Single-index anomaly detection method based on operation and maintenance monitoring

Abstract

The invention discloses a single-index anomaly detection method based on operation and maintenance monitoring. The anomaly detection system carries out KPI anomaly detection on time series data collected and stored by operation and maintenance monitoring, the time series data comprises time and index values collected by the operation and maintenance monitoring through a technical tool, and the anomaly detection system comprises a feature descriptor, a detector and a classifier. The invention is scientific and reasonable, safe and convenient in use; appropriate algorithms are selected for different scenes to carry out anomaly detection, abnormity detection efficiency and accuracy can be effectively improved, a problem of true value missing caused by false alarm and missing alarm can be avoided, so the algorithm is made to have enough fast speed to process the online real-time data, and the algorithm is made to automatically detect abnormity without dependence on annotation.

Description

technical field [0001] The invention relates to the technical field of operation and maintenance monitoring, in particular to a single-index anomaly detection method based on operation and maintenance monitoring. Background technique [0002] Operation and maintenance monitoring collects various monitoring indicators through various technical tools, such as Tivoli, Zabbix, APM, network packet capture, application buried point monitoring, etc. These indicators are usually stored as time series data (including collection time and indicator values), KPI abnormal Detection detects the timing curve of monitoring indicators and automatically discovers its abnormal behavior, so as to detect risks early and prevent them from developing into faults, or detect faults in time for stop loss, diagnosis and repair. [0003] The traditional popular KPI anomaly detection algorithms are as follows: [0004] 1. Based on supervised machine learning / deep learning, such as random forest, multi-...

AI Technical Summary

Problems solved by technology

[0004] 1. Based on supervised machine learning / deep learning, such as random forest, multi-layer perceptron, etc., the disadvantage is that a large number of manual annotations are required, and a considerable part of the abnormalities detected by the algorithm are unexplainable;

[0005] 2. Based on unsupervised machine learning, representative methods include isolation forest, density-based clustering method applied to discrete points, etc. The disadvantage is that the effect is not good enough on a considerable part of the time series, and there are also problems that the results cannot be explained ;

[0006] 3. Methods based on prediction errors, such as linear regression and its variants, moving average and its variants, etc. The disadvantage is that KPIs have different shapes, and it is difficult to solve all problems with a fixed regression, and most of the methods are very sensitive to abnormal points. Sensitive, the effect is not good enough;

[0009] 2. There is a lack of abnormal annotations in the actual environment, and the algorithm needs to be able to automatically detect abnormalities without relying on annotations;

[0011] 4. The algorithm must be accurate enough, otherwise a large number of false positives and false positives will miss truly valuable problems;

Images