WO2021189844A1

WO2021189844A1 - Detection method and apparatus for multivariate kpi time series, and device and storage medium

Info

Publication number: WO2021189844A1
Application number: PCT/CN2020/125003
Authority: WO
Inventors: 邓悦; 郑立颖; 徐亮
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-09-22
Filing date: 2020-10-30
Publication date: 2021-09-30
Also published as: CN112131272A; CN112131272B

Abstract

A detection method and apparatus for a multivariate KPI time series, and a computer device and a computer-readable storage medium, which relate to the technical field of artificial intelligence. The method comprises: according to a preset segmentation policy and a multivariate KPI time series to be trained, determining a plurality of corresponding segments of sub-multivariate KPI time series to be trained (S101), wherein the sub-multivariate KPI time series to be trained are untagged; training a preset model according to the sub-multivariate KPI time series to be trained, so as to generate a corresponding deterministic model (S102); acquiring a multivariate KPI time series to be tested (S103); according to the multivariate KPI time series to be tested and the deterministic model, acquiring a reconstruction probability value of a numerical value to be tested in the multivariate KPI time series to be tested (S104); and according to a preset threshold and the reconstruction probability value of the numerical value to be tested, determining whether a moment corresponding to the numerical value to be tested is an anomaly point (S105). The deterministic model is generated by means of the untagged multivariate KPI time series, the robustness of the model is enhanced, and the detection accuracy is improved.

Description

Detection method, device, equipment and storage medium of multiple KPI time series

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on September 22, 2020, with the application number CN2020110040443, and the name "Multivariate KPI time series detection methods, devices, equipment and storage media", all of which are approved The reference is incorporated in this application.

Technical field

This application relates to the field of artificial intelligence technology, and in particular to a detection method, device, computer equipment, and computer-readable storage medium for multiple KPI time series.

Background technique

Industrial equipment, such as servers, spacecraft, robotic assistance systems, engines, etc., usually generate multiple time series indicators so that the abnormal behavior of each device can be detected in time. Multiple univariate time series from the same device or the same entity form a multivariate KPI time series. Generally, the effect of directly using multiple KPI time series to detect entity anomalies at the entity level is better than that of multiple univariate time series.

The anomaly detection of multivariate KPI time series is mainly divided into the deterministic model and the random based model. The deterministic model mainly reconstructs the "normal" time series behavior and uses the reconstruction error to perform multi-sensor anomaly detection. The inventor realizes that the deterministic model requires a large number of labeled time series for training; and based on the randomness model, the value range of the historical multivariate KPI time series is obtained, and the current multivariate KPI time series is detected through the value range whether the current multivariate KPI time series is abnormal, and the accuracy of the detection is Lower.

Summary of the invention

This application provides a method for detecting multiple KPI time series. The method for detecting multiple KPI time series includes the following steps:

According to the preset segmentation strategy and the multi-element KPI time series to be trained, determine the corresponding multi-segment sub-multiple KPI time series to be trained, wherein the sub-multiple KPI time series to be trained are unlabeled;

Training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model;

Obtain the time series of multiple KPIs to be tested;

Obtaining the reconstruction probability value of the value to be detected in the multivariate KPI time series to be detected according to the multivariate KPI time series to be detected and the deterministic model;

According to the preset threshold and the reconstruction probability value of the to-be-detected value, it is determined whether the time corresponding to the to-be-detected value is an abnormal point.

The present application also provides a detection device for multiple KPI time series, and the detection device for multiple KPI time series includes:

The obtaining module is used to obtain the corresponding multi-segment sub-multiple KPI time series to be trained according to the preset segmentation strategy and the multi-element KPI time series to be trained, wherein the sub-multiple KPI time series to be trained are unlabeled;

A generating module, configured to train a preset model according to the sub-multiple KPI time series to be trained, and generate a corresponding deterministic model;

The first acquisition module is used to acquire the time series of multiple KPIs to be tested;

The second obtaining module is configured to obtain the reconstruction probability value of the value to be detected in the multivariate KPI time series to be detected according to the multivariate KPI time series to be detected and the deterministic model;

The determining module is configured to determine whether the time corresponding to the value to be detected is an abnormal point according to a preset threshold value and the reconstruction probability value of the value to be detected.

The present application also provides a computer device that includes a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein when the computer program is executed by the processor , To achieve the following steps:

Obtain the time series of multiple KPIs to be tested;

The present application also provides a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

Obtain the time series of multiple KPIs to be tested;

Description of the drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings used in the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present application. Ordinary technicians can obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a method for detecting multiple KPI time series according to an embodiment of the application;

FIG. 2 is a schematic flowchart of sub-steps of the method for detecting multiple KPI time series in FIG. 1;

FIG. 3 is a schematic diagram of decoding and encoding of a deterministic model in an embodiment of the application;

FIG. 4 is a schematic block diagram of a detection device for multiple KPI time series provided by an embodiment of the application;

FIG. 5 is a schematic block diagram of the structure of a computer device related to an embodiment of the application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

The technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

The flowchart shown in the drawings is only an example, and does not necessarily include all contents and operations/steps, nor does it have to be executed in the described order. For example, some operations/steps can also be decomposed, combined or partially combined, so the actual execution order may be changed according to actual conditions.

