WO2019020094A1 - 一种指标异常检测方法、装置以及电子设备 - Google Patents

一种指标异常检测方法、装置以及电子设备 Download PDF

Info

Publication number
WO2019020094A1
WO2019020094A1 PCT/CN2018/097338 CN2018097338W WO2019020094A1 WO 2019020094 A1 WO2019020094 A1 WO 2019020094A1 CN 2018097338 W CN2018097338 W CN 2018097338W WO 2019020094 A1 WO2019020094 A1 WO 2019020094A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
window
probability
joint probability
monitoring
Prior art date
Application number
PCT/CN2018/097338
Other languages
English (en)
French (fr)
Inventor
李龙飞
Original Assignee
阿里巴巴集团控股有限公司
李龙飞
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 李龙飞 filed Critical 阿里巴巴集团控股有限公司
Priority to EP18838643.7A priority Critical patent/EP3644186A4/en
Publication of WO2019020094A1 publication Critical patent/WO2019020094A1/zh
Priority to US16/749,772 priority patent/US10860453B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/38—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation
    • G06F7/48—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation using non-contact-making devices, e.g. tube, solid state device; using unspecified devices
    • G06F7/544—Methods or arrangements for performing computations using exclusively denominational number representation, e.g. using binary, ternary, decimal representation using non-contact-making devices, e.g. tube, solid state device; using unspecified devices for evaluating functions by calculation
    • G06F7/556—Logarithmic or exponential functions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N7/00—Computing arrangements based on specific mathematical models
    • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07G—REGISTERING THE RECEIPT OF CASH, VALUABLES, OR TOKENS
    • G07G3/00—Alarm indicators, e.g. bells

