CN116702006A - Abnormality determination method, abnormality determination device, computer device, and storage medium - Google Patents
Abnormality determination method, abnormality determination device, computer device, and storage medium Download PDFInfo
- Publication number
- CN116702006A CN116702006A CN202310721873.0A CN202310721873A CN116702006A CN 116702006 A CN116702006 A CN 116702006A CN 202310721873 A CN202310721873 A CN 202310721873A CN 116702006 A CN116702006 A CN 116702006A
- Authority
- CN
- China
- Prior art keywords
- reference value
- value
- preset
- abnormality
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000005856 abnormality Effects 0.000 title claims abstract description 114
- 238000000034 method Methods 0.000 title claims abstract description 59
- 230000002159 abnormal effect Effects 0.000 claims abstract description 71
- 230000007774 longterm Effects 0.000 claims abstract description 65
- 238000013145 classification model Methods 0.000 claims abstract description 16
- 238000004590 computer program Methods 0.000 claims description 15
- 238000012544 monitoring process Methods 0.000 claims description 4
- 238000012423 maintenance Methods 0.000 abstract description 16
- 238000010586 diagram Methods 0.000 description 8
- 230000008569 process Effects 0.000 description 8
- 238000004364 calculation method Methods 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000013473 artificial intelligence Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 206010033799 Paralysis Diseases 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000009194 climbing Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3013—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F18/2148—Generating training patterns; Bootstrap methods, e.g. bagging or boosting characterised by the process organisation or structure, e.g. boosting cascade
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/24323—Tree-organised classifiers
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S10/00—Systems supporting electrical power generation, transmission or distribution
- Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Quality & Reliability (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Computation (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Computing Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Mathematical Physics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The application relates to the field of intelligent operation and maintenance, and provides an abnormality judgment method, device, equipment and storage medium, wherein the method comprises the following steps: acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index; determining a target reference value according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a target reference value determining rule; determining an abnormal relative value of the index data according to the index data and the target reference value; acquiring an accumulated value of abnormal relative values in a preset time window; if the abnormal accumulated value is greater than or equal to a preset threshold value, determining an abnormal type according to the abnormal relative value based on a preset classification model; and outputting an abnormality alarm according to the abnormality type. The method can prevent the intelligent operation and maintenance system from misjudging whether the index data are abnormal or not, and improve the accuracy of the intelligent operation and maintenance system. The application also relates to the field of intelligent medical treatment, and the abnormality determination method can be applied to abnormality determination according to indexes of a medical system.
Description
Technical Field
The present application relates to the field of intelligent operation and maintenance, and in particular, to an anomaly determination method, an anomaly determination device, a computer device, and a storage medium.
Background
Along with the development of operation and maintenance technology, the intelligent operation and maintenance realized based on the artificial intelligence technology gradually replaces a part of traditional artificial operation and maintenance. However, in the conventional abnormality determination method in the intelligent operation and maintenance technology, a fixed threshold is usually set for the index data, if the index data exceeds the threshold, the abnormality is considered to occur, the abnormality determination standard has a certain subjectivity, erroneous determination is easy to occur, and it is difficult to classify the abnormality according to the index data. For example, in the intelligent medical field, if abnormality existing in a medical system cannot be found timely and accurately, the system is paralyzed, which can cause low experience of patients and even bring economic loss; if the system is mistakenly considered to be abnormal during normal operation of the medical system, operation and maintenance personnel are prompted to conduct investigation and repair, and therefore labor cost of operation and maintenance of the medical system is increased. Therefore, a more flexible and accurate abnormality determination method is needed.
Disclosure of Invention
The application mainly aims to provide an abnormality determination method, an abnormality determination device, abnormality determination equipment and a computer storage medium, aiming to improve the rationality of abnormality determination, prevent erroneous determination and improve the accuracy of abnormality determination.