The embodiments of the present application provide a detection method, device, computer equipment, and computer-readable storage medium for multiple KPI time series. Wherein, the detection method of the multiple KPI time series can be applied to a computer device, and the computer device can be an electronic device such as a notebook computer or a desktop computer.

Hereinafter, some embodiments of the present application will be described in detail with reference to the accompanying drawings. In the case of no conflict, the following embodiments and features in the embodiments can be combined with each other.

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a method for detecting multiple KPI time series according to an embodiment of the application.

As shown in FIG. 1, the detection method of the multiple KPI time series includes step S101 to step S105.

Step S101: Determine the corresponding multi-segment sub-multiple KPI time sequence to be trained according to the preset segmentation strategy and the multi-element KPI time sequence to be trained, wherein the sub-multiple KPI time sequence to be trained is unlabeled.

Exemplarily, obtain the multivariate KPI time series to be trained, and perform data processing on the obtained multivariate KPI time series to be trained through a preset segmentation strategy. The preset segmentation strategy includes the sliding window information of T+1, where T can be Is 0. For example, when T is 1, the length of the sliding window is 2 moments. When the obtained time series of the multivariate KPI to be trained includes 0-24 moments, based on the length of the sliding window of 2 moments, the 0-24 moments of the multivariate KPI time series to be trained are segmented to obtain 23 sub-multivariate KPI time series. . Or, when T is 0, the length of the sliding window is 1 moment. When the obtained multivariate KPI time series to be trained includes 0-24 moments, based on the length of the sliding window is 1 time, the 0-24 moments of the multivariate KPI time series to be trained are segmented to obtain 24 sub-multiple KPI time series . Among them, each segment of the multiple KPI time series corresponds to a pair of values at a time.

Step S102: Train a preset model according to the sub-multiple KPI time series to be trained, and generate a corresponding deterministic model.

Exemplarily, the preset model is trained through the sub-multiple KPI time series to generate a corresponding deterministic model, where the sub-multiple KPI time series is a sub-multiple KPI time series without labels. For example, input the sub-multiple KPI time series into a preset model, extract the value corresponding to each time in the sub-multiple KPI time series through the network layer in the preset model, and obtain the vector features between the values corresponding to each time, based on the The vector features between the corresponding values at each time train the weight parameters of the network layer to generate the corresponding deterministic model. Or, input the submultivariate KPI time series into a preset model, establish a specific distribution for the numerical samples of each input submultivariate KPI time series to obtain auxiliary variables, and then reconstruct the original numerical samples based on the auxiliary variables, and improve by maximizing the loss function Preset the network parameters of the model to generate the corresponding deterministic model.

In an embodiment, specifically, referring to FIG. 2, step S102 includes: sub-step S1021 to sub-step S1024.

Sub-step S1021, input the sub-multiple KPI time sequence to be trained into the preset model, and extract the values in the sub-multiple KPI time sequence to be trained.

Input the sub-multiple KPI time series into the preset model, and extract the values in the sub-multiple KPI time series through the input layer of the preset model, where the sub-multiple KPI time series includes multiple moments, and each moment corresponds to multiple Numerical value. The numerical value may be the first numerical value at the first time, or the second numerical value at the first time, or the first numerical value at the second time, or the like.

In sub-step S1022, the numerical value is coded according to a preset coding program, and the first Gaussian distribution and the first auxiliary variable of the numerical value are obtained.

The preset model includes an encoding program. The value is encoded by the encoding program to obtain the first Gaussian distribution after encoding of the value. A diagonal Gaussian vector is randomly selected from the first Gaussian distribution, and the diagonal Gaussian vector is taken as The first auxiliary variable for this value.

In an embodiment, the preset encoding program includes a first preset neural network model and a first fully connected layer, and the value is encoded according to the preset encoding program to obtain the first Gaussian distribution of the value And the first auxiliary variable, including: obtaining the first hidden variable of the first preset neural network model according to the value and the first preset neural network model; according to the first preset fully connected layer and the first preset neural network model The variable is hidden to obtain the first Gaussian distribution corresponding to the value; the first auxiliary variable of the value is obtained based on the first Gaussian distribution.

