WO2021056435A1 - 用于异常检测的方法和装置 - Google Patents

用于异常检测的方法和装置 Download PDF

Info

Publication number
WO2021056435A1
WO2021056435A1 PCT/CN2019/108620 CN2019108620W WO2021056435A1 WO 2021056435 A1 WO2021056435 A1 WO 2021056435A1 CN 2019108620 W CN2019108620 W CN 2019108620W WO 2021056435 A1 WO2021056435 A1 WO 2021056435A1
Authority
WO
WIPO (PCT)
Prior art keywords
management device
information
scene information
detection
performance indicator
Prior art date
Application number
PCT/CN2019/108620
Other languages
English (en)
French (fr)
Inventor
许瑞岳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/108620 priority Critical patent/WO2021056435A1/zh
Publication of WO2021056435A1 publication Critical patent/WO2021056435A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring

Definitions

  • This application relates to the field of network operation and maintenance, and more specifically, to a method and device for abnormality detection in the field of network operation and maintenance.
  • the operator's network has developed to the fifth generation (5G) mobile communication technology.
  • the 5G network architecture is more flexible than the previous communication technology.
  • the 5G network requires key performance indicators such as delay, speed, and connection scale. Also keep improving.
  • the rich and diversified development of the application industry has also put forward higher requirements for service performance assurance and flexibility. Therefore, network operation and maintenance are becoming more and more difficult.
  • the rapid detection of network performance problems is the key to ensuring network performance.
  • Setting thresholds and detecting network performance indicators is an effective mechanism for quickly discovering and evaluating network problems. Operation and maintenance personnel can quickly and effectively discover network problems without the need to monitor massive amounts of network performance information in real time.
  • Network operation and maintenance personnel can set a threshold for a certain network performance index, and the operation and maintenance system monitors the network performance index in real time. As long as the corresponding network performance index reaches or exceeds the set threshold, the operation and maintenance system sends this to the network operation and maintenance personnel. Notification of abnormal network performance indicators enables network operation and maintenance personnel to know that the network is in an abnormal state at this time.
  • the threshold set for the performance indicator to be detected is a fixed threshold. Therefore, it may cause false alarms during the operation and maintenance process or even normal alarms but missed detections. Accurate The sex is low.
  • the present application provides a method and device for anomaly detection, which can perform anomaly detection on performance indicators based on different scene information, and improve the accuracy of detection.
  • this application provides a method for anomaly detection, which includes:
  • the first management device obtains first abnormal dynamic information, where the first abnormal dynamic information is used to indicate that at least one piece of scene information of a first performance indicator and the first performance indicator are under each piece of scene information in the at least one piece of scene information
  • the mapping relationship between the thresholds of, each of the scene information includes at least one of time, service type, and location area;
  • the first management device Acquiring, by the first management device, target scene information of the first performance index and a detection value of the first performance index under the target scene information, and the at least one piece of scene information includes the target scene information;
  • the first management device determines the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information ,
  • the detection result includes abnormal or normal.
  • thresholds corresponding to the scene information are set for different scene information, and anomaly detection can be performed on the performance index based on the scene information of the performance index, thereby improving the accuracy of detection Sex.
  • the first performance indicator may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, number of active users, delay , Call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session establishment number failure , Any one of the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage, which is not limited in the embodiment of the application.
  • Time For example, different times in the morning, afternoon and evening, holidays, etc.;
  • Service types for example, enhanced Mobile Broadband (eMBB), ultra-reliable low latency communication (URLLC), mIoT, V2X (vehicle to everything), augmented reality (augmented) reality, AR), virtual reality (VR), etc.;
  • eMBB enhanced Mobile Broadband
  • URLLC ultra-reliable low latency communication
  • mIoT ultra-reliable low latency communication
  • V2X vehicle to everything
  • augmented reality augmented reality
  • AR virtual reality
  • VR virtual reality
  • Location area for example, indoor, outdoor, high-speed rail, square, etc.
  • the scene information of the first performance indicator may include a second performance indicator, where the second performance indicator is different from the first performance indicator.
  • the throughput rate is selected as the first performance indicator
  • other performance indicators such as the number of online users and coverage ratio may all be used as scene information of the throughput rate.
  • each scene information includes at least one of time, service type, location area, and second performance index.
  • the second performance index may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, number of active users, delay , Call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session establishment number failure , Any one of the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be in a variety of different forms, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be a mapping table, the mapping table including the first performance indicator, at least one scene information of the first performance indicator, and the first performance indicator in the at least one The threshold corresponding to each scene information in the scene information.
  • the first abnormal dynamic information may be an abnormal dynamic model
  • the input of the abnormal dynamic model is the scene information of the first performance index
  • the output is that the first performance index is under the scene information The corresponding threshold.
  • the first management device may obtain the first abnormal dynamic information in a variety of different ways, which is not limited in the embodiment of the present application.
  • the first management device acquiring the first abnormal dynamic information includes: the first management device receives the first indication information sent by the second management device, and the first indication information is used for Instruct the first management device to acquire the first abnormal dynamic information; the first management device determines the first abnormal dynamic information from a plurality of abnormal dynamic information according to the first instruction information.
  • the first management device may obtain the multiple abnormal dynamic information in advance, and the multiple The abnormal dynamic information includes the first abnormal dynamic information.
  • the first indication information may carry an identifier of the first abnormal dynamic information
  • the first management device may determine the first abnormal dynamic information from a plurality of abnormal dynamic information according to the identifier of the first abnormal dynamic information .
  • the first indication information may carry an identifier of the mapping table.
  • the first indication information may carry the identifier of the abnormal dynamic model.
  • the first management device acquiring the first abnormal dynamic information includes: the first management device acquiring at least one set of detection data of the first performance indicator and the at least one set of detection data The detection result corresponding to each group of detection data in the data, where each group of detection data includes scene information and the detection value of the first performance indicator under the scene information; the first management device is based on each group of detection data The detection result corresponding to each set of detection data is used to determine the first abnormal dynamic information.
  • the first management device acquiring at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data includes: The first management device obtains second indication information, where the second indication information is used to instruct the first management device to determine the first abnormal dynamic information; the first management device obtains all information according to the second indication information Each group of detection data and the detection result corresponding to each group of detection data.
  • the second indication information may be carried in a threshold configuration message.
  • the above-mentioned second indication information is carried in the existing threshold configuration message, and the existing threshold configuration interface can be reused, that is, the transmission of the existing threshold configuration interface can be used.
  • Instruction information stronger compatibility.
  • the acquiring, by the first management device, the first abnormal dynamic information includes: the first management device receiving the first abnormal dynamic information sent by the second management device.
  • the first management device may actively request the second management device to send the first abnormal dynamic information; or, the first management device may periodically receive the first abnormal dynamic information sent by the second management device; Or, the first management device may receive the first abnormal dynamic information sent by the second management device in real time after generating or updating the first abnormal dynamic information; or, the first management device may receive the second management device sending The anomaly detection request of, the anomaly detection request carries the first abnormal dynamic information.
  • the first management device acquiring the target scene information of the first performance index and the detection value of the first performance index under the target scene information includes: the first The management device configures the demand information of the detection object according to the first abnormal dynamic information, and the demand information is used to request the detection object to report the target scene information of the first performance index and the first performance index The detection value under the target scene information; the first management device receives the target scene information of the first performance index sent by the detection object according to the demand information and the first performance index is in the The detection value under the target scene information.
  • the first management device may configure the requirement information of the detection object according to the request of the second management device; or the first management device may periodically configure the requirement information of the detection object, which is not limited in this embodiment of the application.
  • the threshold of the first performance indicator under the target scene information may be understood as the minimum or maximum value of the first performance indicator under the target scene information.
  • the detection value of the first performance indicator in the target scene information is less than or equal to the threshold, it is determined that the first performance indicator is abnormal; or, when the first performance indicator is in the target When the detection value under the scene information is greater than the threshold, it is determined that the first performance indicator is normal.
  • the threshold of the first performance indicator in the target scene information may include a first threshold and a second threshold, and the first threshold is smaller than the second threshold.
  • the detection value of the first performance indicator under the target scene information is less than or equal to the first threshold, it is determined that the first performance indicator is seriously abnormal; or, when the first performance indicator is When the detection value under the target scene information is greater than the first threshold and less than or equal to the second threshold, it is determined that the first performance index is generally abnormal; or, when the first performance index is detected under the target scene information When the value is greater than the second threshold, it is determined that the first performance index is normal.
  • the detection value of the first performance indicator under the target scene information is greater than or equal to the second threshold, it is determined that the first performance indicator is seriously abnormal; or, when the first performance When the detection value of the indicator under the target scene information is less than the second threshold and greater than or equal to the first threshold, it is determined that the first performance indicator is generally abnormal; or, when the first performance indicator is under the target scene information When the detection value is less than the first threshold, it is determined that the first performance index is normal.
  • the method further includes: the first management device sends feedback information to the second management device, the feedback information including the detection of the first performance indicator under the target scene information Value and the detection result of the first performance index.
  • the method further includes: the first management device receiving confirmation information sent by the second management device according to the feedback information, the confirmation information being used to indicate the first performance Whether the test result of the indicator is correct.
  • the first management device saves the first abnormal dynamic information.
  • the first abnormal dynamic information is stored locally, and then when abnormality detection is performed on the first performance indicator again, there is no need to obtain the first abnormality from the second management device again.
  • Dynamic information can be called directly from the local, faster and more convenient.
  • the first management device may also receive update abnormal dynamic information sent by the second management device, and the update abnormal dynamic information is used to indicate the first An updated threshold value of a performance indicator under the target scene information.
  • the first management device may update the locally stored first abnormal dynamic information to the updated abnormal dynamic information.
  • the first abnormal dynamic information stored locally can be continuously updated through verification to ensure the real-time performance of the first abnormal dynamic information and improve the accuracy of the first abnormal dynamic information. Sex.
  • the first performance indicator is throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, active users Number, delay, call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, number of wireless resource control connections, number of protocol data unit session requests, number of protocol data unit sessions successfully established, protocol data unit Any of the number of failed sessions established, the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage.
  • this application provides another method for anomaly detection, which includes:
  • the second management device acquires at least one set of detection data of the first performance index and a detection result corresponding to each set of detection data in the at least one set of detection data, and each set of detection data includes scene information and the first set of detection data.
  • the second management device determines the first abnormal dynamic information according to each group of detection data and the detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate at least one of the first performance indicators A mapping relationship between one piece of scene information and the threshold value of the first performance indicator under each piece of scene information in the at least one piece of scene information;
  • the second management device sends the first abnormal dynamic information to the first management device.
  • a mapping relationship of thresholds corresponding to the scene information is set for different scene information, and anomaly detection can be performed on the performance index based on the scene information of the performance index, thereby Improve the accuracy of detection.
  • the first performance indicator may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, number of active users, delay , Call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session establishment number failure , Any one of the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage, which is not limited in the embodiment of the present application.
  • Time For example, different times in the morning, afternoon and evening, holidays, etc.;
  • Service types for example, enhanced Mobile Broadband (eMBB), ultra-reliable low latency communication (URLLC), mIoT, V2X (vehicle to everything), augmented reality (augmented) reality, AR), virtual reality (VR), etc.;
  • eMBB enhanced Mobile Broadband
  • URLLC ultra-reliable low latency communication
  • mIoT ultra-reliable low latency communication
  • V2X vehicle to everything
  • augmented reality augmented reality
  • AR virtual reality
  • VR virtual reality
  • Location area for example, indoor, outdoor, high-speed rail, square, etc.
  • the scene information of the first performance indicator may include a second performance indicator, where the second performance indicator is different from the first performance indicator.
  • the throughput rate is selected as the first performance indicator
  • other performance indicators such as the number of online users and coverage ratio may all be used as scene information of the throughput rate.
  • the scene information includes at least one of time, service type, location area, and second performance index.
  • the second performance index may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, number of active users, delay , Call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session establishment number failure , Any one of the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be in a variety of different forms, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be a mapping table, the mapping table including the first performance indicator, at least one scene information of the first performance indicator, and the first performance indicator in the at least one The threshold corresponding to each scene information in the scene information.
  • the first abnormal dynamic information may be an abnormal dynamic model
  • the input of the abnormal dynamic model is the scene information of the first performance index
  • the output is that the first performance index is under the scene information The corresponding threshold.
  • the first management device may obtain the first abnormal dynamic information in a variety of different ways, which is not limited in the embodiment of the present application.
  • the above-mentioned first abnormal dynamic information is carried in the existing threshold configuration message, and the existing threshold configuration interface can be reused, that is, the transmission of the existing threshold configuration interface can be used.
  • the mapping relationship is compatible with existing interfaces.
  • the method further includes: the second management device receiving feedback information sent by the first management device according to the first abnormal dynamic information, the feedback information including the first The detection value of the performance index under the target scene information and the detection result of the first performance index, and the at least one piece of scene information includes the target scene information.
  • the method further includes: the second management device verifies the detection result of the first performance index according to the feedback information to obtain a verification result, and the verification result includes correctness. Or incorrect.
  • the second management device verifies the detection result of the first performance indicator according to the feedback information, including: the second management device obtains the information of the first performance indicator Business information, where the business information includes at least one of customer feedback, business interruption, and business experience; the second management device performs an evaluation of the first performance index based on the feedback information and the business information The test results are verified.
  • the second management device may also present the feedback information to a technician, and obtain a verification result from the technician who verifies the detection result of the first performance index based on work experience.
  • the method further includes: the second management device sends confirmation information to the first management device, the confirmation information being used to indicate whether the detection result of the first performance indicator is correct .
  • the second management device saves the first abnormal dynamic information.
  • the first abnormal dynamic information is stored locally, and then when abnormality detection is performed on the first performance indicator again, there is no need to re-establish the first abnormal dynamic information, directly from the local Just call, faster and more convenient.
  • the second management device may also determine to update abnormal dynamic information, and the update abnormal dynamic information is used to indicate that the first performance indicator is in the target scene.
  • the threshold value of the update under the information the second management device can send the update abnormal dynamic information to the first management device; accordingly, the first management device can receive the update abnormal dynamic information sent by the second management device, and The locally stored first abnormal dynamic information is updated to the updated abnormal dynamic information.
  • the first abnormal dynamic information stored locally can be continuously updated through verification to ensure the real-time performance of the first abnormal dynamic information and improve the accuracy of the first abnormal dynamic information. Sex.
  • the first performance indicator includes throughput, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, active users Number, delay, call drop rate, CPU usage rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, number of protocol data unit session requests, number of protocol data unit sessions successfully established, protocol data unit Any of the number of failed sessions established, the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage.
  • the present application also provides a method for anomaly detection, the method including:
  • the second management device acquires at least one set of detection data of the first performance index and a detection result corresponding to each set of detection data in the at least one set of detection data, where each set of detection data includes scene information and the first performance
  • the second management device determines the first abnormal dynamic information according to each group of detection data and the detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate at least one of the first performance indicators A mapping relationship between one piece of scene information and the threshold value of the first performance indicator under each piece of scene information in the at least one piece of scene information;
  • the first management device Acquiring, by the first management device, target scene information of the first performance index and a detection value of the first performance index under the target scene information, and the at least one piece of scene information includes the target scene information;
  • the first management device determines the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information .
  • the method further includes: the first management device sends feedback information to the second management device, the feedback information including that the first performance indicator is under the target scene information The detection value of and the detection result of the first performance index.
  • the method further includes: the second management device verifies the detection result of the first performance index according to the feedback information to obtain the verification result; the second management device Sending confirmation information to the first management device, where the confirmation information is used to indicate whether the detection result of the first performance indicator is correct.
  • the method further includes: when the confirmation information indicates that the detection result of the first performance index is incorrect, the second management device determines to update the abnormal dynamic information, and the update is abnormal
  • the dynamic information is used to indicate an update threshold of the first performance indicator under the target scene information; the second management device sends the update abnormal dynamic information to the first management device.
  • the method further includes: the first management device updating the first abnormal dynamic information to the updated abnormal dynamic information.
  • the present application also provides a device for abnormality detection, which is used to execute the above-mentioned first aspect or the method in any possible implementation of the first aspect.
  • the device may include a unit for executing the above-mentioned first aspect or the method in any possible implementation of the first aspect.
  • the present application also provides a device for abnormality detection, which is used to execute the above-mentioned second aspect or the method in any possible implementation of the second aspect.
  • the device may include a unit for executing the foregoing second aspect or any possible implementation manner of the second aspect.
  • the present application also provides a system for anomaly detection, which includes the device described in the fourth aspect and the device described in the fifth aspect.
  • the present application provides a management device, the management device includes: a memory, a processor, a transceiver, and instructions stored in the memory and running on the processor, wherein the memory, the processor And the communication interfaces communicate with each other through an internal connection path, and the processor executes the instruction to enable the communication device to implement the foregoing first aspect or the method in any possible implementation manner of the first aspect.
  • the present application provides a management device including: a memory, a processor, a transceiver, and instructions stored in the memory and running on the processor, wherein the memory, the processor And the communication interfaces communicate with each other through an internal connection path, and the processor executes the instruction to enable the communication device to implement the foregoing second aspect or any possible implementation method of the second aspect.
  • the present application also provides a system for anomaly detection, which includes the management device described in the seventh aspect and the management device described in the eighth aspect.
  • the present application also provides a system for anomaly detection, the system including a first management device and a second management device;
  • the second management device is configured to obtain at least one set of detection data of the first performance index and the detection result corresponding to each set of detection data in the at least one set of detection data, and each set of detection data includes scene information and the first set of detection data.
  • the detection data and the detection result corresponding to each set of detection data determine first abnormal dynamic information, where the first abnormal dynamic information is used to indicate the at least one scene information and the first performance of the first performance indicator
  • the mapping relationship between the thresholds of the indicators in each scene information in the at least one scene information sending the first abnormal dynamic information to the first management device;
  • the first management device is configured to receive the first abnormal dynamic information sent by the first management device; obtain target scene information of the first performance index and information about the first performance index in the target scene According to the target scene information and the first abnormal dynamic information, determine the threshold value of the first performance indicator under the target scene information according to the target scene information and the first abnormal dynamic information; Determine the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information.
  • the first management device is further configured to send feedback information to the second management device, where the feedback information includes the detection value of the first performance indicator under the target scene information And the detection result of the first performance index.
  • the second management device is further configured to verify the detection result of the first performance index according to the feedback information to obtain the verification result; and send a confirmation to the first management device Information, the confirmation information is used to indicate whether the detection result of the first performance indicator is correct.
  • the second management device is further configured to determine to update abnormal dynamic information when the confirmation information indicates that the detection result of the first performance index is incorrect, and the update abnormal dynamic information is used To indicate an update threshold of the first performance indicator under the target scene information; and send the update abnormal dynamic information to the first management device.
  • the first management device is further configured to update the first abnormal dynamic information to the updated abnormal dynamic information.
  • the present application provides a computer-readable storage medium for storing a computer program.
  • the computer program includes instructions for implementing the above-mentioned aspects or methods in any possible implementation manners thereof.
  • this application provides a computer program product containing instructions that, when run on a computer, enables the computer to implement the above-mentioned aspects or methods in any possible implementation manners.
  • the present application provides a chip device, including: an input interface, an output interface, at least one processor, and a memory.
  • the input interface, the output interface, the processor, and the memory communicate with each other through an internal connection path.
  • the processor is configured to execute the code in the memory, and when the processor executes the code, the chip device implements the foregoing aspects or the method in any possible implementation manner.
  • FIG. 1 provides a schematic architecture diagram of a system 100 to which the method for anomaly detection according to an embodiment of the present application is applied;
  • FIG. 2 provides a schematic flowchart of a method 200 for anomaly detection according to an embodiment of the present application
  • Figure 3 provides a schematic diagram of an abnormal dynamic model of an embodiment of the present application