Definitions

  • the present specification relates to the field of computer software technologies, and in particular, to a method, device, and electronic device for detecting an abnormality of an index.
  • the monitored indicators may be, for example, the number of payment account theft events triggered per minute, the delay of payment requests per minute, and the like. Further, based on the monitoring data, an abnormality detection may be performed on the monitored indicator. If an abnormality is detected, it may be processed by the operator or the R&D personnel in time to ensure the reliability of the service system.
  • the historical mean and variance of the monitored indicators, as well as jitter are typically used to detect anomalies for a single monitoring point.
  • the embodiment of the present specification provides a method, an apparatus, and an electronic device for detecting an abnormality of an indicator, which are used to solve the following technical problem: a more accurate indicator abnormality detection scheme is needed.
  • the first calculating module calculates, according to the mean value and the variance of the data of the monitoring point, the probability of occurrence of data of each of the monitoring points;
  • the second calculating module calculates, according to the separately calculated probability, a joint probability of occurrence of data of each monitoring point included in the window divided by the time period;
  • the detecting module detects whether the monitored indicator is abnormal according to the joint probability corresponding to each window.
  • At least one processor and,
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:
  • the above at least one technical solution adopted by the embodiment of the present specification can achieve the following beneficial effects: due to the Gaussian model and the window of the plurality of monitoring points including the indicator, the abnormality detection is performed on the indicator, thereby preventing the jitter of the single monitoring point from being misleading Anomaly detection, which in turn facilitates more accurate indicator anomaly detection.
  • FIG. 1 is a schematic diagram of an overall architecture involved in an implementation scenario of the present specification
  • FIG. 2 is a schematic flowchart of a method for detecting an abnormality of an index according to an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of a specific implementation manner of the above-mentioned indicator abnormality detecting method in an actual application scenario according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart diagram of a specific implementation manner of the foregoing abnormality detecting method of an indicator in an actual application scenario provided by an embodiment of the present disclosure
  • FIG. 5 is a schematic structural diagram of an indicator abnormality detecting apparatus corresponding to FIG. 1 according to an embodiment of the present disclosure.
  • the embodiment of the present specification provides a method, an apparatus, and an electronic device for detecting an abnormality of an indicator.
  • FIG. 1 is a schematic diagram of an overall architecture involved in a scenario of the present application in a practical application scenario.
  • the overall architecture (a) there are mainly two parts: the equipment where the monitoring data is located and the equipment where the Gaussian model is located.
  • the device where the monitoring data is located transmits the monitoring data of the monitored indicator to the device where the Gaussian model is located through the network, and the device where the Gaussian model is located can process the monitoring data based on the window and the Gaussian model, and then the indicator abnormality detection can be performed according to the processing result.
  • the monitoring data and the Gaussian model may be on the same device.
  • the overall architecture (b) may be adopted.
  • FIG. 2 is a schematic flowchart diagram of an indicator abnormality detecting method according to an embodiment of the present disclosure, which may be separately performed for each monitored indicator of one or more monitored indicators.
  • Possible execution entities of the process include, but are not limited to, the following devices that can serve as servers or terminals: mobile phones, tablets, smart wearable devices, car machines, personal computers, medium computers, computer clusters, and the like.
  • the process in Figure 2 can include the following steps:
  • S202 Acquire data of each monitoring point included in the monitored indicator for a period of time.
  • a plurality of monitoring points may be included for a period of time.
  • the period of time may include 24 monitoring points; assuming that the period of time is specifically the last hour, each The minutes are each a monitoring point, and the period can contain 60 monitoring points.
  • the monitoring points are not necessarily evenly distributed, for example, it may be relatively dense during the day and relatively sparse in the middle of the night.
  • the data of the monitored indicator at the monitoring point may point to the original monitoring data of the monitored indicator, that is, the value of the monitored indicator obtained at the monitoring point, for example, assuming the number of account stealing events.
  • the monitored indicators obtain 2, 8, and 1 items at three monitoring points included in a period of time, respectively, and 2, 8, and 1 pieces can be used as data corresponding to the monitoring points;
  • the data of the monitoring indicator at the monitoring point may also refer to data obtained by specifically processing the original monitoring data, which may be a scheme for implementing the present specification more efficiently.
  • the specific processing may be a logarithmic process, and the logarithmic processing may be used to convert the original monitoring data into a smaller change, which is beneficial to reducing the adverse effects of single monitoring point jitter on the abnormality detection of the indicator; For example, the above two, eight, and one pieces may be taken as the data of the corresponding monitoring points.
  • the specific processing may be a homogenization process, and the data obtained by processing may be more uniform than the original monitoring data before processing by deleting or adding a part of the data in the original monitoring data.
  • S204 Extract a mean and a variance of data of the monitoring point by using a Gaussian model.
  • the mean and variance of the data of the monitoring point are extracted by using the Gaussian model, and the data of the monitoring point can be estimated by the Gaussian model, and then The mean and variance of the data of the monitoring points are obtained according to the estimated Gaussian model.
  • the Gaussian model may specifically include a Gaussian mixture model.
  • S206 Calculate, according to the mean value and the variance of the data of the monitoring point, the probability of occurrence of data of each of the monitoring points.
  • the probability of occurrence of the corresponding data of each monitoring point can be separately calculated.
  • S208 Calculate a joint probability of occurrence of data of each monitoring point included in the window divided by the time period according to the separately calculated probability.
  • the indicator abnormality detection may not be performed for a single monitoring point, but the indicator abnormality detection may be performed for a window including multiple monitoring points. Specifically, a plurality of windows may be divided for a period of time in step S202. For the divided windows, each monitoring point included in the window is regarded as a whole, and then the monitored indicator is abnormal according to the whole unit. .
  • the joint probability of the corresponding data of each monitoring point in the divided window may be further calculated, and the joint probability may reflect the corresponding The level of monitored indicators in the window relative to other windows.
  • S210 Detect whether the monitored indicator is abnormal according to the joint probability corresponding to each window.
  • the probability of occurrence of the joint probability corresponding to each window may be further calculated as the abnormality detection basis of the monitored indicator.
  • the abnormality detection is performed on the indicator based on the Gaussian model and the window of the plurality of monitoring points including the indicator, thereby preventing the jitter misdirection abnormality detection of the single monitoring point, thereby facilitating more accurate indexing. abnormal detection.
  • the embodiments of the present specification further provide some specific implementations of the method, and an extended solution, which will be described below.
  • the data of the monitored indicator at the corresponding monitoring point is obtained, and in step S202, the monitoring data of the monitored indicator is obtained for a period of time.
  • the method may be: obtaining original monitoring data of each monitored point included in the monitored indicator for a period of time; and performing logarithm processing on the original monitoring data, as the monitored indicator is included in the period of time
  • the data of each monitoring point is used for the abnormality detection of the indicator.
  • each window may be first divided, and the corresponding joint probability may be separately calculated, or the joint probability corresponding to the currently divided window may be calculated while dividing the window.
  • the joint probability of occurrence of data of each monitoring point included in the window divided by the time period is calculated according to the separately calculated probability.
  • the method may include: determining a plurality of different windows divided by the time period; respectively calculating, for each window, a probability according to the data of the separately calculated probabilities corresponding to each of the monitoring points included in the window The joint probability of the occurrence of data for each of the monitoring points contained in the window.
  • the plurality of different windows preferably may completely cover the period of time.
  • the specific manner of window division may be various.
  • the window can be divided according to the set time interval, or the window can be divided according to the business characteristics (for example, account level, region, etc.).
  • Dividing a plurality of different windows by the period of time may include, for example, dividing a plurality of different windows by the time period according to the set time interval and the window length, wherein a starting time of the adjacent window is different Time interval.
