WO2021164267A1

WO2021164267A1 - Anomaly detection method and apparatus, and terminal device and storage medium

Info

Publication number: WO2021164267A1
Application number: PCT/CN2020/119304
Authority: WO
Inventors: 陈桢博; 金戈; 徐亮
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-02-21
Filing date: 2020-09-30
Publication date: 2021-08-26
Also published as: CN111338878A

Abstract

The present application is applicable to the technical field of artificial intelligence. Provided are an anomaly detection method and apparatus, and a terminal and a storage medium. The method comprises: acquiring index data of a monitoring index at the current moment; acquiring, from among periodic components respectively corresponding to historical moments, a periodic component corresponding to the current moment; calculating a residual value of the index data according to the periodic component; and when the residual value is not within a residual threshold value range, determining that the monitoring index at the current moment is anomalous, wherein the process of acquiring the periodic components respectively corresponding to the historical moments comprises: by means of a convolutional noise reduction auto-encoder, carrying out noise reduction on first time sequence data of a monitoring index within a past preset time period, and outputting second time sequence data within the past preset time period; and decomposing the second time sequence data to obtain the periodic components respectively corresponding to the historical moments. Noise reduction is carried out on first time sequence data, such that the problem of noise interference during a periodic component decomposition process is ameliorated, and the detection precision of anomaly detection is improved.

Description

Anomaly detection method, device, terminal equipment and storage medium

This application affirms that it enjoys the priority of the Chinese patent application with the application number 202010108336.5 and the name "abnormal detection method, device, terminal equipment and storage medium" filed on February 21, 2020. The entire content of the Chinese patent application is by reference Incorporated in this application.

Technical field

This application belongs to the field of artificial intelligence technology, and particularly relates to an abnormality detection method, device, computer equipment, and storage medium related to predictive analysis technology.

Background technique

Anomaly detection equipment is used to detect abnormal data in the operation and maintenance monitoring indicators that deviate from the normal monitoring value, so as to prompt the operation and maintenance personnel to perform fault prevention and troubleshooting. At present, most anomaly detection is based on SH-ESD algorithm or statistical algorithm, which has high robustness in most scenarios. However, the inventor realized that for the operation and maintenance monitoring indicators with a lot of noise, the confidence of this type of model The calculation of the interval will be undesirably interfered, resulting in a decrease in the detection accuracy of the anomaly detection model.

technical problem

In view of this, the embodiments of the present application provide an abnormality detection method, device, terminal device, and storage medium, aiming to solve the problem of low detection accuracy of the abnormality detection model in the prior art method.

Technical solutions

In order to solve the above technical problems, the technical solutions adopted in the embodiments of this application are:

In the first aspect, an embodiment of the present application provides an abnormality detection method, including:

Obtain the indicator data of the monitoring indicator at the current moment;

Obtaining the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

Calculating the residual value of the indicator data according to the periodic component;

When the residual value is not within the residual error threshold range, it is determined that the monitoring index at the current moment is abnormal;

Wherein, the process of obtaining period components corresponding to each historical moment respectively includes:

The first time series data of the monitoring index in the past preset time period is denoised by the convolutional noise reduction autoencoder, and the second time series data in the past preset time period is outputted, and the preset time period includes A plurality of said historical moments;

Decomposing the second time series data at each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.

In the second aspect, an embodiment of the present application provides an abnormality detection device, including:

The first obtaining module is used to obtain the indicator data of the monitoring indicator at the current moment;

The second acquisition module is configured to acquire the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

A calculation module, configured to calculate the residual value of the indicator data according to the period component;

A judging module, used for judging that the monitoring index at the current moment is abnormal when the residual value is not within the residual threshold range;

The device also includes:

The noise reduction module is used to reduce the noise of the first time series data of the monitoring index in the past preset time period through the convolutional noise reduction autoencoder, and output the second time series data in the past preset time period, the A plurality of said historical moments are included in the preset time period;

The decomposition module is configured to decompose the second time series data of each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.

In the third aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, The anomaly detection method described in any one of the above-mentioned first aspects is implemented.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium that stores a computer program that, when executed by a processor, implements any one of the above-mentioned aspects of the first aspect Anomaly detection method.

In a fifth aspect, the embodiments of the present application provide a computer program product, which when the computer program product runs on a terminal device, causes the terminal device to execute the abnormality detection method described in any one of the above-mentioned first aspects.