  • FIG. 4 provides a schematic diagram of another abnormal dynamic model according to an embodiment of the present application.
  • FIG. 5 provides a schematic flowchart of a method 300 for anomaly detection according to an embodiment of the present application
  • FIG. 6 provides a schematic flowchart of a method 400 for anomaly detection according to an embodiment of the present application
  • FIG. 7 provides a schematic flowchart of a method 500 for anomaly detection according to an embodiment of the present application
  • FIG. 8 provides a schematic block diagram of a device 600 for abnormality detection according to an embodiment of the present application.
  • FIG. 9 provides a schematic block diagram of a device 700 for abnormality detection according to an embodiment of the present application.
  • FIG. 10 provides a schematic block diagram of a device 800 for abnormality detection according to an embodiment of the present application.
  • FIG. 11 provides a schematic block diagram of a device 900 for abnormality detection according to an embodiment of the present application.
  • FIG. 1 shows a schematic architecture diagram of a system 100 to which the method for anomaly detection provided by an embodiment of the present application is applied.
  • the system 100 includes a business operation device 110, an end-to-end network management device 120, a domain network management device 130, and a network device 140.
  • the business operation device 110 and the end-to-end network management device 120
  • the end-to-end network management device 120 and the domain network management device 130
  • the domain network management device 130 and the network device 140 There is a communication connection.
  • the business operation equipment provides business operation functions, including: business issuance, business guarantee, business scheduling, user management and other functions, including the business operation system of the vertical industry or the business operation system of the operator.
  • the business operation device may be a business support system (BSS) or a communication service management function (communication service management function, CSMF).
  • BSS business support system
  • CSMF communication service management function
  • the end-to-end network management equipment provides network operation and maintenance functions, including: network life cycle management, network deployment, network fault management, network performance management, network configuration management, and network performance guarantee. Network optimization functions, etc.
  • the network here may include one or more network elements, one or more sub-networks, one or more network elements, and one or more sub-networks.
  • the end-to-end network management device may be a network management (network manager, NM) system, an operation support system (OSS), a network slice management function (network slice management function, NSMF), and a network management data analysis function (management data analytical function, MDAF), self-organization network (self-organization network, SON) function (function).
  • network management network manager, NM
  • OSS operation support system
  • NSMF network slice management function
  • MDAF management data analytical function
  • MDAF self-organization network
  • SON self-organization network function
  • domain network management device provides one or all of the following functions:
  • Intra-domain network operation and maintenance functions that is, the operation and maintenance functions of sub-networks or network elements, including life cycle management of sub-networks or network elements, deployment of sub-networks or network elements, fault management of sub-networks or network elements, sub-networks Or the performance management of the network element, the performance guarantee of the sub-network or the network element, the optimization function of the sub-network or the network element, etc.
  • the sub-network here includes one or more network elements, one or more other sub-networks, one or more network elements, and one or more other sub-networks.
  • the domain here can include a technical domain (including a wireless access network domain, a transmission network domain, or a core network domain), a vendor domain (the network devices in the domain are all from the same manufacturer), or a geographic area (a network in a certain geographic area).
  • a technical domain including a wireless access network domain, a transmission network domain, or a core network domain
  • a vendor domain the network devices in the domain are all from the same manufacturer
  • a geographic area a network in a certain geographic area
  • the network control function is responsible for the autonomous management, control, and analysis of wireless resources in a specific range (e.g. geographic area), and exposes the network that meets the wireless traffic scenario of a specific user group.
  • the domain network management device may be a network slice subnet management system (NSSMF), a subnetwork management system (SMF), a domain management system (domain manager, DM), and an element management system.
  • NSSMF network slice subnet management system
  • SMF subnetwork management system
  • domain manager domain management system
  • EM domain management data analysis function
  • MDAF domain management data analysis function
  • RAN intelligent controller RIC
  • RAN external controller RAN external controller
  • REC application controller
  • Application Controller Application Controller
  • MAE Mobile Network Automation Engine
  • a network device can be understood as an entity that provides network services, that is, a network element; or can be understood as a network function.
  • the network element may be an access network element (base station), a centralized control unit (CUCP), a centralized unit (centralized, unit, CU), a distributed unit (DU), and a centralized user plane unit (CUUP) , Core network elements (access management function (AMF) or session management function (session management function, SMF)).
  • base station a centralized control unit
  • CUCP centralized control unit
  • DU distributed unit
  • CUUP centralized user plane unit
  • Core network elements access management function (AMF) or session management function (session management function, SMF)
  • AMF access management function
  • SMF session management function
  • the system 100 provided in FIG. 1 only schematically shows one network device (network device 140) managed by the domain network management device 130, and the domain network management device 130 can also manage other numbers of network devices.
  • This application is implemented The example does not limit this.
  • FIG. 2 shows a schematic flowchart of a method 200 for anomaly detection provided by an embodiment of the present application, and the method 200 is applicable to the system 100 shown in FIG. 1.
  • the first management device acquires first abnormal dynamic information, where the first abnormal dynamic information is used to indicate at least one piece of scene information of a first performance indicator and the value of the first performance indicator under each piece of scene information in the at least one piece of The mapping relationship between thresholds, each of the scene information includes at least one of time, service type, and location area.
  • the first abnormal dynamic information may indicate a mapping relationship between a plurality of scene information of the first performance index and a threshold value of the first performance index under each scene information in the plurality of scene information.
  • each scene information may include at least one of time, service type, location area, and second performance index.
  • the first management device obtains target scene information of the first performance index and a detection value of the first performance index under the target scene information, where the at least one piece of scene information includes the target scene information.
  • the first management device determines a threshold value of the first performance indicator under the target scene information according to the target scene information and the first abnormal dynamic information.
  • the first management device determines the detection result of the first performance index according to the detection value of the first performance index in the target scene information and the threshold value of the first performance index in the target scene information, and the detection result Including abnormal or normal.
  • the above-mentioned first management device may be a domain network management device, an end-to-end network management device, or a network device in the system 100.
  • the first performance indicator described in the embodiment of the application may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate , Number of active users, delay, call drop rate, CPU usage, load rate, coverage ratio, regional traffic capacity, number of wireless resource control connections, number of protocol data unit session requests, number of protocol data unit sessions successfully established, Any one of the number of protocol data unit session establishment failures, the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage is not limited in this embodiment of the application.
  • enhanced Mobile Broadband eMBB
  • ultra-reliable low latency communication URLLC
  • mIoT ultra-reliable low latency communication
  • V2X vehicle to everything
  • AR augmented reality
  • VR virtual reality, etc.
  • the scene information of the first performance indicator may include a second performance indicator, where the second performance indicator is different from the first performance indicator.
  • the throughput rate is selected as the first performance indicator
  • other performance indicators such as the number of online users and coverage ratio may all be used as scene information of the throughput rate.
  • the first abnormal dynamic information may be in a variety of different forms, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be a mapping table, the mapping table including the first performance indicator, at least one scene information of the first performance indicator, and the first performance indicator in the at least one The threshold corresponding to each scene information in the scene information.
  • the first abnormal dynamic information may be as shown in Table 1, where the first performance indicator is the number of online users, the first scene information is time, and the threshold of the first performance indicator under the first scene information is the first A threshold.
  • the first performance index First scene information First threshold Number of online users 5:00 am ⁇ 7:00 am 100 people
  • the first abnormal dynamic information may be as shown in Table 2, where the first performance indicator is the number of online users, the first scene information is the time, the second scene information is the location area, and the first performance indicator is in the The threshold corresponding to the first scene information is a first threshold, and the threshold of the first performance indicator in the second scene information is a second threshold.
  • the first abnormal dynamic information may be as shown in Table 3, where the first performance indicator is the number of online users, the first scene information and the second scene information both include time and service type, and the first scene information and The second scenario information is different, the threshold of the first performance indicator under the first scenario information is a first threshold, and the threshold of the first performance indicator under the second scenario information is a second threshold.
  • the first abnormal dynamic information may be as shown in Table 4, where the first performance indicator is the number of online users, the first scene information includes time and business type, and the second scene information includes the number of registered users (the second Performance index) and location area, the threshold of the first performance index under the first scene information is the first threshold, and the threshold of the first performance index under the second scene information is the second threshold.
  • the first abnormal dynamic information may be an abnormal dynamic model
  • the input of the abnormal dynamic model is the scene information of the first performance index
  • the output is that the first performance index is under the scene information The corresponding threshold.
  • the abnormal dynamic model may be as shown in Figure 3.
  • the first management device may obtain the first abnormal dynamic information in a variety of different ways, which is not limited in the embodiment of the present application.
  • the first management device may receive first indication information sent by the second management device, where the first indication information is used to instruct the first management device to obtain the first abnormal dynamic information; An indication information, determining the first abnormal dynamic information from a plurality of abnormal dynamic information.
  • the second management device is an end-to-end network management device; or, when the first management device is an end-to-end network management device, the first management device is an end-to-end network management device.
  • the second management device is a business operation management device; or, when the first management device is a network device, the second management device is a domain network management device or an end-to-end network management device.
  • first management device can be understood as a provider
  • second management device can be understood as a consumer
  • the first indication information may carry an identifier of the first abnormal dynamic information
  • the first management device may determine the first abnormal dynamic information from a plurality of abnormal dynamic information according to the identifier of the first abnormal dynamic information .
  • the first indication information may carry an identifier of the mapping table.
  • the first indication information may carry the identifier of the abnormal dynamic model.
  • the first management device may obtain the multiple abnormal dynamic information in advance, and the multiple The abnormal dynamic information includes the first abnormal dynamic information.
  • the second abnormal dynamic information is used to indicate at least one scene information of the second performance indicator And the mapping relationship between the second performance indicator and the threshold under each scene information in the at least one scene information.
  • the second abnormal dynamic information may be in the form of a mapping table or an abnormal dynamic model.
  • reference may be made to the first abnormal dynamic information. To avoid repetition, it will not be repeated here.
  • the first management device may determine the first abnormal dynamic information by itself.
  • the first management device may obtain at least one set of detection data of the first performance index and a detection result corresponding to each set of detection data in the at least one set of detection data, and each set of detection data includes Scene information and the detection value of the first performance indicator under the scene information; the first management device determines the first abnormal dynamic information according to the detection results corresponding to each group of detection data and each group of detection data.
  • the first management device may input at least one set of detection data of the first performance index and the detection result corresponding to each set of detection data in the at least one set of detection data into machine learning (ML)
  • ML machine learning
  • the first management device may obtain second indication information, where the second indication information is used to instruct the first management device to determine the first abnormal dynamic information; the first management device may, according to the second indication information, Obtain each group of detection data and the detection result corresponding to each group of detection data.
  • the second management device may send second indication information to the first management device, and the second indication information may enable the first management device to generate or update the first abnormal dynamic information by itself.
  • the second indication information may be carried in a threshold configuration message.
  • the above-mentioned second indication information is carried in the existing threshold configuration message, and the existing threshold configuration interface can be reused, that is, the transmission of the existing threshold configuration interface can be used. 2. Indication information, thereby instructing the first management device to automatically generate or update the first abnormal dynamic information.
  • the first management device may receive the first abnormal dynamic information sent by the second management device.
  • the first management device may actively request the second management device to send the first abnormal dynamic information; or, the first management device may periodically receive the first abnormal dynamic information sent by the second management device; Or, the first management device may receive the first abnormal dynamic information sent by the second management device in real time after generating or updating the first abnormal dynamic information; or, the first management device may receive the second management device sending The anomaly detection request of, the anomaly detection request carries the first abnormal dynamic information.
  • the first management device may send an abnormal dynamic information acquisition request to the second management device, and the abnormal dynamic information acquisition request is used to request to acquire the first abnormal dynamic information; the first management device Receiving the first abnormal dynamic information sent by the second management device according to the abnormal dynamic information acquisition request.
  • the abnormal dynamic information acquisition request may carry the identifier of the first abnormal dynamic information.
  • the first management device may periodically receive the first abnormal dynamic information sent by the second management device according to a transmission period.
  • the first management device and the second management device may pre-appoint the transmission period, or the second management device may indicate the transmission period to the first management device through instruction information.
  • This embodiment of the application does not do this. limited.
  • the second management device may send the first abnormal dynamic information to the first management device in real time; accordingly, , The first management device may receive the first abnormal dynamic information sent by the second management device in real time.
  • the second management device may send an abnormality detection request to the first management device, and the abnormality detection request is used to request abnormality detection of the first performance indicator, and the abnormality detection request may carry The first abnormal dynamic information; accordingly, the first management device receives the abnormality detection request sent by the second management device.
  • the first abnormal dynamic information may be carried in a threshold configuration message.
  • the above-mentioned first abnormal dynamic information is carried in the existing threshold configuration message, and the existing threshold configuration interface can be reused, that is, the transmission of the existing threshold configuration interface can be used.
  • the mapping relationship is compatible with existing interfaces.
  • the first management device may receive an abnormality detection request sent by the second management device, where the abnormality detection request is used to request an abnormality detection for the first performance indicator.
  • the first management device may execute S210 and S220 according to the abnormality detection request.
  • the embodiment of the present application does not limit the execution sequence of S210 and S220.
  • the first management device may perform S210 and S220 respectively.
  • S220 may be that the first management device obtains the target scene information of the first performance indicator and the detection value of the first performance indicator under the target scene information according to at least one preset scene information, and the at least one scene information Including the target scene information.
  • S210 may be executed after S220, or S210 may be executed before S220, or S210 and S220 may be executed at the same time.
  • the first management device may obtain the target scene information of the first performance index and the detection value of the first performance index under the target scene information according to the first abnormal dynamic information.
  • S220 is executed after S210.
  • the first management device may configure demand information of the detection object according to the first abnormal dynamic information, and the demand information is used to request the detection object to report the target scene information of the first performance indicator and the first performance indicator The detection value under the target scene information; the first management device receives the target scene information reported by the detection object according to the demand information and the detection value of the first performance indicator under the target scene information.
  • the first management device may configure the detection object's demand information according to Table 1, and the demand information is used to request the detection object to report from 5:00 am to 7:00 am
  • the detection object can report the detection value of the number of online users from 5:00 a.m. to 7:00 a.m. according to the demand information.
  • the first management device may configure the detection object's demand information according to Table 2.
  • the demand information is used to request detection and report from 5:00 am to 7:00 am
  • the detection object can report the detection value of the number of online users from 5:00 a.m. to 7:00 a.m., and the detection value of the number of outdoor online users according to the demand information.
  • the first management device may configure the requirement information of the detection object according to the request of the second management device; or the first management device may periodically configure the requirement information of the detection object, which is not limited in this embodiment of the application.
  • the first management device may search and match the target scene information in the first abnormal dynamic information, and determine the threshold value of the first performance indicator under the target scene information.
  • the first management device may compare the detection value of the first performance indicator under the target scene information with the threshold value of the first performance indicator under the target scene information to obtain the first performance indicator The test results.
  • the threshold of the first performance indicator under the target scene information may be understood as the minimum or maximum value of the first performance indicator under the target scene information.
  • S240 may include: when the detection value of the first performance indicator under the target scene information is less than or equal to the threshold, determining that the first performance indicator is abnormal; or, when the first performance When the detection value of the indicator under the target scene information is greater than the threshold, it is determined that the first performance indicator is normal.
  • S240 may include: when the detection value of the first performance indicator in the target scene information is greater than or equal to the threshold, determining that the first performance indicator is abnormal; or, when the first performance indicator is detected When the detection value of the performance indicator under the target scene information is less than the threshold value, it is determined that the first performance indicator is normal.
  • the threshold of the first performance indicator in the target scene information may include a first threshold and a second threshold, and the first threshold is smaller than the second threshold.
  • S240 may include: when the detection value of the first performance indicator in the target scene information is less than or equal to the first threshold, determining that the first performance indicator is seriously abnormal; or, when the detection value of the first performance indicator is less than or equal to the first threshold; When the detection value of the first performance index under the target scene information is greater than the first threshold and less than or equal to the second threshold, it is determined that the first performance index is generally abnormal; or, when the first performance index is in the target scene When the detected value under the information is greater than the second threshold, it is determined that the first performance index is normal.
  • S240 may include: when the detection value of the first performance indicator under the target scene information is greater than or equal to the second threshold, determining that the first performance indicator is seriously abnormal; or, when When the detection value of the first performance indicator under the target scene information is less than the second threshold and greater than or equal to the first threshold, it is determined that the first performance indicator is generally abnormal; or, when the first performance indicator is in the target When the detection value under the scene information is less than the first threshold, it is determined that the first performance index is normal.
  • the first management device sends feedback information to the second management device, the feedback information including the detection value of the first performance indicator under the target scene information and the detection result of the first performance indicator.
  • the first management device may receive confirmation information sent by the second management device according to the feedback information, and the confirmation information is used to indicate the second management device. Whether the test result of a performance index is correct.
  • the first management device saves the first abnormal dynamic information.
  • the first abnormal dynamic information is stored locally, and then when abnormality detection is performed on the first performance indicator again, there is no need to obtain the abnormal dynamic information from the second management device again , Can be called directly from the local, faster and more convenient.
  • the first management device may also receive update abnormal dynamic information sent by the second management device, and the update abnormal dynamic information is used to indicate the first An updated threshold value of a performance indicator under the target scene information.
  • the first management device may update the locally stored first abnormal dynamic information to the updated abnormal dynamic information.
  • the first abnormal dynamic information stored locally can be continuously updated through verification to ensure the real-time performance of the first abnormal dynamic information and improve the accuracy of the first abnormal dynamic information. Sex.
  • FIG. 5 shows a schematic flowchart of a method 300 for abnormality detection provided by an embodiment of the present application, and the method 300 is applicable to the system 100 shown in FIG. 1.
  • the second management device acquires at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data, where each set of detection data includes scene information and the first performance indicator
  • the second management device determines first abnormal dynamic information according to each group of detection data and a detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate at least one scene information of the first performance indicator And the mapping relationship between the first performance indicator and the threshold under each scene information in the at least one scene information.
  • the second management device sends the first abnormal dynamic information to the first management device; accordingly, the first management device receives the first abnormal dynamic information sent by the second management device.
  • the first management device acquires target scene information of the first performance indicator and a detection value of the first performance indicator under the target scene information, where the at least one piece of scene information includes the target scene information.
  • the first management device determines a threshold value of the first performance indicator under the target scene information according to the target scene information and the first abnormal dynamic information.
  • the first management device determines the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information.
  • the above-mentioned first management device may be a domain network management device, an end-to-end network management device, or a network device in the system 100.
  • the second management device is an end-to-end network management device; or, when the first management device is an end-to-end network management device, the second management device is an end-to-end network management device.
  • the device is a business operation management device; or, when the first management device is a network device, the second management device is a domain network management device or an end-to-end network management device.
  • first management device can be understood as a provider
  • second management device can be understood as a consumer
  • the first performance indicator described in the embodiment of the application may be throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate , Number of active users, delay, call drop rate, CPU usage, load rate, coverage ratio, regional traffic capacity, number of wireless resource control connections, number of protocol data unit session requests, number of protocol data unit sessions successfully established, Any one of the number of protocol data unit session establishment failures, the number of successful data radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage.
  • the load For example, the load, the number of users, etc.;
  • eMBB enhanced mobile broadband
  • URLLC enhanced mobile broadband
  • mIoT enhanced mobile broadband
  • V2X enhanced mobile broadband
  • AR enhanced reality
  • VR virtual reality
  • etc. eMBB, URLLC, mIoT, V2X, AR, VR, etc.
  • the scene information of the first performance indicator may include a second performance indicator, where the second performance indicator is different from the first performance indicator.
  • the throughput rate is selected as the first performance indicator
  • other performance indicators such as the number of online users and coverage ratio may all be used as scene information of the throughput rate.
  • the first abnormal dynamic information may be in a variety of different forms, which is not limited in the embodiment of the present application.
  • the first abnormal dynamic information may be a mapping table, the mapping table including the first performance indicator, at least one scene information of the first performance indicator, and the first performance indicator in the at least one The threshold corresponding to each scene information in the scene information.
  • the first abnormal dynamic information may be as shown in Table 1 to Table 4 above.
  • the first abnormal dynamic information may be an abnormal dynamic model
  • the input of the abnormal dynamic model is the scene information of the first performance index
  • the output is that the first performance index is under the scene information The corresponding threshold.
  • the abnormal dynamic model may be as shown in Figure 3.
