A method, device, equipment and medium for analyzing abnormal changes during activity execution

Abstract

The present invention discloses a method, device, medium and equipment for analyzing anomalies during the execution of an activity, including: obtaining anomaly indicator data within the current monitoring period of the activity; obtaining historical activity data, and obtaining a first judgment result based on the historical activity data, anomaly indicator data and a first criterion; obtaining global data within the current monitoring period, and obtaining a second judgment result based on the global data, anomaly indicator data and a second criterion; when it is determined that the anomaly indicator data is abnormal according to the first judgment result and the second judgment result, obtaining the anomaly data and alarm information within the current monitoring period. An anomaly prediction model is constructed based on deep learning of artificial intelligence, and anomaly prediction information for the next monitoring period can also be output. The technical solution of the present invention can be used to analyze anomalies during the execution of an activity to achieve dynamic monitoring and analysis. At the same time, multi-dimensional data indicators, multi-dimensional data comparison and composite prediction models improve the accuracy of anomaly alarms and anomaly predictions.

Description

Technical Field

[0001] The present invention relates to the field of data analysis, and in particular to a method, device, equipment and medium for analyzing abnormalities during the execution of an activity. Background Art

[0002] Currently, campaign summaries primarily focus on post-event summary analysis. This approach isolates the contribution of specific daily data to the campaign and prevents dynamic monitoring of campaign data. Furthermore, current campaign analysis relies on a single, incomplete metric. Page views (PV) and unique visitors (UV) for campaigns significantly deviate from actual user engagement. Furthermore, initially, campaign data can experience a certain degree of decline in user engagement, necessitating a distinction between normal and abnormal data declines.

[0003] With the development of artificial intelligence, deep learning models have been widely applied across industries and are playing a vital role in various scenarios. Using neural networks to predict activity data is susceptible to numerous internal and external factors. Activity data fluctuates widely and has no definite patterns, resulting in a high degree of disorder. The timing of activities also increases the randomness of predictions, leading to significant discrepancies in activity predictions at different time points. This complicates activity data prediction. Summary of the Invention

[0004] In order to solve the problems of the prior art, the present invention provides a method, device, equipment and medium for analyzing abnormalities during the execution of an activity. The technical solution is as follows:

[0005] In a first aspect, the present invention provides a method for analyzing abnormalities during activity execution, the method comprising:

[0006] Get the abnormal indicator data within the current monitoring period of the activity;

[0007] Acquiring historical activity data, and obtaining a first judgment result based on the historical activity data, the abnormal indicator data, and a first criterion, wherein the first judgment result represents abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period;

[0008] Obtaining global data within the current monitoring period, and obtaining a second judgment result based on the global data, the abnormal indicator data, and a second criterion, wherein the second judgment result represents abnormal performance of the abnormal indicator data within the current monitoring period in a global dimension;

[0009] When it is determined that the abnormal indicator data is abnormal according to the first judgment result and the second judgment result, the abnormal data and alarm information in the current monitoring period are obtained.

[0010] In a second aspect, the present invention provides a device for analyzing abnormalities during activity execution, the device comprising:

[0011] The data acquisition module is used to obtain the abnormal indicator data within the current monitoring period of the activity;

[0012] a first judgment module, configured to obtain historical activity data and obtain a first judgment result based on the historical activity data, the abnormal indicator data, and a first judgment criterion, wherein the first judgment result represents the abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period;

[0013] a second judgment module, configured to obtain global data within the current monitoring period, and obtain a second judgment result based on the global data, the abnormal indicator data, and the second judgment criterion, wherein the second judgment result represents the abnormal performance of the abnormal indicator data within the current monitoring period in a global dimension;

[0014] The abnormality analysis module is used to obtain abnormality data and alarm information in the current monitoring period when determining that the abnormality indicator data is abnormal based on the first judgment result and the second judgment result.

[0015] In a third aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by a processor to implement a method for analyzing anomalies during the execution of an activity as described in the first aspect.

[0016] In a fourth aspect, the present invention provides a computer device comprising a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded by the processor and executed by a method for analyzing anomalies during the execution of an activity as described in the first aspect.

[0017] The present invention provides a method, device, equipment, and storage medium for analyzing abnormalities during activity execution, which have the following technical effects:

[0018] (1) Compared with the summary analysis of activities after the end of the activities, the technical solution provided by the present invention realizes the dynamic monitoring and analysis of abnormal data during the execution of the activities. After the end of a monitoring cycle of the activity, the abnormal data analysis of the current monitoring cycle and the abnormal data prediction of the next monitoring cycle are carried out, making the abnormal data analysis more timely and convenient for the business layer to adjust the activity strategy in time according to the abnormal data analysis;

[0019] (2) The technical solution provided by the present invention designs monitoring data indicators in multiple dimensions based on the characteristics of the activity, and conducts cross-refined comparisons of the monitoring data in multiple dimensions, which can more comprehensively reflect whether the data has changed. Specifically, by discovering changes based on the comparison of the activity's own dimensions, and combining the changes in the historical activity dimensions and the global dimensions to further determine whether the data in the current monitoring period is abnormal, the inaccuracy caused by a single alarm is avoided, and the abnormal data is more interpretable;

[0020] (3) The technical solution provided by the present invention utilizes a prediction model that combines a time series analysis method with a BP neural network in the prediction of abnormal data. It can better adapt to active data, process linear and nonlinear data sequences in various complex environments, and achieve better prediction accuracy. In particular, it can feedback data abnormalities in some extreme cases.