In a first aspect, the present application provides an abnormality determination method including the steps of:
acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index;
determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule;
determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
acquiring an accumulated value of the abnormal relative value in a preset time window;
if the accumulated value in the time window is greater than or equal to a preset threshold value, determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model;
and outputting an abnormality alarm according to the abnormality type.
In a second aspect, the present application also provides an abnormality determination apparatus including:
the data acquisition module is used for acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to the preset index;
the reference value determining module is used for determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule;
the relative value determining module is used for determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
the accumulated value determining module is used for obtaining the accumulated value of the abnormal relative value in a preset time window;
the abnormality classification module is used for determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model if the accumulated value in the time window is greater than or equal to a preset threshold value;
and the abnormality alarm module is used for outputting an abnormality alarm according to the abnormality type.
In a third aspect, the present application also provides a computer device comprising a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein the computer program, when executed by the processor, implements the anomaly determination method as described above.
In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the abnormality determination method as described above.
The application provides an abnormality judging method, a device, equipment and a computer storage medium, wherein the method comprises the steps of obtaining a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index; determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule; determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value; acquiring an accumulated value of the abnormal relative value in a preset time window; if the accumulated value in the time window is greater than or equal to a preset threshold value, determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model; and outputting an abnormality alarm according to the abnormality type. The method can be applied to the abnormality judgment of the medical system, and as the long-term reference value, the short-term reference value and the off-line reference value of the index are integrated to judge whether the index data has abnormality, the rationality and the accuracy of the abnormality judgment are improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flowchart of an anomaly determination method according to an embodiment of the present application;
FIG. 2 is a view of a usage scenario of an anomaly determination method according to an embodiment of the present application;
FIG. 3 is a schematic block diagram of an abnormality determination apparatus according to an embodiment of the present application;
fig. 4 is a schematic block diagram of a computer device according to an embodiment of the present application.
Detailed Description
The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
The flow diagrams depicted in the figures are merely illustrative and not necessarily all of the elements and operations/steps are included or performed in the order described. For example, some operations/steps may be further divided, combined, or partially combined, so that the order of actual execution may be changed according to actual situations.
The embodiment of the application provides an abnormality determination method, an abnormality determination device, computer equipment and a computer readable storage medium.
Some embodiments of the present application are described in detail below with reference to the accompanying drawings. The following embodiments and features of the embodiments may be combined with each other without conflict.
Referring to fig. 1, fig. 1 is a flowchart of an anomaly determination method according to an embodiment of the application. The abnormality determination method can be used for a medical system, and the medical system can be configured in a terminal or a server to accurately and reasonably determine whether abnormality exists in each item of index data of intelligent operation and maintenance of the medical system. The terminal can be electronic equipment such as a mobile phone, a tablet personal computer, a notebook computer, a desktop computer, a personal digital assistant, wearable equipment and the like; the server may be an independent server, a server cluster, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), basic cloud computing services such as big data and artificial intelligence platforms, and the like.
Referring to fig. 2, fig. 2 is a usage scenario diagram according to an embodiment of the present application. As shown in fig. 2, abnormality determination is performed on index data of a medical system disposed in a server or a terminal (not shown) by a target server. Specifically, the target server continuously acquires index data of the medical system, determines a long-term reference value, a short-term reference value and an offline reference value according to the index data, and performs abnormality judgment on the index data acquired in real time according to the long-term reference value, the short-term reference value and the offline reference value, and outputs an abnormality alarm based on an abnormality type when it is judged that the index data is abnormal.
Of course, the long-term reference value, the short-term reference value and the off-line reference value may be determined by the medical system and then sent to the target server, and the usage scenario diagram shown in fig. 2 is only used to illustrate the abnormality determination method provided in this embodiment, and does not limit the implementation procedure of the method.
As shown in fig. 1, the abnormality determination method includes steps S101 to S106.
Step S101, a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index are obtained.
