Anomaly detection method, apparatus, device, and storage medium

Abstract

The application relates to an anomaly detection method, device, equipment and storage medium. The method comprises the following steps: acquiring at least one to-be-detected time series data; extracting basic feature information from the at least one to-be-detected time series data; determining an anomaly detection model corresponding to the basic feature information; inputting the at least one to-be-detected time series data into the corresponding anomaly detection model to perform anomaly detection processing, and obtaining an anomaly detection result corresponding to the at least one to-be-detected time series data; acquiring to-be-detected time series data with an anomaly detection result as target time series data, and acquiring a business type corresponding to the target time series data; verifying the target time series data based on the business type corresponding to the target time series data, and determining a target anomaly detection result corresponding to the target time series data. The anomaly detection processing is low in labor cost, low in time consumption, high in anomaly detection model universality, and high in anomaly detection refinement.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to an anomaly detection method, apparatus, device, and storage medium. Background Technology

[0002] Current methods for monitoring time series metrics typically employ manual threshold detection or machine learning based on feature engineering. Manual threshold detection relies on the experience of operations personnel to set a static threshold for each time series metric. When a metric exceeds this threshold, it's considered abnormal and an alarm is triggered. However, in real-world monitoring scenarios, metrics often number in the millions. Maintaining a static threshold for each metric would be prohibitively costly. Furthermore, as business grows and evolves, the initially set static thresholds may become inappropriate, making adjustments insufficient to keep pace with development.

[0003] While feature engineering-based machine learning addresses some issues of traditional approaches, it still has shortcomings. These include high detection time, weak model generalization (meaning the model struggles to adapt to different business scenarios), and the fact that data annotation and model business characteristics are loaded into the annotation of metric data, resulting in a model trained in business A becoming unsuitable for business B. Furthermore, annotating and training models for different business data across various business scenarios is a significant workload. Summary of the Invention

[0004] In view of the above-mentioned technical problems, this application proposes an anomaly detection method, apparatus, device and storage medium.

[0005] According to one aspect of this application, an anomaly detection method is provided, the method comprising:

[0006] Acquire at least one time series data to be detected;

[0007] Extract basic feature information from the at least one time-series data to be detected;

[0008] Determine the anomaly detection model corresponding to the basic feature information;

[0009] The at least one time series data to be detected is input into the corresponding anomaly detection model for anomaly detection processing, and the anomaly detection result corresponding to the at least one time series data to be detected is obtained.

[0010] The process involves obtaining the time-series data to be detected that has an abnormality detection result as the target time-series data, and obtaining the service type corresponding to the target time-series data.

[0011] Based on the service type corresponding to the target time series data, the target time series data is verified to determine the target anomaly detection result corresponding to the target time series data.

[0012] According to another aspect of this application, an anomaly detection device is provided, comprising:

[0013] The time series data acquisition module is used to acquire at least one time series data to be detected;

[0014] A basic feature information extraction module is used to extract basic feature information from the at least one time series data to be detected;

[0015] An anomaly detection model determination module is used to determine the anomaly detection model corresponding to the basic feature information;

[0016] An anomaly detection result acquisition module is used to input the at least one time series data to be detected into the corresponding anomaly detection model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected.

[0017] The target time series data and business type acquisition module is used to acquire the time series data to be detected that has an abnormality detection result as the target time series data and to acquire the business type corresponding to the target time series data.

[0018] The target anomaly detection result determination module is used to verify the target time series data based on the service type corresponding to the target time series data, and determine the target anomaly detection result corresponding to the target time series data.

[0019] According to another aspect of this application, an anomaly detection device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to perform the above-described method.

[0020] According to another aspect of this application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions, when executed by a processor, implement the above-described method.

[0021] By extracting basic feature information from the time-series data to be detected, inputting the time-series data into the corresponding anomaly detection model for anomaly detection processing, and verifying the target time-series data based on the corresponding business type, the target anomaly detection result is determined. This application's anomaly detection processing eliminates the need for manual setting and maintenance of detection thresholds, reducing labor costs; it also avoids the computation of numerous features, requiring only the extraction of basic feature information, thus avoiding extensive feature engineering calculations. The anomaly detection processing is more streamlined and time-efficient, achieving millisecond-level processing. Furthermore, the anomaly detection model is extracted from the business type, resulting in strong generalization ability. It can detect only the inherent form of the time-series data, making it more versatile and easier to extend. Additionally, by inputting the time-series data to be detected into the corresponding anomaly detection model for anomaly detection processing, parallel processing of anomaly detection can be achieved, further improving the efficiency of anomaly detection and enabling refined anomaly detection.

[0022] Other features and aspects of this application will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0023] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this application together with the specification and serve to explain the principles of this application.

[0024] Figure 1 This diagram illustrates an application system provided according to an embodiment of the present application.

[0025] Figure 2 A schematic diagram of timing data according to an embodiment of this application is shown.

[0026] Figure 3 A flowchart illustrating a training method for an anomaly detection model according to an embodiment of this application is shown.

[0027] Figure 4 A flowchart of an anomaly detection method according to an embodiment of this application is shown.

[0028] Figure 5 The flowchart illustrates a method for verifying target time-series data based on the service type corresponding to the target time-series data, according to an embodiment of this application, and determining the target anomaly detection result corresponding to the target time-series data.

[0029] Figure 6 A flowchart of an anomaly detection method according to an embodiment of this application is shown.

[0030] Figure 7This diagram illustrates an alarm for abnormal timing data according to an embodiment of the present application.

[0031] Figure 8 A flowchart of an anomaly detection method according to an embodiment of this application is shown.

[0032] Figure 9 A schematic diagram of an anomaly detection technology architecture according to an embodiment of this application is shown.

[0033] Figure 10 A flowchart of an anomaly detection method according to an embodiment of this application is shown.

[0034] Figure 11 A block diagram of an anomaly detection device according to an embodiment of this application is shown.

