WO2023045829A1

WO2023045829A1 - Service abnormality prediction method and device, storage medium, and electronic device

Info

Publication number: WO2023045829A1
Application number: PCT/CN2022/119099
Authority: WO
Inventors: 冯媛; 杨翌晨; 邵敏峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2021-09-24
Filing date: 2022-09-15
Publication date: 2023-03-30
Also published as: CN115859188A

Abstract

Embodiments of the present application provide a service abnormality prediction method and device, a storage medium, and an electronic device. The method comprises: acquiring real-time service data at a current time; performing multi-dimensional indicator aggregation on the real-time service data to obtain a multi-dimensional real-time data indicator; inputting the multi-dimensional real-time data indicator into a target neural network model to obtain a prediction result of the service within a preset time period after the current time output by the target neural network model; and inputting the prediction result into a target random forest model to obtain an abnormality detection result of the service within the preset time period output by the target random forest model. The problem in the related art of untimely abnormality processing caused by the operation and maintenance personnel starting abnormality diagnosis only after an abnormality occurs can be solved, and abnormalities that may occur in the network in future can be predicted, so that the operation and maintenance personnel can perform intervention and handling in advance, thereby reducing the risk of complaint.

Description

A business abnormality prediction method, device, storage medium and electronic device

Cross References to Related Applications

This disclosure is based on the Chinese patent application CN202111124591.X filed on September 24, 2021 with the title of "a service abnormality prediction method, device, storage medium and electronic device", and claims the priority of this patent application, which is incorporated by reference The contents disclosed therein are fully incorporated into the present disclosure.

technical field

Embodiments of the present disclosure relate to the communication field, and in particular, relate to a service anomaly prediction method, device, storage medium, and electronic device.

Background technique

In the field of operation and maintenance of mobile operators, thousands of dimensional index data are stored in the big data analysis system. Network operation and maintenance personnel usually conduct regular inspections on core indicators based on manual experience, and start the next troubleshooting work only after abnormal indicators are found. However, due to the complexity of the mobile network and the diversity of indicators, it is difficult and time-consuming to troubleshoot the root cause of the fault. Serious problems may even directly lead to network paralysis and affect the normal use of users.

At present, mobile operators have begun to monitor Key Performance Indicators (KPI) in the network, and use thresholds to judge abnormal indicators. There is no breakthrough application practice for early intervention in network operation and maintenance.

Aiming at the problem in the related technology that the operation and maintenance personnel start to diagnose the abnormality after the abnormality occurs, which leads to the untimely processing of the abnormality, no solution has been proposed yet.

Contents of the invention

Embodiments of the present disclosure provide a service anomaly prediction method, device, storage medium, and electronic device to at least solve the problem in the related art that operation and maintenance personnel start to diagnose anomalies after anomalies occur, resulting in untimely anomaly processing.

According to an embodiment of the present disclosure, a business abnormality prediction method is provided, including:

Collect real-time business data at the current time;

Aggregating the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

Inputting the multi-dimensional real-time data index into the target neural network model trained in advance based on historical business data, and obtaining the forecast result of the business within the preset time period after the current time output by the target neural network model;

The prediction result is input into the target random forest model trained in advance based on the historical business data, and the abnormal detection result of the business within the preset time output by the target random forest model is obtained.

In an exemplary embodiment, before performing multi-dimensional indicator aggregation on the real-time business data to obtain multi-dimensional real-time data indicators, the method further includes:

Stripping invalid data in the real-time business data to obtain valid real-time business data;

Standardize the non-normalized data in the effective real-time business data to obtain cleaned real-time business data.

In an exemplary embodiment, the method also includes:

Extracting the historical business data;

Aggregating the historical business data with multi-dimensional indicators to obtain multi-dimensional historical data indicators;

The constructed initial neural network model is trained according to the multi-dimensional historical data indicators to obtain the trained target neural network model.

In an exemplary embodiment, before performing multi-dimensional indicator aggregation on the historical business data to obtain multi-dimensional historical data indicators, the method further includes:

Stripping invalid data from the historical business data to obtain valid historical business data;

Normalize the non-normalized data in the valid historical business data to obtain cleaned historical business data.

