CN116166927A - Online number of people abnormality detection method, device and storage medium - Google Patents

Online number of people abnormality detection method, device and storage medium Download PDF

Info

Publication number
CN116166927A
CN116166927A CN202310194754.4A CN202310194754A CN116166927A CN 116166927 A CN116166927 A CN 116166927A CN 202310194754 A CN202310194754 A CN 202310194754A CN 116166927 A CN116166927 A CN 116166927A
Authority
CN
China
Prior art keywords
moment
people
online
abnormal
current
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310194754.4A
Other languages
Chinese (zh)
Inventor
朱明�
李雨诗
陈建文
陶云飞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huazhong University of Science and Technology
Original Assignee
Huazhong University of Science and Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huazhong University of Science and Technology filed Critical Huazhong University of Science and Technology
Priority to CN202310194754.4A priority Critical patent/CN116166927A/en
Publication of CN116166927A publication Critical patent/CN116166927A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G08—SIGNALLING
    • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B21/00—Alarms responsive to a single specified undesired or abnormal condition and not otherwise provided for
    • G08B21/18—Status alarms
    • G08B21/182—Level alarms, e.g. alarms responsive to variables exceeding a threshold
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G08—SIGNALLING
    • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
    • G08B31/00—Predictive alarm systems characterised by extrapolation or other computation using updated historic data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/21—Server components or server architectures
    • H04N21/218—Source of audio or video content, e.g. local disk arrays
    • H04N21/2187—Live feed
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
    • H04N21/442—Monitoring of processes or resources, e.g. detecting the failure of a recording device, monitoring the downstream bandwidth, the number of times a movie has been viewed, the storage space available from the internal hard disk
    • H04N21/44213—Monitoring of end-user related data

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Mathematical Optimization (AREA)
  • Computational Linguistics (AREA)
  • Computational Mathematics (AREA)
  • Multimedia (AREA)
  • Biophysics (AREA)
  • Mathematical Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • Pure & Applied Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Molecular Biology (AREA)
  • Emergency Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Algebra (AREA)
  • Probability & Statistics with Applications (AREA)
  • Operations Research (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Social Psychology (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a method, a device and a storage medium for detecting the abnormality of the number of people on line. The method comprises the following steps: adaptively determining a differential threshold according to the history data of the number of people on line; judging whether the descending gradient of the moment to be detected exceeds a differential threshold value or not; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds a differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming; acquiring a true value and a predicted value of the number of online people at the current moment, and carrying out continuous abnormality judgment; when the judgment result of the continuous preset number is normal, the number of the online people is determined to be normal, the current time is taken as the ending time of the current abnormal period, and the alarm is ended. The problem of inaccurate positioning and high training cost existing in an anomaly detection method is solved. The method has the advantages that the differential threshold value is adaptively determined under the condition of saving time and energy, and the boundary of the abnormal segment is accurately positioned.