[0035] Figure 12 This is a block diagram illustrating an anomaly detection device 1200 according to an exemplary embodiment. Detailed Implementation

[0036] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0037] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0038] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0039] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. AI software technology mainly includes computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0040] In recent years, with the research and progress of artificial intelligence technology, it has been widely applied in many fields. The solutions provided in this application involve technologies such as computer vision, and are specifically illustrated through the following embodiments:

[0041] Please see Figure 1 , Figure 1 This diagram illustrates an application system according to an embodiment of this application. The application system can be used in the anomaly detection method of this application. Figure 1 As shown, the application system may include at least server 01 and terminal 02.

[0042] In this embodiment of the application, the server 01 may include an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0043] In this embodiment, the terminal 02 may include physical devices such as smartphones, desktop computers, tablets, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices. The physical device may also include software running on it, such as applications. The operating system running on the terminal 02 in this embodiment may include, but is not limited to, Android, iOS, Linux, and Windows.

[0044] In the embodiments described in this specification, the terminal 02 and the server 01 can be directly or indirectly connected through wired or wireless communication, and this application does not limit this connection.

[0045] The terminal 02 can be used to provide user-oriented anomaly detection processing. Users can upload time-series data to be detected to the terminal 02. The terminal 02 can receive and display alarm information, time-series graphs corresponding to the abnormal time-series data, and basic characteristic information of the abnormal time-series data. Users can also provide feedback on the alarm information on the terminal 02, that is, they can provide feedback on the abnormal time-series data. The terminal 02 can provide user-oriented anomaly detection processing in ways including but not limited to application-based methods, web-based methods, etc.

[0046] It should be noted that, in this embodiment of the application, the anomaly detection method can be executed by server 01, and preferably, the anomaly detection method is implemented in server 01. This is to reduce the data processing pressure on the terminal and improve the device performance of the user-facing terminal.

[0047] In a specific embodiment, when server 01 is a distributed system, this distributed system can be a blockchain system. When the distributed system is a blockchain system, it can be formed by multiple nodes (any form of computing device connected to the network, such as servers or user terminals). The nodes form a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In the distributed system, any machine, such as a server or terminal, can join and become a node. A node includes a hardware layer, a middleware layer, an operating system layer, and an application layer. Specifically, the functions of each node in the blockchain system may include:

[0048] 1) Routing: A basic function of nodes used to support communication between nodes.

[0049] In addition to routing capabilities, nodes can also have the following functions:

[0050] 2) Applications are deployed in the blockchain to implement specific business needs. They record data related to the implementation of functions to form record data, carry digital signatures in the record data to indicate the source of the task data, and send the record data to other nodes in the blockchain system. When other nodes successfully verify the source and integrity of the record data, they add the record data to a temporary block.

[0051] It should be noted that the following diagram shows one possible sequence of steps, and it is not strictly necessary to follow this order. Some steps can be executed in parallel without interdependence.

[0052] In the embodiments of this specification, since the correspondence between basic feature information, feature type, and anomaly detection model is used in both the anomaly detection process and the anomaly detection model training process, the correspondence between basic feature information, feature type, and anomaly detection model is introduced first. This correspondence can be set according to actual needs, and this application does not limit it.

[0053] The basic feature information can be used to reflect the distribution information of time series data and to select anomaly detection models. For example, basic feature information can include fluctuation information, trend (monotonic) information, and periodic information of time series data. Feature types can include stationary and non-stationary types. For stationary time series data, the sigma model performs well in anomaly detection, such as the N-sigma model, where N can be 3. However, for non-stationary time series data, the sigma model does not achieve good anomaly detection results. To better handle anomaly detection for non-stationary time series data, this application introduces trend information and periodic information to further subdivide the non-stationary types. In one example, non-stationary types can include a first non-stationary type, a second non-stationary type, and a third non-stationary type. Specifically, the first non-stationary type can include time series data that is highly volatile, has no trend, and has no periodic differences, or time series data that is highly volatile, has a trend, and has no periodic differences; the second non-stationary type can include time series data that is highly volatile, has a trend, and has periodic differences; and the third non-stationary type can include time series data that includes highly volatile, has no trend, and has periodic differences. For details on time-series data, please refer to the relevant sections below.

[0054] In the embodiments of this specification, the feature type can be determined based on basic feature information and the corresponding fluctuation threshold. For example, if the fluctuation information in the basic feature information is less than or equal to the fluctuation threshold, the feature type can be determined to be a stationary type; if the fluctuation information in the basic feature information is greater than the fluctuation threshold, the feature type can be determined to be a non-stationary type. When the basic feature information includes fluctuation information, trend information, and periodic information of time series data, in one example, further classification of non-stationary types can include: classifying fluctuation information greater than the fluctuation threshold, no trend, periodicity, and no difference between periods as the corresponding first non-stationary type; classifying fluctuation information greater than the fluctuation threshold, upward or downward trend, periodicity, and no difference between periods as the corresponding second non-stationary type; and classifying fluctuation information greater than the fluctuation threshold, no trend, periodicity, and difference between periods as the corresponding third non-stationary type.

[0055] The fluctuation information refers to the degree of fluctuation in time-series data; the trend information refers to the rise, fall, or stabilization of the time-series data from a preset time before the detection data point to the detection data point, where the preset time can be half an hour, and this application does not limit this; the periodicity information refers to whether the time-series data has periodicity and the differences between periods; the differences between periods include differences between periods (periodic differences) and no differences between periods (no periodic differences). Periodic differences can mean that the detection data point is different from the data point corresponding to the detection time point in historical data points; no periodic differences can mean that the detection data point is the same as the data point corresponding to the detection time point in historical data points. For example, if the detection data point is the current 10:00, the data point corresponding to this detection point can be the data point corresponding to the historical detection point of 10:00. The time-series data, detection data points, and historical data points are described in the corresponding descriptions below. Historical time points can correspond to historical data points. As an example, time series decomposition algorithms, such as the STL (Seasonal-Trend decomposition procedure based on Loess) algorithm (a time series decomposition algorithm based on local regression smoothing), can be used to obtain periodic information of time series data.