The embodiment of the application obtains the indicator data of the monitoring indicator in real time, and calculates the residual error in combination with the period component at the corresponding historical moment, and then determines the abnormal situation according to the residual threshold interval, thereby realizing online real-time abnormality detection; self-reducing noise through convolution The encoder reduces the noise of the first time series data to improve the problem of noise interference during the decomposition of the periodic component, so that the periodic component and the residual threshold range are more accurate, so that the residual value and the residual calculated from the indicator data and the periodic component are more accurate The comparison result between the value and the residual threshold range is more accurate, thereby improving the detection accuracy of anomaly detection.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only of the present application. For some embodiments, for those of ordinary skill in the art, other drawings may be obtained based on these drawings without creative labor.

FIG. 1 is a schematic flowchart of an abnormality detection method provided by an embodiment of the present application;

2 is a schematic flowchart of an abnormality detection method provided by another embodiment of the present application;

FIG. 3 is a schematic flowchart of an abnormality detection method provided by a third embodiment of the present application;

4 is a schematic flowchart of an abnormality detection method provided by a fourth embodiment of the present application;

FIG. 5 is a schematic flowchart of an abnormality detection method provided by a fifth embodiment of the present application;

FIG. 6 is a schematic structural diagram of an abnormality detection device provided by an embodiment of the present application;

Fig. 7 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.

Embodiments of the present invention

In the following description, for the purpose of illustration rather than limitation, specific details such as a specific system structure and technology are proposed for a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from obstructing the description of this application.

It should be understood that when used in the specification and appended claims of this application, the term "comprising" indicates the existence of the described features, wholes, steps, operations, elements and/or components, but does not exclude one or more other The existence or addition of features, wholes, steps, operations, elements, components, and/or collections thereof.

It should also be understood that the term "and/or" used in the specification and appended claims of this application refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

As used in the description of this application and the appended claims, the term "if" can be construed as "when" or "once" or "in response to determination" or "in response to detecting ". Similarly, the phrase "if determined" or "if detected [described condition or event]" can be interpreted as meaning "once determined" or "in response to determination" or "once detected [described condition or event]" depending on the context ]" or "in response to detection of [condition or event described]".

In addition, in the description of the specification of this application and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

The reference to "one embodiment" or "some embodiments" described in the specification of this application means that one or more embodiments of this application include a specific feature, structure, or characteristic described in combination with the embodiment. Therefore, the sentences "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification are not necessarily All refer to the same embodiment, but mean "one or more but not all embodiments" unless it is specifically emphasized otherwise. The terms "including", "including", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

As related to the background art, most of the current anomaly detection is based on the SH-ESD algorithm or statistical algorithm. For the operation and maintenance monitoring indicators with a large amount of noise, a large amount of noise will cause harmful interference to the periodic components of the decomposition monitoring indicator data, making the decomposition The period component obtained by the monitoring index data is inaccurate, which affects the accuracy of the calculation result of the confidence interval (residual error threshold range), and ultimately leads to a decrease in the detection accuracy of anomaly detection.

Therefore, there is a need for an anomaly detection method to remove a large amount of noise in the time series data of monitoring indicators and online real-time detection to improve detection accuracy.

Among them, monitoring indicators can refer to system monitoring indicators, such as load (the average number of threads in the run queue in a specific time interval), CPU utilization, disk space usage, disk I/O (input/output), memory usage, Network traffic, etc., can also refer to the monitoring indicators of the function calculation process, such as region dimension indicators (monitoring metrics for the overall usage of function computing resources in a certain region), Service dimension indicators (monitoring metrics for the usage of a certain Service resource) ), Function dimension indicators (monitoring metrics for the usage of a certain Function resource), etc. It should be understood that the above monitoring indicators are only used for illustration, and the embodiments of this application do not limit the specific types of the monitoring indicators.

The embodiment of the present application regularly updates the model parameters of the anomaly detection model. Specifically, it can be updated by the first time series data of the monitoring index in the past preset time period to update the period component and residual threshold range of the model, and the updated period component is updated. The sum residual threshold range is used as a reference value for online real-time anomaly detection, and there may be a lot of noise in the first time series data in the model update process. The embodiment of the present application implements noise reduction on the first time series data through a convolutional denoising autoencoder. .

