnormality exists is determined as the time period between the time point of the start data x (7) and the time point of the last data x (9).
In order to show that the processing procedure described above in the embodiment of the present application can be completed in the cloud database by using the basic interface of the database, a corresponding operation example is given below. ClickHouse (Data Ware House) is a column-wise storage Database (DBMS: database Management System) for the MPP architecture of Online Analytical Processing queries (OLAP), which can generate Analytical Data reports in real time using SQL queries. Taking clickhouse as an example, the statement for calculating the difference is:
select event_value-threshold from table；
the statement of normalization processing is:
select(event_value-threshold)/abs(event_value-threhold),timestamp from table；
the statement that calculates the difference of adjacent values is:
select diff,timestamp,runningDifference(diff)from(select(event_value-threshold)/abs(event_value-threhold)diff,timestamp from table order by timestamp)t
the statements that return the data change point (data with a positive or negative jump) are:
select timestamp,delta from(select diff,timestamp,runningDifference(diff)delta from(select(event_value-threshold)/abs(event_value-threhold)diff,timestamp from table order by timestamp)t)where delta in(2,-2)
therefore, all the calculations can be executed on the cloud database by using the basic interface of the database, and all the data with abnormal threshold values do not need to be downloaded locally, so that the processing efficiency is improved.
The following describes the time series data threshold anomaly detection device provided in the embodiment of the present application, and the time series data threshold anomaly detection device described below and the time series data threshold anomaly detection method described above may be referred to in correspondence with each other.
Referring to fig. 4, the apparatus for detecting threshold abnormality of time series data according to the embodiment of the present application may include:
the threshold difference calculation unit 21 is configured to compare each piece of data in the to-be-detected time series data with a preset threshold to obtain a target threshold difference of each piece of data, where the target threshold difference includes two values;
an adjacent value difference unit 22, configured to compare the target threshold difference of each data in the time series data with the target threshold difference of the previous data of the data, so as to obtain an adjacent threshold difference of each data;
a time period determining unit 23, configured to determine a time period in which a threshold anomaly exists based on the adjacent threshold difference of each data in the time series data.
In some embodiments of the present application, the preset threshold comprises a maximum threshold; the process of comparing each data in the time series data to be detected with a preset threshold by the threshold difference calculation unit 21 to obtain the target threshold difference of each data may include:
subtracting a preset threshold value from each data in the time sequence data to be detected to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
In some embodiments of the present application, the preset threshold comprises a minimum threshold; the process of comparing each data in the time series data to be detected with a preset threshold by the threshold difference calculation unit 21 to obtain the target threshold difference of each data may include:
subtracting each data in the time sequence data to be detected from a preset threshold value to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
In some embodiments of the present application, the process of normalizing the candidate threshold difference of each data by the threshold difference calculating unit 21 to obtain the target threshold difference of each data may include:
the target threshold difference is calculated using the following equation:
y i ＝x i /|x i |
wherein, y i A target threshold difference, x, for the ith data in the time series data i And the candidate threshold value is the candidate threshold value of the ith item in the time series data.
In some embodiments of the present application, the process of comparing the target threshold difference of each data in the time series data with the target threshold difference of the previous data of the data by the adjacent value difference unit 22 to obtain the adjacent threshold difference of each data may include:
subtracting the target threshold difference of the previous data of the data from the target threshold difference of each data in the time sequence data to obtain the adjacent threshold difference of each data;
wherein, it is assumed that data of data preceding the first data in the time series data is data smaller than the maximum threshold.
In some embodiments of the present application, the process of determining, by the time period determining unit 23, a time period in which the threshold anomaly exists based on the adjacent threshold difference of each data in the time series data may include:
screening initial data with adjacent threshold differences equal to a first difference from the time sequence data, and screening termination data with state differences equal to a second difference from the time sequence data, wherein the first difference is the maximum value of each adjacent threshold difference, and the second difference is the minimum value of each adjacent threshold difference;
based on the time point of each start data and the time point of each end data, a time period in which a threshold abnormality exists is determined.
In some embodiments of the present application, the process of determining, by the time period determining unit 23, the time period in which the threshold anomaly exists based on the time point of each start data and the time point of each end data may include:
for each start datum:
determining the time point of the initial data as an initial point, and judging whether termination data with the time point behind the initial point exists or not;
if so, taking the time of the termination data with the time after the starting point and the closest distance to the starting point as a termination point;
if not, determining the time point of the last item of data of the time sequence data as a termination point;
determining a time period between the start point and the end point as a time period in which a threshold anomaly exists.
