Data detection method and device

Abstract

The embodiment of the present invention provides a data detection method and device. The embodiment of the present invention uses a detection window to traverse the current data stream with a preset step length to obtain the detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window, and according to the detection results of the target data in multiple detection windows, it is determined whether the target data is abnormal, which can effectively avoid misjudgment caused by data being at the boundary of the detection window, improve the stability of data anomaly detection, and reduce the false alarm rate.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data detection method and device. Background Art

[0002] In industry, it is often necessary to collect data from the detection target regularly through acquisition equipment. However, due to the influence of acquisition equipment factors, environmental factors or human factors, the collected data may contain data with quality problems. This type of data is called abnormal data in this article.

[0003] In order to improve the data quality of the collected data, it is necessary to find abnormal data from the collected data and submit it to manual for further confirmation. If it is manually confirmed as abnormal data, it will be processed according to the preset abnormal data processing strategy; if it is manually confirmed not to be abnormal data, the data will be put back into the data sequence of the collected data. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present invention provides a data detection method and device.

[0005] According to a first aspect of an embodiment of the present invention, there is provided a data detection method, comprising:

[0006] Using a detection window to traverse the current data stream with a preset step length, obtaining detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window;

[0007] Whether the target data is abnormal is determined according to the detection results of the target data in multiple detection windows.

[0008] According to a second aspect of an embodiment of the present invention, there is provided a data detection device, comprising:

[0009] An acquisition module, used to traverse the current data stream using a detection window with a preset step length, and acquire detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window;

[0010] The determination module is used to determine whether the target data is abnormal according to the detection results of the target data in multiple detection windows.

[0011] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0012] In an embodiment of the present invention, a detection window is used to traverse the current data stream with a preset step size to obtain detection results of target data in the current data stream in multiple detection windows; the preset step size is smaller than the width of the detection window, and whether the target data is abnormal is determined based on the detection results of the target data in multiple detection windows, which can effectively avoid misjudgment caused by data being at the boundary of the detection window, improve the stability of data anomaly detection, and reduce the false alarm rate.

[0013] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0015] Figure 1 It is an example flowchart of the data detection method provided by an embodiment of the present invention.

[0016] Figure 2 This is an example diagram of the sliding process of the sliding window.

[0017] Figure 3 It is a functional block diagram of a data detection device provided by an embodiment of the present invention.

[0018] Figure 4 It is a hardware structure diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the appended claims.

[0020] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments of the present invention, and are not intended to limit the embodiments of the present invention. The singular forms of "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0021] It should be understood that although the terms first, second, third, etc. may be used to describe various information in embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0022] The data detection method provided by the present invention is described in detail below through embodiments.

[0023] Figure 1 FIG. 1 is a flowchart of a data detection method provided by an embodiment of the present invention. Figure 1 As shown, the data detection method may include:

[0024] S101, traversing the current data stream with a detection window at a preset step length to obtain detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window.

[0025] S102: Determine whether the target data is abnormal based on detection results of the target data in multiple detection windows.

[0026] In this embodiment, the current data stream is the current data stream of the collected data of the detection target.

[0027] In the application, the acquisition device collects the data of the detection target at a fixed time interval, so the time interval between two adjacent data in the current data stream is equal. The width of the detection window can be equal to an integer multiple of the time interval of the data in the current data stream.

[0028] In this embodiment, the preset step size may be equal to an integer multiple of the time interval of the data in the current data stream. For example, the minimum step size may be equal to one time interval.

[0029] In the application, the preset step value can be determined according to the application requirements. The smaller the preset step, the more times the detection is performed, the higher the accuracy of the detection result, but at the same time, more computing resources are required; the larger the preset step, the fewer times the detection is performed, the fewer computing resources are required, but the accuracy of the detection result will be reduced accordingly.

[0030] In this embodiment, each time the detection window slides one step, the data in the detection window is detected once. As the detection window slides, the position of the data in the detection window will also change. Figure 2 This is an example diagram of the sliding process of the sliding window. Figure 2 As shown, assuming that the step size of the detection window sliding is equal to a time interval, then Figure 2 In Figure (a), the data at time T is at the boundary of the detection window. The detection window slides 2 steps further on the basis of Figure (a) to reach Figure 2 As shown in Figure (b), the data at time T is in the middle of the detection window.

[0031] When testing the data in the detection window, the data in the entire detection window usually reflects the law of the data in the same period. According to the law, it can be detected whether each piece of data in the detection window is normal. When the data is located at the boundary of the detection window, since the previous data or the following data of the data is not in the detection window, the law of the data segment where the data is located cannot be fully reflected in the detection window, so it is easy to make a misjudgment during the detection, resulting in abnormal data. When the data is located in other positions in the detection window except the boundary, since the previous data and the following data of the data are in the detection window, the law of the data segment where the data is located can be fully reflected in the detection window, so the detection accuracy is higher.

[0032] If detection is performed according to a fixed detection window (each piece of data exists in only one detection window), and each piece of data is detected only once, then the data at the boundary of each detection window may be misjudged and result in detection errors, causing actually normal data to be judged as abnormal data.

[0033] In this embodiment, since the step size of the sliding detection window is smaller than the width of the detection window, each piece of data can be detected at least twice. In this way, there is a high probability of obtaining detection results that the data is located at other positions in the detection window except the boundary. Compared with the above-mentioned method of detecting according to a fixed detection window, the detection accuracy can be effectively improved.

[0034] For example Figure 2 In the example, when the step size of the detection window sliding is equal to a time interval, there are 5 detection windows covering the data at time T. In each of the 5 detection windows, the data at time T will be detected once, so the detection results of the data at time T in the 5 detection windows can be obtained.

[0035] In this embodiment, whether the target data is abnormal is not determined based on only one detection result of the target data, but is determined based on multiple detection results of the target data in multiple detection windows. This can effectively avoid misjudgment caused by data being at the boundary of the detection window, improve the stability of data anomaly detection, and reduce the false alarm rate.

[0036] In one example, obtaining detection results of target data in a current data stream in multiple detection windows may include:

[0037] Determining a target detection window, wherein the target detection window covers the target data;

[0038] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window.

[0039] In this embodiment, the detection result of the target data in the detection window is determined based on the data in the same detection window as the target data, and the target data can be detected according to the rules of the data segment where the target data is located to obtain accurate data detection results.

[0040] In this embodiment, the strategy for detecting the target data based on the first data may be determined according to a specific application scenario, and this embodiment does not impose any limitation on this.

[0041] In some cases, a piece of data may be judged as abnormal data because it is too different from the data in the same detection window, but it is not abnormal data based on historical patterns.

[0042] For example, in a company's sales data for a year, the sales data for a certain day shows a surge compared with the data before and after it. However, it may be that the company has a promotion on this day every year. Therefore, this surge in data may seem abnormal in the current data stream of the current period, but it is normal when placed in the historical data of the same period.

[0043] Therefore, in this embodiment, it is also possible to jointly detect whether the target data is abnormal based on the current data stream where the target data is located and the historical data stream of the same period as the target data.

[0044] Based on this, in one example, obtaining the detection results of target data in the current data stream in multiple detection windows may include:

[0045] Determining a target detection window, wherein the target detection window covers the target data;

[0046] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window.

[0047] In this embodiment, after the current data stream and the historical data stream are aligned in time, the detection window can be used to traverse the current data stream and the historical data stream at the same time with a preset step size. The first data and the second data are in the same detection window, and the second data is the historical data of the same period of the first data.

[0048] For example, the current data stream is the actual water supply of a water supply company every day in 2019, and the historical data stream is the actual water supply of the water supply company every day in 2018. Assuming that the detection window width is 30 days and the target data is October 15, 2019, when the detection window covers the period from October 1 to October 30, the first data is from October 1, 2019 to October 30, 2019, and the second data is from October 1, 2018 to October 30, 2018.

[0049] This embodiment jointly determines the detection result of the target data based on the data of the current data stream and the historical data stream of the same period, taking into account the correlation between the current data rules and the historical data rules of the same period, which can further improve the stability of data detection and reduce the misjudgment rate.

[0050] In an example, determining, according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window, a detection result of the target data in the target detection window may include:

[0051] If a detection result of the target data in the target detection window determined according to the first data and a detection result of the target data in the target detection window determined according to the second data both indicate that the target data is abnormal, determining that the detection result of the target data in the target detection window indicates that the target data is abnormal;

[0052] If at least one of the detection result of the target data determined according to the first data in the target detection window and the detection result of the target data determined according to the second data in the target detection window indicates that the target data is normal, it is determined that the detection result of the target data in the target detection window indicates that the target data is normal.

[0053] In this embodiment, when at least one of the detection results based on current data and the detection results based on historical data indicates that the target data is normal, it is determined that the target data is normal, which can improve the stability of data detection and reduce the false alarm rate.

[0054] In order to ensure the reliability of detection, the data in the detection window needs to reach a certain level. When the data is relatively sparse, inaccurate detection may occur due to the amount of data in the detection window not meeting the required level. To address this problem, this embodiment designs the following mechanism for dynamically adjusting the detection window width based on the amount of covered data.

[0055] In one example, using a detection window to traverse the current data stream with a preset step size includes:

[0056] During the traversal process, determining whether the amount of data in the current detection window is greater than or equal to a preset data amount threshold;

[0057] If not, increase the width of the current detection window; if so, keep the width of the current detection window unchanged.

[0058] In this embodiment, when the amount of data in the current detection window is small, the amount of data in the current detection window can be increased by increasing the width of the current detection window, thereby improving detection accuracy.

[0059] In this embodiment, the data volume threshold can be set according to the specific application scenario.

[0060] The increase range of the width of the detection window can be determined according to application requirements.

[0061] In an example, increasing the width of the current detection window may include:

[0062] The width of the current detection window is increased to a first width so that the amount of data in the current detection window is equal to the data amount threshold; the first width is less than or equal to a preset width threshold.

[0063] In this embodiment, the principle of increasing the detection window width is to make the detection window as small as possible while ensuring that the amount of data in the detection window reaches the required level of detection accuracy. This can reduce the amount of detection calculations in each detection window as much as possible and reduce the requirements for computing resources.

[0064] In an example, increasing the width of the current detection window may include:

[0065] If the width of the current detection window increases to a preset width threshold, and the amount of data in the current detection window is still smaller than the data amount threshold, the width of the current detection window is kept equal to the width threshold.

[0066] The detection window width needs to be adjusted within a certain range and cannot be adjusted infinitely. In this embodiment, the detection window width is limited by a width threshold. If the detection window width has been adjusted to the upper limit of the adjustment range (i.e., the width threshold), and the amount of data in the detection window still does not reach the minimum magnitude requirement, the detection window width is no longer increased.

[0067] Furthermore, for data in the detection window whose detection window width is equal to the maximum width threshold but whose data volume is still less than the aforementioned data volume threshold, no data detection is performed and the data can be marked as unknown, so that the data in the unknown state can be detected by other detection methods or abandoned as needed.

[0068] In one example, determining whether the target data is abnormal according to the detection results of the target data in multiple detection windows may include:

[0069] If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data;

[0070] If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

[0071] In this embodiment, as long as one of the detection results of multiple detection windows indicates that the target data is normal, the target data is determined to be normal data, which effectively improves the stability of data detection and reduces the false alarm rate.

[0072] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows further includes:

[0073] Each time the detection window slides one step, the unlabeled data and the data labeled as abnormal in the detection window are detected once;

[0074] The corresponding data are marked according to the detection results of the unmarked data and the data marked as abnormal in the current detection window, and the mark of the data marked as normal in the detection window is kept unchanged.

[0075] For example, the data in the first detection window correspond to the time T1, T2, T3, T4, and T5, and the five data are not marked. In this case, the five data are all tested in the first detection window. After the test, the data at the time T1 and T5 are marked as abnormal, and the data at the time T2, T3, and T4 are marked as normal. The data in the second detection window correspond to the time T2, T3, T4, T5, and T6. In this detection window, the data at the time T2, T3, and T4 are not tested, and only the data at the time T5 (marked as abnormal) and T6 (unmarked) are tested. If the test result of the data at the time T5 is normal in the second detection window, the data at the time T5 is marked as normal, and the data at the time T5 does not need to be tested in the subsequent detection windows.

[0076] In this embodiment, only the unlabeled data and the data labeled as abnormal in the detection window are detected, and the data labeled as normal in the detection window are not detected, which can reduce the amount of calculation and thus save computing resources.

[0077] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows may also include:

[0078] Each time the detection window slides one step, all data in the detection window is detected once, and each piece of data in the detection window is marked according to the detection result.

[0079] In this embodiment, all data within the detection window are detected, so that sufficient detection results can be obtained, so that the final detection result has higher accuracy.

[0080] The data detection method provided by the embodiment of the present invention adopts a detection window to traverse the current data stream with a preset step size to obtain the detection results of the target data in the current data stream in multiple detection windows; the preset step size is smaller than the width of the detection window, and whether the target data is abnormal is determined according to the detection results of the target data in multiple detection windows, which can effectively avoid misjudgment caused by the data being at the boundary of the detection window, improve the stability of data anomaly detection, and reduce the false alarm rate.

[0081] Based on the above method embodiments, the present invention also provides corresponding device, equipment and storage medium embodiments. For detailed implementation of the device, equipment and storage medium embodiments of the present invention, please refer to the corresponding description of the above method embodiment part.

[0082] Figure 3 is a functional block diagram of a data detection device provided by an embodiment of the present invention. Figure 3 As shown, in this embodiment, the device may include:

[0083] An acquisition module 310 is used to traverse the current data stream using a detection window with a preset step length to obtain detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window;

[0084] The determination module 320 is used to determine whether the target data is abnormal according to the detection results of the target data in multiple detection windows.

[0085] In one example, the acquisition module 310 may be specifically configured to:

[0086] Determining a target detection window, wherein the target detection window covers the target data;

[0087] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window.

[0088] In one example, the acquisition module 310 may be specifically configured to:

[0089] Determining a target detection window, wherein the target detection window covers the target data;

[0090] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window.

[0091] In one example, the acquisition module 310 may be specifically configured to:

[0092] During the traversal process, determining whether the amount of data in the current detection window is greater than or equal to a preset data amount threshold;

[0093] If not, increase the width of the current detection window; if so, keep the width of the current detection window unchanged.

[0094] In one example, increasing the width of the current detection window includes:

[0095] The width of the current detection window is increased to a first width so that the amount of data in the current detection window is equal to the data amount threshold; the first width is less than or equal to a preset width threshold.

[0096] In one example, increasing the width of the current detection window includes:

[0097] If the width of the current detection window increases to a preset width threshold, and the amount of data in the current detection window is still smaller than the data amount threshold, the width of the current detection window is kept equal to the width threshold.

[0098] In one example, the determination module 320 may be specifically configured to:

[0099] If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data;

[0100] If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

[0101] In one example, determining a detection result of the target data in the target detection window according to first data in the current data stream and second data in the target detection window in the historical data stream includes:

[0102] If a detection result of the target data in the target detection window determined according to the first data and a detection result of the target data in the target detection window determined according to the second data both indicate that the target data is abnormal, determining that the detection result of the target data in the target detection window indicates that the target data is abnormal;

[0103] If at least one of the detection result of the target data determined according to the first data in the target detection window and the detection result of the target data determined according to the second data in the target detection window indicates that the target data is normal, it is determined that the detection result of the target data in the target detection window indicates that the target data is normal.

[0104] In one example, it also includes:

[0105] A first detection module, configured to detect the unlabeled data and the data labeled as abnormal within the detection window once each time the detection window slides one step;

[0106] The first marking module is used to mark the corresponding data according to the detection results of the unmarked data and the data marked as abnormal in the current detection window, and keep the mark of the data marked as normal in the detection window unchanged.

[0107] In one example, it also includes:

[0108] A second detection module, configured to detect all data in the detection window once each time the detection window slides one step;

[0109] The second marking module is used to mark each piece of data in the detection window according to the detection result.

[0110] An embodiment of the present invention further provides an electronic device. Figure 4 FIG. 1 is a hardware structure diagram of an electronic device provided by an embodiment of the present invention. Figure 4 As shown, the electronic device includes: an internal bus 401, and a memory 402, a processor 403 and an external interface 404 connected via the internal bus.

[0111] The processor 403 is configured to read the machine-readable instructions on the memory 402 and execute the instructions to implement the following operations:

[0112] Using a detection window to traverse the current data stream with a preset step length, obtaining detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window;

[0113] Whether the target data is abnormal is determined according to the detection results of the target data in multiple detection windows.

[0114] In one example, obtaining detection results of target data in a current data stream in multiple detection windows includes:

[0115] Determining a target detection window, wherein the target detection window covers the target data;

[0116] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window.

[0117] In one example, obtaining detection results of target data in a current data stream in multiple detection windows includes:

[0118] Determining a target detection window, wherein the target detection window covers the target data;

[0119] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window.

[0120] In one example, using a detection window to traverse the current data stream with a preset step size includes:

[0121] During the traversal process, determining whether the amount of data in the current detection window is greater than or equal to a preset data amount threshold;

[0122] If not, increase the width of the current detection window; if so, keep the width of the current detection window unchanged.

[0123] In one example, increasing the width of the current detection window includes:

[0124] The width of the current detection window is increased to a first width so that the amount of data in the current detection window is equal to the data amount threshold; the first width is less than or equal to a preset width threshold.

[0125] In one example, increasing the width of the current detection window includes:

[0126] If the width of the current detection window increases to a preset width threshold, and the amount of data in the current detection window is still smaller than the data amount threshold, the width of the current detection window is kept equal to the width threshold.

[0127] In one example, determining whether the target data is abnormal according to detection results of the target data in multiple detection windows includes:

[0128] If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data;

[0129] If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

[0130] In one example, determining a detection result of the target data in the target detection window according to first data in the current data stream and second data in the target detection window in the historical data stream includes:

[0131] If a detection result of the target data in the target detection window determined according to the first data and a detection result of the target data in the target detection window determined according to the second data both indicate that the target data is abnormal, determining that the detection result of the target data in the target detection window indicates that the target data is abnormal;

[0132] If at least one of the detection result of the target data determined according to the first data in the target detection window and the detection result of the target data determined according to the second data in the target detection window indicates that the target data is normal, it is determined that the detection result of the target data in the target detection window indicates that the target data is normal.

[0133] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows further includes:

[0134] Each time the detection window slides one step, the unlabeled data and the data labeled as abnormal in the detection window are detected once;

[0135] The corresponding data are marked according to the detection results of the unmarked data and the data marked as abnormal in the current detection window, and the mark of the data marked as normal in the detection window is kept unchanged.

[0136] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows further includes:

[0137] Each time the detection window slides one step, all data in the detection window is detected once, and each piece of data in the detection window is marked according to the detection result.

[0138] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a plurality of computer instructions, and when the computer instructions are executed, the following processing is performed:

[0139] Using a detection window to traverse the current data stream with a preset step length, obtaining detection results of target data in the current data stream in multiple detection windows; the preset step length is smaller than the width of the detection window;

[0140] Whether the target data is abnormal is determined according to the detection results of the target data in multiple detection windows.

[0141] In one example, obtaining detection results of target data in a current data stream in multiple detection windows includes:

[0142] Determining a target detection window, wherein the target detection window covers the target data;

[0143] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window.

[0144] In one example, obtaining detection results of target data in a current data stream in multiple detection windows includes:

[0145] Determining a target detection window, wherein the target detection window covers the target data;

[0146] A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window.

[0147] In one example, using a detection window to traverse the current data stream with a preset step size includes:

[0148] During the traversal process, determining whether the amount of data in the current detection window is greater than or equal to a preset data amount threshold;

[0149] If not, increase the width of the current detection window; if so, keep the width of the current detection window unchanged.

[0150] In one example, increasing the width of the current detection window includes:

[0151] The width of the current detection window is increased to a first width so that the amount of data in the current detection window is equal to the data amount threshold; the first width is less than or equal to a preset width threshold.

[0152] In one example, increasing the width of the current detection window includes:

[0153] If the width of the current detection window increases to a preset width threshold, and the amount of data in the current detection window is still smaller than the data amount threshold, the width of the current detection window is kept equal to the width threshold.

[0154] In one example, determining whether the target data is abnormal according to detection results of the target data in multiple detection windows includes:

[0155] If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data;

[0156] If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

[0157] In one example, determining a detection result of the target data in the target detection window according to first data in the current data stream and second data in the target detection window in the historical data stream includes:

[0158] If a detection result of the target data in the target detection window determined according to the first data and a detection result of the target data in the target detection window determined according to the second data both indicate that the target data is abnormal, determining that the detection result of the target data in the target detection window indicates that the target data is abnormal;

[0159] If at least one of the detection result of the target data determined according to the first data in the target detection window and the detection result of the target data determined according to the second data in the target detection window indicates that the target data is normal, it is determined that the detection result of the target data in the target detection window indicates that the target data is normal.

[0160] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows further includes:

[0161] Each time the detection window slides one step, the unlabeled data and the data labeled as abnormal in the detection window are detected once;

[0162] The corresponding data are marked according to the detection results of the unmarked data and the data marked as abnormal in the current detection window, and the mark of the data marked as normal in the detection window is kept unchanged.

[0163] In one example, obtaining target data in the current data stream before the detection results of multiple detection windows further includes:

[0164] Each time the detection window slides one step, all data in the detection window is detected once, and each piece of data in the detection window is marked according to the detection result.

[0165] For the device and equipment embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0166] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0167] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention claimed herein. The specification is intended to cover any variations, uses or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0168] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0169] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A data detection method, characterized in that: include: Using a detection window to traverse the current data stream with a preset step size, obtaining detection results of target data in the current data stream in multiple detection windows; The preset step length is smaller than the width of the detection window; Determining whether the target data is abnormal according to the detection results of the target data in multiple detection windows; Wherein, determining whether the target data is abnormal according to the detection results of the target data in multiple detection windows includes: If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data; If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

2. The method according to claim 1, characterized in that Get the detection results of the target data in the current data stream in multiple detection windows, including: Determining a target detection window, wherein the target detection window covers the target data; A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window.

3. The method according to claim 1, characterized in that: Get the detection results of the target data in the current data stream in multiple detection windows, including: Determining a target detection window, wherein the target detection window covers the target data; A detection result of the target data in the target detection window is determined according to first data in the current data stream that is within the target detection window and second data in the historical data stream that is within the target detection window.

4. The method according to claim 1, characterized in that Use the detection window to traverse the current data stream with a preset step size, including: During the traversal process, determining whether the amount of data in the current detection window is greater than or equal to a preset data amount threshold; If not, increase the width of the current detection window; if so, keep the width of the current detection window unchanged.

5. The method according to claim 4, characterized in that Increase the width of the current detection window, including: The width of the current detection window is increased to a first width so that the amount of data in the current detection window is equal to the data amount threshold; the first width is less than or equal to a preset width threshold.

6. The method according to claim 4, characterized in that Increase the width of the current detection window, including: If the width of the current detection window increases to a preset width threshold, and the amount of data in the current detection window is still smaller than the data amount threshold, the width of the current detection window is kept equal to the width threshold.

7. The method according to claim 3, characterized in that Determining a detection result of the target data in the target detection window according to first data in the current data stream and in the target detection window and second data in the historical data stream and in the target detection window, comprising: If a detection result of the target data in the target detection window determined according to the first data and a detection result of the target data in the target detection window determined according to the second data both indicate that the target data is abnormal, determining that the detection result of the target data in the target detection window indicates that the target data is abnormal; If at least one of the detection result of the target data determined according to the first data in the target detection window and the detection result of the target data determined according to the second data in the target detection window indicates that the target data is normal, it is determined that the detection result of the target data in the target detection window indicates that the target data is normal.

8. The method according to claim 1, characterized in that: Obtaining the target data in the current data stream before the detection results of multiple detection windows also includes: Each time the detection window slides one step, the unlabeled data and the data labeled as abnormal in the detection window are detected once; The corresponding data are marked according to the detection results of the unmarked data and the data marked as abnormal in the current detection window, and the mark of the data marked as normal in the detection window is kept unchanged.

9. The method according to claim 1, characterized in that: Obtaining the target data in the current data stream before the detection results of multiple detection windows also includes: Each time the detection window slides one step, all data in the detection window is detected once, and each piece of data in the detection window is marked according to the detection result.

10. A data detection device, characterized in that: include: An acquisition module is used to traverse the current data stream using a detection window with a preset step size to obtain detection results of target data in the current data stream in multiple detection windows; The preset step length is smaller than the width of the detection window; A determination module, configured to determine whether the target data is abnormal according to the detection results of the target data in multiple detection windows; Wherein, determining whether the target data is abnormal according to the detection results of the target data in multiple detection windows includes: If the detection results of the target data in multiple detection windows all indicate that the target data is abnormal, determining that the target data is abnormal data; If at least one detection result of the target data in the detection results of the plurality of detection windows indicates that the target data is normal, it is determined that the target data is normal data.

Images