The embodiment of the application provides an anomaly detection method. The above method can be applied to a terminal device or a separate application program. The application program can obtain monitoring index data, denoise monitoring index data, and obtain monitoring index data. The residual value, the process of determining the abnormal situation of the monitoring index based on the residual value. Exemplarily, the terminal device may be a computing device such as a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a desktop computer, a stand-alone server, a cluster server, etc. The implementation of this application The example does not impose any restrictions on the specific types of terminal equipment.

Fig. 1 shows a schematic flowchart of the abnormality detection method provided by the present application. As an example and not a limitation, the method can be applied to the above-mentioned terminal device.

S101: Obtain index data of the monitoring index at the current moment.

The above-mentioned index data are index values collected by terminal equipment in real time.

S102. Obtain the period components of the historical moments corresponding to the current moment from the period components respectively corresponding to the respective historical moments.

The foregoing historical moments are the same historical period moments within a preset time period in the past, and the foregoing period components are obtained by calculation of monitoring index data at the same historical period moment. For example, the preset time period in the past is the past 2 weeks, and the current time is 3 o'clock in the afternoon today, then the period component corresponding to 3 o'clock in the afternoon today is the sequence of index data at 3 o'clock in the afternoon every day for 2 weeks. Click the periodic component of this historical period moment.

Wherein, the process of obtaining the period components corresponding to each historical moment respectively includes S1021 and S1022.

S1021: Perform noise reduction on the first time series data of the monitoring index in the past preset time period by using the convolutional noise reduction autoencoder, and output the second time series data in the past preset time period, and the preset time period Contains a plurality of said historical moments;

The above-mentioned first time series data is time series data with high saturation and periodicity composed of all index data collected in the past preset time period according to the time stamp, which may or may not contain a lot of noise. It should be understood that the anomaly detection method of the embodiment of the present application can be applied to time series data that contains a lot of noise, and can also be applied to time series data that does not contain a lot of noise.

The aforementioned convolutional noise reduction autoencoder is a self-encoder that includes an encoder and a decoder, and has a symmetrical structure of convolutional layer-self-encoding algorithm-deconvolutional layer.

S1022: Decompose the second time series data of each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.

The above-mentioned second time series data is time series data after removing the noise in the first time series data. The series of index data at each historical time of the same period in the second time series data is decomposed into trend components and periodic components through the STL algorithm. (seasonal component) and remainder component. For example, if the time of the same historical period is 3 pm, the series of indicator data collected at 3 pm in the second time series data is decomposed into the trend component, period component and remainder of the historical period time of 3 pm.

Denoise the first time series data of the monitoring index through the convolution noise reduction autoencoder, reduce the noise in the first time series data, thereby reducing the process of noise decomposing the time series data into periodic components when updating the model parameters of the anomaly detection model The undesirable interference of, makes the residual threshold range obtained by the model update more accurate, and thus makes the anomaly detection have higher detection accuracy.

S103: Calculate a residual value of the index data according to the periodic component.

The above-mentioned period component is used as the expected value (understandable as a standard value) of the indicator data at the corresponding historical time, and the indicator data collected in real time at the current time deviates from the period component, so the degree of deviation needs to be calculated. Specifically, the difference between the index data and the periodic component is calculated, and the difference is the residual value or the degree of deviation.

S104: When the residual error value is not within the residual error threshold value range, it is determined that the monitoring index at the current moment is abnormal.

The above residual threshold range includes a threshold range composed of multiple differences between the indicator data at each historical moment in the second time series data and the period data at the corresponding historical time decomposed by the second time series data. It should be understood that, in other embodiments, the residual threshold range may also be a range value set by yourself.

If the residual value between the indicator data at the current time and the period component corresponding to the historical time is not in the residual threshold range, it means that the indicator data of the monitoring indicator at the current time has exceeded the allowable deviation range from the period component, that is, the monitoring at the current time The indicator is abnormal.

Based on the embodiment shown in FIG. 1, FIG. 2 shows a schematic flowchart of another abnormality detection method provided by an embodiment of the present application. As shown in FIG. 2, step S1021 specifically includes steps S201-S203. It should be noted that the steps that are the same as those in the embodiment in FIG. 1 will not be repeated here, please refer to the foregoing.

