An operation and maintenance data anomaly detection method and device

Abstract

The embodiment of the application provides a kind of operation and maintenance data exception detection method and device, it is related to computer technical field, can effectively detect operation and maintenance data, significantly improve detection effect.The method comprises: obtaining the historical operation and maintenance data corresponding to current operation and maintenance data, the current operation and maintenance data is the operation and maintenance data corresponding to target monitoring item at current time, the historical operation and maintenance data includes multiple operation and maintenance data corresponding to target monitoring item in historical time period, the data type of historical operation and maintenance data is one of the following: periodic, stationary or random, the type of current operation and maintenance data is identical with the type of historical operation and maintenance data;Then based on predetermined fitting algorithm, determine the fitting result corresponding to historical operation and maintenance data;And according to the fitting result corresponding to historical operation and maintenance data determine first detection parameter and second detection parameter;Further based on the first detection parameter and second detection parameter, determine whether current operation and maintenance data is abnormal.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for handling abnormal operation and maintenance data. Background Technology

[0002] With the development of information technology, various applications (Apps) are emerging in an endless stream. As the information processing equipment for these applications, the stability and reliability of servers (or server clusters) are becoming increasingly important. In actual business processing, various performance indicators of the server can be collected and analyzed to determine if there are any server anomalies.

[0003] Currently, different detection methods are used for different types of performance indicator data (hereinafter referred to as O&M data) to determine whether there is abnormal data in the O&M data, thereby determining whether the server is abnormal. Specifically, firstly, the collected O&M data is classified using an algorithm-selected decision tree, i.e., the type of collected O&M data is determined. The types of O&M data include periodic, stationary, and random. Then, the corresponding detection method is selected according to the type of O&M data to determine whether there is abnormality in the O&M data. For example, for periodic data, the year-on-year algorithm is used to determine whether there is abnormality in the O&M data; for stationary data, the sudden rise and fall algorithm is used to determine whether there is abnormality in the O&M data; and for random data, the constant threshold method is used to determine whether there is abnormality in the O&M data.

[0004] However, the above methods require different detection methods for different types of operation and maintenance data, and all of these different detection methods involve threshold settings. Deviations in threshold settings may lead to significant errors in the detection results. Summary of the Invention

[0005] This application provides a method and apparatus for detecting anomalies in operation and maintenance data, which can effectively detect operation and maintenance data and significantly improve the detection effect.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0007] In a first aspect, embodiments of this application provide a method for detecting anomalies in operation and maintenance (O&M) data, comprising: acquiring historical O&M data corresponding to current O&M data, determining a fitting result corresponding to the historical O&M data based on a predetermined fitting algorithm, and determining a first detection parameter and a second detection parameter based on the fitting result corresponding to the historical O&M data, wherein the first detection parameter and the second detection parameter are used to detect whether the O&M data is abnormal; and determining whether the current O&M data is abnormal based on the first detection parameter and the second detection parameter. The current O&M data is the O&M data corresponding to the target monitoring item at the current time, and the historical O&M data includes multiple O&M data corresponding to the target monitoring item within a historical time period. The data type of the historical O&M data is one of the following: periodic, stable, or random, and the data type of the current O&M data is the same as that of the historical O&M data.

[0008] In this embodiment, the monitoring items may include the server's processor (e.g., CPU), memory, etc. The server's operating status is determined by analyzing the operational data corresponding to these monitoring items. The target monitoring item can be one of the aforementioned monitoring items. It should be understood that for each monitoring item, there are multiple performance indicators. For example, if the target monitoring item is the CPU, then the CPU's performance indicators include CPU utilization, CPU load, etc.

[0009] The data type of the aforementioned historical operation and maintenance data is one of the following: periodic, stable, or random. It should be understood that the current operation and maintenance data is of the same type as the historical operation and maintenance data. Periodic refers to data that fluctuates regularly in a periodic manner (for example, some advertising revenue or search traffic is periodic data); stable refers to data that fluctuates within a small range in the short term and does not suddenly rise or fall; random refers to data that fluctuates irregularly.

[0010] The anomaly detection method for operation and maintenance data provided in this application is applied to analyze various performance indicators of a server to determine whether the server has any anomalies. Specifically, the detection device acquires historical operation and maintenance data, which includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period. The data type of the historical operation and maintenance data is one of the following: periodic, stationary, or random. Based on a predetermined fitting algorithm, the fitting result corresponding to the historical operation and maintenance data is determined. A first detection parameter and a second detection parameter are determined based on the fitting result corresponding to the historical operation and maintenance data. Then, based on the first detection parameter and the second detection parameter, it is determined whether the current operation and maintenance data is abnormal. Compared with the existing method of detecting operation and maintenance data by setting a fixed threshold, the detection parameters (i.e., the first detection parameter and the second detection parameter) obtained based on the historical operation and maintenance data corresponding to the current operation and maintenance data in this application embodiment are more applicable and flexible, and can effectively detect operation and maintenance data based on these parameters, significantly improving the detection effect.

[0011] In one possible implementation, before determining the fitting result corresponding to the historical operation and maintenance data based on a predetermined fitting algorithm, the anomaly detection method for operation and maintenance data provided in this application embodiment further includes: determining the type of historical operation and maintenance data.

[0012] Optionally, this embodiment of the application uses a random forest algorithm to determine the type of historical operation and maintenance data, that is, to determine whether the type of historical operation and maintenance data is periodic, stationary, or random. Specifically, the detection device divides the historical data into multiple data groups, and then performs feature extraction (extracting multi-dimensional features) for each data group. The extracted features are used as input to the random forest model, and the random forest model outputs the classification result for each data group. Finally, the classification results of multiple data groups are statistically analyzed, and the type of historical operation and maintenance data is determined based on the statistical results. This statistical result can also be understood as a voting result. The detection device counts the number of periodic data, the number of stationary data, and the number of random data in the identification results corresponding to multiple data groups, and takes the type with the most occurrences in the statistical results as the type of historical operation and maintenance data.

[0013] In one possible implementation, the aforementioned historical operation and maintenance data is of a periodic type. The determination of the fitting result corresponding to the historical operation and maintenance data based on the predetermined fitting algorithm specifically includes: removing the periodic component of the historical operation and maintenance data to obtain processed historical operation and maintenance data, wherein the periodic component is the median of multiple historical operation and maintenance data corresponding to the current time; and fitting the processed historical operation and maintenance data using a first fitting parameter based on the predetermined fitting algorithm to obtain the fitting result corresponding to the historical operation and maintenance data, wherein the first fitting parameter is a preset duration or a preset quantity.

[0014] The first fitting parameter mentioned above is a preset duration or a preset number. This first fitting parameter is used to determine how many reference data points are used to predict each data point in the processed historical operation and maintenance data. These reference data points come from the processed historical operation and maintenance data mentioned above.

[0015] In this embodiment, the median periodic component of multiple historical operation and maintenance data corresponding to the current time is used as a periodic component. Since the median is not easily affected by the extreme values ​​in the historical operation and maintenance data, using the median as a periodic component can not only reflect the periodic fluctuations of the historical operation and maintenance data, but also has strong anti-interference ability.

[0016] In one possible implementation, determining the first and second detection parameters based on the fitting results corresponding to the historical operation and maintenance data specifically includes: determining the difference between the processed historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data; and determining the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0017] In one possible implementation, determining whether the current operation and maintenance data is abnormal based on the first detection parameter and the second detection parameter specifically includes: removing the periodic component of the current operation and maintenance data to obtain processed current operation and maintenance data; fitting the processed current operation and maintenance data with the first fitting parameter based on a predetermined fitting algorithm to obtain the fitting result corresponding to the current operation and maintenance data; and determining the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data; then determining the first detection threshold and the second detection threshold according to the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, n is a preset value, n is greater than 0, * represents multiplication, and the first detection threshold is less than the second detection threshold; if the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0018] In this embodiment of the application, for periodic operation and maintenance data, the above-mentioned removal of the periodic component of the operation and maintenance data before processing and detection can remove the influence of the periodic fluctuation of the operation and maintenance data on the detection results, and the detection results are less affected by abnormal quantities.

[0019] In one possible implementation, the type of historical operation and maintenance data is random. Determining the fitting result corresponding to the historical operation and maintenance data based on a predetermined fitting algorithm specifically includes: using a second fitting parameter to fit the historical operation and maintenance data based on the predetermined fitting algorithm to obtain the fitting result corresponding to the historical operation and maintenance data. The second fitting parameter is a preset duration or a preset quantity.

[0020] In one possible implementation, the historical operation and maintenance data is of a stationary type. The specific steps to determine the fitting result corresponding to the historical operation and maintenance data based on the predetermined fitting algorithm include: using a third fitting parameter to fit the historical operation and maintenance data based on the predetermined fitting algorithm to obtain the fitting result corresponding to the historical operation and maintenance data. The third fitting parameter is a preset duration or a preset quantity.

[0021] In one possible implementation, determining the first and second detection parameters based on the fitting results corresponding to the historical operation and maintenance data specifically includes: determining the difference between the historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data; and determining the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0022] In one possible implementation, determining whether the current operation and maintenance data is abnormal based on the first detection parameter and the second detection parameter specifically includes: fitting the current operation and maintenance data using the second fitting parameter based on a predetermined fitting algorithm to obtain the fitting result corresponding to the current operation and maintenance data; determining the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data; and determining a first detection threshold and a second detection threshold according to the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, * represents multiplication, and the first detection threshold is less than the second detection threshold; if the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0023] In one possible implementation, determining whether the current operation and maintenance data is abnormal based on the first detection parameter and the second detection parameter specifically includes: fitting the current operation and maintenance data using a third fitting parameter based on a predetermined fitting algorithm to obtain the fitting result corresponding to the current operation and maintenance data; determining the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data; and determining a first detection threshold and a second detection threshold according to the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, * represents multiplication, and the first detection threshold is less than the second detection threshold; if the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0024] Optionally, in this embodiment, the second fitting parameter and the first fitting parameter can be the same, for example, both being 3 hours prior to the current time. The third fitting parameter can be different from the first and second fitting parameters, for example, the third fitting parameter being 1 hour prior to the current time. The specific method is determined according to the actual situation, and this embodiment does not impose any limitations.

[0025] In one possible implementation, before determining the fitting result corresponding to the historical operation and maintenance data based on a predetermined fitting algorithm, the operation and maintenance data anomaly detection method provided in this application embodiment further includes: preprocessing the historical operation and maintenance data, the preprocessing including: interpolation processing and / or smoothing processing.

[0026] In this embodiment, interpolation processing of historical operation and maintenance data can supplement operation and maintenance data lost due to network or storage anomalies; smoothing processing of historical operation and maintenance data can remove abnormal or noisy data from historical operation and maintenance data, and then determining the first detection parameter and the second detection parameter based on the preprocessed historical operation and maintenance data, so that the detection results are more accurate and reliable when anomaly detection of operation and maintenance data is performed based on the first detection parameter and the second detection parameter.

[0027] Secondly, embodiments of this application provide an operation and maintenance data detection device, including: an acquisition module, a determination module, and a detection module. The acquisition module is used to acquire historical operation and maintenance data corresponding to the current operation and maintenance data. The current operation and maintenance data is the operation and maintenance data corresponding to the target monitoring item at the current time. The historical operation and maintenance data includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period. The data type of the historical operation and maintenance data is one of the following: periodic, stationary, or random. The type of the current operation and maintenance data is the same as the type of the historical operation and maintenance data. The determination module is used to determine the fitting result corresponding to the historical operation and maintenance data based on a predetermined fitting algorithm; and to determine a first detection parameter and a second detection parameter based on the fitting result corresponding to the historical operation and maintenance data. The first detection parameter and the second detection parameter are used to detect whether the operation and maintenance data is abnormal. The detection module is used to determine whether the current operation and maintenance data is abnormal based on the first detection parameter and the second detection parameter.

[0028] In one possible implementation, the aforementioned determining module is also used to determine the type of historical operation and maintenance data.

[0029] In one possible implementation, the historical operation and maintenance data is of a periodic type. The aforementioned determining module is specifically used to remove the periodic component of the historical operation and maintenance data to obtain processed historical operation and maintenance data. The periodic component is the median of multiple historical operation and maintenance data corresponding to the current moment. Furthermore, based on a predetermined fitting algorithm, the processed historical operation and maintenance data is fitted using a first fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The first fitting parameter is a preset duration or a preset quantity.

[0030] In one possible implementation, the aforementioned determining module is specifically used to determine the difference between the processed historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; and to determine the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0031] In one possible implementation, the determining module is further configured to remove the periodic components of the current operation and maintenance data to obtain processed current operation and maintenance data; and to fit the processed current operation and maintenance data using a predetermined fitting algorithm and first fitting parameters to obtain a fitting result corresponding to the current operation and maintenance data; and to determine the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data. The detection module is specifically configured to determine a first detection threshold and a second detection threshold based on the first detection parameter and the second detection parameter. The first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, n is a preset value (n > 0), * represents multiplication, and the first detection threshold is less than the second detection threshold. If the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0032] In one possible implementation, the historical operation and maintenance data is of random type. The determination module is specifically used to fit the historical operation and maintenance data based on a predetermined fitting algorithm and a second fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The second fitting parameter is a preset duration or a preset quantity.

[0033] In one possible implementation, the aforementioned determining module is specifically used to fit historical operation and maintenance data based on a predetermined fitting algorithm and a third fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The third fitting parameter is a preset duration or a preset quantity.

[0034] In one possible implementation, the aforementioned determining module is specifically used to determine the difference between the historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; and to determine the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0035] In one possible implementation, the determining module is further configured to fit the current operation and maintenance data using a second fitting parameter based on a predetermined fitting algorithm to obtain a fitting result corresponding to the current operation and maintenance data; and to determine the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data. The detection module is specifically configured to determine a first detection threshold and a second detection threshold based on a first detection parameter and a second detection parameter. The first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, * represents multiplication, and the first detection threshold is less than the second detection threshold. If the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0036] In one possible implementation, the determining module is further configured to fit the current operation and maintenance data using a third fitting parameter based on a predetermined fitting algorithm, to obtain the fitting result corresponding to the current operation and maintenance data; and to determine the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data. The detection module is specifically configured to determine a first detection threshold and a second detection threshold based on a first detection parameter and a second detection parameter. The first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, * represents multiplication, and the first detection threshold is less than the second detection threshold. If the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0037] In one possible implementation, the operation and maintenance data detection device provided in this application embodiment further includes a preprocessing module; the preprocessing module is used to preprocess historical operation and maintenance data, and the preprocessing includes: interpolation processing and / or smoothing processing.

[0038] Thirdly, embodiments of this application provide a detection device, including a memory and at least one processor connected to the memory. The memory is used to store instructions. After the instructions are read by the at least one processor, the detection device executes the method in the first aspect or any possible implementation of the first aspect, as detailed in the above description, which will not be repeated here.

[0039] Fourthly, embodiments of this application provide a computer-readable storage medium for storing computer software instructions for use in the aforementioned detection device, comprising a program designed to execute the first aspect or any possible implementation thereof.

[0040] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect or any possible implementation thereof.

[0041] Sixthly, embodiments of this application provide a chip including a memory and a processor. The memory is used to store computer instructions. The processor is used to retrieve and execute the computer instructions from the memory to perform the methods described in the first aspect and any possible implementation thereof. Attached Figure Description

[0042] Figure 1 This is a hardware schematic diagram of a detection device provided in an embodiment of this application;

[0043] Figure 2 A schematic diagram of an anomaly detection method for operation and maintenance data provided in this application embodiment. Figure 1 ;

[0044] Figure 3 A schematic diagram of an anomaly detection method for operation and maintenance data provided in this application embodiment. Figure 2 ;

[0045] Figure 4 A schematic diagram of an anomaly detection method for operation and maintenance data provided in this application embodiment. Figure 3 ;

[0046] Figure 5 A schematic diagram of an anomaly detection method for operation and maintenance data provided in this application embodiment. Figure 4 ;

[0047] Figure 6 A schematic diagram of an anomaly detection method for operation and maintenance data provided in this application embodiment. Figure 5 ;

[0048] Figure 7 This application provides a schematic flowchart of an anomaly detection method for operation and maintenance data.

[0049] Figure 8 A schematic diagram of the structure of an operation and maintenance data detection device provided in this application embodiment. Figure 1 ;

[0050] Figure 9 A schematic diagram of the structure of an operation and maintenance data detection device provided in this application embodiment. Figure 2 . Detailed Implementation

[0051] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0052] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects. For example, "first fitting parameter" and "second fitting parameter," etc., are used to distinguish different fitting parameters, not to describe a specific order of fitting parameters.

[0053] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0054] In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. For example, multiple processing units means two or more processing units; multiple systems means two or more systems.

[0055] To address the problems existing in the background technology, this application provides an anomaly detection method and apparatus for operation and maintenance data. This method is applied to scenarios where various performance indicators of a server are analyzed to determine if the server exhibits any anomalies. Specifically, the detection device acquires historical operation and maintenance data, which includes multiple operation and maintenance data corresponding to target monitoring items within a historical time period. The data type of this historical operation and maintenance data is one of the following: periodic, stationary, or random. Based on a predetermined fitting algorithm, a fitting result corresponding to the historical operation and maintenance data is determined. A first detection parameter and a second detection parameter are determined based on the fitting result corresponding to the historical operation and maintenance data. Then, based on the first and second detection parameters, it is determined whether the current operation and maintenance data is abnormal. The technical solution provided by this application can effectively detect operation and maintenance data, significantly improving the detection effect.

[0056] The apparatus for implementing the anomaly detection method for operation and maintenance data provided in the embodiments of this application can be a detection device. Figure 1 This is a schematic diagram of the hardware structure of the detection device 100 provided in the embodiments of this application, as shown below. Figure 1 As shown, the detection device 100 includes a processor 101, a memory 102, and a network interface 103, etc.

[0057] The processor 101 is the core component of the detection device 100. The processor 101 is used to run the operating system of the detection device 100 and the applications (including system applications and third-party applications) on the detection device 100 to implement the method of the detection device 100 to perform operation and maintenance data detection.

[0058] In this embodiment, the processor 101 may be a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, transistor logic device, hardware component, or any combination thereof, which can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of this invention; the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of DSP and microprocessor, etc.

[0059] Optionally, the testing device 100 includes one or more CPUs, which are single-core CPUs or multi-core CPUs.

[0060] The processor 101 includes one or more central processing units (CPUs). The CPU can be a single-core CPU or a multi-core CPU.

[0061] The memory 102 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, or optical memory. The memory 102 stores the operating system code.

[0062] Optionally, the processor 101 implements the method in the above embodiments by reading instructions stored in the memory 102, or the processor 101 implements the method provided in the embodiments of this application by internally stored instructions. When the processor 101 implements the method provided in the embodiments of this application by reading instructions stored in the memory 102, the memory 102 stores instructions for implementing the anomaly detection method for operation and maintenance data provided in the embodiments of this application.

[0063] Network interface 103 is a wired interface, such as a fiber distributed data interface (FDDI) or a gigabit Ethernet (GE) interface. Alternatively, network interface 103 is a wireless interface. Network interface 103 is used to detect communication between the device and other devices.

[0064] The memory 102 is used to store operation and maintenance data. Optionally, the memory 102 also includes storage for detection records, etc. At least one processor 101 further executes the method described in the above method embodiments based on the operation and maintenance data and detection records stored in the memory 102. For more details on how the processor 101 implements the above functions, please refer to the descriptions in the following method embodiments.

[0065] Optionally, the detection device 100 also includes a bus 104, through which the processor 101 and memory 102 are typically interconnected or in other ways.

[0066] Optionally, the detection device 100 also includes an input / output interface 105, which is used to connect to an input device and receive detection requirements input by the user through the input device (e.g., which performance indicator of which monitoring item to detect). Input devices include, but are not limited to, keyboards, touchscreens, microphones, etc. The input / output interface 105 is also used to connect to an output device to output the detection results of the processor 101 (i.e., whether the current maintenance data is abnormal). Output devices include, but are not limited to, monitors, printers, etc.

[0067] The anomaly detection method for operation and maintenance data provided in this application embodiment can be applied to data with, for example, anomaly detection methods for operation and maintenance data. Figure 1 The detection equipment with the hardware structure shown may be a detection equipment with a similar structure, or may also be used in detection equipment with other structures. This application does not limit the scope of the embodiments.

[0068] like Figure 2 As shown, the anomaly detection method for operation and maintenance data provided in this application embodiment includes S101-S104.

[0069] S101. Obtain historical operation and maintenance data corresponding to the current operation and maintenance data.

[0070] The current operation and maintenance data is the operation and maintenance data corresponding to the target monitoring item at the current moment, while the historical operation and maintenance data includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period.

[0071] In this embodiment, the monitoring items may include the server's processor (e.g., CPU), memory, etc. The server's operating status is determined by analyzing the operational data corresponding to these monitoring items. The target monitoring item can be one of the aforementioned monitoring items. It should be understood that for each monitoring item, there are multiple performance indicators. For example, if the target monitoring item is the CPU, then the CPU's performance indicators include CPU utilization, CPU load, etc.

[0072] The multiple operational data corresponding to the aforementioned target monitoring item are performance metrics collected at fixed intervals (e.g., every minute) for a certain performance indicator, resulting in multiple performance indicators. For example, the multiple operational data corresponding to the aforementioned target monitoring item may be CPU utilization collected at multiple times. Alternatively, the multiple operational data corresponding to the target monitoring item may be CPU load collected at multiple times, depending on the actual situation, and this application embodiment does not impose any limitations.

[0073] In this embodiment of the application, when the detection device detects a certain operation and maintenance data at the current moment (hereinafter referred to as the current operation and maintenance data), the detection device first obtains the operation and maintenance data within the historical time period corresponding to the current operation and maintenance data. The operation and maintenance data within the historical time period and the current operation and maintenance data are the same performance indicators. For example, if the current operation and maintenance data is the CPU utilization rate, then the detection device obtains the utilization rates of multiple CPUs within the historical time period.

[0074] Optionally, the aforementioned historical time period is a period of time between the current moment and the present moment, such as one week (7 days) before the current moment or two weeks (14 days) before the current moment. The duration of the historical time period can be determined according to actual needs, and this application embodiment does not limit it.

[0075] The data type of the aforementioned historical operation and maintenance data is one of the following: periodic, stable, or random. It should be understood that the current operation and maintenance data is of the same type as the historical operation and maintenance data. Periodic refers to data that fluctuates regularly in a periodic manner (for example, some advertising revenue or search traffic is periodic data); stable refers to data that fluctuates within a small range in the short term and does not suddenly rise or fall; random refers to data that fluctuates irregularly.

[0076] S102. Based on the predetermined fitting algorithm, determine the fitting result corresponding to the historical operation and maintenance data.

[0077] It should be understood that the fitting results corresponding to the above historical operation and maintenance data are the fitting results corresponding to each of the multiple operation and maintenance data contained in the historical operation and maintenance data, that is, the prediction results of each of the multiple operation and maintenance data.

[0078] The aforementioned pre-defined fitting algorithm is a local quadratic regression algorithm (or a local quadratic curve fitting algorithm).

[0079] Alternatively, other fitting algorithms can be used to obtain the fitting results corresponding to the historical operation and maintenance data. Specifically, a suitable fitting algorithm is selected as the predetermined fitting algorithm according to the actual situation, and this application embodiment does not limit it.

[0080] S103. Determine the first detection parameter and the second detection parameter based on the fitting results corresponding to the historical operation and maintenance data.

[0081] The first and second detection parameters are used to detect whether the operation and maintenance data is abnormal.

[0082] S104. Based on the first detection parameter and the second detection parameter, determine whether the current operation and maintenance data is abnormal.

[0083] The process of determining the first and second detection parameters, as well as the process of determining whether the current operation and maintenance data is abnormal based on the first and second detection parameters, will be described in detail in the following embodiments in conjunction with the data types of historical operation and maintenance data.

[0084] The anomaly detection method for operation and maintenance data provided in this application is applied to analyze various performance indicators of a server to determine whether the server has any anomalies. Specifically, the detection device acquires historical operation and maintenance data, which includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period. The data type of the historical operation and maintenance data is one of the following: periodic, stationary, or random. Based on a predetermined fitting algorithm, the fitting result corresponding to the historical operation and maintenance data is determined. A first detection parameter and a second detection parameter are determined based on the fitting result corresponding to the historical operation and maintenance data. Then, based on the first detection parameter and the second detection parameter, it is determined whether the current operation and maintenance data is abnormal. Compared with the existing method of detecting operation and maintenance data by setting a fixed threshold, the detection parameters (i.e., the first detection parameter and the second detection parameter) obtained based on the historical operation and maintenance data corresponding to the current operation and maintenance data in this application embodiment are more applicable and flexible, and can effectively detect operation and maintenance data based on these parameters, significantly improving the detection effect.

[0085] Furthermore, the anomaly detection method for operation and maintenance data provided in this application embodiment can use a unified detection method for different types of operation and maintenance data, which can simplify the detection process and reduce the complexity of detecting operation and maintenance data.

[0086] Combination Figure 2 ,like Figure 3 As shown, prior to S102 above, the anomaly detection method for operation and maintenance data provided in this application embodiment further includes S105.

[0087] S105. Determine the type of historical operation and maintenance data.

[0088] It should be understood that the type of the historical operation and maintenance data is one of periodic, stationary, or random, that is, the detection equipment determines which of the above three types the historical operation and maintenance data is.

[0089] Optionally, in this embodiment of the application, the detection device determines the type of historical operation and maintenance data based on the random forest algorithm. Taking 14 days of historical operation and maintenance data as an example, the 14 days of operation and maintenance data is divided into 7 data groups, each containing 2 consecutive days of operation and maintenance data. Then, multidimensional features are extracted from each of the 7 data groups, and the multidimensional features of the data groups are used as input to the random forest model in the random forest algorithm. Thus, the random forest model outputs the classification results of the 7 data groups. The classification results are the types of historical operation and maintenance data contained in each of the 7 data groups.

[0090] Based on the example above, a dataset containing data for two days, denoted as DAY1 and DAY2, can have its multidimensional features represented as follows:

[0091]

[0092] Where μ1 is the mean of the historical operation and maintenance data corresponding to DAY1, and μ2 is the mean of the historical operation and maintenance data corresponding to DAY2; σ1 is the standard deviation of the historical operation and maintenance data corresponding to DAY1, and σ2 is the standard deviation of the historical operation and maintenance data corresponding to DAY2; D1 is the data width of the historical operation and maintenance data corresponding to DAY1 (this data width is the difference between the maximum and minimum values ​​of the historical operation and maintenance data corresponding to DAY1), and D2 is the data width of the historical operation and maintenance data corresponding to DAY2 (this data width is the difference between the maximum and minimum values ​​of the historical operation and maintenance data corresponding to DAY2); σ3 is the standard deviation of the difference between the historical operation and maintenance data corresponding to DAY1 and the historical operation and maintenance data corresponding to DAY2; and D3 is the Euclidean distance between the historical operation and maintenance data corresponding to DAY1 and the historical operation and maintenance data corresponding to DAY2.

[0093] Based on the above examples, Table 1 below shows an example of the identification results of the above 7 data groups based on the random forest algorithm.

[0094] Table 1

[0095] Data Group 1 Periodic Data Group 2 Periodic Data Group 3 Periodic Data Group 4 stability Data Group 5 Periodic Data set 6 random Data Group 7 random

[0096] After obtaining the identification results of the seven data groups, the detection device statistically analyzes these results to determine the type of the historical maintenance data. This statistical result can also be understood as a voting result. The detection device counts the number of periodic data, stationary data, and random data in the identification results corresponding to the seven data groups, and uses the type with the highest number of occurrences in the statistical result as the type of the historical maintenance data. Table 2 below shows an example of the statistical results.

[0097] Table 2

[0098] Periodic 4 Stable type 1 random 2

[0099] Based on Table 2, the historical operation and maintenance data can be determined to be of a periodic type. For a detailed description of the random forest algorithm, please refer to the relevant introductions to the random forest algorithm in the prior art; this application's embodiments will not elaborate further.

[0100] like Figure 4 As shown, in conjunction with S105 (i.e., determining the type of historical operation and maintenance data), in one implementation, the above S102 specifically includes S1021-S1022.

[0101] S1021. When the type of historical operation and maintenance data is periodic, remove the periodic component of the historical operation and maintenance data to obtain the processed historical operation and maintenance data.

[0102] In this embodiment, the periodic component is the median of multiple historical operation and maintenance data corresponding to the current time. Specifically, the periodic component is determined based on a portion of the historical operation and maintenance data. First, multiple historical operation and maintenance data corresponding to the current time are selected from all the operation and maintenance data included in the historical operation and maintenance data. Then, the median of the multiple historical operation and maintenance data is calculated, and the median of the multiple historical operation and maintenance data is determined as the periodic component.

[0103] For example, if the aforementioned historical maintenance data is collected every minute over 14 consecutive days prior to the current time, and the current time is 14:22, then the multiple historical maintenance data points corresponding to the current time are the maintenance data at 14:22 for each of those 14 days. This yields 14 historical maintenance data points corresponding to the current time. The median of these 14 historical maintenance data points is then calculated and used as the periodic component. Since the median is less susceptible to extreme values ​​in the historical maintenance data, using the median as the periodic component not only reflects the periodic fluctuations of the historical maintenance data but also has strong anti-interference properties.

[0104] After identifying the periodic components of the operation and maintenance data, the periodic components are removed from the acquired historical operation and maintenance data. Specifically, the periodic components are subtracted from each of the multiple historical operation and maintenance data points to obtain the processed historical operation and maintenance data. It should be understood that this processed historical operation and maintenance data is composed of the differences between the historical operation and maintenance data and the periodic components.

[0105] S1022. Based on the predetermined fitting algorithm, the first fitting parameters are used to fit the processed historical operation and maintenance data to obtain the fitting result corresponding to the historical operation and maintenance data.

[0106] The first fitting parameter is a preset duration or a preset number. This first fitting parameter is used to determine how many reference data points are used to predict each data point in the processed historical operation and maintenance data. These reference data points are derived from the processed historical operation and maintenance data.

[0107] In this embodiment of the application, fitting the processed historical operation and maintenance data with the first fitting parameter based on the predetermined fitting algorithm specifically refers to: predicting each data in the processed historical operation and maintenance data to obtain the prediction result of each data in the processed historical operation and maintenance data.

[0108] Taking a single data point from processed historical operation and maintenance data (hereinafter referred to as "first data") as an example, the process of fitting the processed historical operation and maintenance data is illustrated. First, reference data is determined based on the aforementioned first fitting parameters. Specifically, if the first fitting parameter is a preset duration (e.g., 3 hours), the reference data consists of processed historical operation and maintenance data (excluding the first data) contained within the 3 hours preceding the time corresponding to the first data. The number of reference data points is 180 (one data point is collected every minute). If the first fitting parameter is a preset quantity of 180, then the number of reference data points is determined to be 180, which are the 180 processed historical operation and maintenance data points preceding the time corresponding to the first data. Then, based on a preset fitting algorithm (e.g., local quadratic regression algorithm), the 180 reference data points are used to fit (predict) the first data, obtaining the fitting result of the first data (i.e., the predicted value of the first data). Similarly, using the above method, fitting results for multiple data points contained in the processed historical operation and maintenance data can be obtained.

[0109] like Figure 4 As shown, S103 specifically includes S1031-S1032.

[0110] S1031. Determine the difference between the processed historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data.

[0111] The difference between the processed historical operation and maintenance data and the corresponding fitting result refers to the difference between the actual value of the processed historical operation and maintenance data and the corresponding fitting result. Table 3 below is an example of the difference between the processed historical operation and maintenance data and the corresponding fitting result.

[0112] Table 3

[0113] <![CDATA[a1]]> <![CDATA[a1']]> <![CDATA[Δa1]]> <![CDATA[a2]]> <![CDATA[a2']]> <![CDATA[Δa2]]> <![CDATA[a3]]> <![CDATA[a3']]> <![CDATA[Δa3]]> … … … <![CDATA[a n ]]> <![CDATA[a n ']]> <![CDATA[Δa n ]]>

[0114] S1032. Determine the mean and standard deviation of the difference between the processed historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data, and use the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0115] Based on Table 3, determine Δa1, Δa2, Δa3, ..., Δa n The mean is μ and the standard deviation is σ. Thus, the first detection parameter is μ and the second detection parameter is σ.

[0116] like Figure 4 As shown, S104 specifically includes S1041a-S1041e.

[0117] S1041a. Remove the periodic component from the current operation and maintenance data to obtain the processed current operation and maintenance data.

[0118] This periodic component is the periodic component described in S1021 above.

[0119] S1041b: Based on the predetermined fitting algorithm, the first fitting parameters are used to fit the processed current operation and maintenance data to obtain the fitting result corresponding to the current operation and maintenance data.

[0120] The predetermined fitting algorithm is the same as the predetermined fitting algorithm for fitting historical operation and maintenance data described above. The first fitting parameter is the same as the first fitting parameter for fitting historical operation and maintenance data described above. For a detailed description of S1041a-S1041b, please refer to the detailed description of S1021-S1022 described above. It will not be repeated here.

[0121] S1041c, Determine the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data.

[0122] Assuming the current operation and maintenance data is b, the processed current operation and maintenance data is b1, and the fitting result corresponding to the current operation and maintenance data b is b1' (it should be understood that b1' is the predicted value of b1), then the difference between the processed current operation and maintenance data b1 and the fitting result b1' corresponding to the current operation and maintenance data is Δb1.

[0123] S1041d: Determine the first detection threshold and the second detection threshold based on the first detection parameter and the second detection parameter.

[0124] The first detection threshold satisfies: TH_D = μ - n * σ, and the second detection threshold satisfies: TH_U = μ + n * σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, n is a preset value, n is greater than 0, * represents multiplication, and the first detection threshold is less than the second detection threshold.

[0125] S1041e If the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0126] Based on the above example, if Δb1 is located in the interval (μ-n*σ, μ+n*σ), then the current operation and maintenance data b is determined to be normal; otherwise, the current operation and maintenance data b is determined to be abnormal.

[0127] In summary, when historical operation and maintenance data is periodic, the periodic component of the historical operation and maintenance data is first removed, and then the historical operation and maintenance data after removing the periodic component is fitted to obtain the first detection parameter and the second detection parameter. Similarly, when detecting current operation and maintenance data of the same type as the historical operation and maintenance data, the periodic component of the current operation and maintenance data is first removed, and then the current operation and maintenance data after removing the periodic component is fitted. Finally, based on the first detection parameter and the second detection parameter, it is determined whether the current operation and maintenance data is abnormal. In this embodiment of the application, for periodic operation and maintenance data, the above-mentioned removal of the periodic component of the operation and maintenance data before processing and detecting the operation and maintenance data can remove the influence of the periodic fluctuation of the operation and maintenance data on the detection results, and the detection results are less affected by the amount of anomalies.

[0128] like Figure 5 As shown, in conjunction with S105, in another implementation, the above S102 may specifically include S1023.

[0129] S1023. When the type of historical operation and maintenance data is random, the historical operation and maintenance data is fitted using the second fitting parameter based on the predetermined fitting algorithm to obtain the fitting result corresponding to the historical operation and maintenance data.

[0130] The second fitting parameter is a preset duration or a preset number of reference data points used to determine how many reference data points are used to predict each data point in the historical operation and maintenance data. Optionally, the second fitting parameter can be the same as the first fitting parameter; for example, if the second fitting parameter is a preset duration, it could be 3 hours prior to the current time. Alternatively, the second fitting parameter can be different from the first fitting parameter, depending on the specific circumstances, and this embodiment does not impose limitations.

[0131] For a description of S1023, please refer to the detailed description of S1022 in the above embodiments, which will not be repeated here.

[0132] like Figure 5 As shown, S103 specifically includes S1033-S1034.

[0133] S1033. Determine the difference between the historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data.

[0134] S1034. Determine the mean and standard deviation of the difference between the historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data. Use the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0135] For the description of S1033-S1034, please refer to the relevant description of S1031-S1032 in the above embodiments, which will not be repeated here.

[0136] like Figure 5 As shown, S104 specifically includes S1042a-S1042d.

[0137] S1042a. Based on the predetermined fitting algorithm, the current operation and maintenance data is fitted using the second fitting parameters to obtain the fitting result corresponding to the current operation and maintenance data.

[0138] Similarly, the predetermined fitting algorithm is the same as the predetermined fitting algorithm for fitting historical operation and maintenance data described above, and the second fitting parameter is the same as the second fitting parameter for fitting historical operation and maintenance data described above. For a detailed description of S1042a, please refer to the detailed description of S1023 described above; it will not be repeated here.

[0139] S1042b: Determine the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data.

[0140] Suppose the current operation and maintenance data is b, and the fitting result corresponding to the current operation and maintenance data b is b' (it should be understood that b' is the predicted value of b), then the difference between the current operation and maintenance data b and the fitting result b' corresponding to the current operation and maintenance data is Δb.

[0141] S1042c. Determine the first detection threshold and the second detection threshold based on the first detection parameter and the second detection parameter.

[0142] The first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, and * represents multiplication. The first detection threshold is less than the second detection threshold.

[0143] S1042d. If the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0144] Based on the above example, if the above Δb is located in the interval (μ-n*σ, μ+n*σ), then the current operation and maintenance data b is determined to be normal; otherwise, the current operation and maintenance data b is determined to be abnormal.

[0145] In summary, when the historical operation and maintenance data is of the random type, the historical operation and maintenance data is fitted to obtain the first detection parameter and the second detection parameter; then, when detecting current operation and maintenance data of the same type as the historical operation and maintenance data, the current operation and maintenance data is fitted to, and then the first detection parameter and the second detection parameter are used to determine whether the current operation and maintenance data is abnormal.

[0146] like Figure 6 As shown, in another implementation, in conjunction with S105, the above-mentioned S102 may specifically include S1024.

[0147] S1024. Based on the predetermined fitting algorithm, the historical operation and maintenance data is fitted using the third fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data.

[0148] The third fitting parameter mentioned above is a preset duration or a preset quantity. This third fitting parameter is used to determine how many reference data points are used to predict each data point in the historical operation and maintenance data. These reference data points are derived from the historical operation and maintenance data. Optionally, the third fitting parameter may be different from the first or second fitting parameter mentioned above. For example, when the third fitting parameter is a preset duration, it may be one hour prior to the current time. Alternatively, the third fitting parameter may be the same as the first or second fitting parameter, depending on the actual situation. This application embodiment does not impose any limitations on this.

[0149] For a description of S1024, please refer to the detailed description of S1022 in the above embodiments, which will not be repeated here.

[0150] like Figure 6 As shown, S103 specifically includes S1035-S1036.

[0151] S1035. Determine the difference between the historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data.

[0152] S1036. Determine the mean and standard deviation of the difference between the historical operation and maintenance data and the fitting results corresponding to the historical operation and maintenance data, and use the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

[0153] For the description of S1035-S1036, please refer to the relevant description of S1031-S1032 in the above embodiments, which will not be repeated here.

[0154] like Figure 6 As shown, S104 specifically includes S1043a-S1043d.

[0155] S1043a. Based on the predetermined fitting algorithm, the current operation and maintenance data is fitted using the third fitting parameter to obtain the fitting result corresponding to the current operation and maintenance data.

[0156] Similarly, the predetermined fitting algorithm is the same as the predetermined fitting algorithm for fitting historical operation and maintenance data mentioned above, and the third fitting parameter is the same as the third fitting parameter for fitting historical operation and maintenance data mentioned above. For a detailed description of S1043a, please refer to the detailed description of S1024 mentioned above, which will not be repeated here.

[0157] S1043b, Determine the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data.

[0158] Suppose the current operation and maintenance data is b, and the fitting result corresponding to the current operation and maintenance data b is b' (it should be understood that b' is the predicted value of b), then the difference between the current operation and maintenance data b and the fitting result b' corresponding to the current operation and maintenance data is Δb.

[0159] S1043c. Determine the first detection threshold and the second detection threshold based on the first detection parameter and the second detection parameter.

[0160] The first detection threshold satisfies: TH_D = μ - n*σ, and the second detection threshold satisfies: TH_U = μ + n*σ, where TH_D represents the first detection threshold, TH_U represents the second detection threshold, μ represents the first detection parameter, σ represents the second detection parameter, and * represents multiplication. The first detection threshold is less than the second detection threshold.

[0161] S1043d. If the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

[0162] Based on the above example, if the above Δb is located in the interval (μ-n*σ, μ+n*σ), then the current operation and maintenance data b is determined to be normal; otherwise, the current operation and maintenance data b is determined to be abnormal.

[0163] In summary, when the historical operation and maintenance data is of a stable type, the historical operation and maintenance data is fitted to obtain the first detection parameter and the second detection parameter; then, when detecting current operation and maintenance data of the same type as the historical operation and maintenance data, the current operation and maintenance data is fitted to, and then the first detection parameter and the second detection parameter are used to determine whether the current operation and maintenance data is abnormal.

[0164] Optionally, in this embodiment of the application, after the detection device acquires historical operation and maintenance data, before determining the fitting result corresponding to the historical operation and maintenance data based on a predetermined fitting algorithm, the anomaly detection method for operation and maintenance data provided in this embodiment of the application further includes: preprocessing the historical operation and maintenance data, which includes: interpolation processing and / or smoothing processing. Interpolation processing of historical operation and maintenance data can supplement operation and maintenance data lost due to network anomalies or storage anomalies; smoothing processing of historical operation and maintenance data can remove abnormal or noisy data from the historical operation and maintenance data. Then, based on the preprocessed historical operation and maintenance data, the first detection parameter and the second detection parameter are determined, making the detection results more accurate and reliable when performing anomaly detection of operation and maintenance data based on the first detection parameter and the second detection parameter.

[0165] In this embodiment, after the detection device completes the detection of a certain operation and maintenance data, the detection device can save the detection record of the operation and maintenance data. The content of the detection record may include: the monitoring items and / or performance indicators corresponding to the operation and maintenance data, the type of the operation and maintenance data, and the first detection parameter and the second detection parameter obtained based on the historical operation and maintenance data corresponding to the operation and maintenance data. If the type of the operation and maintenance data is periodic, the content of the detection record also includes the periodic component determined based on the historical operation and maintenance data.

[0166] Optionally, the content of the aforementioned detection record may include: the monitoring items and / or performance indicators corresponding to the operation and maintenance data, the type of the operation and maintenance data, and one or more pairs of first and second detection thresholds obtained based on the historical operation and maintenance data corresponding to the operation and maintenance data. These pairs of detection thresholds are the first and second detection thresholds corresponding to different values ​​of n. Similarly, if the type of the operation and maintenance data is periodic, the content of the detection record may also include the periodic component determined based on the historical operation and maintenance data.

[0167] Optionally, the above detection record may also include, but is not limited to, the following information: the identifier of the predetermined fitting algorithm, the fitting parameters corresponding to the predetermined fitting algorithm (such as the first fitting parameter, the second fitting parameter and the third fitting parameter mentioned above), and relevant preprocessing parameters.

[0168] In one implementation, during subsequent anomaly detection of maintenance data, the detection equipment refers to the aforementioned saved detection records to simplify the anomaly detection process and achieve rapid detection of specific maintenance data. The following section will combine... Figure 7 Taking a piece of maintenance data to be tested as an example, this paper briefly describes the process of anomaly detection for the first piece of maintenance data.

[0169] Step 1: Receive detection indication information sent by the external alarm module (Alarm module). The detection indication information includes monitoring item indication information and / or performance indicator indication information, as well as a timestamp.

[0170] The monitoring item indication information and / or performance indicator indication information indicate the corresponding monitoring item and / or performance indicator of the operation and maintenance data to be detected, and the timestamp indicates the time of the operation and maintenance data to be detected.

[0171] Step 2: Based on the monitoring item indication information and / or performance indicator indication information, as well as the timestamp, the operation and maintenance data to be monitored can be determined.

[0172] Step 3: Determine whether this type of maintenance data to be tested has been tested before.

[0173] It should be understood that determining whether such operational data to be tested has been tested refers to: based on the monitoring items and / or performance indicators corresponding to the operational data to be tested, determining whether operational data with the same monitoring item and / or the same performance indicator has been tested before.

[0174] If this type of operation and maintenance data has not been detected before, proceed to steps 4-9. If this type of operation and maintenance data has been detected before, proceed to steps 7-9.

[0175] Step 4: Obtain the historical operation and maintenance data corresponding to the operation and maintenance data to be tested.

[0176] Specifically, historical operation and maintenance data is stored in an external storage medium. At this time, the detection device retrieves the historical operation and maintenance data corresponding to the operation and maintenance data to be detected from the external storage medium.

[0177] Step 5: Preprocess and / or determine the type of historical operation and maintenance data.

[0178] Step 6: Calculate parameters based on historical operation and maintenance data.

[0179] Specifically, the first detection parameter and the second detection parameter are determined based on the historical operation and maintenance data obtained above.

[0180] Step 7: Obtain the first detection parameter and the second detection parameter.

[0181] If the maintenance data to be tested has not been tested before, the first and second testing parameters are obtained by parameter calculation based on historical maintenance data in step 6; if the maintenance data to be tested has been tested before, the first and second testing parameters are obtained from the testing records saved by the testing equipment.

[0182] Step 8: Perform fitting processing on the operation and maintenance data to be tested.

[0183] Step 9: Detect the operation and maintenance data to be tested based on the first detection parameter and the second detection parameter.

[0184] Specifically, the fitting results of the operation and maintenance data to be tested obtained in step 8 above, as well as the first detection parameter and the second detection parameter, are used to detect the operation and maintenance data to be tested.

[0185] All relevant content involved in steps 1 to 9 above can be found in the content of the above embodiments, and will not be repeated here.

[0186] The above primarily describes the solutions provided in this application from the perspective of an operation and maintenance data detection device (e.g., a detection equipment). It is understood that, to achieve the aforementioned functions, the operation and maintenance data detection device includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0187] This application embodiment can divide the operation and maintenance data detection device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0188] When dividing each function into modules according to its corresponding function. Figure 8A possible structural schematic diagram of the operation and maintenance data detection device involved in the above embodiments is shown. For example... Figure 8 As shown, the operation and maintenance data detection device includes: an acquisition module 1001, a determination module 1002, and a detection module 1003. The acquisition module 1001 supports the operation and maintenance data detection device in executing S101 of the above method embodiments. The determination module 1002 supports the operation and maintenance data detection device in executing S102 (including S1021-S1022 or S1023 or S1024), S103 (including S1031-S1032 or S1033-S1034 or S1035-S1036), and S105 of the above method embodiments. The detection module 1003 supports the operation and maintenance data detection device in executing S104 (including S1041a-S1041e or S1042a-S1042d or S1043a-S1043d) of the above method embodiments.

[0189] Optionally, the operation and maintenance data detection device provided in this application embodiment further includes a preprocessing module 1004, which is used to support the operation and maintenance data detection device in preprocessing historical operation and maintenance data (including difference processing and / or smoothing processing).

[0190] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0191] When using integrated units, Figure 9 A possible structural schematic diagram of the operation and maintenance data detection device involved in the above embodiments is shown. For example... Figure 9 As shown, the operation and maintenance data detection device may include a processing module 2001 and a communication module 2002. The processing module 2001 can be used to control and manage the actions of the operation and maintenance data detection device. The processing module 2001 can support the operation and maintenance data detection device in executing S101-S104 and S105 in the above method embodiment, wherein S102 includes S1021-S1022 or S1023 or S1024, S103 includes S1031-S1032 or S1033-S1034 or S1035-S1036, and S104 includes S1041a-S1041e or S1042a-S1042d or S1043a-S1043d. The communication module 2002 can be used to support communication between the operation and maintenance data detection device and other network entities. Optionally, as... Figure 9 As shown, the operation and maintenance data detection device may also include a storage module 2003 for storing the program code and data of the operation and maintenance data detection device.

[0192] The processing module 2001 can be a processor or controller, such as a CPU, general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The communication module 2002 can be a transceiver, transceiver circuit, or communication interface, etc. The storage module 2003 can be a memory.

[0193] When the processing module 2001 is a processor (e.g.) Figure 1 The processor 101 in the middle), and the communication module 2002 is a transceiver (e.g. Figure 1 The network interface 103 and / or input / output interface 105 are in the middle, and the storage module 2003 is a memory (e.g., Figure 1 When the memory (102) is connected, the processor, transceiver, and memory can be connected via a bus. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc.

[0194] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0195] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting anomalies in operation and maintenance data, characterized in that, include: Obtain historical operation and maintenance data corresponding to the current operation and maintenance data. The current operation and maintenance data is the operation and maintenance data corresponding to the target monitoring item at the current moment. The historical operation and maintenance data includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period. The data type of the historical operation and maintenance data is one of the following: periodic, stable, or random. The type of the current operation and maintenance data is the same as the type of the historical operation and maintenance data. The type of the historical operation and maintenance data is determined based on the random forest algorithm; Based on the local quadratic regression algorithm, the fitting result corresponding to the historical operation and maintenance data is determined; wherein, when the type of the historical operation and maintenance data is periodic, the periodic component of the historical operation and maintenance data is removed to obtain the processed historical operation and maintenance data, wherein the periodic component is the median of multiple historical operation and maintenance data corresponding to the current time; based on the local quadratic regression algorithm, the processed historical operation and maintenance data is fitted using a first fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data, wherein the first fitting parameter is a preset duration or a preset number. A first detection parameter and a second detection parameter are determined based on the fitting result corresponding to the historical operation and maintenance data. The first detection parameter and the second detection parameter are used to detect whether the operation and maintenance data is abnormal. The first detection parameter is the mean of the difference between the historical operation and maintenance data and the fitting result, and the second detection parameter is the standard deviation of the difference. Based on the first detection parameter and the second detection parameter, determine whether the current operation and maintenance data is abnormal.

2. The method according to claim 1, characterized in that, The step of determining the first detection parameter and the second detection parameter based on the fitting result corresponding to the historical operation and maintenance data includes: Determine the difference between the processed historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; The mean and standard deviation of the difference are determined, and the mean of the difference is used as the first detection parameter, and the standard deviation of the difference is used as the second detection parameter.

3. The method according to claim 1 or 2, characterized in that, Based on the first detection parameter and the second detection parameter, determine whether the current operation and maintenance data is abnormal, including: Remove the periodic component from the current operation and maintenance data to obtain the processed current operation and maintenance data; Based on the local quadratic regression algorithm, the first fitting parameters are used to fit the processed current operation and maintenance data to obtain the fitting result corresponding to the current operation and maintenance data. Determine the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data; Based on the first detection parameter and the second detection parameter, a first detection threshold and a second detection threshold are determined, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, This represents the first detection threshold. This represents the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. This is a preset value, where n is greater than 0. This indicates multiplication, where the first detection threshold is less than the second detection threshold; If the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

4. The method according to claim 1, characterized in that, The historical operation and maintenance data is of random type. The process of determining the fitting result corresponding to the historical operation and maintenance data based on a local quadratic regression algorithm includes: Based on the local quadratic regression algorithm, the historical operation and maintenance data is fitted using a second fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The second fitting parameter is a preset duration or a preset quantity.