  • the second management device may obtain at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data, and each set of detection data includes scene information And the detection value of the first performance indicator under the scene information; the second management device determines the first abnormal dynamic information according to each group of detection data and a detection result corresponding to each group of detection data.
  • the second management device may input at least one set of detection data of the first performance index and the detection result corresponding to each set of detection data in the at least one set of detection data into the machine learning algorithm model for learning, and establish The abnormal dynamic model.
  • the second management device may send the first abnormal dynamic information to the first management device according to the request of the first management device; or, the second management device may periodically send the first management device to the first management device.
  • the device sends the first abnormal dynamic information; or, the second management device may send the first abnormal dynamic information to the first management device in real time after generating or updating the first abnormal dynamic information; or, the second management
  • the device may send an abnormality detection request to the first management device, where the abnormality detection request is used to request abnormality detection of the first performance indicator, and the abnormality detection request carries the first abnormal dynamic information.
  • the first management device may send an abnormal dynamic information acquisition request to the second management device, and the abnormal dynamic information acquisition request is used to request to acquire the first abnormal dynamic information; accordingly, the first abnormal dynamic information 2.
  • the management device receives the abnormal dynamic information acquisition request, and sends the first abnormal dynamic information to the first management device according to the abnormal dynamic information acquisition request.
  • the abnormal dynamic information acquisition request may carry the identifier of the first abnormal dynamic information.
  • the second management device may periodically send the first abnormal dynamic information to the first management device according to the transmission period; accordingly, the first management device may periodically send the first abnormal dynamic information according to the transmission period. Receiving the first abnormal dynamic information sent by the second management device.
  • the first management device and the second management device may pre-appoint the transmission period, or the second management device may indicate the transmission period to the first management device through instruction information.
  • This embodiment of the application does not do this. limited.
  • the second management device may send the first abnormal dynamic information to the first management device in real time; accordingly, , The first management device may receive the first abnormal dynamic information sent by the second management device in real time.
  • the second management device may send an abnormality detection request to the first management device, where the abnormality detection request is used to request an abnormality detection of the first performance indicator, and the abnormality detection request carries the First abnormal dynamic information; accordingly, the first management device receives the abnormality detection request sent by the second management device.
  • S340 may be: the first management device obtains the target scene information of the first performance indicator and the detection value of the first performance indicator under the target scene information according to the abnormality detection request.
  • the first abnormal dynamic information may be carried in a threshold configuration message.
  • the above-mentioned first abnormal dynamic information is carried in the existing threshold configuration message, and the existing threshold configuration interface can be reused, that is, the transmission of the existing threshold configuration interface can be used.
  • the mapping relationship is compatible with existing interfaces.
  • the first management device may send feedback information to the second management device, where the feedback information includes that the first performance indicator is in the target scenario The detection value under the information and the detection result of the first performance index; correspondingly, the second management device receives the feedback information sent by the first management device.
  • the second management device may verify the detection result of the first performance index according to the feedback information to obtain a verification result, the verification result including correct or Incorrect.
  • the embodiment of the present application does not limit the verification method adopted by the second management device.
  • the second management device may obtain service information of the first performance index, and the service information includes at least one of customer feedback, service interruption, and service experience; the second management The device may verify the detection result of the first performance index based on the feedback information and the service information.
  • the second management device may also present the feedback information to a technician, and obtain a verification result from the technician who verifies the detection result of the first performance index based on work experience.
  • the second management device may send confirmation information to the first management device, where the confirmation information is used to indicate whether the detection result of the first performance indicator is correct; correspondingly;
  • the first management device receives the confirmation information sent by the second management device.
  • the second management device saves the first abnormal dynamic information.
  • the first abnormal dynamic information is stored locally, and then when abnormality detection is performed on the first performance indicator again, there is no need to re-establish the first abnormal dynamic information, directly from the local Just call, faster and more convenient.
  • the second management device may also determine to update abnormal dynamic information, and the update abnormal dynamic information is used to indicate that the first performance indicator is in the target scene.
  • the threshold value of the update under the information the second management device can send the update abnormal dynamic information to the first management device; accordingly, the first management device can receive the update abnormal dynamic information sent by the second management device, and The locally stored first abnormal dynamic information is updated to the updated abnormal dynamic information.
  • the first abnormal dynamic information stored locally can be continuously updated through verification to ensure the real-time performance of the first abnormal dynamic information and improve the accuracy of the first abnormal dynamic information. Sex.
  • FIG. 6 shows a schematic flowchart of a method 400 for anomaly detection provided by an embodiment of the present application, and the method 400 is applicable to the system 100 shown in FIG. 1.
  • the second management device acquires at least one set of detection data of the first performance indicator and a detection result corresponding to each set of the detection data in the at least one set of detection data, where each set of detection data includes scene information and the first performance indicator
  • the second management device determines first abnormal dynamic information according to each group of detection data and the detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate at least one scene information of the first performance indicator and The mapping relationship between the first performance indicator and the threshold under each scene information in the at least one scene information.
  • the second management device may save the first abnormal dynamic information.
  • the second management device sends an abnormality detection request to the first management device, where the abnormality detection request is used to request abnormality detection of the first performance indicator, and the abnormality detection request carries the first abnormal dynamic information; accordingly, the The second management device receives the abnormality detection request sent by the first management device.
  • the first management device obtains target scene information of the first performance index and a detection value of the first performance index under the target scene information according to the abnormality detection request, and the at least one scene information includes the target scene information.
  • the first management device determines a threshold value of the first performance indicator under the target scene information according to the target scene information and the first abnormal dynamic information.
  • the first management device determines the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information.
  • the method 400 may further include S407 to S409.
  • the first management device sends feedback information to the second management device, where the feedback information includes the detection value of the first performance indicator under the target scene information and the detection result of the first performance indicator; accordingly, the first performance indicator
  • the second management device receives the feedback information sent by the first management device.
  • the second management device verifies the detection result of the first performance index based on the feedback information and the service information of the first performance index to obtain a verification result.
  • the service information includes customer feedback status, service interruption status, and service information. At least one of the experience conditions, the verification result includes correct or incorrect.
  • S409 The second management device sends confirmation information to the first management device, where the confirmation information is used to indicate whether the detection result of the first performance indicator is correct; accordingly, the first management device receives the second management device sent by the second management device.
  • the confirmation message The confirmation message.
  • the method may further include S410 and S411.
  • the second management device determines to update abnormal dynamic information, where the updated abnormal dynamic information is used to indicate an update threshold of the first performance indicator under the target scene information.
  • S411 The second management device updates the first abnormal dynamic information stored locally to the updated abnormal dynamic information.
  • the above-mentioned first management device may be a domain network management device, an end-to-end network management device, or a network device in the system 100.
  • the second management device is an end-to-end network management device; or, when the first management device is an end-to-end network management device, the second management device is an end-to-end network management device.
  • the device is a business operation management device; or, when the first management device is a network device, the second management device is a domain network management device or an end-to-end network management device.
  • first management device can be understood as a supplier
  • second management device can be understood as a consumer
  • FIG. 7 shows a schematic flowchart of a method 500 for abnormality detection provided by an embodiment of the present application, and the method 500 is applicable to the system 100 shown in FIG. 1.
  • the second management device sends an abnormality detection request to the first management device, where the abnormality detection request is used to request abnormality detection of the first performance indicator; accordingly, the first management device receives the abnormality sent by the second management device. Test request.
  • the first management device obtains at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data according to the abnormality detection request, and each set of detection data includes scene information And the detection value of the first performance indicator under the scene information, and the detection result includes abnormal or normal.
  • the first management device determines the first abnormal dynamic information according to each group of detection data and the detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate at least one scene information of the first performance index And the mapping relationship between the first performance indicator and the threshold under each scene information in the at least one scene information, where each scene information includes at least one of time, service type, and location area.
  • the first management device may save the first abnormal dynamic information.
  • the first management device acquires target scene information of the first performance index and a detection value of the first performance index under the target scene information, where the at least one piece of scene information includes the target scene information.
  • the first management device determines a threshold value of the first performance indicator under the target scene information according to the target scene information and the first abnormal dynamic information.
  • the first management device determines the detection result of the first performance indicator according to the detection value of the first performance indicator under the target scene information and the threshold value of the first performance indicator under the target scene information.
  • the method 500 may further include S507 to S509.
  • the first management device sends feedback information to the second management device, where the feedback information includes the detection value of the first performance indicator under the target scene information and the detection result of the first performance indicator; accordingly, the first performance indicator
  • the second management device receives the feedback information sent by the first management device.
  • the second management device verifies the detection result of the first performance index based on the feedback information and the service information of the first performance index, and obtains a verification result.
  • the service information includes customer feedback, service interruption, and service At least one of the experience conditions, the verification result includes correct or incorrect.
  • the second management device sends confirmation information to the first management device, where the confirmation information is used to indicate whether the detection result of the first performance index is correct; accordingly, the first management device receives the second management device sent by the second management device.
  • the confirmation message is used to indicate whether the detection result of the first performance index is correct.
  • the method may further include S510 to S512.
  • the second management device determines to update abnormal dynamic information, where the updated abnormal dynamic information is used to indicate an updated threshold of the first performance indicator under the target scene information.
  • the second management device sends the update abnormal dynamic information to the first management device; correspondingly, the first management device receives the update abnormal dynamic information sent by the second management device.
  • the first management device updates the locally stored first abnormal dynamic information to the updated abnormal dynamic information.
  • the above-mentioned first management device may be a domain network management device, an end-to-end network management device, or a network device in the system 100.
  • the second management device is an end-to-end network management device; or, when the first management device is an end-to-end network management device, the second management device is an end-to-end network management device.
  • the device is a business operation management device; or, when the first management device is a network device, the second management device is a domain network management device or an end-to-end network management device.
  • first management device can be understood as a supplier
  • second management device can be understood as a consumer
  • FIG. 8 shows a schematic block diagram of a device 600 for abnormality detection provided by an embodiment of the present application.
  • the device 600 includes:
  • the acquiring unit 610 is configured to acquire first abnormal dynamic information, where the first abnormal dynamic information is used to indicate at least one piece of scene information of a first performance indicator and the value of the first performance indicator under each piece of scene information in the at least one piece of scene information.
  • the mapping relationship between thresholds, each scene information includes at least one of time, service type, and location area; acquiring target scene information of the first performance index and detection of the first performance index under the target scene information Value, the at least one piece of scene information includes the target scene information;
  • the determining unit 620 is configured to determine the threshold value of the first performance index under the target scene information according to the target scene information and the first abnormal dynamic information acquired by the acquiring unit 610;
  • the detection value under the information and the threshold value of the first performance index under the target scene information determine the detection result of the first performance index, and the detection result includes abnormal or normal.
  • the obtaining unit 610 is specifically configured to receive first indication information sent by the second management device, where the first indication information is used to instruct the first management device to obtain the first abnormal dynamic information; the determining unit 620 also uses According to the first indication information, the first abnormal dynamic information is determined from a plurality of abnormal dynamic information.
  • the acquiring unit 610 is specifically configured to acquire at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data, and each set of detection data includes scene information and the The detection value of the first performance index under the scene information; the determining unit 620 is further configured to determine the first abnormal dynamic information according to each group of detection data and a detection result corresponding to each group of detection data.
  • the acquiring unit 610 is further configured to acquire second indication information, where the second indication information is used to instruct the first management device to determine the first abnormal dynamic information; the determining unit 620 is further configured to determine the first abnormal dynamic information according to the second indication Information to obtain each group of detection data and the detection result corresponding to each group of detection data.
  • the apparatus 600 may further include a receiving unit 630 configured to receive the first abnormal dynamic information sent by the second management device.
  • the device 600 may further include a configuration unit 640 configured to configure demand information of the detection object according to the first abnormal dynamic information, and the demand information is used to request the detection object to report the first performance index.
  • the apparatus 600 may further include a sending unit 650 configured to send feedback information to the second management device, the feedback information including the detection value of the first performance indicator under the target scene information and the first Test results of performance indicators.
  • a sending unit 650 configured to send feedback information to the second management device, the feedback information including the detection value of the first performance indicator under the target scene information and the first Test results of performance indicators.
  • the receiving unit 630 is further configured to receive confirmation information sent by the second management device according to the feedback information, where the confirmation information is used to indicate whether the detection result of the first performance indicator is correct.
  • the first performance indicator is throughput rate, physical resource block usage rate, physical resource block usage distribution information, number of registered users, number of online users, user perception rate, packet loss rate, number of active users, delay, drop Call rate, CPU utilization rate, load rate, coverage ratio, regional traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session failure establishment number, data Any one of the number of successful radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage.
  • the device 600 here is embodied in the form of a functional unit.
  • the term "unit” here can refer to application specific integrated circuits (ASICs), electronic circuits, processors used to execute one or more software or firmware programs (such as shared processors, proprietary processors, or groups). Processor, etc.) and memory, merged logic circuits, and/or other suitable components that support the described functions.
  • ASICs application specific integrated circuits
  • the apparatus 600 may be specifically the first management device in the above-mentioned method 200 to method 500 embodiments, and the apparatus 600 may be used to execute the same as those in the above-mentioned method 200 to method 500 embodiments. To avoid repetition, each process and/or step corresponding to the first management device will not be repeated here.
  • the device 600 may be replaced with a chip device, for example, a communication chip that can be used in the device to implement related functions of the processor in the device.
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for realizing related functions.
  • the chip may optionally include one or more memories for storing program codes. When the codes are executed, the processor realizes corresponding functions.
  • FIG. 9 shows a schematic block diagram of a device 700 for abnormality detection provided by an embodiment of the present application.
  • the device 700 includes:
  • the obtaining unit 710 is configured to obtain at least one set of detection data of the first performance indicator and a detection result corresponding to each set of detection data in the at least one set of detection data, where each set of detection data includes scene information and the first performance indicator
  • the determining unit 720 is configured to determine first abnormal dynamic information according to each group of detection data obtained by the obtaining unit 710 and a detection result corresponding to each group of detection data, where the first abnormal dynamic information is used to indicate the first performance index A mapping relationship between the at least one piece of scene information of and the threshold value of the first performance indicator under each piece of scene information in the at least one piece of scene information;
  • the sending unit 730 is configured to send the first abnormal dynamic information determined by the determining unit 720 to the first management device.
  • the apparatus 700 further includes a receiving unit 740 for the feedback information sent by the first management device according to the first abnormal dynamic information, the feedback information including the first performance indicator in the target scene information And the detection result of the first performance indicator, the at least one piece of scene information includes the target scene information.
  • the device 700 further includes a verification unit 750 configured to verify the detection result of the first performance index according to the feedback information to obtain a verification result, and the verification result includes correctness or incorrectness.
  • a verification unit 750 configured to verify the detection result of the first performance index according to the feedback information to obtain a verification result, and the verification result includes correctness or incorrectness.
  • the acquiring unit 710 is further configured to acquire business information of the first performance index, the business information including at least one of customer feedback, business interruption, and business experience; the verification unit is specifically configured to The feedback information and the business information verify the detection result of the first performance index.
  • the sending unit 730 is further configured to send confirmation information to the first management device, where the confirmation information is used to indicate whether the detection result of the first performance indicator is correct.
  • the first performance index includes throughput rate, physical resource block usage rate, physical resource block usage distribution information, the number of registered users, the number of online users, the user perception rate, the packet loss rate, the number of active users, the delay, and the Call rate, CPU usage rate, load rate, coverage ratio, area traffic capacity, wireless resource control connection number, protocol data unit session request establishment number, protocol data unit session establishment number successfully, protocol data unit session failure establishment number, data Any one of the number of successful radio bearer establishments, the number of QoS flow requests, the number of QoS flow establishments, or the amount of virtual resource usage.
  • the device 700 here is embodied in the form of a functional unit.
  • the term "unit” here can refer to ASICs, electronic circuits, processors for executing one or more software or firmware programs (such as shared processors, proprietary processors, or group processors, etc.) and memory, combined logic circuits, and /Or other suitable components that support the described functions.
  • the apparatus 700 may be specifically the second management device in the foregoing method 200 to method 500 embodiments, and the apparatus 700 may be used to execute the same as those in the foregoing method 200 to method 500 embodiments. To avoid repetition, each process and/or step corresponding to the second management device will not be repeated here.
  • the device 700 can be replaced with a chip device, for example, a communication chip that can be used in the device to implement related functions of the processor in the device.
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for realizing related functions.
  • the chip may optionally include one or more memories for storing program codes. When the codes are executed, the processor realizes corresponding functions.
  • FIG. 10 shows a device 800 for abnormality detection provided by an embodiment of the present application, and the device 800 may be the device 600 described in FIG. 8.
  • the device 600 may adopt the hardware architecture shown in FIG. 10.
  • the device 800 may include a processor 810, a transceiver 820, and a memory 830, and the processor 810, the transceiver 820, and the memory 830 communicate with each other through an internal connection path.
  • the relevant functions implemented by the determining unit 620 in FIG. 8 may be implemented by the processor 810, and the relevant functions implemented by the acquiring unit 610, the receiving unit 630, the configuration unit 640, and the sending unit 650 may be controlled by the processor 810 to control the transceiver 820. achieve.
  • the processor 810 may include one or more processors, for example, one or more central processing units (central processing units, CPUs).
  • CPUs central processing units
  • the processor may be a single-core CPU, or It can be a multi-core CPU.
  • the transceiver 820 is used to send and receive data and/or information, and to receive data and/or information.
  • the transceiver may include a transmitter and a receiver, the transmitter is used to send data and/or signals, and the receiver is used to receive data and/or signals.
  • the memory 830 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable memory (erasable read only memory, EPROM), and read-only memory.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable read only memory
  • read-only memory erasable read only memory
  • CD-ROM compact disc
  • the memory 830 is used to store program codes and data of the device, and may be a separate device or integrated in the processor 810.
  • the processor 810 is configured to control the transceiver to perform signal transmission with the second management device.
  • the processor 810 is configured to control the transceiver to perform signal transmission with the second management device.
  • FIG. 10 only shows a simplified design of the device 800.
  • the device 800 may also include other necessary components, including but not limited to any number of transceivers, processors, controllers, memories, etc., and all the management devices that can implement the application are protected by the application. Within range.
  • the device 800 can be replaced with a chip device for implementing related functions of the processor in the device.
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for realizing related functions.
  • the chip may optionally include one or more memories for storing program codes. When the codes are executed, the processor realizes corresponding functions.
  • FIG. 11 shows a device 900 for abnormality detection provided by an embodiment of the present application, and the device 900 may be the device 700 described in FIG. 9.
  • the device 700 may adopt the hardware architecture shown in FIG. 11.
  • the device 900 may include a processor 910, a transceiver 920, and a memory 930, and the processor 910, the transceiver 920, and the memory 930 communicate with each other through an internal connection path.
  • the related functions implemented by the determining unit 720 and the verification unit 750 in FIG. 9 can be implemented by the processor 910, and the related functions implemented by the acquiring unit 710, the sending unit 730, and the receiving unit 740 can be controlled by the processor 910 to control the transceiver 920. achieve.
  • the processor 910 may include one or more processors, for example, one or more CPUs.
  • the processor may be a single-core CPU or a multi-core CPU.
  • the transceiver 920 is used to send and receive data and/or information, and to receive data and/or information.
  • the transceiver may include a transmitter and a receiver, the transmitter is used to send data and/or signals, and the receiver is used to receive data and/or signals.
  • the memory 930 includes but is not limited to RAM, ROM, EPROM, and CD-ROM, and the memory 930 is used to store related instructions and data.
  • the memory 930 is used to store program codes and data of the apparatus, and may be a separate device or integrated in the processor 910.
  • the processor 910 is configured to control the transceiver to perform signal transmission with the first management device.
  • the processor 910 is configured to control the transceiver to perform signal transmission with the first management device.
  • FIG. 11 only shows a simplified design of the device 900.
  • the device 900 may also include other necessary components, including but not limited to any number of transceivers, processors, controllers, memories, etc., and all the management devices that can implement this application are protected by this application. Within range.
  • the device 900 may be replaced with a chip device for implementing related functions of the processor in the device.
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chips for realizing related functions.
  • the chip may optionally include one or more memories for storing program codes. When the codes are executed, the processor realizes corresponding functions.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)