S201: Input the first time series data into the convolutional noise reduction autoencoder;

S202: Perform multi-layer hidden layer encoding on the first time series data by an encoder in the convolutional noise reduction autoencoder to obtain a low-dimensional feature vector;

S203: Perform multi-layer hidden layer decoding on the low-dimensional feature vector by a decoder in the convolutional noise reduction autoencoder, and output second time series data of the monitoring indicator.

In this embodiment, the low-dimensional feature vector is the hidden feature of the hidden layer in the self-encoder, and its dimension is lower than the input of the encoder (first time series data) and the output of the decoder (second time series data). The multi-layer hidden layer of the encoder is a multi-layer convolutional layer, that is, the input layer, and the multi-layer hidden layer of the decoder is a multi-layer deconvolution layer, that is, the output layer.

Specifically, use φ to represent the encoder and ψ to represent the decoder, then φ:X→F, ψ:F→X, F=wX+b, where X in φ:X→F is the first noise-containing Time series data, x in ψ:F→X is the second time series data obtained after denoising, F is the low-dimensional feature vector, w and b are the hidden parameters of the hidden layer update in the self-encoding model. By encoding the first time series data into low-dimensional feature vectors, when the first time series data in a preset time period is used to update the model parameters, the noise in the first time series data is removed, and the adverse effect of noise on the decomposition process of periodic components is reduced. , And make the hidden layer features concentrated, so that the anomaly detection model has better performance.

On the basis of the embodiment shown in FIG. 1, the convolutional noise reduction autoencoder of the present application is obtained by training according to the time series data of the monitoring index containing the preset noise.

In this embodiment, in order that the convolutional denoising autoencoder can well imitate the noise of the first time series data in the denoising process, the time series data with preset noise is used as the training sample when the convolution denoising autoencoder is trained. . Wherein, the preset noise may be Gaussian noise conforming to Gaussian distribution (normal distribution), that is, x～N(μ,σ ² ), where x is Gaussian noise, which includes but is not limited to zero-value noise and high-value noise, so that The convolutional denoising autoencoder can be applied to denoise the time series data of monitoring indicators in a variety of monitoring scenarios.

Based on the embodiment shown in FIG. 1, FIG. 3 shows a schematic flowchart of another abnormality detection method provided by an embodiment of the present application. As shown in FIG. 3, step S1022 specifically includes steps S301-S303. It should be noted that the steps that are the same as those in the embodiment in FIG. 1 will not be repeated here, please refer to the foregoing.

S301: Generate periodic sub-sequences corresponding to each historical time according to the second time series data of each historical time within the preset time period;

S302: Perform smooth regression on each of the periodic subsequences to obtain a smoothing result corresponding to each of the periodic subsequences.

S303: Remove the low flux in each of the smoothing results, and obtain the period component corresponding to each of the historical moments.

The aforementioned periodic sub-sequence is a sub-sequence composed of sample points at the same position in each period in the second time series data. For example, if the time length of the second time series data is 2 weeks and the period is 1 day, the index data corresponding to the same time every day is the sample point at the same position in the same period. As an example and not a limitation, the second time series data is the data in the previous 14 days, and the data at 10 o'clock every day is formed into a periodic sub-sequence (A, B,..., N, where data A is the data at 10 o'clock in the first day , Data B is the data at 10 o'clock the next day, and so on to the last day's data N).

In this embodiment, the second time series data is decomposed into periodic components by STL (Seasonal-Trend Decomposition Procedure based on Loess) algorithm. The STL algorithm decomposes the time series data Yv into trend component, seasonal component and remainder component based on LOESS: Yv=Tv+Sv+Rv, v=1~N. In this embodiment, an inner loop is used to perform trend fitting and calculation of period components, and the period components of each historical moment obtained by decomposing the second time series data are used as the expected value of the monitoring index at the corresponding moment.

_{For example, there are n (p)} periodic subsequences in the second time series data, and LOESS (q=n _n(s) , d=1) is used to perform smooth regression on each periodic subsequence, that is, each periodic subsequence forwards And extend backward each for a period to get a smooth result

v=-n _(p) +1～-N+n _(p) , where n(s) is the smoothing parameter of the LOESS smooth regression, k represents the kth pass in the inner loop; extract the smooth result

Medium and low throughput

Smooth result

Do the _{moving average of n (p)} , n _(p) , and 3 in turn to get the average result, and then use LOESS (q=n _n(l) , d=1) to smoothly regress the average result; remove smoothing result

Medium and low throughput

Get the periodic component

Based on the embodiment shown in FIG. 1, FIG. 4 shows a schematic flowchart of another abnormality detection method provided by an embodiment of the present application. As shown in FIG. 4, the above step S104 further includes steps S401-S403. It should be noted that the steps that are the same as those in the embodiment in FIG. 1 will not be repeated here, please refer to the foregoing.