Description

Online number of people abnormality detection method, device and storage medium
Technical Field
The invention belongs to the technical field of data detection, and particularly relates to a method and a device for detecting the abnormality of the number of people on line and a storage medium.
Background
Key performance indicators (Key Performance Indicator, KPI) include page access traffic, number of online users, device memory utilization, and web page response time, among others, which may be obtained from Simple Network Management Protocol (SNMP), system logs, network tracking, network access logs, and other data sources. The online population is taken as time series KPI data which is acquired through timing sampling and has specific time meaning, and can reflect the change of a plurality of applications and services, such as server load condition, network bandwidth use condition, game popularity and the like. The number of online people can be used as an important index for judging the running state of the system service, and can also be used as an evaluation index for measuring the benefits of the application value of the game, thereby having important value for business operation and maintenance. And the generation frequency of the online people number data is rapid, and the real-time performance and timeliness are very strong. In order to ensure the quality and reliability of the service, effective data mining analysis is required to be carried out on the real-time online number of people, and the abnormality can be quickly found, so that the purposes of avoiding faults and stopping damage in time are achieved.
The existing online people number abnormality detection methods are generally divided into an abnormality detection method based on statistical prediction and an abnormality detection method based on machine learning. The anomaly detection method based on statistical prediction assumes that the time sequence obeys a certain probability distribution, and judges whether anomalies exist according to the distribution. The method requires operation and maintenance personnel to manually select the optimal statistical probability algorithm and parameters for each time sequence at intervals, and is easy to make mistakes and difficult to expand. In the abnormality detection method based on machine learning, generally, a time sequence is sliced according to a period without overlapping, and whether abnormality exists or not is judged by utilizing a characteristic rule of each section of fixed period sequence of model learning. Such methods are difficult to accurately locate the abnormal segment boundaries, and have large data volumes and high training costs.
Disclosure of Invention
Aiming at the defects of the related technology, the invention aims to provide an online people number abnormality detection method, an online people number abnormality detection device and a storage medium, and aims to solve the problems of inaccurate positioning and high training cost in the existing abnormality detection method.
In order to achieve the above object, the present invention provides an online population anomaly detection method, comprising:
s1, adaptively determining a differential threshold according to historical data of the number of people on line;
s2, judging whether the descending gradient of the number of online people at the moment to be detected exceeds the differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds the differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming;
s3, acquiring a true value and a predicted value of the number of online people at the current moment, and performing continuous abnormality judgment; and when the judgment result of the continuous preset number is normal, determining that the number of the online people is recovered to be normal, taking the current moment as the ending moment of the current abnormal period, and ending the alarm.
Optionally, the determining whether the gradient of the decrease of the number of online people at the moment to be detected exceeds the differential threshold includes:
acquiring the number of online people at the moment to be detected, and solving the descending gradient of the number of online people at the moment to be detected according to a gradient descending difference method; the gradient descent difference method formula is as follows:
Figure BDA0004106730410000021
wherein w is a differential window, and n is the nth time;
and judging whether the descending gradient exceeds the differential threshold value or not.
Optionally, S3 includes:
s31, acquiring historical online people number data of a current abnormal starting moment and a plurality of previous periods;
s32, inputting the historical online population data into a pre-trained prediction model, and predicting a predicted value of the online population in the next period at the current abnormal starting moment;
s33, acquiring a real value and a predicted value of the number of online people at the current moment, and judging whether the real value at the current moment is larger than or equal to the predicted value; if not, executing S34; if yes, executing S35;
s34, determining that the current moment is still abnormal, recording an abnormal result, and carrying out continuous alarm; judging whether the recorded abnormal time exceeds a period; if yes, taking the predicted value of the current period as the predicted value of the next period, and continuing to perform continuous abnormality judgment; if not, continuing to judge the abnormality at the next moment;
s35, determining that the current time is normal, and judging whether the continuous normal time exceeds a preset number; if yes, determining that the number of the online people is recovered to be normal, taking the current moment as the ending moment of the current abnormal period, and ending the alarm; if not, normal result recording is carried out, and the abnormality judgment at the next moment is continued.