  • the period of time is 1000 minutes
  • the set time interval is 5 minutes
  • the window length is 10 minutes.
  • divide the 1st to 10th minutes into a window divide the 5th to 15th minutes into one window
  • divide the 10th to 20th minutes into one window divide the 15th to 25th minutes into one window, and so on.
  • adjacent windows overlap, which is not necessary in practical applications, and the time interval and window length may not be fixed.
  • the step of detecting, according to the joint probability corresponding to each of the windows, whether the monitored indicator is abnormal may include: the joint corresponding to each of the windows. Probabilistically extracting a mean and a variance of the joint probability using a Gaussian model; calculating, according to the mean and variance of the joint probability, a probability of occurrence of the joint probability corresponding to each window; and the joint probability corresponding to the window The probability of occurrence, detecting whether the monitored indicator is abnormal.
  • the Gaussian model can be used again here.
  • the main difference between the two uses is that the Gaussian model used here is for the window, and the Gaussian model used in step S204 is for the monitoring point.
  • the detecting whether the monitored indicator is abnormal according to the probability of occurrence of the joint probability corresponding to the window may specifically include: according to the mean and variance of the joint probability, and the corresponding according to the window The probability of occurrence of the joint probability is detected by the 3 ⁇ criterion whether the monitored indicator is abnormal in the window.
  • the probability of occurrence of the joint probability deviates from the above-mentioned calculated standard deviation of the joint probability by three standard deviations (the standard deviation is the square root of the variance of the joint probability calculated above), it can be considered that The monitored indicator has an exception in the corresponding window.
  • the threshold of the joint probability and/or the threshold of the probability of the joint probability appearing may be artificially set to detect the window of the abnormality, and it is not necessary to utilize the 3 ⁇ criterion.
  • the embodiment of the present specification further provides a specific implementation manner of the foregoing indicator abnormality detecting method in an actual application scenario, which is described in conjunction with FIG. 3 and FIG. 4.
  • Figure 3 is a schematic illustration of the principles of this particular embodiment. 4 is a flow chart showing the specific embodiment of FIG. 3.
  • the box in FIG. 3 represents the current window, and the circle in the box represents the monitoring point.
  • the flow in FIG. 4 may include the following steps:
  • S402 Acquire original monitoring data of a monitored indicator, and perform logarithmic processing to obtain monitoring data.
  • S404 Extract a mean value ⁇ 1 and a variance ⁇ 1 of data of each monitoring point by using a Gaussian model for the monitoring data;
  • S406 Calculate a probability of occurrence of data of each monitoring point according to ⁇ 1 and ⁇ 1 respectively;
  • S408 Calculate, according to the probability of occurrence of data of each monitoring point separately calculated, a joint probability of occurrence of data of each monitoring point included in the window;
  • S412 Calculate a probability of occurrence of a joint probability corresponding to the window according to ⁇ 2 and ⁇ 2 ;
  • S414 Calculating whether the probability of occurrence of joint probability corresponding to the window is deviated from ⁇ 2 by using the 3 ⁇ criterion If yes, it is detected that the monitored indicator has an abnormality in the window.
  • the probability p(X) of the joint probability corresponding to the current window can be calculated by the following formula:
  • ⁇ 1 represents the square root of the operand of ⁇ 1
  • ⁇ 2 represents the square root of the operand of ⁇ 2
  • k represents the number of monitoring points contained in the current window
  • ⁇ 1 , ⁇ 1 ) represents the ith monitoring of the current window
  • each window contains 6 monitoring points, as shown in Figure 3.
  • the original monitoring data of the current window corresponding to each monitoring point are: 2 pieces, 8 pieces, 1 piece, 20 pieces, 1 piece, 1 piece; the logarithm of the original monitoring data of the current window is taken (assuming natural pairing is adopted)
  • the data is processed to obtain the data of the monitoring points included in the current window, which are: In2, In8, 0, In20, 0, 0.
  • the logarithmic processing may be performed to obtain data of each monitoring point included in the monitored indicator at the time; further, the mean and variance of the data of the monitoring point may be extracted by using a Gaussian model, and the current formula 1 is used to calculate the current The probability of occurrence of the joint probability corresponding to the window, and using the 3 ⁇ criterion to detect whether the monitored indicator has an abnormality in the current window. According to this scheme, it is possible to separately check whether any of the windows of the monitored indicator divided by the period of time has an abnormality.
  • index anomaly detection scheme based on window and Gaussian model, it is beneficial to reduce false positives and improve the accuracy of detection results.
  • the embodiment of the present specification further provides a corresponding device, as shown in FIG.
  • FIG. 5 is a schematic structural diagram of an indicator abnormality detecting apparatus corresponding to FIG. 2 according to an embodiment of the present disclosure.
  • the dotted line box indicates an optional module, and the apparatus may be located on the execution body of the process in FIG. 2, and includes:
  • the obtaining module 501 is configured to obtain data of each monitoring point included in the monitored indicator for a period of time, where the monitoring period includes multiple monitoring points;
  • An extraction module 502 using a Gaussian model to extract a mean and a variance of data of the monitoring point;
  • the first calculating module 503 is configured to calculate, according to the mean value and the variance of the data of the monitoring point, the probability of occurrence of data of each of the monitoring points;
  • the second calculating module 504 is configured to calculate a joint probability of occurrence of data of each monitoring point included in the window divided by the time period according to the separately calculated probability;
  • the detecting module 505 is configured to detect whether the monitored indicator is abnormal according to the joint probability corresponding to each window.
  • the device further includes:
  • the logarithm module 506 obtains the original monitoring data of each monitoring point included in the monitored indicator for a period of time before the acquiring module 501 acquires the data of the monitoring points included in the monitoring index for a period of time. After the logarithmic processing of the original monitoring data, the data of each monitoring point included in the monitored indicator for the period of time is used for the abnormality detection of the indicator.
  • the second calculating module 504 calculates, according to the separately calculated probability, a joint probability of occurrence of data of each monitoring point included in the window divided by the time period, specifically:
  • the second calculating module 504 determines a plurality of different windows divided by the time period
  • a joint probability of occurrence of data of each of the monitoring points included in the window is calculated according to a probability of data corresponding to each of the monitoring points included in the window among the separately calculated probabilities.
  • dividing the plurality of different windows by the time period includes:
  • a plurality of different windows are divided by the time period, wherein the starting moments of the adjacent windows differ by the time interval.
  • the detecting module 505 is configured to detect whether the monitored indicator is abnormal according to the joint probability corresponding to each of the windows, and specifically includes:
  • the detecting module 505 extracts a mean and a variance of the joint probability using a Gaussian model for the joint probability corresponding to each of the windows;
  • the detecting module 505 is configured to detect whether the monitored indicator is abnormal according to the probability of occurrence of the joint probability corresponding to the window, and specifically includes:
  • the detecting module 505 uses the 3 ⁇ criterion to detect whether the monitored indicator is abnormal in the window according to the mean and variance of the joint probability and the probability of occurrence of the joint probability according to the window.
  • the Gaussian model comprises a Gaussian mixture model.
  • At least one processor and,
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:
  • the embodiment of the present specification further provides a corresponding non-volatile computer storage medium, where computer executable instructions are stored, and the computer executable instructions are set as:
  • the device, the electronic device, the non-volatile computer storage medium and the method provided by the embodiments of the present specification are corresponding, and therefore, the device, the electronic device, the non-volatile computer storage medium also have a beneficial technical effect similar to the corresponding method,
  • the beneficial technical effects of the method have been described in detail above, and therefore, the beneficial technical effects of the corresponding device, the electronic device, and the non-volatile computer storage medium will not be described herein.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • computer readable program code eg, software or firmware
  • examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding.
  • Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component.
  • a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.
  • the system, device, module or unit illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.
  • a typical implementation device is a computer.
  • the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • embodiments of the specification can be provided as a method, system, or computer program product.
  • embodiments of the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware.
  • embodiments of the present specification can take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.