S401: Obtain the historical residual value of the second time series data at each historical moment in the preset time period;

The aforementioned historical residual value is the difference between the second time series data at each historical moment and the period component of the corresponding historical moment.

S402: Calculate the mean value and standard deviation of all the historical residual values based on the normal distribution;

The above-mentioned normal distribution is x～N(μ,σ ² ), μ is the mean value, and σ is the standard deviation.

S403: Based on the n-sigma principle, determine the residual threshold value range according to the mean value, standard value, and preset n value of the historical residual value.

The aforementioned n value is a positive integer, for example, n-sigma is 3-sigma, 3 is the n value, and sigma is the standard deviation σ. The above residual threshold range may be (μ-nσ, μ+nσ). When the residual error value is not within the residual error threshold range, that is, when the residual error value is less than μ-nσ, or greater than μ+nσ, it is determined that the monitoring index at the current moment is abnormal. When the residual error value is within the residual error threshold value range, it is determined that the monitoring index at the current moment is normal.

The residual threshold range is determined by the historical residual value and the n-sigma principle, so that the residual threshold range is automatically adjusted according to multiple historical residual values in the preset time period, so as to be more in line with the abnormal detection at the current moment, and to realize the operation Online real-time anomaly detection of dimensional monitoring indicators.

On the basis of the embodiment shown in FIG. 4, the present application provides another embodiment of an abnormality detection method. The above step S401 specifically includes step S4011. It should be noted that the steps that are the same as those in the embodiment in FIG. 4 will not be repeated here, please refer to the foregoing.

S4011: Calculate the historical residual value between the second time series data of each historical time and the period component of the corresponding historical time according to the period component of each historical time within the preset time period.

In this embodiment, the periodic component is obtained by decomposing the second time series data. There is also a difference between the second time series data and the periodic component. There will be errors in the comparison of the residual values of the data. Therefore, it is necessary to calculate the historical residual values at each historical moment, and then determine the residual threshold range through all historical residual values to reduce the error of the direct comparison result.

Based on the embodiment shown in FIG. 1, FIG. 5 shows a schematic flowchart of another abnormality detection method provided by an embodiment of the present application. As shown in FIG. 5, before the above step S1021, the step S501-S504 is further included. It should be noted that the steps that are the same as those in the embodiment in FIG. 1 will not be repeated here, please refer to the foregoing.

S501: Acquire third time series data of monitoring indicators in the preset time period;

The above-mentioned third time series data is all the time series data of the monitoring index in the preset time period.

S502: Convert the third time series data into frequency domain data through fast Fourier transform;

The above-mentioned third time series data is time-domain data, and the corresponding frequency-domain data is obtained after fast Fourier transform.

S503, searching for an amplitude component corresponding to the target frequency in the frequency domain data;

The above-mentioned target frequency is the frequency corresponding to a certain moment in the preset time period in the third time series data, and the amplitude component is the amplitude corresponding to the frequency at this moment. The higher the amplitude component, the larger the proportion of the main component of the wave of that frequency in the third time series data.

S504: When the number of the target frequencies whose amplitude components are greater than a first preset value is greater than a second preset value, use the third time series data as the first time series data.

The first preset value is a reference value for the magnitude of the amplitude component, and the second preset value is a reference value for the number of target frequencies. In order to ensure that the time series data meets the requirements of high saturation and periodicity, the time series data needs to be filtered. When the number of target frequencies with amplitude components greater than the first preset value reaches the second preset value, the third time series The saturation of the data is high, and the third time series data is originally data composed of all indicator data according to the time stamp, so the third time series data has periodicity.

It should be understood that the size of the sequence number of each step in the foregoing embodiment does not mean the order of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

Corresponding to the abnormality detection method described in the above embodiment, FIG. 6 shows a structural block diagram of an abnormality detection device 600 provided in an embodiment of the present application. For ease of description, only the parts related to the embodiment of the present application are shown.