[0021] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 This is a schematic diagram of an implementation environment of a method for analyzing abnormalities during activity execution provided by an embodiment of the present application;

[0024] Figure 2 This is a flow chart of a method for analyzing abnormalities during activity execution provided by an embodiment of the present invention;

[0025] Figure 3 This is a flow chart of obtaining abnormal indicator data within the current monitoring period of an activity provided by an embodiment of the present invention;

[0026] Figure 4 This is a flow chart of obtaining a first judgment result based on historical activity data provided by an embodiment of the present invention;

[0027] Figure 5 This is a flowchart of a specific indicator data change analysis provided by an embodiment of the present invention;

[0028] Figure 6 This is a flow chart of obtaining a second judgment result based on global data provided by an embodiment of the present invention;

[0029] Figure 7 This is a flow chart of predicting abnormal data for the next monitoring period provided by an embodiment of the present invention;

[0030] FIG8 (1) is a schematic diagram of a prediction process of an ARIMA model provided by an embodiment of the present invention;

[0031] FIG8 (2) is a topological structure diagram of a BP neural network model provided by an embodiment of the present invention;

[0032] Figure 9 This is a structural diagram of an anomaly prediction model provided by an embodiment of the present invention;

[0033] Figure 10 This is a prediction effect diagram of the anomaly prediction model provided by an embodiment of the present invention;

[0034] Figure 11 This is a schematic diagram of a device for analyzing abnormalities during activity execution provided by an embodiment of the present invention;

[0035] Figure 12 The present invention provides a hardware structure block diagram of a server that runs a method for analyzing abnormalities during the execution of an activity according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Examples of the embodiments are shown in the accompanying drawings, in which the same or similar numbers throughout represent the same or similar elements or elements with the same or similar functions.

[0037] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] In order to make the purpose, technical solutions and advantages disclosed in the embodiments of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present invention and are not intended to limit the embodiments of the present invention.

[0039] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this embodiment, unless otherwise specified, "multiple" means two or more. In order to facilitate understanding of the technical solutions described in the embodiments of the present invention and the technical effects produced therefrom, the embodiments of the present invention first explain the relevant professional terms:

[0040] Artificial Intelligence (AI) studies the design principles and implementation methods of various intelligent machines, enabling them to perceive, reason, and make decisions. AI technology encompasses both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0041] Deep Learning (DL) is a new research direction in the field of machine learning (ML). It was introduced to bring ML closer to its original goal: artificial intelligence. Deep learning studies the inherent patterns and representational hierarchies of sample data. The information gained from this learning process is highly helpful in interpreting data such as text, images, and sound. Its ultimate goal is to enable machines to acquire human-like analytical learning capabilities and recognize data such as text, images, and sound.

[0042] ARIMA model: Autoregressive Integrated Moving Average model, also known as the Autoregressive Integrated Moving Average model (moving can also be called sliding), is a time series forecasting and analysis method. In ARIMA(p, d, q), AR stands for "autoregressive," p is the number of autoregressive terms; MA stands for "moving average," q is the number of moving average terms, and d is the number of differencing operations performed to make the series stationary.

[0043] BP Neural Network: Back Propagation Neural Network, is a multi-layer feedforward neural network trained according to the error back propagation algorithm. It is the most widely used neural network.

[0044] MSE: Mean Square Error.

[0045] PV: Page View, page views or clicks. Each time a user visits a web page on a website, 1 PV is recorded. Multiple visits to the same page by a user are accumulated to measure the number of web pages visited by website users.

[0046] UV: Unique Visitor, refers to a natural person who accesses and browses this webpage through the Internet. A computer client that accesses the website is a visitor.

[0047] DAU (Daily Active User) is a metric commonly used to measure the performance of websites, internet applications, or online games. DAU typically counts the number of users who log in or use a product within a single day (the day the statistics are collected), similar to the concept of daily active users (UV) in traffic statistics tools.

[0048] See also Figure 1 , which shows a schematic diagram of the implementation environment of a method for analyzing abnormalities during the execution of an activity provided by an embodiment of the present application, such as Figure 1 As shown, the implementation environment may include at least a client 01 and a server 02 .