Abstract

一种指标异常检测方法、装置以及电子设备。所述方法包括：基于高斯模型和包含指标的多个监控点的窗口，对该指标进行异常检测。

Description

一种指标异常检测方法、装置以及电子设备 技术领域
本说明书涉及计算机软件技术领域，尤其涉及一种指标异常检测方法、装置以及电子设备。
背景技术
随着计算机和互联网技术的迅速发展，很多业务都可以在网上进行，这给用户带来了便利，也对相应的各种业务系统的可靠性提出了较高的要求。
一般地，可以对业务系统中的一些比较重要的指标进行监控。以第三方支付系统为例，被监控指标比如可以是：每分钟触发的支付账户盗用事件数量、每分钟的支付请求时延等。进而，可以基于监控数据，对被监控指标进行异常检测，若检测出异常，则可以由运营人员或者研发人员及时处理，以保证业务系统的可靠性。
在现有技术中，通常针对单个监控点，使用被监控指标的历史均值和方差，以及抖动来检测异常。
基于现有技术，需要更准确的指标异常检测方案。
发明内容
本说明书实施例提供一种指标异常检测方法、装置以及电子设备，用以解决如下技术问题：需要更准确的指标异常检测方案。
为解决上述技术问题，本说明书实施例是这样实现的：
本说明书实施例提供的一种指标异常检测方法，包括：
获取被监控指标在一段时间包含的各监控点的数据；
使用高斯模型提取所述监控点的数据的均值和方差；
根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现 的概率；
根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
本说明书实施例提供的一种指标异常检测装置，包括：
获取模块，获取被监控指标在一段时间包含的各监控点的数据；
提取模块，使用高斯模型提取所述监控点的数据的均值和方差；
第一计算模块，根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
第二计算模块，根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
检测模块，根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
本说明书实施例提供的一种电子设备，包括：
至少一个处理器；以及，
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
获取被监控指标在一段时间包含的各监控点的数据；
使用高斯模型提取所述监控点的数据的均值和方差；
根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
本说明书实施例采用的上述至少一个技术方案能够达到以下有益效果：由 于基于高斯模型和包含指标的多个监控点的窗口，对该指标进行异常检测，因此，有利于防止单个监控点的抖动误导异常检测，进而有利于更准确地进行指标异常检测。
附图说明
为了更清楚地说明本说明书实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本说明书中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本说明书的方案在一种实际应用场景下涉及的一种整体架构示意图；
图2为本说明书实施例提供的一种指标异常检测方法的流程示意图；
图3为本说明书实施例提供的一种实际应用场景下，上述指标异常检测方法的一种具体实施方案的原理示意图；
图4本说明书实施例提供的一种实际应用场景下，上述指标异常检测方法的一种具体实施方案的流程示意图；
图5为本说明书实施例提供的对应于图1的一种指标异常检测装置的结构示意图。
具体实施方式
本说明书实施例提供一种指标异常检测方法、装置以及电子设备。
为了使本技术领域的人员更好地理解本说明书中的技术方案，下面将结合本说明书实施例中的附图，对本说明书实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本说明书实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
图1为本说明书的方案在一种实际应用场景下涉及的整体架构示意图。在整体架构(a)中，主要涉及两部分：监控数据所在设备、高斯模型所在设备。监控数据所在设备通过网络，将被监控指标的监控数据发送给高斯模型所在设备，高斯模型所在设备可以基于窗口和高斯模型对监控数据进行处理，进而可以根据处理结果进行指标异常检测。需要说明的是，在实际应用中，监控数据和高斯模型可能处于同一设备上，在这种情况下，可以采用整体架构(b)。
基于以上整体架构，下面对本说明书的方案进行详细说明。
图2为本说明书实施例提供的一种指标异常检测方法的流程示意图，可以针对一个或多个被监控指标中的每个被监控指标分别执行该流程。该流程可能的执行主体包括但不限于可作为服务器或者终端的以下设备：手机、平板电脑、智能可穿戴设备、车机、个人计算机、中型计算机、计算机集群等。
图2中的流程可以包括以下步骤：
S202：获取被监控指标在一段时间包含的各监控点的数据。
在本说明书实施例中，一段时间可以包含多个监控点。
以被监控指标是每分钟触发的支付账户盗用事件数量为例。假定所述一段时间具体为最近的一天，且每个整点的第一分钟分别为一个监控点，则该一段时间可以包含24个监控点；假定所述一段时间具体为最近的一小时，每分钟分别为一个监控点，则该一段时间可以包含60个监控点。
另外，在实际应用中，监控点未必要均匀分布，比如，可能白天相对密集，半夜相对稀疏。
在本说明书实施例中，被监控指标在监控点的数据可以指针对被监控指标的原始监控数据，也即，在监控点获取的被监控指标的取值，比如，假定支付账户盗用事件数量这个被监控指标在一段时间包含的其中三个监控点获取的取值分别为2件、8件、1件，则可以将2件、8件、1件作为对应的所述监控点的数据；被监控指标在监控点的数据也可以指对原始监控数据进行特定处理得到的数据，所述特定处理可以是为了更有效地实施本说明书的方案。
例如，所述特定处理可以是取对数处理，通过取对数处理，可以将原始监控数据转化到一个更小的变化中，有利于降低单个监控点抖动给指标异常检测带来的不利影响；比如，可以将上述的2件、8件、1件取对数后作为对应的所述监控点的数据。
又例如，所述特定处理可以是均匀化处理，可以通过在原始监控数据中删除或增加一部分数据，以使处理得到的数据比处理前的原始监控数据更加均匀。
S204：使用高斯模型提取所述监控点的数据的均值和方差。
在本说明书实施例中，可以假定各监控点对应数据服从高斯分布，并基于这样的假定，使用高斯模型提取监控点的数据的均值和方差，具体可以高斯模型对监控点的数据进行估计，再根据估计后的高斯模型得到监控点的数据的均值和方差。所述高斯模型具体可以包括高斯混合模型。
S206：根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率。
在本说明书实施例中，利用监控点的数据的均值和方差，以及提取监控点的数据的均值和方差所使用的高斯模型，可以分别计算各监控点对应数据出现的概率。
S208：根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率。
在本说明书实施例中，可以不针对单个监控点进行指标异常检测，而是可以针对包含多个监控点的窗口进行指标异常检测。具体地，可以针对步骤S202中的一段时间划分出多个窗口，对于划分出的窗口，将该窗口包含的各监控点视为一个整体，进而以所述整体为单位，检测被监控指标是否异常。
在本说明书实施例中，基于已分别计算出的各监控点对应数据出现的概率，可以进一步地计算划分出的窗口内的各监控点对应数据出现的联合概率，该联合概率可以反映其对应的窗口内被监控指标相对于其他窗口的水平。
S210：根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
在本发明实施例中，根据各所述窗口对应的联合概率，可以进一步地计算各窗口对应的联合概率出现的概率，以作为被监控指标的异常检测依据。
通过图2的方法，由于基于高斯模型和包含指标的多个监控点的窗口，对该指标进行异常检测，因此，有利于防止单个监控点的抖动误导异常检测，进而有利于更准确地进行指标异常检测。
基于图2的方法，本说明书实施例还提供了该方法的一些具体实施方案，以及扩展方案，下面进行说明。
在本说明书实施例中，假定预先对原始监控数据进行了取对数处理后，得到被监控指标在相应的监控点的数据，则对于步骤S202，所述获取被监控指标一段时间内的监控数据前，可以执行：获取所述被监控指标在一段时间包含的各监控点的原始监控数据；对所述原始监控数据进行取对数处理后，作为所述被监控指标在所述一段时间包含的各监控点的数据，以用于所述指标异常检测。
在本说明书实施例中，可以先划分好各窗口，再分别计算对应的联合概率，也可以一边划分窗口，一边计算当前划分出的窗口对应的联合概率。
以上一段中的前一种方式为例，对于步骤S208，所述根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率，具体可以包括：确定由所述一段时间划分出的多个不同的窗口；分别针对每个窗口，根据所述分别计算的概率中对应于该窗口包含的各所述监控点的数据的概率，计算该窗口包含的各所述监控点的数据出现的联合概率。
其中，所述多个不同的窗口优选地可以完整覆盖所述一段时间。
在本说明书实施例中，窗口划分的具体方式可以有多种。比如，可以按照设定的时间间隔划分窗口，也可以按照业务特性(比如，账户等级、地域等)划分窗口。
以按照设定的时间间隔划分窗口为例。由所述一段时间划分出多个不同的窗口比如可以包括：根据设定的时间间隔和窗口长度，由所述一段时间划分出多个不同的窗口，其中，相邻窗口的起始时刻相差所述时间间隔。