Optionally, after the determining that the online population is recovered to be normal and taking the current time as the end time of the current abnormal period, the method further includes:
and clearing the abnormal result record and the normal result record, and continuing to perform abnormal detection at the next moment.
Optionally, the prediction model includes: RNN, LSTM, ARIMA, holt-Winters.
Optionally, the adaptively determining the differential threshold according to the history data of the number of people on line includes:
acquiring on-line population historical data of a preset time sequence, and determining a differential window according to the sampling frequency and the time period of the time sequence;
according to the gradient descent difference method, the descent gradient of each historical moment is obtained and used as test data;
and inputting the test data into a threshold calculation model, and solving a differential threshold of the adaptive gradient.
Optionally, the threshold calculation model includes: KNN algorithm, 3sigma outlier detection and One Class SVM.
In a second aspect, the present invention also provides an online population anomaly detection device, including:
the differential threshold determining module is used for adaptively determining a differential threshold according to the history data of the number of people on line;
the abnormal starting moment determining module is used for judging whether the descending gradient of the number of online people at the moment to be detected exceeds the differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds the differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming;
the abnormal end moment determining module is used for acquiring the true value and the predicted value of the online number of people at the current moment and carrying out continuous abnormal judgment; and when the judgment result of the continuous preset number is normal, determining that the number of the online people is recovered to be normal, and taking the current time as the ending time of the current abnormal period.
In a third aspect, the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to implement the method for detecting an abnormality in an online population of any one of the second aspects when executed.
In general, the above technical solutions conceived by the present invention, compared with the prior art, enable the following beneficial effects to be obtained:
1. according to the online people number abnormality detection method provided by the invention, the difference threshold value can be rapidly determined only based on the online people number history data, other data characteristics and manually marked labels are not required to be collected, and the time and labor for preprocessing a large amount of data are saved. The detection of the abnormal period of the online number of people is carried out by carrying out initial judgment of abnormal gradient descent and continuous abnormal judgment on the moment to be detected in real time, so that the starting boundary and the ending boundary of the abnormal period are positioned more accurately, and the accuracy of abnormal detection is improved.
2. According to the online people number abnormality detection method provided by the invention, the predicted value of the current period is used as the predicted value of the next period when the abnormality moment exceeds one period by the prediction method for continuous abnormality judgment, so that the problem of error superposition is avoided, the real-time performance is high, the calculation cost is low, and the false alarm rate is low.
3. The threshold calculation models adopted in the online people number abnormality detection method are models aiming at the online people number KPI time sequence, and can quickly obtain effective characteristic representation to find a differential threshold.
Drawings
Fig. 1 is a schematic flow chart of an online person number anomaly detection method according to an embodiment of the present invention;
fig. 2 is a schematic flow chart of determining an abnormal end boundary by continuous abnormality determination in an online person number abnormality detection method according to an embodiment of the present invention;
fig. 3 is a diagram of an on-line abnormal number of people detection result in an application example of the on-line abnormal number of people detection method according to the first embodiment of the present invention.
Detailed Description
The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention. In addition, the technical features of the embodiments of the present invention described below may be combined with each other as long as they do not collide with each other.
The description of the contents of the above embodiment will be given below in connection with a preferred embodiment.
Example 1
Fig. 1 is a flow chart of an online person number anomaly detection method according to an embodiment of the present invention.
As shown in fig. 1, an online population anomaly detection method includes:
s1, adaptively determining a differential threshold according to the history data of the number of people on line.
S2, judging whether the descending gradient of the number of online people at the moment to be detected exceeds a differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds a differential threshold value; if yes, determining that the number of people on line is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming.
S3, acquiring a true value and a predicted value of the number of online people at the current moment, and performing continuous abnormality judgment; when the judgment result of the continuous preset number is normal, the number of the online people is determined to be normal, and the current time is taken as the ending time of the current abnormal period.
The number of online people can be the number of players playing games on line in a game application scene, the number of users watching live broadcast on video live broadcast scenes, and the number of online people in other scenes with the requirement of detecting real-time online people. The number of online people can be used as one of evaluation indexes of game or live broadcast popularity, and also can be used as an important index of network bandwidth use condition and system running state. The monitoring and analysis of the number of online people find out the abnormal time period of the number of online people, so as to adjust the operation and maintenance of the business.
The method comprises the steps of collecting online people number data through a server, wherein the online people number data comprises collection time and online headcount corresponding to the collection time. Generally, in order to ensure the real-time performance and accuracy of the data, the sampling frequency of the online people number data is 1-10 minutes/time, and the data trend period is one day or one week.
Firstly, the gradient descent differential threshold value of the time sequence is self-adaptively calculated according to the history data of the number of people on line. Judging according to a gradient descent difference method, solving the descent gradient of the number of online people at the moment to be detected, and judging whether the descent gradient exceeds a threshold value; if the judgment result is yes, judging that the online people number at the moment to be detected is abnormal, starting to alarm, setting the moment as an abnormal starting boundary, namely the starting moment of an abnormal period, and starting to perform continuous abnormal judgment from the next moment of the moment, and not performing gradient descent differential judgment; if the judgment result is negative, judging that the online number of people at the moment to be detected is normal, and continuing gradient descent differential judgment at the next moment.
After the abnormality of the online people is found, acquiring historical online people data of the moment nearby the moment to predict, and comparing the predicted value of the subsequent moment with the true value to perform continuous abnormality judgment; if the real value is smaller than the predicted value at the subsequent moment, continuous abnormal alarming is always carried out, if the real value is larger than or equal to the predicted value for a continuous period of time, the number of online people is considered to be recovered to be normal, the alarm is released, and the current detection moment is an abnormal end boundary.
Alarming when abnormality occurs, reminding operation staff to check and repair in time; the method has the advantages that the time period of abnormal number of online people is recorded, the popularity of games or live broadcasts is analyzed periodically, the content or operation strategy of the games or live broadcasts is adjusted in time, faults are avoided, losses are stopped in time, and the benefit of application value is improved.
Optionally, the adaptively determining the differential threshold according to the history data of the number of people on line includes:
acquiring on-line population historical data of a preset time sequence, and determining a differential window according to the sampling frequency and the time period of the time sequence;
according to the gradient descent difference method, the descent gradient of each historical moment is obtained and used as test data;
and inputting the test data into a threshold calculation model, and solving a differential threshold of the adaptive gradient.
Optionally, the threshold calculation model includes: KNN algorithm, 3sigma outlier detection and One Class SVM.
The self-adaptive differential threshold is obtained by training based on online people number history data in advance, the self-adaptive differential threshold comprises data trend information, the differential window is determined according to the data sampling frequency and the time period, and the differential threshold is used for determining the starting boundary of the abnormal segment in gradient descent judgment.
In this embodiment, the preset time sequence is one month, and the sampling frequency and the time period of the time sequence are obtained according to the historical online population data of one month, so as to determine the differential window. Wherein the sampling frequency is 1-10 minutes/time, and the differential window is 10 minutes. And then, according to a gradient descent difference method, a descent gradient at the historical moment is obtained, and is input into a threshold calculation model to obtain an adaptive gradient difference threshold. The threshold value can be obtained in a self-adaptive mode in each application scene, and each time sequence only needs one threshold value without manual intervention. Threshold calculation models include, but are not limited to: KNN algorithm, 3sigma outlier detection, one Class SVM, and the like.
Taking a KNN algorithm as an example to perform self-adaptive differential threshold calculation description:
(1) Extracting historical online people number data of one month, and solving a descending gradient at each moment according to a gradient descending difference method, wherein the gradient descending method is as test data, and comprises the following formula:
Figure BDA0004106730410000071
where w is the differential window, and w is 10 minutes when the sampling frequency is 1 minute/time.
(2) The k value and the distance calculation method are generally selected from a smaller k and an odd number, and the distance calculation method includes Manhattan distance, euclidean distance, chebyshev distance and the like.
(3) The test data are input into a KNN model, the data at each historical moment are used as a test sample, and the model takes the first K categories with highest frequency as prediction classification of the test data.
(4) In the category with the highest frequency, a differential threshold value in which the maximum value of the falling gradient is the time-series data is selected.