Abstract

用于异常检测的方法包括：第一管理设备获取第一异常动态信息，该第一异常动态信息用于指示第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系，该每个场景信息包括时间、业务类型和位置区域中的至少一项（S210）；该第一管理设备获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息（S220）；该第一管理设备根据该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值（S230）；该第一管理设备根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果，该检测结果包括异常或正常（S240）。能够基于不同的场景对性能指标进行异常检测，提高检测的准确性。

Description

用于异常检测的方法和装置 技术领域
本申请涉及网络运维领域，并且更具体地，涉及网络运维领域中用于异常检测的方法和装置。
背景技术
运营商网络已发展到第五代(5G)移动通信技术，5G的网络架构方式相比于之前的通信技术来说更灵活，另外5G网络的时延、速率、连接规模等关键性能指标的需求也不断提升。与此同时，应用行业的丰富和多样发展，也对业务的性能保障和灵活性提出了更高的要求，因此，网络运维的难度越来越大。
网络性能问题的快速检测是保障网络性能的关键。对网络性能的指标设定阈值和检测是快速发现和评估网络问题的一种有效机制，运维人员可以快速有效发现网络问题，而无需实时监视海量的网络性能信息。网络运维人员可以对某个网络性能指标设定阈值，运维系统实时监控该网络性能指标，只要相应的网络性能指标达到或者超过该设定的阈值，运维系统向网络运维人员发送该网络性能指标异常的通知，使得网络运维人员获知此时网络处于异常状态。
然而，由于现有的网络性能指标监控方法中，针对待检测的性能指标设定的阈值是固定阈值，因此，可能导致在运维过程中发生虚假告警或即使正常告警但漏检的情况，准确性较低。
发明内容
本申请提供一种用于异常检测的方法和装置，能够基于不同的场景信息对性能指标进行异常检测，提高检测的准确性。
第一方面，本申请提供了一种用于异常检测的方法，该方法包括：
第一管理设备获取第一异常动态信息，所述第一异常动态信息用于指示第一性能指标的至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系，所述每个场景信息包括时间、业务类型和位置区域中的至少一项；
所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；
所述第一管理设备根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；
所述第一管理设备根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果，所述检测结果包括异常或正常。
采用本申请实施例提供的用于异常检测的方法，针对不同的场景信息设定有与该场景 信息对应的阈值，能够基于性能指标的场景信息对该性能指标进行异常检测，从而提高检测的准确性。
可选地，所述第一性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项，本申请实施例对此不作限定。
还需要说明的是，本申请实施例中所述的场景信息可以包括以下几项中的至少一项：
(1)时间：例如，早中晚不同时刻，节假日等；
(2)业务类型：例如，增强的移动宽带(enhanced Mobile Broadband，eMBB)、低时延高可靠性(ultra-reliable low latency communication，URLLC)、mIoT、V2X(vehicle to everything)、增强现实(augmented reality，AR)、虚拟现实(virtual reality，VR)等；
(3)位置区域：例如，室内，室外，高铁，广场等；
(4)其它性能指标：也就是说，第一性能指标的场景信息可以包括第二性能指标，其中，该第二性能指标与该第一性能指标不同。例如，当选定吞吐率为第一性能指标时，在线用户数、覆盖比例等其它性能指标可能均可作为吞吐率的场景信息。
也就是说，所述每个场景信息包括时间、业务类型、位置区域和第二性能指标中的至少一项。
可选地，所述第二性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项，本申请实施例对此不作限定。
可选地，该第一异常动态信息可以为多种不同的形式，本申请实施例对此不作限定。
在一种可能的实现方式中，该第一异常动态信息可以为映射表，该映射表包括该第一性能指标、该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下所对应的阈值。
在另一种可能的实现方式中，该第一异常动态信息可以为异常动态模型，该异常动态模型的输入为该第一性能指标的场景信息，输出为该第一性能指标在该场景信息下所对应的阈值。
可选地，该第一管理设备可以通过多种不同的方式获取该第一异常动态信息，本申请实施例对此不作限定。
在一种可能的实现方式中，所述第一管理设备获取第一异常动态信息，包括：所述第一管理设备接收第二管理设备发送的第一指示信息，所述第一指示信息用于指示所述第一管理设备获取所述第一异常动态信息；所述第一管理设备根据所述第一指示信息，从多个异常动态信息中确定所述第一异常动态信息。
可选地，在该第一管理设备根据该第一指示信息，从多个异常动态信息中确定该第一 异常动态信息之前，该第一管理设备可以预先获取该多个异常动态信息，该多个异常动态信息包括该第一异常动态信息。
可选地，该第一指示信息可以携带该第一异常动态信息的标识，该第一管理设备可以根据该第一异常动态信息的标识，从多个异常动态信息中确定该第一异常动态信息。
例如，当该第一异常动态信息为映射表的形式时，该第一指示信息可以携带该映射表的标识。
又例如，当该第一异常动态信息为异常动态模型的形式时，该第一指示信息可以携带该异常动态模型的标识。
在一种可能的实现方式中，所述第一管理设备获取第一异常动态信息，包括：所述第一管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值；所述第一管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定所述第一异常动态信息。
在一种可能的实现方式中，所述第一管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，包括：所述第一管理设备获取第二指示信息，所述第二指示信息用于指示所述第一管理设备确定所述第一异常动态信息；所述第一管理设备根据所述第二指示信息，获取所述每组检测数据和所述每组检测数据对应的检测结果。
可选地，该第二指示信息可以承载在阈值配置消息中。
采用本申请实施例提供的用于异常检测的方法，上述第二指示信息承载在现有的阈值配置消息中，可以重用现有的阈值配置接口，即可以通过现有的阈值配置接口的传输第二指示信息，兼容性更强。
在一种可能的实现方式中，所述第一管理设备获取第一异常动态信息，包括：所述第一管理设备接收第二管理设备发送的所述第一异常动态信息。
可选地，该第一管理设备可以主动请求该第二管理设备发送该第一异常动态信息；或，该第一管理设备可以周期性接收该第二管理设备发送的该第一异常动态信息；或，该第一管理设备可以接收该第二管理设备在生成或更新该第一异常动态信息之后实时发送的该第一异常动态信息；或，该第一管理设备可以接收该第二管理设备发送的该异常检测请求，该异常检测请求携带该第一异常动态信息。
在一种可能的实现方式中，所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，包括：所述第一管理设备根据所述第一异常动态信息，配置检测对象的需求信息，所述需求信息用于请求所述检测对象上报所述第一性能指标的所述目标场景信息和所述第一性能指标在所述目标场景信息下的检测值；所述第一管理设备接收所述检测对象根据所述需求信息发送的所述第一性能指标的所述目标场景信息和所述第一性能指标在所述目标场景信息下的检测值。
可选地，该第一管理设备可以根据该第二管理设备的请求配置检测对象的需求信息；或该第一管理设备可以周期性配置检测对象的需求信息，本申请实施例对此不作限定。
可选地，该第一性能指标在该目标场景信息下的阈值可以理解为该第一性能指标在该目标场景信息下的最小值或最大值。
在一种可能的实现方式中，当该第一性能指标在该目标场景信息下的检测值小于或等于该阈值时，判定该第一性能指标异常；或，当该第一性能指标在该目标场景信息下的检测值大于该阈值时，判定该第一性能指标正常。
在另一种可能的实现方式中，当该第一性能指标在该目标场景信息下的检测值大于或等于该阈值时，判定该第一性能指标异常；或，当该第一性能指标在该目标场景信息下的检测值小于该阈值时，判定该第一性能指标正常。
可选地，该第一性能指标在该目标场景信息下的阈值可以包括第一阈值和第二阈值，该第一阈值小于该第二阈值。
在一种可能的实现方式中，当该第一性能指标在该目标场景信息下的检测值小于或等于该第一阈值时，判定该第一性能指标严重异常；或，当该第一性能指标在该目标场景信息下的检测值大于该第一阈值，且小于或等于该第二阈值时，判定该第一性能指标普通异常；或，当该第一性能指标在该目标场景信息下的检测值大于该第二阈值时，判定该第一性能指标正常。
在另一种可能的实现方式中，当该第一性能指标在该目标场景信息下的检测值大于或等于该第二阈值时，判定该第一性能指标严重异常；或，当该第一性能指标在该目标场景信息下的检测值小于该第二阈值，且大于或等于该第一阈值时，判定该第一性能指标普通异常；或，当该第一性能指标在该目标场景信息下的检测值小于该第一阈值时，判定该第一性能指标正常。
在一种可能的实现方式中，所述方法还包括：所述第一管理设备向第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
在一种可能的实现方式中，所述方法还包括：所述第一管理设备接收所述第二管理设备根据所述反馈信息发送的确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
可选地，当该确认信息指示该第一性能指标的检测结果正确时，该第一管理设备保存该第一异常动态信息。
采用本申请实施例提供的用于异常检测的方法，将第一异常动态信息保存在本地，之后再次对该第一性能指标进行异常检测时，无需重新从第二管理设备处获取该第一异常动态信息，直接从本地调用即可，更加快速和便捷。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该第一管理设备还可以接收该第二管理设备发送的更新异常动态信息，该更新异常动态信息用于表示第一性能指标在该目标场景信息下的更新的阈值。
相应地，该第一管理设备可以将本地存储的该第一异常动态信息更新为该更新异常动态信息。
采用本申请实施例提供的用于异常检测的方法，通过验证不断更新本地存储的该第一异常动态信息，能够保证该第一异常动态信息的实时性，并提高该第一异常动态信息的准确性。
在一种可能的实现方式中，所述第一性能指标为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时 延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
第二方面，本申请提供另一种用于异常检测的方法，该方法包括：
所述第二管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；
所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；
所述第二管理设备向第一管理设备发送所述第一异常动态信息。
采用本申请实施例提供的用于异常检测的方法，针对不同的场景信息设定有与该场景信息对应的阈值的映射关系，能够基于该性能指标的场景信息对该性能指标进行异常检测，从而提高检测的准确性。
可选地，所述第一性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项，本申请实施例对此不作限定。
还需要说明的是，本申请实施例中所述的场景信息可以包括以下几项中的至少一项：
(1)时间：例如，早中晚不同时刻，节假日等；
(2)业务类型：例如，增强的移动宽带(enhanced Mobile Broadband，eMBB)、低时延高可靠性(ultra-reliable low latency communication，URLLC)、mIoT、V2X(vehicle to everything)、增强现实(augmented reality，AR)、虚拟现实(virtual reality，VR)等；
(3)位置区域：例如，室内，室外，高铁，广场等；
(4)其它性能指标：也就是说，第一性能指标的场景信息可以包括第二性能指标，其中，该第二性能指标与该第一性能指标不同。例如，当选定吞吐率为第一性能指标时，在线用户数、覆盖比例等其它性能指标可能均可作为吞吐率的场景信息。
也就是说，所述场景信息包括时间、业务类型、位置区域和第二性能指标中的至少一项。
可选地，所述第二性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任 一项，本申请实施例对此不作限定。
可选地，该第一异常动态信息可以为多种不同的形式，本申请实施例对此不作限定。
在一种可能的实现方式中，该第一异常动态信息可以为映射表，该映射表包括该第一性能指标、该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下所对应的阈值。
在另一种可能的实现方式中，该第一异常动态信息可以为异常动态模型，该异常动态模型的输入为该第一性能指标的场景信息，输出为该第一性能指标在该场景信息下所对应的阈值。
可选地，该第一管理设备可以通过多种不同的方式获取该第一异常动态信息，本申请实施例对此不作限定。
采用本申请实施例提供的用于异常检测的方法，上述第一异常动态信息承载在现有的阈值配置消息中，可以重用现有的阈值配置接口，即可以通过现有的阈值配置接口的传输映射关系，兼容现有接口。
在一种可能的实现方式中，所述方法还包括：所述第二管理设备接收所述第一管理设备根据所述第一异常动态信息发送的反馈信息，所述反馈信息包括所述第一性能指标在目标场景信息下的检测值和所述第一性能指标的检测结果，所述至少一个场景信息包括所述目标场景信息。
在一种可能的实现方式中，所述方法还包括：所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果，所述验证结果包括正确或不正确。
在一种可能的实现方式中，所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，包括：所述第二管理设备获取所述第一性能指标的业务信息，所述业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项；所述第二管理设备根据所述反馈信息和所述业务信息，对所述第一性能指标的检测结果进行验证。
可选地，该第二管理设备还可以将该反馈信息呈现给技术人员，获取技术人员根据工作经验对该第一性能指标的检测结果进行验证得到验证结果。
在一种可能的实现方式中，所述方法还包括：所述第二管理设备向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
可选地，当该确认信息指示该第一性能指标的检测结果正确时，该第二管理设备保存该第一异常动态信息。
采用本申请实施例提供的用于异常检测的方法，将第一异常动态信息保存在本地，之后再次对该第一性能指标进行异常检测时，无需重新建立该第一异常动态信息，直接从本地调用即可，更加快速和便捷。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该第二管理设备还可以确定更新异常动态信息，该更新异常动态信息用于表示该第一性能指标在目标场景信息下的更新的阈值；该第二管理设备可以向该第一管理设备发送该更新异常动态信息；相应地，该第一管理设备可以接收该第二管理设备发送的该更新异常动态信息，并将本地存储的该第一异常动态信息更新为该更新异常动态信息。
采用本申请实施例提供的用于异常检测的方法，通过验证不断更新本地存储的该第一 异常动态信息，能够保证该第一异常动态信息的实时性，并提高该第一异常动态信息的准确性。
在一种可能的实现方式中，所述第一性能指标包括吞吐率、物理资源块使用率、物理资源块使用分布信息，注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数，协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
第三方面，本申请还提供一种用于异常检测的方法，该方法包括：
第二管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；
所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；
所述第二管理设备向第一管理设备发送所述第一异常动态信息；
所述第一管理设备接收所述第一管理设备发送的所述第一异常动态信息；
所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；
所述第一管理设备根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；
所述第一管理设备根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果。
在一种可能的实现方式中，所述方法还包括：所述第一管理设备向所述第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
在一种可能的实现方式中，所述方法还包括：所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果；所述第二管理设备向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
在一种可能的实现方式中，所述方法还包括：当所述确认信息指示所述第一性能指标的检测结果不正确时，所述第二管理设备确定更新异常动态信息，所述更新异常动态信息用于指示所述第一性能指标在所述目标场景信息下的更新的阈值；所述第二管理设备向所述第一管理设备发送所述更新异常动态信息。
在一种可能的实现方式中，所述方法还包括：所述第一管理设备将所述第一异常动态信息更新为所述更新异常动态信息。
第四方面，本申请还提供一种用于异常检测的装置，用于执行上述第一方面或第一方面的任意可能的实现方式中的方法。具体地，该装置可以包括用于执行上述第一方面或第 一方面的任意可能的实现方式中的方法的单元。
第五方面，本申请还提供一种用于异常检测的装置，用于执行上述第二方面或第二方面的任意可能的实现方式中的方法。具体地，该装置可以包括用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的单元。
第六方面，本申请还提供一种用于异常检测的系统，该系统包括上述第四方面所述的装置和上述第五方面所述的装置。
第七方面，本申请提供了一种管理设备，该管理设备包括：存储器、处理器、收发器及存储在该存储器上并可在该处理器上运行的指令，其中，该存储器、该处理器以及该通信接口之间通过内部连接通路互相通信，该处理器执行该指令使得该通信设备实现上述第一方面或第一方面的任意可能的实现方式中的方法。
第八方面，本申请提供了一种管理设备，该管理设备包括：存储器、处理器、收发器及存储在该存储器上并可在该处理器上运行的指令，其中，该存储器、该处理器以及该通信接口之间通过内部连接通路互相通信，该处理器执行该指令使得该通信设备实现上述第二方面或第二方面的任意可能的实现方式中的方法。