更具体地，例如，假定所述一段时间为1000分钟，设定的时间间隔为5分钟，窗口长度为10分钟。则将第1～10分钟划分为一个窗口，将第5～15分钟划分为一个窗口，将第10～20分钟划分为一个窗口，将第15～25分钟划分为一个窗口，等等，以此类推，可以划分出199个窗口。在该例中，相邻的窗口有重叠，在实际应用中，这并不是必须的，而且，时间间隔和窗口长度也可以不固定。
在本说明书实施例中，对于步骤S210，所述根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常，具体可以包括：对所述各所述窗口对应的所述联合概率使用高斯模型提取所述联合概率的均值和方差；根据所述联合概率的均值和方差，分别计算各所述窗口对应的所述联合概率出现的概率；根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常。
可以看到，这里可以又一次使用高斯模型，两次使用主要的不同之处在于：这里使用的高斯模型是针对窗口的，而步骤S204中使用的高斯模型是针对监控点的。
在本说明书实施例中，根据联合概率出现的概率的高低程度，可以检测被监控指标在该联合概率对应的窗口内是否异常。
例如，所述根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常，具体可以包括：根据所述联合概率的均值和方差，以及所述根据所述窗口对应的所述联合概率出现的概率，利用3σ准则检测所述被监控指标在所述窗口内是否异常。
更具体地，根据3σ准则，若联合概率出现的概率偏离上面计算出的联合概率的均值上下3个标准差(该标准差为上面计算出的联合概率的方差的算数 平方根)，则可以认为对应的被监控指标在对应窗口内存在异常。
需要说明的是，在实际应用中，也可以人为设定联合概率的阈值和/或联合概率出现的概率的阈值，用以检测异常的窗口，而未必要利用3σ准则。
在检测出异常的窗口后，还可以采取特定措施，进一步地分析该窗口中的主要由哪些监控点导致该异常，如此，有利于后续更精准和有效地解决相关的业务系统问题。
基于上面的说明，本说明书实施例还提供了一种实际应用场景下，上述指标异常检测方法的一种具体实施方案，结合图3、图4进行说明。
图3为该具体实施方案的原理示意图。图4为对照图3的该具体实施方案的流程示意图。
图3中的方框表示当前窗口，方框中的圆圈表示监控点，对照图3，图4中的流程可以包括以下步骤：
S402：获取某被监控指标的原始监控数据，并进行取对数处理，得到监控数据；
S404：对监控数据使用高斯模型提取各监控点的数据的均值μ 1和方差Δ 1；
S406：根据μ 1和Δ 1，分别计算各监控点的数据出现的概率；
S408：根据分别计算的各监控点的数据出现的概率，计算窗口包含的各监控点的数据出现的联合概率；
S410：计算联合概率的均值μ 2和方差Δ 2；
S412：根据μ 2和Δ 2，计算窗口对应的联合概率出现的概率；
S414：利用3σ准则计算窗口对应的联合概率出现的概率是否偏离μ 2上下三个
Figure PCTCN2018097338-appb-000001
，若是，则检测出该被监控指标在该窗口内存在异常。
为了便于理解，可以用以下公式计算当前窗口对应的联合概率出现的概率p(X)：
Figure PCTCN2018097338-appb-000002
其中，σ 1表示Δ 1的算数平方根，σ 2表示Δ 2的算数平方根，k表示当前窗口包含的监控点数量，p(x i|μ 1,σ 1)表示当前窗口包含的第i个监控点的数据出现的概率，
Figure PCTCN2018097338-appb-000003
表示当前窗口包含的k个监控点的数据出现的联合概率。
若p(X)偏离μ 2上下三个σ 2，则可以认为该被监控指标在当前窗口内存在异常。
仍以被监控指标是每分钟触发的支付账户盗用事件数量为例。将一段时间内的每6分钟划分为一个窗口，每个窗口里包含6个监控点，正如图3所示。
假定当前窗口的对应于各监控点的原始监控数据分别为：2件、8件、1件、20件、1件、1件；对当前窗口的原始监控数据进行取对数(假定采用自然对数)处理，得到被监控指标在当前窗口包含的各监控点的数据，分别为：In2、In8、0、In20、0、0。
类似地，可以通过取对数处理，得到被监控指标在该段时间包含的各监控点的数据；进而，可以使用高斯模型提取监控点的数据的均值和方差，以及利用上述的公式一计算当前窗口对应的联合概率出现的概率，并利用3σ准则检测被监控指标在当前窗口是否存在异常。按照这种方案可以分别检查出被监控指标在由该段时间划分出的任一窗口是否存在异常。
通过基于窗口和高斯模型的指标异常检测方案，有利于减少误报，提高检测结果的准确性。
基于同样的思路，本说明书实施例还提供了对应的装置，如图5所示。
图5为本说明书实施例提供的对应于图2的一种指标异常检测装置的结构示意图，虚线方框表示可选的模块，该装置可以位于图2中流程的执行主体上，包括：
获取模块501，获取被监控指标在一段时间包含的各监控点的数据，所述一段时间内包含多个监控点；
提取模块502，使用高斯模型提取所述监控点的数据的均值和方差；
第一计算模块503，根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
第二计算模块504，根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
检测模块505，根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
可选地，所述装置还包括：
取对数模块506，在所述获取模块501获取被监控指标在一段时间包含的各监控点的数据前，获取所述被监控指标在一段时间包含的各监控点的原始监控数据，对所述原始监控数据进行取对数处理后，作为所述被监控指标在所述一段时间包含的各监控点的数据，以用于所述指标异常检测。
可选地，所述第二计算模块504根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率，具体包括：
所述第二计算模块504确定由所述一段时间划分出的多个不同的窗口；
分别针对每个窗口，根据所述分别计算的概率中对应于该窗口包含的各所述监控点的数据的概率，计算该窗口包含的各所述监控点的数据出现的联合概率。
可选地，由所述一段时间划分出多个不同的窗口包括：
根据设定的时间间隔和窗口长度，由所述一段时间划分出多个不同的窗口，其中，相邻窗口的起始时刻相差所述时间间隔。
可选地，所述检测模块505根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常，具体包括：
所述检测模块505对所述各所述窗口对应的所述联合概率使用高斯模型提取所述联合概率的均值和方差；
根据所述联合概率的均值和方差，分别计算各所述窗口对应的所述联合概率出现的概率；
根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常。
可选地，所述检测模块505根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常，具体包括：
所述检测模块505根据所述联合概率的均值和方差，以及所述根据所述窗口对应的所述联合概率出现的概率，利用3σ准则检测所述被监控指标在所述窗口内是否异常。
可选地，所述高斯模型包括高斯混合模型。
基于同样的思路，本说明书实施例还提供了对应的一种电子设备，包括：
至少一个处理器；以及，
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
获取被监控指标在一段时间包含的各监控点的数据；
使用高斯模型提取所述监控点的数据的均值和方差；
根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
基于同样的思路，本说明书实施例还提供了对应的一种非易失性计算机存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为：
获取被监控指标在一段时间包含的各监控点的数据；
使用高斯模型提取所述监控点的数据的均值和方差；
根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置、电子设备、非易失性计算机存储介质实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本说明书实施例提供的装置、电子设备、非易失性计算机存储介质与方法是对应的，因此，装置、电子设备、非易失性计算机存储介质也具有与对应方法类似的有益技术效果，由于上面已经对方法的有益技术效果进行了详细说明，因此，这里不再赘述对应装置、电子设备、非易失性计算机存储介质的有益技术效果。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设 计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件 部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本说明书实施例可提供为方法、系统、或计算机程序产品。因此，本说明书实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本说明书实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书是参照根据本说明书实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使 得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本说明书可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型 的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本说明书实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (15)