Referring to Figure 6, the device includes:

The first obtaining module 601 is configured to obtain indicator data of the monitoring indicators at the current moment;

The second obtaining module 602 is configured to obtain the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

The calculation module 603 is configured to calculate the residual value of the indicator data according to the period component;

The determining module 604 is configured to determine that the monitoring index at the current moment is abnormal when the residual value is not within the residual error threshold range;

The device also includes:

The noise reduction module 6021 is used to reduce the noise of the first time series data of the monitoring index in the past preset time period through the convolutional noise reduction autoencoder, and output the second time series data in the past preset time period, so A plurality of the historical moments are included in the preset time period;

The decomposition module 6022 is configured to decompose the second time series data of each historical moment in the preset time period to obtain the period components corresponding to each historical moment.

It should be noted that the information interaction and execution process between the above-mentioned devices/units are based on the same concept as the method embodiment of this application, and its specific functions and technical effects can be found in the method embodiment section. I won't repeat it here.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, only the division of the above functional units and modules is used as an example. In practical applications, the above functions can be allocated to different functional units and modules as needed. Module completion, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist alone physically, or two or more units can be integrated into one unit. The above-mentioned integrated units can be hardware-based Formal realization can also be realized in the form of a software functional unit. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working process of the units and modules in the foregoing system, reference may be made to the corresponding process in the foregoing method embodiment, which will not be repeated here.

FIG. 7 is a schematic structural diagram of a terminal device provided by an embodiment of this application. As shown in FIG. 7, the terminal device 7 of this embodiment includes: at least one processor 70 (only one is shown in FIG. 7), a processor, a memory 71, and a processor stored in the memory 71 and capable of being processed in the at least one processor. A computer program 72 running on the processor 70, when the processor 70 executes the computer program 72, the steps in any of the foregoing anomaly detection method embodiments are implemented.

The terminal device 7 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The terminal device may include, but is not limited to, a processor 70 and a memory 71. Those skilled in the art can understand that FIG. 7 is only an example of the terminal device 7 and does not constitute a limitation on the terminal device 7. It may include more or less components than shown in the figure, or a combination of certain components, or different components. , For example, can also include input and output devices, network access devices, and so on.

The so-called processor 70 may be a central processing unit (Central Processing Unit, CPU), and the processor 70 may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), and application specific integrated circuits (Application Specific Integrated Circuits). , ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 71 may be an internal storage unit of the terminal device 7 in some embodiments, such as a hard disk or a memory of the terminal device 7. In other embodiments, the memory 71 may also be an external storage device of the terminal device 7, such as a plug-in hard disk equipped on the terminal device 7, a smart media card (SMC), and a secure digital (Secure Digital, SD) card, Flash Card, etc. Further, the memory 71 may also include both an internal storage unit of the terminal device 7 and an external storage device. The memory 71 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 71 can also be used to temporarily store data that has been output or will be output.

The embodiments of the present application also provide a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the foregoing method embodiments can be realized. The computer-readable storage medium may be non-volatile or volatile.

The embodiments of the present application provide a computer program product. When the computer program product runs on a mobile terminal, the steps in the foregoing method embodiments can be realized when the mobile terminal is executed.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the implementation of all or part of the processes in the above-mentioned embodiment methods in the present application can be accomplished by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by the processor, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to the photographing device/terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), and random access memory (RAM, Random Access Memory), electric carrier signal, telecommunications signal and software distribution medium. For example, U disk, mobile hard disk, floppy disk or CD-ROM, etc. In some jurisdictions, according to legislation and patent practices, computer-readable media cannot be electrical carrier signals and telecommunication signals.

In the above-mentioned embodiments, the description of each embodiment has its own focus. For parts that are not described in detail or recorded in an embodiment, reference may be made to related descriptions of other embodiments.

A person of ordinary skill in the art may realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

In the embodiments provided in this application, it should be understood that the disclosed apparatus/network equipment and method may be implemented in other ways. For example, the device/network device embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units. Or components can be combined or integrated into another system, or some features can be omitted or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still implement the foregoing The technical solutions recorded in the examples are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the application, and should be included in Within the scope of protection of this application.