[0049] Specifically, the client 01 may include devices such as smart phones, desktop computers, tablet computers, laptops, digital assistants, smart wearable devices, monitoring devices, and voice interaction devices. It may also include software running in the device, such as web pages provided by some service providers to users, or applications provided by these service providers to users. Specifically, the client 01 can be used to display various data indicators, as well as display abnormal data and alarm information sent by the server 02. Specifically, the server 02 may include an independently running server, or a distributed server, or a server cluster composed of multiple servers. The server 02 may include a network communication unit, a processor, a memory, and the like. Specifically, the server 02 can be used to perform abnormal analysis on various indicator data, and to use an abnormal prediction model to predict abnormalities for the next monitoring period.

[0050] Figure 2 This is a flowchart of a method for analyzing changes during activity execution provided by an embodiment of the present invention. Figure 2The embodiment of this specification provides a method for analyzing abnormalities during the execution of an activity, including the following steps:

[0051] S101: Obtain abnormal indicator data within the current monitoring period of the activity.

[0052] In an embodiment of the present specification, the activity data stream is collected and analyzed according to a preset monitoring cycle. For example, the monitoring cycle is set on a daily basis. Compared to summarizing and analyzing activity data after the end of an activity, the embodiment of the present specification aims to implement daily dynamic monitoring and analysis of activity monitoring data during the execution of the activity, identify any data changes, and feed back the change information to the business layer so that the business layer can effectively and timely adjust the activity strategy based on the changes. For example, in the early stages of many Internet mobile applications, the number of participants is prone to a sharp drop. If the problem can be discovered in time, the strategy can be adjusted in time by increasing promotion channels, adding high-probability props, etc. to ensure the effectiveness of the activity.

[0053] In the embodiments of this specification, combined with the characteristics of the activities, it is possible to design indicators for monitoring changes in multiple dimensions of data, which can more comprehensively reflect whether the data has changed. Analyzing only the PV or UV of a page cannot reflect the actual situation of user participation, let alone the changes in specific indicators of activities within the application. Specifically, as shown in Table 1, the indicators for changes in multiple dimensions may include but are not limited to the difference in the number of activity participants in the previous two days in the dimension of an activity itself, the continuous decline ratio of the number of activity participants, and other indicators, the number of participants and the number of viewers in the dimension of the activity collection, and the active user-related indicators and payment-related indicators in the dimension of the market. It should be noted that the data in the market dimension covers the entire application, including activity data and inactivity data. For example, in a game application, in addition to activity operation data, there is also daily operation data.

[0054] Table 1 Abnormal indicators in multiple dimensions

[0055]

[0056]

[0057] In a specific embodiment, the anomaly can be found by performing a month-on-month analysis on the data of various anomaly indicators in the current monitoring period. Figure 3 As shown, obtaining abnormal indicator data within the current monitoring period of the activity may include the following steps:

[0058] S201: Acquire monitoring data of the activity in the previous monitoring cycle and monitoring data in the current monitoring cycle.

[0059] S203: performing a comparison analysis on the monitoring data in the current monitoring period and the monitoring data in the previous monitoring period according to a plurality of preset data indicators to obtain comparison results of the plurality of data indicators.

[0060] In a feasible implementation, the monitoring data in the current monitoring cycle and the previous monitoring cycle can be analyzed on a month-on-month basis according to the various indicators described in Table 1 to obtain month-on-month results for each indicator, which can comprehensively reflect changes in activity data.

[0061] S205: Determine abnormal indicator data within the current monitoring period according to the month-on-month comparison results of the multiple data indicators and abnormality criteria corresponding to the multiple data indicators.

[0062] In one feasible implementation, the abnormality criteria corresponding to the multiple data indicators may be a data drop threshold, a data drop ratio threshold, etc. When the month-on-month result of a data indicator meets its corresponding abnormality criteria, the data indicator is used as an abnormality indicator, and the corresponding data is used as abnormality indicator data.

[0063] S103: Acquire historical activity data, and obtain a first judgment result based on the historical activity data, the abnormal indicator data, and a first criterion, wherein the first judgment result represents the abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period.

[0064] In the embodiment of this specification, the historical activity data can be used to further determine whether the obtained abnormal indicator data is abnormal, thereby improving the accuracy of abnormal analysis. It should be noted that historical activities are a set of activities that are highly similar or highly matched to the current activities.

[0065] In the embodiments of this specification, specifically, Figure 4 As shown, obtaining the first judgment result according to the historical activity data, the abnormal indicator data and the first criterion may include the following steps:

[0066] S301: According to the abnormal indicator corresponding to the abnormal indicator data, obtain historical data corresponding to the abnormal indicator in the historical activity data.

[0067] It is understandable that historical activities that are highly similar or highly matched to current activities have certain similarities or regularities in the changes in indicator data.