For example, in order to perform abnormality determination on a preset index in the related art, a fixed threshold value or an index range is generally set for each index, and when index data corresponding to the index exceeds the threshold value or falls outside the index range, it is determined that the index data is abnormal and an alarm is given. However, the abnormality judgment flexibility is poor, the index abnormality judgment standard cannot be adjusted at any time according to the actual situation, and due to the fact that the judgment standard is too single, erroneous judgment is easy to occur, and the abnormality judgment accuracy and the operation and maintenance efficiency are reduced.
By means of the abnormality determination method, the long-term reference value, the short-term reference value and the off-line reference value which correspond to the preset indexes in different time periods are obtained, so that the determination standard for subsequent abnormality determination can be determined according to the long-term reference value, the short-term reference value and the off-line reference value, and the flexibility and the accuracy of abnormality determination are improved.
In some embodiments, the obtaining the long-term reference value, the short-term reference value, and the offline reference value corresponding to the preset index includes: determining the long-term reference value according to the index data in a first preset duration; and determining the short-term reference value according to the index data in a second preset time period, wherein the first preset time period is longer than the second preset time period.
Illustratively, the long-term reference value and the short-term reference value are determined from the index data within a first predetermined time period and a second predetermined time period, respectively. The first preset duration may be, for example, 24 hours, and the second preset duration may be, for example, 1 hour. Of course, the first preset time period and the second preset time period are not limited thereto, and may be other time periods, which are not limited thereto. It is understood that the first preset time period is longer than the second preset time period.
For example, the long-term reference value is determined according to the index data of the preset index within the first preset time period, for example, the long-term reference value is determined according to the average value of the index data of the preset index within 24 hours; the short-term reference value is determined by index data of the preset index within a second preset duration, for example, the short-term reference value is determined according to the average value of the index data of the preset index within 1 hour. The long-term reference value and the short-term reference value may be calculated according to other methods based on the index data in the corresponding time period, for example, may be the median of the index data in the corresponding time period, which is not limited herein.
For example, the offline reference value may be determined from index data over a longer period of time, e.g., from all historical index data acquired; or the offline reference value may be preset according to actual requirements, for example, a corresponding offline reference value is set for each preset index, which is not limited herein.
The long-term reference value and the short-term reference value can reflect reasonable reference values of the index under the current condition, for example, under the condition that index data are at a higher level or a lower level, the sizes of the corresponding long-term reference value and short-term reference value are different, the rationality and flexibility of the subsequent target reference are improved, and the accuracy of final abnormality judgment is also improved.
Step S102, determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule.
Illustratively, the target reference value is used to reflect a reasonable value of the index data in the present case. Specifically, the target reference value is derived from the long-term reference value, the short-term reference value, and the off-line reference value.
In some embodiments, the determining, based on a preset target reference value determining rule, the target reference value of the index data according to the long-term reference value, the short-term reference value, and the offline reference value corresponding to the index includes: and according to the first weight corresponding to the long-term reference value, the second weight corresponding to the short-term reference value and the third weight corresponding to the off-line reference value, carrying out weighted summation on the long-term reference value, the short-term reference value and the off-line reference value to obtain the target reference value.
The target reference value for determining the abnormal relative value of the index data is obtained by weighting and summing the long-term reference value, the short-term reference value and the off-line reference value according to weights respectively corresponding to the long-term reference value, the short-term reference value and the off-line reference value.
For example, the short-term reference value most reflects the current change of the index under normal conditions, so that the importance of the short-term reference value is highest, the importance of the long-term reference value is next highest, and the importance of the offline reference value is lowest. Therefore, the second weight > the first weight > the third weight may be set, but is not limited thereto.
For example, the target reference value may be calculated according to the following formula:
threshold＝w 1 ×threshold long +w 2 ×threshold short +w 3 ×threshold offline
wherein threshold represents the target reference value long 、threshold short And threshold offline The long-term reference value, the short-term reference value, and the off-line reference value are represented, respectively, and the first weight, the second weight, and the third weight are represented, respectively.