第九方面，本申请还提供一种用于异常检测的系统，该系统包括上述第七方面所述的管理设备和上述第八方面所述的管理设备。
第十方面，本申请还提供一种用于异常检测的系统，所述系统包括第一管理设备和第二管理设备；
第二管理设备，用于获取第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的所述至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；向第一管理设备发送所述第一异常动态信息；
所述第一管理设备，用于接收所述第一管理设备发送的所述第一异常动态信息；获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果。
在一种可能的实现方式中，所述第一管理设备还用于向所述第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
在一种可能的实现方式中，所述第二管理设备还用于根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果；向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
在一种可能的实现方式中，所述第二管理设备还用于当所述确认信息指示所述第一性能指标的检测结果不正确时，确定更新异常动态信息，所述更新异常动态信息用于指示所 述第一性能指标在所述目标场景信息下的更新的阈值；向所述第一管理设备发送所述更新异常动态信息。
在一种可能的实现方式中，所述第一管理设备还用于将所述第一异常动态信息更新为所述更新异常动态信息。
第十一方面，本申请提供了一种计算机可读存储介质，用于存储计算机程序，该计算机程序包括用于实现上述各个方面或其任意可能的实现方式中的方法的指令。
第十二方面，本申请提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机实现上述各个方面或其任意可能的实现方式中的方法。
第十三方面，本申请提供了一种芯片装置，包括：输入接口、输出接口、至少一个处理器、存储器，该输入接口、输出接口、该处理器以及该存储器之间通过内部连接通路互相通信，该处理器用于执行该存储器中的代码，当该处理器执行该代码时，该芯片装置实现上述各个方面或其任意可能的实现方式中的方法。
附图说明
图1提供了本申请实施例的用于异常检测的方法所应用的系统100的示意性架构图；
图2提供了本申请实施例的用于异常检测的方法200的示意性流程图；
图3提供了本申请实施例的异常动态模型的示意图；
图4提供了本申请实施例的另一异常动态模型的示意图；
图5提供了本申请实施例的用于异常检测的方法300的示意性流程图；
图6提供了本申请实施例的用于异常检测的方法400的示意性流程图；
图7提供了本申请实施例的用于异常检测的方法500的示意性流程图；
图8提供了本申请实施例的用于异常检测的装置600的示意性框图；
图9提供了本申请实施例的用于异常检测的装置700的示意性框图；
图10提供了本申请实施例的用于异常检测的装置800的示意性框图；
图11提供了本申请实施例的用于异常检测的装置900的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
图1示出了本申请实施例提供的用于异常检测的方法所应用的系统100的示意性架构图。如图1所示，该系统100包括业务运营设备110、端到端网络管理设备120、域网络管理设备130和网络设备140。其中，业务运营设备110与端到端网络管理设备120之间存在通信连接，端到端网络管理设备120与域网络管理设备130之间存在通信连接，域网络管理设备130与网络设备140之间存在通信连接。
需要说明的是，业务运营设备提供业务运营功能，包括：业务发放、业务保障、业务调度、用户管理等功能，包括垂直行业的业务运营系统或者运营商的业务运营系统。
例如，该业务运营设备可以为业务支撑系统(business support system，BSS)或者通信业务管理功能(communication service management function，CSMF)。
还需要说明的是，端到端网络管理设备提供网络运维功能，包括：网络的生命周期管理、网络的部署、网络的故障管理、网络的性能管理、网络的配置管理、网络的性能保障, 网络的优化功能等。这里的网络可以包括一个或者多个网元、一个或者多个子网络、一个或者多个网元和一个或者多个子网络。
例如，该端到端网络管理设备可以是网络管理(network manager，NM)系统、运营支撑系统(operations support system，OSS)、网络切片管理功能(network slice management function，NSMF)、网络管理数据分析功能(management data analytical function，MDAF)、自组织网络(self-organization network，SON)功能(function)。
还需要说明的是，域网络管理设备提供以下功能之一或者全部：
(1)域内网络运维功能，即子网络或者网元的运维功能，包括子网络或者网元的生命周期管理，子网络或者网元的部署，子网络或者网元的故障管理，子网络或者网元的性能管理，子网络或者网元的性能保障，子网络或者网元的优化功能等。这里的子网络包括一个或者多个网元、一个或者多个其它子网络、一个或者多个网元和一个或者多个其它子网络。这里的域可以包括技术域(包括无线接入网域，传输网域或者核心网域),厂商域(域内的网络设备都来自同一个厂商)或者地理区域(某一个地理区域的网络)。
(2)网络控制功能，负责特定范围(e.g.地理区域)内无线资源的自治管理、控制和分析，对外暴露满足一个特定用户群的无线话务场景的网络。
例如，该域网络管理设备可以是网络切片子网管理系统(network slice subnet management function，NSSMF)、子网络管理系统(subnetwork management function,SMF)、域管理系统(domain manager,DM)、元素管理系统(element manager，EM)、域管理数据分析功能(management data analytic function,MDAF)、无线智能控制器(RAN intelligent controller,RIC)、无线外接控制器(RAN external controller，REC)、应用控制器(Application Controller,APPC)、移动网络自动化引擎(Mobile Network Automation Engine,MAE)。
还需要说明的是，网络设备可以理解为提供网络服务的实体，即网元；或可以理解为网络功能。
例如，网元可以为接入网网元(基站)、集中控制单元(CUCP)、集中式单元(centralized，unit，CU)、分布式单元(distributed unit，DU)、集中用户面单元(CUUP)、核心网网元(接入管理功能(access management function，AMF)或会话管理功能(session management function，SMF))。
可选地，图1中提供的系统100仅示意性示出域网络管理设备130管理的1个网络设备(网络设备140)，域网络管理设备130还可以管理其他数量的网络设备，本申请实施例对此不作限定。
图2示出了本申请实施例提供的用于异常检测的方法200的示意性流程图，该方法200适用于如图1所示的系统100。
S210，第一管理设备获取第一异常动态信息，该第一异常动态信息用于指示第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系，该每个场景信息包括时间、业务类型和位置区域中的至少一项。
可选地，该第一异常动态信息可以指示该第一性能指标的多个场景信息和该第一性能指标在该多个场景信息中每个场景信息下的阈值之间的映射关系。
可选地，该每个场景信息可以包括时间、业务类型、位置区域和第二性能指标中的至少一项。
S220，该第一管理设备获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息。
S230，该第一管理设备根据该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值。
S240，该第一管理设备根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果，该检测结果包括异常或正常。
需要说明的是，上述第一管理设备可以为系统100中的域网络管理设备、端到端网络管理设备或网络设备。
需要说明的是，本申请实施例中所述的第一性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项，本申请实施例对此不作限定。
还需要说明的是，本申请实施例中所述的场景信息可以包括以下几项中的至少一项：
(1)时间
例如，早中晚不同时刻，节假日等；
(2)业务类型
例如，增强的移动宽带(enhanced Mobile Broadband，eMBB)、低时延高可靠性(ultra-reliable low latency communication，URLLC)、mIoT、V2X(vehicle to everything)、增强现实(augmented reality，AR)、虚拟现实(virtual reality，VR)等；
(3)位置区域
例如，室内，室外，高铁，广场等；
(4)其它性能指标
也就是说，第一性能指标的场景信息可以包括第二性能指标，其中，该第二性能指标与该第一性能指标不同。
例如，当选定吞吐率为第一性能指标时，在线用户数、覆盖比例等其它性能指标可能均可作为吞吐率的场景信息。
可选地，该第一异常动态信息可以为多种不同的形式，本申请实施例对此不作限定。
在一种可能的实现方式中，该第一异常动态信息可以为映射表，该映射表包括该第一性能指标、该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下所对应的阈值。
例如，该第一异常动态信息可以如表一所示，其中，该第一性能指标为在线用户数，第一场景信息为时间，该第一性能指标在该第一场景信息下的阈值为第一阈值。
第一性能指标 第一场景信息 第一阈值
在线用户数 上午5:00～上午7:00 100人
表一
又例如，该第一异常动态信息可以如表二所示，其中，该第一性能指标为在线用户数， 第一场景信息为时间，第二场景信息为位置区域，该第一性能指标在该第一场景信息下所对应的阈值为第一阈值，该第一性能指标在该第二场景信息下的阈值为第二阈值。
Figure PCTCN2019108620-appb-000001
表二
又例如，该第一异常动态信息可以如表三所示，其中，该第一性能指标为在线用户数，第一场景信息和第二场景信息均包括时间和业务类型，该第一场景信息和该第二场景信息不同，该第一性能指标在该第一场景信息下的阈值为第一阈值，该第一性能指标在该第二场景信息下的阈值为第二阈值。
Figure PCTCN2019108620-appb-000002
表三
又例如，该第一异常动态信息可以如表四所示，其中，该第一性能指标为在线用户数，第一场景信息包括时间和业务类型，该第二场景信息包括注册用户数(第二性能指标)和位置区域，该第一性能指标在该第一场景信息下的阈值为第一阈值，该第一性能指标在该第二场景信息下的阈值为第二阈值。
Figure PCTCN2019108620-appb-000003
表四
在另一种可能的实现方式中，该第一异常动态信息可以为异常动态模型，该异常动态模型的输入为该第一性能指标的场景信息，输出为该第一性能指标在该场景信息下所对应的阈值。
例如，该异常动态模型可以如图3所示。
可选地，S210中，该第一管理设备可以通过多种不同的方式获取该第一异常动态信息，本申请实施例对此不作限定。
方式一，该第一管理设备可以接收第二管理设备发送的第一指示信息，该第一指示信息用于指示该第一管理设备获取该第一异常动态信息；该第一管理设备根据该第一指示信息，从多个异常动态信息中确定该第一异常动态信息。
需要说明的是，当上述第一管理设备为域网络管理设备时，上述第二管理设备为端到端网络管理设备；或，当上述第一管理设备为端到端网络管理设备时，上述第二管理设备 为业务运营管理设备；或，当上述第一管理设备为网络设备时，上述第二管理设备为域网络管理设备或端到端网络管理设备。
还需要说明的是，该第一管理设备可以理解为供应方(provider)，该第二管理设备可以理解为消费方(consumer)。
可选地，该第一指示信息可以携带该第一异常动态信息的标识，该第一管理设备可以根据该第一异常动态信息的标识，从多个异常动态信息中确定该第一异常动态信息。
例如，当该第一异常动态信息为映射表的形式时，该第一指示信息可以携带该映射表的标识。
又例如，当该第一异常动态信息为异常动态模型的形式时，该第一指示信息可以携带该异常动态模型的标识。
可选地，在该第一管理设备根据该第一指示信息，从多个异常动态信息中确定该第一异常动态信息之前，该第一管理设备可以预先获取该多个异常动态信息，该多个异常动态信息包括该第一异常动态信息。
在第一种可能的实现方式中，以该多个异常动态信息包括该第一异常动态信息和第二异常动态信息为例，第二异常动态信息用于指示第二性能指标的至少一个场景信息和该第二性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系。
可选地，该第二异常动态信息可以为映射表的形式或异常动态模型的形式，具体可以参考第一异常动态信息，为避免重复，此处不再赘述。
方式二，该第一管理设备可以自己确定该第一异常动态信息。
在一种可能的实现方式中，该第一管理设备可以获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值；该第一管理设备根据该每组检测数据和该每组检测数据对应的检测结果，确定该第一异常动态信息。
例如，如图4所示，该第一管理设备可以将第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果输入机器学习(machine learning，ML)算法模型进行学习，建立该异常动态模型。
可选地，该第一管理设备可以获取第二指示信息，该第二指示信息用于指示该第一管理设备确定该第一异常动态信息；该第一管理设备可以根据该第二指示信息，获取该每组检测数据和该每组检测数据对应的检测结果。
也就是说，第二管理设备可以向第一管理设备发送第二指示信息，该第二指示信息可以使能该第一管理设备自己生成或更新该第一异常动态信息。
可选地，该第二指示信息可以承载在阈值配置消息中。
采用本申请实施例提供的用于异常检测的方法，上述第二指示信息承载在现有的阈值配置消息中，可以重用现有的阈值配置接口，即可以通过现有的阈值配置接口的传输第二指示信息，从而指示该第一管理设备自动生成或者更新第一异常动态信息。
方式三，该第一管理设备可以接收第二管理设备发送的该第一异常动态信息。
可选地，该第一管理设备可以主动请求该第二管理设备发送该第一异常动态信息；或，该第一管理设备可以周期性接收该第二管理设备发送的该第一异常动态信息；或，该第一管理设备可以接收该第二管理设备在生成或更新该第一异常动态信息之后实时发送的该 第一异常动态信息；或，该第一管理设备可以接收该第二管理设备发送的该异常检测请求，该异常检测请求携带该第一异常动态信息。
在第一种可能的实现方式中，该第一管理设备可以向第二管理设备发送异常动态信息获取请求，该异常动态信息获取请求用于请求获取该第一异常动态信息；该第一管理设备接收该第二管理设备根据该异常动态信息获取请求发送的该第一异常动态信息。
可选地，该异常动态信息获取请求可以携带该第一异常动态信息的标识。
在第二种可能的实现方式中，该第一管理设备可以根据传输周期，周期性接收该第二管理设备发送的该第一异常动态信息。
可选地，该第一管理设备和该第二管理设备可以预先约定该传输周期，或该第二管理设备可以通过指示信息向该第一管理设备指示该传输周期，本申请实施例对此不作限定。
在第三种可能的实现方式中，当该第二管理设备生成或更新该第一异常动态信息后，该第二管理设备可以实时向该第一管理设备发送该第一异常动态信息；相应地，该第一管理设备可以接收该第二管理设备实时发送的该第一异常动态信息。
在第四种可能的实现方式中，该第二管理设备可以向该第一管理设备发送异常检测请求，该异常检测请求用于请求对该第一性能指标进行异常检测，该异常检测请求可以携带该第一异常动态信息；相应地，该第一管理设备接收该第二管理设备发送的该异常检测请求。
可选地，该第一异常动态信息可以承载在阈值配置消息中。
采用本申请实施例提供的用于异常检测的方法，上述第一异常动态信息承载在现有的阈值配置消息中，可以重用现有的阈值配置接口，即可以通过现有的阈值配置接口的传输映射关系，兼容现有接口。
可选地，在S210之前，该第一管理设备可以接收该第二管理设备发送的异常检测请求，该异常检测请求用于请求对该第一性能指标进行异常检测。相应地，该第一管理设备可以根据该异常检测请求，执行S210和S220。
可选地，本申请实施例对S210和S220的执行顺序不作限定。
在一种可能的实现方式中，该第一管理设备可以分别执行S210和S220。其中，S220可以为该第一管理设备根据预设的至少一个场景信息，获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息。
也就是说，S210可以在S220之后执行，或S210可以在S220之前执行，或S210和S220可以同时执行。
在另一种可能的实现方式中，该第一管理设备可以根据该第一异常动态信息，获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值。
也就是说，S220在S210之后执行。
具体地，该第一管理设备可以根据该第一异常动态信息，配置检测对象的需求信息，该需求信息用于请求该检测对象上报该第一性能指标的该目标场景信息和该第一性能指标在该目标场景信息下的检测值；该第一管理设备接收该检测对象根据该需求信息上报的该目标场景信息和该第一性能指标在该目标场景信息下的检测值。
例如，该第一异常动态信息如表一所示时，该第一管理设备可以根据表一，配置检测 对象的需求信息，该需求信息用于请求检测对象上报上午5:00～上午7:00的在线用户数，该检测对象可以根据该需求信息上报上午5:00～上午7:00的在线用户数的检测值。
又例如，该第一异常动态信息如表二所示时，该第一管理设备可以根据表二，配置检测对象的需求信息，该需求信息用于请求检测上报上午5:00～上午7:00的在线用户数，以及室外的在线用户数，该检测对象可以根据该需求信息上报上午5:00～上午7:00的在线用户数的检测值，以及室外的在线用户数的检测值。
可选地，该第一管理设备可以根据该第二管理设备的请求配置检测对象的需求信息；或该第一管理设备可以周期性配置检测对象的需求信息，本申请实施例对此不作限定。
需要说明的是，S230中，该第一管理设备可以将该目标场景信息在该第一异常动态信息中进行查找和匹配，确定该第一性能指标在该目标场景信息下的阈值。
相应地，S240中，该第一管理设备可以通过该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值进行比较，得到该第一性能指标的检测结果。
可选地，该第一性能指标在该目标场景信息下的阈值可以理解为该第一性能指标在该目标场景信息下的最小值或最大值。
在一种可能的实现方式中，S240可以包括：当该第一性能指标在该目标场景信息下的检测值小于或等于该阈值时，判定该第一性能指标异常；或，当该第一性能指标在该目标场景信息下的检测值大于该阈值时，判定该第一性能指标正常。
在另一种可能的实现方式中，S240可以包括：当该第一性能指标在该目标场景信息下的检测值大于或等于该阈值时，判定该第一性能指标异常；或，当该第一性能指标在该目标场景信息下的检测值小于该阈值时，判定该第一性能指标正常。