Optionally, the determining whether the gradient of the decrease of the number of online people at the moment to be detected exceeds the differential threshold includes:
acquiring the number of online people at the moment to be detected, and solving the descending gradient of the number of online people at the moment to be detected according to a gradient descending difference method; the gradient descent difference method formula is as follows:
Figure BDA0004106730410000081
wherein w is a differential window, and n is the nth time;
and judging whether the descending gradient exceeds the differential threshold value or not.
And (3) calculating the descending gradient of the online population at the moment to be detected according to a gradient descending difference method, and judging whether the threshold value is exceeded. The gradient descent difference method has the advantages of quick operation, accurate positioning, capability of amplifying the gradient at the abnormal moment and convenience for identifying the abnormality.
Optionally, S3 includes:
s31, acquiring historical online people number data of a current abnormal starting moment and a plurality of previous periods;
s32, inputting the historical online population data into a pre-trained prediction model, and predicting a predicted value of the online population in the next period at the current abnormal starting moment;
s33, acquiring a real value and a predicted value of the number of online people at the current moment, and judging whether the real value at the current moment is larger than or equal to the predicted value; if not, executing S34; if yes, executing S35;
s34, determining that the current moment is still abnormal, recording an abnormal result, and carrying out continuous alarm; judging whether the recorded abnormal time exceeds a period; if yes, taking the predicted value of the current period as the predicted value of the next period, and continuing to perform continuous abnormality judgment; if not, continuing to judge the abnormality at the next moment;
s35, determining that the current time is normal, and judging whether the continuous normal time exceeds a preset number; if yes, determining that the number of the online people is recovered to be normal, and taking the current time as the ending time of the current abnormal period; if not, normal result recording is carried out, and the abnormality judgment at the next moment is continued.
The first several periods are 7 periods before the current abnormal starting moment, namely, the historical online people number data of the first 7 days are obtained, and the online people number of one day after the abnormal starting moment is predicted according to the historical online people number data of 7 days. Judging whether the continuous normal time exceeds the detection time length of the preset number, wherein the preset number is 10 in the embodiment.
Optionally, after the determining that the online population is recovered to be normal and taking the current time as the end time of the current abnormal period, the method further includes:
and clearing the abnormal result record and the normal result record, and continuing to perform abnormal detection at the next moment.
The prediction model adopted in the present embodiment includes: RNN, LSTM, ARIMA, holt-Winters. The model framework is small, the training speed is high, the requirements of second-level real-time prediction can be met, the positioning efficiency of the abnormal situations of the number of people on line is improved, and the positioning accuracy is improved.
As shown in fig. 2, once the abnormal starting boundary is determined, an alarm is started; then the online people number predicted value of the next period is predicted according to the historical online people number data of the moment close to the current abnormal starting moment, and continuous abnormal judgment is carried out on the subsequent moment, and gradient descent judgment is not carried out any more. The method comprises the steps of acquiring historical online population data of the first 7-10 periods at the moment close to the abnormal initial boundary, and inputting the data into a pre-trained prediction model for predicting the online population data of one period from the moment next to the abnormal initial boundary. Because of the seasonal nature of the online population data, the prediction period is far better than predicting a single moment.
The abnormality judgment is specifically to judge whether the actual value at the current time is equal to or greater than the predicted value, and if the actual value is equal to or greater than the predicted value, the number of online people at the time is normal, and if the actual value is less than the predicted value, the number of online people at the time is abnormal. If the real value is continuously smaller than the predicted value, the real value is always judged to be abnormal, continuous alarm is carried out, if the alarm duration exceeds a period, the predicted value of the current period is used as the predicted value of the next period, continuous alarm judgment is carried out, and prediction errors caused by error superposition are avoided. And restarting the initial judgment of gradient descent after the continuous alarm is finished, and repeating the steps. In this embodiment, the preset detection time length is greater than or equal to 10 detection times, preferably 10 detection times, that is, 10 minutes are selected; when the continuous normal time exceeds 10 minutes, namely, the detection result exceeding the preset detection time length is normal, the number of the online people is determined to be normal, and the current time is taken as the ending time of the current abnormal period. Recording the normal result and the abnormal result, and considering that the online people number data is still in an abnormal state when fluctuation of the normal result and the abnormal result occurs in the continuous abnormal judgment process; only if the number of continuous normal times exceeds 10, the online people number data can be considered to be in a stable normal state. After the abnormal time period is over, the records of the abnormal result and the normal result are cleared, and the records are re-recorded when the abnormal time period is entered next time.