By way of example, since the target reference value is obtained by combining the magnitudes of the long-term reference value, the short-term reference value and the off-line reference value, the rough value of the index can be reasonably reflected, and the accuracy of the subsequent determination of the abnormal relative value and the abnormal determination according to the abnormal relative value is improved.
In some embodiments, the determining, based on a preset target reference value determining rule, the target reference value of the index data according to the long-term reference value, the short-term reference value, and the offline reference value corresponding to the index includes: and determining a target reference value of the index data according to the long-term reference value, the short-term reference value and the off-line reference value corresponding to the index based on a preset reference value updating period.
For example, the reference value update period may be determined according to actual requirements, for example, the reference value update period may be determined as a change period of at least one of a long-term reference value, a short-term reference value, and an offline reference value, which is not limited herein.
By way of example, the target reference value is updated according to the reference value updating period, so that the target reference value which is more in line with the actual situation can be determined, and the rationality of abnormality judgment is improved.
Step 103, determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value.
Illustratively, the anomaly relative value is derived from comparing the index data to a target reference value.
The abnormal relative value is a numerical value obtained by processing the collected index, and can objectively and truly reflect the degree of abnormality of the index data.
In some embodiments, the determining, according to the index data corresponding to the preset index and the target reference value, an abnormal relative value of the index data includes: and determining the abnormal relative value according to the ratio of the target difference value to the target reference value, wherein the target difference value is the difference value between the target reference value and the current index data.
For example, the anomaly relative value can reflect a difference between the index data and the target reference value, and if the difference between the index data and the target reference value is too large, the anomaly relative value indicates that the index is abnormal.
Illustratively, the anomaly relative value may be determined by the following formula:
wherein R represents an abnormal relative value, value represents index data, and epsilon represents a preset constant for preventing denominator from being 0.
By way of example, the degree of abnormality of the index data can be reflected more objectively by the difference between the index data and the target reference value being represented by the abnormality relative value.
Step S104, acquiring the accumulated value of the abnormal relative value in a preset time window.
For example, a certain time window is set according to the actual situation, for example, a time window with a duration of 5 minutes is set, the abnormal relative value of the index within 5 minutes before the current moment is analyzed, and the accumulated value of the abnormal relative value of the index data within the time window is determined. Specifically, the abnormal relative values in the time window are integrated to obtain an integrated value.
By way of example, the anomaly determination is performed according to the accumulated value of the anomaly relative values, so that erroneous determination caused by data fluctuation is prevented, and an anomaly alarm is performed only when the anomaly relative values are at a higher level within a period of time, thereby further improving the accuracy of the anomaly determination.
Step 105, if the accumulated value in the time window is greater than or equal to a preset threshold, determining the abnormality type based on a preset classification model according to the abnormality relative value in the preset time window.
Illustratively, the anomaly relative value is determined by a predetermined classification model. Specifically, an exception type is set according to actual requirements, and the exception type can be, for example, a CPU load exception, a CPU climbing exception, a memory consumption exception, a process termination exception, a disk space consumption exception, a network packet loss exception, a network resource packet repeated transmission exception, a network resource packet damage exception and the like; training the classification model according to the preset anomaly type and the anomaly relative values corresponding to the various indexes when different anomaly types occur, and obtaining the classification model for determining the anomaly type according to the anomaly relative values of the indexes. The classification model may be, for example, an xgboost model.
By means of the method, the anomaly type is determined according to the anomaly relative value of the index through a preset classification model, labor cost for anomaly type analysis is reduced, and anomaly determination efficiency is improved.
And step S106, outputting an abnormality alarm according to the abnormality type.
Illustratively, an anomaly alert is output based on the type of anomaly determined by the classification model to allow the relevant personnel to quickly determine the root cause of the anomaly and to handle the anomaly.