可选地，该第一性能指标在该目标场景信息下的阈值可以包括第一阈值和第二阈值，该第一阈值小于该第二阈值。
在一种可能的实现方式中，S240可以包括：当该第一性能指标在该目标场景信息下的检测值小于或等于该第一阈值时，判定该第一性能指标严重异常；或，当该第一性能指标在该目标场景信息下的检测值大于该第一阈值，且小于或等于该第二阈值时，判定该第一性能指标普通异常；或，当该第一性能指标在该目标场景信息下的检测值大于该第二阈值时，判定该第一性能指标正常。
在另一种可能的实现方式中，S240可以包括：当该第一性能指标在该目标场景信息下的检测值大于或等于该第二阈值时，判定该第一性能指标严重异常；或，当该第一性能指标在该目标场景信息下的检测值小于该第二阈值，且大于或等于该第一阈值时，判定该第一性能指标普通异常；或，当该第一性能指标在该目标场景信息下的检测值小于该第一阈值时，判定该第一性能指标正常。
可选地，在S240之后，该第一管理设备向第二管理设备发送反馈信息，该反馈信息包括该第一性能指标在该目标场景信息下的检测值和该第一性能指标的检测结果。
可选地，在该第一管理设备向第二管理设备发送该反馈信息之后，该第一管理设备可以接收该第二管理设备根据该反馈信息发送的确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确。
可选地，当该确认信息指示该第一性能指标的检测结果正确时，该第一管理设备保存 该第一异常动态信息。
采用本申请实施例提供的用于异常检测的方法，将第一异常动态信息保存在本地，之后再次对该第一性能指标进行异常检测时，无需重新从第二管理设备处获取该异常动态信息，直接从本地调用即可，更加快速和便捷。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该第一管理设备还可以接收该第二管理设备发送的更新异常动态信息，该更新异常动态信息用于表示第一性能指标在该目标场景信息下的更新的阈值。
相应地，该第一管理设备可以将本地存储的该第一异常动态信息更新为该更新异常动态信息。
采用本申请实施例提供的用于异常检测的方法，通过验证不断更新本地存储的该第一异常动态信息，能够保证该第一异常动态信息的实时性，并提高该第一异常动态信息的准确性。
图5示出了本申请实施例提供的用于异常检测的方法300的示意性流程图，该方法300适用于如图1所示的系统100。
S310，该第二管理设备获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值，该场景信息包括时间、业务类型和位置区域中的至少一项，该检测结果包括异常或正常。
S320，该第二管理设备根据该每组检测数据和该每组检测数据对应的检测结果，确定第一异常动态信息，该第一异常动态信息用于指示该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系。
S330，该第二管理设备向第一管理设备发送该第一异常动态信息；相应地，该第一管理设备接收该第二管理设备发送的该第一异常动态信息。
S340，该第一管理设备获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息。
S350，该第一管理设备根据该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值。
S360，该第一管理设备根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果。
需要说明的是，上述第一管理设备可以为系统100中的域网络管理设备、端到端网络管理设备或网络设备。
相应地，当上述第一管理设备为域网络管理设备时，上述第二管理设备为端到端网络管理设备；或，当上述第一管理设备为端到端网络管理设备时，上述第二管理设备为业务运营管理设备；或，当上述第一管理设备为网络设备时，上述第二管理设备为域网络管理设备或端到端网络管理设备。
还需要说明的是，该第一管理设备可以理解为供应方(provider)，该第二管理设备可以理解为消费方(consumer)。
需要说明的是，本申请实施例中所述的第一性能指标可以为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活 用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
还需要说明的是，本申请实施例中的场景信息可以包括以下几项中的至少一项：
(1)时间
例如，早中晚不同时刻，节假日等；
(2)负载
例如，负载轻重，用户数等；
(3)业务类型
例如，eMBB、URLLC、mIoT、V2X、AR、VR等；
(4)位置区域
例如，室内，室外，高铁，广场等；
(5)其它性能指标约束
也就是说，第一性能指标的场景信息可以包括第二性能指标，其中，该第二性能指标与该第一性能指标不同。
例如，当选定吞吐率为第一性能指标时，在线用户数、覆盖比例等其它性能指标可能均可作为吞吐率的场景信息。
可选地，该第一异常动态信息可以为多种不同的形式，本申请实施例对此不作限定。
在一种可能的实现方式中，该第一异常动态信息可以为映射表，该映射表包括该第一性能指标、该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下所对应的阈值。
例如，该第一异常动态信息可以如上述表一至表四所示。
在另一种可能的实现方式中，该第一异常动态信息可以为异常动态模型，该异常动态模型的输入为该第一性能指标的场景信息，输出为该第一性能指标在该场景信息下所对应的阈值。
例如，该异常动态模型可以如图3所示。
可选地，S320中，该第二管理设备可以获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值；该第二管理设备根据该每组检测数据和该每组检测数据对应的检测结果，确定该第一异常动态信息。
例如，如图4所示，该第二管理设备可以将第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果输入机器学习算法模型进行学习，建立该异常动态模型。
可选地，S330中，该第二管理设备可以根据该第一管理设备的请求，向该第一管理设备发送该第一异常动态信息；或，该第二管理设备可以周期性向该第一管理设备发送该第一异常动态信息；或，该第二管理设备可以在生成或更新该第一异常动态信息后，实时向该第一管理设备发送该第一异常动态信息；或，该第二管理设备可以向该第一管理设备发送异常检测请求，该异常检测请求用于请求对该第一性能指标进行异常检测，该异常检 测请求携带该第一异常动态信息。
在第一种可能的实现方式中，第一管理设备可以向该第二管理设备发送异常动态信息获取请求，该异常动态信息获取请求用于请求获取该第一异常动态信息；相应地，该第二管理设备接收该异常动态信息获取请求，并根据该异常动态信息获取请求，向该第一管理设备发送该第一异常动态信息。
可选地，该异常动态信息获取请求可以携带该第一异常动态信息的标识。
在第二种可能的实现方式中，该第二管理设备可以根据传输周期，周期性向该第一管理设备发送该第一异常动态信息；相应地，该第一管理设备根据该传输周期，周期性接收该第二管理设备发送的该第一异常动态信息。
可选地，该第一管理设备和该第二管理设备可以预先约定该传输周期，或该第二管理设备可以通过指示信息向该第一管理设备指示该传输周期，本申请实施例对此不作限定。
在第三种可能的实现方式中，当该第二管理设备生成或更新该第一异常动态信息后，该第二管理设备可以实时向该第一管理设备发送该第一异常动态信息；相应地，该第一管理设备可以接收该第二管理设备实时发送的该第一异常动态信息。
在第四种可能的实现方式中，该第二管理设备可以向该第一管理设备发送异常检测请求，该异常检测请求用于请求对该第一性能指标进行异常检测，该异常检测请求携带该第一异常动态信息；相应地，该第一管理设备接收该第二管理设备发送的该异常检测请求。
相应地，S340可以为：该第一管理设备根据该异常检测请求，获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值。
可选地，该第一异常动态信息可以承载在阈值配置消息中。
采用本申请实施例提供的用于异常检测的方法，上述第一异常动态信息承载在现有的阈值配置消息中，可以重用现有的阈值配置接口，即可以通过现有的阈值配置接口的传输映射关系，兼容现有接口。
可选地，在S330～S360的具体实现过程可以参考上述S210～S240，为避免重复，此处不再赘述。
可选地，在该第一管理设备确定该第一性能指标的检测结果之后，该第一管理设备可以向该第二管理设备发送反馈信息，该反馈信息包括该第一性能指标在该目标场景信息下的检测值和该第一性能指标的检测结果；相应地，该第二管理设备接收该第一管理设备发送的该反馈信息。
可选地，在该第二管理设备接收到该反馈信息以后，该第二管理设备可以根据该反馈信息，对该第一性能指标的检测结果进行验证，得到验证结果，该验证结果包括正确或不正确。
可选地，本申请实施例对该第二管理设备采用的验证方法不作限定。
在一种可能的实现方式中，该第二管理设备可以获取该第一性能指标的业务信息，该业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项；该第二管理设备可以根据该反馈信息和该业务信息，对该第一性能指标的检测结果进行验证。
可选地，该第二管理设备还可以将该反馈信息呈现给技术人员，获取技术人员根据工作经验对该第一性能指标的检测结果进行验证得到验证结果。
可选地，在验证该第一性能指标的检测结果之后，该第二管理设备可以向该第一管理 设备发送确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确；相应地，该第一管理设备接收该第二管理设备发送的该确认信息。
可选地，当该确认信息指示该第一性能指标的检测结果正确时，该第二管理设备保存该第一异常动态信息。
采用本申请实施例提供的用于异常检测的方法，将第一异常动态信息保存在本地，之后再次对该第一性能指标进行异常检测时，无需重新建立该第一异常动态信息，直接从本地调用即可，更加快速和便捷。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该第二管理设备还可以确定更新异常动态信息，该更新异常动态信息用于表示该第一性能指标在目标场景信息下的更新的阈值；该第二管理设备可以向该第一管理设备发送该更新异常动态信息；相应地，该第一管理设备可以接收该第二管理设备发送的该更新异常动态信息，并将本地存储的该第一异常动态信息更新为该更新异常动态信息。
采用本申请实施例提供的用于异常检测的方法，通过验证不断更新本地存储的该第一异常动态信息，能够保证该第一异常动态信息的实时性，并提高该第一异常动态信息的准确性。
图6示出了本申请实施例提供的用于异常检测的方法400的示意性流程图，该方法400适用于如图1所示的系统100。
S401，该第二管理设备获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值，该场景信息包括时间、业务类型和位置区域中的至少一项，该检测结果包括异常或正常。
S402，该第二管理设备根据该每组检测数据和该每组检测数据对应的检测结果，确定第一异常动态信息，该第一异常动态信息用于指示第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系。
可选地，该第二管理设备可以保存该第一异常动态信息。
S403，该第二管理设备向第一管理设备发送异常检测请求，该异常检测请求用于请求对该第一性能指标进行异常检测，该异常检测请求携带该第一异常动态信息；相应地，该第二管理设备接收该第一管理设备发送的该异常检测请求。
S404，该第一管理设备根据该异常检测请求，获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息。
S405，该第一管理设备根据该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值。
S406，该第一管理设备根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果。
可选地，该方法400还可以包括S407至S409。
S407，该第一管理设备向该第二管理设备发送反馈信息，该反馈信息包括该第一性能指标在该目标场景信息下的检测值和该第一性能指标的检测结果；相应地，该第二管理设备接收该第一管理设备发送的该反馈信息。
S408，该第二管理设备根据该反馈信息和该第一性能指标的业务信息，对该第一性能指标的检测结果进行验证，得到验证结果，该业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项，该验证结果包括正确或不正确。
S409，该第二管理设备向该第一管理设备发送确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确；相应地，该第一管理设备接收该第二管理设备发送的该确认信息。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该方法还可以包括S410和S411。
S410，该第二管理设备确定更新异常动态信息，该更新异常动态信息用于表示该第一性能指标在该目标场景信息下的更新的阈值。
S411，该第二管理设备将本地保存的该第一异常动态信息更新为该更新异常动态信息。
需要说明的是，上述第一管理设备可以为系统100中的域网络管理设备、端到端网络管理设备或网络设备。
相应地，当上述第一管理设备为域网络管理设备时，上述第二管理设备为端到端网络管理设备；或，当上述第一管理设备为端到端网络管理设备时，上述第二管理设备为业务运营管理设备；或，当上述第一管理设备为网络设备时，上述第二管理设备为域网络管理设备或端到端网络管理设备。
还需要说明的是，该第一管理设备可以理解为供应方，该第二管理设备可以理解为消费方。
图7示出了本申请实施例提供的用于异常检测的方法500的示意性流程图，该方法500适用于如图1所示的系统100。
S501，第二管理设备向第一管理设备发送异常检测请求，该异常检测请求用于请求对第一性能指标进行异常检测；相应地，该第一管理设备接收该第二管理设备发送的该异常检测请求。
S502，该第一管理设备根据该异常检测请求，获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值，该检测结果包括异常或正常。
S503，该第一管理设备根据该每组检测数据和该每组检测数据对应的检测结果，确定该第一异常动态信息，该第一异常动态信息用于指示第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系，该每个场景信息包括时间、业务类型和位置区域中的至少一项。
可选地，该第一管理设备可以保存该第一异常动态信息。
S504，该第一管理设备获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息。
S505，该第一管理设备根据该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值。
S506，该第一管理设备根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果。
可选地，该方法500还可以包括S507至S509。
S507，该第一管理设备向该第二管理设备发送反馈信息，该反馈信息包括该第一性能指标在该目标场景信息下的检测值和该第一性能指标的检测结果；相应地，该第二管理设备接收该第一管理设备发送的该反馈信息。
S508，该第二管理设备根据该反馈信息和该第一性能指标的业务信息，对该第一性能指标的检测结果进行验证，得到验证结果，该业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项，该验证结果包括正确或不正确。
S509，该第二管理设备向该第一管理设备发送确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确；相应地，该第一管理设备接收该第二管理设备发送的该确认信息。
可选地，当该确认信息指示该第一性能指标的检测结果不正确时，该方法还可以包括S510至S512。
S510，该第二管理设备确定更新异常动态信息，该更新异常动态信息用于表示该第一性能指标在该目标场景信息下的更新的阈值。
S511，该第二管理设备向该第一管理设备发送该更新异常动态信息；相应地，该第一管理设备接收该第二管理设备发送的该更新异常动态信息。
S512，该第一管理设备将本地保存的该第一异常动态信息更新为该更新异常动态信息。
需要说明的是，上述第一管理设备可以为系统100中的域网络管理设备、端到端网络管理设备或网络设备。
相应地，当上述第一管理设备为域网络管理设备时，上述第二管理设备为端到端网络管理设备；或，当上述第一管理设备为端到端网络管理设备时，上述第二管理设备为业务运营管理设备；或，当上述第一管理设备为网络设备时，上述第二管理设备为域网络管理设备或端到端网络管理设备。
还需要说明的是，该第一管理设备可以理解为供应方，该第二管理设备可以理解为消费方。
上面结合图2至图7详细介绍了本申请实施例提供的用于异常检测的方法，下面将结合图8至图11介绍本申请实施例提供的用于异常检测的装置和管理设备。
图8示出了本申请实施例提供的用于异常检测的装置600的示意性框图。该装置600包括：
获取单元610，用于获取第一异常动态信息，该第一异常动态信息用于指示第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系，该每个场景信息包括时间、业务类型和位置区域中的至少一项；获取该第一性能指标的目标场景信息和该第一性能指标在该目标场景信息下的检测值，该至少一个场景信息包括该目标场景信息；
确定单元620，用于根据该获取单元610获取的该目标场景信息和该第一异常动态信息，确定该第一性能指标在该目标场景信息下的阈值；根据该第一性能指标在该目标场景信息下的检测值和该第一性能指标在该目标场景信息下的阈值，确定该第一性能指标的检测结果，该检测结果包括异常或正常。
可选地，该获取单元610具体用于接收第二管理设备发送的第一指示信息，该第一指示信息用于指示该第一管理设备获取该第一异常动态信息；该确定单元620还用于根据该第一指示信息，从多个异常动态信息中确定该第一异常动态信息。
可选地，该获取单元610具体用于获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值；该确定单元620还用于根据该每组检测数据和该每组检测数据对应的检测结果，确定该第一异常动态信息。
可选地，该获取单元610还用于获取第二指示信息，该第二指示信息用于指示该第一管理设备确定该第一异常动态信息；该确定单元620还用于根据该第二指示信息，获取该每组检测数据和该每组检测数据对应的检测结果。
可选地，该装置600还可以包括接收单元630，该接收单元用于接收第二管理设备发送的该第一异常动态信息。
可选地，该装置600还可以包括配置单元640，该配置单元用于根据该第一异常动态信息，配置检测对象的需求信息，该需求信息用于请求该检测对象上报该第一性能指标的该目标场景信息和该第一性能指标在该目标场景信息下的检测值；该接收单元还用于接收该检测对象根据该需求信息发送的该第一性能指标的该目标场景信息和该第一性能指标在该目标场景信息下的检测值。
可选地，该装置600还可以包括发送单元650，该发送单元用于向第二管理设备发送反馈信息，该反馈信息包括该第一性能指标在该目标场景信息下的检测值和该第一性能指标的检测结果。
可选地，该接收单元630还用于接收该第二管理设备根据该反馈信息发送的确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确。