Claims

An anomaly detection method, the method includes:

Obtain the indicator data of the monitoring indicator at the current moment;

Obtaining the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

Calculating the residual value of the indicator data according to the periodic component;

When the residual value is not within the residual error threshold range, it is determined that the monitoring index at the current moment is abnormal;

Wherein, the process of obtaining period components corresponding to each historical moment respectively includes:

The first time series data of the monitoring index in the past preset time period is denoised by the convolutional noise reduction autoencoder, and the second time series data in the past preset time period is outputted, and the preset time period includes A plurality of said historical moments;

Decomposing the second time series data at each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.
The abnormality detection method according to claim 1, wherein the first time series data of the monitoring index in the past preset time period is denoised by the convolution noise reduction autoencoder, and the past preset time period is output The second time series data in includes:

Inputting the first time series data to the convolutional noise reduction autoencoder;

Performing multi-layer hidden layer encoding on the first time series data by an encoder in the convolutional noise reduction autoencoder to obtain a low-dimensional feature vector;

Perform multi-layer hidden layer decoding on the low-dimensional feature vector by a decoder in the convolutional denoising self-encoder, and output the second time series data.
5. The abnormality detection method according to claim 1, wherein the convolutional noise reduction autoencoder is obtained by training according to time series data of monitoring indicators containing preset noise.
The abnormality detection method according to claim 1, wherein said decomposing said second time series data of each of said historical moments in said preset time period to obtain said period components corresponding to each of said historical moments. ,include:

Generating a periodic sub-sequence corresponding to each historical time according to the second time series data of each historical time within the preset time period;

Performing smooth regression on each of the periodic subsequences to obtain a smoothing result corresponding to each of the periodic subsequences;

Remove the low flux in each of the smoothing results, and obtain the period components corresponding to each of the historical moments.
5. The abnormality detection method according to claim 1, wherein when the residual value is not in the residual error threshold range, before determining that the monitoring index at the current moment is abnormal, the method further comprises:

Acquiring the historical residual value of the second time series data at each historical moment in the preset time period;

Based on the normal distribution, calculate the mean and standard deviation of all the historical residual values;

Based on the n-sigma principle, the residual threshold value range is determined according to the mean value of the historical residual value, the standard value, and the preset n value.
5. The abnormality detection method according to claim 5, wherein said obtaining the historical residual value of the second time series data at each historical moment in the preset time period comprises:

According to the period component of each historical moment in the preset time period, the historical residual value between the second time series data of each historical moment and the period component of the corresponding historical moment is calculated.
The abnormality detection method according to claim 1, wherein before the noise reduction of the first time series data of the monitoring index in the past preset time period by the convolution noise reduction autoencoder, the method further comprises:

Acquiring the third time series data of the monitoring index in the preset time period;

Converting the third time series data into frequency domain data through fast Fourier transform;

Searching for the amplitude component corresponding to the target frequency in the frequency domain data;

When the number of the target frequencies whose amplitude components are greater than a first preset value is greater than a second preset value, the third time series data is used as the first time series data.
An abnormality detection device, including:

The first obtaining module is used to obtain the indicator data of the monitoring indicator at the current moment;

The second acquisition module is configured to acquire the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

The first calculation module is configured to calculate the residual value of the indicator data according to the periodic component;

A judging module, used for judging that the monitoring index at the current moment is abnormal when the residual value is not within the residual threshold range;

The device also includes:

The noise reduction module is used to reduce the noise of the first time series data of the monitoring index in the past preset time period through the convolutional noise reduction autoencoder, and output the second time series data in the past preset time period, the A plurality of said historical moments are included in the preset time period;

The decomposition module is configured to decompose the second time series data of each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.
A terminal device includes a memory, a processor, and a computer program that is stored in the memory and can run on the processor, and the processor implements the following steps when the processor executes the computer program:

Obtain the indicator data of the monitoring indicator at the current moment;

Obtaining the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

Calculating the residual value of the indicator data according to the periodic component;

When the residual value is not within the residual error threshold range, it is determined that the monitoring index at the current moment is abnormal;

Wherein, the process of obtaining period components corresponding to each historical moment respectively includes:

The first time series data of the monitoring index in the past preset time period is denoised by the convolutional noise reduction autoencoder, and the second time series data in the past preset time period is outputted, and the preset time period includes A plurality of said historical moments;

Decomposing the second time series data at each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.
9. The terminal device of claim 9, wherein the processor further implements the following steps when executing the computer program:

