Method, model training method and apparatus for traffic anomaly detection

Abstract

The application provides a method for flow anomaly detection, which comprises the following steps: obtaining a target time sequence comprising N elements; obtaining a target parameter of the target time sequence according to the target time sequence, wherein the target parameter comprises a cycle factor and / or a jitter density, the cycle factor represents a wave-shaped variation around a long-term trend presented in the target time sequence, and the jitter density represents a deviation between an actual value and a target value of the target time sequence within a target time; determining a first type to which the target time sequence belongs from a plurality of types according to the target parameter, wherein each type in the plurality of types corresponds to a parameter set, and the target parameter belongs to a parameter set corresponding to the first type; and detecting an abnormal situation of the target time sequence according to a first type judgment model corresponding to the first type, wherein each type in the plurality of types corresponds to a type judgment model. Through the above technical solution, the accuracy of flow anomaly detection can be improved.

Description

Technical Field

[0001] This application relates to the field of machine learning, and more specifically, to a method, model training method, and apparatus for detecting traffic anomalies. Background Technology

[0002] In the field of machine learning, anomaly detection refers to the detection of models, data, or events that do not conform to predictions. Anomaly detection is typically performed by professionals who learn from historical data to identify outliers. Data sources include applications, processes, operating systems, devices, or networks. However, with the increasing complexity of computing systems, human intervention is no longer sufficient to handle the current level of anomaly detection.

[0003] In existing technologies, algorithms based on statistics and data distribution are used to detect anomalies in network traffic data. This is based on the assumption that the traffic data follows a normal distribution in a short period of time. However, network traffic data does not follow a normal distribution in a short period of time. Therefore, the accuracy of algorithms based on statistics and data distribution for detecting anomalies in network traffic data is not high. Summary of the Invention

[0004] This application provides a method, model training method, and apparatus for detecting traffic anomalies, which can improve the accuracy of the model in detecting anomalies in network traffic data.

[0005] Firstly, a method for detecting traffic anomalies is provided, comprising: acquiring a target time series, the target time series including N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring target parameters of the target time series based on the target time series, the target parameters including a periodicity factor and / or jitter density, wherein the periodicity factor represents a wave-like variation around a long-term trend in the target time series, and the jitter density represents the deviation between the actual value and the target value of the target time series within a target time period; determining a first type to which the target time series belongs from multiple types based on the target parameters, wherein each of the multiple types corresponds to a parameter set, and the target parameters belong to the parameter set corresponding to the first type; and detecting anomalies in the target time series based on a first-category judgment model corresponding to the first type, wherein each of the multiple types corresponds to a type judgment model, and the judgment model is used for traffic anomaly detection.

[0006] First, based on the obtained target time series, the target parameters of the target time series are determined; second, based on the target parameters, the first type to which the target time series belongs is determined; finally, based on the judgment model of the first type corresponding to the first category, traffic anomaly detection is performed on the target time series, thus improving the accuracy of traffic anomaly detection.

[0007] In conjunction with the first aspect, in one possible implementation, obtaining the target parameters of the target time series based on the target time series includes: decomposing each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determining a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0008] In conjunction with the first aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining whether the target time series has the periodic factor based on the first sub-time series.

[0009] In conjunction with the first aspect, in one possible implementation, determining whether the target time series has the periodic factor based on the first sub-time series includes: determining that the target time series has the periodic factor if N periodic components in the first sub-time series exist; and determining that the target time series does not have the periodic factor if the N periodic components in the first sub-time series do not exist.

[0010] In conjunction with the first aspect, in one possible implementation, the method further includes: determining a second-category determination model corresponding to the first type based on a first mapping relationship and the first type to which the target time series belongs, wherein the first mapping relationship includes the correspondence between the plurality of types and the plurality of second-category determination models; detecting anomalies in the target time series based on the second sub-time series and the second-category determination model corresponding to the first type, wherein the second-category determination model is an N-sigma model.

[0011] In conjunction with the first aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining the jitter density of the target time series based on the second sub-time series.

[0012] In conjunction with the first aspect, in one possible implementation, determining the jitter density of the target time series based on the second sub-time series includes: determining R of the target time series according to the following formula:

[0013]

[0014] Where R is the jitter density, and r n It can be determined using the following formula:

[0015]

[0016] Wherein, the C n x is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0017] The N is determined according to the following formula:

[0018]

[0019] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0020] In conjunction with the first aspect, in one possible implementation, determining the first type to which the target time series belongs from multiple types based on the target parameters includes: determining the first parameter set to which the target parameters belong from the multiple parameter sets based on the target parameters; and determining the first type to which the target time series belongs from multiple types based on a third mapping relationship and the first parameter set, wherein the third mapping relationship includes a correspondence between multiple parameter sets and multiple types.

[0021] The types mentioned above may include: periodic, non-periodic, stable, burr type, periodic stable, periodic burr type, non-periodic stable, or non-periodic burr type.

[0022] The type can be determined based on a periodic factor. Specifically, if the periodic factor exists, the type is periodic; if the periodic factor does not exist, the type is aperiodic.

[0023] The stable and burr types can be determined based on the jitter density. Specifically, when the jitter density is greater than a second preset value, the type is burr type; when the jitter density is less than or equal to the second preset value, the type is stable type.

[0024] Based on the target parameters, the first parameter set to which the target parameters belong is determined from multiple parameter sets. Then, based on the third mapping relationship and the first parameter set, the first type to which the target time series belongs is determined from multiple types. Thus, the type to which the target time series belongs can be obtained, and the classification of the target time series can be completed.

[0025] In conjunction with the first aspect, in one possible implementation, detecting anomalies in the target time series based on the determination model of the first type corresponding to the first category includes: determining a third sub-time series comprising N trend components; dividing the second time series into M sub-sequences of target length, where M is a positive integer, and the second time series is the third sub-time series or the second time series is formed based on the third sub-time series and the linear segmentation algorithm PLR; calculating the matrix profile MP values ​​of the M sub-sequences of target length, wherein the matrix profile MP values ​​of the M sub-sequences of target length constitute the MP time series; and detecting anomalies in the target time series based on the MP time series and the N-sigma algorithm.

[0026] First, the second time series is divided into M subsequences of target length, wherein the second time series is the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR. Second, the matrix contour MP value of the M subsequences of target length is calculated. Finally, based on the MP time series and the N-sigma algorithm, anomalies in the target time series are detected, thereby improving the accuracy of traffic anomaly detection.

[0027] In conjunction with the first aspect, in one possible implementation, the method further includes: determining a determination model for a first category corresponding to the first type based on a second mapping relationship and the first type to which the target time series belongs, wherein the second mapping relationship includes the correspondence between the multiple types and the multiple determination models for the first category.

[0028] Based on the second mapping relationship and the first type to which the target time series belongs, the judgment model of the first category corresponding to the first type is determined. Thus, the corresponding judgment model can be determined for the type to which the target time series belongs, thereby improving the accuracy of traffic anomaly detection.

[0029] Secondly, a method for detecting traffic anomalies is provided, comprising: acquiring a target time series; the target time series includes N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring target parameters of the target time series based on the target time series, the target parameters including a periodicity factor and / or jitter density, wherein the periodicity factor is used to represent a wave-like variation around a long-term trend in the target time series, and the jitter density is used to represent the deviation between the actual value and the target value of the target time series within a target time; determining a first parameter set to which the target parameters belong from multiple parameter sets; and detecting anomalies in the target time series based on a first-type judgment model corresponding to the first parameter set, wherein each parameter set in the multiple parameter sets corresponds to a type of judgment model, and the judgment model is used for traffic anomaly detection.

[0030] First, based on the obtained target time series, the target parameters of the target time series are determined. Second, based on the target parameters, the first parameter set to which the target time series belongs is determined. Finally, based on the first-class judgment model corresponding to the first parameter set, traffic anomaly detection is performed on the target time series. Therefore, the accuracy of traffic anomaly detection can be improved.

[0031] In conjunction with the second aspect, in one possible implementation, obtaining the target parameters of the target time series based on the target time series includes: decomposing each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determining a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0032] In conjunction with the second aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining whether the target time series has the periodic factor based on the first sub-time series.

[0033] In conjunction with the second aspect, in one possible implementation, determining whether the target time series has the periodic factor based on the first sub-time series includes: determining that the target time series has the periodic factor if N periodic components in the first sub-time series exist; and determining that the target time series does not have the periodic factor if the N periodic components in the first sub-time series do not exist.

[0034] In conjunction with the second aspect, in one possible implementation, the method further includes: detecting anomalies in the target time series based on a second-class determination model corresponding to the second sub-time series and the first parameter set, wherein the second-class determination model is an N-sigma model.

[0035] In conjunction with the second aspect, in one possible implementation, the method further includes: determining a second-class judgment model corresponding to the first parameter set based on the fourth mapping relationship and the first parameter set to which the target parameter belongs, wherein the fourth mapping relationship includes the correspondence between the plurality of parameter sets and the plurality of second-class judgment models.

[0036] In conjunction with the second aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining the jitter density of the target time series based on the second sub-time series.

[0037] In conjunction with the second aspect, in one possible implementation, determining the jitter density of the target time series based on the second sub-time series includes: determining the jitter density of the target time series according to the following formula:

[0038]

[0039] Where R is the jitter density, and r n It can be determined using the following formula:

[0040]

[0041] Wherein, the C n x is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0042] The N is determined according to the following formula:

[0043]

[0044] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0045] In conjunction with the second aspect, in one possible implementation, detecting anomalies in the target time series based on the first type of judgment model corresponding to the first parameter set includes: determining a third sub-time series comprising N trend components; dividing the second time series into M sub-sequences of target length, where M is a positive integer, and the second time series is the third sub-time series or the second time series is formed based on the third sub-time series and the linear segmentation algorithm PLR; calculating the matrix profile MP values ​​of the M sub-sequences of target length, the matrix profile MP values ​​of the M sub-sequences of target length forming the MP time series; and detecting anomalies in the target time series based on the MP time series and the N-sigma algorithm.

[0046] First, the second time series is divided into M subsequences of target length, wherein the second time series is the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR; second, the matrix profile MP value of the M subsequences of target length is calculated; finally, based on the MP time series and the N-sigma algorithm, anomalies in the target time series are detected, thereby improving the accuracy of traffic anomaly detection.

[0047] In conjunction with the second aspect, in one possible implementation, the method further includes: determining a first-class determination model corresponding to the first parameter set based on the fifth mapping relationship and the first parameter set to which the target parameter belongs, wherein the fifth mapping relationship includes the correspondence between the plurality of parameter sets and the plurality of first-class determination models.

[0048] Based on the fifth mapping relationship and the first parameter set, the first type of judgment model corresponding to the first parameter set is determined, thereby obtaining the judgment model corresponding to the target time series and improving the accuracy of traffic anomaly detection.

[0049] Thirdly, a method for detecting traffic anomalies is provided. The method includes: acquiring a target time series, the target time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; decomposing each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determining a third sub-time series comprising the N trend components; dividing a second time series into M sub-sequences of target length, where M is a positive integer, the second time series being the third sub-time series or the second time series being formed based on the third sub-time series and the linear segmentation algorithm (PLR); calculating the matrix contour MP values ​​of the M sub-sequences of target length, the matrix contour MP values ​​of the M sub-sequences of target length forming an MP time series; and detecting anomalies in the MP time series according to a third-class judgment model.