可选地，该第一性能指标为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
应理解，这里的装置600以功能单元的形式体现。这里的术语“单元”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置600可以具体为上述方法200至方法500实施例中的第一管理设备，装置600可以用于执行上述方法200至方法500实施例中与第一管理设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
在一种可能的设计中，装置600可以被替换为芯片装置，例如可以为可用于装置中的通信芯片，用于实现装置中处理器的相关功能。该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当该代码被执行时，使得处理器实现相应的功能。
图9示出了本申请实施例提供的用于异常检测的装置700的示意性框图。该装置700包括：
获取单元710，用于获取该第一性能指标的至少一组检测数据和该至少一组检测数据中每组检测数据对应的检测结果，该每组检测数据包括场景信息和该第一性能指标在该场景信息下的检测值，该场景信息包括时间、业务类型和位置区域中的至少一项，该检测结果包括异常或正常；
确定单元720，用于根据该获取单元710获取的该每组检测数据和该每组检测数据对应的检测结果，确定第一异常动态信息，该第一异常动态信息用于指示该第一性能指标的至少一个场景信息和该第一性能指标在该至少一个场景信息中每个场景信息下的阈值之间的映射关系；
发送单元730，用于向第一管理设备发送该确定单元720确定的该第一异常动态信息。
可选地，该装置700还包括接收单元740，该接收单元740用于该第一管理设备根据该第一异常动态信息发送的反馈信息，该反馈信息包括该第一性能指标在目标场景信息下的检测值和该第一性能指标的检测结果，该至少一个场景信息包括该目标场景信息。
可选地，该装置700还包括验证单元750，该验证单元用于根据该反馈信息，对该第一性能指标的检测结果进行验证，得到验证结果，该验证结果包括正确或不正确。
可选地，该获取单元710还用于获取该第一性能指标的业务信息，该业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项；该验证单元具体用于根据该反馈信息和该业务信息，对该第一性能指标的检测结果进行验证。
可选地，该发送单元730还用于向该第一管理设备发送确认信息，该确认信息用于指示该第一性能指标的检测结果是否正确。
可选地，该第一性能指标包括吞吐率、物理资源块使用率、物理资源块使用分布信息，注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数，协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
应理解，这里的装置700以功能单元的形式体现。这里的术语“单元”可以指ASIC、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置700可以具体为上述方法200至方法500实施例中的第二管理设备，装置700可以用于执行上述方法200至方法500实施例中与第二管理设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
在一种可能的设计中，装置700可以被替换为芯片装置，例如可以为可用于装置中的通信芯片，用于实现装置中处理器的相关功能。该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当该代码被执行时，使得处理器实现相应的功能。
图10示出了本申请实施例提供的用于异常检测的装置800，该装置800可以为图8中所述的装置600。该装置600可以采用如图10所示的硬件架构。该装置800可以包括 处理器810、收发器820和存储器830，该处理器810、收发器820和存储器830通过内部连接通路互相通信。图8中的确定单元620所实现的相关功能可以由处理器810来实现，获取单元610、接收单元630、配置单元640和发送单元650所实现的相关功能可以由处理器810控制收发器820来实现。
该处理器810可以包括是一个或多个处理器，例如包括一个或多个中央处理单元(central processing unit，CPU)，在处理器是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该收发器820用于发送和接收数据和/或信息，以及接收数据和/或信息。该收发器可以包括发射器和接收器，发射器用于发送数据和/或信号，接收器用于接收数据和/或信号。
该存储器830包括但不限于是随机存取存储器(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程存储器(erasable programmable read only memory，EPROM)、只读光盘(compact disc read-only memory，CD-ROM)，该存储器830用于存储相关指令及数据。
存储器830用于存储装置的程序代码和数据，可以为单独的器件或集成在处理器810中。
具体地，该处理器810用于控制收发器与第二管理设备进行信号传输。具体可参见方法实施例中的描述，在此不再赘述。
可以理解的是，图10仅仅示出了装置800的简化设计。在实际应用中，装置800还可以分别包含必要的其他元件，包含但不限于任意数量的收发器、处理器、控制器、存储器等，而所有可以实现本申请的管理设备都在本申请的保护范围之内。
在一种可能的设计中，装置800可以被替换为芯片装置，用于实现装置中处理器的相关功能。该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当该代码被执行时，使得处理器实现相应的功能。
图11示出了本申请实施例提供的用于异常检测的装置900，该装置900可以为图9中所述的装置700。该装置700可以采用如图11所示的硬件架构。该装置900可以包括处理器910、收发器920和存储器930，该处理器910、收发器920和存储器930通过内部连接通路互相通信。图9中的确定单元720和验证单元750所实现的相关功能可以由处理器910来实现，获取单元710、发送单元730和接收单元740所实现的相关功能可以由处理器910控制收发器920来实现。
该处理器910可以包括是一个或多个处理器，例如包括一个或多个CPU，在处理器是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该收发器920用于发送和接收数据和/或信息，以及接收数据和/或信息。该收发器可以包括发射器和接收器，发射器用于发送数据和/或信号，接收器用于接收数据和/或信号。
该存储器930包括但不限于是RAM、ROM、EPROM、CD-ROM，该存储器930用于存储相关指令及数据。
存储器930用于存储装置的程序代码和数据，可以为单独的器件或集成在处理器910中。
具体地，该处理器910用于控制收发器与第一管理设备进行信号传输。具体可参见方法实施例中的描述，在此不再赘述。
可以理解的是，图11仅仅示出了装置900的简化设计。在实际应用中，装置900还可以分别包含必要的其他元件，包含但不限于任意数量的收发器、处理器、控制器、存储器等，而所有可以实现本申请的管理设备都在本申请的保护范围之内。
在一种可能的设计中，装置900可以被替换为芯片装置，用于实现装置中处理器的相关功能。该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当所述代码被执行时，使得处理器实现相应的功能。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种用于异常检测的方法，其特征在于，包括：
    第一管理设备获取第一异常动态信息，所述第一异常动态信息用于指示第一性能指标的至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系，所述每个场景信息包括时间、业务类型和位置区域中的至少一项；
    所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；
    所述第一管理设备根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；
    所述第一管理设备根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果，所述检测结果包括异常或正常。
  2. 根据权利要求1所述的方法，其特征在于，所述第一管理设备获取第一异常动态信息，包括：
    所述第一管理设备接收第二管理设备发送的第一指示信息，所述第一指示信息用于指示所述第一管理设备获取所述第一异常动态信息；
    所述第一管理设备根据所述第一指示信息，从多个异常动态信息中确定所述第一异常动态信息。
  3. 根据权利要求1所述的方法，其特征在于，所述第一管理设备获取第一异常动态信息，包括：
    所述第一管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值；
    所述第一管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定所述第一异常动态信息。
  4. 根据权利要求3所述的方法，其特征在于，所述第一管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，包括：
    所述第一管理设备获取第二指示信息，所述第二指示信息用于指示所述第一管理设备确定所述第一异常动态信息；
    所述第一管理设备根据所述第二指示信息，获取所述每组检测数据和所述每组检测数据对应的检测结果。
  5. 根据权利要求1所述的方法，其特征在于，所述第一管理设备获取第一异常动态信息，包括：
    所述第一管理设备接收第二管理设备发送的所述第一异常动态信息。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，包括：
    所述第一管理设备根据所述第一异常动态信息，配置检测对象的需求信息，所述需求信息用于请求所述检测对象上报所述第一性能指标的所述目标场景信息和所述第一性能指标在所述目标场景信息下的检测值；
    所述第一管理设备接收所述检测对象根据所述需求信息发送的所述第一性能指标的所述目标场景信息和所述第一性能指标在所述目标场景信息下的检测值。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一管理设备向第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
  8. 根据权利要求7所述的异常检测方法，其特征在于，所述方法还包括：
    所述第一管理设备接收所述第二管理设备根据所述反馈信息发送的确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第一性能指标为吞吐率、物理资源块使用率、物理资源块使用分布信息、注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数、协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
  10. 一种用于异常检测的方法，其特征在于，包括：
    所述第二管理设备获取所述第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；
    所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；
    所述第二管理设备向第一管理设备发送所述第一异常动态信息。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述第二管理设备接收所述第一管理设备根据所述第一异常动态信息发送的反馈信息，所述反馈信息包括所述第一性能指标在目标场景信息下的检测值和所述第一性能指标的检测结果，所述至少一个场景信息包括所述目标场景信息。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果，所述验证结果包括正确或不正确。
  13. 根据权利要求12所述的方法，其特征在于，所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，包括：
    所述第二管理设备获取所述第一性能指标的业务信息，所述业务信息包括客户反馈情况、业务中断情况和业务体验情况中的至少一项；
    所述第二管理设备根据所述反馈信息和所述业务信息，对所述第一性能指标的检测结 果进行验证。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    所述第二管理设备向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
  15. 根据权利要求10至14中任一项所述的方法，其特征在于，所述第一性能指标包括吞吐率、物理资源块使用率、物理资源块使用分布信息，注册用户数、在线用户数、用户感知速率、丢包率、激活用户数、时延、掉话率、中央处理器使用率、负载率、覆盖比例、区域流量容量、无线资源控制连接数，协议数据单元会话请求建立数、协议数据单元会话成功建立数、协议数据单元会话失败建立数、数据无线承载建立成功数、服务质量流请求数、服务质量流建立数或虚拟资源使用量中的任一项。
  16. 一种用于异常检测的方法，其特征在于，包括：
    第二管理设备获取第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的所述至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；
    所述第二管理设备向第一管理设备发送所述第一异常动态信息；
    所述第一管理设备接收所述第一管理设备发送的所述第一异常动态信息；
    所述第一管理设备获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；
    所述第一管理设备根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；
    所述第一管理设备根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果。
  17. 根据权利要求16所述的方法，其特征在于，所述方法还包括：
    所述第一管理设备向所述第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述第二管理设备根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果；
    所述第二管理设备向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    当所述确认信息指示所述第一性能指标的检测结果不正确时，所述第二管理设备确定更新异常动态信息，所述更新异常动态信息用于指示所述第一性能指标在所述目标场景信息下的更新的阈值；
    所述第二管理设备向所述第一管理设备发送所述更新异常动态信息。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    所述第一管理设备将所述第一异常动态信息更新为所述更新异常动态信息。
  21. 一种用于异常检测的装置，其特征在于，包括处理器和存储器，所述处理器和所述存储器耦合，所述处理器用于执行权利要求1至15中任一项所述的方法。
  22. 一种用于异常检测系统，其特征在于，包括第一装置和第二装置，所述第一装置包括第一处理器和第一存储器，所述第一处理器和所述第一存储器耦合，所述第一处理器用于执行权利要求1至9中任一项所述的方法，所述第二装置包括第二处理器和第二存储器，所述第二处理器和所述第二存储器耦合，所述第二处理器用于执行权利要求10至15中任一项所述的方法。
  23. 一种用于异常检测的系统，包括第一管理设备和第二管理设备；
    所述第二管理设备，用于获取第一性能指标的至少一组检测数据和所述至少一组检测数据中每组检测数据对应的检测结果，所述每组检测数据包括场景信息和所述第一性能指标在所述场景信息下的检测值，所述场景信息包括时间、业务类型和位置区域中的至少一项，所述检测结果包括异常或正常；所述第二管理设备根据所述每组检测数据和所述每组检测数据对应的检测结果，确定第一异常动态信息，所述第一异常动态信息用于指示所述第一性能指标的所述至少一个场景信息和所述第一性能指标在所述至少一个场景信息中每个场景信息下的阈值之间的映射关系；向第一管理设备发送所述第一异常动态信息；
    所述第一管理设备，用于接收所述第一管理设备发送的所述第一异常动态信息；获取所述第一性能指标的目标场景信息和所述第一性能指标在所述目标场景信息下的检测值，所述至少一个场景信息包括所述目标场景信息；根据所述目标场景信息和所述第一异常动态信息，确定所述第一性能指标在所述目标场景信息下的阈值；根据所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标在所述目标场景信息下的阈值，确定所述第一性能指标的检测结果。
  24. 根据权利要求23所述的方法，其特征在于，
    所述第一管理设备还用于向所述第二管理设备发送反馈信息，所述反馈信息包括所述第一性能指标在所述目标场景信息下的检测值和所述第一性能指标的检测结果。
  25. 根据权利要求24所述的方法，其特征在于，
    所述第二管理设备还用于根据所述反馈信息，对所述第一性能指标的检测结果进行验证，得到验证结果；向所述第一管理设备发送确认信息，所述确认信息用于指示所述第一性能指标的检测结果是否正确。
  26. 根据权利要求25所述的方法，其特征在于，
    所述第二管理设备还用于当所述确认信息指示所述第一性能指标的检测结果不正确时，确定更新异常动态信息，所述更新异常动态信息用于指示所述第一性能指标在所述目标场景信息下的更新的阈值；向所述第一管理设备发送所述更新异常动态信息。
  27. 根据权利要求26所述的方法，其特征在于，
    所述第一管理设备还用于将所述第一异常动态信息更新为所述更新异常动态信息。
  28. 一种芯片装置，包括：输入接口、输出接口、至少一个处理器、存储器，所述输入接口、所述输出接口、所述处理器以及所述存储器之间通过内部连接通路互相通信，所述处理器用于执行所述存储器中的代码，其特征在于，当所述处理器执行所述代码时，所 述芯片装置实现上述权利要求1至15中任一项所述的方法。
  29. 一种计算机可读存储介质，用于存储计算机程序，其特征在于，所述计算机程序包括用于实现上述权利要求1至15中任一项所述的方法的指令。
  30. 一种计算机程序产品，所述计算机程序产品中包含指令，其特征在于，当所述指令在计算机上运行时，使得计算机实现上述权利要求1至15中任一项所述的方法。
PCT/CN2019/108620 2019-09-27 2019-09-27 用于异常检测的方法和装置 WO2021056435A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/108620 WO2021056435A1 (zh) 2019-09-27 2019-09-27 用于异常检测的方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/108620 WO2021056435A1 (zh) 2019-09-27 2019-09-27 用于异常检测的方法和装置