The time sequence data threshold value abnormity detection device provided by the embodiment of the application can be applied to time sequence data threshold value abnormity detection equipment, such as a computer and the like. Optionally, fig. 5 is a block diagram illustrating a hardware structure of the time-series data threshold anomaly detection device, and referring to fig. 5, the hardware structure of the time-series data threshold anomaly detection device may include: at least one processor 31, at least one communication interface 32, at least one memory 33 and at least one communication bus 34.
In the embodiment of the present application, the number of the processor 31, the communication interface 32, the memory 33 and the communication bus 34 is at least one, and the processor 31, the communication interface 32 and the memory 33 complete the communication with each other through the communication bus 34;
the processor 31 may be a central processing unit CPU, or an Application Specific Integrated Circuit ASIC (Application Specific Integrated Circuit), or one or more Integrated circuits configured to implement the embodiments of the present Application, etc.;
the memory 33 may include a high-speed RAM memory, and may further include a non-volatile memory (non-volatile memory) or the like, such as at least one disk memory;
wherein the memory 33 stores a program and the processor 31 may invoke the program stored in the memory 33, the program being for:
comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data, wherein the target threshold value difference comprises two numerical values;
comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data;
and determining a time period with abnormal threshold value based on the adjacent threshold value difference of each data in the time sequence data.
Alternatively, the detailed function and the extended function of the program may be as described above.
Embodiments of the present application further provide a storage medium, where a program suitable for execution by a processor may be stored, where the program is configured to:
comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data, wherein the target threshold value difference comprises two numerical values;
comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data;
and determining the time period with abnormal threshold value based on the adjacent threshold value difference of each data in the time sequence data.
Alternatively, the detailed function and the extended function of the program may be as described above.
In summary, the following steps:
according to the method, each piece of data in the time sequence data to be detected is compared with a preset threshold value to obtain a target threshold value difference of the data. Wherein the target threshold difference comprises two values reflecting whether the data has a threshold anomaly. Then, the target threshold difference of each data in the time series data is compared with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of the data. The adjacent threshold difference reflects the jump condition of the target threshold difference of each data in the time sequence data. And finally, determining a time period with abnormal threshold values based on the adjacent threshold value difference of each data in the time sequence data. All the calculations can be executed on the cloud database by using the basic interface of the database, and all the data with abnormal threshold values do not need to be downloaded locally, so that the processing efficiency is improved.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or apparatus that comprises the element.
The embodiments in the present description are described in a progressive manner, each embodiment focuses on differences from other embodiments, the embodiments may be combined as needed, and the same and similar parts may be referred to each other.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (10)
1. A method for detecting time series data threshold abnormity is characterized by comprising the following steps:
comparing each data in the time sequence data to be detected with a preset threshold value to obtain a target threshold value difference of each data, wherein the target threshold value difference comprises two numerical values;
comparing the target threshold difference of each data in the time sequence data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data;
and determining the time period with abnormal threshold value based on the adjacent threshold value difference of each data in the time sequence data.
2. The method of claim 1, wherein the preset threshold comprises a maximum threshold; the process of comparing each data in the time series data to be detected with a preset threshold value to obtain the target threshold value difference of each data comprises the following steps:
subtracting a preset threshold value from each data in the time sequence data to be detected to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
3. The method of claim 1, wherein the preset threshold comprises a minimum threshold; the process of comparing each data in the time sequence data to be detected with a preset threshold value to obtain the target threshold value difference of each data comprises the following steps:
subtracting each data in the time sequence data to be detected from a preset threshold value to obtain a candidate threshold value difference of each data;
and carrying out normalization processing on the candidate threshold difference of each data to obtain a target threshold difference of each data.
4. The method according to claim 2 or 3, wherein the step of comparing the target threshold difference of each data in the time series data with the target threshold difference of the previous data of the data to obtain the adjacent threshold difference of each data comprises:
subtracting the target threshold difference of the previous data of the data from the target threshold difference of each data in the time sequence data to obtain the adjacent threshold difference of each data;
wherein, it is assumed that data of data preceding the first data in the time series data is data smaller than the maximum threshold.
5. The method of claim 2 or 3, wherein the step of determining the time period in which the threshold anomaly exists based on the adjacent threshold difference of each data in the time series data comprises:
screening initial data with adjacent threshold differences equal to a first difference from the time sequence data, and screening termination data with state differences equal to a second difference from the time sequence data, wherein the first difference is the maximum value of each adjacent threshold difference, and the second difference is the minimum value of each adjacent threshold difference;
based on the time point of each start data and the time point of each end data, a time period in which a threshold abnormality exists is determined.