5. The method according to claim 1, characterized in that, The historical operation and maintenance data is of a stationary type. The process of determining the fitting result corresponding to the historical operation and maintenance data based on a local quadratic regression algorithm includes: Based on the local quadratic regression algorithm, a third fitting parameter is used to fit the historical operation and maintenance data to obtain the fitting result corresponding to the historical operation and maintenance data. The third fitting parameter is a preset duration or a preset quantity.

6. The method according to claim 4 or 5, characterized in that, The step of determining the first detection parameter and the second detection parameter based on the fitting result corresponding to the historical operation and maintenance data includes: Determine the difference between the historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; The mean and standard deviation of the difference are determined, and the mean of the difference is used as the first detection parameter, and the standard deviation of the difference is used as the second detection parameter.

7. The method according to claim 4, characterized in that, Based on the first detection parameter and the second detection parameter, determine whether the current operation and maintenance data is abnormal, including: Based on the local quadratic regression algorithm, the current operation and maintenance data is fitted using the second fitting parameter to obtain the fitting result corresponding to the current operation and maintenance data. Determine the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data; Based on the first detection parameter and the second detection parameter, a first detection threshold and a second detection threshold are determined, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, Indicates the first detection threshold. This indicates the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. This indicates multiplication, where the first detection threshold is less than the second detection threshold; If the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

8. The method according to claim 5, characterized in that, Based on the first detection parameter and the second detection parameter, determine whether the current operation and maintenance data is abnormal, including: Based on the local quadratic regression algorithm, the current operation and maintenance data is fitted using a third fitting parameter to obtain the fitting result corresponding to the current operation and maintenance data. Determine the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data; Based on the first detection parameter and the second detection parameter, a first detection threshold and a second detection threshold are determined, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, Indicates the first detection threshold. This indicates the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. This indicates multiplication, where the first detection threshold is less than the second detection threshold; If the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal; otherwise, the current operation and maintenance data is determined to be abnormal.

9. The method according to any one of claims 1-2 and 4-5, characterized in that, Before determining the fitting result corresponding to the historical operation and maintenance data based on the local quadratic regression algorithm, the method further includes: The historical operation and maintenance data is preprocessed, including interpolation and / or smoothing.

10. A maintenance data detection device, characterized in that, include: Acquisition module, determination module, and detection module; The acquisition module is used to acquire historical operation and maintenance data corresponding to the current operation and maintenance data. The current operation and maintenance data is the operation and maintenance data corresponding to the target monitoring item at the current moment. The historical operation and maintenance data includes multiple operation and maintenance data corresponding to the target monitoring item within a historical time period. The data type of the historical operation and maintenance data is one of the following: periodic, stable, or random. The type of the current operation and maintenance data is the same as the type of the historical operation and maintenance data. The determining module is used to determine the type of the historical operation and maintenance data based on the random forest algorithm; The determining module is further configured to determine the fitting result corresponding to the historical operation and maintenance data based on a local quadratic regression algorithm; wherein, when the type of the historical operation and maintenance data is periodic, the periodic component of the historical operation and maintenance data is removed to obtain processed historical operation and maintenance data, wherein the periodic component is the median of multiple historical operation and maintenance data corresponding to the current time; based on the local quadratic regression algorithm, the processed historical operation and maintenance data is fitted using a first fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data, wherein the first fitting parameter is a preset duration or a preset quantity; and a first detection parameter and a second detection parameter are determined according to the fitting result corresponding to the historical operation and maintenance data, wherein the first detection parameter is the mean of the difference between the historical operation and maintenance data and the fitting result, and the second detection parameter is the standard deviation of the difference; The detection module is used to determine whether the current operation and maintenance data is abnormal based on the first detection parameter and the second detection parameter.

11. The apparatus according to claim 10, characterized in that, The determining module is specifically used to determine the difference between the processed historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; and to determine the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

12. The apparatus according to claim 10 or 11, characterized in that, The determining module is further configured to remove the periodic component of the current operation and maintenance data to obtain processed current operation and maintenance data; and based on the local quadratic regression algorithm, use the first fitting parameters to fit the processed current operation and maintenance data to obtain the fitting result corresponding to the current operation and maintenance data; and determine the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data. The detection module is specifically used to determine a first detection threshold and a second detection threshold based on the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, This represents the first detection threshold. This represents the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. This is a preset value, where n is greater than 0. The first detection threshold is less than the second detection threshold; if the difference between the processed current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, the current operation and maintenance data is determined to be normal. Otherwise, the current operation and maintenance data is determined to be abnormal.

13. The apparatus according to claim 10, characterized in that, The historical operation and maintenance data is of random type. The determining module is specifically used to fit the historical operation and maintenance data based on the local quadratic regression algorithm and a second fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The second fitting parameter is a preset duration or a preset quantity.

14. The apparatus according to claim 10, characterized in that, The historical operation and maintenance data is of a stable type. The determining module is specifically used to fit the historical operation and maintenance data based on the local quadratic regression algorithm and a third fitting parameter to obtain the fitting result corresponding to the historical operation and maintenance data. The third fitting parameter is a preset duration or a preset quantity.

15. The apparatus according to claim 12, characterized in that, The determination module is specifically used to determine the difference between the historical operation and maintenance data and the fitting result corresponding to the historical operation and maintenance data; and to determine the mean and standard deviation of the difference, using the mean of the difference as the first detection parameter and the standard deviation of the difference as the second detection parameter.

16. The apparatus according to claim 12, characterized in that, The determining module is further configured to, based on the local quadratic regression algorithm, use a second fitting parameter to fit the current operation and maintenance data to obtain a fitting result corresponding to the current operation and maintenance data; and determine the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data. The detection module is specifically used to determine a first detection threshold and a second detection threshold based on the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, Indicates the first detection threshold. This indicates the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. The first detection threshold is less than the second detection threshold. If the difference between the current operation and maintenance data and the fitting result corresponding to the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal. Otherwise, the current operation and maintenance data is determined to be abnormal.

17. The apparatus according to claim 13 or 14, characterized in that, The determining module is further configured to, based on the local quadratic regression algorithm, use a third fitting parameter to fit the current operation and maintenance data to obtain the fitting result corresponding to the current operation and maintenance data; and determine the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data. The detection module is specifically used to determine a first detection threshold and a second detection threshold based on the first detection parameter and the second detection parameter, wherein the first detection threshold satisfies: The second detection threshold satisfies: ,in, Indicates the first detection threshold. This indicates the second detection threshold. This represents the first detection parameter. This represents the second detection parameter. The first detection threshold is less than the second detection threshold. If the difference between the current operation and maintenance data and the fitting result of the current operation and maintenance data is greater than the first detection threshold and less than the second detection threshold, then the current operation and maintenance data is determined to be normal. Otherwise, the current operation and maintenance data is determined to be abnormal.

18. The apparatus according to any one of claims 10-11 and 13-14, characterized in that, The device also includes a preprocessing module; The preprocessing module is used to preprocess the historical operation and maintenance data, and the preprocessing includes: interpolation processing and / or smoothing processing.

19. A testing device, characterized in that, The device includes a memory and at least one processor connected to the memory, the memory being used to store instructions, which, after being read by the at least one processor, enable the detection device to perform the method as described in any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer instructions that, when executed on a computer, perform the method as described in any one of claims 1 to 9.

Images