[0056] Optionally, anomaly detection models can be categorized into non-deep learning models and deep learning models. Anomaly detection models can be supervised or unsupervised learning models; this application does not impose any limitations on this.

[0057] As an example, the correspondence between basic feature information, feature type, and anomaly detection model can be shown in Table 1 below:

[0058] Table 1

[0059]

[0060] It should be noted that Table 1 above is merely an example and does not limit this application. For data with large fluctuations and no significant differences between periods, decision tree models can achieve good results in anomaly detection. For example, decision tree models can include GBDT (Gradient Boosting Decison Tree) or XGBoost (Extreme Gradient Boosting) models. GBDT sums the conclusions of all trees to arrive at the final conclusion; the trees in GBDT are regression trees, and GBDT can be used for regression prediction and classification. XGBoost is an efficient gradient boosting algorithm that automatically utilizes CPU multithreading, improving anomaly detection efficiency and making it suitable for scenarios with large datasets. For data with large fluctuations, trends, and periodic differences, moving average algorithms can effectively evaluate the fit of multiple data points near the detected data point for effective anomaly detection. For example, moving average algorithms can include EWMA (Exponentially Weighted Moving Average) or ARIMA (Autoregressive Integrated Moving Average) models. For data types with large fluctuations, no trend, and periodic differences, the EWMA algorithm cannot detect anomalies because neighboring data points do not show a clear trend. Therefore, a combination of a multinomial fitting algorithm and a change point detection algorithm can be used for anomaly detection. The multinomial fitting algorithm is essentially a linear model, but the variables can be powers of 2 or higher. It uses a polynomial expansion to fit the time series data, where the expansion coefficients can be determined using least squares fitting. The change point detection algorithm primarily uses differencing to detect the magnitude of changes in the time series. If the magnitude exceeds a threshold, a change point is considered to exist, indicating an anomaly.

[0061] During the training phase of the anomaly detection model, a sub-sample time-series dataset corresponding to the feature type can be obtained. Using this dataset, a pre-defined machine learning model can be trained to obtain the non-deep learning models shown in Table 1. Alternatively, a pre-defined deep learning model can be trained using the sub-sample time-series dataset to obtain the deep learning models shown in Table 1: the first anomaly detection model, the second anomaly detection model, the third anomaly detection model, and the fourth anomaly detection model.

[0062] It should be noted that the basic characteristics of time series data can also be non-periodic. Correspondingly, anomaly detection models can be set up, and non-periodic subsample time series data can be obtained. Based on this subsample time series data, a preset machine learning model can be trained to obtain the corresponding anomaly detection model. Anomaly detection can also be performed on non-periodic time series data subsequently.

[0063] In anomaly detection applications, the time series data to be detected can be input into the corresponding anomaly detection model. Since the anomaly detection models corresponding to the time series data include two types: non-deep learning models and deep learning models, the user can select the type of anomaly detection model; or the type can be automatically selected; or both a non-deep learning model and a deep learning model can be input simultaneously, and the anomaly detection result is determined based on the weights corresponding to the outputs of the two models. This application does not impose any limitations on this.

[0064] In addition, this section first introduces the time-series data used in the embodiments of this specification. This time-series data can be reported by monitoring devices. Time-series data refers to data arranged in chronological order of reporting time, and can be represented by a one-dimensional array. This one-dimensional array can include data from left to right, corresponding to the data arranged in chronological order of reporting time. This time-series data can be viewed as a time series, a sequence of data points arranged in chronological order of occurrence. Each element in the one-dimensional array can be a data point (corresponding to one reported data point). The rightmost (last) data point in the one-dimensional array can be a detection data point; other data points can be historical data points. The interval between data points can be constant, because the reporting interval can be constant, such as 10 seconds, 1 minute, 5 minutes, etc. The time series here can refer to a monitoring-related time series, such as a cloud monitoring time series.

[0065] The anomaly detection in this application targets anomalies in the data points, such as sudden increases or decreases in data points, or fluctuations deviating from normal values. Using the currently reported data as the detection data point constitutes anomaly detection for the currently reported data.

[0066] In the embodiments described in this specification, time-series data may consist of historical data points and detection data points. In one example, it may be as follows: Figure 2 As shown, the one-dimensional array of time-series data is [first historical data point; second historical data point; third historical data point; detection data point]. The detection data point is the detection data point corresponding to 10:00 on August 10, 2018, where 10:00 is the detection time point. The third historical data point can include historical data points within a preset time period k prior to the detection data point: [ , The first set of historical data points can be data points within the previous day (e.g., August 9, 2018) at the same time point during the detection period. Historical data points within a preset time period k before and after: [ , The data points within the range; the first historical data point can include the same time point at the detection time on a certain day last week ( Historical data points within a preset time period k before and after: [ , The data points are defined within the range []. The date of a specific day last week can be 7 days different from the date corresponding to the detected data point, for example, 20180803. Here, k can be 3 hours, and this application does not limit this.

[0067] It should be noted that, Figure 2 This is merely an example. The detection data point can be the currently reported data corresponding to the current time point, or it can be the data point that needs to be detected. This application does not limit this; as long as it is the last data point of the time series data, that last data point is considered the detection data point. Historical data points can include only the third historical data point, or historical data points can include the third historical data point and the first historical data point, or the third historical data point and the second historical data point. Alternatively, historical data points can be selected based on the detection time point corresponding to the detection data point. This application does not limit this, as long as the selected historical data points, combined with the detection data points, can characterize the basic feature information of the time series data.

[0068] In the embodiments of this specification, time-series data may include data of different indicator types. Generally, they can be divided into basic monitoring indicator types and business monitoring indicator types. Basic indicator types refer to monitoring indicators for lower-level services such as basic machines and databases; data of this type includes, for example, CPU utilization, memory utilization, and network bandwidth. Business monitoring indicator types refer to monitoring indicators for higher-level services; data of this type includes, for example, the success rate of interfaces, the success rate of accessing web pages, the buffering rate of live video, and the number of online users of an application. For each piece of time-series data, each moment corresponds to a unique value.

[0069] By using time-series data provided by the cloud monitoring system, anomaly detection can be performed on the time-series data. This allows for timely and accurate detection of the service status corresponding to different data types and can trigger alarms to notify machine maintenance personnel for verification, processing, and repair, thereby ensuring stable service.

[0070] Specifically, Figure 3A flowchart illustrating a training method for an anomaly detection model according to an embodiment of this application is shown. Figure 3 As shown, the method may include:

[0071] S301, Obtain the sample time series dataset, which includes sample time series data and corresponding labels.

[0072] In the embodiments described in this specification, a large amount of time-series data can be acquired, and this large amount of time-series data can be preprocessed, such as cleaning and interpolation, to obtain a sample time-series dataset. A single sample time-series dataset is a one-dimensional array; labels can include normal and abnormal.

[0073] In one example, preprocessing this large amount of time-series data could include:

[0074] Perform data validation on this large amount of time-series data. For example, perform size validation, missing value validation, NAN (Not a Number) value validation, and illegal value validation on the data in the time-series data.

[0075] Perform data cleaning on the time series data. For example, if the time series data contains missing values, interpolation can be used to fill in the missing values; if the time series data contains NaN values, interpolation or averaging can be used to remove the NaN values. If the time series data contains illegal values ​​(such as characters), a detection failure code can be returned directly.

[0076] Standardization can be performed on cleaned time-series data. For example, normalization can be performed on cleaned time-series data so that the data in the time-series data can be uniformly ranged between [0,1].

[0077] S303 extracts basic feature information of each sample from the time series data.

[0078] In one possible implementation, S303 can be implemented in the following way, that is, S303 can include:

[0079] The sample time-series dataset is input into a basic feature extraction model for basic feature extraction processing to obtain the basic feature information of each sample time-series data in the dataset. This basic feature extraction model can be a pre-trained machine learning model. For example, the machine learning model can be an N-sigma model, where the value of N can be set according to actual needs.

[0080] Alternatively, statistical processing or fitting processing can be performed on each sample of time-series data to extract the basic feature information of each sample of time-series data. This application does not limit the specific methods for statistical processing and fitting processing. For example, for statistical processing, statistics can be performed on each sample of time-series data, and the variance obtained from the statistics can be used as fluctuation information; trend information can be extracted based on the upward or downward trend of the detection data points in the half hour before the detection time point; and periodic information of each sample of time-series data can be obtained based on statistical analysis, which may include information on whether there is periodicity and whether there are differences between periods.

[0081] S305, determine the feature type corresponding to the basic feature information of the sample.

[0082] In the embodiments of this specification, the correspondence between basic feature information and feature types can be obtained. Then, by finding the basic feature information that matches the basic feature information of the sample, the feature type corresponding to the basic feature information of the sample can be determined. For example, based on the basic feature information of the sample, Table 1 above can be searched, and the feature type corresponding to the basic feature information of the sample can be determined by matching.

[0083] S307, Based on the feature type corresponding to each sample time series data, the sample time series dataset is divided into sub-sample time series datasets corresponding to the feature type. That is, sample time series data with the same feature type in the sample time series dataset can be divided into the same sub-sample time series dataset, thereby dividing the sample time series dataset into sub-sample time series datasets corresponding to the feature type.

[0084] Alternatively, subsample time series datasets corresponding to feature types can be directly obtained from a large amount of time series data. That is, subsample time series datasets corresponding to each feature type can be obtained one by one from a large amount of time series data.

[0085] S309, Based on the time-series dataset of subsamples corresponding to the feature type, perform machine learning training on the preset machine learning model until the preset conditions are met, and obtain the anomaly detection model corresponding to the feature type.

[0086] In the embodiments of this specification, the feature types may include the five feature types shown in Table 1. Since the anomaly detection models include both non-deep learning models and deep learning models, while stationary types do not require deep learning models, the five feature types can correspond to nine anomaly detection models. Based on the sub-sample time-series datasets corresponding to the feature types, machine learning training can be performed on preset machine learning models until preset conditions are met, thus obtaining the anomaly detection model corresponding to the feature type. These preset conditions may include a preset number of iterations or a preset error threshold, etc.

[0087] Optionally, for decision tree models, S309 may include:

[0088] This involves extracting sample detection feature information from the subsample time-series data within a subsample time-series dataset. This extraction can be based on feature engineering. The sample detection feature information can be used for anomaly detection and classification. As an example, the sample detection feature information may include minimum and maximum values ​​in the subsample time-series data; this application does not limit this to specific values.

[0089] Based on the sample detection feature information of the time-series dataset corresponding to the feature type, a preset decision tree model is trained using machine learning until preset conditions are met, resulting in an anomaly detection model corresponding to the feature type. As an example, the preset decision tree model may include a GBDT model or an XGBoost model. This application does not limit this.

[0090] Figure 4 A flowchart illustrating an anomaly detection method according to an embodiment of this application is shown. Figure 4 As shown, the method may include:

[0091] S401, acquire at least one time series data to be detected.

[0092] In the embodiments of this specification, the time-series data to be detected can refer to time-series data for which anomaly detection is required. For example, the current data point reported by the monitoring device can be obtained, and the current data point combined with selected historical data points can be used as the time-series data to be detected. Based on this method, at least one time-series data to be detected can be obtained.

[0093] S403, extract basic feature information from the at least one time series data to be detected;

[0094] S405, determine the anomaly detection model corresponding to the basic feature information.

[0095] The implementation methods of the above steps S403 and S405 can be found in steps S303 and S305, and will not be repeated here.

[0096] S407, input the at least one time series data to be detected into the corresponding anomaly detection model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected.

[0097] In the embodiments of this specification, an anomaly detection model corresponding to the basic feature information of the data to be detected is used to perform anomaly detection processing on the data to be detected, thereby obtaining the anomaly detection result corresponding to the time series data to be detected, such as normal or abnormal. The anomaly detection model may include the anomaly detection models in Table 1 above.