In an exemplary embodiment, the method also includes:

Respectively extracting data aggregation indicators with a time window of N and a time window of M from the multi-dimensional historical data indicators, wherein N is not equal to M, and both N and M are integers greater than 1;

determining characteristic parameters according to the data aggregation index;

converting the characteristic parameters into a characteristic matrix;

The constructed initial random forest model is trained according to the feature matrix to obtain the trained target random forest model.

In an exemplary embodiment, determining characteristic parameters according to the data aggregation index includes:

The following parameters are respectively obtained from the data aggregation index: mean, standard deviation, minimum value, maximum value, quarter point, median, third quarter point, standard deviation mean, variance mean, cut Bischeff statistical characteristics, total variation, coefficient of variation;

The obtained parameters are composed into the characteristic parameters.

In an exemplary embodiment, the real-time service data includes at least: time information, behavior information, location information and KPI;

The historical service data includes at least: time information, behavior information, location information and KPI.

According to another embodiment of the present disclosure, a service anomaly prediction device is also provided, including:

The collection module is configured to collect real-time business data at the current time;

The first aggregation module is configured to aggregate the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

The input module is configured to input the multi-dimensional real-time data index into the target neural network model trained in advance based on the historical business data, and obtain the output of the target neural network model within the preset time period after the current time. forecast result;

The anomaly detection module is configured to input the prediction result into a pre-trained target random forest model based on the historical business data, and obtain the abnormal detection result of the business within the preset time output by the target random forest model.

In an exemplary embodiment, the device also includes:

The first stripping module is configured to strip invalid data in the real-time business data to obtain valid real-time business data;

The first cleaning module is configured to normalize the non-normalized data in the valid real-time business data to obtain cleaned real-time business data.

In an exemplary embodiment, the device also includes:

The first extraction module is configured to extract the historical business data;

The second focusing module is configured to aggregate the historical business data with multi-dimensional indicators to obtain multi-dimensional historical data indicators;

The first training module is configured to train the constructed initial neural network model according to the multi-dimensional historical data indicators to obtain the trained target neural network model.

In an exemplary embodiment, the device also includes:

The second stripping module is configured to strip invalid data in the historical business data to obtain valid historical business data;

The second cleaning module is configured to normalize the non-normalized data in the valid historical business data to obtain cleaned historical business data.

In an exemplary embodiment, the device also includes:

The second extraction module is configured to extract data aggregation indicators with a time window of N and a time window of M from the multi-dimensional historical data indicators respectively, wherein N is not equal to M, and both N and M are integers greater than 1;

A determining module, configured to determine characteristic parameters according to the data aggregation index;

A conversion module, configured to convert the characteristic parameters into a characteristic matrix;

The second training module is configured to train the constructed initial random forest model according to the feature matrix to obtain the trained target random forest model.

In an exemplary embodiment, the determination module is further configured to

The obtained parameters are composed into the characteristic parameters.

According to yet another embodiment of the present disclosure, there is also provided a computer-readable storage medium, where a computer program is stored in the storage medium, wherein the computer program is set to execute any one of the above method embodiments when running in the steps.

According to yet another embodiment of the present disclosure, there is also provided an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform any of the above Steps in the method examples.

In the embodiment of the present disclosure, the real-time business data at the current time is collected; the real-time business data is aggregated with multi-dimensional indicators to obtain multi-dimensional real-time data indicators; the multi-dimensional real-time data indicators are input into the pre-trained historical business data In the target neural network model, the forecast result of the business within the preset time period after the current time output by the target neural network model is obtained; the forecast result is input into the target random forest model trained in advance based on the historical business data In this method, obtaining the abnormality detection results of the business within the preset time output by the target random forest model can solve the problem in related technologies that the operation and maintenance personnel only start to diagnose the abnormality after the abnormality occurs, which leads to the untimely processing of the abnormality. Predicting possible abnormalities in the future can enable operation and maintenance personnel to intervene and deal with them in advance, reduce the risk of complaints, and improve user experience.

Description of drawings

FIG. 1 is a block diagram of a hardware structure of a mobile terminal according to a business anomaly prediction method according to an embodiment of the present disclosure;

FIG. 2 is a flow chart of a business anomaly prediction method according to an embodiment of the present disclosure;

FIG. 3 is a flow chart of a business anomaly prediction method according to an optional embodiment of the present disclosure;

FIG. 4 is a flowchart of a KPI network intelligent early warning according to an embodiment of the present disclosure;

5 is a schematic diagram of a neural network model according to an embodiment of the present disclosure;

FIG. 6 is a network diagram of VoLTE probe collection and deployment according to an embodiment of the present disclosure;

Fig. 7 is a block diagram of a service anomaly prediction device according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings and in combination with the embodiments.

