Abnormal movement detection method, device and electronic equipment

Abstract

The embodiments of this specification provide a method, device and electronic device for detecting anomalies. The method includes: obtaining business flow data generated within a preset time period, and performing aggregation operations on the business flow data to obtain overall business flow data; splitting the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data contains data of multiple different dimensions, and each time series data corresponds to at least one dimension combination; determining the historical baseline data corresponding to the dimension combination according to the time series data corresponding to the dimension combination, and the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimension combination; performing a fitting operation on the time series data and the historical baseline data, so as to realize the detection of anomalies of the time series data.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method, device and electronic device for detecting abnormality. Background Art

[0002] With the popularization and development of computer technology and Internet technology, the business scenarios involved in Internet platforms are becoming more and more diverse, and business traffic is also increasing dramatically. For example, taking the payment system platform as an example, while providing a variety of payment services to tens of thousands of external merchants, one of the important things is to monitor the business efficiently and accurately to detect changes in business flow, so as to promptly discover faults in the current payment system.

[0003] In the existing technology, abnormality detection and monitoring are mainly performed through expert rule-based methods, which mainly rely on human experience to maintain the business monitoring objects, so the manpower operation and maintenance costs are high; at the same time, multiple businesses are often combined into one monitoring object for monitoring, making the business monitoring granularity coarse; in addition, expert rule-based monitoring relies on manually set thresholds to trigger alarms, and the alarm accuracy is low.

[0004] Based on the existing technology, it is necessary to provide a change detection solution that can reduce the cost of change detection and monitoring, realize more fine-grained business change detection, and has higher alarm accuracy without the need to configure alarm thresholds. Summary of the invention

[0005] The embodiments of this specification provide a method, device and electronic device for detecting abnormality, so as to solve the problems existing in the prior art of high manpower operation and maintenance cost, coarse business monitoring granularity and low alarm accuracy.

[0006] To solve the above technical problems, the embodiments of this specification are implemented as follows:

[0007] An embodiment of the present specification provides a method for detecting abnormality, the method comprising:

[0008] Acquire the business flow data generated within a preset time period, and perform aggregation operations on the business flow data to obtain overall business flow data;

[0009] Splitting the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data includes data of multiple different dimensions, and each time series data corresponds to at least one dimension combination;

[0010] Determine the historical baseline data corresponding to the dimensional combination according to the time series data corresponding to the dimensional combination, wherein the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination;

[0011] A fitting operation is performed on the time series data and the historical baseline data to achieve abnormal movement detection of the time series data.

[0012] An abnormality detection device provided in an embodiment of the present specification includes:

[0013] An acquisition module, used to acquire the business flow data generated within a preset time period, and perform aggregation operations on the business flow data to obtain overall business flow data;

[0014] A splitting module, used for splitting the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data contains data of multiple different dimensions, and each time series data corresponds to at least one dimension combination;

[0015] A determination module, used to determine the historical baseline data corresponding to the dimensional combination according to the time series data corresponding to the dimensional combination, wherein the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination;

[0016] The fitting module is used to perform a fitting operation on the time series data and the historical baseline data so as to realize abnormal movement detection on the time series data.

[0017] An electronic device provided in an embodiment of the present specification includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned abnormality detection method when executing the program.

[0018] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0019] The overall business flow data is obtained by acquiring the business flow data generated within a preset time period and performing aggregation operations on the business flow data; the overall business flow data is split into several time series data according to predetermined rules, wherein the time series data contains data of multiple different dimensions, and each time series data corresponds to at least one dimension combination; according to the time series data corresponding to the dimension combination, the historical baseline data corresponding to the dimension combination is determined, and the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimension combination; the time series data and the historical baseline data are fitted to realize the detection of anomalies in the time series data. Based on this solution, the configuration cost and subsequent operation and maintenance cost of the monitoring object itself are reduced, and more fine-grained business anomaly detection can be achieved, without the need to configure alarm thresholds, and the anomaly detection results are more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0021] Figure 1 A flow chart of a method for detecting abnormality provided in an embodiment of this specification;

[0022] Figure 2 A schematic diagram of the structure of an abnormal movement detection device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0024] As mentioned above, the existing abnormality detection or monitoring methods mainly adopt expert rule-based monitoring. This expert rule-based abnormality monitoring solution has the following main problems:

[0025] First, the human operation and maintenance cost is high. Since the maintenance of business monitoring objects mainly relies on human experience, a large amount of human resources needs to be continuously invested in monitoring configuration and alarm rule preservation.

[0026] Second, the monitoring granularity is coarse. Due to the limitation of operation and maintenance costs, the monitoring granularity is coarse when monitoring changes. There is no way to make fine-grained divisions for business scenarios. Multiple businesses are often combined into one monitoring object for monitoring, resulting in some business changes with less business traffic not being discovered in a timely manner.

[0027] Third, the alarm accuracy is low. Since the alarm is triggered by manually set thresholds, the setting and maintenance of thresholds is a major difficulty in current production and operation. Once this kind of monitoring alarm that relies on thresholds lacks maintenance for a period of time, the alarm noise will increase day by day, and the meaning of monitoring will be lost.

[0028] Therefore, in response to the many defects of existing anomaly detection solutions, the embodiments of this specification propose a method for anomaly detection. This method can perform fine-grained division and detection of business in complex business scenarios, and can automatically clean and register monitoring tasks according to business dimensions. Without the need to manually set alarm rules, anomaly detection is automatically performed based on intelligent algorithms combined with historical business operation data. At the same time, the technical solution of this specification also incorporates user feedback information on alarm events into the detection logic for supervised learning, which saves manpower and effectively improves the accuracy of alarms.

[0029] The following is an introduction to the application scenarios of the technical solution of this specification. It should be pointed out that the anomaly detection mentioned in this specification can also be considered as the monitoring of business anomalies, and the change in nouns does not constitute a limitation on the technical solution. The business fields that require anomaly monitoring are relatively wide, such as video monitoring, hardware health status monitoring, server health status monitoring, etc. Different fields have different monitoring solutions, and the differences between the solutions are also relatively large. The technical solution of this specification mainly focuses on the anomaly monitoring of the health status of system services from a business perspective (or called anomaly detection). This type of monitoring records monitoring information from the perspective of event occurrence time and current values. Corresponding to the specific indicators of the monitored object is a time series, and the anomaly is perceived by monitoring the trend of the time series. Of course, the above application scenarios do not constitute a limitation on the application scenarios of the technical solution of this specification.

[0030] Based on the above scenario, the solution of this specification is described in detail below.

[0031] Figure 1 A flow chart of a method for detecting abnormality provided in an embodiment of this specification, the method may specifically include the following steps:

[0032] In step S110, the business flow data generated within a preset time period is acquired, and an aggregation operation is performed on the business flow data to obtain overall business flow data.

[0033] In actual applications, a large amount of business flow data will be generated in the business system. Taking the payment system as an example, the payment platform faces a large number of external merchant groups and provides a variety of payment services to these external merchant groups. The payment requests initiated by each merchant will also be collected into the payment system in the form of data flow. Therefore, how to aggregate these messy business flow data so as to split the business traffic is the first thing to consider.

[0034] In the embodiments of this specification, the following methods may be used to perform aggregation operations on the service flow data, specifically including the following:

[0035] The business flow data generated within a predetermined time period is obtained from the log, and the business flow data is aggregated according to a preset time window and preset indicators.

[0036] The following is an explanation of the process of the aggregation operation in conjunction with a specific embodiment. Taking the same set of OpenAPI (open business interface) supporting multiple business scenarios at the same time and providing payment services for different merchants as an example, the business request information (including business identity information) sent from different merchants and the processing results of the payment service on the business request information will be buried in the log. The business requests between merchants mainly reflect the differences in the request parameters, and the request parameters will also carry the merchant's identity. Therefore, after the inlet traffic comes in, the various business scenarios and merchants are mixed together from the perspective of OpenAPI. Therefore, after obtaining the business flow data generated within a predetermined time period from the log, the business flow data in the log can be imported into the streaming computing engine, so that the business flow data can be aggregated into business flow data corresponding to monitoring indicators such as total amount, success amount and time consumption according to a certain time window, and these data constitute the overall business flow data.

[0037] In step S120, the overall business flow data is split into a plurality of time series data according to a predetermined rule, wherein the time series data contains data of multiple different dimensions, and each time series data corresponds to at least one dimensional combination.

[0038] In one or more embodiments of the present specification, after obtaining the overall business flow data, the overall business flow data can be split into several time series data composed of different dimensional data according to a predetermined dimension, and the split time series data can be stored in a time series database; wherein each dimensional combination corresponds to a monitoring object, and each monitoring object and at least one preset indicator constitute a monitoring item.

[0039] In practical applications, dimensions can be considered as one or more tags, that is, different dimensions that describe the subject. Tag consists of TagKey and TagValue, where TagKey represents the dimension and TagValue represents the value of the dimension. In this embodiment, the following dimensions are included but not limited to: merchant ID, business identity, OpenAPI name, OpenAPI version, etc.

[0040] Furthermore, in the embodiments of the present specification, a number of time series data of a series of dimensional combinations can be cleaned from the log data according to the pre-set cleaning rules. That is to say, the log can be directly cleaned according to the cleaning rules to obtain time series data composed of a series of dimensional combinations, and the split time series data can be monitored separately. The cleaning rules can be rules based on the mutual combination of the above-mentioned different dimensions. Each dimensional combination can be considered as a specific monitoring object, and the monitoring object can be combined with monitoring indicators (such as success rate, time consumption, etc.) to form a specific monitoring project. For example: "The success rate of a certain version of a certain OpenAPI used by a certain merchant" is a specific monitoring project.

[0041] Based on the content of the aforementioned technical solution, dimension management can automatically and regularly replace dimensions based on recent log data, so that the increase or decrease of actual monitoring items can be automatically completed as the actual business develops, without the need to invest additional manpower in configuration and operation and maintenance.

[0042] In addition, the above cleaning rules can be used to split the mixed business traffic in the log into monitoring objects with a certain combination of dimensions, and monitor the changes of each monitoring object separately, so that users can customize the granularity of monitoring objects by setting dimension cleaning rules based on the actual business monitoring requirements. After the dimension cleaning rules are set, the remaining monitoring objects are generated and the registration of monitoring tasks are completed automatically. At the same time, the cost of setting cleaning rules is a one-time investment and the cost is also low. The subsequent increase and decrease of monitoring objects are completed automatically without the need for additional manual configuration, which greatly reduces the configuration cost of the monitoring itself and the subsequent operation and maintenance costs.

[0043] Since users can easily split the original coarse-grained monitoring objects into finer-grained ones according to business requirements, they can perceive finer-grained business changes, and business scenarios with smaller business traffic will also be covered without increasing additional labor costs.

[0044] In step S130, historical baseline data corresponding to the dimensional combination is determined based on the time series data corresponding to the dimensional combination, and the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination.

[0045] In one or more embodiments of the present specification, after the overall business flow data is split, the historical baseline data of the monitoring item is calculated for each monitoring item formed by the split monitoring object (i.e., the time series data corresponding to each dimensional combination) and at least one monitoring indicator combination. In fact, it can be considered that for each dimensional combination of time series data, the historical baseline data of the time series data under a certain monitoring indicator is determined. Specifically, the historical baseline data can be determined in the following manner:

[0046] The historical time series data corresponding to the time series data of the dimension combination in the same historical time period is obtained from the time series database, and the historical baseline data corresponding to the dimension combination is calculated based on the historical time series data.

[0047] Generally speaking, the so-called baseline can be the trend and water level characteristics of this time series data in an average sense. The time series data of a certain dimensional combination has certain statistical characteristics. For example, if the success rate of a certain dimensional combination was basically around 90% in the past, then the success rate of this dimensional combination in the short term in the future should also be maintained at around 90%. If it deviates too much from the baseline, it is considered an abnormality.

[0048] Furthermore, by recording the baseline of the historical time series data corresponding to each specific monitoring project, the historical baseline data obtained can be used for subsequent real-time fitting and abnormal perception. Therefore, there is no need to configure the threshold, the baseline is automatically recorded based on the historical data, and the abnormality detection is automatically completed by the algorithm model, saving the threshold configuration and subsequent operation and maintenance costs.

[0049] In actual applications, after the dimension splitting is completed, the solution for managing the fitting strategy is also included. For example, since the business traffic size of different dimensional combinations is different, in order to avoid too much jitter in the time series due to different traffic sizes, which affects the anomaly detection effect, the time series data of different dimensional combinations will be set at the peak and trough of business traffic in a day. A shorter time interval (such as 1 minute) will be set for large traffic, and a longer time interval (such as 30 minutes) will be set for small traffic. It should be noted that the size of the time interval will affect the frequency of abnormal detection of the time series data. Generally, the detection frequency and time interval of the abnormal task are consistent. For example, if the time interval is 1 minute, it will be detected once every minute.

[0050] In step S140, a fitting operation is performed on the time series data and the historical baseline data, so as to detect anomalies in the time series data.

[0051] In one or more embodiments of the present specification, after the baseline recording and fitting strategy setting are completed, the scheduled task will periodically trigger the abnormality detection task according to the fitting strategy. Each abnormality detection task will compare each time series data with the historical baseline data corresponding to the time series data to check the difference between the two. Therefore, this comparison process can be called fitting. In other words, the abnormality detection operation is performed regularly according to the fitting strategy, and the abnormality detection operation includes comparing the time series data with the historical baseline data using the abnormality detection algorithm.

[0052] In practical applications, anomaly detection is implemented based on anomaly detection models. Commonly used anomaly detection algorithm models include 3-sigma, dbscan and other models, which can realize intelligent judgment of anomalies.

[0053] Furthermore, in the embodiments of this specification, after completing the abnormality detection of the time series data through the aforementioned embodiments, a fault matching algorithm can be used to perform fault matching on the detected abnormality events, and an alarm can be issued for the abnormality events based on the results of the fault matching.

[0054] Specifically, when an anomaly is detected, fault matching will be performed in combination with historical manual marking information. The fault matching algorithm is trained based on a supervised learning model. The purpose of fault matching is mainly to reduce the noise of anomaly events. Although the event may be an anomaly from the perspective of time series fluctuation characteristics, this anomaly may also be harmless to the business or be an expected anomaly. Therefore, no alarm is required for such anomalies.

[0055] When it is confirmed to be an abnormality through fault matching, an alarm notification needs to be sent to the relevant operation and maintenance engineers for processing. After receiving the alarm notification, the operation and maintenance engineers will investigate, analyze and locate the abnormality, and provide feedback on the abnormal event, whether the abnormality is a real fault or an expected abnormality or noise. The feedback information will flow back to the monitoring platform for subsequent fault matching and noise reduction. In addition, users can also subscribe to the abnormal events they are concerned about according to dimensions, so that when the abnormal event occurs, it can be directly sent to the designated operation and maintenance personnel according to the subscription relationship. At the same time, the feedback entrance is embedded in the broadcasted event. The operation and maintenance personnel who receive the alarm through this entrance can provide feedback on the event, and the feedback information will flow back to the event center and be stored together with the event.

[0056] The technical solution in this specification not only detects abnormal events by integrating multiple intelligent abnormal event detection algorithms, but also classifies abnormal events based on classification models. Only abnormal events that do not meet business expectations will be reported, thereby further improving the accuracy of alarms.

[0057] Based on the same idea, the embodiment of this specification also provides a device for detecting abnormal movement, such as Figure 2 This is a schematic diagram of the structure of a device for detecting abnormal movement provided in an embodiment of this specification. The device 200 mainly includes:

[0058] The acquisition module 201 is used to acquire the business flow data generated within a preset time period, and perform aggregation operations on the business flow data to obtain overall business flow data;

[0059] A splitting module 202 is used to split the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data includes data of multiple different dimensions, and each time series data corresponds to at least one dimension combination;

[0060] A determination module 203 is used to determine historical baseline data corresponding to the time series data of the dimensional combination according to the time series data corresponding to the dimensional combination, wherein the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination;

[0061] The fitting module 204 is used to perform a fitting operation on the time series data and the historical baseline data so as to detect anomalies in the time series data.

[0062] Furthermore, the device may also include:

[0063] The alarm module 205 is used to perform fault matching on the detected abnormal events using a fault matching algorithm after realizing abnormal event detection on the time series data, and to alarm the abnormal events according to the result of the fault matching.

[0064] The embodiment of the present specification also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned abnormality detection method when executing the program.

[0065] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0066] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0067] The apparatus, electronic device, non-volatile computer storage medium and method provided in the embodiments of this specification correspond to each other, and therefore, the apparatus, electronic device and non-volatile computer storage medium also have similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding apparatus, electronic device and non-volatile computer storage medium will not be repeated here.

[0068] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0069] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0070] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0071] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0072] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification may be in the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0073] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0076] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0077] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0078] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0079] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0080] The specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media including storage devices.

[0081] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0082] The above is only an embodiment of this specification and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for detecting abnormality, the method comprising: Obtaining the business flow data generated within a preset time period, and performing aggregation operations on the business flow data to obtain overall business flow data; including: obtaining the business flow data generated within a preset time period from the log, and aggregating the business flow data according to a preset time window and preset indicators; Splitting the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data includes data of multiple different dimensions, and each time series data corresponds to at least one dimension combination; each of the data of the dimension combination corresponds to a monitoring object, and each of the monitoring objects and at least one preset indicator constitute a monitoring item; Determine the historical baseline data corresponding to the dimensional combination according to the time series data corresponding to the dimensional combination, wherein the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination; A fitting operation is performed on the time series data and the historical baseline data to achieve abnormal movement detection of the time series data.

2. The method according to claim 1, wherein the overall business flow data is split into a plurality of time series data according to a predetermined rule, comprising: The overall business flow data is split into a number of time series data composed of different dimensional data according to a predetermined dimension, and the split time series data is stored in a time series database; wherein each dimensional combination corresponds to a monitoring object, and each monitoring object and at least one preset indicator constitute a monitoring item.

3. The method according to claim 1, wherein determining the historical baseline data corresponding to the dimension combination according to the time series data corresponding to the dimension combination comprises: The historical time series data corresponding to the time series data of the dimension combination in the same historical time period is obtained from the time series database, and the historical baseline data corresponding to the dimension combination is calculated based on the historical time series data.

4. The method according to claim 1, wherein the fitting operation on the time series data and the historical baseline data comprises: An anomaly detection operation is performed regularly according to the fitting strategy, and the anomaly detection operation includes comparing the time series data with the historical baseline data using an anomaly detection algorithm.

5. The method according to claim 1, after detecting the abnormality of the time series data, the method further comprises: A fault matching algorithm is used to perform fault matching on the detected abnormal event, and an alarm is issued for the abnormal event according to the result of the fault matching.

6. A device for detecting abnormal movement, comprising: The acquisition module is used to acquire the business flow data generated within a preset time period, and perform aggregation operations on the business flow data to obtain the overall business flow data; including: acquiring the business flow data generated within a preset time period from the log, and aggregating the business flow data according to the preset time window and preset indicators; A splitting module is used to split the overall business flow data into a plurality of time series data according to a predetermined rule, wherein the time series data contains data of multiple different dimensions, and each time series data corresponds to at least one dimension combination; each of the data of the dimension combination corresponds to a monitoring object, and each of the monitoring objects and at least one preset indicator constitute a monitoring project; A determination module, used to determine the historical baseline data corresponding to the dimensional combination according to the time series data corresponding to the dimensional combination, wherein the historical baseline data is used to represent the historical average level of the preset indicator corresponding to the time series data of the dimensional combination; The fitting module is used to perform a fitting operation on the time series data and the historical baseline data so as to realize abnormal movement detection on the time series data.

7. The device according to claim 6, wherein the splitting module is specifically used for: The overall business flow data is split into a plurality of time series data composed of data of different dimensions according to a predetermined dimension, and the split time series data is stored in a time series database; wherein, Each dimension combination corresponds to a monitoring object, and each monitoring object and at least one preset indicator constitute a monitoring project.

8. The device according to claim 6, wherein the determining module is specifically configured to: The historical time series data corresponding to the time series data of the dimension combination in the same historical time period is obtained from the time series database, and the historical baseline data corresponding to the dimension combination is calculated based on the historical time series data.

9. The device according to claim 6, wherein the fitting module is specifically used for: An anomaly detection operation is performed regularly according to the fitting strategy, and the anomaly detection operation includes comparing the time series data with the historical baseline data using an anomaly detection algorithm.

10. The device of claim 6, further comprising: The alarm module is used to perform fault matching on the detected abnormal events using a fault matching algorithm after realizing abnormal detection on the time series data, and to alarm the abnormal events according to the result of the fault matching.

11. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 5 when executing the program.

Images