[0098] S409, obtain the time series data to be detected that is abnormal as the target time series data, and obtain the service type corresponding to the target time series data.

[0099] In the embodiments of this specification, after screening by the anomaly detection model, the time series data to be detected that have anomaly detection results can be selected, and the selected time series data with anomaly detection results can be used as the target time series data.

[0100] Optionally, since the anomaly detection model only targets the time-series data to be detected, meaning the anomaly detection of the time-series data is extracted from the business scenario, the anomaly detection of the time-series data itself and the anomaly detection of the data in the business scenario are separate. This improves the generalization ability of the anomaly detection model, but whether the time-series data to be detected is abnormal is also related to the business type. For example, for the data to be detected for the success rate indicator, anomaly in the business scenario could mean that the detected data points are trending downwards. For the data to be detected for the failure rate indicator, anomaly in the business scenario could mean that the detected data points are trending upwards. Therefore, selecting the business type corresponding to the target time-series data allows for further verification (detection) of the anomaly detection results based on the business type, ensuring the accuracy of the anomaly detection.

[0101] S411, Based on the service type corresponding to the target time series data, verify the target time series data and determine the target anomaly detection result corresponding to the target time series data.

[0102] In the embodiments of this specification, the business type can refer to the indicator type of time series data.

[0103] In one example, an anomaly threshold can be set for each business type. For instance, the anomaly threshold for interface success rate is 30%. If the value is below 30%, it is considered abnormal. If the business type of the target time series data is interface success rate, the value of the detected data point in the target time series data can be checked to see if it is lower than the anomaly threshold for that interface success rate. If so, the target anomaly detection result corresponding to the target time series data can be determined to be abnormal; otherwise, the target anomaly detection result corresponding to the target time series data can be determined to be normal. This application does not limit the anomaly threshold for each business type; it can be set according to actual needs.

[0104] By extracting basic feature information from the time-series data to be detected, inputting the time-series data into the corresponding anomaly detection model for anomaly detection processing, and verifying the target time-series data based on the corresponding business type, the target anomaly detection result is determined. This anomaly detection process eliminates the need for manual setting and maintenance of detection thresholds, reducing labor costs; it also avoids the need for a large number of features, requiring only the extraction of basic feature information, thus avoiding extensive feature engineering work. The anomaly detection process is more streamlined and time-efficient, achieving millisecond-level processing. Furthermore, the anomaly detection model is extracted from the business type, resulting in strong generalization ability. It can detect only the inherent form of the time-series data, making it more versatile and easier to extend. Additionally, by inputting the time-series data to be detected into the corresponding anomaly detection model for anomaly detection processing, parallel processing of anomaly detection can be achieved, further improving the efficiency of anomaly detection and enabling refined anomaly detection.

[0105] Figure 5 This document illustrates a flowchart of a method for verifying target time-series data based on the service type corresponding to the target time-series data, according to an embodiment of this application, to determine the target anomaly detection result corresponding to the target time-series data. Figure 5 As shown, it may include:

[0106] S501, obtain the basic feature information of the target time series data and the preset abnormal information of the business type corresponding to the target time series data.

[0107] In the embodiments of this specification, the specific implementation of "obtaining the basic feature information of the target time series data" in S501 can be found in S303, and will not be repeated here. Alternatively, it can be obtained from S403, in which at least one basic feature information of the time series data to be detected has been extracted, and the time series data to be detected corresponding to the target time series data can be determined, thereby obtaining the basic feature information of the target time series data.

[0108] In the embodiments of this specification, the preset anomaly information can be indicator information corresponding to the business type and capable of characterizing whether the time-series data is abnormal. For example, the preset anomaly information may include anomaly thresholds, anomaly trend information, etc. This application does not limit this and can set it according to actual needs or business experience. The corresponding preset anomaly information can be obtained based on the business type corresponding to the target time-series data and the preset anomaly information corresponding to the business type.

[0109] S503, based on the basic feature information of the target time series data and the preset anomaly information of the business type corresponding to the target time series data, determine the target anomaly detection result corresponding to the target time series data.

[0110] In one example, consider a success rate-related business type. The pre-defined anomaly information for this business type could be a downward trend. This allows verification of whether the trend information in the basic feature information of the target time series data is downward. If it is downward, the target anomaly detection result for the target time series data is determined to be abnormal; if it is upward, the target anomaly detection result for the target time series data is determined to be normal. This allows for further verification of the anomaly detection results based on the business type.

[0111] In the embodiments described in this specification, an anomaly alarm can be triggered when the target anomaly detection result is found to be abnormal. In one possible implementation, see [link to relevant documentation]. Figure 6 , Figure 6 A flowchart illustrating an anomaly detection method according to an embodiment of this application is shown. The method may further include:

[0112] S601, from the target time series data, obtain the target time series data whose target anomaly detection result is abnormal as the abnormal time series data, and obtain the basic feature information corresponding to the abnormal time series data. This step can be referred to in S409 and S403, and will not be repeated here.

[0113] S603, generate alarm information corresponding to the abnormal time series data and time series graph corresponding to the abnormal time series data.

[0114] In the embodiments of this specification, alarm information may include the detection time point corresponding to the detection data point (i.e., the time point when the anomaly occurred). A corresponding time series graph can be generated based on the abnormal time series data, such as... Figure 7 a and Figure 7 As shown in b, the abnormal time series data is presented intuitively in the form of a graph.

[0115] S605, send the alarm information, the time series graph corresponding to the abnormal time series data, and the basic feature information of the abnormal time series data to the terminal.

[0116] In the embodiments described in this specification, alarm information, time series graphs corresponding to abnormal time series data, and basic characteristic information of the abnormal time series data can be sent to the terminal so that the terminal can display this information to the user. This allows the user to not only intuitively understand the abnormal time series data, but also to better understand the cause of the anomaly through the basic characteristic information. This improves the interpretability of anomaly detection.