6. The method of claim 5, wherein determining a time period for which a threshold anomaly exists based on the time point for each start datum and the time point for each end datum comprises:
for each start datum:
determining the time point of the initial data as an initial point, and judging whether termination data with the time point behind the initial point exists or not;
if so, taking the time of the termination data with the time after the starting point and the closest distance to the starting point as a termination point;
if not, determining the time point of the last item of data of the time sequence data as a termination point;
determining a time period between the start point and the end point as a time period in which a threshold anomaly exists.
7. The method according to claim 2 or 3, wherein the step of normalizing the candidate threshold difference of each data to obtain the target threshold difference of each data comprises:
the target threshold difference is calculated using the following equation:
y i ＝x i /|x i |
wherein, y i A target threshold difference, x, for the ith data in the time series data i And the candidate threshold value is the candidate threshold value of the ith item in the time series data.
8. A time series data threshold anomaly detection apparatus, comprising:
the threshold difference calculation unit is used for comparing each data in the time sequence data to be detected with a preset threshold to obtain a target threshold difference of each data, and the target threshold difference comprises two numerical values;
an adjacent value difference unit, configured to compare a target threshold difference of each piece of data in the time series data with a target threshold difference of a previous piece of data of the piece of data, to obtain an adjacent threshold difference of each piece of data;
and the time period determining unit is used for determining the time period with abnormal threshold values based on the adjacent threshold value difference of each data in the time sequence data.
9. A time series data threshold anomaly detection apparatus, comprising: a memory and a processor;
the memory is used for storing programs;
the processor, configured to execute the program, and implement the steps of the time series data threshold anomaly detection method according to any one of claims 1 to 7.
10. A storage medium having stored thereon a computer program which, when executed by a processor, carries out the steps of the time series data threshold anomaly detection method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211413195.3A CN115658774A (en) | 2022-11-11 | 2022-11-11 | Time sequence data threshold value abnormity detection method, device and related equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211413195.3A CN115658774A (en) | 2022-11-11 | 2022-11-11 | Time sequence data threshold value abnormity detection method, device and related equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115658774A true CN115658774A (en) | 2023-01-31 |
Family
ID=85021882
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211413195.3A Pending CN115658774A (en) | 2022-11-11 | 2022-11-11 | Time sequence data threshold value abnormity detection method, device and related equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115658774A (en) |
-
2022
- 2022-11-11 CN CN202211413195.3A patent/CN115658774A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108632097B (en) | Abnormal behavior object identification method, terminal device and medium | |
| AU2017274576B2 (en) | Classification of log data | |
| US11074237B2 (en) | Method and system to estimate the cardinality of sets and set operation results from single and multiple HyperLogLog sketches | |
| US20150206109A1 (en) | Long string pattern matching of aggregated account data | |
| US20160255109A1 (en) | Detection method and apparatus | |
| CN111782707B (en) | Data query method and system | |
| CN107870956B (en) | High-utility item set mining method and device and data processing equipment | |
| JP4889618B2 (en) | Data processing apparatus, data processing method, and program | |
| CN111797104A (en) | Method and device for acquiring data change condition and electronic equipment | |
| CN115658774A (en) | Time sequence data threshold value abnormity detection method, device and related equipment | |
| JP4452234B2 (en) | Data stream processing method, data stream processing program, storage medium, and data stream processing apparatus | |
| CN112698861A (en) | Source code clone identification method and system | |
| US10372719B2 (en) | Episode mining device, method and non-transitory computer readable medium of the same | |
| US7542995B2 (en) | Method and apparatus for detecting a change-point in a time-series of computer telemetry signals | |
| CN112861891B (en) | User behavior abnormality detection method and device | |
| CN108647098B (en) | Method and device for determining numerical value change speed | |
| CN113109761A (en) | Trajectory-oriented calculation time reduction method based on multi-hypothesis tracking algorithm | |
| CN111913805B (en) | CPU utilization rate calculation method and device | |
| CN110716929A (en) | Control and deployment processing method, device and equipment | |
| CN114978863B (en) | Data processing method, device, computer equipment and readable storage medium | |
| CN112989555B (en) | Time sequence data processing method, device, equipment and computer medium | |
| JP2023087998A (en) | Machine learning system and machine learning method | |
| CN112395283B (en) | Data query method and device and storage medium | |
| US20230161683A1 (en) | Method and apparatus for detecting outliers in a set of runs of software applications | |
| CN116795974A (en) | Log retrieval method, log retrieval device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |