Anomaly detection method and device

Abstract

The embodiment of the invention provides an anomaly detection method and device. The method comprises following steps of obtaining the history data sequence and the recent trend data sequence of performance parameters of a to-be-detected device; according to the history data sequence, calculating to obtain a first dynamic threshold range of an observing value at a current detection point; according to the recent trend data sequence, calculating to obtain a second dynamic threshold range of the observing value at the current detection point; then determining the dynamic threshold range of the current detection point according to the first dynamic threshold range, the second dynamic threshold range and a dynamic threshold selection strategy; and finally, judging whether the observing value of the current detection point belongs to the dynamic threshold range of the current detection point. According to the method, the dynamic threshold range of the current detection point can be determined through combination of the history data sequence and the recent trend data sequence of the performance parameters; different dynamic threshold selection strategies can be set according to different performance parameters; and the performance parameter anomalies of the to-be-detected device are prevented from misjudgment, underreporting and false alarm.

Description

technical field [0001] Embodiments of the present invention relate to communication technologies, and in particular to an abnormality detection method and device. Background technique [0002] With the increasing popularity of cloud computing virtualization technology, the management and monitoring of basic virtualization facilities become more and more important. Through real-time monitoring of various performance indicators of virtualized facilities, abnormal situations can be detected in time, and alarm notifications can be issued to remind operation and maintenance personnel to take measures to maintain the normal operation of virtualized facilities. [0003] The existing anomaly detection is to calculate the dynamic threshold range and the discriminant decision value of the current detection point through the historical data of each performance parameter, and then judge whether the decision value of the current detection point belongs to the dynamic threshold range, if ...

AI Technical Summary

Problems solved by technology

[0004] The existing method adopts a unified processing method for all performance parameters to determine whether there is an abnormality, resulting in a large number of false alarms and missed judgments. For example, for some performance parameters that are not sensitive to parameter fluctuations, a large number of false alarms will be generated. Warning, for some performance parameters that are sensitive to parameter fluctuations, false negatives will occur

Images