It should be noted that the terms "first" and "second" in the specification and claims of the present disclosure and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence.

The method embodiments provided in the embodiments of the present disclosure may be executed in mobile terminals, computer terminals or similar computing devices. Taking running on a mobile terminal as an example, Fig. 1 is a block diagram of the hardware structure of the mobile terminal of the business anomaly prediction method of the embodiment of the present disclosure. As shown in Fig. 1, the mobile terminal may include one or more (only shown in Fig. 1 1) Processor 102 (processor 102 may include but not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned mobile terminal may also include a communication function The transmission device 106 and the input and output device 108. Those skilled in the art can understand that the structure shown in FIG. 1 is only for illustration, and it does not limit the structure of the above mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in FIG. 1 , or have a different configuration from that shown in FIG. 1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the business anomaly prediction method in the embodiment of the present disclosure, and the processor 102 executes the computer program stored in the memory 104 by running the Various functional applications and service chain address pool slicing processing realize the above-mentioned method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory that is remotely located relative to the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used to receive or transmit data via a network. The specific example of the above network may include a wireless network provided by the communication provider of the mobile terminal. In one example, the transmission device 106 includes a network interface controller (NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet in a wireless manner.

In this embodiment, a service anomaly prediction method running on the above-mentioned mobile terminal or network architecture is provided. FIG. 2 is a flowchart of a service anomaly prediction method according to an embodiment of the present disclosure. As shown in FIG. 2 , the process includes the following step:

Step S202, collecting real-time business data at the current time;

In this embodiment, the real-time service data includes at least: time information, behavior information, location information and KPI.

Step S204, aggregating the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

Step S206, input the multi-dimensional real-time data index into the target neural network model trained in advance based on historical business data, and obtain the forecast result of the business within the preset time period after the current time output by the target neural network model ;

Step S208, inputting the prediction result into the target random forest model trained in advance based on the historical business data, and obtaining the abnormal detection result of the business within the preset time output by the target random forest model.

Through the above steps S202 to S208, it is possible to solve the problem in the related technology that the operation and maintenance personnel start to diagnose the abnormality after the abnormality occurs, which leads to the untimely processing of the abnormality, and predicting the abnormality that may occur in the network in the future can enable the operation and maintenance personnel to intervene in advance, Deal with it in advance to reduce the risk of complaints and improve user experience.

In order to remove invalid real-time business data, before the above step S204, the real-time business data is cleaned to obtain the cleaned real-time business data, and further, the invalid data in the real-time business data is stripped to obtain an effective real-time Business data: standardize the non-standardized data in the effective real-time business data to obtain cleaned real-time business data.

Fig. 3 is a flowchart of a business anomaly prediction method according to an optional embodiment of the present disclosure, as shown in Fig. 3 , including:

Step S302, extracting historical business data;

In this embodiment, the historical service data at least includes: time information, behavior information, location information and KPI, and specifically, specific data may be collected from different locations.

Step S304, aggregating the historical business data with multi-dimensional indicators to obtain multi-dimensional historical data indicators;

Step S306: Train the constructed initial neural network model according to the multi-dimensional historical data indicators to obtain the trained target neural network model.

In order to remove invalid historical business data, before the above step S304, the historical business data is cleaned to obtain the cleaned historical business data, and further, the invalid data in the historical business data is stripped to obtain valid historical data Business data: standardize the non-normalized data in the effective historical business data to obtain cleaned historical business data.

This embodiment extracts historical business data, and aggregates hourly and daily granularity indicators for historical business data in each dimension; based on multi-dimensional historical business data, extracts the time series features of historical data after collection; constructs an initial neural network model, and extracts The historical business data after the feature is used to train the initial neural network model; the initial neural network model is often used in natural language translation. After the model is modified, it is used to predict the time series. The actual results show that the accuracy of the prediction is better than Common time series forecasting algorithms. The target neural network model obtained after training can be used to predict the prediction results for a period of time in the future.

