Abnormal data detection method, device, electronic device and storage medium

Abstract

The present disclosure relates to an abnormal data detection method, device, electronic device and storage medium. The method includes: predicting the acquired business attribute data sequence to obtain a predicted baseline of the business attribute data; the business attribute data sequence is periodic data, and the business attribute data includes the number of visits to the business or the attention data of the business object; obtaining the error sequence between the predicted baseline of the business attribute data and the measured data of the business attribute data, fitting the error sequence, and obtaining the limit value of the business attribute data; obtaining the backward difference sequence of the measured data, fitting the difference sequence, and obtaining the jump value of the business attribute data; at least one of the limit value of the business attribute data and the jump value of the business attribute data is incorporated into the predicted baseline of the business attribute data to obtain the business attribute prediction data. Therefore, anomaly detection can be performed on periodic data from multiple dimensions such as the predicted baseline, the limit value and the jump value.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer data processing, and in particular to an abnormal data detection method, device, electronic device and storage medium. Background Art

[0002] With the development of computer Internet technology, various Internet services have emerged. In order to ensure the normal operation of Internet services, it is necessary to monitor the business attribute data generated in Internet services and detect abnormal data. In traditional abnormal data detection methods, thresholds or jump values ​​are usually used for detection, and business attribute data that exceeds the threshold or jump value is determined as abnormal data.

[0003] However, the above-mentioned traditional abnormal data detection method is only applicable to data with stable trends. By comparing with threshold values ​​or jump values, obvious outlier data is determined as abnormal data, but it is unable to detect abnormal data in data with periodicity. Summary of the invention

[0004] The present disclosure provides an abnormal data detection method, device, electronic device and storage medium to at least solve the problem that the related art cannot detect abnormal data in periodic data. The technical solution of the present disclosure is as follows:

[0005] According to a first aspect of an embodiment of the present disclosure, there is provided a method for detecting abnormal data, comprising:

[0006] Predicting the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence;

[0007] Obtaining an error sequence between a predicted baseline of the business attribute data and actual measured data of the business attribute data, fitting the error sequence, and obtaining a limit value of the business attribute data; wherein the limit value of the business attribute data includes an upper limit value and a lower limit value;

[0008] Acquire a backward difference sequence of the measured data, fit the difference sequence, and obtain a jump value of the service attribute data; wherein the jump value includes a jump upper limit value and a jump lower limit value;

[0009] Incorporating at least one of the limit value of the service attribute data and the jump value of the service attribute data into the prediction baseline of the service attribute data to obtain service attribute prediction data;

[0010] Real-time business attribute data is acquired, and the real-time business attribute data that is outside the restricted interval formed by the business attribute prediction data is determined as abnormal data.

[0011] In an exemplary embodiment, predicting the acquired service attribute data sequence to obtain a prediction baseline of the service attribute data includes:

[0012] Dividing the service attribute data sequence according to the frequency of the service attribute data sequence to obtain at least two first target service attribute data sequences;

[0013] Predict each of the first target service attribute data sequences respectively to obtain prediction data corresponding to the first target service attribute data sequence;

[0014] The at least two types of prediction data are weighted to obtain a prediction baseline for the business attribute data.

[0015] In an exemplary embodiment, the at least two first target business attribute data sequences include a trend component of the business attribute data sequence and a period component of the business attribute data sequence;

[0016] The step of predicting each of the first target service attribute data sequences to obtain prediction data corresponding to the first target service attribute data sequence comprises:

[0017] Predicting the trend component of the business attribute data sequence to obtain trend prediction data;

[0018] The periodic component of the service attribute data sequence is predicted to obtain periodic prediction data.

[0019] In an exemplary embodiment, predicting the periodic component of the service attribute data sequence to obtain periodic prediction data includes:

[0020] Performing mean analysis processing on the business attribute data sequence, determining the prediction data corresponding to the target prediction point for which no business attribute data exists, and obtaining the trend prediction data; wherein the mean analysis processing includes determining the value of the to-be-predicted point according to the data within a preset range of the to-be-predicted point in the business attribute data sequence; the position corresponding to the target prediction point is the to-be-predicted point, and the trend prediction data is the value of the to-be-predicted point;

[0021] Obtain a cutoff frequency corresponding to the business attribute data sequence, fit the periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expand the periodic component to obtain the periodic prediction data; wherein the cutoff frequency represents the maximum frequency for fitting the periodic component corresponding to the business attribute data sequence.

[0022] In an exemplary embodiment, obtaining the cutoff frequency corresponding to the service attribute data sequence, fitting the periodic component corresponding to the service attribute data sequence under the restriction of the cutoff frequency, and expanding the periodic component to obtain the periodic prediction data includes:

[0023] Acquire a phase sequence of the service attribute data sequence, and acquire a spectrum amplitude corresponding to the phase sequence;

[0024] Normalizing the spectrum amplitudes and arranging them in ascending order to obtain the spectrum amplitude sequence;

[0025] The frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value is determined as the cutoff frequency.

[0026] In an exemplary embodiment, before predicting the periodic component of the service attribute data sequence to obtain periodic prediction data, the method includes:

[0027] Obtaining an initial business attribute data sequence;

[0028] Acquire initial service attribute data from the initial service attribute data sequence according to a preset first time sequence to obtain at least one second target service attribute data;

[0029] Performing the mean analysis process on the second target business attribute data to determine the first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted;

[0030] The first service attribute update data is used to replace the corresponding initial service attribute data in the initial service attribute data sequence to obtain the service attribute data sequence.

[0031] In an exemplary embodiment, the point to be predicted is a point in periodic data;

[0032] The mean value analysis process includes:

[0033] In a period before the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain first initial data;

[0034] In a period after the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain second initial data;

[0035] Acquire third initial data and fourth initial data adjacent to the point to be predicted, and acquire an initial value corresponding to the point to be predicted;

[0036] Obtain a weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, and obtain a first edge weight corresponding to the first initial data, a second edge weight corresponding to the second initial data, a third edge weight corresponding to the third initial data, and a fourth edge weight corresponding to the fourth initial data;

[0037] weighting the first initial data, the second initial data, the third initial data, and the fourth initial data according to a preset third weight vector to obtain a prediction value corresponding to the point to be predicted;

[0038] The predicted value is adopted to replace the initial value, and the process of obtaining the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value is returned to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data is obtained, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

[0039] In an exemplary embodiment, the step of weighting the at least two types of prediction data to obtain a prediction baseline for the business attribute data includes:

[0040] Obtaining a first weight vector and random noise;

[0041] The trend prediction data, the period prediction data and the random noise are weighted according to the first weight vector to obtain a prediction baseline for the business attribute data.

[0042] In an exemplary embodiment, after weighting the trend prediction data, the period prediction data, and the random noise according to the first weight vector to obtain the prediction baseline of the business attribute data, the method further includes:

[0043] Acquire the service attribute data from the service attribute data sequence according to the preset second time sequence to obtain at least one third target service attribute data;

[0044] According to a preset second weight vector, weighting the third target service attribute data within a preset time period of the third target service attribute data is performed to obtain second service attribute update data;

[0045] The second business attribute update data is used to replace the corresponding business attribute data in the prediction baseline of the business attribute data to obtain the updated prediction baseline of the business attribute data.

[0046] In an exemplary embodiment, the acquiring of real-time business attribute data and determining the real-time business attribute data outside the restricted interval formed by the business attribute prediction data as abnormal data includes:

[0047] Comparing the real-time service attribute data with the limit value of the service attribute data and the jump value of the service attribute data in the service attribute prediction data;

[0048] The real-time service attribute data that is outside the limit value of the service attribute data and the jump value range of the service attribute data is determined as the abnormal data.

[0049] According to a second aspect of an embodiment of the present disclosure, there is provided an abnormal data detection device, comprising:

[0050] A baseline prediction unit is configured to perform prediction on the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence;

[0051] A limit value prediction unit is configured to execute to obtain an error sequence between a prediction baseline of the business attribute data and actual measured data of the business attribute data, and to fit the error sequence to obtain a limit value of the business attribute data; wherein the limit value of the business attribute data includes a limit upper limit value and a limit lower limit value;

[0052] A jump value prediction unit is configured to execute the backward difference sequence of the measured data, fit the difference sequence, and obtain the jump value of the service attribute data; wherein the jump value includes a jump upper limit value and a jump lower limit value;

[0053] A service attribute prediction unit, configured to merge at least one of the limit value of the service attribute data and the jump value of the service attribute data into a prediction baseline of the service attribute data to obtain service attribute prediction data;

[0054] The abnormal data detection unit is configured to acquire real-time business attribute data and determine the real-time business attribute data outside the restricted interval formed by the business attribute prediction data as abnormal data.

[0055] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0056] Dividing the service attribute data sequence according to the frequency of the service attribute data sequence to obtain at least two first target service attribute data sequences;

[0057] Predict each of the first target service attribute data sequences respectively to obtain prediction data corresponding to the first target service attribute data sequence;

[0058] The at least two types of prediction data are weighted to obtain a prediction baseline for the business attribute data.

[0059] In an exemplary embodiment, the at least two first target business attribute data sequences include a trend component of the business attribute data sequence and a period component of the business attribute data sequence;

[0060] The baseline prediction unit is further configured to perform:

[0061] Predicting the trend component of the business attribute data sequence to obtain trend prediction data;

[0062] The periodic component of the service attribute data sequence is predicted to obtain periodic prediction data.

[0063] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0064] Performing mean analysis processing on the business attribute data sequence, determining the prediction data corresponding to the target prediction point for which no business attribute data exists, and obtaining the trend prediction data; wherein the mean analysis processing includes determining the value of the to-be-predicted point according to the data within a preset range of the to-be-predicted point in the business attribute data sequence; the position corresponding to the target prediction point is the to-be-predicted point, and the trend prediction data is the value of the to-be-predicted point;

[0065] Obtain a cutoff frequency corresponding to the business attribute data sequence, fit the periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expand the periodic component to obtain the periodic prediction data; wherein the cutoff frequency represents the maximum frequency for fitting the periodic component corresponding to the business attribute data sequence.

[0066] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0067] Acquire a phase sequence of the service attribute data sequence, and acquire a spectrum amplitude corresponding to the phase sequence;

[0068] Normalizing the spectrum amplitudes and arranging them in ascending order to obtain the spectrum amplitude sequence;

[0069] The frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value is determined as the cutoff frequency.

[0070] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0071] Obtaining an initial business attribute data sequence;

[0072] Acquire initial service attribute data from the initial service attribute data sequence according to a preset first time sequence to obtain at least one second target service attribute data;

[0073] Performing the mean analysis process on the second target business attribute data to determine the first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted;

[0074] The first service attribute update data is used to replace the corresponding initial service attribute data in the initial service attribute data sequence to obtain the service attribute data sequence.

[0075] In an exemplary embodiment, the point to be predicted is a point in periodic data;

[0076] The baseline prediction unit is further configured to perform:

[0077] In a period before the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain first initial data;

[0078] In a period after the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain second initial data;

[0079] Acquire third initial data and fourth initial data adjacent to the point to be predicted, and acquire an initial value corresponding to the point to be predicted;

[0080] Obtain a weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, and obtain a first edge weight corresponding to the first initial data, a second edge weight corresponding to the second initial data, a third edge weight corresponding to the third initial data, and a fourth edge weight corresponding to the fourth initial data;

[0081] weighting the first initial data, the second initial data, the third initial data, and the fourth initial data according to a preset third weight vector to obtain a prediction value corresponding to the point to be predicted;

[0082] The predicted value is adopted to replace the initial value, and the process of obtaining the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value is returned to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data is obtained, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

[0083] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0084] Obtaining a first weight vector and random noise;

[0085] The trend prediction data, the period prediction data and the random noise are weighted according to the first weight vector to obtain a prediction baseline for the business attribute data.

[0086] In an exemplary embodiment, the baseline prediction unit is further configured to perform:

[0087] Acquire the service attribute data from the service attribute data sequence according to the preset second time sequence to obtain at least one third target service attribute data;

[0088] According to a preset second weight vector, weighting the third target service attribute data within a preset time period of the third target service attribute data is performed to obtain second service attribute update data;

[0089] The second business attribute update data is used to replace the corresponding business attribute data in the prediction baseline of the business attribute data to obtain the updated prediction baseline of the business attribute data.

[0090] In an exemplary embodiment, the abnormal data detection unit is further configured to perform:

[0091] Comparing the real-time service attribute data with the limit value of the service attribute data and the jump value of the service attribute data in the service attribute prediction data;

[0092] The real-time service attribute data that is outside the limit value of the service attribute data and the jump value range of the service attribute data is determined as the abnormal data.

[0093] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0094] processor;

[0095] a memory for storing instructions executable by the processor;

[0096] The processor is configured to execute the instructions to implement the abnormal data detection method described in any one of the embodiments of the first aspect above.

[0097] According to a fourth aspect of an embodiment of the present disclosure, a storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the abnormal data detection method described in any one of the embodiments of the first aspect above.

[0098] According to a fifth aspect of the embodiments of the present disclosure, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the abnormal data detection method in any one of the embodiments of the first aspect.

[0099] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0100] By predicting the acquired business attribute data sequence, a prediction baseline of the business attribute data is obtained, and an error sequence between the prediction baseline of the business attribute data and the measured data of the business attribute data is obtained, the error sequence is fitted, the limit value of the business attribute data is obtained, the backward difference sequence of the measured data is obtained, and the difference sequence is fitted to obtain the jump value of the business attribute data. Thus, a prediction baseline of the business attribute data based on the business attribute data sequence, a limit value of the business attribute data for limiting the prediction upper limit and the prediction lower limit, and a jump value of the business attribute data for limiting the jump value can be obtained, and the prediction baseline of the business attribute data and at least one of the limit value of the business attribute data and the jump value of the business attribute data are determined as business attribute prediction data, the business attribute data sequence is predicted from multiple dimensions, and anomaly detection is performed on real-time business attribute data with periodic changes through the prediction baseline, the limit value of the business attribute data, and the jump value of the business attribute data.

[0101] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0103] Figure 1 The figure is a flow chart of a method for detecting abnormal data according to an exemplary embodiment.

[0104] Figure 2 is a schematic diagram of kernel density fitting according to an exemplary embodiment.

[0105] Figure 3 is a flowchart of an implementable method of step S100 according to an exemplary embodiment.

[0106] Figure 4 It is a schematic diagram of trend prediction data according to an exemplary embodiment.

[0107] Figure 5 is a flow chart showing a method for determining a cutoff frequency according to an exemplary embodiment.

[0108] Figure 6 is a schematic diagram of a method for determining a cutoff frequency according to a specific exemplary embodiment.

[0109] Figure 7 It is a flowchart of an implementable method before step S120 according to an exemplary embodiment.

[0110] Figure 8 is a flowchart of an implementable method of mean value analysis processing according to an exemplary embodiment.

[0111] Fig. 9 is a schematic diagram of a mean analysis method according to an exemplary embodiment.

[0112] Fig.10 is a flowchart of an implementable method of step S130 according to an exemplary embodiment.

[0113] Fig.11 It is a flowchart of an implementable method after step S130 according to an exemplary embodiment.

[0114] Fig.12 The figure is a schematic diagram of data recovery according to an exemplary embodiment.

[0115] Fig.13 is a flowchart of an implementable method of step S500 according to an exemplary embodiment.

[0116] Fig.14 The figure is a block diagram of an abnormal data detection device according to an exemplary embodiment.

[0117] Fig.15 The invention is a block diagram of a device for detecting abnormal data according to an exemplary embodiment. DETAILED DESCRIPTION

[0118] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0119] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0120] Figure 1 This is a flowchart of an abnormal data detection method according to an exemplary embodiment. This exemplary embodiment uses the method applied to a computer device as an example. It can be understood that the method can also be applied to a server, and can also be applied to a system including a computer device and a server, and is implemented through the interaction between the computer device and the server. Specifically, the following steps are included:

[0121] In step S100, the acquired business attribute data sequence is predicted to obtain a prediction baseline for the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the business visits or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence.

[0122] In step S200, the error sequence between the predicted baseline of the business attribute data and the measured data of the business attribute data is obtained, and the error sequence is fitted to obtain the limit value of the business attribute data; wherein the limit value of the business attribute data includes a limit upper limit value and a limit lower limit value.

[0123] In step S300, a backward difference sequence of measured data is obtained, and the difference sequence is fitted to obtain a jump value of the service attribute data; wherein the jump value of the service attribute data includes a jump upper limit value and a jump lower limit value.

[0124] In step S400, at least one of the limit value of the service attribute data and the jump value of the service attribute data is incorporated into the prediction baseline of the service attribute data to obtain the service attribute prediction data.

[0125] In step S500, real-time business attribute data is acquired, and the real-time business attribute data outside the restricted range formed by the business attribute prediction data is determined as abnormal data.

[0126] Among them, the visit volume of the service refers to the access frequency of the service service, the server port pressure, etc., and the attention data of the business object refers to the attention data of the service service. For example, when a business service is an audio and video work, the attention data of the business object refers to the likes, comments or forwarding volume of the audio and video work. The upper limit value refers to the maximum value of the service attribute data. The lower limit value refers to the minimum value of the service attribute data. The jump upper limit value refers to the maximum value of the difference between a certain position data and the previous position data. The jump lower limit value refers to the minimum value of the difference between a certain position data and the previous position data. Real-time service attribute data refers to the service attribute data generated in real time during normal operation.

[0127] Specifically, a periodic business attribute data sequence is obtained, and the business attribute data sequence is predicted to obtain a predicted baseline of the business attribute data. Next, an error sequence between the predicted baseline of the business attribute data and the measured data of the business attribute data is obtained, and the error sequence is fitted to obtain a limit value of the business attribute data, and the upper limit value and the lower limit value of the limit value of the business attribute data are the upper and lower limits of the predicted baseline of the business attribute data. At the same time, a backward difference sequence of the measured data is obtained, and the difference sequence is fitted to obtain a jump value of the business attribute data, and the jump value of the business attribute data includes a jump upper limit value and a jump lower limit value, which are used to limit the jump data. And one or all of the limit value of the business attribute data and the jump value of the business attribute data are incorporated into the predicted baseline of the business attribute data to obtain business attribute prediction data. After obtaining the business attribute prediction data, that is, the trend and limit value of the business attribute data are obtained, the real-time business attribute data obtained in real time during the operation process can be detected. When the real-time business attribute data is located within the restricted interval formed by the business attribute prediction data, the real-time business attribute data is determined to be normal data. When the real-time service attribute data is outside the restricted range formed by the service attribute prediction data, the real-time service attribute data is determined to be abnormal data.

[0128] In the above abnormal data detection method, the predicted baseline of the business attribute data is obtained by predicting the acquired business attribute data sequence, and the error sequence between the predicted baseline of the business attribute data and the measured data of the business attribute data is obtained, the error sequence is fitted, the limit value of the business attribute data is obtained, the backward difference sequence of the measured data is obtained, and the difference sequence is fitted to obtain the jump value of the business attribute data. In this way, the predicted baseline of the business attribute data based on the business attribute data sequence, the limit value of the business attribute data used to limit the prediction upper limit and the prediction lower limit, and the jump value of the business attribute data used to limit the jump value can be obtained, and the predicted baseline of the business attribute data and at least one of the limit value of the business attribute data and the jump value of the business attribute data are determined as the business attribute prediction data, the business attribute data sequence is predicted from multiple dimensions, and the real-time business attribute data with periodic changes are jointly detected for abnormality through the predicted baseline, the limit value of the business attribute data and the jump value of the business attribute data.

[0129] In an exemplary embodiment, a possible implementation of step S200 includes:

[0130] Specifically, for the predicted baseline f(t) of the service attribute data, the difference between f(t) and the corresponding historical service attribute data h(t) is made to obtain an error sequence, and the length of the error sequence is the same as the length of the historical data. It should be noted that the "error" here can be an absolute error, that is, the error at any point e(t) = h(t)-f(t); a relative error (normalized error) can be used, that is, the error at any point e(t) = [h(t)-f(t)] / f(t) (f(t) is not 0); a "semi-normalized error" ("root normalized error" or "Poisson standard deviation multiple") between the absolute error and the relative error can also be used, and its expression is e(t) = [h(t)-f(t)] / sqrt[f(t)]. If the absolute error is used, the upper and lower bounds of the error can be directly added to the predicted baseline of the service attribute data to generate the limit value of the service attribute data. If the relative error is used, the upper and lower bounds of the error need to be multiplied by the value of the predicted baseline of the business attribute data and then added to the predicted baseline of the business attribute data to generate the limit value of the business attribute data. If the semi-normalized error is used, the upper and lower bounds of the error need to be multiplied by the value of the predicted baseline under the square root and then added to the predicted baseline of the business attribute data to generate the limit value of the business attribute data.

[0131] Optionally, Gaussian kernel density estimation can be used to fit the error sequence. Assuming that the error sequence is Gaussian distributed, it is more reasonable to use semi-normalized error or relative error for quantity data (the number of times an event occurs per minute), and it is more reasonable to use absolute error for rate data (such as packet loss rate, etc.). The three methods will produce different degrees of tightness of the upper and lower bounds during the low peak period of the quantity data. The normalized error calculation method will make the upper and lower bounds of the low peak period data particularly tight, while the non-normalized error calculation method will make the low peak period data very loose.

[0132] In the above exemplary embodiment, the error sequence between the predicted baseline of the business attribute data and the measured data of the business attribute data is taken, and the error sequence is fitted to obtain the limit value of the business attribute data including the upper limit value and the lower limit value. This can provide a data basis for predicting the business attribute data sequence from multiple dimensions, and predict and limit the periodic data under the limit value of the business attribute data.

[0133] In an exemplary embodiment, a possible implementation of step S300 includes:

[0134] Specifically, for the historical data h(t), calculate its backward difference sequence of 1 to K steps (a total of K sequences). Assuming that the value of the historical data at time t is h(t), then the value of its k-step (k is selected from 1 to K) backward difference at time t is d[t,k]=h(t)-h(tk). For the leftmost side of the data (for example, t=0), since there is no data on the left side, its differential value can be ignored, or it can be forcibly calculated through some left-side extension methods (such as constant extension, linear extension, and periodic extension, etc.). The upper limit K of k can be set as needed. If K is set to 1, it means that only 1 step of backward difference data needs to be calculated. Using this sequence, the "k-step jump upper and lower bounds" (there are several sets of upper and lower bounds corresponding to the values ​​of k) can be calculated in subsequent processing.

[0135] In the above exemplary embodiment, a 1-k step backward difference sequence between the measured data of the business attribute data is taken, and the difference sequence is fitted to obtain the jump value of the business attribute data including the jump upper limit value and the jump lower limit value. This can provide a data basis for predicting the business attribute data sequence from multiple dimensions, and predict and limit the periodic data under the restriction of the jump value of the business attribute data.

[0136] Figure 2 is a schematic diagram of kernel density fitting according to an exemplary embodiment, which is an implementable method of the fitting method in steps S200 and S300, including:

[0137] The stacks are stacked according to the unit time length (e.g., "days"), and the left and right widths of the stacks are L (number of points per unit time length) and N (period length). Any column represents the value at a certain moment of the unit time length. To calculate the upper and lower limits (upper and lower bounds) of the value at each moment, you can refer to the data near the current time point. If the time window is r, r×N data are needed to calculate the upper and lower limits of the current moment (r is generally 1 to 3 for data with a period of days and a resolution of minutes).

[0138] For fitting, the Gaussian kernel KDE algorithm can be used. This algorithm fits the input data into the superposition of multiple Gaussian distributions, so that its cumulative probability distribution can be obtained. In its cumulative probability distribution curve, find the lower quantile with a value of ρ and the upper quantile with a value of ρ (generally around 0.005), which can be used as the upper and lower limits of the point. Depending on the input data, the output of KDE represents different meanings. When the input is an error sequence, the upper and lower limits of its output represent the upper and lower limits of the fitting error. Adding it to the prediction baseline of the business attribute data represents the upper and lower limits of the fitting and prediction. When a 1 to k step backward difference sequence is input, the upper and lower limits of its output represent the range that can be tolerated for a single-step jump of the measured data, that is, the jump upper limit and jump lower limit.

[0139] Optionally, the upper limit and lower limit are calculated independently, so that the calculated upper limit and lower limit fluctuate violently in the time dimension, so it is necessary to find a suitable smooth envelope. Optionally, the upper boundary envelope can be obtained by multiple max&mean methods, and the lower boundary envelope can be obtained by multiple min&mean. Here, the upper limit is taken as an example, specifically, for any point of the business attribute data, the maximum value is calculated in a time window of length w near it, and then the average value is calculated for any point in the time window of length w near it. Repeat the process for a preset number of times or until the graph is stable or. In order to make the smoothness of the graph fluctuation more suitable for the characteristics of the data itself, the size of the time window w here can be calculated according to the cutoff frequency (the specific calculation method of the cutoff frequency is shown below) M, and a negative correlation function such as w=L / M is used. The maximum and minimum values ​​of w can also be limited to avoid extreme situations. Finally, a bias value δ (adjustable parameter) can be added to the upper limit and lower limit respectively. The value is expressed as a multiple of the overall upper and lower amplitudes of the current data, so that the upper and lower bounds can be appropriately expanded.

[0140] In the above exemplary embodiments, by determining the limit value of the business attribute data and the jump value of the business attribute data, a data basis can be provided for predicting the business attribute data sequence from multiple dimensions, and under the limit of the limit value of the business attribute data and the jump value of the business attribute data, the data with periodicity can be predicted and limited. The limit value of the predicted baseline business attribute data and the jump value of the business attribute data of the above business attribute data are finally uniformly stored in the model library (for example, they can be implemented using the redis memory database). For all the above training functions, a single-threaded program implemented in python and running on a laptop computer takes 3 seconds to generate a 2-day forecast using 28 days of historical data, and takes 7 seconds to generate a 7-day forecast using 63 days of data.

[0141] Figure 3 is a flowchart of an implementable method of step S100 according to an exemplary embodiment, comprising the following steps:

[0142] In step S110, the business attribute data sequence is divided according to the frequency of the business attribute data sequence to obtain at least two first target business attribute data sequences.

[0143] In step S120, prediction is performed on each first target service attribute data sequence to obtain prediction data corresponding to the first target service attribute data sequence.

[0144] In step S130, at least two types of prediction data are weighted to obtain a prediction baseline for the business attribute data.

[0145] Specifically, the business attribute data sequence is divided according to the frequency of the business attribute data sequence, and the business attribute data sequence is split into at least two sequences with frequency characteristics, that is, at least two first target business attribute data sequences. After obtaining sequences with different frequency characteristics, each first target business attribute data sequence is predicted based on different frequency characteristics of different sequences, so that the prediction result is more targeted and has a higher accuracy. Finally, after obtaining the prediction data corresponding to each first target business attribute data sequence, the at least two prediction data are weighted to obtain the prediction baseline of the business attribute data.

[0146] Optionally, in an exemplary embodiment, an implementable method of step S120 includes: predicting a trend component of the business attribute data sequence to obtain trend prediction data; and predicting a period component of the business attribute data sequence to obtain period prediction data.

[0147] Optionally, the determination of trend prediction data further includes: performing mean analysis on the business attribute data sequence to determine prediction data corresponding to the target to-be-predicted point for which no business attribute data exists, and obtaining trend prediction data.

[0148] Among them, the mean analysis processing includes determining the value of the point to be predicted based on the data within a preset range of the point to be predicted in the business attribute data sequence; the position corresponding to the target prediction point is the point to be predicted, and the trend prediction data is the value of the point to be predicted.

[0149] Specifically, the following uses one week (7 days) as the cycle length of the business attribute data sequence for explanation. Regarding trend prediction data, the general prediction length is set to 1 to 7 days. First, assume that the daily average values ​​of the next few days are the same as the last daily average values, and then mark the business attribute data of these days as unreliable data, and then input all the daily average values ​​into the daily average value analysis algorithm. After the calculation is completed, the daily average value estimates of several days can be obtained, that is, the trend prediction data. Then, the historical daily average value and the predicted daily average value are regarded as a key point in the center of each day, and the missing parts are linearly interpolated to construct a trend line with a length of "historical length + predicted length". Figure 4 It is a schematic diagram of trend prediction data according to an exemplary embodiment, wherein the curve is a business attribute data sequence and the broken line is trend prediction data.

[0150] Optionally, the determination of the periodic prediction data further includes: obtaining a cutoff frequency corresponding to the business attribute data sequence, fitting a periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expanding the periodic component to obtain the periodic prediction data.

[0151] The cutoff frequency refers to the frequency at which the output signal is reduced to 0.707 times of the maximum value while the amplitude of the input signal remains unchanged and the frequency is changed, that is, the -3dB point is the cutoff frequency in terms of frequency response characteristics, and is a special frequency used to illustrate frequency characteristic indicators. In this exemplary embodiment, the cutoff frequency refers to the maximum frequency for fitting periodic service attribute data.

[0152] Specifically, the business attribute data sequence is decomposed in time series. During the decomposition process, a multiplicative model or an additive model can be selected. The multiplicative model is "measured data = trend * (periodic fluctuation + random noise)", and the additive model is "measured data = trend + periodic fluctuation + random noise". The multiplicative model is more effective for data whose fluctuation amplitude increases with the increase, while the additive model is more effective for data whose fluctuation amplitude hardly changes with the increase. The multiplicative model or the additive model can be selected according to the specific situation of the business attribute data. Here, the multiplicative model is used as an example to illustrate. When using the multiplicative model, in order to avoid the situation where some non-summation statistical data are less than or equal to 0, the data can be raised by a fixed value as a whole to ensure that any data point is greater than 0, and the data can be moved back as a whole after fitting. After determining the cutoff frequency corresponding to the business attribute data sequence, the periodic component corresponding to the business attribute data sequence can be fitted under the limit of the cutoff frequency, and the fitted periodic component can be expanded to obtain periodic prediction data.

[0153] For example, based on the cutoff frequency (upper limit of the octave), the appropriate frequency component can be selected to generate the fitting (and prediction) of the periodic term. Since the orthogonal transformation assumes that the left and right outer sides of the finite-length time domain signal are repeated placements of the current signal, in order to extract the weekly periodic characteristics, the length of the time domain signal must be an integer multiple of one week. Among them, extracting fluctuations with a daily cycle and extracting fluctuations with a weekly cycle may use data from different ranges. Therefore, according to the time alignment, it can be intercepted from N days of historical data. For the data of weeks (indicates rounding down), orthogonal transformation is performed on these two data segments to obtain the corresponding frequency domain information. For FFT with multiples of integer days, frequency components of 0, N, 2N...M×N are extracted from them, and the time domain waveform W is restored by trigonometric functions, where M is the optimal multiple frequency value calculated above. It should be noted here that since Lx and x belong to the same frequency in the transformation result, when extracting the frequency component N, not only the subscript N but also the subscript LN should be removed. For the orthogonal components with multiples of integer weeks, frequency components of W, 2W...M'×W are extracted from them, and those frequencies that are integer multiples of N are eliminated (to avoid duplication), and the time domain waveform is restored by trigonometric functions. Here, M' can be used to calculate the cutoff frequency of the period length (one week) alone, or a fixed value can be set, because the periodicity of the week generally has less impact on the shape than the periodicity of the day, and the impact is smaller. Finally, due to the periodicity of the trigonometric function, the period can be extended to the left and right to obtain complete data covering the historical data time period and the time period to be predicted. Finally, by adding the time domain fluctuations with daily periodicity and the time domain fluctuations with weekly periodicity, we can obtain the required fitting and prediction sequence of periodic fluctuations, that is, the periodic prediction data.

[0154] In the above exemplary embodiments, the trend component and the period component of the business attribute data sequence can be predicted respectively, and the trend component of the business attribute data sequence can be predicted by using mean analysis processing; at the same time, under the restriction of the cutoff frequency corresponding to the business attribute data sequence, the period prediction data is determined. Based on the different frequency characteristics of different sequences, predictions are made separately, so that the prediction results are more targeted and more accurate.

[0155] Figure 5 is a flow chart showing a method for determining a cutoff frequency according to an exemplary embodiment, comprising the following steps:

[0156] In step S121, a phase sequence of the service attribute data sequence is obtained, and a spectrum amplitude corresponding to the phase sequence is obtained.

[0157] In step S122, the spectrum amplitudes are normalized and arranged in ascending order to obtain a spectrum amplitude sequence.

[0158] In step S123, the frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value is determined as the cutoff frequency.

[0159] The phase sequence refers to a sequence formed by phase data obtained when the service attribute data sequence is orthogonally decomposed. The first preset value refers to a parameter for controlling the cutoff frequency. Optionally, the first preset value can be

[0160] Specifically, FFT (Fast Fourier Transform) can be used to fit and predict the periodic prediction data. FFT can decompose time series data into multiple orthogonal trigonometric functions. First of all, it should be noted that from the input and output of the algorithm, if the input time series data is of length Z, then a complex sequence of length Z will be obtained, where the modulus of the kth complex number in the sequence represents the amplitude of the cosine function with frequency k, and the phase angle of the kth complex number represents the initial phase of the cosine function with frequency k. For example, assuming that the kth complex number is (1,1), the corresponding trigonometric function expression is: f_k(t)=sqrt(2)× cos(k×t / Z×2π+45°). Among them, k=0 is the DC component, k=Z / 2 is the highest frequency, and k and Zk are trigonometric functions (cos and sin) of the same frequency but orthogonal. Therefore, in the following description, k greater than Z / 2 is regarded as Zk for description (that is, k=Z-1 and k=1 are both components with frequency 1). In addition, if the data length contains N days, L points per day, and the total length Z = N × L, the waveform of its trigonometric function will have a period of days only when k is an integer multiple of N. Similarly, the waveform of its trigonometric function will have a period of weeks only when k is an integer multiple of 7N. Therefore, the "first point" to obtain periodic prediction data is to extract reasonable trigonometric function components from the FFT results, and then weight them to generate periodic prediction data.

[0161] While eliminating "components that are not based on days or weeks", it is also necessary to determine the corresponding "cutoff frequency" to avoid overfitting. Since only components that are integer multiples of N are taken for k, it is necessary to examine the corresponding maximum multiple upper limit "cutoff frequency M", that is, select k = 0, N, ..., M × N. The "second most important point" to obtain periodic prediction data is to determine the value of the maximum multiple upper limit M. Since actual data often have the characteristics of a weekly cycle, it is necessary not only to extract components k = 0, N, ..., M × N with a daily cycle, but also to extract components k = 0, 7N, ..., M' × 7N with a weekly cycle (remove the part that repeats with the day). It is necessary to calculate the multiple upper limit M with a daily cycle and the multiple upper limit M' with a weekly cycle (if the data contains a small number of "weeks", you can set a fixed value directly without calculating M').

[0162] Optionally, Figure 6 is a schematic diagram of a method for determining a cutoff frequency according to a specific exemplary embodiment, such as Figure 6As shown, the determination of the cutoff frequency M is as follows: for a total of N days of data with L points per day, the first step is to extract the "phase values" of the above components of 0, N, 2N...(L-1)×N to form a "phase sequence" of length L. The second step is to continue to perform FFT transformation on this phase sequence to obtain a new complex sequence of length L, select the subsequence with subscripts of 1 to L / 2 and calculate the amplitude, which can represent the spectrum amplitude of the "phase sequence". The third step is to normalize the spectrum amplitude to [0,1] and sort it in ascending order. Find the first data greater than ε (generally set to 0.03) in the sorted sequence. The data subscript +1 represents the best upper limit of the frequency multiplication M, and the corresponding cutoff frequency is M×N, where N represents the number of days of historical data.

[0163] In the above exemplary embodiment, by obtaining the phase sequence of the service attribute data sequence and the spectrum amplitude corresponding to the phase sequence; normalizing the spectrum amplitude and arranging it in ascending order to obtain the spectrum amplitude sequence; determining the frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than the first preset value as the cutoff frequency. This provides a data basis for subsequent periodic prediction data, applies the cutoff frequency, filters out high-frequency and relatively useless information, and obtains stable periodic prediction data containing a large amount of useful information.

[0164] Figure 7 This is a flowchart of an implementable method before step S120 according to an exemplary embodiment, including the following steps:

[0165] In step S1211, an initial business attribute data sequence is obtained.

[0166] In step S1212, initial service attribute data is acquired from the initial service attribute data sequence according to a preset first time sequence to obtain at least one second target service attribute data.

[0167] In step S1213, the second target business attribute data is subjected to mean analysis to determine the first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted.

[0168] In step S1214, the first service attribute update data is used to replace the corresponding initial service attribute data in the initial service attribute data sequence to obtain a service attribute data sequence.

[0169] The first time series is a time series formed at a specified time point, and the specified time point may be a holiday or other time point that may cause a sudden change in the business attribute data.

[0170] Specifically, the peak-to-valley division is used to divide the business attribute data sequence: the initial business attribute data is divided according to the lowest point position of the unit length (for example, every day). The specific reliable algorithm for finding the average daily lowest point is: FFT (Fast Fourier Transform) is performed on the business attribute data sequence, and the amplitude spectrum and phase spectrum of the sequence in the frequency domain are obtained after the transformation. This information describes the amplitude and phase of the original sequence after being decomposed into trigonometric functions of different frequencies. Since the data has been truncated to a length of N cycles (days) in the preprocessing, M components with frequencies of N*1, N*2...N*M are extracted here (for data of 1440 points per day, M can be about 10 to 20), and the trigonometric functions of these frequency components are re-superimposed in the time domain, so as to restore a periodic waveform that can stably describe daily fluctuations. If any minimum value is found in the waveform, then its position represents a division point. Referring to this point, the entire data sequence can be divided into multiple segments at equal intervals (the length of the left and right ends may generally be less than 1440 points).

[0171] In order to deal with holidays or other time points that are prone to cause sudden changes in business attribute data, it is necessary to maintain a first time series (time list). Each entry in the first time series marks a holiday or a time point that may cause a sudden change in business attribute data (for example: statutory holidays, any date that may cause abnormal data form, including weekend adjustments), that is, the initial business attribute data obtained from the initial business attribute data sequence, and at least one second target business attribute data is obtained. On this basis, for the daily peak and valley division given above, the "date" to which each segment of data belongs is redefined. If the lowest point is between 0 and 12 o'clock, the data segment after the current lowest point (first business attribute update data) is classified as that day, otherwise it is classified as the next day. For example, if the daily lowest point of a certain data is 3 a.m., then 3 a.m. on October 1 to 3 a.m. on October 2 is regarded as "October 1"; if the daily lowest point of a certain data is 18 o'clock in the evening, then the data from 18 o'clock in the evening of October 1 to 18 o'clock in the evening of October 2 is regarded as "October 2". If the current training data contains no more than half of the holidays and the data contains at least seven cycles (days), perform the following holiday data correction operation, otherwise skip it. Each segment of data that is attributed to holidays needs to be replaced with a regular shape to avoid affecting the subsequent algorithm learning of the rules. Specifically, for any holiday data segment of a day, it is necessary to find available data one or more weeks ago and one or more weeks later in the given historical data (that is, non-holiday data segments, and the length can cover the replaced part). When there are multiple segments of available data, it is necessary to calculate the median value (or average) of these segments at each time point to form a new data segment, that is, an alternative data segment for replacing holidays.

[0172] Before the formal replacement, it is necessary to use the daily average analysis method to perform correction operations: before replacing the holiday data segment (the corresponding initial business attribute data in the initial business attribute data sequence) with the alternative data segment (the first business attribute update data), it is necessary to analyze how large the overall amplitude of the data here should be. This is to avoid the problem of mismatching data with rising and falling trends during replacement. For example, for periodic data with continuously rising values, the amplitude value of the data a week ago cannot match the amplitude value of the data that needs to be replaced this week. After calculating the target daily average value that the target data segment should have, use the daily average value to correct the alternative data segment (multiply it by a number so that its daily average value is equal to the target daily average value) to obtain the business attribute data sequence.

[0173] In the above exemplary embodiments, the main difference between the fluctuations of the business attribute data sequence is that the data form of the daily lowest point is relatively more regular and more stable based on the higher value point. Therefore, by dividing the business attribute data in the way of peak and valley division, a sequence with clearer division results can be obtained. At the same time, by maintaining a first time series and replacing the business attribute data corresponding to the first time series, the business attribute data sequence is made more regular, which can provide a stable data basis for subsequent data processing.

[0174] Figure 8 FIG. 1 is a flowchart of an exemplary embodiment of a mean value analysis process, including the following steps:

[0175] In step S121, in a period before the point to be predicted, data corresponding to the position of the point to be predicted is acquired to obtain first initial data.

[0176] In step S122, in a period after the point to be predicted, data corresponding to the position of the point to be predicted is acquired to obtain second initial data.

[0177] In step S123, the third initial data and the fourth initial data adjacent to the point to be predicted are obtained, and the initial value corresponding to the point to be predicted is obtained.

[0178] In step S124, the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value is obtained to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data.

[0179] In step S125, the first initial data, the second initial data, the third initial data and the fourth initial data are weighted according to a preset third weight vector to obtain a prediction value corresponding to the point to be predicted.

[0180] In step S126, the predicted value is used to replace the initial value, and the execution returns to obtain the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data, and the fourth edge weight corresponding to the fourth initial data, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

[0181] The point to be predicted is a point in the periodic data. The third weight vector refers to a set of weight parameters for weighted summation of the group data, and the weight parameters can be adjusted accordingly according to different data types.

[0182] Specifically, the daily average analysis method can calculate the value that the unreliable daily average value of business attribute data (holiday data) should have (how much it should have been if those days were not holidays) by mining the associations between business attribute data. Fig. 9 This is a schematic diagram of the mean analysis method according to an exemplary embodiment. First, taking a cycle of one week and 7 days as an example, it is necessary to put the daily average data into a two-dimensional table in the form of a calendar. Among them, the numbers without shading represent reliable daily averages, and the numbers with square gray shading represent unreliable holiday data (points to be predicted) that need to be re-estimated. The next task is to calculate the numerical values ​​that the unreliable data "should have". Treat each daily average value in the calendar table structure as a node, and add edges between the nodes to describe the relationship between each pair of nodes. Optionally, the two physical quantities "daily year-on-year" and "weekly year-on-year" can be used to describe the relationship between "two adjacent days" and "corresponding two days in adjacent weeks". Among them, "daily year-on-year" is in Fig. 9 It is indicated by a horizontal arrow in the chart, which can be defined as the difference (or ratio) between the two daily averages before and after the arrow. Fig. 9In the figure, it is represented by a vertical arrow, which can be defined as the difference (or ratio) between the two daily averages above and below the arrow; in the overall structure of the data, "daily year-on-year" and "weekly year-on-year" may have certain similarities at different locations. For example, the "daily year-on-year" of Tuesday and Wednesday this week may be similar to the daily year-on-year of Tuesday and Wednesday of the previous week or the next week; the "weekly year-on-year" of Tuesday this week and Tuesday next week may be similar to the "weekly year-on-year" of Tuesday last week and Tuesday this week. Therefore, it is necessary to explore this rule, and the method adopted is to iteratively use the node value (that is, the daily average value of a certain day) to calculate those edge weights (that is, the daily year-on-year and the weekly year-on-year), and then use the edge weights to calculate the node value (the point to be predicted), and finally converge and remain unchanged to stop. Each round of iteration requires updating the weight parameters (first edge weight, second edge weight, third edge weight, and fourth edge weight). For a certain horizontal edge, although it only connects the two nodes on the left and right (the first initial data, the second initial data), in order to examine the average "daily year-on-year change", it is extended forward and backward by X weeks (X can be 2), and 2X+1 daily year-on-year values ​​are calculated. The result of weighted average is used as the new weight of this edge (first edge weight, second edge weight). If the data range is exceeded during the extension, the excess part is ignored. When weighting, it can be completely averaged, or the respective weights can be increased or decreased accordingly depending on whether unreliable daily averages are used during the calculation. Each round of iteration calculates the weight of the vertical edge: For a certain vertical edge, although it only connects the two nodes above and below (the third initial data, the fourth initial data), in order to examine the average "weekly year-on-year change", it is extended to the left and right by X days (X can be 3), and 2X+1 weekly year-on-year values ​​are calculated. The result of weighted average is used as the new weight of this edge. Note that when expanding left and right, the calculation range can be extended to the position of the previous row or the next row. Similar to the calculation of horizontal edges, the weighting can be completely averaged, or the respective weights (third edge weight and fourth edge weight) can be increased or decreased accordingly depending on whether the unreliable daily average value is used in the calculation. Each round of iterative calculation of node values: Each node is directly connected to up to four edges (arrows), so these four edges and the four surrounding nodes connected are used to update the calculation of this node. For example, assuming that this node is Tuesday of the third week, the value of this node can be inferred from "the daily average value of Wednesday of the third week" and "the daily year-on-year change of Tuesday & Wednesday of the third week". Similarly, the value of this node can be inferred from "the daily average value of Monday of the third week" and "the daily year-on-year change of Monday & Tuesday of the third week", "the daily average value of Tuesday of the second week" and "the weekly year-on-year change of Tuesday of the second & third week", "the daily average value of Tuesday of the fourth week" and "the weekly year-on-year change of Tuesday of the third & fourth week" and three other data sources. Since there are four calculation results in total, the four results need to be weighted averaged. When weighting, those results that use unreliable daily averages (for example, Tuesday of the second week is a holiday, so it is unreliable to use it to calculate the daily average of Tuesday of the third week) can be given a lower weight.According to the above steps, edge weights are calculated in each round, and then node values ​​are calculated. Finally, when the results of the nodes converge and remain unchanged (generally within 20 rounds), the algorithm stops running. At this point, a method can be designed to measure the uncertainty of the results of the daily average analysis algorithm. For example, when updating the node values ​​mentioned above, four values ​​are used for weighting. If the four numbers before weighting are different from the weighted results, the uncertainty is large. Therefore, for each point, the "sum of the range" or "variance" can be calculated to describe its uncertainty, and then the uncertainty of all points is weighted or averaged as the overall uncertainty. This uncertainty can be used to determine the weight of holiday replacement. For example, when the normalized uncertainty is 0.1, the new data curve corresponding to the daily average analysis result with a weight of 90% is weighted and superimposed with the original data curve with a weight of 10%, so as to avoid the serious impact of the daily average analysis on the results when the calculation is inaccurate in some extreme cases.

[0183] In the above exemplary embodiment, the specific data corresponding to the point where the business attribute data is uncertain can be obtained through the daily average analysis method, providing a method for predicting and updating the point, so that the prediction baseline of the business attribute data corresponding to the point can be determined based on the business attribute data, the limit value of the business attribute data and the jump value of the business attribute data, so that the business attribute data sequence can be predicted from multiple dimensions, and the data with periodicity can be predicted and limited together through the prediction baseline, the limit value of the business attribute data and the jump value of the business attribute data.

[0184] Fig.10 is a flowchart of an implementable method of step S130 according to an exemplary embodiment, comprising the following steps:

[0185] Step S131, obtaining a first weight vector and random noise.

[0186] Step S132: weighting the trend prediction data, the period prediction data and the random noise according to the first weight vector to obtain a prediction baseline for the business attribute data.

[0187] The random noise is composed of random numbers within a preset range, which is used to simulate the noise component in the measured value of the business attribute data, so that the predicted baseline of the business attribute data is more in line with the actual law. The first weight vector refers to a set of weight parameters for weighted summation of group data, and the weight parameters can be adjusted accordingly according to different data types.

[0188] Specifically, the trend component of the business attribute data sequence is predicted to obtain trend prediction data, and the period component of the business attribute data sequence is predicted to obtain period prediction data. After obtaining the trend prediction data and the period prediction data, the trend prediction data, the period prediction data and the obtained random noise are weighted according to the first weight vector to obtain a prediction baseline for the business attribute data.

[0189] Optionally, Fig.11 is a flowchart of an implementable method after step S130 according to an exemplary embodiment, comprising the following steps:

[0190] In step S131, business attribute data is acquired from a business attribute data sequence according to a preset second time sequence to obtain at least one third target business attribute data.

[0191] In step S132, the third target service attribute data within a preset time period of the third target service attribute data is weighted according to a preset second weight vector to obtain second service attribute update data.

[0192] In step S133, the second business attribute update data is used to replace the corresponding business attribute data in the prediction baseline of the business attribute data, so as to obtain the updated prediction baseline of the business attribute data.

[0193] The second time series is a time series formed by a specified time point, and the specified time point may be a time point around the first time point. The second weight vector refers to a set of weight parameters for weighted summation of group data, and the weight parameters may be adjusted accordingly according to different data types.

[0194] Specifically, according to the above calculation, the trend fitting & prediction data and the periodic fluctuation fitting & prediction data can be obtained. According to the product model of "measured data = trend × (periodic fluctuation + random noise)", the corresponding "prediction data = trend × periodic fluctuation" can be obtained, that is, the final fitting & prediction baseline can be obtained. Since the business attribute data prediction baseline is a sequence that removes the time points corresponding to the first time series, when the first time series is a holiday, the business attribute data prediction baseline does not consider holidays. Therefore, after obtaining the business attribute data prediction baseline, it is necessary to reconstruct the holiday data amplitude. The specific method is: prepare a holiday table in advance, and mark whether the statutory holiday is a holiday or overtime (adjustment). If a data segment corresponds to a holiday, replace the holiday data segment (the corresponding business attribute data in the prediction baseline of the business attribute data) with the weighted average of the nearby weekend data (Saturday and Sunday) in the prediction baseline (the second business attribute update data). If a data segment corresponds to overtime, replace the holiday data segment with the weighted average of the nearby midweek data (Monday to Friday) in the prediction baseline. The weighting method can be designed in a way that gives greater weight to recent data. When replacing, the jump of the connection point needs to be considered, but there is no need to do daily average analysis. Fig.12 is a schematic diagram of data recovery according to an exemplary embodiment. Fig.12 As shown, taking the Dragon Boat Festival as an example, the upper half of the figure shows the measurement values ​​and baseline before recovery, and the lower half of the figure shows the measurement values ​​and baseline after recovery. It can be seen that the gap between the measurement data after recovery can be filled to a certain extent.

[0195] In the above exemplary embodiment, after eliminating some time points that may cause mutations in the business attribute data and obtaining a preliminary prediction baseline for the business attribute data, the data at the eliminated time points are restored to obtain a more accurate prediction baseline for the business attribute data, providing a more precise baseline for the subsequent determination of the limit value of the business attribute data and the jump value of the business attribute data, thereby making the obtained limit value of the business attribute data and the jump value of the business attribute data more accurate.

[0196] Fig.13 is a flowchart of an implementable method of step S500 according to an exemplary embodiment, comprising the following steps:

[0197] In step S510, the real-time service attribute data is compared with the limit value of the service attribute data and the jump value of the service attribute data in the service attribute prediction data.

[0198] In step S520, the real-time service attribute data that is outside the range of the limit value of the service attribute data and the jump value of the service attribute data is determined as abnormal data.

[0199] Specifically, after obtaining the limit value of the business attribute data and the jump value of the business attribute data, real-time business attribute data is obtained, and the real-time business attribute data is compared with the limit value of the business attribute data and the jump value of the business attribute data in the business attribute prediction data. The real-time business attribute data that is outside the range of the limit value of the business attribute data and the jump value of the business attribute data can be determined as abnormal data.

[0200] Optionally, the abnormal data is displayed so that users can obtain relevant abnormal data and make annotations and feedback based on the abnormal data. After receiving the false alarm feedback indicated by the user, an attribution analysis is performed to examine which rules caused the abnormal judgment. These rules have adjustable parameters, which are specifically divided into parameters that can be updated immediately online and parameters that can only be updated offline. The parameters that can be updated online are directly written into the data of the prediction model and take effect almost immediately, while the parameters that can only be updated offline need to be written into the metadata of the business data curve and will not take effect until the next training and generation of a new model. Including: (1) Attribution analysis: The person who receives the abnormal alarm can observe the data form and determine whether the current data is truly abnormal according to the actual situation of the individual. If the alarm rule is considered too strict, feedback can be submitted, and the online program that receives the feedback will automatically execute the parameter adjustment algorithm. Before adjustment, it is necessary to examine which data curve and which time point caused the alarm, and then determine the rules that the algorithm determines that the point is abnormal, so as to achieve attribution analysis, which is conducive to the following targeted parameter adjustment. (2) Parameter adjustment: Regardless of whether the alarm reason is exceeding the upper and lower bounds of the prediction or exceeding the upper and lower bounds of the 1-n step difference, a similar method is used to relax the parameters of the upper and lower bounds. Specifically, the upper and lower quantile parameters ρ of the above-mentioned calculation of the single-point KDE can be reduced, that is, the out-of-bounds distribution value is made smaller and the tolerance to noise is higher. This parameter needs to be written into the parameter table used for offline training, recorded in the data metadata and effective at the next offline training. In addition, the bias value δ of the upper and lower boundaries after smoothing can also be increased, so that the overall curve expands to a fixed size. It is worth noting that this parameter can actually be written directly into the model library after the training is completed, so that it takes effect almost immediately without having to wait for the next offline training.

[0201] In the above exemplary embodiments, the business attribute data can be dynamically tracked according to the latest business attribute data, and the business attribute data that exceeds the limit value of the updated business attribute data and the jump value of the business attribute data can be determined as abnormal data, so as to detect whether the data with a certain change trend is abnormal. The parameters in the data detection method can also be adjusted according to the specific feedback results, so that the abnormal data detection method can be continuously improved.

[0202] In an exemplary embodiment, optionally, the abnormal data detection method further includes:

[0203] Obtain a business attribute data sequence, and obtain business attribute output data corresponding to the business attribute data sequence; wherein the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the business attribute output data includes a business attribute prediction value, a limit value of the business attribute data, and a first business attribute deviation, wherein the first business attribute deviation is the deviation of a preset number of business attribute data relative to the corresponding business attribute prediction value. Obtain a second business attribute deviation corresponding to the latest business attribute data in the business attribute data sequence; wherein the second business attribute deviation represents the deviation of the latest business attribute data relative to the corresponding business attribute prediction value. According to the preset weight, the second business attribute deviation is applied to update the first business attribute deviation. The updated first business attribute deviation is applied to update the limit value of the business attribute data, and the business attribute data that exceeds the limit value of the updated business attribute data is determined as abnormal data.

[0204] Among them, the visit volume of the service refers to the access frequency of the service service, server port pressure, etc., and the attention data of the business object refers to the attention data of the service service. For example, when a business service is an audio and video work, the attention data of the business object refers to the likes, comments or forwarding volume of the audio and video work. The business attribute prediction value refers to the estimated value of the business attribute data. The limit value of the business attribute data refers to the maximum or minimum value of the business attribute data. The deviation refers to the proportion of the absolute value of the difference between the measured business attribute data and the business attribute prediction value to the business attribute prediction value. The preset weight refers to the weight parameter of the original first business attribute deviation and the second business attribute deviation corresponding to the update of the first business attribute deviation. The preset number refers to the number of recent business attribute data used to calculate the first business attribute deviation.

[0205] Specifically, a business attribute data sequence is obtained, and a corresponding business attribute prediction model is found according to the business attribute data sequence. The business attribute data sequence is input into the corresponding business attribute prediction model to obtain a business attribute prediction value, a limit value of the business attribute data, and a first business attribute deviation. Next, the latest business attribute data is obtained from the business attribute data sequence, and the deviation between the latest business attribute data and the corresponding business attribute prediction value is determined according to the calculation method of the deviation, so as to obtain a second business attribute deviation. According to the preset weight, the first business attribute deviation is updated with the second business attribute deviation, and the limit value of the business attribute data is updated with the updated first business attribute deviation, so that the limit value of the updated business attribute data can reflect the influence of the latest business attribute data, and the business attribute data is dynamically tracked according to the latest business attribute data, and the business attribute data exceeding the limit value of the updated business attribute data is determined as abnormal data.

[0206] In the above abnormal data detection method, a business attribute data sequence is obtained, and a business attribute prediction value, a limit value of the business attribute data and a first business attribute deviation corresponding to the business attribute data sequence are obtained; a second business attribute deviation corresponding to the latest business attribute data in the business attribute data sequence is obtained; according to a preset weight, the first business attribute deviation is updated by applying the second business attribute deviation, and the limit value of the business attribute data is updated by applying the updated first business attribute deviation, so that the limit value of the updated business attribute data can reflect the influence of the latest business attribute data, the business attribute data is dynamically tracked according to the latest business attribute data, and the business attribute data that exceeds the limit value of the updated business attribute data is determined as abnormal data, so as to detect whether the data with a certain change trend is abnormal, and at the same time, the limit value of the business attribute data is updated by the first business attribute deviation, so as to avoid frequent alarms caused by the overall deviation of the business attribute data from the business attribute prediction value.

[0207] In an exemplary embodiment, obtaining the business attribute output data includes:

[0208] Obtain a business attribute data sequence; according to the business attribute data sequence, search for a business attribute prediction model corresponding to the business attribute data sequence from a preset model library; input the business attribute data sequence into the business attribute prediction model to obtain business attribute output data.

[0209] Among them, the preset model library stores business attribute prediction models corresponding to various types of business attribute data. The business attribute prediction model refers to a prediction model that can output the corresponding business attribute prediction value, the limit value of the business attribute data, the first business attribute deviation and the jump value of the business attribute data based on a certain amount of business attribute data. The business attribute prediction model stored in the preset model library can be an existing prediction model or a self-developed prediction model.

[0210] Specifically, after obtaining the business attribute data sequence, the business attribute data sequence is analyzed to determine the type of the business attribute data sequence, and according to the type of the business attribute data sequence, a business attribute prediction model corresponding to the business attribute data sequence is searched from a preset model library. After obtaining the corresponding business attribute prediction model, the business attribute data sequence is input into the business attribute prediction model to obtain business attribute output data, which includes a business attribute prediction value, a limit value of the business attribute data, a first business attribute deviation, and a jump value of the business attribute data.

[0211] In the above exemplary embodiment, a business attribute data sequence is obtained; based on the business attribute data sequence, a business attribute prediction model corresponding to the business attribute data sequence is searched from a preset model library; the business attribute data sequence is input into the business attribute prediction model to obtain business attribute output data. Thus, the corresponding business attribute prediction model can be quickly determined based on the specific business attribute data sequence, and the corresponding output data can be obtained, providing a data basis for subsequent abnormal data detection, so as to detect whether data with a certain change trend is abnormal.

[0212] In an exemplary embodiment, determining the first service attribute deviation includes:

[0213] Obtain weight update parameters; apply the weight update parameters to update the preset weights; and apply the second business attribute deviation to update the first business attribute deviation according to the updated preset weights.

[0214] The weight update parameter refers to a parameter for adjusting the weight ratio of the first business attribute deviation and the second business attribute deviation when the second business attribute deviation is applied to update the first business attribute deviation.

[0215] Specifically, each time abnormal data detection is performed, a weight update parameter is first obtained, the weight update parameter is applied, the preset weight is updated, and the second business attribute deviation is applied to update the first business attribute deviation according to the updated preset weight. The limit value of the business attribute data is updated with the latest first business attribute deviation, and the business attribute data that exceeds the limit value of the updated business attribute data is determined as abnormal data.

[0216] In the above exemplary embodiment, the weight update parameter is obtained; the weight update parameter is applied to update the preset weight; and the second business attribute deviation is applied to update the first business attribute deviation according to the updated preset weight. Thus, the weight update parameter can be applied to adjust and update the weight of the first business attribute deviation, so that the second business attribute deviation can be updated to the first deviation in different ways, thereby improving the sensitivity of the latest business attribute data and increasing the accuracy of abnormal data detection.

[0217] In an exemplary embodiment, the determination of the second weight update parameter includes:

[0218] Obtain the change speed of the business attribute data in the business attribute data sequence; when the change speed is greater than or equal to the preset speed, increase the first weight update parameter according to a first preset ratio or according to a preset value to obtain an updated first weight update parameter; adjust the second weight update parameter according to a second preset ratio and a jump value of the business attribute data to obtain an updated second weight update parameter; wherein the second weight update parameter is negatively correlated with the jump value of the business attribute data.

[0219] The weight update parameters include a first weight update parameter and a second weight update parameter, the service attribute output data include a jump value of the service attribute data, and the jump value of the service attribute data includes a jump upper limit value and a jump lower limit value.

[0220] Specifically, the change speed of the business attribute data in the time series business attribute data sequence is obtained, and the relationship between the change speed and the preset speed is detected. When the change speed is greater than or equal to the preset speed, the first weight update parameter is increased according to a first preset ratio or according to a preset value to obtain an updated first weight update parameter; and the second weight update parameter is adjusted according to a second preset ratio and a jump value of the business attribute data to obtain an updated second weight update parameter, so that the second weight update parameter is negatively correlated with the jump value of the business attribute data.

[0221] Optionally, the first weight update parameter and / or the second weight update parameter are applied to update the first weight and the second weight; and the first business attribute deviation is updated by applying the second business attribute deviation according to the updated first weight and the second weight.

[0222] The preset weight includes a first weight and a second weight. The limit value of the service attribute data includes an upper limit value and a lower limit value.

[0223] Specifically, the first weight update parameter and / or the second weight update parameter are applied to update the first weight and the second weight, and the first business attribute deviation is updated by applying the second business attribute deviation according to the updated first weight and the second weight.

[0224] For example, for any business attribute data r(t), its second business attribute deviation x(t) is the degree of deviation of r(t) relative to the business attribute prediction value f(t). The second business attribute deviation x(t) can be expressed in different forms. When S is used to represent the average amplitude of the change of the business attribute data within a preset time, the first expression of the second business attribute deviation is x(t) = [r(t)-f(t)] / S, that is, the absolute error is normalized by S; the second expression of the second business attribute deviation is x(t) = [r(t)-f(t)] / f(t), that is, the relative error does not need to be normalized by S; the third expression of the second business attribute deviation is x(t) = [r(t)-f(t)] / sqrt[f(t)] / sqrt[S], that is, the semi-normalized error (indicating the multiple of the standard deviation of the Poisson distribution) is normalized by the square root S. It should be noted that the above three expressions of deviation are only for illustrative purposes and are not used to specifically limit the deviation.

[0225] x(t) is the single point deviation, and the second business attribute deviation y(t) is used to describe the overall deviation of the measured data of recent business attribute data relative to the predicted value of the business attribute. Set the initial value of the second business attribute deviation y(t) to 0. For each latest data point, update the latest point deviation x(t) to y(t) in the manner of y(t) = (1-a*b)*y(t-1) + a*b*x(t), where a and b are weight update parameters, and their values ​​are both between 0 and 1. Among them, y(t) is one of the output data of the business attribute prediction model, which can be calculated from the left end to the right end of the historical data during the offline training process of the business attribute prediction model, and the latest value is stored in the prediction model, indicating the recent deviation of the position where the training data ends. After each abnormal data detection is completed, the updated y(t) needs to be saved in the business attribute prediction model for subsequent calls.

[0226] The above-mentioned first weight update parameter a can also be called a fast update indication parameter or a holiday indication parameter. For example, when the holiday comes, the business attribute data of the network platform of each business service may change greatly. When the time is in the holiday stage, a larger value can be set for the first weight update parameter a to allow x(t) to be updated to y(t) with a higher weight, so that y(t) changes more quickly and improves the tracking speed of abnormal data detection. In addition, some slow-changing strategies can also be configured for the first weight update parameter a according to the specific situation. The second weight update parameter b is a parameter that characterizes the reliability of the data point, which depends on the 1 to K step backward difference value of the current data point relative to the upper and lower bounds of the 1 to K step backward difference value given by the business attribute prediction model. The larger the absolute value of the jump value of the business attribute data, the smaller the second weight update parameter b. The design here can have many variations. For example, if the jump value of the business attribute data is D, D>0, and the upper limit value is U, then the parameter b=exp(-p*D / U), where p is a constant; for D<0, the lower limit value L is used as the denominator, that is, b=exp(-p*D / L). In addition, some inverse proportional functions or piecewise linear functions can also be used. When K>1, the K different jump values ​​from 1-step jump to K-step jump can be used at the same time, and the corresponding parameters b can be calculated respectively and then multiplied, or a joint function can be designed. In any case, it must be ensured that the absolute value of the jump value of the business attribute data from 1-step jump to K-step jump is negatively correlated with the final parameter b, and the value range of b is between 0 and 1.

[0227] In the above exemplary embodiments, the corresponding preset weights can be adjusted through weight update parameters, so that in the process of applying the second business attribute deviation to update the first business attribute deviation, recent data can be better tracked, avoiding excessive influence of previous data and ensuring the accuracy of abnormal data detection.

[0228] In an exemplary embodiment, determining the lower limit value includes:

[0229] The upper limit value is adjusted upward by one unit of the first business attribute deviation to obtain an updated upper limit value; the lower limit value is adjusted downward by one unit of the first business attribute deviation to obtain an updated lower limit value.

[0230] The limit values ​​of the business attribute data include an upper limit value and a lower limit value.

[0231] Specifically, after updating the second business attribute deviation y(t) corresponding to the latest business attribute data, y(t) can be used to correct the predicted original upper limit value U and the original lower limit value L. Corresponding to the first expression of the second business attribute deviation, the new upper bound is y*S+U, and the new lower bound is y*S+L. For the second expression of the second business attribute deviation, the new upper bound is y*U+U, and the new lower bound is y*L+L. For the third expression of the second business attribute deviation, the new upper bound is y*sqrt[U]*sqrt(S)+U, and the new lower bound is y*sqrt[L]*sqrt(S)+L. It should be noted that the latter two are only applicable to quantitative data, and the third requires that the upper and lower bounds are not less than zero (for square root extraction).

[0232] Optionally, if the business attribute data does not exceed the limit value of the updated business attribute data, the size relationship between the business attribute data and the jump value of the business attribute data is detected; if the business attribute data is greater than the jump value of the business attribute data, the business attribute data is determined as abnormal data.

[0233] Optionally, the magnitude relationship between the first business attribute deviation and a preset threshold is detected; if the first business attribute deviation corresponding to the business attribute data is greater than the preset threshold, the business attribute data is determined to be abnormal data.

[0234] Specifically, for a given 1+K business attribute data, the updated upper limit value and lower limit value are used to determine whether the business attribute data is abnormal. If no abnormality is found, 1+K data are continued to be used to calculate k steps (k=1~K) of backward difference, and then the corresponding jump values ​​of the business attribute data are used for judgment. If none of the above conditions detect an abnormality, then finally check whether the value of the first business attribute deviation y(t) of the current data exceeds the preset threshold. If it exceeds, it means that the overall rise or fall is beyond expectations. Since the deviation alarm describes the overall shape of the curve, it only needs to be reported once in a long period of time, and there is no need to report at each point. The physical meaning of the above anomaly detection rules is clear, which allows the personnel who receive the alarm to understand the operating status of the business attribute data at the first time. In addition, for some data business curves, it can be set separately to only report upward out-of-bounds anomalies or downward out-of-bounds anomalies, which is convenient for expansion.

[0235] For example, when the data is moving away from the predicted value of the business attribute at a slower speed, due to the dynamic tracking of the upper and lower limits, the data will not exceed the upper limit value, the lower limit value and the jump value of the business attribute data, but deviation too far is intolerable. Therefore, the range of the second business attribute deviation y(t) cannot exceed a fixed interval (for example, [-0.1, 0.1]). If it exceeds, it is judged as abnormal according to "excessive deviation". What are the different physical meanings of 0.1 as the limit of the recent deviation y under the above three different definitions of deviation? First, for the peak period of the value data, f(t)≈S, so the three definitions are very close, indicating that the tolerable relative error is 10%. However, during off-peak periods, the three definitions are different. For the first definition, it means that the data can be approximately tolerated to deviate from "10% of the overall maximum value of the data" (a very wide range); for the second definition, it means that the data can be approximately tolerated to deviate from "10% of the predicted value at this location" (a very narrow range); for the third definition, it means that the degree of data deviation that can be tolerated is between the first two. If the lowest value is about one-ninth of the highest value, it means that during off-peak periods, the data can be approximately tolerated to deviate from "30% at this location" (square root of nine multiplied by 10%). For many business data that "can tolerate more relative errors during off-peak periods than during peak periods", the third definition is better. In the specific implementation process, you can choose one or use a combination according to the specific situation.

[0236] In the above exemplary embodiment, the business attribute data is dynamically tracked according to the latest business attribute data, and the business attribute data exceeding the limit value of the updated business attribute data is determined as abnormal data, so as to detect whether the data with a certain change trend is abnormal. Further, the business attribute data is judged to be abnormal based on the size relationship between the business attribute data and the jump value of the business attribute data, and the size relationship between the first business attribute deviation and the preset threshold value. The abnormal data can be detected in all directions step by step, so as to detect whether the data with a certain change trend is abnormal.

[0237] It should be understood that although Figure 1-12 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1-12 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0238] Fig.14 FIG. 1 is a block diagram of an abnormal data detection device according to an exemplary embodiment. Fig.14 The device includes a baseline prediction unit 141, a limit value prediction unit 142, a jump value prediction unit 143, a service attribute prediction unit 144 and an abnormal data detection unit 145:

[0239] The baseline prediction unit 141 is configured to perform prediction on the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence;

[0240] The limit value prediction unit 142 is configured to execute the error sequence between the prediction baseline of the business attribute data and the measured data of the business attribute data, and fit the error sequence to obtain the limit value of the business attribute data; wherein the limit value of the business attribute data includes an upper limit value and a lower limit value;

[0241] The jump value prediction unit 143 is configured to execute a backward difference sequence of the acquired measured data, fit the difference sequence, and obtain a jump value of the service attribute data; wherein the jump value includes a jump upper limit value and a jump lower limit value;

[0242] The service attribute prediction unit 144 is configured to perform at least one of the limit value of the service attribute data and the jump value of the service attribute data into the prediction baseline of the service attribute data to obtain the service attribute prediction data;

[0243] The abnormal data detection unit 145 is configured to acquire real-time service attribute data and determine the real-time service attribute data outside the restricted range formed by the service attribute prediction data as abnormal data.

[0244] In an exemplary embodiment, the baseline prediction unit 141 is further configured to perform: dividing the business attribute data sequence according to the frequency of the business attribute data sequence to obtain at least two first target business attribute data sequences; predicting each first target business attribute data sequence separately to obtain prediction data corresponding to the first target business attribute data sequence; and weighting at least two prediction data to obtain a prediction baseline for the business attribute data.

[0245] In an exemplary embodiment, at least two first target business attribute data sequences include a trend component of the business attribute data sequence and a periodic component of the business attribute data sequence; the baseline prediction unit 141 is also configured to perform: predicting the trend component of the business attribute data sequence to obtain trend prediction data; predicting the periodic component of the business attribute data sequence to obtain period prediction data.

[0246] In an exemplary embodiment, the baseline prediction unit 141 is further configured to execute: performing mean analysis processing on the business attribute data sequence to determine the prediction data corresponding to the target prediction point where no business attribute data exists, and obtain trend prediction data; wherein the mean analysis processing includes determining the value of the point to be predicted based on data within a preset range of the point to be predicted in the business attribute data sequence; the position corresponding to the target prediction point is the point to be predicted, and the trend prediction data is the value of the point to be predicted; obtaining the cutoff frequency corresponding to the business attribute data sequence, fitting the periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expanding the periodic component to obtain periodic prediction data; wherein the cutoff frequency represents the maximum frequency for fitting the periodic component corresponding to the business attribute data sequence.

[0247] In an exemplary embodiment, the baseline prediction unit 141 is further configured to perform: obtaining a phase sequence of the service attribute data sequence, and obtaining a spectrum amplitude corresponding to the phase sequence; normalizing the spectrum amplitude and arranging it in ascending order to obtain a spectrum amplitude sequence; and determining the frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value as the cutoff frequency.

[0248] In an exemplary embodiment, the baseline prediction unit 141 is further configured to execute: obtaining an initial business attribute data sequence; obtaining initial business attribute data from the initial business attribute data sequence according to a preset first time series to obtain at least one second target business attribute data; performing mean analysis on the second target business attribute data to determine first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted; and using the first business attribute update data to replace the corresponding initial business attribute data in the initial business attribute data sequence to obtain a business attribute data sequence.

[0249] In an exemplary embodiment, the point to be predicted is a point in periodic data; the baseline prediction unit 141 is further configured to perform: in a period before the point to be predicted, obtain data corresponding to the position of the point to be predicted to obtain first initial data; in a period after the point to be predicted, obtain data corresponding to the position of the point to be predicted to obtain second initial data; obtain third initial data and fourth initial data adjacent to the point to be predicted, and obtain an initial value corresponding to the point to be predicted; obtain a weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, and obtain a first edge weight corresponding to the first initial data, a second edge weight corresponding to the second initial data, and a third initial data corresponding to the initial value. The first initial data, the second initial data, the third initial data and the fourth initial data are weighted according to the preset third weight vector to obtain the predicted value corresponding to the point to be predicted; the predicted value is used to replace the initial value, and the execution is returned to obtain the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

[0250] In an exemplary embodiment, the baseline prediction unit 141 is further configured to perform: obtaining a first weight vector and random noise; weighting the trend prediction data, the cycle prediction data and the random noise according to the first weight vector to obtain a prediction baseline for the business attribute data.

[0251] In an exemplary embodiment, the baseline prediction unit 141 is further configured to perform: acquiring business attribute data from the business attribute data sequence according to a preset second time series to obtain at least one third target business attribute data; weighting the third target business attribute data within a preset time period of the third target business attribute data according to a preset second weight vector to obtain second business attribute update data; and using the second business attribute update data to replace the corresponding business attribute data in the prediction baseline of the business attribute data to obtain the prediction baseline of the updated business attribute data.

[0252] In an exemplary embodiment, the abnormal data detection unit 145 is further configured to perform: comparing the real-time business attribute data with the limit value of the business attribute data and the jump value of the business attribute data in the business attribute prediction data; and determining the real-time business attribute data that is outside the range of the limit value of the business attribute data and the jump value of the business attribute data as abnormal data.

[0253] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0254] Fig.15 1 is a block diagram of an abnormal data detection device 1500 according to an exemplary embodiment. For example, the device 1500 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0255] Reference Fig.15 , device 1500 may include one or more of the following components: a processing component 1502 , a memory 1504 , a power component 1506 , a multimedia component 1508 , an audio component 1510 , an input / output (I / O) interface 1512 , a sensor component 1514 , and a communication component 1516 .

[0256] The processing component 1502 generally controls the overall operation of the device 1500, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 1502 may include one or more processors 1520 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 1502 may include one or more modules to facilitate the interaction between the processing component 1502 and other components. For example, the processing component 1502 may include a multimedia module to facilitate the interaction between the multimedia component 15015 and the processing component 1502.

[0257] The memory 1504 is configured to store various types of data to support operations on the device 1500. Examples of such data include instructions for any application or method operating on the device 1500, contact data, phone book data, messages, pictures, videos, etc. The memory 1504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0258] The power supply component 1506 provides power to the various components of the device 1500. The power supply component 1506 can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 1500.

[0259] The multimedia component 1508 includes a screen that provides an output interface between the device 1500 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1508 includes a front camera and / or a rear camera. When the device 1500 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0260] The audio component 1510 is configured to output and / or input audio signals. For example, the audio component 1510 includes a microphone (MIC), and when the device 1500 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 1504 or sent via the communication component 1516. In some embodiments, the audio component 1510 also includes a speaker for outputting audio signals.

[0261] I / O interface 1512 provides an interface between processing component 1502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0262] The sensor assembly 1514 includes one or more sensors for providing various aspects of status assessment for the device 1500. For example, the sensor assembly 1514 can detect the open / closed state of the device 1500, the relative positioning of components, such as the display and keypad of the device 1500, and the sensor assembly 1514 can also detect the position change of the device 1500 or a component of the device 1500, the presence or absence of user contact with the device 1500, the orientation or acceleration / deceleration of the device 1500, and the temperature change of the device 1500. The sensor assembly 1514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 1514 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1514 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0263] The communication component 1516 is configured to facilitate wired or wireless communication between the device 1500 and other devices. The device 1500 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 1516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1516 also includes a near field communication (NFC) module to facilitate short-range communication.

[0264] In an exemplary embodiment, device 1500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0265] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1504 including instructions, and the instructions can be executed by the processor 1520 of the device 1500 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0266] In an exemplary embodiment, a computer program product is also provided, and when the computer program / instructions are executed by a processor, the above-mentioned business attribute prediction is realized.

[0267] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0268] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for detecting abnormal data, characterized in that: include: Predicting the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence; Obtaining an error sequence between a predicted baseline of the business attribute data and actual measured data of the business attribute data, fitting the error sequence, and obtaining a limit value of the business attribute data; wherein the limit value of the business attribute data includes an upper limit value and a lower limit value; Acquire a backward difference sequence of the measured data, fit the difference sequence, and obtain a jump value of the service attribute data; wherein the jump value includes a jump upper limit value and a jump lower limit value; Incorporating the limit value of the service attribute data and the jump value of the service attribute data into the prediction baseline of the service attribute data to obtain service attribute prediction data; Real-time business attribute data is acquired, and the real-time business attribute data that is outside the restricted interval formed by the business attribute prediction data is determined as abnormal data.

2. The abnormal data detection method according to claim 1, characterized in that: The step of predicting the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data includes: Dividing the service attribute data sequence according to the frequency of the service attribute data sequence to obtain at least two first target service attribute data sequences; Predict each of the first target service attribute data sequences respectively to obtain prediction data corresponding to the first target service attribute data sequence; The at least two types of prediction data are weighted to obtain a prediction baseline for the business attribute data.

3. The abnormal data detection method according to claim 2, characterized in that: The at least two first target business attribute data sequences include a trend component of the business attribute data sequence and a period component of the business attribute data sequence; The step of predicting each of the first target service attribute data sequences to obtain prediction data corresponding to the first target service attribute data sequence comprises: Predicting the trend component of the business attribute data sequence to obtain trend prediction data; The periodic component of the service attribute data sequence is predicted to obtain periodic prediction data.

4. The abnormal data detection method according to claim 3, characterized in that: The step of predicting the periodic component of the service attribute data sequence to obtain periodic prediction data includes: Performing mean analysis processing on the business attribute data sequence, determining the prediction data corresponding to the target prediction point for which no business attribute data exists, and obtaining the trend prediction data; wherein the mean analysis processing includes determining the value of the to-be-predicted point according to the data within a preset range of the to-be-predicted point in the business attribute data sequence; the position corresponding to the target prediction point is the to-be-predicted point, and the trend prediction data is the value of the to-be-predicted point; Obtain a cutoff frequency corresponding to the business attribute data sequence, fit the periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expand the periodic component to obtain the periodic prediction data; wherein the cutoff frequency represents the maximum frequency for fitting the periodic component corresponding to the business attribute data sequence.

5. The abnormal data detection method according to claim 4, characterized in that: The obtaining of the cutoff frequency corresponding to the service attribute data sequence, fitting the periodic component corresponding to the service attribute data sequence under the restriction of the cutoff frequency, and expanding the periodic component to obtain the periodic prediction data includes: Acquire a phase sequence of the service attribute data sequence, and acquire a spectrum amplitude corresponding to the phase sequence; Normalizing the spectrum amplitudes and arranging them in ascending order to obtain the spectrum amplitude sequence; The frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value is determined as the cutoff frequency.

6. The abnormal data detection method according to claim 4, characterized in that: Before predicting the periodic component of the service attribute data sequence to obtain periodic prediction data, the method includes: Obtaining an initial business attribute data sequence; Acquire initial service attribute data from the initial service attribute data sequence according to a preset first time sequence to obtain at least one second target service attribute data; Performing the mean analysis process on the second target business attribute data to determine the first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted; The first service attribute update data is used to replace the corresponding initial service attribute data in the initial service attribute data sequence to obtain the service attribute data sequence.

7. The abnormal data detection method according to claim 6, characterized in that: The point to be predicted is a point in the periodic data; The mean value analysis process comprises: In a period before the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain first initial data; In a period after the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain second initial data; Acquire third initial data and fourth initial data adjacent to the point to be predicted, and acquire an initial value corresponding to the point to be predicted; Obtain a weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, and obtain a first edge weight corresponding to the first initial data, a second edge weight corresponding to the second initial data, a third edge weight corresponding to the third initial data, and a fourth edge weight corresponding to the fourth initial data; weighting the first initial data, the second initial data, the third initial data, and the fourth initial data according to a preset third weight vector to obtain a prediction value corresponding to the point to be predicted; The predicted value is adopted to replace the initial value, and the process of obtaining the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value is returned to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data is obtained, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

8. The abnormal data detection method according to claim 2, characterized in that: The step of weighting the at least two types of prediction data to obtain a prediction baseline for the service attribute data includes: Obtaining a first weight vector and random noise; The trend prediction data, the period prediction data and the random noise are weighted according to the first weight vector to obtain a prediction baseline for the business attribute data.

9. The abnormal data detection method according to claim 8, characterized in that: After weighting the trend prediction data, the period prediction data and the random noise according to the first weight vector to obtain the prediction baseline of the business attribute data, the method further includes: Acquire the service attribute data from the service attribute data sequence according to the preset second time sequence to obtain at least one third target service attribute data; According to a preset second weight vector, weighting the third target service attribute data within a preset time period of the third target service attribute data is performed to obtain second service attribute update data; The second business attribute update data is used to replace the corresponding business attribute data in the prediction baseline of the business attribute data to obtain the updated prediction baseline of the business attribute data.

10. The abnormal data detection method according to any one of claims 1 to 9, characterized in that: The acquiring of real-time business attribute data and determining the real-time business attribute data outside the restricted interval formed by the business attribute prediction data as abnormal data includes: Comparing the real-time service attribute data with the limit value of the service attribute data and the jump value of the service attribute data in the service attribute prediction data; The real-time service attribute data that is outside the limit value of the service attribute data and the jump value range of the service attribute data is determined as the abnormal data.

11. An abnormal data detection device, characterized in that: include: A baseline prediction unit is configured to perform prediction on the acquired business attribute data sequence to obtain a prediction baseline of the business attribute data; wherein the business attribute data sequence is periodic data, the business attribute data in the business attribute data sequence includes the number of visits to the business or the attention data of the business object, and the prediction baseline is a trend line obtained by predicting the business attribute data sequence; A limit value prediction unit is configured to execute to obtain an error sequence between a prediction baseline of the business attribute data and actual measured data of the business attribute data, and to fit the error sequence to obtain a limit value of the business attribute data; wherein the limit value of the business attribute data includes a limit upper limit value and a limit lower limit value; A jump value prediction unit is configured to execute the backward difference sequence of the measured data, fit the difference sequence, and obtain the jump value of the service attribute data; wherein the jump value includes a jump upper limit value and a jump lower limit value; A service attribute prediction unit is configured to merge the limit value of the service attribute data and the jump value of the service attribute data into the prediction baseline of the service attribute data to obtain service attribute prediction data; The abnormal data detection unit is configured to acquire real-time business attribute data and determine the real-time business attribute data outside the restricted interval formed by the business attribute prediction data as abnormal data.

12. The abnormal data detection device according to claim 11, characterized in that: The baseline prediction unit is further configured to perform: Dividing the service attribute data sequence according to the frequency of the service attribute data sequence to obtain at least two first target service attribute data sequences; Predict each of the first target service attribute data sequences respectively to obtain prediction data corresponding to the first target service attribute data sequence; The at least two types of prediction data are weighted to obtain a prediction baseline for the business attribute data.

13. The abnormal data detection device according to claim 12, characterized in that: The at least two first target business attribute data sequences include a trend component of the business attribute data sequence and a period component of the business attribute data sequence; The baseline prediction unit is further configured to perform: Predicting the trend component of the business attribute data sequence to obtain trend prediction data; The periodic component of the service attribute data sequence is predicted to obtain periodic prediction data.

14. The abnormal data detection device according to claim 13, characterized in that: The baseline prediction unit is further configured to perform: Performing mean analysis processing on the business attribute data sequence, determining the prediction data corresponding to the target prediction point for which no business attribute data exists, and obtaining the trend prediction data; wherein the mean analysis processing includes determining the value of the to-be-predicted point according to the data within a preset range of the to-be-predicted point in the business attribute data sequence; the position corresponding to the target prediction point is the to-be-predicted point, and the trend prediction data is the value of the to-be-predicted point; Obtain a cutoff frequency corresponding to the business attribute data sequence, fit the periodic component corresponding to the business attribute data sequence under the restriction of the cutoff frequency, and expand the periodic component to obtain the periodic prediction data; wherein the cutoff frequency represents the maximum frequency for fitting the periodic component corresponding to the business attribute data sequence.

15. The abnormal data detection device according to claim 14, characterized in that: The baseline prediction unit is further configured to perform: Acquire a phase sequence of the service attribute data sequence, and acquire a spectrum amplitude corresponding to the phase sequence; Normalizing the spectrum amplitudes and arranging them in ascending order to obtain the spectrum amplitude sequence; The frequency of the first spectrum amplitude in the spectrum amplitude sequence that is greater than a first preset value is determined as the cutoff frequency.

16. The abnormal data detection device according to claim 14, characterized in that: The baseline prediction unit is further configured to perform: Obtaining an initial business attribute data sequence; Acquire initial service attribute data from the initial service attribute data sequence according to a preset first time sequence to obtain at least one second target service attribute data; Performing the mean analysis process on the second target business attribute data to determine the first business attribute update data corresponding to the second target business attribute data; wherein the position corresponding to the second target business attribute data is the point to be predicted, and the first business attribute update data is the value of the point to be predicted; The first service attribute update data is used to replace the corresponding initial service attribute data in the initial service attribute data sequence to obtain the service attribute data sequence.

17. The abnormal data detection device according to claim 16, characterized in that: The point to be predicted is a point in the periodic data; The baseline prediction unit is further configured to perform: In a period before the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain first initial data; In a period after the point to be predicted, acquiring data corresponding to the position of the point to be predicted to obtain second initial data; Acquire third initial data and fourth initial data adjacent to the point to be predicted, and acquire an initial value corresponding to the point to be predicted; Obtain a weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value, and obtain a first edge weight corresponding to the first initial data, a second edge weight corresponding to the second initial data, a third edge weight corresponding to the third initial data, and a fourth edge weight corresponding to the fourth initial data; weighting the first initial data, the second initial data, the third initial data, and the fourth initial data according to a preset third weight vector to obtain a prediction value corresponding to the point to be predicted; The predicted value is adopted to replace the initial value, and the process of obtaining the weight relationship between the first initial data, the second initial data, the third initial data, the fourth initial data and the initial value is returned to obtain the first edge weight corresponding to the first initial data, the second edge weight corresponding to the second initial data, the third edge weight corresponding to the third initial data and the fourth edge weight corresponding to the fourth initial data is obtained, until the fluctuation of the predicted value is less than the second preset value, the predicted value is determined as the value of the point to be predicted.

18. The abnormal data detection device according to claim 12, characterized in that: The baseline prediction unit is further configured to perform: Obtaining a first weight vector and random noise; The trend prediction data, the period prediction data and the random noise are weighted according to the first weight vector to obtain a prediction baseline for the business attribute data.

19. The abnormal data detection device according to claim 18, characterized in that: The baseline prediction unit is further configured to perform: Acquire the service attribute data from the service attribute data sequence according to the preset second time sequence to obtain at least one third target service attribute data; According to a preset second weight vector, weighting the third target service attribute data within a preset time period of the third target service attribute data is performed to obtain second service attribute update data; The second business attribute update data is used to replace the corresponding business attribute data in the prediction baseline of the business attribute data to obtain the updated prediction baseline of the business attribute data.

20. The abnormal data detection device according to any one of claims 11 to 19, characterized in that: The abnormal data detection unit is further configured to perform: Comparing the real-time service attribute data with the limit value of the service attribute data and the jump value of the service attribute data in the service attribute prediction data; The real-time service attribute data that is outside the limit value of the service attribute data and the jump value range of the service attribute data is determined as the abnormal data.

21. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the abnormal data detection method according to any one of claims 1 to 10.

22. A storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the abnormal data detection method according to any one of claims 1 to 10.

23. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the abnormal data detection method according to any one of claims 1 to 10 is implemented.

Images