Inputting the first time series data to the convolutional noise reduction autoencoder;

Performing multi-layer hidden layer encoding on the first time series data by an encoder in the convolutional noise reduction autoencoder to obtain a low-dimensional feature vector;

Perform multi-layer hidden layer decoding on the low-dimensional feature vector by a decoder in the convolutional denoising self-encoder, and output the second time series data.
9. The terminal device according to claim 9, wherein the convolutional noise reduction autoencoder is trained based on time series data containing preset noise monitoring indicators.
9. The terminal device of claim 9, wherein the processor further implements the following steps when executing the computer program:

Generating a periodic sub-sequence corresponding to each historical time according to the second time series data of each historical time within the preset time period;

Performing smooth regression on each of the periodic subsequences to obtain a smoothing result corresponding to each of the periodic subsequences;

Remove the low flux in each of the smoothing results, and obtain the period components corresponding to each of the historical moments.
9. The terminal device of claim 9, wherein the processor implements the following steps when executing the computer program:

Acquiring the historical residual value of the second time series data at each historical moment in the preset time period;

Based on the normal distribution, calculate the mean and standard deviation of all the historical residual values;

Based on the n-sigma principle, the residual threshold value range is determined according to the mean value of the historical residual value, the standard value, and the preset n value.
9. The terminal device of claim 9, wherein the processor further implements the following steps when executing the computer program:

Acquiring the third time series data of the monitoring index in the preset time period;

Converting the third time series data into frequency domain data through fast Fourier transform;

Searching for the amplitude component corresponding to the target frequency in the frequency domain data;

When the number of the target frequencies whose amplitude components are greater than a first preset value is greater than a second preset value, the third time series data is used as the first time series data.
A computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

Obtain the indicator data of the monitoring indicator at the current moment;

Obtaining the period component of the historical moment corresponding to the current moment from the period components respectively corresponding to each historical moment;

Calculating the residual value of the indicator data according to the periodic component;

When the residual value is not within the residual error threshold range, it is determined that the monitoring index at the current moment is abnormal;

Wherein, the process of obtaining period components corresponding to each historical moment respectively includes:

The first time series data of the monitoring index in the past preset time period is denoised by the convolutional noise reduction autoencoder, and the second time series data in the past preset time period is outputted, and the preset time period includes A plurality of said historical moments;

Decomposing the second time series data at each of the historical moments in the preset time period to obtain the period components corresponding to each of the historical moments.
15. The computer-readable storage medium of claim 15, wherein the computer program further implements the following steps when being executed by the processor:

Inputting the first time series data to the convolutional noise reduction autoencoder;

Performing multi-layer hidden layer encoding on the first time series data by an encoder in the convolutional noise reduction autoencoder to obtain a low-dimensional feature vector;

Perform multi-layer hidden layer decoding on the low-dimensional feature vector by a decoder in the convolutional denoising self-encoder, and output the second time series data.
15. The computer-readable storage medium according to claim 15, wherein the convolutional noise reduction autoencoder is trained based on time series data containing preset noise monitoring indicators.
15. The computer-readable storage medium of claim 15, wherein the computer program further implements the following steps when being executed by the processor:

Generating a periodic sub-sequence corresponding to each historical time according to the second time series data of each historical time within the preset time period;

Performing smooth regression on each of the periodic subsequences to obtain a smoothing result corresponding to each of the periodic subsequences;

Remove the low flux in each of the smoothing results, and obtain the period components corresponding to each of the historical moments.
15. The computer-readable storage medium of claim 15, wherein the computer program further implements the following steps when being executed by the processor:

Acquiring the historical residual value of the second time series data at each historical moment in the preset time period;

Based on the normal distribution, calculate the mean and standard deviation of all the historical residual values;

Based on the n-sigma principle, the residual threshold value range is determined according to the mean value of the historical residual value, the standard value, and the preset n value.
15. The computer-readable storage medium of claim 15, wherein the computer program further implements the following steps when being executed by the processor:

Acquiring the third time series data of the monitoring index in the preset time period;

Converting the third time series data into frequency domain data through fast Fourier transform;

Searching for the amplitude component corresponding to the target frequency in the frequency domain data;

When the number of the target frequencies whose amplitude components are greater than a first preset value is greater than a second preset value, the third time series data is used as the first time series data.