In some embodiments, the outputting an anomaly alert according to the anomaly type includes: and when the accumulated values in a plurality of time windows in the third preset duration are greater than or equal to a preset threshold, merging the abnormal alarms corresponding to the time windows into the same abnormal alarm.
In some embodiments, the outputting an anomaly alert according to the anomaly type includes: if more than two monitoring objects in the fourth preset time period have the abnormal alarms of the same abnormal type, merging the abnormal alarms of the same abnormal type into a high-priority abnormal alarm.
By way of example, multiple anomalies of the same type of the same object in the third preset duration or multiple anomalies of the same type of the same object in the fourth preset duration are combined, so that a large number of anomaly alarms are prevented from being generated by the intelligent operation and maintenance system in a short time due to the same anomaly root at one time, and the anomaly efficiency of operation and maintenance personnel is improved.
According to the abnormality determination method provided by the embodiment, the long-term reference value, the short-term reference value and the off-line reference value corresponding to the preset index are obtained; determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule; determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value; acquiring an accumulated value of the abnormal relative value in a preset time window; if the accumulated value in the time window is greater than or equal to a preset threshold value, determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model; and outputting an abnormality alarm according to the abnormality type. The method can improve the rationality of the abnormality judgment of the intelligent operation and maintenance system, prevent the occurrence of misjudgment and improve the accuracy of the abnormality judgment.
Referring to fig. 3, fig. 3 is a schematic diagram of an abnormality determining apparatus according to an embodiment of the present application, where the abnormality determining apparatus may be configured in a server or a terminal for executing the abnormality determining method described above.
As shown in fig. 3, the abnormality determination apparatus includes: a data acquisition module 110, a reference value determination module 120, a relative value determination module 130, an accumulated value determination module 140, an anomaly classification module 150, and an anomaly alert module 160.
The data acquisition module 110 is configured to acquire a long-term reference value, a short-term reference value, and an offline reference value corresponding to a preset index;
the reference value determining module 120 is configured to determine a target reference value of the index data according to a long-term reference value, a short-term reference value, and an offline reference value corresponding to the index based on a preset target reference value determining rule;
a relative value determining module 130, configured to determine an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
the accumulated value determining module 140 is configured to obtain an accumulated value of the abnormal relative value within a preset time window;
the anomaly classification module 150 is configured to determine an anomaly type based on a preset classification model if the accumulated value in the time window is greater than or equal to a preset threshold value, and according to an anomaly relative value in the preset time window;
an abnormality alert module 160 for outputting an abnormality alert according to the abnormality type.
Illustratively, the data acquisition module 110 further includes: the device comprises a long-term reference value acquisition module and a short-term reference value acquisition module.
And the short-term reference value acquisition module is used for determining the long-term reference value according to the index data in the first preset time period.
The long-term reference value acquisition module is used for determining the short-term reference value according to the index data in a second preset time length, wherein the first preset time length is longer than the second preset time length.
Illustratively, the reference value determination module 120 further includes: and a reference value calculation module.
And the reference value calculation module is used for carrying out weighted summation on the long-term reference value, the short-term reference value and the offline reference value according to the first weight corresponding to the long-term reference value, the second weight corresponding to the short-term reference value and the third weight corresponding to the offline reference value to obtain the target reference value.
Illustratively, the relative value determination module 130 further includes: and a relative value calculation module.
And the relative value calculation module is used for determining the abnormal relative value according to the ratio of a target difference value to the target reference value, wherein the target difference value is the difference value between the target reference value and the current index data.
Illustratively, the anomaly alert module 160 further includes: the device comprises a first merging module and a second merging module.
And the first merging module is used for merging the abnormal alarms corresponding to the time windows into the same abnormal alarm when the accumulated values in the time windows in the third preset time period are larger than or equal to a preset threshold value.
And the second merging module is used for merging the abnormal alarms of the same abnormal type into the high-priority abnormal alarm if more than two monitoring objects in the fourth preset time period have the abnormal alarms of the same abnormal type.