As shown in FIG. 3, one example of a specific application for online people monitoring in a game is listed below:
1. the online number data of the 23:59 games of 2021-07-01 to 2021-7-31 are collected at a sampling frequency of once a minute, the time period is 1 day, the differential window is selected to be 10 minutes, the online number at the nth moment of the time sequence is recorded as X (n), the descending gradient is G (n), and the formula of the gradient descending difference method is as follows:
Figure BDA0004106730410000101
and (3) calculating a descending gradient of a month history moment according to a gradient descent difference method, setting k=3 according to a KNN algorithm, setting a time sequence as 1-dimensional data, preferentially selecting Manhattan distance as a distance calculation method, and calculating a gradient difference threshold T=33% of the time sequence under the game scene.
2. Starting from 00:00 of 2021-09-01, sequentially inputting online people number data at the moment to be detected, and solving the descending gradient of the online people number at the current moment to be detected, and judging whether the descending gradient exceeds a threshold value T. If the gradient is not exceeded, the gradient of the next time is continuously calculated to judge. When the falling gradient at the moment of 2:45 of 2021-09-07 exceeds the threshold, the moment is an abnormal starting boundary, and an abnormal alarm starts to be generated. Continuing anomaly determination is performed starting from 2:45 of 2021-09-07, and gradient descent differential determination is no longer performed.
3. The first 7 days of online people data, 2:45 of 2021-08-31 to 2:45 of 2021-09-07, near the 2:45 of the anomaly initiation boundary 2021-09-07 are acquired and input into a pre-trained LSTM prediction model to obtain the next day of online people prediction data, 2:45 of 2021-09-07 to 2:45 of 2021-09-08.
4. And (3) sequentially inputting online number data of the moment to be detected from the moment 2:46 of 2021-09-07, and judging whether the actual value exceeds the predicted value. Detecting that the real value of the number of online people at the moment is smaller than a predicted value from 2:46 of 2021-09-07 to 6:48 of 2021-09-07, wherein the moment is still abnormal, and continuously generating an abnormal alarm; if the continuous time period from 6:49 of 2021-09-07 to 6:58 of 2021-09-07 is 10 minutes greater than the predicted value, 6:58 of the current detection time 2021-09-07 is an abnormal end boundary, and the abnormal alarm is ended. The gradient descent differential determination is restarted from the point next to the abnormal end boundary, i.e., 6:59 of 2021-09-07. The application instance results are shown in scatter plot 3, where the "+" within the box is bolded as the detected anomaly fragment.
According to the technical scheme, the differential threshold value is rapidly determined through the online population historical data, the descending gradient of the online population at the moment to be detected is obtained through a gradient descent differential method, abnormal gradient descent initial judgment is performed through comparison of the descending gradient of the online population at the moment to be detected and the differential threshold value, the starting boundary of the abnormal period of the online population is positioned, and the ending boundary of the abnormal period of the online population is positioned through persistence judgment, so that the accuracy of abnormality detection can be improved. The method solves the technical problems of inaccurate positioning and high training cost in the existing anomaly detection method, and has the beneficial effects of adaptively determining the differential threshold value and accurately positioning the boundary of the anomaly fragment under the condition of saving time and energy.
Example two
The invention also provides an online people number abnormality detection device, which comprises:
and the differential threshold determining module is used for adaptively determining a differential threshold according to the history data of the number of people on line.
The abnormal starting moment determining module is used for judging whether the descending gradient of the number of online people at the moment to be detected exceeds the differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds the differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming.
The abnormal end moment determining module is used for acquiring the true value and the predicted value of the online number of people at the current moment and carrying out continuous abnormal judgment; and when the judgment result of the continuous preset number is normal, determining that the number of the online people is recovered to be normal, and taking the current time as the ending time of the current abnormal period.
The device for detecting the abnormal number of the online people provided by the embodiment of the invention can execute the method for detecting the abnormal number of the online people provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.
Example III
The present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to implement the method for detecting an abnormality in an online population according to any one of the above embodiments when executed.
It will be readily appreciated by those skilled in the art that the foregoing description is merely a preferred embodiment of the invention and is not intended to limit the invention, but any modifications, equivalents, improvements or alternatives falling within the spirit and principles of the invention are intended to be included within the scope of the invention.