[0068] In one possible implementation, Figure 5As shown in the figure, a month-over-month analysis of the number of participants and successful recipients of an event revealed an anomaly, initiating a detailed analysis of the anomaly data across different dimensions. In the historical activity dimension, data for the indicators requiring analysis for this type of activity was pulled, specifically the historical data on the ratio of participants to successful recipients.

[0069] S303: Compare the abnormal indicator data with the historical data to obtain a first dimension comparison result.

[0070] In the embodiment of this specification, specifically, obtaining the first dimension comparison result may include the following steps:

[0071] S401: Calculating an abnormality threshold of the abnormality indicator according to a preset formula and the historical data, and comparing the abnormality indicator data with the abnormality threshold to obtain a comparison result of the first dimension.

[0072] In another possible embodiment, Figure 5 As shown in the figure, when the threshold for the decrease in the number of participants / successful recipients does not exceed the decrease threshold calculated from historical data, it can be further compared with the decrease in the number of active users in the broader market during the same period. When analyzing the changes in the historical activity dimension in detail, the broader market dimension of the same period is introduced, and the intersection of dimensions improves the accuracy of the analysis.

[0073] S403: Generate a data distribution graph in a preset format based on the historical data, and compare the abnormal indicator data with the historical data using the data distribution graph to obtain a comparison result of the first dimension.

[0074] In one possible implementation, Figure 5 As shown, a box plot is made by combining the contemporaneous data in the historical activity set to reflect the characteristic distribution of the historical data. The first dimension comparison result is obtained according to the position of the abnormal indicator data in the box plot.

[0075] S305: Determine whether the abnormal indicator data is abnormal based on the first dimension comparison result and the first criterion, and obtain a first judgment result.

[0076] Specifically, if the abnormal indicator data exceeds the abnormal threshold of the abnormal indicator, it is directly determined that the historical activity dimension of the abnormal indicator data is abnormal; if the abnormal indicator data does not exceed the abnormal threshold of the abnormal indicator, but the quartiles and interquartile range of the box plot show that the abnormal indicator data is an abnormal value, it is determined that the abnormal indicator data is abnormal in the historical activity dimension.

[0077] S105: Acquire global data in the current monitoring period, and obtain a second judgment result based on the global data, the abnormal indicator data, and a second criterion, wherein the second judgment result represents the abnormal performance of the abnormal indicator data in the current monitoring period in a global dimension.

[0078] In the embodiments of this specification, global data can be used to further determine whether the obtained abnormal indicator data is abnormal, thereby improving the accuracy of abnormal analysis. It is understood that the global data can be global data for all currently running activities, or it can be global data covering the entire application. For example, for gaming applications, the game market data includes daily operation data in addition to activity operation data.

[0079] In the embodiments of this specification, specifically, Figure 6 As shown, obtaining the second judgment result according to the global data, the abnormal index data and the second criterion may include the following steps:

[0080] S501: Determine, based on the abnormal indicator corresponding to the abnormal indicator data, a global target indicator that satisfies a preset correlation with the abnormal indicator.

[0081] In one possible implementation, Figure 5 As shown, for the abnormal indicator of the number of people participating in the activity / successfully receiving the rewards, the combined global data indicators include the average user payment value per person in the market data and the number of active users in the market data during the current monitoring period of the activity. The reason for selecting these two types of data indicators is mainly because when analyzing a large amount of activity effect data and the intersection of market data, it was found that these two indicators and the indicator of the number of people participating in the activity / successfully receiving the rewards were highly correlated. Therefore, combining these two market data indicators and the derived indicators (such as their own decline ratio, etc.) with the abnormal indicator of the number of people participating in the activity / receiving the rewards can provide more comprehensive and explanatory information on the abnormal data.

[0082] S503: Obtain global target data corresponding to the global target indicator in the global data.

[0083] S505: Compare the abnormal indicator data with the global target data to obtain a second dimension comparison result.

[0084] In one possible implementation, Figure 5As shown in the figure, a month-over-month analysis of the number of participants / successful recipients of an event revealed an abnormal decline in the indicator data, triggering a detailed analysis of the abnormal data across different dimensions. At the global data level, data for global indicators highly correlated with the number of participants / successful recipients was pulled. Specifically, the average user spending value within the broader data showed an upward trend, as did the number of active users within the broader data. This trend was inversely proportional to the abnormal indicator number of participants / successful recipients.

[0085] S507: Determine whether the abnormal indicator data is abnormal based on the second dimension comparison result and the second criterion, and obtain a second judgment result.

[0086] In one possible implementation, Figure 5 As shown, after comparison, the changing trends of the average user payment value and the number of active users in the market data are opposite to the changing trends of the abnormal indicator activity participants / successful recipients, and it is determined that in the global data dimension, the performance of the abnormal indicator data is abnormal.

[0087] S107: When it is determined that the abnormal indicator data is abnormal according to the first judgment result and the second judgment result, the abnormal data and alarm information in the current monitoring period are obtained.

[0088] It is understandable that in order to ensure the accuracy of the alarm, the abnormal indicator data is compared in multiple dimensions, and abnormal problems are discovered by combining anomalies, avoiding the inaccuracy caused by a single alarm; secondly, the indicator anomalies are more interpretable. For example, it may not be possible to tell whether the decline in the number of visitors to an activity is a normal change. However, if the number of active users and the paying ratio of the market increase during the same period, it can be effectively inferred that the effect of the activity at this time may not be ideal. The reason may be that there are fewer delivery channels or the channel promotion effect is not good. The business layer can thus receive feedback in a timely manner and take corresponding actions to solve the problem.

[0089] In the embodiment of this specification, the monitoring and analysis of abnormal data during the execution of the activity can not only analyze the abnormal data of the current monitoring cycle, but also make predictions about the abnormal data of the next monitoring cycle. Figure 7 As shown, the method further includes:

[0090] S701: Obtain an anomaly prediction model, and determine whether the anomaly data in the current monitoring period is fitted according to the anomaly prediction model.

[0091] Understandably, the prediction results involving activity data have not been ideal. Data changes are related to a large number of internal and external factors, such as player preferences and the timing of activity pushes. Among these, the prediction effect of data is most significantly affected by the timing, which greatly increases the randomness of the prediction, resulting in significant differences in activity data predictions at different time points. In some extreme conditions, there is no inherent pattern to follow, making it difficult to determine whether it is a linear or nonlinear system, which greatly increases the difficulty of activity data prediction. Therefore, the prediction of activity data requires a model that can not only predict the linear change trend of the data but also reflect certain nonlinear change trends. Traditional mathematical statistics methods, such as linear regression models, can extract linear features, and neural networks have effective nonlinear mapping capabilities.

[0092] In the embodiments of this specification, in order to solve the above problems, based on deep learning in the field of artificial intelligence, the ARIMA model and the BP neural network are combined as an anomaly prediction model. Specifically, before obtaining the anomaly prediction model, the following steps may be included:

[0093] S7011: The time series prediction analysis model and the back propagation neural network are combined into the anomaly prediction model.

[0094] Specifically, the ARIMA model, also known as the autoregressive integrated moving average model, is a mathematical statistical model that can transform the original data sequence into a stable data sequence, and then perform linear regression on the lag value and current value calculated by the algorithm. Its prediction flow chart is shown in Figure 8 (1). First, if the data sequence is non-stationary and has a certain growth or decline trend, it is necessary to perform differential processing on the data so that the autocorrelation function value and partial correlation function value of the final processed data are not significantly different from zero. Then, according to the identification rules of the time series model, the corresponding model is established. If the partial correlation function of the stationary sequence is truncated and the autocorrelation function is trailing, then the sequence is suitable for the AR (Autoregressive, autoregressive) model; if the partial correlation function of the stationary sequence is trailing and the autocorrelation function is truncated, then the sequence is suitable for the MA (Moving Average, moving average) model; if the partial correlation function and autocorrelation function of the stationary sequence are both trailing, then the sequence is suitable for the ARMA model. Secondly, perform parameter estimation to test whether it is statistically significant. Conduct hypothesis testing on the model to check whether the residual sequence is white noise. Finally, after testing and optimization, use the model for forecasting analysis.

[0095] Specifically, the topological structure of the BP neural network model is shown in Figure 8 (2). The BP neural network consists of an input layer (m = 1), a hidden layer (m = 2), and an output layer (m = 3). The hidden layer can have multiple layers, and Figure 8 is just an example. During forward propagation, the input sample is passed from the input layer, processed by each hidden layer layer by layer, and then passed to the output layer. If the actual output of the output layer does not match the expected output, the error is transferred to the back propagation stage; during back propagation, the output is propagated back to the input layer layer by layer through the hidden layer in some form, and the error is apportioned to all units in each layer, thereby obtaining the error signal of each layer unit. This error signal is used as the basis for correcting the weights of each unit.

[0096] In the embodiment of this specification, the ARIMA model and the BP neural network are combined to form the abnormality prediction model. The structure of the abnormality prediction model is as follows: Figure 9 As shown in the figure, the use of ARIMA model and BP neural network to predict the changing trend of activity data, especially in the short term, has certain practical reference significance, can better adapt to activity data, can handle linear and nonlinear data sequences in various complex environments, and achieve better prediction accuracy. In particular, it can feedback the abnormal changes of data in some extreme cases to ensure the stability of the system.

[0097] S7013: Acquire historical activity data, and train the time series prediction analysis model based on the historical activity data.