Illustratively, the reference value determination module 120 further includes: and a reference value updating module.
The reference value updating module is used for determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset reference value updating period.
It should be noted that, for convenience and brevity of description, specific working processes of the above-described apparatus and each module, unit may refer to corresponding processes in the foregoing method embodiments, which are not repeated herein.
The methods and apparatus of the present application are operational with numerous general purpose or special purpose computing system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The above-described methods, apparatus may be implemented, for example, in the form of a computer program that is executable on a computer device as shown in fig. 4.
Referring to fig. 4, fig. 4 is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device may be a server or a terminal.
As shown in fig. 4, the computer device includes a processor, a memory, and a network interface connected by a system bus, wherein the memory may include a storage medium and an internal memory.
The storage medium may store an operating system and a computer program. The computer program includes program instructions that, when executed, cause a processor to perform any of a number of exception determination methods.
The processor is used to provide computing and control capabilities to support the operation of the entire computer device.
The internal memory provides an environment for the execution of a computer program in a storage medium that, when executed by a processor, causes the processor to perform any of a number of anomaly determination methods.
The network interface is used for network communication such as transmitting assigned tasks and the like. It will be appreciated by persons skilled in the art that the architecture shown in fig. 4 is merely a block diagram of some of the architecture relevant to the present inventive arrangements and is not limiting as to the computer device to which the present inventive arrangements are applicable, and that a particular computer device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.
It should be appreciated that the processor may be a central processing unit (Central Processing Unit, CPU), but may also be other general purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. Wherein the general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
Wherein in one embodiment the processor is configured to run a computer program stored in the memory to implement the steps of:
acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index;
determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule;
determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
acquiring an accumulated value of the abnormal relative value in a preset time window;
if the accumulated value in the time window is greater than or equal to a preset threshold value, determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model;
and outputting an abnormality alarm according to the abnormality type.
In one embodiment, the processor is configured to, when implementing obtaining the long-term reference value, the short-term reference value, and the offline reference value corresponding to the preset index, implement:
determining the long-term reference value according to the index data in a first preset duration;
and determining the short-term reference value according to the index data in a second preset time period, wherein the first preset time period is longer than the second preset time period.
In one embodiment, the processor is configured to, when implementing a rule for determining a target reference value based on a preset target reference value, determine the target reference value of the index data according to a long-term reference value, a short-term reference value, and an offline reference value corresponding to the index, implement:
and according to the first weight corresponding to the long-term reference value, the second weight corresponding to the short-term reference value and the third weight corresponding to the off-line reference value, carrying out weighted summation on the long-term reference value, the short-term reference value and the off-line reference value to obtain the target reference value.
In one embodiment, the processor is configured to, when determining the abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value, implement:
and determining the abnormal relative value according to the ratio of the target difference value to the target reference value, wherein the target difference value is the difference value between the target reference value and the current index data.
In one embodiment, when implementing the outputting of the abnormality alert according to the abnormality type, the processor is configured to implement:
and when the accumulated values in a plurality of time windows in the third preset duration are greater than or equal to a preset threshold, merging the abnormal alarms corresponding to the time windows into the same abnormal alarm.
In one embodiment, when implementing the outputting of the abnormality alert according to the abnormality type, the processor is configured to implement:
if more than two monitoring objects in the intelligent operation and maintenance system have the abnormal alarms of the same abnormal type within the fourth preset time period, merging the abnormal alarms of the same abnormal type into a high-priority abnormal alarm.
In one embodiment, when implementing the rule for determining the target reference value based on the preset target reference value, the processor is configured to implement:
and determining a target reference value of the index data according to the long-term reference value, the short-term reference value and the off-line reference value corresponding to the index based on a preset reference value updating period.
It should be noted that, for convenience and brevity of description, the specific working process of the foregoing description of the abnormality determination may refer to the corresponding process in the foregoing embodiment of the abnormality determination control method, which is not described herein again.