Publications (1)

Publication Number Publication Date
WO2021056435A1 true WO2021056435A1 (zh) 2021-04-01

Family

ID=75165046

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/108620 WO2021056435A1 (zh) 2019-09-27 2019-09-27 用于异常检测的方法和装置

Country Status (1)

Country Link
WO (1) WO2021056435A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113342616A (zh) * 2021-06-30 2021-09-03 北京奇艺世纪科技有限公司 异常指标信息的定位方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160056064A1 (en) * 2014-08-25 2016-02-25 Kabushiki Kaisha Toshiba Anomaly detection system and method of manufacturing semiconductor device
CN105718715A (zh) * 2015-12-23 2016-06-29 华为技术有限公司 异常检测方法和设备
CN106971058A (zh) * 2017-02-21 2017-07-21 河海大学 一种泵站运行监控数据异常点检测方法
CN107086944A (zh) * 2017-06-22 2017-08-22 北京奇艺世纪科技有限公司 一种异常检测方法和装置
US10129118B1 (en) * 2016-03-29 2018-11-13 Amazon Technologies, Inc. Real time anomaly detection for data streams
CN110064203A (zh) * 2019-04-03 2019-07-30 福建天晴数码有限公司 游戏奖励的异常检测方法及计算机可读存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160056064A1 (en) * 2014-08-25 2016-02-25 Kabushiki Kaisha Toshiba Anomaly detection system and method of manufacturing semiconductor device
CN105718715A (zh) * 2015-12-23 2016-06-29 华为技术有限公司 异常检测方法和设备
US10129118B1 (en) * 2016-03-29 2018-11-13 Amazon Technologies, Inc. Real time anomaly detection for data streams
CN106971058A (zh) * 2017-02-21 2017-07-21 河海大学 一种泵站运行监控数据异常点检测方法
CN107086944A (zh) * 2017-06-22 2017-08-22 北京奇艺世纪科技有限公司 一种异常检测方法和装置
CN110064203A (zh) * 2019-04-03 2019-07-30 福建天晴数码有限公司 游戏奖励的异常检测方法及计算机可读存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113342616A (zh) * 2021-06-30 2021-09-03 北京奇艺世纪科技有限公司 异常指标信息的定位方法、装置、电子设备及存储介质
CN113342616B (zh) * 2021-06-30 2023-10-27 北京奇艺世纪科技有限公司 异常指标信息的定位方法、装置、电子设备及存储介质

Similar Documents

Publication Publication Date Title
US11696161B2 (en) System and method for distributed network performance management
US10320649B2 (en) Method and system for implementing virtual network function performance monitoring
CN112689300A (zh) 管理应用和执行单元的方法、装置、系统及介质
US8355341B2 (en) Delay time measurement apparatus, storage medium storing delay time measurement program and network system
US8667126B2 (en) Dynamic rate heartbeating for inter-node status updating
EP2873193B1 (en) Method and system for using a downloadable agent for a communication system, device, or link
JP2005521359A (ja) ソフトウェアアプリケーションのネットワーク動作特性を測定する方法、システム及びコンピュータプログラム
CN110832911B (zh) 用于提供无线网络速度信息的方法、装置和系统
CN112311628B (zh) 网络测速方法、系统、网络设备和存储介质
CN110659109A (zh) 一种openstack集群虚拟机监控系统及方法
US9104565B2 (en) Fault tracing system and method for remote maintenance
US9608874B2 (en) Methods and apparatus to identify network topologies
CN105103495A (zh) 用于允许或拒绝第一和第二设备之间的测量请求的接纳控制
CN107333260A (zh) 一种获取终端的真实mac地址的方法及装置
CN114302429A (zh) Nwdaf网元的确定方法、装置、设备及存储介质
US20220247651A1 (en) System and method for network and computation performance probing for edge computing
CN112311585A (zh) 选择管理节点的方法和装置、设备及其存储介质
JP2018528549A (ja) インターネット接続問題を検出するための方法および装置
WO2021056435A1 (zh) 用于异常检测的方法和装置
CN113300914A (zh) 网络质量监测方法、装置、系统、电子设备和存储介质
CN117956429A (zh) 一种用于自动驾驶车辆的通信方法、装置及电子设备
CN110958170B (zh) 一种网络互联方法和装置
CN109831335B (zh) 一种数据监控方法、监控终端、存储介质及数据监控系统
US9692685B2 (en) Heterogeneous network system, network apparatus, and rendezvous path selection method thereof
CN113810238A (zh) 网络监测方法、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19947232

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19947232

Country of ref document: EP

Kind code of ref document: A1