Exemplarily, as shown in FIG. 3, the preset model includes an encoding program and a decoding program, where the encoding program includes a first preset neural network GPU and a first fully connected layer h ₁ ; the decoding program includes a second preset neural network Network GPU and the second fully connected layer h ₂ . When the value in the sub-multiple KPI time series is obtained, the first hidden variable generated before the first preset neural network GPU is obtained, and the value and the first hidden variable are input into the first preset neural network GPU to obtain The second hidden variable output by the first preset neural network GPU. _{For example, obtain the value x t} in the sub-multiple KPI time series _{, obtain the first hidden variable e t-1} generated before the GPU of the first preset neural network, and input the x _t and e _t-1 into the first preset neural network Network GPU, through the first preset formula in the first preset neural network GPU

Among them, w ^e , u ^e , and b ^e are variable parameters. By obtaining the parameter matrix of the first neural network or preset model, the parameter matrix is distributed with 0 as the center, and the parameters in the parameter matrix are randomly selected as w ^e , U ^e , b ^e initial parameters.

It is the update gate in the GRU, which is used to determine how to combine the newly input independent variable with the previous timing information.

It is the reset gate in the GRU, used to decide how much previous timing information to keep. Obtained by the second preset formula

in,

In order to be variable parameters, by obtaining the parameter matrix of the first neural network or preset model, the parameter matrix is distributed with 0 as the center, and the parameters in the parameter matrix are randomly selected as

The initial parameters. Obtained by the third preset formula

in,

The initial parameters.

When the first hidden variable of the value is obtained, the second hidden variable before the first fully connected layer is obtained, and the obtained first hidden variable is connected with the second hidden variable to obtain vector information. The vector information is input into the first fully connected layer, the network layer in the first fully connected layer uses the preset ReLU as the activation function, and the mean value and standard deviation are obtained through the following two linear transformations and softplus activation function transformations. For example, the value obtained in the first hidden variables e _t and before the first layer a second fully-connected hidden variable z _t-1, the first and second hidden variables hidden variables e _t z _t-1 connected to afford Hidden variable vector (z _t-1 , e _t ), through the first linear transformation function of the first fully connected layer

Get the first average of this value. in,

Is a constant. The second linear transformation function through the first fully connected layer

Get the first standard deviation of this value. in,

Is a constant, ε is a very small constant, which is set in order to prevent the value from overflowing during calculation.

When the first mean value and the first standard deviation of the value are obtained, the first Gaussian distribution of the value is constructed through the first mean value and the first standard deviation. For example, when getting the first mean

And the first standard deviation

, Construct the specific Gaussian distribution at the time corresponding to the value

When constructing the first Gaussian distribution of the value, a diagonal Gaussian vector is randomly selected from the first Gaussian distribution as the first auxiliary variable of the value. For example, from this particular Gaussian distribution

A diagonal Gaussian vector z _{t is} randomly selected, and the diagonal Gaussian vector z _{t is} used as the first auxiliary variable of the value.

Sub-step S1023: Decode the first auxiliary variable according to a preset decoding program to obtain a second Gaussian distribution corresponding to the value.

The preset model includes a decoding program. When the first auxiliary variable of the value is obtained, the first auxiliary variable is decoded by the preset decoding program to obtain the second Gaussian distribution after decoding the first auxiliary variable.

In an embodiment, the decoding program includes a second preset neural network model and a second preset fully connected layer, and the first auxiliary variable is decoded according to the preset decoding program to obtain the corresponding value The second Gaussian distribution includes: obtaining the second hidden variable of the second preset neural network model according to the first auxiliary variable and the second preset neural network model; and obtaining the second hidden variable of the second preset neural network model according to the second preset fully connected layer and the The second hidden variable obtains the second Gaussian distribution corresponding to the value.

Exemplarily, as shown in FIG. 3, the decoding program includes a second preset neural network GPU and a second fully connected layer h _2. When the first auxiliary variable of the value is obtained, the second preset neural network is obtained For the first hidden variable before the GPU, the second hidden variable corresponding to the output of the second preset neural network is obtained by inputting the first auxiliary variable and the first hidden variable into the second preset neural network. For example, the first auxiliary variable z _{t is} _{obtained, the first hidden variable d t-1} generated before the second preset neural network GPU is obtained, and the z _t and d _{t-1 are} input to the second preset neural network GPU through The first preset formula in the first preset neural network GPU

Among them, w ^e , u ^e , and b ^e are variable parameters. By obtaining the parameter matrix of the first neural network or the preset model, the parameter matrix is distributed with 0 as the center, and the parameters in the parameter matrix are randomly selected.

in,

The initial parameters. Obtained by the third preset formula

in,

The initial parameters.

When the second hidden variable of the second preset neural network is obtained, the second hidden variable is input into the second fully connected layer, and the preset ReLU is used as the activation function through the network layer in the second fully connected layer. The following two linear transformations and softplus transformations get the mean and standard deviation. For example, through the first linear transformation function of the first fully connected layer

Get the second mean of this value. in,

Get the second standard deviation of this value. in,

When the second mean value and the second standard deviation of the value are obtained, the second Gaussian distribution of the value is constructed through the second mean value and the second standard deviation. For example, when getting the second mean

And the first standard deviation

Where the specific Gaussian distribution

It is the second Gaussian distribution.

Sub-step S1024, training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution, and generating a corresponding deterministic model.

The loss function of the preset model is trained by obtaining the first Gaussian distribution and the second Gaussian distribution of the value to obtain the corresponding deterministic model. For example, by training the first loss function of the coding program with the obtained first Gaussian distribution, and training the second loss function of the decoding function with the obtained second Gaussian distribution, the corresponding deterministic function is obtained.

In an embodiment, the training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate a corresponding deterministic model includes: obtaining a cumulative distribution in the second Gaussian distribution Probability; according to the cumulative distribution probability and the first preset loss function, obtain the reconstruction probability of the value; according to the first Gaussian distribution, obtain the regular term of the first Gaussian distribution; according to the regular term and the first Two preset loss functions to obtain a regularization term of the value; training the network parameters of the decoding program and the network parameters of the encoding program based on the reconstruction probability and the regularization term, and generate a corresponding deterministic model.

Exemplary, the reconstruction probability is calculated by calculating the original data x _t in the reconstruction distribution

The cumulative distribution probability in

The next step is to calculate the regularization term. _{Since the auxiliary variable is not directly fitted in the encoding process, but z t is} obtained by fitting the mean and standard deviation of the auxiliary variable, and then resampling, the entire reconstruction process is affected by noise. Noise intensity, which is the standard deviation of the fit

It is calculated by a neural network, so in order to better reconstruct the original data during the whole training process, the standard deviation will be compressed as close to 0 as possible. Once the standard deviation is close to 0, the randomness of sampling disappears, and only a fixed sample will be obtained, namely

In this case, the model is equivalent to an ordinary autoencoder.

For example, z _t |x _t obeys the standard normal distribution, which avoids noise (ie

) Is compressed to zero, so it is guaranteed that the model can generate new samples that are different from the original data.

Therefore, we use the KL divergence KL[N(u,σ ² )]||N(0,I) of the multivariate independent normal distribution and the standard normal distribution as this regular term and add it to the loss function.

Among them, N is the number _{of z t.}

Combine the above two loss functions to get the total loss function:

The network parameters of the encoder and decoder are continuously trained by maximizing the above loss function until the expected accuracy is achieved.

In an embodiment, after obtaining the reconstruction probability of the value, the method further includes: recording the reconstruction probability of each value in the sub-multiple KPI time series to be trained, and sorting the reconstruction probability of each value; Determine the target reconstruction probability corresponding to the preset sequence number in the reconstruction probability after sorting, and use the target reconstruction probability as the preset threshold.

Exemplarily, recording the data of the last calculation of L _recon in the preset model training, we get the reconstruction probability corresponding to each original data, denoted as S _i =log[p(x _i |z _i )], where i =1 to N, combined into a set S={S ₁ , S ₂ ... S _N } containing N elements. Reconstruction means higher probability S _i x _i input time series subject to the normal mode, it can be reconstructed highly reliable manner. The smaller the probability, the smaller the possibility of reconstructing the original data, and therefore the greater the possibility of abnormality. A very small proportion due to abnormal values, based on practical experience, we selected 5% quantile S _i of all data as a threshold.

Step S103: Obtain a multivariate KPI time series to be detected.

Exemplarily, the time series of multiple KPIs to be detected is obtained through a preset segmentation strategy. For example, when a new value is detected on the multiple KPI time series, the multiple KPI time series are segmented based on the target window information in the preset segmentation strategy, and the multiple KPI time series to be detected containing the new value are obtained. .

Step S104: According to the multivariate KPI time series to be detected and the deterministic model, obtain the reconstruction probability value of the value to be detected in the multivariate KPI time series to be detected

Exemplarily, when the multivariate KPI time sequence to be detected is input into the deterministic model, the value to be detected in the multivariate KPI time sequence to be detected is obtained, and the value to be detected is a new value. The value to be detected is input into the first preset neural network of the deterministic model to obtain hidden variables output by the first preset neural network. The hidden variable is input into the first preset fully connected layer, and the first mean value and the first standard deviation obtained by the transformation of the first preset fully connected layer are obtained. According to the first mean value and the first standard deviation, the first Gaussian distribution of the value to be detected is obtained. Based on the first Gaussian distribution, the auxiliary variable of the value to be detected is obtained. Based on the second preset neural network and auxiliary variables, the hidden variables output by the second preset neural network are obtained. Based on the hidden variables output by the second preset neural network and the second preset fully connected layer, the second mean value and the second standard deviation obtained by the transformation of the second preset fully connected layer are obtained. Based on the second mean value and the second standard deviation, a second Gaussian distribution map of the value to be detected is constructed to obtain the reconstruction probability of the value to be detected.

Step S105: Determine whether the time corresponding to the value to be detected is an abnormal point according to the preset threshold value and the reconstruction probability value of the value to be detected.

The reconstruction probability value of the value to be detected is compared with a preset threshold value to determine whether the time of the value to be detected is an abnormal point; if the reconstruction probability value of the value to be detected is less than the preset threshold value, the value to be detected is determined The moment of is an abnormal point.

In the embodiment of the present application, a preset model is trained through an unlabeled multivariate KPI time series to generate a corresponding deterministic model, and the detected multivariate KPI time series is detected through the deterministic model to determine that the multivariate KPI time series is Whether the time corresponding to the value to be detected is an abnormal point. Use the knowledge of Bayesian network to establish different Gaussian distributions according to different input data, and then sample the corresponding latent variables from it, and then establish a specific distribution based on the latent variables, and then sample the reconstructed data again, so variables different from the original data can be generated. Enhance the robustness of the model; in the encoding process, the model based on determinism and the model based on randomness are merged to fully capture the time dependence between auxiliary variables in the latent space, so the input data can be better represented The distribution is more suitable for the abnormal detection of multiple KPI time series data; the modeling function of the recurrent neural network with random variables is expanded, and the GRU model is integrated to fully capture the time dependence of time series data, which improves the accuracy of the model and greatly improves the accuracy of the model. Reduce the complexity of the model, save the CPU occupancy rate in the calculation process, and also reduce the required storage space.

This application determines the corresponding multi-segment sub-multiple KPI time series to be trained according to the preset segmentation strategy and the multi-element KPI time series to be trained, wherein the sub-multiple KPI time series to be trained is unlabeled; according to the Training preset models for the sub-multiple KPI time series to be trained to generate the corresponding deterministic model; obtain the multi-element KPI time series to be detected; obtain the multi-element KPI time series to be detected and the deterministic model to obtain the The reconstruction probability value of the to-be-detected value in the detected multivariate KPI time series; according to the preset threshold and the reconstruction probability value of the to-be-detected value, it is determined whether the time corresponding to the to-be-detected value is an abnormal point. The KPI time series generates a deterministic model, which enhances the robustness of the model, making the deterministic model more suitable for abnormal detection of multiple KPI time series data, and improves the accuracy of the detection.

Please refer to FIG. 4. FIG. 4 is a schematic block diagram of an apparatus for detecting multiple KPI time series according to an embodiment of the present application.

As shown in FIG. 4, the detection device 400 for multiple KPI time series includes: a first determination module 401, a generation module 402, a first acquisition module 403, a second acquisition module 404, and a second determination module 405.

The first determination module 401 is configured to obtain the corresponding multi-segment sub-multiple KPI time series to be trained according to the preset segmentation strategy and the multi-element KPI time series to be trained, wherein the sub-multiple KPI time series to be trained is none Label;

The generating module 402 is configured to train a preset model according to the sub-multiple KPI time series to be trained, and generate a corresponding deterministic model;

The first obtaining module 403 is used to obtain the multivariate KPI time series to be detected;

The second obtaining module 404 is configured to obtain the reconstruction probability value of the value to be detected in the multivariate KPI time series to be detected according to the multivariate KPI time series to be detected and the deterministic model;

The second determining module 405 is configured to determine whether the time corresponding to the value to be detected is an abnormal point according to the preset threshold value and the reconstruction probability value of the value to be detected.

Among them, the generating module 402 is also specifically used for:

Input the sub-multiple KPI time series to be trained into the preset model, and extract the values in the sub-multiple KPI time series to be trained;

Encode the numerical value according to a preset coding program, and obtain the first Gaussian distribution and the first auxiliary variable of the numerical value;

Decode the first auxiliary variable according to a preset decoding program to obtain a second Gaussian distribution corresponding to the value;

Training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate a corresponding deterministic model.

Among them, the generating module 402 is also specifically used for:

Obtaining the first hidden variable of the first preset neural network model according to the value and the first preset neural network model;

Obtaining the first Gaussian distribution corresponding to the value according to the first preset fully connected layer and the first hidden variable;

The first auxiliary variable of the value is obtained based on the first Gaussian distribution.

Among them, the generating module 402 is also specifically used for:

Obtaining the second hidden variable of the second preset neural network model according to the first auxiliary variable and the second preset neural network model;

According to the second preset fully connected layer and the second hidden variable, a second Gaussian distribution corresponding to the value is obtained.

Among them, the generating module 402 is also specifically used for:

Acquiring the cumulative distribution probability in the second Gaussian distribution;

Obtaining the numerical reconstruction probability according to the cumulative distribution probability and the first preset loss function;

Obtaining a regular term of the first Gaussian distribution according to the first Gaussian distribution;

Obtaining a regularization term of the numerical value according to the regularization term and the second preset loss function;

Training the network parameters of the decoding program and the network parameters of the encoding program based on the reconstruction probability and the regularization term, and generate a corresponding deterministic model.

Among them, the detection device of multiple KPI time series is also used for:

Recording the reconstruction probability of each value in the sub-multiple KPI time series to be trained, and sorting the reconstruction probability of each value;

Determine the target reconstruction probability corresponding to the preset sequence number in the reconstruction probability after sorting, and use the target reconstruction probability as the preset threshold.

Wherein, the second determining module 405 is also used for:

Comparing the reconstruction probability value of the to-be-detected value with a preset threshold to determine whether the moment of the to-be-detected value is an abnormal point;

If the reconstruction probability value of the to-be-detected value is less than the preset threshold, the time when the to-be-detected value is determined to be an abnormal point.

It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described device and each module and unit can be referred to in the foregoing embodiment of the detection method for multiple KPI time series The corresponding process will not be repeated here.

The apparatus provided in the foregoing embodiment may be implemented in the form of a computer program, and the computer program may run on the computer device shown in FIG. 5.

Please refer to FIG. 5, which is a schematic block diagram of the structure of a computer device according to an embodiment of the application. The computer device may be a terminal.

As shown in FIG. 5, the computer device includes a processor, a memory, and a network interface connected through a system bus, where the memory may be volatile or non-volatile.

The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any method for detecting multiple KPI time series.

The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any method for detecting multiple KPI time series.

The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art can understand that the structure shown in FIG. 5 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may Including more or fewer parts than shown in the figure, or combining some parts, or having a different arrangement of parts.

It should be understood that the processor may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), and application specific integrated circuits (Application Specific Integrated Circuits). Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor.

Wherein, in an embodiment, the processor is used to run a computer program stored in a memory to implement the following steps:

Determine the corresponding multi-segment sub-multiple KPI time series to be trained according to the preset segmentation strategy and the multi-element KPI time series to be trained, wherein the sub-multiple KPI time series to be trained is unlabeled;

Obtain the time series of multiple KPIs to be tested;

Obtaining the reconstruction probability value of the to-be-detected value in the multi-element KPI time series to be detected according to the multi-element KPI time series to be detected and the deterministic model;

In an embodiment, the processor trains a preset model according to the sub-multiple KPI time series to be trained, and generates a corresponding deterministic model when it is implemented, and is used to implement:

In an embodiment, the preset coding program of the processor includes a first preset neural network model and a first fully connected layer, and the numerical value is coded according to the preset coding program to obtain the value When the first Gaussian distribution and the first auxiliary variable are realized, they are used to realize:

In an embodiment, the decoding program of the processor includes a second preset neural network model and a second preset fully connected layer, and the first auxiliary variable is decoded according to the preset decoding program to obtain the When the second Gaussian distribution corresponding to the above-mentioned value is realized, it is used to realize:

In an embodiment, when the processor trains the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution, and generates a corresponding deterministic model for implementation, it is used to realize:

In an embodiment, when the processor obtains the reconstruction probability of the numerical value and implements it, it is used to implement:

In an embodiment, when the processor determines whether the time when the value to be detected is an abnormal point realization based on a preset threshold and the reconstruction probability value of the value to be detected, the processor is used to implement:

The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium may be volatile or non-volatile. A computer program is stored on the computer-readable storage medium. The program includes program instructions, and the method implemented when the program instructions are executed can refer to the various embodiments of the method for detecting multiple KPI time series in this application.

The computer-readable storage medium may be the internal storage unit of the computer device described in the foregoing embodiment, for example, the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), and a Secure Digital (SD) ) Card, Flash Card, etc.

Further, the computer-readable storage medium may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, an application program required by at least one function, etc.; the storage data area may store Data created by the use of nodes, etc.

The blockchain referred to in this application is a new application mode of computer technology such as storage of preset models and deterministic models, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information for verification. The validity of the information (anti-counterfeiting) and the generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

It should be noted that in this article, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements not only includes those elements, It also includes other elements that are not explicitly listed, or elements inherent to the process, method, article, or system. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, article, or system that includes the element.

The serial numbers of the foregoing embodiments of the present application are for description only, and do not represent the superiority or inferiority of the embodiments. The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Anyone familiar with the technical field can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, these modifications or replacements shall be covered within the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

A detection method for multiple KPI time series, including:

According to the preset segmentation strategy and the multi-element KPI time series to be trained, determine the corresponding multi-segment sub-multiple KPI time series to be trained, wherein the sub-multiple KPI time series to be trained are unlabeled;

Training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model;

Obtain the time series of multiple KPIs to be tested;

Obtaining the reconstruction probability value of the to-be-detected value in the multi-element KPI time series to be detected according to the multi-element KPI time series to be detected and the deterministic model;

According to the preset threshold and the reconstruction probability value of the to-be-detected value, it is determined whether the time corresponding to the to-be-detected value is an abnormal point.
5. The method for detecting multiple KPI time series according to claim 1, wherein the training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model comprises:

Input the sub-multiple KPI time series to be trained into the preset model, and extract the values in the sub-multiple KPI time series to be trained;