Embodiments of the present application also provide a computer readable storage medium having a computer program stored thereon, the computer program including program instructions that, when executed, implement a method that may refer to embodiments of the anomaly determination method of the present application.
The computer readable storage medium may be an internal storage unit of the computer device according to the foregoing embodiment, for example, a hard disk or a memory of the computer device. The computer readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), or the like, which are provided on the computer device.
It is to be understood that the terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should also be understood that the term "and/or" as used in the present specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations. It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or system that comprises the element.
The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments. While the application has been described with reference to certain preferred embodiments, it will be understood by those skilled in the art that various changes and substitutions of equivalents may be made and equivalents will be apparent to those skilled in the art without departing from the scope of the application. Therefore, the protection scope of the application is subject to the protection scope of the claims.
Claims (10)
1. An abnormality determination method, characterized by comprising:
acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to a preset index;
determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule;
determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
acquiring an accumulated value of the abnormal relative value in a preset time window;
if the accumulated value in the time window is greater than or equal to a preset threshold value, determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model;
and outputting an abnormality alarm according to the abnormality type.
2. The anomaly determination method according to claim 1, wherein the obtaining the long-term reference value, the short-term reference value, and the off-line reference value corresponding to the preset index includes:
determining the long-term reference value according to the index data in a first preset duration;
and determining the short-term reference value according to the index data in a second preset time period, wherein the first preset time period is longer than the second preset time period.
3. The anomaly determination method according to claim 1, wherein the determining the target reference value of the index data based on the long-term reference value, the short-term reference value, and the offline reference value corresponding to the index based on a preset target reference value determination rule includes:
and according to the first weight corresponding to the long-term reference value, the second weight corresponding to the short-term reference value and the third weight corresponding to the off-line reference value, carrying out weighted summation on the long-term reference value, the short-term reference value and the off-line reference value to obtain the target reference value.
4. The abnormality determination method according to claim 1, characterized in that said determining an abnormality relative value of the index data based on the index data corresponding to the preset index and the target reference value includes:
and determining the abnormal relative value according to the ratio of the target difference value to the target reference value, wherein the target difference value is the difference value between the target reference value and the current index data.
5. The abnormality determination method according to any one of claims 1 to 4, characterized in that said outputting an abnormality alarm according to said abnormality type includes:
and when the accumulated values in a plurality of time windows in the third preset duration are greater than or equal to a preset threshold, merging the abnormal alarms corresponding to the time windows into the same abnormal alarm.
6. The abnormality determination method according to any one of claims 1 to 4, characterized in that said outputting an abnormality alarm according to said abnormality type includes:
if more than two monitoring objects in the fourth preset time period have the abnormal alarms of the same abnormal type, merging the abnormal alarms of the same abnormal type into a high-priority abnormal alarm.
7. The abnormality determination method according to any one of claims 1 to 4, characterized in that the determining the target reference value of the index data based on the long-term reference value, the short-term reference value, and the off-line reference value corresponding to the index based on a preset target reference value determination rule includes:
and determining a target reference value of the index data according to the long-term reference value, the short-term reference value and the off-line reference value corresponding to the index based on a preset reference value updating period.
8. An abnormality determination device, characterized by comprising:
the data acquisition module is used for acquiring a long-term reference value, a short-term reference value and an off-line reference value corresponding to the preset index;
the reference value determining module is used for determining a target reference value of the index data according to a long-term reference value, a short-term reference value and an offline reference value corresponding to the index based on a preset target reference value determining rule;
the relative value determining module is used for determining an abnormal relative value of the index data according to the index data corresponding to the preset index and the target reference value;
the accumulated value determining module is used for obtaining the accumulated value of the abnormal relative value in a preset time window;
the abnormality classification module is used for determining an abnormality type according to an abnormality relative value in the preset time window based on a preset classification model if the accumulated value in the time window is greater than or equal to a preset threshold value;
and the abnormality alarm module is used for outputting an abnormality alarm according to the abnormality type.