[0117] In the embodiments described in this specification, when abnormal time-series data is presented to the user, the user can provide feedback, such as... Figure 7In the anomaly detection of the ping unreachable event time-series data shown in b, when sending alarm information, the time series graph corresponding to the abnormal time-series data, and the basic feature information corresponding to the abnormal time-series data to the terminal, it is also possible to send operation information for feedback. This could include operations such as labeling as abnormal, labeling as normal, or providing more feedback, allowing the user to perform corresponding feedback operations. This allows for optimization and improvement of anomaly detection based on feedback operations. Based on this, a feedback mechanism can be added. In one possible implementation, such as... Figure 8 As shown, Figure 8 A flowchart illustrating an anomaly detection method according to an embodiment of this application is shown. The anomaly detection method may further include:

[0118] S801, obtain feedback information on the abnormal time series data.

[0119] In the embodiments described in this specification, such as Figure 7 As shown in b, if the user performs a feedback operation, feedback information regarding the abnormal time-series data can be obtained. This feedback information may include the identifier of the abnormal time-series data, abnormal information, or normal information.

[0120] S803, based on the feedback information, add the abnormal time series data to the sample time series dataset.

[0121] In the embodiments of this specification, the abnormal time-series data corresponding to the anomaly information in the feedback information can be added to the sample time-series dataset. That is, the abnormal time-series data confirmed by user feedback can be added to the sample time-series dataset to enrich it for subsequent optimization of the anomaly detection model. This also saves the annotation process of the sample time-series data, allowing for the acquisition of more sample time-series data. This forms the anomaly detection technology architecture of the embodiments of this specification, such as... Figure 9 As shown, it can include the acquisition of sample time series datasets, the acquisition of time series data to be detected, the selection of anomaly detection models, verification based on business type, alarm triggering, and user feedback.

[0122] Optionally, when obtaining feedback information on anomalous data, the target feature type corresponding to the anomalous time-series data can also be obtained; based on the feedback information, the anomalous time-series data is added to the sample time-series dataset corresponding to the target feature type. In other words, the anomalous time-series data can be directly added to the corresponding subsample time-series dataset.

[0123] In one possible implementation, determining the anomaly detection model corresponding to the basic feature information may include:

[0124] Determine the feature type corresponding to the basic feature information;

[0125] If the feature type is stationary, the anomaly detection model corresponding to the basic feature information is determined to be the Sigma model.

[0126] If the feature type is the first non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a decision tree model.

[0127] If the feature type is the second non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a moving average algorithm model.

[0128] If the feature type is the third non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a multinomial fitting algorithm model and a change point detection algorithm model.

[0129] In the embodiments of this specification, the corresponding anomaly detection model can be determined based on the correspondence between feature types and anomaly detection models in Table 1.

[0130] In one possible implementation, Figure 10 A flowchart illustrating an anomaly detection method according to an embodiment of this application is shown. Figure 10 As shown, when the anomaly detection model is a decision tree model, before inputting the at least one time series data to be detected into the corresponding anomaly detection model for anomaly detection processing to obtain the anomaly detection result corresponding to the at least one time series data to be detected, the method may further include:

[0131] S1001, extract target detection feature information from the at least one time series data to be detected;

[0132] S1003, the step of inputting the at least one time series data to be detected into the corresponding anomaly detection model, performing anomaly detection processing, and obtaining the anomaly detection result corresponding to the at least one time series data to be detected includes: inputting the target detection feature information into the decision tree model, performing anomaly detection processing, and obtaining the anomaly detection result corresponding to the at least one time series data to be detected.

[0133] The implementation methods of steps S1001 and S1003 can be found in the corresponding part of the decision tree model in S309, and will not be repeated here.

[0134] In one possible implementation, extracting basic feature information from the at least one time-series data to be detected may include:

[0135] The at least one time series data to be detected is input into the basic feature extraction model for basic feature extraction processing to obtain the basic feature information of the at least one time series data to be detected.

[0136] or,

[0137] Statistical processing or fitting processing is performed on the at least one time series data to be detected to extract the basic feature information of the at least one time series data to be detected.

[0138] For details on the implementation method here, please refer to step S303, which will not be repeated here.

[0139] Figure 11 A block diagram of an anomaly detection device according to an embodiment of this application is shown. Figure 11 As shown, the device may include:

[0140] The time series data acquisition module 1101 is used to acquire at least one time series data to be detected.

[0141] The basic feature information extraction module 1103 is used to extract basic feature information from the at least one time series data to be detected;

[0142] An anomaly detection model determination module 1105 is used to determine the anomaly detection model corresponding to the basic feature information;

[0143] An anomaly detection result acquisition module 1107 is used to input the at least one time series data to be detected into the corresponding anomaly detection model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected.

[0144] The target time series data and service type acquisition module 1109 is used to acquire the time series data to be detected that has an abnormality detection result as the target time series data and to acquire the service type corresponding to the target time series data.

[0145] The target anomaly detection result determination module 1111 is used to verify the target time series data based on the service type corresponding to the target time series data, and determine the target anomaly detection result corresponding to the target time series data.

[0146] By extracting basic feature information from the time-series data to be detected, inputting the time-series data into the corresponding anomaly detection model for anomaly detection processing, and verifying the target time-series data based on the corresponding business type, the target anomaly detection result is determined. This anomaly detection process eliminates the need for manual setting and maintenance of detection thresholds, reducing labor costs; it also avoids the need for a large number of features, requiring only the extraction of basic feature information, thus avoiding extensive feature engineering work. The anomaly detection process is more streamlined and time-efficient, achieving millisecond-level processing. Furthermore, the anomaly detection model is extracted from the business type, resulting in strong generalization ability. It can detect only the inherent form of the time-series data, making it more versatile and easier to extend. Additionally, by inputting the time-series data to be detected into the corresponding anomaly detection model for anomaly detection processing, parallel processing of anomaly detection can be achieved, further improving the efficiency of anomaly detection and enabling refined anomaly detection.

[0147] In one possible implementation, the target anomaly detection result determination module 1111 may include:

[0148] The basic feature information and preset anomaly information acquisition unit is used to acquire the basic feature information of the target time series data and the preset anomaly information of the business type corresponding to the target time series data.

[0149] The target anomaly detection result determination unit is used to determine the target anomaly detection result corresponding to the target time series data based on the basic feature information of the target time series data and the preset anomaly information corresponding to the target time series data.

[0150] In one possible implementation, the device may further include:

[0151] The module for acquiring basic feature information of abnormal time series data is used to acquire target time series data with abnormal detection results from the target time series data as abnormal time series data and to acquire basic feature information of the abnormal time series data.

[0152] The time series graph generation module is used to generate alarm information corresponding to the abnormal time series data and the time series graph corresponding to the abnormal time series data.

[0153] The alarm sending module is used to send the alarm information, the time series graph corresponding to the abnormal time series data, and the basic feature information of the abnormal time series data to the terminal.

[0154] In one possible implementation, the anomaly detection model determination module 1105 may include:

[0155] A feature type determination unit is used to determine the feature type corresponding to the basic feature information;

[0156] The anomaly detection model determination unit is configured to: if the feature type is stationary, determine the anomaly detection model corresponding to the basic feature information as a sigma model; if the feature type is a first non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a decision tree model; if the feature type is a second non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a moving average algorithm model; and if the feature type is a third non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a multinomial fitting algorithm model and a change point detection algorithm model.

[0157] In one possible implementation, when the anomaly detection model is a decision tree model, the apparatus may further include:

[0158] The target detection feature information extraction module is used to extract target detection feature information from the at least one time-series data to be detected;

[0159] The anomaly detection result acquisition module 1107 can also be used to input the target detection feature information into the decision tree model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected.

[0160] In one possible implementation, the basic feature information extraction module 1103 may include:

[0161] A basic feature information extraction unit is used to input the at least one time-series data to be detected into a basic feature extraction model for basic feature extraction processing to obtain the basic feature information of the at least one time-series data to be detected; or...

[0162] Statistical processing or fitting processing is performed on the at least one time series data to be detected to extract the basic feature information of the at least one time series data to be detected.

[0163] In one possible implementation, the device may further include:

[0164] The sample time series dataset acquisition module is used to acquire the sample time series dataset, which includes sample time series data and corresponding labels.

[0165] The sample basic feature information extraction module is used to extract sample basic feature information from the time series data of each sample;

[0166] The feature type determination module is used to determine the feature type corresponding to the basic feature information of the sample;

[0167] The subsample time series dataset partitioning module is used to partition the sample time series dataset into subsample time series datasets corresponding to the feature types corresponding to each sample time series data.

[0168] The anomaly detection model acquisition module is used to train a preset machine learning model on the time series dataset of subsamples corresponding to the feature type until the preset conditions are met, so as to obtain an anomaly detection model corresponding to the feature type.

[0169] In one possible implementation, the device may further include:

[0170] The feedback information acquisition module is used to acquire feedback information on the abnormal time-series data;

[0171] The sample time series dataset update module is used to add the abnormal time series data to the sample time series dataset based on the feedback information.

[0172] Regarding the apparatus in the above embodiments, the specific manner in which each module and unit performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0173] On the other hand, this application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the anomaly detection methods provided in the various optional implementations described above.

[0174] Figure 12 This is a block diagram illustrating an anomaly detection device 1200 according to an exemplary embodiment. For example, device 1200 may be provided as a server. (Refer to...) Figure 12 The apparatus 1200 includes a processing component 1222, which further includes one or more processors, and memory resources represented by memory 1232 for storing instructions, such as application programs, that can be executed by the processing component 1222. The application programs stored in memory 1232 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1222 is configured to execute instructions to perform the methods described above.

[0175] Device 1200 may also include a power supply component 1226 configured to perform power management of device 1200, a wired or wireless network interface 1250 configured to connect device 1200 to a network, and an input / output (I / O) interface 1258. Device 1200 can operate on an operating system stored in memory 1232, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0176] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1232 including computer program instructions that can be executed by the processing component 1222 of the device 1200 to perform the above-described method.

[0177] This application may be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this application.

[0178] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0179] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0180] The computer program instructions used to perform the operations of this application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), are personalized by utilizing the status information of the computer-readable program instructions. These electronic circuits can execute the computer-readable program instructions to implement various aspects of this application.

[0181] Various aspects of this application are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0182] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0183] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0184] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0185] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. An anomaly detection method, characterized in that, The method includes: Acquire at least one time series data to be detected; Basic feature information is extracted from the at least one time series data to be detected; the basic feature information is used to reflect the distribution information of the time series data to be detected. Determine the anomaly detection model corresponding to the basic feature information; The at least one time series data to be detected is input into the corresponding anomaly detection model for anomaly detection processing, and the anomaly detection result corresponding to the at least one time series data to be detected is obtained. The process involves obtaining the time-series data to be detected that has an abnormality detection result as the target time-series data, and obtaining the service type corresponding to the target time-series data. Acquire the basic feature information of the target time series data and the preset anomaly information of the business type corresponding to the target time series data; Based on the basic feature information of the target time series data and the preset anomaly information of the business type corresponding to the target time series data, the target anomaly detection result corresponding to the target time series data is determined.

2. The method according to claim 1, characterized in that, Also includes: From the target time series data, obtain the target time series data whose target anomaly detection result is abnormal as the abnormal time series data, and obtain the basic feature information of the abnormal time series data; Generate alarm information corresponding to the abnormal time series data and a time series graph corresponding to the abnormal time series data; Send the alarm information, the time series graph corresponding to the abnormal time series data, and the basic feature information of the abnormal time series data to the terminal.

3. The method according to claim 1, characterized in that, The determination of the anomaly detection model corresponding to the basic feature information includes: Determine the feature type corresponding to the basic feature information; If the feature type is stationary, the anomaly detection model corresponding to the basic feature information is determined to be the Sigma model. If the feature type is the first non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a decision tree model. If the feature type is the second non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a moving average algorithm model. If the feature type is the third non-stationary type, the anomaly detection model corresponding to the basic feature information is determined to be a multinomial fitting algorithm model and a change point detection algorithm model.