In an exemplary embodiment, data aggregation indexes with a time window of N and a time window of M are respectively extracted from the multi-dimensional historical data indexes, wherein, N is not equal to M, and both N and M are integers greater than 1, For example, N is 7 days and M is 60 days. When collecting historical data, start from the current time, extract the data aggregation indicators with a time window of 7 days from the multi-dimensional historical data indicators, and extract from the multi-dimensional historical data indicators The time window is a data aggregation index of 60 days; the characteristic parameters are determined according to the data aggregation index; the characteristic parameters are converted into a characteristic matrix; the initial random forest model constructed is trained according to the characteristic matrix, and the trained results are obtained. The target random forest model.

In this embodiment, the hourly and daily granularity index aggregation is performed on the historical business data of each dimension; based on the multi-dimensional historical business data, the historical statistical characteristic parameters after the collection are extracted, and the model training is performed on the random forest network; conventional anomaly detection requires A large number of manually labeled samples, based on hundreds of millions of samples per hour, is almost impossible to achieve in the field of operation and maintenance. The embodiment of the present disclosure adopts a semi-automatic labeling method combining statistics and manual labeling to edit samples, which can greatly reduce the cost of manual labeling and improve labeling efficiency. The target random forest model obtained after training is used to detect and classify abnormal indicators (normal indicators, abnormal indicators), and give prediction conclusions about indicators that may appear abnormal.

Further, the above-mentioned determination of characteristic parameters according to the data aggregation index may specifically include: respectively obtaining the following parameters from the data aggregation index: mean value, standard deviation, minimum value, maximum value, quarter point, median , three-quarters point, standard deviation mean, variance mean, Chebyshev statistical features, total variation, coefficient of variation; the obtained parameters form the characteristic parameters.

Compared with the mode in the related technology that the operation and maintenance personnel do not start fault diagnosis until the fault is triggered, this embodiment provides a practical implementation plan for the operation and maintenance thinking of early identification, early diagnosis and early disposal through the evolution of technical capabilities. Based on the multi-dimensional KPI historical feature learning method, the future trend of KPI is predicted; in the process of abnormal identification, this embodiment is compared with the historical data of the dimension-KPI itself, and does not rely on threshold thresholds to divide abnormalities, which can effectively avoid false positives. Alarms and missed alarms can detect obvious KPI abnormalities and abnormalities with a tendency to deteriorate; in the fault early warning interface, through deep integration with operation and maintenance work, according to abnormal scenarios, build golden business indicators-operation and maintenance KPI indicators, multi-dimensional layering Early warning system, so as to filter out false alarms caused by sporadic index fluctuations, greatly reduce the scope of alarms, and improve the optimization efficiency of operation and maintenance colleagues.

Fig. 4 is a flowchart of a KPI network intelligent early warning according to an embodiment of the present disclosure, as shown in Fig. 4 , including:

After the probe collects the data, it cleans the basic data, and completes the basic index aggregation and abnormal data processing in the cleaning stage.

The aggregated data is subjected to feature extraction through feature engineering, which includes statistical features of single-time granularity of global data and time series features of dimensional data (that is, sequence prediction features).

The extracted features are used as the input of the AI model, and the time series sequence is input to the prediction model to obtain the prediction result of the specified dimension. The predicted historical data and the predicted results are spliced and then input into the abnormal recognition model to determine the abnormal recognition. Among them, the abnormal recognition model is a random forest abnormal recognition model, which can be obtained through historical business data training. The historical business data includes at least: time information, Behavior information, location information, and KPIs. KPIs specifically include statistical tags and manual analysis tags.

Finally, the summary result of abnormal dimensions that may exist in the future is obtained.

Fig. 5 is a schematic diagram of a neural network model according to an embodiment of the present disclosure. As shown in Fig. 5, the model mainly includes three parts: an encoder Encoder, a decoder Decoder and an attention model Attention. The encoding and decoding network uses RNN (Recurrent Neural Network , recurrent neural network) model. The time series KPI index is used as the input of the Encoder model, and the feature is encoded and converted into a feature tensor through the Encoder, which is used as the input of the Decoder. Combined with Self Attention, different weights are given according to the degree of influence, and the feature matrix and Encoder results are concatenated as the input of the fully connected network, and finally the prediction result is output.