  1. 一种指标异常检测方法，包括：
    获取被监控指标在一段时间包含的各监控点的数据；
    使用高斯模型提取所述监控点的数据的均值和方差；
    根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
    根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
    根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
  2. 如权利要求1所述的方法，所述获取被监控指标在一段时间包含的各监控点的数据前，所述方法还包括：
    获取所述被监控指标在一段时间包含的各监控点的原始监控数据；
    对所述原始监控数据进行取对数处理后，作为所述被监控指标在所述一段时间包含的各监控点的数据，以用于所述指标异常检测。
  3. 如权利要求1所述的方法，所述根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率，具体包括：
    确定由所述一段时间划分出的多个不同的窗口；
    分别针对每个窗口，根据所述分别计算的概率中对应于该窗口包含的各所述监控点的数据的概率，计算该窗口包含的各所述监控点的数据出现的联合概率。
  4. 如权利要求3所述的方法，由所述一段时间划分出多个不同的窗口包括：
    根据设定的时间间隔和窗口长度，由所述一段时间划分出多个不同的窗口，其中，相邻窗口的起始时刻相差所述时间间隔。
  5. 如权利要求1所述的方法，所述根据各所述窗口对应的所述联合概率， 检测所述被监控指标是否异常，具体包括：
    对所述各所述窗口对应的所述联合概率使用高斯模型提取所述联合概率的均值和方差；
    根据所述联合概率的均值和方差，分别计算各所述窗口对应的所述联合概率出现的概率；
    根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常。
  6. 如权利要求5所述的方法，所述根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常，具体包括：
    根据所述联合概率的均值和方差，以及所述根据所述窗口对应的所述联合概率出现的概率，利用3σ准则检测所述被监控指标在所述窗口内是否异常。
  7. 如权利要求1～6任一项所述的方法，所述高斯模型包括高斯混合模型。
  8. 一种指标异常检测装置，包括：
    获取模块，获取被监控指标在一段时间包含的各监控点的数据；
    提取模块，使用高斯模型提取所述监控点的数据的均值和方差；
    第一计算模块，根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
    第二计算模块，根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
    检测模块，根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
  9. 如权利要求8所述的装置，所述装置还包括：
    取对数模块，在所述获取模块获取被监控指标在一段时间包含的各监控点的数据前，获取所述被监控指标在一段时间包含的各监控点的原始监控数据，对所述原始监控数据进行取对数处理后，作为所述被监控指标在所述一段时间包含的各监控点的数据，以用于所述指标异常检测。
  10. 如权利要求8所述的装置，所述第二计算模块根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率，具体包括：
    所述第二计算模块确定由所述一段时间划分出的多个不同的窗口；
    分别针对每个窗口，根据所述分别计算的概率中对应于该窗口包含的各所述监控点的数据的概率，计算该窗口包含的各所述监控点的数据出现的联合概率。
  11. 如权利要求10所述的装置，由所述一段时间划分出多个不同的窗口包括：
    根据设定的时间间隔和窗口长度，由所述一段时间划分出多个不同的窗口，其中，相邻窗口的起始时刻相差所述时间间隔。
  12. 如权利要求8所述的装置，所述检测模块根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常，具体包括：
    所述检测模块对所述各所述窗口对应的所述联合概率使用高斯模型提取所述联合概率的均值和方差；
    根据所述联合概率的均值和方差，分别计算各所述窗口对应的所述联合概率出现的概率；
    根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常。
  13. 如权利要求12所述的装置，所述检测模块根据所述窗口对应的所述联合概率出现的概率，检测所述被监控指标是否异常，具体包括：
    所述检测模块根据所述联合概率的均值和方差，以及所述根据所述窗口对应的所述联合概率出现的概率，利用3σ准则检测所述被监控指标在所述窗口内是否异常。
  14. 如权利要求8～13任一项所述的装置，所述高斯模型包括高斯混合模型。
  15. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够：
    获取被监控指标在一段时间包含的各监控点的数据；
    使用高斯模型提取所述监控点的数据的均值和方差；
    根据所述监控点的数据的均值和方差，分别计算各所述监控点的数据出现的概率；
    根据所述分别计算的概率，计算由所述一段时间划分出的窗口包含的各所述监控点的数据出现的联合概率；
    根据各所述窗口对应的所述联合概率，检测所述被监控指标是否异常。
PCT/CN2018/097338 2017-07-28 2018-07-27 一种指标异常检测方法、装置以及电子设备 WO2019020094A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18838643.7A EP3644186A4 (en) 2017-07-28 2018-07-27 METHOD, DEVICE AND ELECTRONIC DEVICE FOR DETECTING INDICATOR ABNORMALITIES
US16/749,772 US10860453B2 (en) 2017-07-28 2020-01-22 Index anomaly detection method and apparatus, and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710629717.6A CN107526667B (zh) 2017-07-28 2017-07-28 一种指标异常检测方法、装置以及电子设备
CN201710629717.6 2017-07-28

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/749,772 Continuation US10860453B2 (en) 2017-07-28 2020-01-22 Index anomaly detection method and apparatus, and electronic device

Publications (1)

Publication Number Publication Date
WO2019020094A1 true WO2019020094A1 (zh) 2019-01-31

Family

ID=60680373

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/097338 WO2019020094A1 (zh) 2017-07-28 2018-07-27 一种指标异常检测方法、装置以及电子设备

Country Status (5)

Country Link
US (1) US10860453B2 (zh)
EP (1) EP3644186A4 (zh)
CN (1) CN107526667B (zh)
TW (1) TWI709931B (zh)
WO (1) WO2019020094A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110399268A (zh) * 2019-07-26 2019-11-01 阿里巴巴集团控股有限公司 一种异常数据检测的方法、装置及设备
CN110796497A (zh) * 2019-10-31 2020-02-14 支付宝(杭州)信息技术有限公司 检测异常操作行为的方法以及装置
CN112241351A (zh) * 2020-09-30 2021-01-19 中国银联股份有限公司 数据处理方法、装置、设备和介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107526667B (zh) * 2017-07-28 2020-04-28 阿里巴巴集团控股有限公司 一种指标异常检测方法、装置以及电子设备
CN110135445A (zh) * 2018-02-02 2019-08-16 兴业数字金融服务（上海）股份有限公司 用于监控应用的状态的方法和装置
CN108984376B (zh) * 2018-05-31 2021-11-19 创新先进技术有限公司 一种系统异常检测方法、装置及设备
CN109101390B (zh) * 2018-06-29 2021-08-24 平安科技（深圳）有限公司 基于高斯分布的定时任务异常监控方法、电子装置及介质
TWI749416B (zh) * 2019-11-29 2021-12-11 中國鋼鐵股份有限公司 變轉速設備異常監診方法
CN111626842A (zh) * 2020-04-22 2020-09-04 北京芯盾时代科技有限公司 一种消费行为数据的分析方法和装置
CN113672446B (zh) * 2020-05-14 2023-09-15 百度在线网络技术（北京）有限公司 监控参数确定方法、装置、设备以及存储介质
CN112498419B (zh) * 2020-11-25 2022-09-09 中铁第四勘察设计院集团有限公司 一种加密方法、装置、设备和存储介质
CN112950085B (zh) * 2021-04-07 2024-03-26 江苏大势航空科技有限公司 无人机集群监测方法、计算机存储介质及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645884A (zh) * 2009-08-26 2010-02-10 西安理工大学 基于相对熵理论的多测度网络异常检测方法
CN102957579A (zh) * 2012-09-29 2013-03-06 北京邮电大学 一种网络异常流量监测方法及装置
CN103974311A (zh) * 2014-05-21 2014-08-06 哈尔滨工业大学 基于改进高斯过程回归模型的状态监测数据流异常检测方法
CN104348810A (zh) * 2013-08-05 2015-02-11 深圳市腾讯计算机系统有限公司 被盗帐号的检测方法、装置及系统
US20150269050A1 (en) * 2014-03-18 2015-09-24 Microsoft Corporation Unsupervised anomaly detection for arbitrary time series
CN107526667A (zh) * 2017-07-28 2017-12-29 阿里巴巴集团控股有限公司 一种指标异常检测方法、装置以及电子设备

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0354638A (ja) * 1989-07-21 1991-03-08 Nec Field Service Ltd 命令再試行処理方式
US7539597B2 (en) * 2001-04-10 2009-05-26 Smartsignal Corporation Diagnostic systems and methods for predictive condition monitoring
US7930593B2 (en) * 2008-06-23 2011-04-19 Hewlett-Packard Development Company, L.P. Segment-based technique and system for detecting performance anomalies and changes for a computer-based service
US20110172916A1 (en) * 2010-01-14 2011-07-14 Qualcomm Incorporated Mobile Device Positioning In A Constrained Environment
CN102937930B (zh) * 2012-09-29 2016-05-18 重庆新媒农信科技有限公司 应用程序监控系统及方法
CN103218628A (zh) * 2013-03-22 2013-07-24 中国科学技术大学 一种基于团块与轨迹特征的异常行为描述方法
US20160062950A1 (en) * 2014-09-03 2016-03-03 Google Inc. Systems and methods for anomaly detection and guided analysis using structural time-series models
US10061632B2 (en) * 2014-11-24 2018-08-28 Anodot Ltd. System and method for transforming observed metrics into detected and scored anomalies
CN105827472B (zh) * 2015-01-04 2019-08-20 华为技术有限公司 网络数据流类型检测方法及装置
US10261851B2 (en) * 2015-01-23 2019-04-16 Lightbend, Inc. Anomaly detection using circumstance-specific detectors
US10303539B2 (en) * 2015-02-23 2019-05-28 International Business Machines Corporation Automatic troubleshooting from computer system monitoring data based on analyzing sequences of changes
US11277420B2 (en) * 2017-02-24 2022-03-15 Ciena Corporation Systems and methods to detect abnormal behavior in networks
US10635565B2 (en) * 2017-10-04 2020-04-28 Servicenow, Inc. Systems and methods for robust anomaly detection
US20190334759A1 (en) * 2018-04-26 2019-10-31 Microsoft Technology Licensing, Llc Unsupervised anomaly detection for identifying anomalies in data

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645884A (zh) * 2009-08-26 2010-02-10 西安理工大学 基于相对熵理论的多测度网络异常检测方法
CN102957579A (zh) * 2012-09-29 2013-03-06 北京邮电大学 一种网络异常流量监测方法及装置
CN104348810A (zh) * 2013-08-05 2015-02-11 深圳市腾讯计算机系统有限公司 被盗帐号的检测方法、装置及系统
US20150269050A1 (en) * 2014-03-18 2015-09-24 Microsoft Corporation Unsupervised anomaly detection for arbitrary time series
CN103974311A (zh) * 2014-05-21 2014-08-06 哈尔滨工业大学 基于改进高斯过程回归模型的状态监测数据流异常检测方法
CN107526667A (zh) * 2017-07-28 2017-12-29 阿里巴巴集团控股有限公司 一种指标异常检测方法、装置以及电子设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3644186A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110399268A (zh) * 2019-07-26 2019-11-01 阿里巴巴集团控股有限公司 一种异常数据检测的方法、装置及设备
CN110399268B (zh) * 2019-07-26 2023-09-26 创新先进技术有限公司 一种异常数据检测的方法、装置及设备
CN110796497A (zh) * 2019-10-31 2020-02-14 支付宝(杭州)信息技术有限公司 检测异常操作行为的方法以及装置
CN112241351A (zh) * 2020-09-30 2021-01-19 中国银联股份有限公司 数据处理方法、装置、设备和介质
CN112241351B (zh) * 2020-09-30 2023-12-22 中国银联股份有限公司 数据处理方法、装置、设备和介质

Also Published As

Publication number Publication date
EP3644186A1 (en) 2020-04-29
CN107526667A (zh) 2017-12-29
US10860453B2 (en) 2020-12-08
EP3644186A4 (en) 2020-06-03
TWI709931B (zh) 2020-11-11
CN107526667B (zh) 2020-04-28
TW201911173A (zh) 2019-03-16
US20200159637A1 (en) 2020-05-21

Similar Documents

Publication Publication Date Title
WO2019020094A1 (zh) 一种指标异常检测方法、装置以及电子设备
KR102340223B1 (ko) 블록체인 합의 방법 및 디바이스
JP6804668B2 (ja) ブロックデータ検証方法および装置
EP3780541B1 (en) Identity information identification method and device
WO2018177250A1 (zh) 一种基于区块链的数据处理方法及设备
WO2019128526A1 (zh) 一种训练风控模型和风控的方法、装置及设备
CN109344789B (zh) 人脸跟踪方法及装置
WO2018177245A1 (zh) 一种基于区块链的数据处理方法及设备
KR102316230B1 (ko) 이미지 처리 방법 및 장치
CN110245047B (zh) 时间序列异常检测方法、装置及设备
WO2019095858A1 (zh) 随机游走、基于集群的随机游走方法、装置以及设备
WO2019192258A1 (zh) 一种数据同步的方法、装置及设备
US9477889B2 (en) Face recognition with parallel detection and tracking, and/or grouped feature motion shift tracking
CN110634030B (zh) 应用的业务指标挖掘方法、装置及设备
WO2019085614A1 (zh) 随机游走、基于分布式系统的随机游走方法、装置以及设备
WO2019007286A1 (zh) 一种事件提醒方法及装置
TW201931150A (zh) 社交內容風險識別方法、裝置及設備
WO2019072198A1 (zh) 一种文件分享方法、设备及计算机可读介质
US20200167527A1 (en) Method, device, and apparatus for word vector processing based on clusters
WO2016116020A1 (zh) 一种实现对象过期操作的方法、装置和设备
EP3211541A1 (en) Method and apparatus for determining directory category and automatic categorization method and apparatus
WO2019072040A1 (zh) 随机游走、基于集群的随机游走方法、装置以及设备
WO2019072063A1 (zh) 随机游走、基于集群的随机游走方法、装置以及设备
CN115267667B (zh) 井下高精度定位修正方法、装置、设备及存储介质
WO2019174392A1 (zh) 针对rpc信息的向量处理

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18838643

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018838643

Country of ref document: EP

Effective date: 20200123