Claims (9)

1. An online population anomaly detection method is characterized by comprising the following steps:
s1, adaptively determining a differential threshold according to historical data of the number of people on line;
s2, judging whether the descending gradient of the number of online people at the moment to be detected exceeds the differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds the differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming;
s3, acquiring a true value and a predicted value of the number of online people at the current moment, and performing continuous abnormality judgment; and when the judgment result of the continuous preset number is normal, determining that the number of the online people is recovered to be normal, taking the current moment as the ending moment of the current abnormal period, and ending the alarm.
2. The method of claim 1, wherein determining whether the decline gradient of the number of people online at the time to be detected exceeds the differential threshold comprises:
acquiring the number of online people at the moment to be detected, and solving the descending gradient of the number of online people at the moment to be detected according to a gradient descending difference method; the gradient descent difference method formula is as follows:
Figure FDA0004106730380000011
wherein w is a differential window, and n is the nth time;
and judging whether the descending gradient exceeds the differential threshold value or not.
3. The method of claim 1, wherein S3 comprises:
s31, acquiring historical online people number data of a current abnormal starting moment and a plurality of previous periods;
s32, inputting the historical online population data into a pre-trained prediction model, and predicting a predicted value of the online population in the next period at the current abnormal starting moment;
s33, acquiring a real value and a predicted value of the number of online people at the current moment, and judging whether the real value at the current moment is larger than or equal to the predicted value; if not, executing S34; if yes, executing S35;
s34, determining that the current moment is still abnormal, recording an abnormal result, and carrying out continuous alarm; judging whether the recorded abnormal time exceeds a period; if yes, taking the predicted value of the current period as the predicted value of the next period, and continuing to perform continuous abnormality judgment; if not, continuing to judge the abnormality at the next moment;
s35, determining that the current time is normal, and judging whether the continuous normal time exceeds a preset number; if yes, determining that the number of the online people is recovered to be normal, taking the current moment as the ending moment of the current abnormal period, and ending the alarm; if not, normal result recording is carried out, and the abnormality judgment at the next moment is continued.
4. The method of claim 3, further comprising, after said determining that the number of people on line has recovered to normal, taking the current time as the end time of the current abnormal period:
and clearing the abnormal result record and the normal result record, and continuing to perform abnormal detection at the next moment.
5. The method of claim 3, wherein the predictive model comprises: RNN, LSTM, ARIMA, holt-Winters.
6. The method of claim 1, wherein said adaptively determining a differential threshold based on online people history data comprises:
acquiring on-line population historical data of a preset time sequence, and determining a differential window according to the sampling frequency and the time period of the time sequence;
according to the gradient descent difference method, the descent gradient of each historical moment is obtained and used as test data;
and inputting the test data into a threshold calculation model, and solving a differential threshold of the adaptive gradient.
7. The method of claim 6, wherein the threshold calculation model comprises: KNN algorithm, 3sigma outlier detection and One Class SVM.
8. An online population anomaly detection device, comprising:
the differential threshold determining module is used for adaptively determining a differential threshold according to the history data of the number of people on line;
the abnormal starting moment determining module is used for judging whether the descending gradient of the number of online people at the moment to be detected exceeds the differential threshold value; if not, determining that the number of online people is normal, and continuously judging whether the descending gradient at the next moment exceeds the differential threshold value; if yes, determining that the number of the online people is abnormal, setting the moment as the starting moment of the current abnormal period, and alarming;
the abnormal end moment determining module is used for acquiring the true value and the predicted value of the online number of people at the current moment and carrying out continuous abnormal judgment; and when the judgment result of the continuous preset number is normal, determining that the number of the online people is recovered to be normal, and taking the current time as the ending time of the current abnormal period.
9. A computer readable storage medium storing computer instructions for causing a processor to implement the method of on-line person number anomaly detection of any one of claims 1-7 when executed.
CN202310194754.4A 2023-02-28 2023-02-28 Online number of people abnormality detection method, device and storage medium Pending CN116166927A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310194754.4A CN116166927A (en) 2023-02-28 2023-02-28 Online number of people abnormality detection method, device and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310194754.4A CN116166927A (en) 2023-02-28 2023-02-28 Online number of people abnormality detection method, device and storage medium