[0098] In a feasible implementation, taking the number of activity participants as an example, the data of the number of activity participants is divided into 500 time data nodes, the first 400 data are used as training data, and the last 100 data are used as test data for model training. First, the ARIMA model is serialized and predicted for the first 400 data to obtain the model ARIMA (2, 2, 4), where the first 2 represents the number of autoregressive terms, the second 2 represents the number of differences made to make it a stationary sequence, and the last 4 represents the number of sliding average terms.

[0099] S7015: Obtain prediction data obtained by the time series prediction analysis model based on the historical activity data.

[0100] S7017: Obtain residual data based on the historical activity data and the predicted data, and use the residual data as training data to train the back propagation neural network.

[0101] In a feasible implementation, the above 400 residual data are input into the BP neural network as training data and the parameters are saved. The prediction effect diagram obtained by testing 100 test data is as follows: Figure 10As shown in the figure, the model can basically fit the changing curve of the actual value. In practice, after three rounds of iteration, the MSE of the model has stabilized and settled at a relatively small value, indicating that the model has a good prediction effect.

[0102] In order to objectively reflect the prediction effect of the ARIMA model and the BP neural network composite model, we can compare the results by calculating the root mean square error (RMSE) and mean absolute percent error (MAPE) of the three models. The comparison of the two indicators between the single model and the composite model is shown in Table 2:

[0103] Table 2 Performance comparison of different models

[0104] Prediction Model RMSE MAPE (%) Single ARIMA 0.6232 6.37 Single BP neural network 0.5918 6.15 Composite Model 0.1201 1.33

[0105] Comparison of the three models above shows that the RMSE and MAPE values ​​predicted by the composite model are significantly lower than those of the other two single prediction models. Therefore, the composite model's prediction accuracy is, to a certain extent, higher than that of the single ARIMA model and BP neural network model, and the composite model's prediction error is significantly reduced. This comparison shows that the composite model utilizes the advantages of the ARIMA model's linear trend prediction and the BP neural network's nonlinear trend prediction, combining the advantages of both models and, to a certain extent, overcoming the shortcomings of both models. It can reflect the changing patterns of activity data, and therefore, this composite model is a relatively accurate activity data prediction method.

[0106] In one embodiment of the present specification, specifically, judging whether the abnormal data in the current monitoring period is fitted according to the abnormal prediction model may be: processing the abnormal data to obtain an abnormal difference; and judging whether it is fitted according to the second-order residual of the abnormal difference.

[0107] S703: If the result is a good match, output the abnormality prediction data and warning information for the next monitoring period according to the abnormality prediction model and the abnormality data in the current monitoring period.

[0108] In one possible implementation, Figure 9 As shown in the figure, the linear prediction value is obtained by the ARIMA model, and the nonlinear prediction value is obtained by the BP neural network prediction model. The superposition of the two is the prediction value of the composite model for the abnormal data of the next monitoring period, which is output together with the abnormal data and alarm information of the current monitoring period.

[0109] The technical solution provided in the embodiments of this specification utilizes a prediction model that is a composite of a time series analysis method and a BP neural network in the prediction of abnormal data. It can better adapt to activity data, can handle linear and nonlinear data sequences in various complex environments, achieve better prediction accuracy, and especially can feedback data abnormalities in some extreme cases.

[0110] The embodiment of the present invention also provides a device for analyzing abnormalities during the execution of an activity. Figure 11 As shown, the device may include:

[0111] The data acquisition module 1110 is used to obtain abnormal indicator data within the current monitoring period of the activity;

[0112] A first judgment module 1120 is configured to obtain historical activity data and obtain a first judgment result based on the historical activity data, the abnormal indicator data, and a first judgment criterion, wherein the first judgment result represents the abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period;

[0113] A second judgment module 1130 is configured to obtain global data within the current monitoring period, and obtain a second judgment result based on the global data, the abnormal indicator data, and the second judgment criterion, wherein the second judgment result represents the abnormal performance of the abnormal indicator data within the current monitoring period in a global dimension;

[0114] The abnormality analysis module 1140 is configured to obtain abnormality data and alarm information within the current monitoring period when determining that the abnormality indicator data is abnormal based on the first judgment result and the second judgment result.

[0115] In one embodiment, the device module may further include:

[0116] The abnormality prediction module 1150 is configured to output abnormality prediction data and alarm information for the next monitoring period based on the abnormality prediction model and the abnormality data in the current monitoring period.

[0117] Specifically, the apparatus for analyzing abnormalities during activity execution disclosed in the embodiment of the present invention and the corresponding method embodiment described above are based on the same inventive concept. For details, please refer to the method embodiment and will not be repeated here.

[0118] An embodiment of the present invention provides a computer device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement a method for analyzing anomalies during activity execution as provided in the above-mentioned method embodiment.

[0119] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, application programs required for the functions, etc.; the data storage area can store data created based on the use of the device, etc. In addition, the memory can include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory can also include a memory controller to provide the processor with access to the memory.

[0120] The method embodiments provided in the embodiments of the present invention can be executed in mobile terminals, computer terminals, servers or similar computing devices, that is, the above-mentioned computer devices may include mobile terminals, computer terminals, servers or similar computing devices. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected through wired or wireless communication, and this application does not limit this. Taking running on the server as an example, Figure 12 This is a hardware structure diagram of a server running a method for analyzing abnormalities during an activity execution process provided by an embodiment of the present invention. Figure 12As shown, the server 1200 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 1210 (the processor 1210 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 1230 for storing data, and one or more storage media 1220 (such as one or more mass storage devices) for storing application programs 1223 or data 1222. Among them, the memory 1230 and the storage medium 1220 can be temporary storage or permanent storage. The program stored in the storage medium 1220 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1210 can be configured to communicate with the storage medium 1220 to execute a series of instruction operations in the storage medium 1220 on the server 1200. The server 1200 may also include one or more power supplies 1260, one or more wired or wireless network interfaces 1250, one or more input and output interfaces 1240, and / or one or more operating systems 1221, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0121] It can be understood by those skilled in the art that Figure 12 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 12 More or fewer components than shown, or with Figure 12 Different configurations shown.

[0122] An embodiment of the present invention also provides a computer-readable storage medium, which can be set in a server to store at least one instruction or at least one program related to the method for analyzing changes during the execution of an activity in the method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method for analyzing changes during the execution of an activity provided in the above method embodiment.

[0123] Optionally, in this embodiment, the storage medium may be located in at least one of a plurality of network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0124] From the above embodiments of the method, device, equipment and medium for analyzing abnormalities during the execution of an activity provided by the present invention, it can be seen that:

[0125] (1) Compared with the summary analysis of activities after the end of the activities, the technical solution provided by the present invention realizes the dynamic monitoring and analysis of abnormal data during the execution of the activities. After the end of a monitoring cycle of the activity, the abnormal data analysis of the current monitoring cycle and the abnormal data prediction of the next monitoring cycle are carried out, making the abnormal data analysis more timely and convenient for the business layer to adjust the activity strategy in time according to the abnormal data analysis;

[0126] (2) The technical solution provided by the present invention designs monitoring data indicators in multiple dimensions based on the characteristics of the activity, and conducts cross-refined comparisons of the monitoring data in multiple dimensions, which can more comprehensively reflect whether the data has changed. Specifically, by discovering changes based on the comparison of the activity's own dimensions, and combining the changes in the historical activity dimensions and the global dimensions to further determine whether the data in the current monitoring period is abnormal, the inaccuracy caused by a single alarm is avoided, and the abnormal data is more interpretable;

[0127] (3) The technical solution provided by the present invention utilizes a prediction model that combines a time series analysis method with a BP neural network in the prediction of abnormal data. It can better adapt to active data, process linear and nonlinear data sequences in various complex environments, and achieve better prediction accuracy. In particular, it can feedback data abnormalities in some extreme cases.

[0128] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not represent the superiority or inferiority of the embodiments. The above description is of specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0129] The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from the other embodiments. In particular, the device, equipment, and storage medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simplified. For relevant portions, refer to the descriptions of the method embodiments.

[0130] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0131] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for analyzing changes during activity execution, characterized in that: The method comprises: Get the abnormal indicator data within the current monitoring period of the activity; Acquire historical activity data, and acquire historical data corresponding to the abnormal indicator in the historical activity data according to the abnormal indicator corresponding to the abnormal indicator data; Comparing the abnormal indicator data with the historical data to obtain a first dimension comparison result; Determining whether the abnormal indicator data is abnormal based on the comparison result of the first dimension and the first criterion, thereby obtaining a first determination result; the first determination result represents the abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period; Acquire the global data in the current monitoring period, and determine, based on the abnormal indicator corresponding to the abnormal indicator data, a global target indicator that satisfies a preset correlation with the abnormal indicator; Obtaining global target data corresponding to the global target indicator in the global data; Comparing the abnormal indicator data with the global target data to obtain a second dimension comparison result; Based on the comparison result of the second dimension and the second criterion, determining whether the abnormal indicator data is abnormal, and obtaining a second judgment result; the second judgment result represents the abnormal performance of the abnormal indicator data in the current monitoring period in the global dimension; When it is determined that the abnormal indicator data is abnormal according to the first judgment result and the second judgment result, the abnormal data and alarm information in the current monitoring period are obtained.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining an anomaly prediction model, and determining whether the anomaly data within the current monitoring period is fitted according to the anomaly prediction model; If there is a fit, the abnormality prediction data and alarm information for the next monitoring period are output according to the abnormality prediction model and the abnormality data in the current monitoring period.