Fig. 6 is a network diagram of VoLTE probe collection and deployment according to an embodiment of the present disclosure, as shown in Fig. 6 , including: IMS (IP Multimedia Subsystem IP, multimedia system), EPC (Evolved Packet Core, all-IP grouping core network ), E-UTRAN (Evolved UMTS Terrestrial Radio Access Network, Evolved UMTS Terrestrial Radio Access Network), GERAN (GSM EDGE Radio Access Network GSM/EDGE, wireless communication network), eMSC/GMSC (Evolved Mobile Switching Center/Gateway Mobile Switching Center, Evolved Gateway Mobile Switching Center/Gateway Mobile Switching Center), DRA (Diameter Routing Agent, routing proxy node), DNS/ENUM (Domain Name System/Telephone Number Mapping working group, domain name system/telephone number mapping working group) and Three-in-one HSS (Home Subscriber Server, belonging to the subscriber server), among which, IMS includes: BGCF (Breakout Gateway Control Function, egress gateway control function), MGCF (Media Gateway Control Function, media gateway control function), AS (Application Server , application server), I/S-CSCF (Interrogating/Serving Call Session Control Function, query/serving CSCF), IBCF (Internet Border Control Function), P-CSCF/SBC (Proxy Call Session Control Function/Session Border Controller, proxy CSCF/Session Border Controller) and PCRF (Policy and Charging Rules Function, policy and charging rule function), EPC includes: SEA-GW (Serving Gateway, service gateway), MME (Mobility Management Entity, mobile management node), E - UTRAN includes eNB (eNode B, base station). The network elements involved in this embodiment include at least I/S-CSCF, P-CSCF/SBC, SEA-GW, MME, eNB, and eMSC/GMSC. Partners hip Project, referred to as 3GPP) protocol standard collection interface, that is, the deployment location of the data collection probe.

This embodiment is based on VoLTE (Voice over Long Term Evolution, long-term evolution voice bearer) mobile communication network video service anomaly prediction, including network index collection, raw data cleaning, multi-dimensional index aggregation, KPI historical feature extraction, KPI index prediction, index anomaly identification process.

Network indicator collection, as shown in Figure 6, the hard probe is deployed on the Mw interface between the I/S-CSCF and P-CSCF/SBC to collect signaling such as registration, call, and call drop; it is deployed on the P/SBC and PCRF The Rx port collects call drop signaling; it is deployed on the Sv port between the MME and the eMSC network element to collect ESRVCC (Evolved Single Radio Voice Call Continuity, evolved single radio mode voice call continuity) handover signaling; it is deployed in the cell and signaling gateway (Security Gateway, referred to as SGW) s1-u interface between network elements collects voice and video user plane signaling.

Raw data cleaning, the collected signaling includes time information, user information, behavior information, location information, and KPI, the key KPI model indicators include at least: initial registration success rate, re-registration success rate, VoLTE network connection rate, V2V call establishment Duration, VoLTE call drop rate, ESRVCC handover success rate, ESRVCC average delay, MOS 3.0 (Mean Opinion Score, mean value of subjective evaluation of call quality) ratio, uplink packet loss rate. Raw data cleaning cleans the effective information in the information, including the stripping of invalid data and the normalization of unplanned data.

Multi-dimensional index aggregation. For the cleaned data, the indicators of the cell dimension and each network element dimension are aggregated separately, and hourly granular aggregation statistics are performed. The aggregated indicator matrix is as follows:

KPI historical feature extraction, respectively take the dimension of the window as N and the window as M-KPI aggregation index, obtain the mean, standard deviation, minimum value, maximum value, quarter point, median, and third quarter Points, mean standard deviation, mean variance, Chebyshev statistical features, total variation, and coefficient of variation are used as feature parameters, and the data is transformed into a feature matrix with the same structure as the above indicators.

For index prediction, the above index matrix is converted into a time series sequence format, and historical data is used as the input of the seq2seq+attention prediction model for model training. Real-time data is used as prediction data to predict future indicators and obtain prediction results.

Indicator anomaly identification, the feature matrix is used as the input of the random forest model for model training. And use the prediction results to input the random forest model to perform anomaly detection on the predicted time series.

According to another embodiment of the present disclosure, there is also provided a business anomaly prediction device, and Fig. 7 is a block diagram of a business anomaly prediction device according to an embodiment of the present disclosure, as shown in Fig. 7 , including:

The collection module 72 is configured to collect real-time business data at the current time;

The first aggregation module 74 is configured to aggregate the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

The input module 76 is configured to input the multi-dimensional real-time data index into the target neural network model pre-trained based on historical business data, and obtain the business within the preset time period after the current time output by the target neural network model prediction results;

The anomaly detection module 78 is configured to input the prediction result into the target random forest model trained in advance based on the historical business data, and obtain the abnormal detection result of the business within the preset time output by the target random forest model.

In an exemplary embodiment, the device also includes:

In an exemplary embodiment, the determination module is further configured to

The obtained parameters are composed into the characteristic parameters.

Embodiments of the present disclosure also provide a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.

In an exemplary embodiment, the above-mentioned computer-readable storage medium may include but not limited to: U disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM) , mobile hard disk, magnetic disk or optical disk and other media that can store computer programs.

Embodiments of the present disclosure also provide an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and exemplary implementation manners, and details will not be repeated here in this embodiment.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned disclosure can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network composed of multiple computing devices In fact, they can be implemented in program code executable by a computing device, and thus, they can be stored in a storage device to be executed by a computing device, and in some cases, can be executed in an order different from that shown here. Or described steps, or they are fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present disclosure is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present disclosure, and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

A business abnormality prediction method, comprising:

Collect real-time business data at the current time;

Aggregating the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

Inputting the multi-dimensional real-time data index into the target neural network model trained in advance based on historical business data, and obtaining the forecast result of the business within the preset time period after the current time output by the target neural network model;

The prediction result is input into the target random forest model trained in advance based on the historical business data, and the abnormal detection result of the business within the preset time output by the target random forest model is obtained.
The method according to claim 1, wherein, before aggregating the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators, the method further comprises:

Stripping invalid data in the real-time business data to obtain valid real-time business data;

Standardize the non-normalized data in the effective real-time business data to obtain cleaned real-time business data.
The method according to claim 1, wherein the method further comprises:

Extracting the historical business data;

Aggregating the historical business data with multi-dimensional indicators to obtain multi-dimensional historical data indicators;

The constructed initial neural network model is trained according to the multi-dimensional historical data indicators to obtain the trained target neural network model.
The method according to claim 3, wherein, before performing multi-dimensional indicator aggregation on the historical business data to obtain multi-dimensional historical data indicators, the method further comprises:

Stripping invalid data from the historical business data to obtain valid historical business data;

Normalize the non-normalized data in the valid historical business data to obtain cleaned historical business data.
The method according to claim 3, wherein the method further comprises:

Respectively extracting data aggregation indicators with a time window of N and a time window of M from the multi-dimensional historical data indicators, wherein N is not equal to M, and both N and M are integers greater than 1;

determining characteristic parameters according to the data aggregation index;

converting the characteristic parameters into a characteristic matrix;

The constructed initial random forest model is trained according to the feature matrix to obtain the trained target random forest model.
The method according to claim 5, wherein determining characteristic parameters according to the data aggregation index comprises:

The following parameters are respectively obtained from the data aggregation index: mean, standard deviation, minimum value, maximum value, quarter point, median, third quarter point, standard deviation mean, variance mean, cut Bischeff statistical characteristics, total variation, coefficient of variation;

The obtained parameters are composed into the characteristic parameters.
A method according to any one of claims 1 to 6, wherein,

The real-time service data includes at least: time information, behavior information, location information and KPI;

The historical service data includes at least: time information, behavior information, location information and KPI.
A business anomaly prediction device, comprising:

The collection module is configured to collect real-time business data at the current time;

The first aggregation module is configured to aggregate the real-time business data with multi-dimensional indicators to obtain multi-dimensional real-time data indicators;

The input module is configured to input the multi-dimensional real-time data index into the target neural network model trained in advance based on the historical business data, and obtain the output of the target neural network model within the preset time period after the current time. forecast result;

The anomaly detection module is configured to input the prediction result into a pre-trained target random forest model based on the historical business data, and obtain the abnormal detection result of the business within the preset time output by the target random forest model.
A computer-readable storage medium, wherein a computer program is stored in the storage medium, wherein the computer program is configured to perform the method described in any one of claims 1 to 7 when running.
An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to perform the method described in any one of claims 1 to 7.