Encode the numerical value according to a preset coding program, and obtain the first Gaussian distribution and the first auxiliary variable of the numerical value;

Decode the first auxiliary variable according to a preset decoding program to obtain a second Gaussian distribution corresponding to the value;

Training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate a corresponding deterministic model.
The method for detecting multiple KPI time series according to claim 2, wherein the preset coding program includes a first preset neural network model and a first fully connected layer, and the numerical value is performed according to the preset coding program. Encoding to obtain the first Gaussian distribution and the first auxiliary variable of the value includes:

Obtaining the first hidden variable of the first preset neural network model according to the value and the first preset neural network model;

Obtaining the first Gaussian distribution corresponding to the value according to the first preset fully connected layer and the first hidden variable;

The first auxiliary variable of the value is obtained based on the first Gaussian distribution.
The method for detecting multiple KPI time series according to claim 2, wherein the decoding program includes a second preset neural network model and a second preset fully connected layer, and the first The auxiliary variable is decoded to obtain the second Gaussian distribution corresponding to the value, including:

Obtaining the second hidden variable of the second preset neural network model according to the first auxiliary variable and the second preset neural network model;

According to the second preset fully connected layer and the second hidden variable, a second Gaussian distribution corresponding to the value is obtained.
The method for detecting a multivariate KPI time series according to claim 2, wherein the training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate the corresponding deterministic model comprises:

Acquiring the cumulative distribution probability in the second Gaussian distribution;

Obtaining the numerical reconstruction probability according to the cumulative distribution probability and the first preset loss function;

Obtaining a regular term of the first Gaussian distribution according to the first Gaussian distribution;

Obtaining a regularization term of the numerical value according to the regularization term and the second preset loss function;

Training the network parameters of the decoding program and the network parameters of the encoding program based on the reconstruction probability and the regularization term, and generate a corresponding deterministic model.
The method for detecting multiple KPI time series according to claim 5, wherein after said obtaining the reconstruction probability of the value, it further comprises:

Recording the reconstruction probability of each value in the sub-multiple KPI time series to be trained, and sorting the reconstruction probability of each value;

Determine the target reconstruction probability corresponding to the preset sequence number in the reconstruction probability after sorting, and use the target reconstruction probability as the preset threshold.
The method for detecting a multivariate KPI time series according to claim 1, wherein the determining whether the time at which the value to be detected is an abnormal point according to a preset threshold and the reconstruction probability value of the value to be detected comprises:

Comparing the reconstruction probability value of the to-be-detected value with a preset threshold to determine whether the moment of the to-be-detected value is an abnormal point;

If the reconstruction probability value of the to-be-detected value is less than the preset threshold, the time when the to-be-detected value is determined to be an abnormal point.
A detection device for multiple KPI time series, which includes:

The first determination module is used to determine the corresponding multi-segment sub-multiple KPI time series to be trained according to the preset segmentation strategy and the multi-element KPI time series to be trained, wherein the sub-multiple KPI time series to be trained is unlabeled ；

A generating module, configured to train a preset model according to the sub-multiple KPI time series to be trained, and generate a corresponding deterministic model;

The first acquisition module is used to acquire the time series of multiple KPIs to be tested;

The second obtaining module is configured to obtain the reconstruction probability value of the value to be detected in the multivariate KPI time series to be detected according to the multivariate KPI time series to be detected and the deterministic model;

The second determining module is configured to determine whether the time corresponding to the value to be detected is an abnormal point according to the preset threshold value and the reconstruction probability value of the value to be detected.
A computer device, wherein the computer device includes a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein when the computer program is executed by the processor, the The following steps:

According to the preset segmentation strategy and the multi-element KPI time series to be trained, determine the corresponding multi-segment sub-multiple KPI time series to be trained, wherein the sub-multiple KPI time series to be trained are unlabeled;

Training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model;

Obtain the time series of multiple KPIs to be tested;

Obtaining the reconstruction probability value of the to-be-detected value in the multi-element KPI time series to be detected according to the multi-element KPI time series to be detected and the deterministic model;

According to the preset threshold and the reconstruction probability value of the to-be-detected value, it is determined whether the time corresponding to the to-be-detected value is an abnormal point.
9. The computer device according to claim 9, wherein the training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model comprises:

Input the sub-multiple KPI time series to be trained into the preset model, and extract the values in the sub-multiple KPI time series to be trained;

Encode the numerical value according to a preset coding program, and obtain the first Gaussian distribution and the first auxiliary variable of the numerical value;

Decode the first auxiliary variable according to a preset decoding program to obtain a second Gaussian distribution corresponding to the value;

Training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate a corresponding deterministic model.
The computer device according to claim 10, wherein the preset coding program includes a first preset neural network model and a first fully connected layer, and the numerical value is coded according to the preset coding program to obtain the The first Gaussian distribution of the value and the first auxiliary variable include:

Obtaining the first hidden variable of the first preset neural network model according to the value and the first preset neural network model;

Obtaining the first Gaussian distribution corresponding to the value according to the first preset fully connected layer and the first hidden variable;

The first auxiliary variable of the value is obtained based on the first Gaussian distribution.
10. The computer device of claim 10, wherein the decoding program includes a second preset neural network model and a second preset fully connected layer, and the first auxiliary variable is decoded according to the preset decoding program, Obtaining the second Gaussian distribution corresponding to the value includes:

Obtaining the second hidden variable of the second preset neural network model according to the first auxiliary variable and the second preset neural network model;

According to the second preset fully connected layer and the second hidden variable, a second Gaussian distribution corresponding to the value is obtained.
10. The computer device of claim 10, wherein the training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate the corresponding deterministic model comprises:

Acquiring the cumulative distribution probability in the second Gaussian distribution;

Obtaining the numerical reconstruction probability according to the cumulative distribution probability and the first preset loss function;

Obtaining a regular term of the first Gaussian distribution according to the first Gaussian distribution;

Obtaining a regularization term of the numerical value according to the regularization term and the second preset loss function;

Training the network parameters of the decoding program and the network parameters of the encoding program based on the reconstruction probability and the regularization term, and generate a corresponding deterministic model.
The computer device according to claim 13, wherein after said obtaining the reconstruction probability of the value, the following steps are further implemented:

Recording the reconstruction probability of each value in the sub-multiple KPI time series to be trained, and sorting the reconstruction probability of each value;

Determine the target reconstruction probability corresponding to the preset sequence number in the reconstruction probability after sorting, and use the target reconstruction probability as the preset threshold.
9. The computer device according to claim 9, wherein the determining whether the time at which the value to be detected is an abnormal point according to a preset threshold and the reconstruction probability value of the value to be detected comprises:

Comparing the reconstruction probability value of the to-be-detected value with a preset threshold to determine whether the moment of the to-be-detected value is an abnormal point;

If the reconstruction probability value of the to-be-detected value is less than the preset threshold, the time when the to-be-detected value is determined to be an abnormal point.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

According to the preset segmentation strategy and the multi-element KPI time series to be trained, determine the corresponding multi-segment sub-multiple KPI time series to be trained, wherein the sub-multiple KPI time series to be trained are unlabeled;

Training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model;

Obtain the time series of multiple KPIs to be tested;

Obtaining the reconstruction probability value of the to-be-detected value in the multi-element KPI time series to be detected according to the multi-element KPI time series to be detected and the deterministic model;

According to the preset threshold and the reconstruction probability value of the to-be-detected value, it is determined whether the time corresponding to the to-be-detected value is an abnormal point.
15. The computer-readable storage medium of claim 16, wherein the training a preset model according to the sub-multiple KPI time series to be trained to generate a corresponding deterministic model comprises:

Input the sub-multiple KPI time series to be trained into the preset model, and extract the values in the sub-multiple KPI time series to be trained;

Encode the numerical value according to a preset coding program, and obtain the first Gaussian distribution and the first auxiliary variable of the numerical value;

Decode the first auxiliary variable according to a preset decoding program to obtain a second Gaussian distribution corresponding to the value;

Training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate a corresponding deterministic model.
17. The computer-readable storage medium of claim 17, wherein the preset coding program comprises a first preset neural network model and a first fully connected layer, and the numerical value is coded according to the preset coding program, Obtaining the first Gaussian distribution and the first auxiliary variable of the value includes:

Obtaining the first hidden variable of the first preset neural network model according to the value and the first preset neural network model;

Obtaining the first Gaussian distribution corresponding to the value according to the first preset fully connected layer and the first hidden variable;

The first auxiliary variable of the value is obtained based on the first Gaussian distribution.
The computer-readable storage medium of claim 17, wherein the decoding program includes a second preset neural network model and a second preset fully connected layer, and the first auxiliary variable is processed according to the preset decoding program. Decoding to obtain the second Gaussian distribution corresponding to the value includes:

Obtaining the second hidden variable of the second preset neural network model according to the first auxiliary variable and the second preset neural network model;

According to the second preset fully connected layer and the second hidden variable, a second Gaussian distribution corresponding to the value is obtained.
17. The computer-readable storage medium of claim 17, wherein the training the loss function of the preset model according to the first Gaussian distribution and the second Gaussian distribution to generate the corresponding deterministic model comprises:

Acquiring the cumulative distribution probability in the second Gaussian distribution;

Obtaining the numerical reconstruction probability according to the cumulative distribution probability and the first preset loss function;

Obtaining a regular term of the first Gaussian distribution according to the first Gaussian distribution;

Obtaining a regularization term of the numerical value according to the regularization term and the second preset loss function;

Training the network parameters of the decoding program and the network parameters of the encoding program based on the reconstruction probability and the regularization term, and generate a corresponding deterministic model.