9. A computer device comprising a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein the computer program when executed by the processor implements the steps of the anomaly determination method of any one of claims 1 to 7.
10. A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, wherein the computer program, when executed by a processor, implements the steps of the abnormality determination method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310721873.0A CN116702006A (en) | 2023-06-16 | 2023-06-16 | Abnormality determination method, abnormality determination device, computer device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310721873.0A CN116702006A (en) | 2023-06-16 | 2023-06-16 | Abnormality determination method, abnormality determination device, computer device, and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116702006A true CN116702006A (en) | 2023-09-05 |
Family
ID=87827344
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310721873.0A Pending CN116702006A (en) | 2023-06-16 | 2023-06-16 | Abnormality determination method, abnormality determination device, computer device, and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116702006A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117094739A (en) * | 2023-10-16 | 2023-11-21 | 湖南半岛医疗科技有限公司 | Medical consumable counterfeit identification method and device, electronic equipment and readable storage medium |
-
2023
- 2023-06-16 CN CN202310721873.0A patent/CN116702006A/en active Pending
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117094739A (en) * | 2023-10-16 | 2023-11-21 | 湖南半岛医疗科技有限公司 | Medical consumable counterfeit identification method and device, electronic equipment and readable storage medium |
| CN117094739B (en) * | 2023-10-16 | 2024-02-06 | 湖南半岛医疗科技有限公司 | Medical consumable counterfeit identification method and device, electronic equipment and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112162878B (en) | Database fault discovery method and device, electronic equipment and storage medium | |
| CN109815084B (en) | Abnormity identification method and device, electronic equipment and storage medium | |
| CN112188531B (en) | Abnormality detection method, abnormality detection device, electronic apparatus, and computer storage medium | |
| Jiang et al. | An intelligent information forwarder for healthcare big data systems with distributed wearable sensors | |
| US7613668B2 (en) | Anomaly detection system and a method of teaching it | |
| CN108123849B (en) | Method, device, equipment and storage medium for determining threshold value for detecting network flow | |
| CN110083507B (en) | Key performance index classification method and device | |
| CN116702006A (en) | Abnormality determination method, abnormality determination device, computer device, and storage medium | |
| CN114138625A (en) | Method and system for evaluating health state of server, electronic device and storage medium | |
| CN114500339B (en) | Node bandwidth monitoring method and device, electronic equipment and storage medium | |
| CN114301803B (en) | Network quality detection method and device, electronic equipment and storage medium | |
| CN115659411A (en) | Method and device for data analysis | |
| CN113296992A (en) | Method, device, equipment and storage medium for determining abnormal reason | |
| CN113347042A (en) | Data security protection method and server based on digitization and artificial intelligence | |
| CN113592192A (en) | Short-term power load prediction method and device and terminal equipment | |
| CN113468014A (en) | Abnormity detection method and device for operation and maintenance data | |
| CN107204879B (en) | A kind of distributed system adaptive failure detection method based on index rolling average | |
| CN116668264A (en) | Root cause analysis method, device, equipment and storage medium for alarm clustering | |
| CN114861909A (en) | Model quality monitoring method and device, electronic equipment and storage medium | |
| CN115310673A (en) | Navigation risk identification, prevention and control method, system, device and storage medium | |
| CN114358581A (en) | Method and device for determining abnormal threshold of performance index, equipment and storage medium | |
| CN112364900A (en) | Equipment alarm management method, device, client and medium for intelligent building | |
| CN111641535A (en) | Network monitoring method, network monitoring device, electronic equipment and medium | |
| CN115693962B (en) | Substation equipment monitoring method and device, electronic equipment and medium | |
| CN117391261B (en) | AI intelligent water service system of internet of things based on low-power consumption ultrasonic measurement |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |