Business anomaly detection method, device and medium based on directional deviation

Abstract

The present invention provides a business anomaly detection method, device and medium, which comprises: a business baseline generation step, based on the historical business data of a specific business feature, generating a business baseline of business data changing over time; an actual business data statistics step, counting the curve of the actual business data of the specific business feature changing over time; a tolerance determination step, judging whether the actual business data meets the tolerance range of the business baseline according to a tolerance algorithm; a directional deviation calculation step, respectively calculating the baseline vector of the baseline data at adjacent data points and the corresponding actual business data vector of the actual business data, and comparing the baseline vector with the actual business data vector to obtain the directional deviation; and a business anomaly determination step, comprehensively analyzing the directional deviations of all adjacent data points in a plurality of continuous data points to determine whether a business anomaly occurs.

Description

Technical Field

[0001] The present invention relates to the field of network service anomaly detection, and in particular to a method, device and medium for detecting service anomalies by using a service learning baseline in a network according to a calculated vector direction deviation. Background Art

[0002] So far, there have been many studies on anomaly detection based on traffic baselines, which mainly use certain characteristics of network traffic, such as bandwidth bps, packet rate pps, message length or the value of some other characteristic field, to statistically analyze the characteristic vector to form a baseline, set a tolerance interval, and then compare the current actual traffic characteristics with the baseline value, and calculate the difference between the actual value and the baseline value. If the difference falls within the tolerance interval, it is considered a normal error, otherwise it is considered that the traffic is abnormal. The baseline threshold-based method usually sets the threshold range in percentage or absolute value.

[0003] The method of judging whether the traffic is abnormal based on the threshold range can meet the requirements in most scenarios, but there are also some scenarios where problems cannot be discovered in time. For example, the threshold range of a certain dimension feature baseline is between 10-20, so as long as the detection data falls within this range, it is a normal scenario. In a normal scenario, the detection data should fluctuate around 15. If the data is monitored to be equal to 19 for a long time, it is very likely that there is a business abnormality, but the traditional threshold-based detection and judgment scheme cannot identify such anomalies. However, this abnormality judgment is particularly important for industrial control systems. If data such as temperature or pressure are at a high level or a low level for a long time, it is very likely to cause damage to the industrial system and cause serious consequences.

[0004] In combination with the above scenarios and taking into account the limitations of existing traffic anomaly detection algorithms, this patent adopts a vector direction deviation detection algorithm, which can more accurately identify the changing characteristics of business data and effectively detect such business anomalies. Summary of the invention

[0005] Business anomaly detection is a technical problem faced by all network business systems. The most commonly used algorithm for business anomaly detection is to establish various traffic baselines, then set tolerances or threshold ranges, and determine whether the business is abnormal by checking whether the actual business data meets the baseline range requirements.

[0006] In industrial control systems, some business data curves must not only meet the tolerance or threshold requirements, but also meet the requirements of the direction of change. If the monitoring data is within the tolerance range but remains at a high level for a long time (as mentioned above, it is equal to 19 for a long time), it is very likely that an abnormal situation has occurred and an alarm needs to be issued for maintenance in time.

[0007] In view of this situation, the present invention is made. The business anomaly detection method, device and medium based on directional deviation of the present invention mainly detect business anomalies by comparing the change direction of the business baseline and the actual curve of the same period. Compared with the traditional anomaly detection algorithm, the business anomaly detection method, device and medium of the present invention introduce the concept of vector direction deviation on the basis of baseline tolerance or threshold, calculate the directional deviation of real-time data and baseline data, and thus focus on the detection of the curve fluctuation direction, and can timely check the correct direction of the business data deviation from the baseline, so as to more accurately identify the change characteristics of the business data and discover some more hidden business anomalies. Moreover, the business anomaly detection method, device and medium of the present invention are simple in calculation, consume very little CPU, and are easy to implement in engineering.

[0008] According to a first aspect of the present invention, a service anomaly detection method is provided, the method comprising:

[0009] A business baseline generation step, based on the historical business data of specific business characteristics, generates a business baseline (Base_t, Base_v) of business data changing over time, where Base_t represents time and Base_v represents baseline data;

[0010] an actual business data statistics step, which is to calculate a curve (Real_t, Real_v) of the actual business data of the specific business feature changing over time, wherein Real_t represents time and Real_v represents actual business data;

[0011] Tolerance determination step, judging whether the actual business data Real_v at time Real_t meets the tolerance range of the business baseline (Base_t, Base_v) according to the tolerance algorithm;

[0012] a directional deviation calculation step, respectively calculating a baseline vector Base_d of the baseline data at adjacent data points and an actual business data vector Real_d of the corresponding actual business data, and comparing the baseline vector Base_d with the actual business data vector Real_d to obtain the directional deviation d; and

[0013] The business anomaly determination step integrates the directional deviations d of all adjacent data points in a plurality of continuous data points to determine whether a business anomaly occurs.

[0014] Furthermore, the time intervals of Base_t and Real_t are the same, and the periods of the baseline data and the actual business data are the same.

[0015] Furthermore, in the direction deviation calculation step, two adjacent baseline data are defined as (Base_t1, Base_v1), (Base_t2, Base_v2), where:

[0016] When Base_v2-Base_v1>0, Base_d=1;

[0017] When Base_v2-Base_v1=0, Base_d=0;

[0018] When Base_v2-Base_v1<0, Base_d=-1; and wherein,

[0019] The corresponding two adjacent actual business data are defined as (Real_t1, Real_v1), (Real_t2, Real_v2), where:

[0020] When Real_v2-Real_v1>0, Real_d=1;

[0021] When Real_v2-Real_v1=0, Real_d=0;

[0022] When Real_v2-Real_v1<0, Real_d=-1.

[0023] Furthermore, the direction deviation d between the baseline vector Base_d of the baseline data and the actual business data vector Real_d is d=Real_d-Base_d, wherein,

[0024] When d=0, it indicates that the direction deviation of the actual business data is consistent with that of the baseline data;

[0025] When d=2 or d=-2, it indicates that the direction deviation between the actual business data and the baseline data is the largest, and the vector directions are opposite.

[0026] Further, in the service anomaly determination step, the total directional deviation D is calculated by accumulating the directional deviations d of all adjacent data points in the plurality of data points, and

[0027] When the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

[0028] Furthermore, the direction deviation threshold range is determined according to the number of the multiple data points.

[0029] Furthermore, in the tolerance determination step, if the actual business data Real_v exceeds the tolerance range, the business data is directly determined to be abnormal.

[0030] Furthermore, in the business baseline generation step, the specific business feature is used as the detection object, and based on the historical business data of the specific business feature, a business baseline model is established according to business cycle learning to form a curve of the business baseline (Base_t, Base_v) related to time.

[0031] According to a second aspect of the present invention, a service anomaly detection device is provided, the device comprising:

[0032] A business baseline generation module, which is used to generate a business baseline (Base_t, Base_v) of business data changing over time based on historical business data of specific business characteristics, where Base_t represents time and Base_v represents baseline data;

[0033] An actual business data statistics module, which is used to calculate a curve (Real_t, Real_v) of the actual business data of the specific business feature changing over time, wherein Real_t represents time and Real_v represents actual business data;

[0034] A tolerance determination module, which is used to determine whether the actual business data Real_v at the time point Real_t meets the tolerance range of the business baseline (Base_t, Base_v) according to a tolerance algorithm;

[0035] a directional deviation calculation module, the directional deviation calculation module being used to respectively calculate a baseline vector Base_d of the baseline data at adjacent data points and an actual business data vector Real_d of the corresponding actual business data, and compare the baseline vector Base_d with the actual business data vector Real_d to obtain the directional deviation d; and

[0036] A business anomaly determination module is used to comprehensively determine the direction deviations d of all adjacent data points in a plurality of continuous data points to determine whether a business anomaly occurs.

[0037] Furthermore, the time intervals of Base_t and Real_t are the same, and the periods of the baseline data and the actual business data are the same.

[0038] Furthermore, the direction deviation calculation module sets the two adjacent baseline data as (Base_t1, Base_v1), (Base_t2, Base_v2), where:

[0039] When Base_v2-Base_v1>0, Base_d=1;

[0040] When Base_v2-Base_v1=0, Base_d=0;

[0041] When Base_v2-Base_v1<0, Base_d=-1; and wherein,

[0042] The direction deviation calculation module sets the corresponding two adjacent actual business data to (Real_t1, Real_v1), (Real_t2, Real_v2), where:

[0043] When Real_v2-Real_v1>0, Real_d=1;

[0044] When Real_v2-Real_v1=0, Real_d=0;

[0045] When Real_v2-Real_v1<0, Real_d=-1.

[0046] Furthermore, the direction deviation d between the baseline vector Base_d of the baseline data and the actual business data vector Real_d is d=Real_d-Base_d, wherein,

[0047] When d=0, it indicates that the direction deviation of the actual business data is consistent with that of the baseline data; and

[0048] When d=2 or d=-2, it indicates that the direction deviation between the actual business data and the baseline data is the largest and is completely opposite.

[0049] Further, the business anomaly determination module calculates a total directional deviation D by accumulating the directional deviations d of all the data points in the plurality of data points, and

[0050] When the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

[0051] According to a third aspect of the present invention, a service anomaly detection device is provided, the device comprising a storage unit storing a program and a processing unit, wherein:

[0052] The processing unit executes the program to implement each step in the method described in the first aspect.

[0053] According to a fourth aspect of the present invention, a computer readable medium is provided, wherein:

[0054] The medium stores a program, which is executed to implement each step of the method according to the first aspect.

[0055] The technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings and preferred embodiments of the present invention, and the beneficial effects of the present invention will be further clarified. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The drawings described herein are used to provide further understanding of the present invention and constitute a part of the present invention, but their description is only used to explain the present invention and does not constitute an improper limitation to the present invention.

[0057] Figure 1 is a schematic diagram showing various steps of a method for detecting a business anomaly based on directional deviation according to a preferred embodiment of the present invention;

[0058] Figure 2 is a schematic diagram showing the configuration of a service anomaly detection device based on direction deviation according to a preferred embodiment of the present invention;

[0059] Figure 3 A specific example of a curve showing actual business data and business baseline changes over time over a period of time;

[0060] Figure 4 another specific example of a graph showing actual business data and a business baseline over time for another time period; and

[0061] Figure 5 It is a diagram showing a schematic configuration of a computer system of a service anomaly detection device based on directional deviation according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0062] The technical solution of the present invention will be described clearly and completely below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the preferred embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Combine the following Figure 1 The detailed steps of the business anomaly detection method based on directional deviation according to the present invention are described.

[0064] Figure 1 is a schematic diagram showing the various steps of a method for detecting a business anomaly based on directional deviation according to a preferred embodiment of the present invention, such as Figure 1As shown, the business anomaly detection method based on directional deviation according to the present invention includes a business baseline generation step S1, an actual business data statistics step S2, a tolerance determination step S3, a directional deviation calculation step S4 and a business anomaly determination step S5.

[0065] The following will combine Figure 1 The various steps of the above-mentioned business anomaly detection method based on directional deviation are described in detail.

[0066] S1: Business baseline generation steps

[0067] Based on the historical business data of specific business characteristics, a business baseline (Base_t, Base_v) of the business data changing over time is generated.

[0068] Specifically, a certain business feature is used as the detection object, and based on the historical business data of the business feature, a business baseline model is established according to the business cycle learning to form a curve of the business baseline related to time. The business baseline generally represents a 2-dimensional vector, and each baseline value can be represented by (Base_t, Base_v), Base_t represents time, and Base_v represents baseline business data. An actual business baseline can be graphically represented as a curve, where the time Base_t is generally an arithmetic progression, that is, the time intervals are the same.

[0069] Business characteristics can be network traffic Kbps, packet rate pps, CPU, memory, temperature, rotation speed, voltage, air pressure, etc.

[0070] S2: Actual business data statistics steps

[0071] The curve (Real_t, Real_v) of the actual business data of the specific business feature changing over time is counted.

[0072] Specifically, the actual business data changes over time in real time, and each actual business data can be represented by (Real_t, Real_v), where Real_t represents time and Real_v represents actual business data. The actual business data changes over time can be graphically represented as a curve, wherein the time Real_t is generally an arithmetic progression, that is, the time intervals are the same, and preferably, the time intervals of the time Base_t and the time Real_t are the same, and the periods (unit time length, that is, a single period) of the baseline data and the actual business data are the same.

[0073] S3: Tolerance determination step

[0074] According to the tolerance algorithm, it is determined whether the actual business data Real_v at the time point Real_t meets the tolerance range of the business baseline (Base_t, Base_v).

[0075] Specifically, if the actual business data Real_v exceeds the tolerance range, the actual business data is determined to be abnormal, and the abnormal result can be directly reported for processing.

[0076] As an example, the tolerance algorithm according to the present invention may adopt, for example, absolute value deviation or proportional deviation.

[0077] S4: Direction deviation calculation step, performing vector direction deviation detection on the actual business data and the baseline data of the same period, respectively calculating the baseline vector Base_d of the baseline data at adjacent time points and the actual business data vector Real_d of the corresponding actual business data, and comparing the baseline vector Base_d with the actual business data vector Real_d to obtain the direction deviation d.

[0078] The specific steps are as follows:

[0079] First, we take the corresponding two data points in the actual business data and the baseline data as an example. Assume that the two data points in the baseline data are (Base_t1, Base_v1) and (Base_t2, Base_v2), and the corresponding two data points in the actual business data are (Real_t1, Real_v1) and (Real_t2, Real_v2). Moreover, the time difference between the two data is the same, that is, Base_t2-Base_t1=Real_t2-Real_t1.

[0080] Assuming that the baseline vector is Base_d and the actual business data vector is Real_d, the specific calculation method is expressed in pseudo code as follows:

[0081]

[0082] The same algorithm is used to calculate the vector deviation Real_d of the real-time data:

[0083]

[0084] That is, it can be interpreted that when Base_v2-Base_v1>0, Base_d=1; when Base_v2-Base_v1=0, Base_d=0; when Base_v2-Base_v1<0, Base_d=-1.

[0085] When Real_v2-Real_v1>0, Real_d=1; when Real_v2-Real_v1=0, Real_d=0; when Real_v2-Real_v1<0, Real_d=-1.

[0086] Thus, the values ​​of the baseline vector Base_d and the actual business data vector Real_d are obtained through the above calculations. Based on these two vectors, the direction deviation d is calculated, where:

[0087] Direction deviation d=Real_d-Base_d.

[0088] Based on the values ​​of the above baseline vector Base_d and the actual business data vector Real_d, it can be seen that the value range of d is -2≤d≤2.

[0089] According to the description of the above calculation process, we can know that:

[0090] When d = 0, it means that the directional deviation of the actual data is completely consistent with the directional deviation of the baseline data;

[0091] When d=2, it means that the direction deviation of the actual data and the direction deviation of the baseline data are positive and reach the maximum value, which means that the direction of the baseline vector is downward, but the direction of the actual data vector is upward.

[0092] When d=-2, it means that the direction deviation of the actual data and the baseline data is negative and reaches a maximum value, which means that the direction of the baseline vector is upward, but the direction of the actual data vector is downward.

[0093] Therefore, according to the d value, the directional deviation of the vectors of the two data points can be determined.

[0094] S5: Business anomaly determination steps

[0095] The direction deviations d of all adjacent data points in the continuous multiple data points are integrated to determine whether a business anomaly occurs. Specifically, the total direction deviation D is calculated by accumulating the direction deviations d of all adjacent data points in the multiple data points, and when the total direction deviation D exceeds a preset direction deviation threshold range, the actual business data is determined to be abnormal.

[0096] Since actual business data is always allowed to fluctuate around the baseline data, the directional deviation of the above two data points is not enough to determine whether the business is abnormal. In view of this, in order to more accurately determine the abnormality, it is necessary to collect the directional deviations of multiple consecutive data points for comprehensive judgment.

[0097] Assume that we take the data of 10 business points as an example to determine the direction deviation. The 10 business data form 9 line segments in total. The direction deviation d is calculated for each line segment, which are recorded as d1, d2, d3...d9 respectively. The total direction deviation is recorded as D, and D can be expressed as:

[0098]

[0099] It can be seen that the larger the value of D is, the greater the directional deviation between the actual business data vector of the actual business data and the baseline vector of the baseline data is; if the actual data fluctuates around the baseline data, positive and negative numbers will appear in the d value, and the value of the total directional deviation D will be reduced. In fact, if the baseline value is relatively accurate, D approaches 0 when the sampling space is large enough. However, if the sampling is too large, too much historical data will affect the timeliness of abnormal judgment, so it is not suitable to sample too much when making abnormal judgments. Theoretically speaking, the number of samples cannot be greater than the number of data in one business cycle, otherwise the fluctuation may be offset by the cycle, weakening the detection of directional deviation. For example, if the business cycle is 40 points, that is, a new cycle starts after every 40 points, then the sampling should be less than 40. The specific number of samples needs to be determined by referring to the waveform of the business data. Generally, about 10 is more appropriate, and the specific number of samples can be adjusted according to the actual needs of the business.

[0100] After determining the number of samples according to actual business needs, the direction deviation threshold range is determined based on the number of samples, so as to determine whether the total direction deviation exceeds the direction deviation threshold range. Exceeding the threshold range indicates business abnormality.

[0101] The above describes in detail the steps of the service anomaly detection method based on direction deviation according to the present invention. To facilitate understanding, the following will use a specific example to describe how the service anomaly detection method based on direction deviation of the present invention performs service anomaly detection based on direction deviation.

[0102] It should be understood that the following text is only used to describe one or several specific implementations of the present invention, and does not strictly limit the scope of protection specifically requested by the present invention.

[0103] The business data baseline of this embodiment is for the memory usage (specific business characteristics) of a certain business process. To simplify the description, the memory unit is not described. For example, if the memory usage is 20MB, it is recorded as 20. In addition, this embodiment omits the traditional tolerance determination process, that is, step S3 described above. It is assumed that in step S3, the actual business data does not exceed the tolerance range.

[0104] Assume that the values ​​of the baseline data (obtained by step S1) and the actual business data (obtained by step S2) of the business baseline of memory usage within a certain period of time are shown in the following table (Table 1):

[0105] Table 1

[0106]

[0107] See also Figure 3 As shown, it shows the curves corresponding to the actual business data 1 and the business baseline changing over time.

[0108] The Base_d calculated between each adjacent data point is 1, -1, -1, 1, 1, 1, -1, 1, 0 respectively.

[0109] The Real_d1 calculated between each adjacent data point is -1, 1, 1, 1, -1, 1, -1, -1, -1 respectively.

[0110] The calculated direction deviation d1 = Real_d1 - Base_d is -2, 2, 2, 0, -2, 0, 0, -2, -1 respectively.

[0111] The corresponding total directional deviation D1 is the sum of the directional deviations d1 calculated above, that is, D1 = -3.

[0112] Assume that the values ​​of the memory usage baseline data and actual business data for another period of time are as shown in the following table (Table 2):

[0113] Table 2

[0114]

[0115] See also Figure 4 As shown, it shows the curves corresponding to the actual business data 2 and the business baseline changing over time.

[0116] The Base_d calculated between each adjacent data point is 1, -1, -1, 1, 1, 1, -1, 1, 0 respectively.

[0117] The Real_d2 calculated between each adjacent data point is 1, 1, 1, 1, 1, 1, 1, 1.

[0118] The calculated direction deviation d2 = Real_d2 - Base_d is 0, 2, 2, 0, 0, 0, 2, 0, 1 respectively.

[0119] The corresponding total directional deviation D2 is the sum of the directional deviations d2 calculated above, that is, D2=7.

[0120] If the direction deviation threshold range is set to [-6, 6], then according to the above calculation, D1 is within the direction deviation threshold range, while D2 exceeds the direction deviation threshold range, and it is determined that the actual business data 1 is normal, while the actual business data 2 has business anomalies.

[0121] It can be seen that in the actual business data 2, although it meets the tolerance range in step S3, that is, it does not exceed the threshold range of memory occupancy, but because its direction deviation exceeds the direction deviation threshold, there may be business anomalies, which requires attention.

[0122] The above describes in detail the business anomaly detection method based on directional deviation and its specific embodiments of the present invention. According to the business anomaly detection method based on directional deviation of the present invention, the business anomaly is effectively detected by comparing the change direction of the business baseline and the actual curve of the same period. Compared with the traditional anomaly detection algorithm, the business anomaly detection method of the present invention introduces the concept of vector direction deviation on the basis of baseline tolerance or threshold, calculates the directional deviation of real-time data and baseline data, and thus focuses on the detection of the curve fluctuation direction. It can timely check the correct direction of the business data deviation from the baseline, so as to more accurately identify the change characteristics of the business data and discover some more hidden business anomalies. Moreover, the business anomaly detection method of the present invention has a simple calculation method, consumes very little CPU, and is easy to implement in engineering.

[0123] Another aspect of the present invention provides a service anomaly detection device 100 based on direction deviation. Figure 2 As shown, the service anomaly detection device 100 based on directional deviation according to the present invention includes a service baseline generation module 110, an actual service data statistics module 120, a tolerance determination module 130, a directional deviation calculation module 140 and a service anomaly determination module 150.

[0124] The following will combine Figure 2 The various modules of the above-mentioned service anomaly detection device 100 based on direction deviation are described in detail.

[0125] Business baseline generation module 110

[0126] The service baseline generation module 110 is used to generate a service baseline (Base_t, Base_v) of service data changing over time based on historical service data of specific service characteristics.

[0127] Specifically, the service baseline generation module 110 uses the determined service feature as the detection object, and based on the historical service data of the service feature, establishes a service baseline model according to the service cycle learning to form a curve of the service baseline related to time. The service baseline generally represents a 2-dimensional vector, and each baseline value can be represented by (Base_t, Base_v), where Base_t represents time and Base_v represents baseline service data. An actual service baseline can be graphically represented as a curve, where the time Base_t is generally an arithmetic progression, that is, the time interval is the same.

[0128] Business characteristics can be network traffic Kbps, packet rate pps, CPU, memory, temperature, rotation speed, voltage, air pressure, etc.

[0129] Actual business data statistics module 120

[0130] The actual business data statistics module 120 is used to count the change curve (Real_t, Real_v) of the actual business data of the specific business feature over time.

[0131] Specifically, the actual business data statistics module 120 counts the changes of the actual business data over time in real time, and each actual business data can be represented by (Real_t, Real_v), where Real_t represents time and Real_v represents actual business data. The changes of the actual business data over time can be graphically represented as a curve, wherein the time Real_t is generally an arithmetic progression, that is, the time intervals are the same, and preferably, the time intervals of the time Base_t and the time Real_t are the same, and the periods (unit time lengths) of the baseline data and the actual business data are the same.

[0132] Tolerance determination module 130

[0133] The tolerance determination module 130 is used to determine whether the actual business data Real_v at the time point Real_t meets the tolerance range of the business baseline (Base_t, Base_v) according to the tolerance algorithm.

[0134] Specifically, if the actual business data Real_v exceeds the tolerance range, the tolerance determination module 130 determines that the actual business data is abnormal, and the abnormal result can be directly reported for processing.

[0135] As an example, the tolerance algorithm according to the present invention may adopt, for example, absolute value deviation or proportional deviation.

[0136] Direction deviation calculation module 140

[0137] The direction deviation calculation module 140 is used to perform vector direction deviation detection on the actual business data and the baseline data of the same period, calculate the baseline vector Base_d of the baseline data at adjacent time points and the corresponding actual business data vector Real_d of the actual business data, and compare the baseline vector Base_d with the actual business data vector Real_d to obtain the direction deviation d.

[0138] The specific steps are as follows:

[0139] First, we take the corresponding two data points in the actual business data and the baseline data as an example. Assume that the two data points in the baseline data are (Base_t1, Base_v1) and (Base_t2, Base_v2), and the corresponding two data points in the actual business data are (Real_t1, Real_v1) and (Real_t2, Real_v2). Moreover, the time difference between the two data is the same, that is, Base_t2-Base_t1=Real_t2-Real_t1.

[0140] Assuming that the baseline vector is Base_d and the actual service data vector is Real_d, the specific calculation method performed by the direction deviation calculation module 140 is expressed in pseudo code as follows:

[0141]

[0142] Furthermore, the direction deviation calculation module 140 uses the same algorithm to calculate the vector deviation Real_d of the real-time data:

[0143]

[0144] That is, it can be interpreted that when Base_v2-Base_v1>0, Base_d=1; when Base_v2-Base_v1=0, Base_d=0; when Base_v2-Base_v1<0, Base_d=-1.

[0145] When Real_v2-Real_v1>0, Real_d=1; when Real_v2-Real_v1=0, Real_d=0; when Real_v2-Real_v1<0, Real_d=-1.

[0146] Thus, the direction deviation calculation module 140 obtains the values ​​of the baseline vector Base_d and the actual business data vector Real_d through the above calculations, and calculates the direction deviation d based on these two vectors, where:

[0147] Direction deviation d=Real_d-Base_d.

[0148] Based on the values ​​of the above baseline vector Base_d and the actual business data vector Real_d, it can be seen that the value range of d is -2≤d≤2.

[0149] According to the description of the above calculation process, we can know that:

[0150] When d = 0, it means that the directional deviation of the actual data is completely consistent with the directional deviation of the baseline data;

[0151] When d=2, it means that the direction deviation of the actual data and the direction deviation of the baseline data are positive and reach the maximum value, which means that the direction of the baseline vector is downward, but the direction of the actual data vector is upward.

[0152] When d=-2, it means that the direction deviation of the actual data and the baseline data is negative and reaches a maximum value, which means that the direction of the baseline vector is upward, but the direction of the actual data vector is downward.

[0153] Therefore, according to the d value, the directional deviation of the vectors of the two data points can be determined.

[0154] Business abnormality determination module 150

[0155] The business anomaly determination module 150 is used to integrate the directional deviations d of multiple continuous data points to determine whether a business anomaly occurs. Specifically, the business anomaly determination module 150 calculates the total directional deviation D by accumulating the directional deviations d of all adjacent data points in the multiple data points, and when the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

[0156] Since actual business data is always allowed to fluctuate around the baseline data, it is not enough to rely on the directional deviation of the above two data points to determine whether the business is abnormal. In view of this, in order to more accurately determine the abnormality, the business abnormality determination module 150 needs to collect the directional deviations of multiple continuous data points for comprehensive judgment.

[0157] Assume that the business anomaly determination module 150 uses the data of 10 business points as an example to determine the direction deviation. The 10 business data form 9 line segments in total, and the direction deviation d is calculated for each line segment, which are recorded as d1, d2, d3...d9 respectively, and the total direction deviation is recorded as D, then D can be expressed as:

[0158]

[0159] It can be seen that the larger the value of D is, the greater the directional deviation between the actual business data vector of the actual business data and the baseline vector of the baseline data is; if the actual data fluctuates around the baseline data, positive and negative numbers will appear in the d value, and the value of the total directional deviation D will be reduced. In fact, if the baseline value is relatively accurate, D approaches 0 when the sampling space is large enough. However, if the sampling is too large, too much historical data will affect the timeliness of abnormal judgment, so it is not suitable to sample too much when making abnormal judgments. Theoretically speaking, the number of samples cannot be greater than the number of data in one business cycle, otherwise the fluctuation may be offset by the cycle, weakening the detection of directional deviation. For example, if the business cycle is 40 points, that is, a new cycle starts after every 40 points, then the sampling should be less than 40. The specific number of samples needs to be determined by referring to the waveform of the business data. Generally, about 10 is more appropriate, and the specific number of samples can be adjusted according to the actual needs of the business.

[0160] The business anomaly determination module 150 determines the number of samples according to the actual needs of the business, and then determines the direction deviation threshold range according to the number of samples, so as to determine whether the total direction deviation exceeds the direction deviation threshold range. Exceeding the threshold range indicates business anomaly.

[0161] The above describes the business anomaly detection device based on directional deviation according to the present invention. The business anomaly detection device based on directional deviation according to the present invention effectively detects business anomalies mainly by comparing the change direction of the business baseline and the actual curve of the same period. Compared with the traditional anomaly detection algorithm and its device, the business anomaly detection device of the present invention introduces the concept of vector directional deviation on the basis of baseline tolerance or threshold, calculates the directional deviation of real-time data and baseline data, and thus focuses on the detection of the curve fluctuation direction. It can timely check the correct direction of the business data deviation from the baseline, so as to more accurately identify the change characteristics of the business data and discover some more hidden business anomalies. Moreover, the business anomaly detection device of the present invention has a simple calculation method, consumes very little CPU, and is easy to implement in engineering.

[0162] In addition, the embodiments of the present invention also provide a computer system used by a business anomaly detection method and device based on directional deviation, as shown below. Figure 5 , which is a structural diagram of a computer system suitable for implementing a business anomaly detection device based on directional deviation according to an embodiment of the present invention. Figure 5 The above is only an example and shall not limit the functions and scope of use of the embodiments of the present invention.

[0163] like Figure 5As shown, the computer system 300 includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage part 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the system 300 are also stored. The CPU 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0164] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 303 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed, so that a computer program read therefrom is installed into the storage section 308 as needed.

[0165] In particular, according to the embodiments disclosed in the present invention, the steps described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer readable medium, the computer program including a computer program for executing Figure 1 In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above functions defined in the system of the present invention are performed.

[0166] It should be noted that the computer-readable medium shown in the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0167] The flow charts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the methods, devices and computer program products according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of boxes in the block diagram or flow chart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0168] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules and their units may also be arranged in a processor. For example, they may be described as follows: a processor includes a service baseline generation module, an actual service data statistics module, a tolerance determination module, a direction deviation calculation module, and a service anomaly determination module. The names of these modules do not, in some cases, constitute limitations on the modules and their units themselves. For example, the direction deviation calculation module may also be described as a "direction deviation acquisition module."

[0169] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0170] S1: Business baseline generation steps

[0171] Based on the historical business data of specific business characteristics, a business baseline (Base_t, Base_v) of the business data changing over time is generated.

[0172] Specifically, a certain business feature is used as the detection object, and based on the historical business data of the business feature, a business baseline model is established according to the business cycle learning to form a curve of the business baseline related to time. The business baseline generally represents a 2-dimensional vector, and each baseline value can be represented by (Base_t, Base_v), Base_t represents time, and Base_v represents baseline business data. An actual business baseline can be graphically represented as a curve, where the time Base_t is generally an arithmetic progression, that is, the time intervals are the same.

[0173] Business characteristics can be network traffic Kbps, packet rate pps, CPU, memory, temperature, rotation speed, voltage, air pressure, etc.

[0174] S2: Actual business data statistics steps

[0175] The curve (Real_t, Real_v) of the actual business data of the specific business feature changing over time is counted.

[0176] Specifically, the actual business data changes over time in real time, and each actual business data can be represented by (Real_t, Real_v), where Real_t represents time and Real_v represents actual business data. The change of actual business data over time can be graphically represented as a curve, wherein the time Real_t is generally an arithmetic progression, that is, the time interval is the same, and preferably, the time interval of the time Base_t is the same as the time Real_t, and the period (unit time length) of the baseline data and the actual business data is the same.

[0177] S3: Tolerance determination step

[0178] According to the tolerance algorithm, it is determined whether the actual business data Real_v at the time point Real_t meets the tolerance range of the business baseline (Base_t, Base_v).

[0179] Specifically, if the actual business data Real_v exceeds the tolerance range, the actual business data is determined to be abnormal, and the abnormal result can be directly reported for processing.

[0180] As an example, the tolerance algorithm according to the present invention may adopt, for example, absolute value deviation or proportional deviation.

[0181] S4: Direction deviation calculation step, performing vector direction deviation detection on the actual business data and the baseline data of the same period, respectively calculating the baseline vector Base_d of the baseline data at adjacent time points and the corresponding actual business data vector Real_d of the actual business data, and comparing the baseline vector Base_d with the actual business data vector Real_d to obtain the direction deviation d.

[0182] As an example, the tolerance algorithm according to the present invention may adopt, for example, absolute value deviation or proportional deviation.

[0183] The specific steps are as follows:

[0184] First, we take the corresponding two data points in the actual business data and the baseline data as an example. Assume that the two data points in the baseline data are (Base_t1, Base_v1) and (Base_t2, Base_v2), and the corresponding two data points in the actual business data are (Real_t1, Real_v1) and (Real_t2, Real_v2). Moreover, the time difference between the two data is the same, that is, Base_t2-Base_t1=Real_t2-Real_t1.

[0185] Assuming that the baseline vector is Base_d and the actual business data vector is Real_d, the specific calculation method is expressed in pseudo code as follows:

[0186] If(Base_v2-Base_v1>0)Then

[0187] Base_d=1

[0188] Else If(Base_v2-Base_v1==0)Then

[0189] Base_d = 0

[0190] Else

[0191] Base_d = -1;

[0192] The same algorithm is used to calculate the vector deviation Real_d of the real-time data:

[0193] If(Real_v2-Real_v1>0)Then

[0194] Real_d=1

[0195] Else If(Real_v2-Real_v1==0)Then

[0196] Real_d=0

[0197] Else

[0198] Real_d = -1;

[0199] That is, it can be interpreted that when Base_v2-Base_v1>0, Base_d=1; when Base_v2-Base_v1=0, Base_d=0; when Base_v2-Base_v1<0, Base_d=-1.

[0200] When Real_v2-Real_v1>0, Real_d=1; when Real_v2-Real_v1=0, Real_d=0; when Real_v2-Real_v1<0, Real_d=-1.

[0201] Thus, the values ​​of the baseline vector Base_d and the actual business data vector Real_d are obtained through the above calculations. Based on these two vectors, the direction deviation d is calculated, where:

[0202] Direction deviation d=Real_d-Base_d.

[0203] Based on the values ​​of the above baseline vector Base_d and the actual business data vector Real_d, it can be seen that the value range of d is -2≤d≤2.

[0204] According to the description of the above calculation process, we can know that:

[0205] When d = 0, it means that the directional deviation of the actual data is completely consistent with the directional deviation of the baseline data;

[0206] When d=2, it means that the direction deviation of the actual data and the direction deviation of the baseline data are positive and reach the maximum value, which means that the direction of the baseline vector is downward, but the direction of the actual data vector is upward.

[0207] When d=-2, it means that the direction deviation of the actual data and the baseline data is negative and reaches a maximum value, which means that the direction of the baseline vector is upward, but the direction of the actual data vector is downward.

[0208] Therefore, according to the d value, the directional deviation of the vectors of the two data points can be determined.

[0209] S5: Business anomaly determination steps

[0210] The directional deviation d of multiple continuous data points is integrated to determine whether a business anomaly occurs. Specifically, the total directional deviation D is calculated by accumulating the directional deviations d of all adjacent data points in the multiple data points, and when the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

[0211] Since actual business data is always allowed to fluctuate around the baseline data, the directional deviation of the above two data points is not enough to determine whether the business is abnormal. In view of this, in order to more accurately determine the abnormality, it is necessary to collect the directional deviations of multiple consecutive data points for comprehensive judgment.

[0212] Assume that we take the data of 10 business points as an example to determine the direction deviation. The 10 business data form 9 line segments in total. The direction deviation d is calculated for each line segment, which are recorded as d1, d2, d3...d9 respectively. The total direction deviation is recorded as D, and D can be expressed as:

[0213]

[0214] It can be seen that the larger the value of D is, the greater the directional deviation between the actual business data vector of the actual business data and the baseline vector of the baseline data is; if the actual data fluctuates around the baseline data, positive and negative numbers will appear in the d value, and the value of the total directional deviation D will be reduced. In fact, if the baseline value is relatively accurate, D approaches 0 when the sampling space is large enough. However, if the sampling is too large, too much historical data will affect the timeliness of abnormal judgment, so it is not suitable to sample too much when making abnormal judgments. Theoretically speaking, the number of samples cannot be greater than the number of data in one business cycle, otherwise the fluctuation may be offset by the cycle, weakening the detection of directional deviation. For example, if the business cycle is 40 points, that is, a new cycle starts after every 40 points, then the sampling should be less than 40. The specific number of samples needs to be determined by referring to the waveform of the business data. Generally, about 10 is more appropriate, and the specific number of samples can be adjusted according to the actual needs of the business.

[0215] After determining the number of samples according to actual business needs, the direction deviation threshold range is determined based on the number of samples, so as to determine whether the total direction deviation exceeds the direction deviation threshold range. Exceeding the threshold range indicates business abnormality.

[0216] The above describes in detail the various embodiments of the present invention. The business anomaly detection method, device and medium based on directional deviation according to the present invention mainly detect business anomalies by comparing the change direction of the business baseline and the actual curve of the same period. Compared with the traditional anomaly detection algorithm, the business anomaly detection method, device and medium of the present invention introduce the concept of vector direction deviation on the basis of baseline tolerance or threshold, calculate the directional deviation of real-time data and baseline data, thereby focusing on the detection of the curve fluctuation direction, and can timely check the correct direction of the business data deviation from the baseline, so as to more accurately identify the change characteristics of the business data and discover some more hidden business anomalies. Moreover, the business anomaly detection method, device and medium of the present invention are simple in calculation, consume very little CPU, and are easy to implement in engineering.

[0217] The above description is only an embodiment of the present application and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention shall be included in the scope of the claims of the present invention.

Claims

1. A method for detecting business anomalies, characterized in that: The method comprises: A business baseline generation step generates a business baseline (Base_t, Base_v) of business data changing over time based on historical business data of specific business characteristics, where Base_t represents time and Base_v represents baseline data; an actual business data statistics step, which is to calculate a curve (Real_t, Real_v) of the actual business data of the specific business feature changing over time, wherein Real_t represents time and Real_v represents actual business data; Tolerance determination step, judging whether the actual business data Real_v at time Real_t meets the tolerance range of the business baseline (Base_t, Base_v) according to the tolerance algorithm; a directional deviation calculation step, respectively calculating a baseline vector Base_d of the baseline data at adjacent data points and an actual business data vector Real_d of the corresponding actual business data, and comparing the baseline vector Base_d with the actual business data vector Real_d to obtain the directional deviation d; and The business anomaly determination step is to comprehensively determine whether a business anomaly occurs by determining the direction deviation d of all adjacent data points in a plurality of continuous data points. In the direction deviation calculation step, two adjacent baseline data are defined as (Base_t1, Base_v1), (Base_t2, Base_v2), where: When Base_v2 - Base_v1 > 0, Base_d = 1; When Base_v2 - Base_v1 = 0, Base_d = 0; When Base_v2 - Base_v1 < 0, Base_d = -1; and where, The corresponding two adjacent actual business data are defined as (Real_t1, Real_v1), (Real_t2, Real_v2), where: When Real_v2 - Real_v1 > 0, Real_d=1; When Real_v2 - Real_v1 = 0, Real_d = 0; When Real_v2 - Real_v1 < 0, Real_d = -1, The direction deviation d between the baseline vector Base_d of the baseline data and the actual business data vector Real_d=Real_d-Base_d, where, When d=0, it indicates that the actual service data vector is consistent with the baseline vector of the baseline data; When d=2 or d=-2, it means that the direction deviation between the actual business data vector and the baseline vector of the baseline data is the largest, and the vector directions are opposite. In the service anomaly determination step, a total directional deviation D is calculated by accumulating the directional deviations d of all adjacent data points in the plurality of data points, and When the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

2. The method according to claim 1, characterized in that in, The time intervals of Base_t and Real_t are the same, and the periods of the baseline data and the actual business data are the same.

3. The method according to claim 1 or 2, characterized in that: in, The direction deviation threshold range is determined according to the number of the multiple data points.

4. The method according to claim 1 or 2, characterized in that: in, In the tolerance determination step, if the actual business data Real_v exceeds the tolerance range, the business data is directly determined to be abnormal.

5. The method according to claim 1 or 2, characterized in that: in, In the business baseline generation step, the specific business feature is used as a detection object, and based on the historical business data of the specific business feature, a business baseline model is established according to business cycle learning to form a curve of the business baseline (Base_t, Base_v) related to time.

6. A service anomaly detection device, characterized in that: The device comprises: A business baseline generation module, which is used to generate a business baseline (Base_t, Base_v) of business data changing over time based on historical business data of specific business characteristics, where Base_t represents time and Base_v represents baseline data; An actual business data statistics module, which is used to count the change curve of the actual business data of the specific business feature over time (Real_t, Real_v), where Real_t represents time and Real_v represents actual business data; A tolerance determination module, the tolerance determination module is used to determine whether the actual business data Real_v at the time point Real_t meets the tolerance range of the business baseline (Base_t, Base_v) according to a tolerance algorithm; a directional deviation calculation module, the directional deviation calculation module being used to respectively calculate a baseline vector Base_d of the baseline data at adjacent data points and an actual business data vector Real_d of the corresponding actual business data, and compare the baseline vector Base_d with the actual business data vector Real_d to obtain the directional deviation d; and A business anomaly determination module is used to comprehensively consider the direction deviation d of all adjacent data points in a plurality of continuous data points to determine whether a business anomaly occurs, wherein: The direction deviation calculation module sets the two adjacent baseline data as (Base_t1, Base_v1), (Base_t2, Base_v2), where: When Base_v2 - Base_v1 > 0, Base_d = 1; When Base_v2 - Base_v1 = 0, Base_d = 0; When Base_v2 - Base_v1 < 0, Base_d = -1; and where, The direction deviation calculation module sets the corresponding two adjacent actual business data to (Real_t1, Real_v1), (Real_t2, Real_v2), where: When Real_v2 - Real_v1 > 0, Real_d=1; When Real_v2 - Real_v1 = 0, Real_d = 0; When Real_v2 - Real_v1 < 0, Real_d = -1, The direction deviation d between the baseline vector Base_d of the baseline data and the actual business data vector Real_d=Real_d-Base_d, where, When d=0, it indicates that the actual service data vector is consistent with the baseline vector of the baseline data; and When d=2 or d=-2, it means that the direction deviation between the actual business data vector and the baseline vector of the baseline data is the largest, and the vector directions are opposite. The business anomaly determination module calculates a total directional deviation D by accumulating the directional deviations d of all adjacent data points in the plurality of data points, and When the total directional deviation D exceeds a preset directional deviation threshold range, the actual business data is determined to be abnormal.

7. The device according to claim 6, characterized in that in, The time intervals of Base_t and Real_t are the same, and the periods of the baseline data and the actual business data are the same.

8. A service anomaly detection device, characterized in that: The device comprises a storage unit storing a program and a processing unit, wherein: The processing unit executes the program to implement each step in the method according to any one of claims 1 to 5.

9. A computer-readable medium, characterized in that in, The medium stores a program, which is executed to implement each step of the method according to any one of claims 1 to 5.

Images