[0050] First, the target time series is obtained, and the second time series is divided into M subsequences of target length. The second time series is formed by the third subsequence or by the third subsequence and the linear segmentation algorithm PLR. The third subsequence is a time series formed by decomposing the trend components of each of the N elements in the target time series. Second, the matrix profile MP value of the M subsequences of target length is calculated. Finally, anomalies in the target time series are detected according to the third-class judgment model, thereby improving the accuracy of traffic anomaly detection.

[0051] In conjunction with the third aspect, in one possible implementation, the method further includes: determining a second sub-time series comprising N residual components; and detecting anomalies in the target time series based on the second sub-time series and a third-class determination model.

[0052] In conjunction with the third aspect, in one possible implementation, the target length is specified by the communication protocol.

[0053] In conjunction with the third aspect, in one possible implementation, the decision model for the third class is the N-sigma model.

[0054] Fourthly, a method for classifying traffic patterns is provided, comprising: acquiring a target time series, the target time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring target parameters of the target time series based on the target time series, the target parameters comprising a periodic factor and / or jitter density, wherein the periodic factor is used to represent a wave-like variation around a long-term trend in the target time series, and the jitter density is used to represent the deviation between the actual value and the target value of the target time series within a target time period; and classifying the target time series based on the target parameters.

[0055] The target time series is obtained and classified according to its target parameters, so as to facilitate subsequent processing of the classified target time series and improve the accuracy of target time series processing.

[0056] In conjunction with the fourth aspect, in one possible implementation, obtaining the target parameters of the target time series based on the target time series includes: decomposing each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determining a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0057] In conjunction with the fourth aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining whether the target time series has the periodic factor based on the first sub-time series.

[0058] In conjunction with the fourth aspect, in one possible implementation, determining whether the target time series has the periodic factor based on the first sub-time series includes: determining that the target time series has the periodic factor if N periodic components exist in the first sub-time series; and determining that the target time series does not have the periodic factor if the N periodic components do not exist in the first sub-time series.

[0059] In conjunction with the fourth aspect, in one possible implementation, classifying the target time series according to the target parameters includes: determining the target time series as periodic when the periodic factor exists; and determining the target time series as aperiodic when the periodic factor does not exist.

[0060] In conjunction with the fourth aspect, in one possible implementation, obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: determining the jitter density of the target time series based on the second sub-time series.

[0061] In conjunction with the fourth aspect, in one possible implementation, determining the jitter density of the target time series based on the residual components of the target time series includes: determining R of the target time series according to the following formula:

[0062]

[0063] Where R is the jitter density, and r n It can be determined using the following formula:

[0064]

[0065] Wherein, the C nx is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0066] The N is determined according to the following formula:

[0067]

[0068] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0069] In conjunction with the fourth aspect, in one possible implementation, classifying the target time series according to the target parameters includes: determining the target time series as spurious when the jitter density is greater than a second preset value; and determining the target time series as stationary when the jitter density is less than or equal to the second preset value.

[0070] Fifthly, a method for training a traffic anomaly detection model is provided, comprising: acquiring a first time series, the first time series including N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring a first type of the first time series according to an original classification model of the first time series; performing traffic anomaly detection processing on the first time series of the first type according to a determination model of a first class corresponding to the first type to acquire first data, the first data being an anomaly point of the first time series; acquiring second data, the second data being the original anomaly point of the first time series; and adjusting the parameters of the determination model of the first class according to the first data and the second data to acquire a first target determination model.

[0071] Optionally, multiple first time series can be obtained, and the first target determination model can be trained based on the multiple first time series.

[0072] In conjunction with the fifth aspect, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0073] Sixthly, a method for training a traffic anomaly detection model is provided, comprising: acquiring a first time series, the first time series including N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring a first parameter set of the first time series according to the original parameter model of the first time series; performing traffic anomaly detection processing on the first time series according to a first-class judgment model corresponding to the first parameter set to obtain fourth data, the fourth data being anomaly points of the first time series; acquiring second data, the second data being the original anomaly points of the first time series; and adjusting the parameters of the first-class judgment model according to the second data and the fourth data to obtain a first target judgment model.

[0074] Optionally, multiple first time series can be obtained, and the first target determination model can be trained based on the multiple first time series.

[0075] In conjunction with the sixth aspect, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0076] A seventh aspect provides a training method for a traffic anomaly detection model, the method comprising: acquiring a first time series, the first time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; processing the first time series to acquire a third sub-time series, the third sub-time series being a time series composed of trend components decomposed from each of the N elements in the first time series; performing traffic anomaly detection processing on the first time series according to a fourth-class judgment model to acquire third data, the third data being anomaly points in the first time series; acquiring second data, the second data being the original anomaly points in the first time series; and adjusting the parameters of the fourth-class judgment model according to the second data and the third data to acquire a second target judgment model.

[0077] Optionally, multiple first time series can be obtained, and a second target determination model can be trained based on the multiple first time series.

[0078] Eighthly, a method for training a classification model of traffic patterns is provided, comprising: acquiring a first time series, the first time series including N elements, the N elements corresponding to the N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquiring a first type of the first time series according to the original classification model of the first time series; acquiring the original type of the first time series; and adjusting the parameters of the original model of the first time series according to the original type and the first type of the first time series to obtain a target classification model of the first time series.

[0079] In conjunction with the eighth aspect, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0080] A ninth aspect provides a traffic anomaly detection device, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor acquires a target time series, the target time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquires target parameters of the target time series based on the target time series, the target parameters including a periodicity factor and / or jitter density, wherein the periodicity factor represents a wave-like variation around a long-term trend in the target time series, and the jitter density represents the deviation between the actual value and the target value of the target time series within a target time period; determines a first type to which the target time series belongs from multiple types based on the target parameters, wherein each of the multiple types corresponds to a parameter set, and the target parameters belong to the parameter set corresponding to the first type; and detects anomalies in the target time series based on a first-category judgment model corresponding to the first type, wherein each of the multiple types corresponds to a type judgment model, and the judgment model is used for traffic anomaly detection.

[0081] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: decompose each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determine a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtain target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0082] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: determine, based on the first sub-time series, whether the target time series has the periodic factor.

[0083] In conjunction with the ninth aspect, in one possible implementation, the processor is further specifically configured to: determine that the target time series has the periodic factor if N periodic components exist in the first sub-time series; and determine that the target time series does not have the periodic factor if N periodic components do not exist in the first sub-time series.

[0084] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: determine a determination model for a second category corresponding to the first type based on a first mapping relationship and a first type to which the target time series belongs, wherein the first mapping relationship includes the correspondence between the plurality of types and the plurality of determination models for the second category; and detect anomalies in the target time series based on the second sub-time series and the determination model for the second category corresponding to the first type, wherein the determination model for the second category is an N-sigma model.

[0085] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: determine the jitter density of the target time series based on the second sub-time series.

[0086] In conjunction with the ninth aspect, in one possible implementation, the processor is further specifically configured to: determine R of the target time series according to the following formula:

[0087]

[0088] Where R is the jitter density, and r n It can be determined using the following formula:

[0089]

[0090] Wherein, the C n x is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0091] The N is determined according to the following formula:

[0092]

[0093] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0094] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: determine, based on the target parameter, a first parameter set to which the target parameter belongs from the plurality of parameter sets; and determine, based on a third mapping relationship and the first parameter set, a first type to which the target time series belongs from a plurality of types, wherein the third mapping relationship includes a correspondence between the plurality of parameter sets and the plurality of types.

[0095] The types mentioned above may include: periodic, non-periodic, stable, burr type, periodic stable, periodic burr type, non-periodic stable, or non-periodic burr type.

[0096] The type can be determined based on a periodic factor. Specifically, if the periodic factor exists, the type is periodic; if the periodic factor does not exist, the type is aperiodic.

[0097] The stable and burr types can be determined based on the jitter density. Specifically, when the jitter density is greater than a second preset value, the type is burr type; when the jitter density is less than or equal to the second preset value, the type is stable type.

[0098] In conjunction with the ninth aspect, in one possible implementation, the processor is further specifically configured to: determine a third sub-time series comprising N trend components; divide the second time series into M sub-sequences of target length, where M is a positive integer, wherein the second time series is the third sub-time series or the second time series is formed based on the third sub-time series and the linear segmentation algorithm PLR; calculate the matrix profile MP values ​​of the M sub-sequences of target length, wherein the matrix profile MP values ​​of the M sub-sequences of target length constitute the MP time series; and detect anomalies in the target time series based on the MP time series and the N-sigma algorithm.

[0099] In conjunction with the ninth aspect, in one possible implementation, the processor is further configured to: determine a determination model for a first category corresponding to the first type based on the second mapping relationship and the first type to which the target time series belongs, wherein the second mapping relationship includes the correspondence between the plurality of types and the plurality of determination models for the first category.

[0100] In a tenth aspect, a traffic anomaly detection device is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor is configured to acquire a target time series. The target time series includes N elements, each corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point. Based on the target time series, target parameters of the target time series are acquired, the target parameters including a periodicity factor and / or jitter density, wherein the periodicity factor represents a wave-like variation around a long-term trend in the target time series, and the jitter density represents the deviation between the actual value and the target value of the target time series within a target time period. A first parameter set to which the target parameters belong is determined from multiple parameter sets. Anomalies in the target time series are detected based on a first-type judgment model corresponding to the first parameter set, wherein each parameter set in the multiple parameter sets corresponds to a type of judgment model, and the judgment model is used for traffic anomaly detection.

[0101] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: decompose each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determine a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtain target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0102] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: determine, based on the first sub-time series, whether the target time series has the periodic factor.

[0103] In conjunction with the tenth aspect, in one possible implementation, the processor is further specifically configured to: determine that the target time series has the periodic factor if N periodic components in the first sub-time series exist; and determine that the target time series does not have the periodic factor if N periodic components in the first sub-time series do not exist.

[0104] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: detect anomalies in the target time series based on a second-class determination model corresponding to the second sub-time series and the first parameter set, wherein the second-class determination model is an N-sigma model.

[0105] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: determine a second-class determination model corresponding to the first parameter set based on the fourth mapping relationship and the first parameter set to which the target parameter belongs, wherein the fourth mapping relationship includes the correspondence between the plurality of parameter sets and the plurality of second-class determination models.

[0106] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: determine the jitter density of the target time series based on the second sub-time series.

[0107] In conjunction with the tenth aspect, in one possible implementation, the processor is further configured to: determine the jitter density of the target time series according to the following formula:

[0108]

[0109] Where R is the jitter density, and r n It can be determined using the following formula:

[0110]

[0111] Wherein, the C n x is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0112] The N is determined according to the following formula:

[0113]

[0114] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0115] In conjunction with the tenth aspect, in one possible implementation, the processor is further specifically configured to: determine a third sub-time series comprising N trend components; divide the second time series into M sub-sequences of target length, where M is a positive integer, wherein the second time series is the third sub-time series or the second time series is formed based on the third sub-time series and the linear segmentation algorithm PLR; calculate the matrix profile MP values ​​of the M sub-sequences of target length, wherein the matrix profile MP values ​​of the M sub-sequences of target length constitute the MP time series; and detect anomalies in the target time series based on the MP time series and the N-sigma algorithm.

[0116] In conjunction with the tenth aspect, in one possible implementation, the processor is further specifically configured to: determine a first-class determination model corresponding to the first parameter set based on the fifth mapping relationship and the first parameter set to which the target parameter belongs, wherein the fifth mapping relationship includes the correspondence between the plurality of parameter sets and the plurality of first-class determination models.

[0117] Eleventhly, a traffic anomaly detection device is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor acquires a target time series, the target time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; decomposes each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determines a third sub-time series comprising the N trend components; divides a second time series into M sub-sequences of target length, where M is a positive integer, the second time series being the third sub-time series or the second time series being formed based on the third sub-time series and the linear segmentation algorithm (PLR); calculates the matrix contour MP values ​​of the M sub-sequences of target length, the matrix contour MP values ​​of the M sub-sequences of target length forming the MP time series; and detects anomalies in the MP time series according to a third-class judgment model.

[0118] In conjunction with the eleventh aspect, in one possible implementation, the processor is further configured to: determine a second sub-time series comprising N residual components; and detect anomalies in the target time series based on the second sub-time series and a third-class determination model.

[0119] In conjunction with the eleventh aspect, in one possible implementation, the target length is specified by the communication protocol.

[0120] In conjunction with the eleventh aspect, in one possible implementation, the decision model for the third class is the N-sigma model.

[0121] In a twelfth aspect, a traffic pattern classification device is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor acquires a target time series, the target time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquires target parameters of the target time series based on the target time series, the target parameters including a periodicity factor and / or jitter density, wherein the periodicity factor represents a wave-like variation around a long-term trend in the target time series, and the jitter density represents the deviation between the actual value and the target value of the target time series within a target time period; and classifies the target time series based on the target parameters.

[0122] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: decompose each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determine a first sub-time series including the N periodic components and a second sub-time series including the N residual components; and obtain target parameters of the target time series based on the first sub-time series or the second sub-time series.

[0123] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine, based on the first sub-time series, whether the target time series has the periodic factor.

[0124] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine that the target time series has the periodic factor if N periodic components in the first sub-time series exist; and determine that the target time series does not have the periodic factor if N periodic components in the first sub-time series do not exist.

[0125] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine the target time series as periodic when the periodic factor exists; and determine the target time series as aperiodic when the periodic factor does not exist.

[0126] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine the jitter density of the target time series based on the second sub-time series.

[0127] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine R of the target time series according to the following formula:

[0128]

[0129] Where R is the jitter density, and r n It can be determined using the following formula:

[0130]

[0131] Wherein, the C n x is the nth element in the second sub-time series. n It is the nth element in the target time series;

[0132] The N is determined according to the following formula:

[0133]

[0134] T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0135] In conjunction with the twelfth aspect, in one possible implementation, the processor is further specifically configured to: determine the target time series as spurious when the jitter density is greater than a second preset value; and determine the target time series as stationary when the jitter density is less than or equal to the second preset value.

[0136] In a thirteenth aspect, a traffic anomaly detection model training device is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor is configured to acquire a first time series, the first time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquire a first type of the first time series according to an original classification model of the first time series; perform traffic anomaly detection processing on the first time series of the first type according to a determination model of a first class corresponding to the first type to acquire first data, the first data being an anomaly point of the first time series; acquire second data, the second data being the original anomaly point of the first time series; and adjust the parameters of the determination model of the first class according to the first data and the second data to acquire a first target determination model.

[0137] Optionally, the processor can acquire multiple first time series and train a first target determination model based on the multiple first time series.

[0138] In conjunction with aspect thirteen, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0139] In a fourteenth aspect, a traffic anomaly detection model training device is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor is configured to: acquire a first time series, the first time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquire a first parameter set of the first time series based on the original parameter model of the first time series; perform traffic anomaly detection processing on the first time series based on a first-class judgment model corresponding to the first parameter set to acquire fourth data, the fourth data being an anomaly point of the first time series; acquire second data, the second data being the original anomaly point of the first time series; and adjust the parameters of the first-class judgment model based on the second data and the fourth data to acquire a first target judgment model.

[0140] Optionally, the processor can acquire multiple first time series and train a first target determination model based on the multiple first time series.

[0141] In conjunction with the fourteenth aspect, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0142] In a fifteenth aspect, a training model for a traffic anomaly detection model is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor is configured to acquire a first time series, the first time series comprising N elements, the N elements corresponding to N time points, wherein each of the N elements is traffic data received at the corresponding time point; process the first time series to acquire a third sub-time series, the third sub-time series being a time series composed of trend components decomposed from each of the N elements in the first time series; perform traffic anomaly detection processing on the first time series according to a fourth-type judgment model to acquire third data, the third data being anomaly points in the first time series; acquire second data, the second data being the original anomaly points in the first time series; and adjust the parameters of the fourth-type judgment model according to the second data and the third data to acquire a second target judgment model.

[0143] Optionally, the processor can acquire multiple first time series and train a second target determination model based on the multiple first time series.

[0144] In a sixteenth aspect, a traffic pattern classification model training apparatus is provided, comprising a memory for storing a program; and a processor for executing the program stored in the memory. When the processor executes the program stored in the memory, the processor is configured to acquire a first time series, the first time series comprising N elements, the N elements corresponding to the N time points, wherein each of the N elements is traffic data received at the corresponding time point; acquire a first type of the first time series based on an original classification model of the first time series; acquire an original type of the first time series; and adjust the parameters of the original model of the first time series based on the original type and the first type of the first time series to acquire a target classification model of the first time series.

[0145] In conjunction with the sixteenth aspect, in one possible implementation, the first type of the first time series is periodic or aperiodic, spurious, stationary, periodically stationary, aperiodically stationary, periodically spurious, or aperiodically spurious.

[0146] In a seventeenth aspect, a computer storage medium is provided that stores program code including methods for performing any of the possible implementations of the first to eighth aspects described above.

[0147] Eighteenth aspect: A computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform the method in any of the possible implementations of the first to eighth aspects described above.

[0148] In a nineteenth aspect, a chip is provided, the chip including a processor and a data interface, wherein the processor reads instructions stored in a memory through the data interface and executes the method in any of the possible implementations of the first to eighth aspects described above.

[0149] Optionally, as one implementation, the chip may further include a memory storing instructions, and the processor is configured to execute the instructions stored in the memory. When the instructions are executed, the processor is configured to perform the method in any of the possible implementations of the first to eighth aspects.

[0150] The aforementioned chip can be a Field Programmable Gate Array (FPGA) or an Application-Specific Integrated Circuit (ASIC). Attached Figure Description

[0151] Figure 1This is a schematic diagram of the system architecture provided in the embodiments of this application.

[0152] Figure 2 This is a schematic flowchart of a traffic pattern classification method 200 provided in an embodiment of this application.

[0153] Figure 3 It is a sequence of network traffic from four network devices.

[0154] Figure 4 This is a schematic flowchart of a traffic anomaly detection method 400 provided in an embodiment of this application.

[0155] Figure 5 This is a schematic diagram of the time series processing according to an embodiment of this application.

[0156] Figure 6 This is a schematic flowchart of another traffic anomaly detection method 600 provided in the embodiments of this application.

[0157] Figure 7 This is a schematic diagram of baseline traffic anomalies in an embodiment of this application.

[0158] Figure 8 This is a schematic flowchart of another method for detecting abnormal traffic provided in this application embodiment 800.

[0159] Figure 9 This is a schematic flowchart of a traffic pattern classification model training method 900 provided in an embodiment of this application.

[0160] Figure 10 This is a schematic flowchart of another traffic anomaly detection model training method 1000 provided in the embodiments of this application.

[0161] Figure 11 This is a schematic flowchart of another traffic anomaly detection model training method 1100 provided in the embodiments of this application.

[0162] Figure 12 This is a schematic flowchart of another traffic anomaly detection model training method 1200 provided in the embodiments of this application.

[0163] Figure 13 This is a schematic block diagram of the traffic pattern classification device 1300 provided in the embodiments of this application.

[0164] Figure 14 This is a schematic block diagram of the flow anomaly detection device 1400 provided in the embodiments of this application.

[0165] Figure 15 This is a schematic diagram of the hardware structure of the traffic pattern classification model training device 1500 provided in the embodiments of this application.

[0166] Figure 16 This is a schematic diagram of the hardware structure of the traffic anomaly detection model training device 1600 provided in this application embodiment. Detailed Implementation

[0167] To facilitate understanding, the following section will introduce several concepts involved in the embodiments of this application.

[0168] 1. A time series is a sequence of data points arranged in chronological order. Typically, the time intervals in a time series are constant, allowing it to be analyzed as discrete-time data. Anomaly detection in time series typically involves identifying data points that deviate from a relatively established pattern or distribution. Time series anomalies include sudden increases, sudden decreases, and changes in the mean. Anomaly detection algorithms for time series include those based on statistics and data distribution (N-Sigma), distance / density-based algorithms (Local Anomaly Factors), Isolation Forest, and prediction-based algorithms (ARIMA), among others.

[0169] 2. Traffic anomaly detection: This function detects anomalies in traffic data collected from devices or ports in the network. The results of anomaly detection provide a basis for discovering network attacks, configuration errors, and network device failures.

[0170] 3. N-Sigma Algorithm

[0171] Assume that the data flow follows a normal distribution in a short period of time, that is:

[0172]

[0173] Where, x t Let be the flow rate data at time t, μ be the mean of the normal distribution, and σ be the variance of the normal distribution.

[0174] The mean and variance can be calculated using n historical traffic data points (x1, x2, ... x) within a time window. t ,...x n An estimate is made, and the estimate is given by the following formula:

[0175]

[0176]

[0177] If the traffic data to be detected is x t If the distance from the mean is greater than a preset value, then the data flow to be detected, x, is... t This is an outlier, i.e.:

[0178]

[0179] Where Y is a preset value.

[0180] If the traffic data to be detected is x t If the distance from the mean is less than or equal to a preset value, then the data flow to be detected is x. t This is the normal point, that is:

[0181]

[0182] The N-sigma algorithm assumes that data traffic follows a normal distribution over a short period of time to detect anomalies in network traffic data. However, network traffic data distribution does not follow a normal distribution over a short period of time. Therefore, algorithms based on statistics and data distribution have low accuracy in detecting anomalies in network traffic data.

[0183] Therefore, there is an urgent need for a method that can improve the accuracy of traffic data anomaly detection.

[0184] The following is combined Figure 1 The system architecture of the embodiments of this application will be described in detail.

[0185] Figure 1 This is a schematic diagram of the system architecture according to an embodiment of this application. For example... Figure 1 As shown, the system architecture 100 includes an execution device 110, a training device 120, a database 130, a network device 140, a data storage system 150, and a data acquisition device 160.

[0186] Additionally, the execution device 110 includes a calculation module 111, an I / O interface 112, a preprocessing module 113, and a preprocessing module 114. The calculation module 111 may include a target model / rule 101, while the preprocessing modules 113 and 114 are optional.

[0187] The data acquisition device 160 is used to collect training data. For the traffic anomaly detection method of this application embodiment, the training data may include a first time series, wherein the first time series includes N elements, each corresponding to one of the N times, and each of the N elements is the traffic data received at the corresponding time. After collecting the training data, the data acquisition device 160 stores this training data in the database 130, and the training device 120 trains the target model / rule 101 based on the training data maintained in the database 130.

[0188] The following describes how the training device 120 obtains the target model / rule 101 based on the training data. The training device 120 performs traffic anomaly detection on the first time series and compares the output traffic anomaly detection result of the first time series with the original traffic anomaly result of the first time series until the traffic anomaly detection result of the first time series output by the training device 120 is less than a certain threshold compared with the original traffic anomaly result of the first time series, thereby completing the training of the target model / rule 101. The original traffic anomaly result of the first time series is obtained by the operator through analysis of the first time series.

[0189] The aforementioned target model / rule 101 can be used to implement the traffic anomaly detection method of this application embodiment. That is, by inputting the target time series (after relevant preprocessing) into the target model / rule 101, the detection result of the target time series can be obtained. It should be noted that in practical applications, the first time series maintained in the database 130 may not all come from the data acquisition device 160, but may also be received from other devices. In addition, it should be noted that the training device 120 may not necessarily train the target model / rule 101 entirely based on the first time series maintained in the database 130, but may also obtain the first time series from the cloud or other places for model training. The above description should not be construed as limiting the embodiments of this application.

[0190] The target model / rule 101 trained using training device 120 can be applied to different systems or devices, such as... Figure 1 The execution device 110 shown can be a server or cloud-based device, etc. Figure 1 In this embodiment, the execution device 110 is configured with an input / output (I / O) interface 112 for data interaction with external devices. The network device 140 inputs data to the I / O interface 112. The input data may include a target time series input by the network device in this application embodiment. Specifically, the network device 140 may be a terminal device.

[0191] Preprocessing module 113 and preprocessing module 114 are used to preprocess the input data (such as the target time series) received by I / O interface 112. In this embodiment, preprocessing module 113 and preprocessing module 114 may be omitted (or only one of them may be used), and the calculation module 111 may be used directly to process the input data.

[0192] During the preprocessing of input data by the execution device 110, or during the calculation module 111 of the execution device 110 performing calculations and other related processes, the execution device 110 can call data, code, etc. in the data storage system 150 for corresponding processing, or store the data, instructions, etc. obtained from the corresponding processing into the data storage system 150.

[0193] Finally, I / O interface 112 presents the processing results, such as the detection results of the target time series obtained above, to network device 140, thereby providing them to the user.

[0194] It is worth noting that the training device 120 can generate corresponding target models / rules 101 based on different training data for different objectives or tasks. The corresponding target models / rules 101 can be used to achieve the above objectives or complete the above tasks, thereby providing the user with the required results.

[0195] exist Figure 1 In the scenario shown, network device 140 can automatically send input data to I / O interface 112. Users can view the results output by execution device 110 on network device 140, which can be presented in various forms such as display, sound, or animation. Network device 140 can also function as a data acquisition terminal, collecting data such as... Figure 1 The input data and output results of the input I / O interface 112 shown are used as new sample data and stored in the database 130. Alternatively, the data can be collected directly from the I / O interface 112 as new sample data without going through the network device 140.

[0196] It is worth noting that, Figure 1 This is merely a schematic diagram of a system architecture provided in an embodiment of this application. The positional relationships between the devices, components, modules, etc., shown in the diagram do not constitute any limitation. For example, in Figure 1 In this context, the data storage system 150 is an external memory relative to the execution device 110. In other cases, the data storage system 150 may also be placed within the execution device 110.

[0197] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0198] The following is combined Figure 2 A traffic pattern classification method 200 provided in the embodiments of this application will be described in detail.

[0199] Figure 2The method shown can be performed by a traffic pattern classification device, which can be a server or cloud with traffic pattern classification capabilities.

[0200] Figure 2 The method 200 shown includes steps 210 to 230. These steps are described in detail below.

[0201] 210. Obtain the target time series, which includes N elements, each of which corresponds to N time points. Each of the N elements is the traffic data received at the corresponding time point.

[0202] Optionally, the target time series can be sent by the first network device.

[0203] Optionally, the server can also obtain other time series to be detected for traffic anomalies besides the target time series. These other time series may originate from the same network device, which can be a first network device or any other network device besides the first network device. Alternatively, the other time series may originate from different network devices. This application does not limit this.

[0204] Optionally, each of the N elements, representing the traffic data received at the corresponding time, can be understood as the traffic data of the first network device collected by the server within a unit of time (second); that is, each of the N elements can represent the traffic data of the first network device collected by the server every 1 second. For example, when N is 4, the target time series can include 4 elements, meaning the server needs to collect the traffic data of the first network device every 1 second to obtain the target time series collected within 4 seconds. For example, the target time series could be {1MB, 2MB, 5MB, 9MB}, where 1MB is the traffic data of the first network device at 1 second, 2MB is the traffic data of the first network device at 2 seconds, 5MB is the traffic data of the first network device at 3 seconds, and 9MB is the traffic data of the first network device at 4 seconds. For example, the target time series could also be {1.2MB, 2MB, 3MB, 5MB}, where 1.2MB is the traffic data of the first network device at 1 second, 2MB is the traffic data of the first network device at 2 seconds, 3MB is the traffic data of the first network device at 3 seconds, and 5MB is the traffic data of the first network device at 4 seconds. Alternatively, each of the N elements, representing the traffic data received at the corresponding time, can be understood as the total traffic data of the first network device collected by the server within a preset time period, where the preset time period is longer than a unit time. For example, when N is 6, the target time series could include 6 elements, meaning the server needs to collect the traffic data of the first network device every preset time period to obtain the target time series within 6 preset time periods. For example, when N is 6 and the preset time period is 10 seconds, the server collects the traffic data of the first network device every 10 seconds to obtain the target time series collected within 1 minute. For example, the target time series could be {1MB, 2.5MB, 5MB, 8MB, 12MB, 18MB}, where 1MB is the traffic data of the first network device within 1s-10s, 2.5MB is the traffic data of the first network device within 11s-20s, 5MB is the traffic data of the first network device within 21s-30s, 8MB is the traffic data of the first network device within 31s-40s, 12MB is the traffic data of the first network device within 41s-50s, and 18MB is the traffic data of the first network device within 51s-60s. For example, with N being 5 and the preset time being 5 seconds, the target time series could also be {1MB, 2MB, 3.5MB, 6MB, 8MB}, where 1MB is the traffic data of the first network device within 1s-5s, 2MB is the traffic data of the first network device within 6s-10s, 3.5MB is the traffic data of the first network device within 11s-15s, 6MB is the traffic data of the first network device within 16s-20s, and 8MB is the traffic data of the first network device within 21s-25s.

[0205] 220. Based on the target time series, obtain the target parameters of the target time series, which include the period factor and / or jitter density. The period factor is used to represent a wave-like variation around the long-term trend in the target time series, and the jitter density is used to represent the deviation between the actual value and the target value of the target time series within the target time.

[0206] Optionally, each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component; a first sub-time series including N periodic components and a second sub-time series including N residual components are determined, and the target parameters of the target time series are obtained based on the first sub-time series or the second sub-time series.

[0207] In this context, the N periodic components of each of the N elements in the target time series are identical, meaning that each periodic component of each element in a time series is identical.

[0208] For example, x n For an element in the target time series, x n Decomposed into trend component T n Periodic component S n Residual component C n S n For the elements in the first sub-time series, C n Let x be an element in the second sub-time series. n This can be expressed as the following formula:

[0209] x n =T n +S n +C n

[0210] Optionally, the server can use the Time Series Decompose (TSD) algorithm to decompose each of the N elements in the target time series into a trend component, a periodic component, and a residual component.

[0211] Optionally, based on the first sub-time series, it can be determined whether the target time series has a periodic factor.

[0212] Specifically, if N periodic components exist in the first sub-time series, the target time series is determined to have a periodic factor; if N periodic components do not exist in the first sub-time series, the target time series is determined to not have a periodic factor.

[0213] Optionally, the existence of the aforementioned N periodic components can be understood as all N periodic components being valid values; for example, the periodic component could be 1, or it could be 3. The absence of the aforementioned N periodic components can be understood as all N periodic components being invalid values; for example, the periodic component could be 0. Here, all N periodic components being valid values ​​can be understood as all N periodic components obtained from time series decomposition being non-zero values; all N periodic components being invalid values ​​can be understood as all N periodic components obtained from time series decomposition being 0 values. For example, as... Figure 3 The time series shown in (c) is a periodic time series, which is obtained by... Figure 3 When the time series shown in (c) is decomposed, the N periodic components of the time series are found to be 0 values, meaning that the N periodic components of the time series are invalid, i.e., the periodic components do not exist. For example, as... Figure 3 The time series shown in (b) is an aperiodic time series, which is obtained by... Figure 3 When the time series shown in (b) is decomposed, all N periodic components of the time series are non-zero values, that is, the N periodic components of the time series are valid values, that is, the periodic components exist.

[0214] Optionally, if the target time series has a periodic factor, the periodic factor can be set to 1; if the target time series does not have a periodic factor, the periodic factor can be set to 0.

[0215] Optionally, the jitter density of the target time series is determined based on the second sub-time series.

[0216] Specifically, the server determines R of the target time series according to the following formula:

[0217]

[0218] Where R is the jitter density, r n It can be determined using the following formula:

[0219]

[0220] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0221] N is determined according to the following formula:

[0222]

[0223] T is the length of the target time series, W is the window length of the window to which the data is added, and α is the first preset value.

[0224] 230. Classify the target time series according to the target parameters.

[0225] Specifically, when the periodicity factor exists, the target time series is determined to be periodic; when the periodicity factor does not exist, the target time series is determined to be aperiodic. When the jitter density is greater than a second preset value, the target time series is determined to be spurious; when the jitter density is less than or equal to the second preset value, the target time series is determined to be stationary.

[0226] Based on the target parameters, the target sequence can be classified into the following eight cases, where S is the periodicity factor and R is the jitter density:

[0227] ① When S exists, that is, when S=1, the first type to which the target time series belongs is periodic.

[0228] ② In the absence of S, i.e. S = 0, the target time series belongs to the first type of aperiodicity;

[0229] ③ When R is greater than the second preset value, the first type to which the target time series belongs is the spurious type;

[0230] ④ When R is less than or equal to the second preset value, the target time series belongs to the first type of stationary type;

[0231] ⑤ When S exists and R is greater than the second preset value, the first type to which the target time series belongs is the periodic spike type;

[0232] ⑥ When S does not exist and R is greater than the second preset value, the first type to which the target time series belongs is the non-periodic spike type;

[0233] ⑦ When S exists and R is less than or equal to the second preset value, the first type to which the target time series belongs is the periodic stationary type;

[0234] ⑧ When S exists and R is greater than the second preset value, the first type to which the target time series belongs is the periodic spike type.

[0235] Optionally, the method 200 may further include step 230.

[0236] 230. Output the classification results of the target time series. That is, output whether the target time series is periodic or aperiodic; or, output whether the target time series is stationary or volatile; or, output whether the target time series is periodic volatile, periodic stationary, aperiodic volatile, or aperiodic stationary.

[0237] For example, such as Figure 3The image shows network traffic sequences for four types of network devices. Figure 3 (a) Figure 3 (b) Figure 3 (c) and Figure 3 As can be seen from (d), the characteristics of network traffic vary greatly. For example, Figure 3 The network traffic of the device shown in (a) is relatively stable at various times, meaning the traffic sequence can be stationary; for example... Figure 3 (b) The network device shown exhibits significant local traffic jitter, meaning the traffic sequence can be erratic; for example... Figure 3 (c) shows that the network device's traffic exhibits strong periodicity (daily, weekly), meaning the traffic sequence can be periodic; for example... Figure 3 (d) The network device shown does not show obvious traffic periodicity characteristics (day, week), that is, the traffic sequence can be aperiodic.

[0238] By classifying the target time series, a foundation can be laid for subsequent traffic anomaly detection of the classified target time series, thereby improving the accuracy of traffic anomaly detection of the target time series.

[0239] The following is combined Figure 4 A method 400 for detecting abnormal traffic flow provided in the embodiments of this application will be described in detail.

[0240] Figure 4 The method shown can be performed by a traffic anomaly detection device, which can be a server with traffic anomaly detection capabilities.

[0241] Figure 4 The method shown includes steps 410 to 440. These steps are described in detail below.

[0242] The abnormal situations of the time series described in the embodiments of this application can be understood as abnormal situations of the time series traffic.

[0243] 410. Obtain the target time series, which includes N elements, each of which corresponds to N time points. Each of the N elements is the traffic data received at the corresponding time point.

[0244] Optionally, the target sequence mentioned above may be sent by the first network device.

[0245] Optionally, the server can also obtain other time series to be detected for traffic anomalies besides the target time series. These other time series can be from the same network device, which can be a first network device or any other network device besides the first network device. Alternatively, the other time series to be detected for traffic anomalies can be from different network devices.

[0246] 420. Based on the target time series, obtain the target parameters of the target time series, which include the period factor and / or jitter density. The period factor is used to represent a wave-like variation around the long-term trend in the target time series, and the jitter density is used to represent the deviation between the actual value and the target value of the target time series within the target time.

[0247] Optionally, each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component; a first sub-time series including N periodic components and a second sub-time series including N residual components are determined; and the target parameters of the target time series are obtained based on the first sub-time series or the second sub-time series.

[0248] For example, x n For an element in the target time series, x n Decomposed into trend component T n Periodic component S n Residual component C n The S n For the elements in the first sub-time series, the C n Let x be an element in the second sub-time series. n This can be expressed as the following formula:

[0249] x n =T n +S n +C n

[0250] Optionally, the server can use the Time Series Decompose (TSD) algorithm to decompose each element in the target time series into trend components, periodic components, and residual components.

[0251] Optionally, based on the first sub-time series, it can be determined whether the target time series has a periodic factor.

[0252] Specifically, if N periodic components exist in the first sub-time series, the target time series is determined to have a periodic factor; if N periodic components do not exist in the first sub-time series, the target time series is determined to not have a periodic factor.

[0253] Optionally, the periodic components of each element in a time series are the same, meaning that each time series corresponds to one periodic component. For example, the periodic components of each element in the time series can all be 1, or the periodic components of each element in the time series can all be 2.

[0254] Optionally, the existence of the aforementioned N periodic components can be understood as all N periodic components being valid values; for example, the periodic component could be 0.5, or it could be 2. The absence of the aforementioned N periodic components can be understood as all N periodic components being invalid values; for example, the periodic component could be 0.

[0255] Optionally, if the target time series has a periodic factor, the periodic factor can be set to 1; if the target time series does not have a periodic factor, the periodic factor can be set to 0.

[0256] Optionally, the jitter density of the target time series is determined based on the second sub-time series.

[0257] Specifically, the server determines R of the target time series according to the following formula:

[0258]

[0259] Where R is the jitter density, r n It can be determined using the following formula:

[0260]

[0261] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0262] N is determined according to the following formula:

[0263]

[0264] T is the length of the target time series, W is the window length of the window to which the data is added, and α is the first preset value.

[0265] For any content not described in steps 410 and 420, please refer to the description of steps 210 and 220 in the above method 200, which will not be repeated here.

[0266] 430. Based on the target parameters, determine the first type to which the target time series belongs from multiple types, wherein each of the multiple types corresponds to a parameter set, and the target parameters belong to the parameter set corresponding to the first type.

[0267] The types mentioned above may include: periodic, non-periodic, stable, burr type, periodic stable, periodic burr type, non-periodic stable, or non-periodic burr type.

[0268] The type can be determined based on a periodic factor. Specifically, if the periodic factor exists, the type is periodic; if the periodic factor does not exist, the type is aperiodic.

[0269] The stable and burr types can be determined based on the jitter density. Specifically, when the jitter density is greater than a second preset value, the type is burr type; when the jitter density is less than or equal to the second preset value, the type is stable type.

[0270] It should be understood that the target time series can belong to one of the following eight types, where S is the periodicity factor and R is the jitter density: ① When S exists (S=1), the target time series belongs to the first type: periodic; ② When S does not exist (S=0), the target time series belongs to the first type: aperiodic; ③ When R is greater than a second preset value, the target time series belongs to the first type: spurious; ④ When R is less than or equal to the second preset value, the target time series belongs to the first type: stationary; ⑤ When S exists and R is greater than the second preset value, the target time series belongs to the first type: periodic spurious; ⑥ When S does not exist and R is greater than the second preset value, the target time series belongs to the first type: aperiodic spurious; ⑦ When S exists and R is less than or equal to the second preset value, the target time series belongs to the first type: periodic stationary; ⑧ When S exists and R is greater than the second preset value, the target time series belongs to the first type: periodic spurious.

[0271] Optionally, the parameter set can be understood as {S=1}, {S=0}, {R>β}, {R≤β}, where β can be a second preset value.

[0272] First, based on the target parameters, a first parameter set to which the target parameters belong is determined from multiple parameter sets. Second, based on a third mapping relationship and the first parameter set, a first type to which the target time series belongs is determined from multiple types. The third mapping relationship includes the correspondence between multiple parameter sets and multiple types. In other words, the target parameters are calculated, and the first parameter set is determined based on which parameter set the target parameters belong to. Finally, the first type to which the target time series belongs is determined based on the first type corresponding to the first parameter set.

[0273] 440. Based on the determination model of the first type corresponding to the first category, detect anomalies in the target time series, wherein each of the multiple types corresponds to a determination model of that type, and the determination model is used for traffic anomaly detection. Optionally, the determination model of the first category corresponding to the first type can be determined based on the second mapping relationship and the first type to which the target time series belongs, wherein the second mapping relationship includes the correspondence between multiple types and multiple determination models of the first category.

[0274] Specifically, the first type of judgment model can be as follows: First, determine a third sub-time series including N trend components; and divide the second time series into M sub-series of target length, where M is a positive integer. The second time series is either the third sub-time series or formed based on the third sub-time series and the Linear Segmentation Algorithms (PLR) algorithm; second, calculate the matrix profile MP values ​​of the M sub-series of target length, and the matrix profile MP values ​​of the M sub-series of target length constitute the MP time series; finally, detect anomalies in the target time series based on the MP time series and the N-sigma algorithm.

[0275] In the PLR ​​representation of a time series, the number of line segments determines the approximate granularity of the original series. More line segments result in shorter average segment lengths, reflecting short-term fluctuations in the time series; fewer line segments result in longer average segment lengths, reflecting medium- to long-term trends. The PLR ​​representation uses M consecutive line segments to approximate a time series of length m (m >> M).

[0276] The trend component reflects the overall change in the time series. Therefore, performing anomaly detection on the third sub-time series, which includes N trend components, can improve the accuracy of time series anomaly detection results.

[0277] In this implementation, the third sub-time series (the time series composed of trend components after decomposing each of the N elements in the target time series) is represented by PLR. It is implemented using a top-down algorithm, with the start and end points of the flow data being the first selected segmentation points. Then, all points between two points are traversed, and the point with the largest straight-line distance to these two points is found. If the distance from this point to the straight-line is greater than a pre-defined threshold, it is designated as the third segmentation point. This results in two line segments: one from the newly added point to its left neighbor and the other to its right neighbor. The search continues for the point with the largest distance. The point with the largest distance to its corresponding line segment, and whose distance is greater than the threshold, is designated as the fourth segmentation point. This process is repeated until no more points with distances greater than the threshold are found, completing the segmentation. This threshold, the distance from the point to the line segment, is calculated using Euclidean distance.

[0278] Optionally, the second time series is divided into M subsequences of target length using a matrix profile (MP), and the MP values ​​of the matrix profiles of the M subsequences of target length are calculated using MP. MP is a method that describes the profile of a time series from a structural perspective, and is commonly used for time series clustering, density estimation, and graph discovery. The principle of MP is to cut the entire time series into fixed-length subsequences, calculate the Euclidean distance between each subsequence and the other subsequences, and take the minimum value as the MP value of that subsequence. For example, a time series X = {x0, x1, ... x...} n-2 ,x n-1} Divide into several subsequences using MP. subsequence The MP value of the subsequence relative to the original time series X is the minimum distance between the subsequence and other subsequences in the original sequence, i.e.

[0279] Based on the MP time series and N-sigma algorithm, the anomalies in the target time series are detected as follows:

[0280] Suppose the MP sequence can be MP = {mp0, mp1, ... mp} n-m},but

[0281]

[0282]

[0283] Where, μ mp Let σ be the mean of the MP time series. mp Let be the variance of the MP time series.

[0284] like Then the traffic data received at the time corresponding to the i-th element in the target time series is abnormal data; if Then the traffic data received at the time corresponding to the i-th element in the target time series is considered normal data. Here, δ is a preset value.

[0285] Specifically, based on the MP time series and the N-sigma algorithm, traffic anomalies in the MP time series can be detected. The time corresponding to the traffic anomaly in the MP time series is the time of the traffic anomaly in the target time series. Thus, the traffic anomalies in the target time series can be obtained from the traffic anomalies in the MP time series.

[0286] For example, such as Figure 5As shown, the top figure shows the original time series; the middle figure shows the time series formed by representing the original series using PLR; and the bottom figure shows the time series formed by dividing the PLR-represented time series into M subsequences and calculating the MP values ​​of the M subsequences. Figure 5 As can be seen, the original sequence has a sudden change around 60 on the horizontal axis. By representing the original time series using PLR, this sudden change around 60 can be smoothed out. In practice, traffic flow time series may fluctuate within a short period, but the traffic flow returns to normal within a short time. Therefore, it is necessary to represent the time series using PLR and calculate the MP value to ensure the accuracy of traffic anomaly detection, thereby improving the precision of traffic anomaly detection. Optionally, after detecting anomalies in the target time series according to the first type of judgment model, the anomaly points of the target time series can be output.

[0287] Optionally, the server can also perform another type of traffic anomaly detection on the target time series, i.e., the server can also perform step 450.

[0288] Step 450: Based on the second sub-time series and the second type of the first type, detect the anomalies in the target time series. The second type of the ...

[0289] Specifically, based on the first mapping relationship and the first type to which the target time series belongs, the determination model of the second type corresponding to the first type is determined. The first mapping relationship includes the correspondence between multiple types and multiple second type determination models.

[0290] Specifically, the second type of judgment model can be:

[0291]

[0292]

[0293] Where μ2 is the mean of the second sub-time series and σ2 is the variance of the second sub-time series.

[0294] like Then the traffic data received at the time corresponding to the nth element in the target time series is abnormal data; if Then the traffic data received at the time corresponding to the nth element in the target time series is considered normal data. This is the default value.

[0295] Specifically, based on the second sub-time series and the second type of the first type's judgment model, traffic anomalies in the second sub-time series can be detected. The time corresponding to the traffic anomalies in the second sub-time series is the time of the traffic anomalies in the target time series. Thus, the traffic anomalies in the target time series can be obtained from the traffic anomalies in the second sub-time series. Optionally, after detecting anomalies in the target time series based on the second type of the second type's judgment model, the anomalies in the target time series can be output.

[0296] In the above embodiments, anomaly detection is performed based on the type of time series and the corresponding decision model. Each type of time series corresponds to a specific decision model; that is, for each type of time series, there are both a first-type decision model and a second-type decision model. For example, periodic time series have both a corresponding first-type and a corresponding second-type decision model; aperiodic time series also have both a corresponding first-type and a corresponding second-type decision model. This allows for anomaly detection based on each type of time series and its corresponding decision model, thereby improving the accuracy of time series anomaly detection.

[0297] The following is combined Figure 6 Another method 600 for detecting abnormal traffic provided in the embodiments of this application will be described in detail.

[0298] Figure 6 The method shown can be performed by a traffic anomaly detection device, which can be a server with traffic anomaly detection capabilities.

[0299] Figure 6 The method shown includes steps 610 to 640. These steps are described in detail below.

[0300] 610. Obtain the target time series; the target time series includes N elements, which correspond to N time points. Each of the N elements is the traffic data received at the corresponding time point.

[0301] 620. Based on the target time series, obtain the target parameters of the target time series. The target parameters include the period factor and / or jitter density. The period factor is used to represent a wave-like variation around the long-term trend in the target time series, and the jitter density is used to represent the deviation between the actual value and the target value of the target time series within the target time.

[0302] Optionally, each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component; a first sub-time series including the N periodic components and a second sub-time series including the N residual components are determined, and the target parameters of the target time series are obtained based on the first sub-time series or the second sub-time series.

[0303] Optionally, based on the first sub-time series, it can be determined whether the target time series has a periodic factor.

[0304] Specifically, if N periodic components exist in the first sub-time series, the target time series is determined to have a periodic factor; if N periodic components do not exist in the first sub-time series, the target time series is determined to not have a periodic factor.

[0305] Optionally, if the target time series has a periodic factor, the periodic factor S can be set to 1 by default; if the target time series does not have a periodic factor, the periodic factor S can be set to 0 by default.

[0306] Optionally, the jitter density of the target time series is determined based on the second sub-time series.

[0307] Specifically, the server determines R of the target time series according to the following formula:

[0308]

[0309] Where R is the jitter density, r n It can be determined using the following formula:

[0310]

[0311] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0312] N is determined according to the following formula:

[0313]

[0314] T is the length of the target time series, W is the window length of the window to which the data is added, and α is the first preset value.

[0315] For any content not described in steps 610 and 620 above, please refer to the description of steps 210 and 220 in method 200 above, which will not be repeated here.

[0316] 630. Determine the first parameter set to which the target parameter belongs from multiple parameter sets.

[0317] Optionally, the set of multiple parameters can be {S=1}, {S=0}, {R>β}, {R≤β}.

[0318] For example, if the jitter density of the target time series is 4 when β equals 2, then the first parameter set can be determined to be {R > β}. If the jitter density of the target time series is 1, then the first parameter set can be determined to be {R ≤ β}.

[0319] For example, if the target sequence has a periodic factor, then S = 1, that is, the first parameter set is {S = 1}; if the target sequence does not have a periodic factor, then S = 0, that is, the first parameter set is {S = 0}.

[0320] 640. Based on the first type of judgment model corresponding to the first parameter set, detect abnormal situations in the target time series. Each parameter set in the multiple parameter sets corresponds to a type of judgment model, and the judgment model is used for traffic anomaly detection.

[0321] Optionally, based on the fifth mapping relationship and the first parameter set to which the target parameter belongs, the first type of judgment model corresponding to the first parameter set is determined. The fifth mapping relationship includes the correspondence between multiple parameter sets and multiple first type judgment models.

[0322] Specifically, a third sub-time series comprising N trend components is determined; the second time series is divided into M sub-series of target length, where M is a positive integer, and the second time series is either the third sub-time series or formed based on the third sub-time series and the linear segmentation algorithm PLR; the matrix profile MP values ​​of the M sub-series of target length are calculated, and the matrix profile MP values ​​of the M sub-series of target length constitute the MP time series; anomalies in the target time series are detected based on the MP time series and the N-sigma algorithm.

[0323] Specifically, based on the MP time series and the N-sigma algorithm, traffic anomalies in the MP time series can be detected. The time corresponding to the traffic anomaly in the MP time series is the time of the traffic anomaly in the target time series. Thus, the traffic anomalies in the target time series can be obtained from the traffic anomalies in the MP time series.

[0324] Optionally, after detecting anomalies in the target time series based on the first type of judgment model corresponding to the first parameter set, the anomaly points of the target time series can be output.

[0325] Optionally, the above method 600 may further include step 650.

[0326] 650. Based on the second sub-time series and the second type of judgment model corresponding to the first parameter set, the second type of judgment model for the abnormal situation of the target time series is the N-sigma model.

[0327] Based on the fourth mapping relationship and the first parameter set to which the target parameter belongs, the second-class decision model corresponding to the first parameter set is determined. The fourth mapping relationship includes the correspondence between multiple parameter sets and multiple second-class decision models.

[0328] Specifically, based on the second sub-time series and the second type of judgment model corresponding to the first parameter set, traffic anomalies in the second sub-time series can be detected. The time corresponding to the traffic anomaly in the second sub-time series is the time of the traffic anomaly in the target time series. Thus, the traffic anomalies in the target time series can be obtained based on the traffic anomalies in the second sub-time series.

[0329] Optionally, after detecting anomalies in the target time series based on the second-class judgment model corresponding to the first parameter set, the anomaly points of the target time series can be output.

[0330] like Figure 7 As shown, due to service switching or equipment failure, port traffic may experience prolonged overall changes. This type of anomaly can be categorized as baseline traffic anomaly. Therefore, this application provides another traffic anomaly detection method 800 to perform baseline traffic anomaly detection. The following section combines... Figure 8 Another method 800 for detecting abnormal traffic provided in the embodiments of this application will be described in detail.

[0331] Figure 8 The method shown can be performed by a traffic anomaly detection device, which can be a server with traffic anomaly detection capabilities.

[0332] Figure 8 The method includes steps 810 to 840. These steps are described in detail below.

[0333] 810. Obtain the target time series, which includes N elements, each corresponding to a time point. Each of the N elements represents the traffic data received at the corresponding time point.

[0334] 820. Decompose each of the N elements in the target time series into a trend component, a periodic component, and a residual component; determine a third sub-time series including the N trend components.

[0335] Optionally, according to the TSD algorithm, each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component.

[0336] 830. Divide the second time series into M subsequences of target length, where M is a positive integer, and the second time series is the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR.

[0337] Optionally, the target length is specified by the communication protocol.

[0338] 840. Calculate the matrix profile MP values ​​of M target length subsequences. The matrix profile MP values ​​of the M target length subsequences form the MP time series.

[0339] For any content not described in steps 810 to 840 above, please refer to the description of the corresponding steps in method 400 above, and it will not be repeated here.

[0340] 850. Based on the third type of judgment model, detect abnormal situations in MP time series.

[0341] The decision model for the third category is the N-sigma model.

[0342] Based on the MP time series and the third-class judgment model, traffic anomalies in the MP time series can be detected. The time corresponding to the traffic anomaly in the MP time series is the time of the traffic anomaly in the target time series. Thus, the traffic anomalies in the target time series can be obtained from the traffic anomalies in the MP time series.

[0343] Optionally, based on the MP time series and the third-class judgment model, after detecting the anomalies in the MP time series, the traffic anomalies in the target time series can be obtained, and then the anomaly points in the target time series can be output.

[0344] The above method 800 may also include step 860.

[0345] 860. Determine a second sub-time series comprising N residual components. Based on the second sub-time series and the third-class judgment model, detect anomalies in the second sub-time series. The second sub-time series is a time series formed by decomposing the residual components of each of the N elements in the target time series.

[0346] Specifically, based on the judgment model of the second sub-time series and the third type, traffic anomalies in the second sub-time series can be detected. The time corresponding to the traffic anomaly in the second sub-time series is the time of the traffic anomaly in the target time series. Thus, the traffic anomalies in the target time series can be obtained based on the traffic anomalies in the second sub-time series.

[0347] Then, based on the third type of judgment model, after detecting the abnormalities in the second sub-time series, the abnormal points in the second sub-time series can be output.

[0348] The above, combined with Figure 2 This application details the method for classifying traffic patterns according to embodiments, and combines... Figures 4 to 8 The method for detecting abnormal traffic according to embodiments of this application is described in detail below. Figure 9 This application provides a detailed description of the traffic pattern classification model training method and its combination with... Figures 10 to 12 This application provides a detailed description of the training method for the traffic anomaly detection model provided in its embodiments.

[0349] Figure 9 This is a schematic flowchart of a traffic pattern classification model training method 900 provided in an embodiment of this application. Figure 9 The method shown can be executed by devices with strong computing power, such as computer devices, server devices, or computing devices. Figure 9 The method shown includes steps 910 to 940, which will be described in detail below.

[0350] 910. Obtain the first time series, which includes N elements, each corresponding to a time point. Each of the N elements represents the traffic data received at the corresponding time point.

[0351] Optionally, each element in the first time series, representing the traffic data received at the corresponding time, can be understood as each element in the first time series representing the historical traffic data received at the corresponding time.

[0352] Optionally, multiple first time series can also be obtained.

[0353] 920. Based on the original classification model of the first time series, obtain the first type of the first time series.

[0354] Optionally, the steps of the original classification model include steps 1 through 4.

[0355] Step 1: According to the TSD algorithm, decompose each of the N elements in the first time series into a trend component, a periodic component, and a residual component; determine the first sub-time series including N periodic components and the second sub-time series including N residual components.

[0356] Step 2: Determine the periodicity factor of the first time series based on the N periodic components in the first sub-time series. If the N periodic components in the first sub-time series exist, the periodicity factor of the first time series exists and can be set to 1; if the N periodic components in the first sub-time series do not exist, the periodicity factor of the first time series does not exist and can be set to 0.

[0357] Step 3: Determine the jitter density of the first time series based on the N residual components in the second sub-time series.

[0358] Specifically, R for the first time series is determined according to the following formula:

[0359]

[0360] Where R is the jitter density, r n It can be determined using the following formula:

[0361]

[0362] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0363] N is determined according to the following formula:

[0364]

[0365] T is the length of the first time series, W is the window length of the window to which the data is added, and α is the first preset value.

[0366] Step 4: Determine the first type of the first time series based on the period factor S and the jitter density R.

[0367] When S exists, the first type of the first time series is periodic; when S does not exist, the first type of the first time series is aperiodic; when R is greater than a second preset value, the first type of the first time series is spurious; when R is less than or equal to the second preset value, the first type of the first time series is stationary; when S exists and R is greater than the second preset value, the first type of the first time series is periodic spurious; when S exists and R is less than or equal to the second preset value, the first type of the first time series is periodic stationary; when S does not exist and R is greater than the second preset value, the first type of the first time series is aperiodic spurious; when S does not exist and R is less than or equal to the second preset value, the first type of the first time series is aperiodic stationary.

[0368] 930. Obtain the original type of the first time series.

[0369] 940. Based on the original type and the first type of the first time series, adjust the parameters of the original model of the first time series to obtain the target classification model of the first time series.

[0370] If the original type of the first time series and the first type of the first time series are inconsistent, adjust the parameters of the original model of the first time series. The parameters of the original model of the first time series include a first preset value and a second preset value. If the original type of the first time series is spurious, while the first type of the first time series is stationary, then the first preset value can be reduced accordingly, or the second preset value can be reduced accordingly.

[0371] Optionally, the server can acquire multiple first time series and train a target classification model for the first time series based on the multiple first time series, that is, continuously optimize the target classification model for the first time series based on the multiple first time series models.

[0372] Figure 10 This is a schematic flowchart of another traffic anomaly detection model training method 1000 provided in the embodiments of this application. Figure 10 The method shown can be executed by devices with strong computing power, such as computer devices, server devices, or computing devices. Figure 10 The method shown includes steps 1010 to 1050, which will be described in detail below.

[0373] 1010. Obtain the first time series, which includes N elements, each of which corresponds to N time points. Each of the N elements represents the traffic data received at the corresponding time point.

[0374] Optionally, each element in the first time series, representing the traffic data received at the corresponding time, can be understood as each element in the first time series representing the historical traffic data received at the corresponding time.

[0375] Optionally, multiple first time series can also be obtained.

[0376] 1020. Based on the original classification model of the first time series, obtain the first type of the first time series.

[0377] Optionally, the steps of the original classification model include steps 1 through 4.

[0378] Step 1: According to the TSD algorithm, decompose each of the N elements in the first time series into a trend component, a periodic component, and a residual component; determine the first sub-time series including N periodic components and the second sub-time series including N residual components.

[0379] Step 2: Determine the periodicity factor of the first time series based on the N periodic components in the first sub-time series. If the N periodic components in the first sub-time series exist, the periodicity factor of the first time series exists and can be set to 1; if the N periodic components in the first sub-time series do not exist, the periodicity factor of the first time series does not exist and can be set to 0.

[0380] Step 3: Determine the jitter density of the first time series based on the N residual components in the second sub-time series.

[0381] Specifically, R for the first time series is determined according to the following formula:

[0382]

[0383] Where R is the jitter density, r n It can be determined using the following formula:

[0384]

[0385] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0386] N is determined according to the following formula:

[0387]

[0388] T is the length of the first time series, W is the window length of the window to which the data is added, and α is the first preset value.

[0389] Step 4: Determine the first type of the first time series based on the period factor S and the jitter density R.

[0390] When S exists, the first type of the first time series is periodic; when S does not exist, the first type of the first time series is aperiodic; when R is greater than a second preset value, the first type of the first time series is spurious; when R is less than or equal to the second preset value, the first type of the first time series is stationary; when S exists and R is greater than the second preset value, the first type of the first time series is periodic spurious; when S exists and R is less than or equal to the second preset value, the first type of the first time series is periodic stationary; when S does not exist and R is greater than the second preset value, the first type of the first time series is aperiodic spurious; when S does not exist and R is less than or equal to the second preset value, the first type of the first time series is aperiodic stationary.

[0391] 1030. Based on the judgment model of the first type corresponding to the first category, perform traffic anomaly detection processing on the first time series of the first type to obtain first data, where the first data is the anomaly point of the first time series.

[0392] Optionally, the decision model for the first type includes steps A through D:

[0393] Step A: Determine the third sub-time series, which includes N trend components;

[0394] Step B: Divide the second time series into M subsequences of target length, where M is a positive integer. The second time series is either the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR.

[0395] Step C: Calculate the matrix profile MP values ​​of M target-length subsequences. The matrix profile MP values ​​of the M target-length subsequences form the MP time series.

[0396] Step D: Detect anomalies in the first time series based on the MP time series and the N-sigma algorithm.

[0397] 1040. Obtain the second data, which consists of the original outliers of the first time series;

[0398] 1050. Based on the first data and the second data, adjust the parameters of the first type of determination model to obtain the first target determination model.

[0399] When the first and second data sets are inconsistent, adjust the parameters of the original model for the first time series, including its sensitivity. If the number of data points in the first data set is greater than the number of data points in the second data set, the sensitivity of the original model for the first time series can be lowered accordingly; if the number of data points in the first data set is less than the number of data points in the second data set, the sensitivity of the original model for the first time series can be increased accordingly; if the number of data points in the first data set is equal to the number of data points in the second data set, there is no need to adjust the sensitivity of the original model for the first time series.

[0400] Optionally, the server can acquire multiple first time series and train the first target determination model based on the multiple first time series, that is, continuously optimize the first target determination model based on the multiple first time series.

[0401] Figure 11 This is a schematic flowchart of another traffic anomaly detection model training method 1100 provided in the embodiments of this application. Figure 11 The method shown can be executed by devices with strong computing power, such as computer devices, server devices, or computing devices. Figure 11 The method shown includes steps 1110 to 1150, which will be described in detail below.

[0402] 1110. Obtain the first time series, which includes N elements, each of which corresponds to N time points. Each of the N elements represents the traffic data received at the corresponding time point.

[0403] Optionally, each element in the first time series, representing the traffic data received at the corresponding time, can be understood as each element in the first time series representing the historical traffic data received at the corresponding time.

[0404] Optionally, multiple first time series can also be obtained.

[0405] 1120. Based on the original parameter model of the first time series, obtain the first parameter set of the first time series.

[0406] Optionally, the original parameter model of the first time series may include steps a through d:

[0407] Step a: According to the TSD algorithm, decompose each of the N elements in the first time series into a trend component, a periodic component, and a residual component; determine the first sub-time series including N periodic components and the second sub-time series including N residual components.

[0408] Step b: Determine the periodicity factor of the first time series based on the N periodic components in the first sub-time series. If the N periodic components in the first sub-time series exist, the periodicity factor of the first time series exists and can be set to 1; if the N periodic components in the first sub-time series do not exist, the periodicity factor of the first time series does not exist and can be set to 0.

[0409] Step c: Determine the jitter density of the first time series based on the N residual components in the second sub-time series.

[0410] Specifically, R for the first time series is determined according to the following formula:

[0411]

[0412] Where R is the jitter density, r n It can be determined using the following formula:

[0413]

[0414] Among them, C n x is the nth element in the second sub-time series. n The nth element in the target time series;

[0415] N is determined according to the following formula:

[0416]

[0417] T is the length of the first time series, W is the window length of the window to which the data is added, and α is a first preset value.

[0418] Step d: Determine the first parameter set of the first time series based on the period factor S and the jitter density R.

[0419] The parameter set is {S=1}, {S=0}, {R>β}, {R≤β}.

[0420] 1130. Based on the first type of judgment model corresponding to the first parameter set, perform traffic anomaly detection processing on the first time series to obtain the fourth data, which is the anomaly point of the first time series.

[0421] Optionally, the decision model for the first type includes steps A through D:

[0422] Step A: Determine the third sub-time series, which includes N trend components;

[0423] Step B: Divide the second time series into M subsequences of target length, where M is a positive integer. The second time series is either the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR.

[0424] Step C: Calculate the matrix profile MP values ​​of M target-length subsequences. The matrix profile MP values ​​of the M target-length subsequences form the MP time series.

[0425] Step D: Detect anomalies in the first time series based on the MP time series and the N-sigma algorithm.

[0426] 1140. Obtain the second data, which is the original outlier point of the first time series.

[0427] 1150. Based on the second and fourth data, adjust the parameters of the first type of determination model to obtain the first target determination model.

[0428] When the first and second data sets are inconsistent, adjust the parameters of the first-class decision model, including its sensitivity. If the number of data points in the first data set is greater than the number of data points in the second data set, the sensitivity of the first-class decision model can be lowered accordingly; if the number of data points in the first data set is less than the number of data points in the second data set, the sensitivity of the first-class decision model can be increased accordingly; if the number of data points in the first data set is equal to the number of data points in the second data set, there is no need to adjust the sensitivity of the first-class decision model.

[0429] Optionally, the server can acquire multiple first time series and train the first target determination model based on the multiple first time series, that is, continuously optimize the first target determination model based on the multiple first time series.

[0430] Figure 12 This is a schematic flowchart of another traffic anomaly detection model training method 1200 provided in the embodiments of this application. Figure 12 The method shown can be executed by devices with strong computing power, such as computer devices, server devices, or computing devices. Figure 12 The method shown includes steps 1210 to 1250, which will be described in detail below.

[0431] 1210. Obtain a first time series, which includes N elements, each of which corresponds to one of the N time points, wherein each of the N elements is the traffic data received at the corresponding time point.

[0432] Optionally, each element in the first time series, representing the traffic data received at the corresponding time, can be understood as each element in the first time series representing the historical traffic data received at the corresponding time.

[0433] Optionally, multiple first time series can also be obtained.

[0434] 1220. Process the first time series to obtain the third sub-time series, which is a time series formed by decomposing the trend components of each of the N elements in the first time series.

[0435] Optionally, according to the TSD algorithm, each of the N elements in the first time series is decomposed into a trend component, a periodic component, and a residual component to determine a third sub-time series including N trend components.

[0436] 1230. Based on the fourth type of judgment model, perform traffic anomaly detection processing on the first time series to obtain third data, which is the anomaly point of the first time series.

[0437] The fourth type of determination model includes steps A' to D':

[0438] Step A': Determine the third sub-time series, which includes N trend components;

[0439] Step B': Divide the second time series into M subsequences of target length, where M is a positive integer. The second time series is either the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR.

[0440] Step C': Calculate the matrix profile MP values ​​of M target-length subsequences. The matrix profile MP values ​​of the M target-length subsequences form the MP time series.

[0441] Step D': Detect anomalies in the first time series based on the MP time series and the N-sigma algorithm.

[0442] 1240. Obtain the second data, which consists of the original outliers of the first time series;

[0443] 1250. Based on the second and third data, adjust the parameters of the fourth category determination model to obtain the second target determination model.

[0444] If the first and second data sets are inconsistent, adjust the parameters of the fourth-class decision model, including its sensitivity. If the number of data points in the first data set is greater than the number of data points in the second data set, the sensitivity of the fourth-class decision model can be lowered accordingly; if the number of data points in the first data set is less than the number of data points in the second data set, the sensitivity of the fourth-class decision model can be increased accordingly; if the number of data points in the first data set is equal to the number of data points in the second data set, there is no need to adjust the sensitivity of the fourth-class decision model.

[0445] Optionally, the server can acquire multiple first time series and train the second target determination model based on the multiple first time series, that is, continuously optimize the second target determination model based on the multiple first time series.

[0446] Figure 13 This is a schematic block diagram of a traffic pattern classification device 1300 according to an embodiment of this application. Figure 13 The traffic pattern classification device 1300 shown includes a memory 1301, a processor 1302, a communication interface 1303, and a bus 1304. The memory 1301, processor 1302, and communication interface 1303 are interconnected via the bus 1304.

[0447] The memory 1301 can be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1301 can store programs. When the program stored in the memory 1301 is executed by the processor 1302, the processor 1302 and the communication interface 1303 are used to execute the various steps of the traffic pattern classification method of this embodiment. Specifically, the communication interface 1303 can obtain the target time series from the memory or other devices, and then the processor 8002 classifies the target time series.

[0448] The processor 1302 may be a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), graphics processing unit (GPU), or one or more integrated circuits, for executing related programs to achieve the functions required by the units in the traffic pattern classification device of this application embodiment, or to execute the traffic pattern classification method of this application embodiment.

[0449] The processor 1302 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the traffic pattern classification method in this application embodiment can be completed by the integrated logic circuitry in the processor 1302 or by software instructions.

[0450] The processor 1302 described above can also be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or the execution of a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 1301. The processor 1302 reads the information in memory 1301 and, in conjunction with its hardware, completes the functions required by the units included in the object detection device of the embodiments of this application, or executes the object detection method of the method embodiments of this application.

[0451] The communication interface 1303 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the device 1300 and other devices or communication networks. For example, a target time series can be acquired through the communication interface 1303.

[0452] Bus 1304 may include a pathway for transmitting information between various components of device 1300 (e.g., memory 1301, processor 1302, communication interface 1303).

[0453] Figure 14 This is a schematic block diagram of the flow anomaly detection device 1400 according to an embodiment of this application. Figure 14 The flow anomaly detection device 1400 shown includes a memory 1401, a processor 1402, a communication interface 1403, and a bus 1404. The memory 1401, processor 1402, and communication interface 1403 are interconnected via the bus 1404.

[0454] The memory 1401 can be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1401 can store programs. When the program stored in the memory 1401 is executed by the processor 1402, the processor 1402 and the communication interface 1403 are used to execute the various steps of the traffic anomaly detection method of this application embodiment. Specifically, the communication interface 1403 can obtain the target time series from the memory or other devices, and then the processor 8002 classifies the target time series.

[0455] The processor 1402 may be a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), graphics processing unit (GPU), or one or more integrated circuits, for executing related programs to achieve the functions required by the units in the traffic pattern classification apparatus of this application embodiment, or to execute the traffic pattern classification method of this application embodiment.

[0456] The processor 1402 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the traffic pattern classification method in this embodiment can be completed by the integrated logic circuitry in the processor 1402 or by software instructions.

[0457] The processor 1402 described above can also be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or the execution of a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 1401. The processor 1402 reads the information in memory 1401 and, in conjunction with its hardware, completes the functions required by the units included in the object detection device of the embodiments of this application, or executes the object detection method of the method embodiments of this application.

[0458] The communication interface 1403 uses transceiver devices, such as, but not limited to, transceivers, to enable communication between the device 1400 and other devices or communication networks. For example, a target time series can be obtained through the communication interface 1403.

[0459] Bus 1404 may include a pathway for transmitting information between various components of device 1400 (e.g., memory 1401, processor 1402, communication interface 1403).

[0460] Figure 15 This is a schematic diagram of the hardware structure of the traffic pattern classification model training device 1500 according to an embodiment of this application. Similar to the device 1300 described above, Figure 15 The traffic pattern classification model training device 1500 shown includes a memory 1501, a processor 1502, a communication interface 1503, and a bus 1504. The memory 1501, processor 1502, and communication interface 1503 are interconnected via the bus 1504.

[0461] The memory 1501 can store a program. When the program stored in the memory 1501 is executed by the processor 1502, the processor 1502 is used to execute the various steps of the traffic pattern classification model training method of the present application embodiment.

[0462] The processor 1502 may be a general-purpose CPU, microprocessor, ASIC, GPU or one or more integrated circuits, used to execute relevant programs to implement the traffic pattern classification model training method of the embodiments of this application.

[0463] The processor 1502 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the traffic pattern classification model training method of this application embodiment can be completed by the integrated logic circuitry in the processor 1502 or by software instructions.

[0464] It should be understood that, through Figure 15 The traffic pattern classification model training device 1500 shown trains the traffic pattern classification model, and the trained traffic pattern classification model can be used to execute the traffic pattern classification method of the embodiments of this application.

[0465] Specifically, Figure 15 The device shown can acquire the first time series from the outside through the communication interface 1503, and then the processor trains the classification model of the traffic pattern to be trained based on the first time series.

[0466] Figure 16This is a schematic diagram of the hardware structure of the traffic anomaly detection model training device 1600 according to an embodiment of this application. Similar to the device 1400 described above, Figure 16 The traffic anomaly detection model training device 1600 shown includes a memory 1601, a processor 1602, a communication interface 1603, and a bus 1604. The memory 1601, processor 1602, and communication interface 1603 are interconnected via the bus 1604.

[0467] The memory 1601 can store a program. When the program stored in the memory 1601 is executed by the processor 1602, the processor 1602 is used to execute the various steps of the traffic anomaly detection model training method of the present application embodiment.

[0468] The processor 1602 may be a general-purpose CPU, microprocessor, ASIC, GPU or one or more integrated circuits, used to execute relevant programs to implement the traffic anomaly detection model training method of the embodiments of this application.

[0469] The processor 1602 can also be an integrated circuit chip with signal processing capabilities. In implementation, each step of the traffic pattern classification model training method of this application embodiment can be completed by the integrated logic circuitry in the processor 1602 or by software instructions.

[0470] It should be understood that, through Figure 16 The traffic pattern classification model training device 1600 shown trains the traffic anomaly detection model, and the trained traffic anomaly detection model can be used to execute the traffic anomaly detection method of the present application embodiment.

[0471] Specifically, Figure 16 The device shown can acquire the first time series from the outside through the communication interface 1603, and then the processor can train the traffic anomaly detection model to be trained based on the first time series.

[0472] It should be noted that although the above-described devices 1300, 1400, 1500, and 1600 only show a memory, processor, and communication interface, those skilled in the art should understand that in specific implementations, devices 1300, 1400, 1500, and 1600 may also include other devices necessary for normal operation. Furthermore, depending on specific needs, those skilled in the art should understand that devices 1300, 1400, 1500, and 1600 may also include hardware devices for implementing other additional functions. Moreover, those skilled in the art should understand that devices 1300, 1400, 1500, and 1600 may only include the devices necessary for implementing the embodiments of this application, and may not necessarily include... Figure 13, Figure 14 , Figure 15 and Figure 16 All the devices shown.

[0473] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0474] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0475] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0476] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0477] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0478] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0479] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting abnormal traffic flow, characterized in that, include: Obtain a target time series, which includes N elements, each of which corresponds to N time points, wherein each of the N elements is the traffic data received at the corresponding time point; Based on the target time series, the target parameters of the target time series are obtained. The target parameters include a periodic factor, which is used to represent a wave-like variation around a long-term trend in the target time series. Based on the target parameters, a first type to which the target time series belongs is determined from multiple types, wherein each of the multiple types corresponds to a parameter set, and the target parameters belong to the parameter set corresponding to the first type; Based on the first type of the judgment model corresponding to the first type, anomalies in the target time series are detected, wherein each of the multiple types corresponds to a judgment model of that type, and the judgment model is used for traffic anomaly detection.

2. The method according to claim 1, characterized in that, The target parameter includes jitter density, which is used to represent the deviation between the actual value and the target value of the target time series within the target time period.

3. The method according to claim 2, characterized in that, The step of obtaining the target parameters of the target time series based on the target time series includes: Each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component; Determine a first sub-time series comprising N periodic components and a second sub-time series comprising N residual components; The target parameters of the target time series are obtained based on the first sub-time series or the second sub-time series.

4. The method according to claim 3, characterized in that, The step of obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: Based on the first sub-time series, determine whether the target time series has the periodic factor.

5. The method according to claim 4, characterized in that, The step of determining whether the target time series has the periodic factor based on the first sub-time series includes: If N periodic components exist in the first sub-time series, it is determined that the target time series contains the periodic factor; If the N periodic components in the first sub-time series are absent, it is determined that the target time series does not contain the periodic factor.

6. The method according to claim 3, characterized in that, The method further includes: Based on the first mapping relationship and the first type to which the target time series belongs, a determination model for the second type corresponding to the first type is determined. The first mapping relationship includes the correspondence between the multiple types and the multiple determination models for the second type. Anomalies in the target time series are detected based on the second sub-time series and the second category of the first type of the determination model, wherein the determination model of the second category is an N-sigma model.

7. The method according to claim 3, characterized in that, The step of obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: The jitter density of the target time series is determined based on the second sub-time series.

8. The method according to claim 7, characterized in that, Determining the jitter density of the target time series based on the second sub-time series includes: The jitter density of the target time series is determined according to the following formula: Wherein, R is the jitter density, and the It can be determined using the following formula: Among them, the For the nth element in the second sub-time series, the It is the nth element in the target time series; The N is determined according to the following formula: T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

9. The method according to claim 1, characterized in that, The step of determining the first type to which the target time series belongs from multiple types based on the target parameters includes: Based on the target parameter, determine the first parameter set to which the target parameter belongs from multiple parameter sets; Based on the third mapping relationship and the first parameter set, the first type to which the target time series belongs is determined from multiple types, wherein the third mapping relationship includes the correspondence between the multiple parameter sets and the multiple types.

10. The method according to claim 3, characterized in that, The step of detecting anomalies in the target time series based on the determination model corresponding to the first type includes: Determine a third sub-time series comprising N of the aforementioned trend components; The second time series is divided into M subsequences of target length, where M is a positive integer. The second time series is the third subsequence or the second time series is formed based on the third subsequence and the linear segmentation algorithm PLR. Calculate the matrix profile MP values ​​of M target-length subsequences, and the matrix profile MP values ​​of the M target-length subsequences constitute the MP time series; Based on the MP time series and the N-sigma algorithm, anomalies in the target time series are detected.

11. The method according to any one of claims 1 to 10, characterized in that, Before detecting anomalies in the target time series based on the determination model corresponding to the first type, the method further includes: Based on the second mapping relationship and the first type to which the target time series belongs, a determination model for the first category corresponding to the first type is determined. The second mapping relationship includes the correspondence between the multiple types and the multiple determination models for the first category.

12. A method for classifying traffic patterns, characterized in that, include: Obtain a target time series, which includes N elements, each of which corresponds to N time points, wherein each of the N elements is the traffic data received at the corresponding time point; Based on the target time series, the target parameters of the target time series are obtained. The target parameters include a periodic factor, which is used to represent a wave-like variation around a long-term trend in the target time series. The target time series is classified according to the target parameters.

13. The method according to claim 12, characterized in that, The target parameter includes jitter density, which is used to represent the deviation between the actual value and the target value of the target time series within the target time period.

14. The method according to claim 13, characterized in that, The step of obtaining the target parameters of the target time series based on the target time series includes: Each of the N elements in the target time series is decomposed into a trend component, a periodic component, and a residual component; Determine a first sub-time series comprising N periodic components and a second sub-time series comprising N residual components; The target parameters of the target time series are obtained based on the first sub-time series or the second sub-time series.

15. The method according to claim 14, characterized in that, The step of obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: Based on the first sub-time series, determine whether the target time series has the periodic factor.

16. The method according to claim 15, characterized in that, The step of determining whether the target time series has the periodic factor based on the first sub-time series includes: If N periodic components exist in the first sub-time series, it is determined that the target time series contains the periodic factor; If the N periodic components in the first sub-time series are absent, it is determined that the target time series does not contain the periodic factor.

17. The method according to claim 16, characterized in that, The step of classifying the target time series according to the target parameters includes: In the presence of the periodic factor, the target time series is determined to be periodic. In the absence of the periodic factor, the target time series is determined to be aperiodic.

18. The method according to claim 14, characterized in that, The step of obtaining the target parameters of the target time series based on the first sub-time series or the second sub-time series includes: The jitter density of the target time series is determined based on the second sub-time series.

19. The method according to claim 18, characterized in that, Determining the jitter density of the target time series based on its residual components includes: The jitter density of the target time series is determined according to the following formula: Wherein, R is the jitter density, and the It can be determined using the following formula: Among them, the For the nth element in the second sub-time series, the It is the nth element in the target time series; The N is determined according to the following formula: T is the length of the target time series, W is the window length of the window to which the data is added, and α is a first preset value.

20. The method according to claim 18 or 19, characterized in that, The step of classifying the target time series according to the target parameters includes: If the jitter density is greater than a second preset value, the target time series is determined to be spiking type; If the jitter density is less than or equal to the second preset value, the target time series is determined to be stationary.

21. An apparatus, characterized in that, include: Memory, used to store programs; A processor for executing a program stored in the memory, wherein when the processor executes the program stored in the memory, the processor is configured to perform the method of any one of claims 1 to 20.

Images