4. The method according to claim 3, characterized in that, When the anomaly detection model is a decision tree model; before inputting the at least one time series data to be detected into the corresponding anomaly detection model for anomaly detection processing to obtain the anomaly detection result corresponding to the at least one time series data to be detected, the method further includes: Extract target detection feature information from the at least one time-series data to be detected; The step of inputting the at least one time series data to be detected into the corresponding anomaly detection model, performing anomaly detection processing, and obtaining the anomaly detection result corresponding to the at least one time series data to be detected includes: inputting the target detection feature information into a decision tree model, performing anomaly detection processing, and obtaining the anomaly detection result corresponding to the at least one time series data to be detected.

5. The method according to claim 1, characterized in that, The step of extracting basic feature information from the at least one time-series data to be detected includes: The at least one time-series data to be detected is input into a basic feature extraction model for basic feature extraction processing to obtain the basic feature information of the at least one time-series data to be detected; or... Statistical processing or fitting processing is performed on the at least one time series data to be detected to extract the basic feature information of the at least one time series data to be detected.

6. The method according to claim 1, characterized in that, The method further includes: Obtain a sample time series dataset, which includes sample time series data and corresponding labels; Extract basic feature information of each sample from the time series data; Determine the feature type corresponding to the basic feature information of the sample; Based on the feature type corresponding to each sample time series data, the sample time series dataset is divided into sub-sample time series datasets corresponding to the feature type; Based on the time-series dataset of subsamples corresponding to the feature type, a preset machine learning model is trained until the preset conditions are met, thereby obtaining an anomaly detection model corresponding to the feature type.

7. The method according to claim 2, characterized in that, Also includes: Obtain feedback information on the abnormal time-series data; Based on the feedback information, the abnormal time series data is added to the sample time series dataset.

8. An anomaly detection device, characterized in that, include: The time series data acquisition module is used to acquire at least one time series data to be detected; A basic feature information extraction module is used to extract basic feature information from the at least one time series data to be detected; the basic feature information is used to reflect the distribution information of the time series data to be detected. An anomaly detection model determination module is used to determine the anomaly detection model corresponding to the basic feature information; An anomaly detection result acquisition module is used to input the at least one time series data to be detected into the corresponding anomaly detection model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected. The target time series data and business type acquisition module is used to acquire the time series data to be detected that has an abnormality detection result as the target time series data and to acquire the business type corresponding to the target time series data. The target anomaly detection result determination module is used to verify the target time series data based on the service type corresponding to the target time series data, and determine the target anomaly detection result corresponding to the target time series data; The target anomaly detection result determination module includes: The basic feature information and preset anomaly information acquisition unit is used to acquire the basic feature information of the target time series data and the preset anomaly information of the business type corresponding to the target time series data. The target anomaly detection result determination unit is used to determine the target anomaly detection result corresponding to the target time series data based on the basic feature information of the target time series data and the preset anomaly information corresponding to the target time series data.

9. The apparatus according to claim 8, characterized in that, The device further includes: The module for acquiring basic feature information of abnormal time series data is used to acquire target time series data with abnormal detection results from the target time series data as abnormal time series data and to acquire basic feature information of the abnormal time series data. The time series graph generation module is used to generate alarm information corresponding to the abnormal time series data and the time series graph corresponding to the abnormal time series data. The alarm sending module is used to send the alarm information, the time series graph corresponding to the abnormal time series data, and the basic feature information of the abnormal time series data to the terminal.

10. The apparatus according to claim 8, characterized in that, The anomaly detection model determination module includes: A feature type determination unit is used to determine the feature type corresponding to the basic feature information; The anomaly detection model determination unit is configured to: if the feature type is stationary, determine the anomaly detection model corresponding to the basic feature information as a sigma model; if the feature type is a first non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a decision tree model; if the feature type is a second non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a moving average algorithm model; and if the feature type is a third non-stationary type, determine the anomaly detection model corresponding to the basic feature information as a multinomial fitting algorithm model and a change point detection algorithm model.

11. The apparatus according to claim 10, characterized in that, When the anomaly detection model is a decision tree model; the device further includes: The target detection feature information extraction module is used to extract target detection feature information from the at least one time-series data to be detected; The anomaly detection result acquisition module is further configured to input the target detection feature information into the decision tree model, perform anomaly detection processing, and obtain the anomaly detection result corresponding to the at least one time series data to be detected.

12. The apparatus according to claim 8, characterized in that, The basic feature information extraction module includes: The basic feature information extraction unit is used to input the at least one time series data to be detected into the basic feature extraction model for basic feature extraction processing to obtain the basic feature information of the at least one time series data to be detected; or, to perform statistical processing or fitting processing on the at least one time series data to be detected to extract the basic feature information of the at least one time series data to be detected.

13. The apparatus according to claim 8, characterized in that, The device further includes: The sample time series dataset acquisition module is used to acquire the sample time series dataset, which includes sample time series data and corresponding labels. The sample basic feature information extraction module is used to extract sample basic feature information from the time series data of each sample; The feature type determination module is used to determine the feature type corresponding to the basic feature information of the sample; The subsample time series dataset partitioning module is used to partition the sample time series dataset into subsample time series datasets corresponding to the feature types corresponding to each sample time series data. The anomaly detection model acquisition module is used to train a preset machine learning model on the time series dataset of subsamples corresponding to the feature type until the preset conditions are met, so as to obtain an anomaly detection model corresponding to the feature type.

14. The apparatus according to claim 9, characterized in that, The device further includes: The feedback information acquisition module is used to acquire feedback information on the abnormal time-series data; The sample time series dataset update module is used to add the abnormal time series data to the sample time series dataset based on the feedback information.

15. An anomaly detection device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to execute the executable instructions to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1 to 7.

17. A computer program product, characterized in that, Includes computer instructions, which, when executed by a processor, cause the computer to perform the method as described in any one of claims 1 to 7.

Images