3. The method according to any one of claims 1 to 2, characterized in that The acquisition of abnormal indicator data within the current monitoring period of the activity includes: Obtain monitoring data from the previous monitoring cycle and the current monitoring cycle of the activity; According to a plurality of preset data indicators, performing a comparative analysis on the monitoring data in the current monitoring period and the monitoring data in the previous monitoring period to obtain comparative results of the plurality of data indicators; The abnormal indicator data within the current monitoring period is determined according to the month-on-month comparison results of the multiple data indicators and the abnormality judgment criteria corresponding to the multiple data indicators.

4. The method according to claim 1, wherein The comparing the abnormal indicator data with the historical data to obtain a first dimension comparison result includes: Calculating an abnormality threshold of the abnormality indicator according to a preset formula and the historical data, and comparing the abnormality indicator data with the abnormality threshold to obtain a comparison result of the first dimension; And / or, a data distribution graph in a preset format is generated based on the historical data, and the abnormal indicator data is compared with the historical data using the data distribution graph to obtain the first dimension comparison result.

5. The method according to claim 2, characterized in that The acquisition of the abnormal change prediction model includes: The time series forecast analysis model and the back propagation neural network are combined into the said abnormal movement prediction model; Acquiring historical activity data, and training the time series prediction analysis model based on the historical activity data; Obtaining forecast data obtained by the time series forecast analysis model based on the historical activity data; Residual data is obtained according to the historical activity data and the predicted data, and the back propagation neural network is trained using the residual data as training data.

6. A device for analyzing abnormalities during the execution of an activity, characterized in that: The device comprises: The data acquisition module is used to obtain the abnormal indicator data within the current monitoring period of the activity; A first judgment module is configured to obtain historical activity data, and based on the abnormal indicator corresponding to the abnormal indicator data, obtain historical data corresponding to the abnormal indicator in the historical activity data; compare the abnormal indicator data with the historical data to obtain a first dimension comparison result; and determine whether the abnormal indicator data is abnormal based on the first dimension comparison result and a first judgment criterion to obtain a first judgment result; the first judgment result represents the abnormal performance of the abnormal indicator data in the historical activity dimension within the current monitoring period; A second judgment module is configured to obtain global data within the current monitoring period, determine a global target indicator that satisfies a preset correlation with the abnormal indicator based on the abnormal indicator corresponding to the abnormal indicator data; obtain global target data corresponding to the global target indicator in the global data; compare the abnormal indicator data with the global target data to obtain a comparison result in a second dimension; and determine whether the abnormal indicator data is abnormal based on the comparison result in the second dimension and a second judgment criterion to obtain a second judgment result; the second judgment result represents the abnormal performance of the abnormal indicator data in the current monitoring period in the global dimension; The abnormality analysis module is used to obtain abnormality data and alarm information in the current monitoring period when determining that the abnormality indicator data is abnormal based on the first judgment result and the second judgment result.

7. The device according to claim 6, characterized in that The device further comprises: The anomaly prediction module is used to obtain an anomaly prediction model and determine whether the anomaly data in the current monitoring period is fitted according to the anomaly prediction model; if it is fitted, the anomaly prediction data and alarm information for the next monitoring period are output according to the anomaly prediction model and the anomaly data in the current monitoring period.

8. The device according to any one of claims 6 or 7, characterized in that The data acquisition module is used to obtain the monitoring data within the previous monitoring cycle of the activity and the monitoring data within the current monitoring cycle; based on a plurality of preset data indicators, the monitoring data within the current monitoring cycle and the monitoring data within the previous monitoring cycle are subjected to a year-on-year analysis to obtain year-on-year results of the plurality of data indicators; based on the year-on-year results of the plurality of data indicators and the abnormality criteria corresponding to the plurality of data indicators, the abnormal indicator data within the current monitoring cycle is determined.

9. The device according to claim 6, characterized in that The first judgment module is used to calculate the abnormality threshold of the abnormality indicator according to a preset formula and the historical data, compare the abnormality indicator data with the abnormality threshold, and obtain the first dimension comparison result; and / or generate a data distribution graph in a preset format according to the historical data, and use the data distribution graph to compare the abnormality indicator data with the historical data to obtain the first dimension comparison result.

10. The device according to claim 7, characterized in that The abnormal movement prediction module is used to: The time series forecast analysis model and the back propagation neural network are combined into the said abnormal movement prediction model; Acquiring historical activity data, and training the time series prediction analysis model based on the historical activity data; Obtaining forecast data obtained by the time series forecast analysis model based on the historical activity data; Residual data is obtained according to the historical activity data and the predicted data, and the back propagation neural network is trained using the residual data as training data.

11. A computer storage medium, characterized in that The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for analyzing anomalies during the execution of an activity as described in any one of claims 1 to 5.

12. A computer device, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded by the processor and executed by the method for analyzing anomalies during the execution of an activity as described in any one of claims 1 to 5.

Images