Publications (1)

Publication Number Publication Date
CN116166927A true CN116166927A (en) 2023-05-26

Family

ID=86413126

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310194754.4A Pending CN116166927A (en) 2023-02-28 2023-02-28 Online number of people abnormality detection method, device and storage medium

Country Status (1)

Country Link
CN (1) CN116166927A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116451139A (en) * 2023-06-16 2023-07-18 杭州新航互动科技有限公司 Live broadcast data rapid analysis method based on artificial intelligence

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116451139A (en) * 2023-06-16 2023-07-18 杭州新航互动科技有限公司 Live broadcast data rapid analysis method based on artificial intelligence
CN116451139B (en) * 2023-06-16 2023-09-01 杭州新航互动科技有限公司 Live broadcast data rapid analysis method based on artificial intelligence

Similar Documents

Publication Publication Date Title
CN108537544B (en) Real-time monitoring method and monitoring system for transaction system
CN111475804B (en) Alarm prediction method and system
CN108197845B (en) Transaction index abnormity monitoring method based on deep learning model LSTM
CN108073497B (en) Multi-index transaction analysis method based on data center data acquisition platform
CN108881194B (en) Method and device for detecting abnormal behaviors of users in enterprise
JP7312919B2 (en) Method and Apparatus, Device and Storage Medium for Determining Operational State of Photovoltaic Array
CN110414155B (en) Fan component temperature abnormity detection and alarm method with single measuring point
CN106951984B (en) Dynamic analysis and prediction method and device for system health degree
US8078913B2 (en) Automated identification of performance crisis
CN108038044B (en) Anomaly detection method for continuous monitored object
CN107844914B (en) Risk management and control system based on group management and implementation method
CN116166927A (en) Online number of people abnormality detection method, device and storage medium
CN112801555B (en) Vehicle dynamic property comprehensive evaluation method based on Internet of vehicles big data
CN109491339B (en) Big data-based substation equipment running state early warning system
CN108306997B (en) Domain name resolution monitoring method and device
CN111666978B (en) Intelligent fault early warning system for IT system operation and maintenance big data
CN111754241A (en) User behavior perception method, device, equipment and medium
CN115660262B (en) Engineering intelligent quality inspection method, system and medium based on database application
CN115719283A (en) Intelligent accounting management system
CN115859200A (en) Data detection method and system
CN117041019A (en) Log analysis method, device and storage medium of content delivery network CDN
CN116319858A (en) Intelligent ship Internet of things data operation and maintenance monitoring method and system
CN113282920B (en) Log abnormality detection method, device, computer equipment and storage medium
CN112882898B (en) Anomaly detection method, system, device and medium based on big data log analysis
CN110909380B (en) Abnormal file access behavior monitoring method and device

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination