A method, system, electronic device and storage medium for detecting abnormal fluctuations of an event

Abstract

The present invention relates to a method, system, electronic device and storage medium for detecting abnormal fluctuations in events. The detection method includes: obtaining historical data of a monitored indicator before a preset moment and historical event parameters corresponding to the historical data; determining a corresponding prediction model based on the periodicity of the historical data in a time series; based on the prediction model, predicting the predicted data of the monitored indicator within a preset time period after the preset moment according to the historical data and the historical event parameters corresponding to the historical data; judging whether the actual data is abnormal according to the predicted data; if the actual data is abnormal, determining that an abnormal fluctuation of the event occurs after the preset moment. This scheme realizes data prediction for the monitored indicator through historical data and corresponding historical event parameters, and determines the abnormality of the predicted data through the actual data of the monitored indicator. Once the predicted data does not match the actual data, it means that the event parameters have changed at this time.

Description

Technical Field

[0001] The present invention relates to the field of data detection technology, and in particular to a method, system, electronic device and storage medium for detecting abnormal fluctuations in an event. Background Art

[0002] Every day we are faced with a variety of data indicators, which can be some core data indicators such as DAU, MAU (daily active users, monthly active users), etc., or the success rate and response time of an interface. Indicators are a combination of concepts and values ​​that describe overall quantitative characteristics, so they are also called comprehensive indicators. In actual statistical work and statistical theory research, concepts that describe overall quantitative characteristics are often directly called indicators.

[0003] When the data indicators we are concerned about experience abnormal fluctuations (sudden increases or decreases), we need to locate the causes of the abnormal fluctuations as early as possible in order to avoid potential risks and improve user stickiness. For example, for most software systems, most of the causes of fluctuations in the number of daily active users are caused by external events, such as the launch of new versions and various holidays. These events will affect user usage and cause fluctuations in the number of daily active users. However, since the statistics of data indicators are a process that will fluctuate, if the data indicators do not fluctuate abnormally and are not discovered in time and improved accordingly, small problems will gradually evolve into big problems. Summary of the invention

[0004] In order to solve the problem in the prior art that it is impossible to determine whether an indicator has abnormal fluctuations, at least one embodiment of the present invention provides an event abnormal fluctuation detection method, system, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting abnormal fluctuations of an event, the detection method comprising:

[0006] Obtain the historical data of the monitored indicator before the preset time and the historical event parameters corresponding to the historical data;

[0007] Determine a corresponding prediction model according to the periodicity of the historical data in the time series;

[0008] Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after the preset time;

[0009] Acquire actual data of the monitored indicator within a preset time period after a preset time, and determine whether the actual data is abnormal based on the predicted data;

[0010] If the actual data is abnormal, it is determined that an abnormal fluctuation of the event occurs after the preset time.

[0011] Based on the above technical solution, the embodiment of the present invention can also make the following improvements.

[0012] In combination with the first aspect, in a first embodiment of the first aspect, determining a corresponding prediction model according to the periodicity of the historical data in a time series includes:

[0013] Judging whether the historical data has periodicity according to the changes of the historical data in the time series;

[0014] If the historical data is periodic, then based on the periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time after the preset time is predicted;

[0015] If the historical data is not periodic, based on a non-periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time period after the preset time is predicted.

[0016] In combination with the first aspect, in a second embodiment of the first aspect, judging whether the actual data is abnormal according to the predicted data includes:

[0017] Calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series;

[0018] Determining whether the similarity is greater than or equal to a preset similarity threshold;

[0019] If the similarity is greater than or equal to the preset similarity threshold, then the actual data is not abnormal;

[0020] If the similarity is less than a preset similarity threshold, the actual data is abnormal.

[0021] In combination with the second embodiment of the first aspect, in a third embodiment of the first aspect, calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes:

[0022] Calculating a first distance value between a change in the actual data in the time series and a change in the predicted data in the time series based on a dynamic time normalization algorithm;

[0023] According to the first distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained.

[0024] In combination with the second embodiment of the first aspect, in a fourth embodiment of the first aspect, calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes:

[0025] Calculating a second distance value between a change in the actual data in time series and a change in the predicted data in time series based on a Euclidean distance algorithm;

[0026] According to the second distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained.

[0027] In combination with the second embodiment of the first aspect, in a fifth embodiment of the first aspect, calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes:

[0028] Calculating a first distance value between a change in the actual data in the time series and a change in the predicted data in the time series based on a dynamic time normalization algorithm;

[0029] Calculating a second distance value between a change in the actual data in time series and a change in the predicted data in time series based on a Euclidean distance algorithm;

[0030] Calculating a relative deviation between the first distance value and the second distance value, and determining whether the relative deviation is greater than a preset threshold;

[0031] When the relative deviation value is greater than a preset threshold, obtaining, according to the first distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series;

[0032] When the relative deviation value is less than or equal to a preset threshold, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained according to the second distance value.

[0033] In combination with the first aspect or the first, second, third, fourth or fifth embodiment of the first aspect, in a sixth embodiment of the first aspect, the detection method further includes:

[0034] When the actual data is abnormal, the actual data and actual event parameters within a preset time period after the preset time are obtained; the actual data is the data of the event whose parameters have changed compared with those before the preset time; the actual event parameters are the parameters of the event whose parameters have changed compared with those before the preset time;

[0035] Adding the actual data to the historical data to form new historical data; and adding the actual event parameters to the historical event parameters to form new historical event parameters;

[0036] Re-predicting the secondary prediction data of the monitored indicator within a preset time period after a preset time according to the historical data and the historical event parameters corresponding to the historical data;

[0037] Determining whether the actual data is abnormal according to the secondary prediction data;

[0038] If the actual data is not abnormal, treating the event corresponding to the actual data and the actual event parameter as an abnormal event;

[0039] If the actual data is abnormal, then the event corresponding to the actual data and the actual event parameter is not abnormal.

[0040] In a second aspect, an embodiment of the present invention provides a system for detecting abnormal fluctuations of an event, the detection system comprising:

[0041] A first acquisition unit is used to acquire historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data;

[0042] A prediction unit, configured to determine a corresponding prediction model according to the periodicity of the historical data in a time series; based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after a preset time;

[0043] The second acquisition unit is used to acquire actual data of the monitored indicator within a preset time after a preset time;

[0044] A judgment unit is used to judge whether the actual data is abnormal according to the predicted data; if the actual data is abnormal, it is judged that an abnormal fluctuation of the event occurs after a preset time.

[0045] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0046] Memory, used to store computer programs;

[0047] The processor is used to implement any event abnormal fluctuation detection method described in the first aspect when executing the program stored in the memory.

[0048] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the event abnormal fluctuation detection method described in any one of the first aspects.

[0049] Compared with the prior art, the above-mentioned technical scheme of the present invention has the following advantages: the scheme realizes data prediction for the monitored indicators through historical data and corresponding historical event parameters, and determines the abnormal situation of the predicted data through the actual data of the monitored indicators. Once the predicted data does not match the actual data, it means that the event parameters have changed at this time. Furthermore, the mismatch between the predicted data and the actual data indicates that the monitored indicators have changed abnormally. If the historical event parameters remain relatively stable around the preset time, it means that it is not the event corresponding to the historical event parameters that has changed, but other events have occurred that have caused the monitored indicators to change. This makes it convenient for users to know in time whether there are events that can affect the monitored indicators and have not been paid attention to, thereby reducing the workload of staff for investigation and reducing the impact of emergencies. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flow chart of a method for detecting abnormal fluctuation of an event provided by an embodiment of the present invention;

[0051] Figure 2 It is a flow chart of a method for detecting abnormal fluctuation of an event provided by another embodiment of the present invention;

[0052] Figure 3 This is a flow chart of a method for detecting abnormal fluctuations of an event provided by another embodiment of the present invention;

[0053] Figure 4 This is a flowchart of a similarity calculation method provided by another embodiment of the present invention;

[0054] Figure 5 This is a second flow chart of a similarity calculation method provided by another embodiment of the present invention;

[0055] Figure 6 It is a third flow chart of a similarity calculation method provided by another embodiment of the present invention;

[0056] Figure 7 This is a second flow chart of a method for detecting abnormal fluctuations of an event provided by another embodiment of the present invention;

[0057] Figure 8 It is a structural schematic diagram of an event abnormal fluctuation detection system provided by another embodiment of the present invention;

[0058] Fig. 9 This is a schematic diagram of the structure of an electronic device provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0059] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0060] An embodiment of the present invention provides a structural diagram of a system for implementing various embodiments of the present invention, including a terminal, wherein the terminal includes: a processor 1110 and a memory 1130, wherein the terminal can be a mobile terminal such as a mobile phone, a tablet computer, a laptop computer, a handheld computer, a personal digital assistant (Personal Digital Assistant, PDA), a portable media player (Portable Media Player, PMP), a navigation device, a wearable device, a smart bracelet, a pedometer, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc.

[0061] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting abnormal fluctuations of events. Figure 1 As shown, the detection method comprises the following steps:

[0062] S11. Obtain historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data.

[0063] In this embodiment, the monitored indicators can be data indicators that we are more concerned about, such as the number of daily active users, the number of monthly active users, the number of views of a certain video, and the popularity of a certain topic. These indicators will fluctuate due to external events, such as the launch of new versions, holidays, and marketing promotion efforts; changes in these events are closely related to changes in data.

[0064] In this embodiment, historical data before a preset time and historical event parameters corresponding to the historical data are obtained. For example, with respect to the number of daily active users, we have found through testing that events such as the launch of new versions, holidays, and marketing promotion efforts will have a certain impact on it. In this step, historical data before a preset time and historical event parameters corresponding to the historical data are obtained.

[0065] S12. Determine a corresponding prediction model based on the periodicity of historical data in the time series.

[0066] In this embodiment, if the historical data has periodicity in the time series, a periodic model can be determined according to the periodic law of the historical data. For example, a corresponding curve graph can be directly drawn according to the changes in the historical data in the time series, and a graph of the changes in the historical data can be generated according to the corresponding period. The graph of the changes in the historical data is used as a prediction model, and the historical data corresponding to different time points are determined thereby; of course, a corresponding calculation formula can also be fitted according to the changes in the historical data in the time series, and the calculation formula can be used as the prediction model in this scheme to predict the historical data corresponding to different time points.

[0067] In this implementation, if the historical data does not have periodicity in the time series, it means that the historical data will undergo different changes due to the influence of the current situation. At this time, it is necessary to deeply learn the corresponding situation of the historical data in the time series. For example, relying on big data mining, a machine learning algorithm is used to learn the correlation between historical data and different situations, and then obtain a prediction model that can predict historical data. For example, the prediction model can be constructed through a deep convolutional neural network, and the prediction model can be trained with a large amount of historical data. The prediction model can also be constructed through a vector machine, a decision tree, and a hidden Markov model, and further trained with a large amount of historical data.

[0068] S13. Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after the preset time.

[0069] In this embodiment, since there is a corresponding correlation between historical data and the historical event parameters corresponding to the historical data, it is common to predict various data of concern through big data statistical detection. For example, the number of video clicks and the promotion strength of the video, the classification of video content, the popularity of the video and other parameters are correlated, and whether the parameters of different events will have an impact on the corresponding data can be directly obtained from the daily data changes. We use historical data to predict subsequent data. By comparing the predicted data with the actual data, we can determine whether there is an event fluctuation, which is not limited to the events corresponding to the historical event parameters. For example, if the historical event parameters are consistent with the event parameters within a preset time after the preset moment, and there is still a difference between the predicted data and the actual data, it means that the actual data is not changed due to the change in the event corresponding to the historical event parameters, but some events that are not noticed in daily life cause the data to change.

[0070] Events that can be noticed in daily life have changed, and staff can quickly know the possible problems and solutions to the problems. On the contrary, events corresponding to small details that are not noticed in daily life are not easy to be discovered. For example, in daily use, the access bandwidth of the server is in a relatively stable state, so when predicting the corresponding data through event parameters, the access bandwidth of the server may not be taken into account. At this time, if there is a small problem with the access bandwidth, some users may not be able to access the server, which will further affect other data, such as video visits, user feedback and evaluation data. Our goal is to determine that an event anomaly has occurred to avoid small problems from becoming big problems. Therefore, in this step, historical data and historical event parameters corresponding to the historical data are used.

[0071] In this embodiment, the data changes under different event parameters can be obtained based on big data machine learning algorithms, vector machine-based linear programming predictions, and more in-depth convolutional neural networks. Therefore, in this step, the corresponding prediction model can be trained based on historical data and historical event parameters corresponding to the historical data. The data changes within a preset time after a preset moment are predicted through the prediction model and the historical event parameters before the preset moment, so as to obtain the predicted data in this step.

[0072] S14: Acquire actual data of the monitored indicator within a preset time period after a preset time, and determine whether the actual data is abnormal based on the predicted data.

[0073] In this embodiment, after the predicted data within the preset time period is obtained in the above steps, the actual data of the monitored indicator within the preset time period after the preset moment is obtained in real time, and whether the actual data is abnormal is determined based on the predicted data. For example, if the relative deviation between the predicted data and the actual data is small, it can be considered that the actual data is not abnormal, or if the similarity between the predicted data and the actual data is high, it can also be considered that the actual data is not abnormal. Different methods can be used to determine whether the predicted data is abnormal based on the attributes of the data. Specifically, if the predicted data and the actual data are specific values, the relative deviation method can be used for judgment. For example, the number of daily active users at the time of the data, The predicted data for the number of daily active users is 990,000, while the actual data is 1 million. The relative deviation between the predicted data and the actual data is 1%. If the relative deviation threshold is set to 0.5%, the predicted data is considered abnormal. The larger the relative deviation threshold is, the lower the accuracy of the data abnormality. Conversely, the greater the accuracy. Similarly, if the predicted data is data that changes over time within a preset period of time, the similarity between the predicted data and the actual data can be calculated to determine whether the predicted data is abnormal. Of course, a fixed value can also be used to determine whether the actual data is abnormal by calculating the similarity. This solution is illustrated here by way of example and is not particularly limited.

[0074] S15. If the actual data is abnormal, it is determined that an abnormal fluctuation of an event occurs after a preset time.

[0075] In this embodiment, if the predicted data obtained through historical data and historical event parameters determines that the actual data is not abnormal, it means that no unexpected events have occurred; and when it is determined that the actual data is abnormal, it means that abnormal fluctuations in events have occurred before and after the preset moment, and it may be that a certain historical event parameter has changed after the preset moment, resulting in a difference between the predicted data and the actual data.

[0076] Of course, it may also be that the parameters of an event that was not monitored before have changed, resulting in a difference between the predicted data and the actual data. Specifically, it is possible to determine whether the parameters of each historical event have changed to determine whether the parameters of an unmonitored event will also affect the data being paid attention to. For example, if the parameters of various historical events involved in the prediction of the predicted data have not changed after the preset time, if the prediction model is accurate, it means that other events have occurred at this time and have affected the data being paid attention to, thereby causing a difference between the predicted data and the actual data. Therefore, an alarm can be issued at this time to allow users to handle it in time to reduce the impact of potential risks.

[0077] In this embodiment, this scheme predicts the predicted data of the monitored indicator based on the historical data of the monitored indicator and the historical event parameters corresponding to the historical data, determines whether the actual data of the monitored indicator is abnormal based on the predicted data, and determines whether the abnormal fluctuation of the event occurs after the preset time after the actual data is abnormal. This scheme realizes data prediction for the monitored indicator through historical data and corresponding historical event parameters, and determines the abnormal situation of the actual data of the monitored indicator through the predicted data. Once the predicted data does not match the actual data, it means that the event parameters have changed at this time. Furthermore, it is also possible to determine whether the event with changed parameters is the event corresponding to the historical event parameters based on whether the historical event parameters have changed after the preset time. This is convenient for users to promptly know whether an event has occurred that can affect the monitored indicator and has not been paid attention to, thereby reducing the workload of staff for investigation and reducing the impact of emergencies.

[0078] like Figure 2 As shown, an embodiment of the present invention provides a method for detecting abnormal fluctuations of events. Figure 2 As shown, the detection method comprises the following steps:

[0079] S21. Obtain historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data.

[0080] In this embodiment, details about step S21 can be found in the description of step S11, and this embodiment will not be repeated here.

[0081] S22. Determine whether the historical data is periodic based on changes in the historical data in time series.

[0082] In this embodiment, the time series (or dynamic series) refers to a series in which the values ​​of the same statistical indicator are arranged in the order of their occurrence time. This scheme determines whether the historical data is periodic based on the changes in the historical data in the time series. Since the periodic historical data will undergo corresponding changes under different historical event parameters, the event parameters will also have a certain periodicity as time changes. The predicted event parameters can be obtained based on the historical event parameters, and the predicted data can be obtained from the predicted event parameters. The historical data that does not have periodicity can only be aggregated by big data machine learning algorithms, such as convolutional neural networks, to train the model, and input data into the model to obtain the output results for data prediction.

[0083] In this embodiment, judging whether the change of data in time series is periodic can be achieved by methods provided in the prior art, and this solution does not specifically limit this.

[0084] S23a. If the historical data is periodic, based on the periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time after the preset time is predicted.

[0085] In this embodiment, when the historical data is periodic, a periodic algorithm model can be constructed based on the periodic algorithm according to the historical data and the historical event parameters corresponding to the historical data, and the actual data of the monitored indicator within a preset time after the preset time can be predicted.

[0086] In this embodiment, the periodic algorithm can be an ARIMA model (Autoregressive Integrated Moving Average model), a differential integrated moving average autoregressive model, also known as an integrated moving average autoregressive model (moving can also be called sliding), which is one of the time series prediction and detection methods; it can also be a SARIMAX algorithm, which adds season (S, Seasonal) and external factors (X, eXogenous) to the differential moving autoregressive model (ARIMA), that is, it adds periodicity and seasonality to the ARIMA basis, and is suitable for data with obvious periodicity and seasonality characteristics in the time series; since historical data has periodicity, it can also be a time series prediction method. The time series prediction method is actually a regression prediction method, which belongs to quantitative prediction. Its basic principle is that on the one hand, it recognizes the continuity of the development of things, uses past time series data for statistical detection, and infers the development trend of things; on the other hand, it fully considers the randomness caused by accidental factors. In order to eliminate the impact of random fluctuations, historical data is used for statistical detection, and the data is properly processed to predict trends.

[0087] In this embodiment, when the historical data is periodic, a periodic algorithm is used and the historical data is substituted into the periodic algorithm to quickly regress and fit the corresponding formula or model, thereby completing the prediction of data at future times.

[0088] Moreover, if the data is periodic, depicting the historical data in a coordinate system and then fitting it can also quickly determine the formula or model corresponding to the data, thus avoiding time-consuming iterations of the machine learning algorithm.

[0089] S23b. If the historical data is not periodic, based on a non-periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time period after the preset time is predicted.

[0090] In this embodiment, when the historical data is not periodic, a non-periodic algorithm model can be constructed based on the non-periodic algorithm according to the historical data and the historical time parameters corresponding to the historical data, and the actual data of the monitored indicator within a preset time after the preset moment can be predicted.

[0091] The non-periodic algorithm can be an RNN algorithm. The RNN algorithm, namely the Recurrent Neural Network (RNN), is a type of recursive neural network that takes sequence data as input, performs recursion in the direction of sequence evolution, and all nodes (recurrent units) are connected in a chain. It can also be an LSTM algorithm. The LSTM algorithm, namely the Long Short-Term Memory Network (LSTM, Long Short-Term Memory), is a time recurrent neural network that is specially designed to solve the long-term dependency problem of general RNN (recurrent neural network). All RNNs have a chain form of repeated neural network modules. It can also be a CNN algorithm. The CNN algorithm, namely the Convolutional Neural Networks (CNN), is a type of feedforward neural network that includes convolution calculations and has a deep structure. It is one of the representative algorithms of deep learning. Convolutional neural networks have the ability of representation learning and can perform shift-invariant classification on input information according to its hierarchical structure. Therefore, they are also called "Shift-Invariant Artificial Neural Networks (SIANN)".

[0092] In this embodiment, compared to the case where the data is periodic, if the data is not periodic, it is very difficult to predict the data at future times. At this time, the correlation between the data can only be learned through iterations of machine learning algorithms to obtain the corresponding model, and the prediction of the data at future times can be realized through the model; in this scheme, a prediction model is established, and historical data is used as the input and output of the prediction model for iterative training until the relative deviation between the prediction result obtained by the model and the actual historical data as the output is less than the preset error. The prediction model training is considered to be completed, and a trained prediction model is obtained. Of course, in the case of periodic historical data, non-periodic algorithms can also be used to construct an algorithm model corresponding to the historical data for prediction.

[0093] S24. Obtain actual data of the monitored indicator within a preset time period after a preset time, and determine whether the actual data is abnormal based on the predicted data.

[0094] In this embodiment, details about step S24 can be found in the description of step S14, and this embodiment will not be repeated here.

[0095] S25. If the actual data is abnormal, an abnormal fluctuation of the event will occur after the preset time.

[0096] In this embodiment, details about step S25 can be found in the description of step S15, and this embodiment will not be repeated here.

[0097] In this embodiment, based on the changes in the historical data of the monitored indicators in the time series, it is determined whether the historical data has periodicity, and different algorithms are selected to build models based on whether the historical data has periodicity to achieve prediction of the data of the monitored indicators, close to the data characteristics of the monitored indicators, and obtain the prediction results of the monitored indicators faster and more efficiently, thereby improving the accuracy of the model prediction results and avoiding misjudgment due to incorrect prediction results.

[0098] like Figure 3 As shown, an embodiment of the present invention provides a method for detecting abnormal fluctuations of events. Figure 3 As shown, the detection method comprises the following steps:

[0099] S31. Obtain historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data.

[0100] In this embodiment, details about step S31 can be found in the description of step S11, and this embodiment will not be repeated here.

[0101] S32. Determine a corresponding prediction model according to the periodicity of the historical data in the time series.

[0102] In this embodiment, details about step S32 can be found in the description of step S12, and this embodiment will not be repeated here.

[0103] S33. Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after the preset time.

[0104] In this embodiment, details about step S33 can be found in the description of step S13, and this embodiment will not be repeated here.

[0105] S34, obtaining actual data of the monitored indicator within a preset time period after a preset time.

[0106] In this embodiment, details about step S34 may refer to the description of step S14, which will not be described in detail in this embodiment.

[0107] S35. Calculate the similarity between the change of the actual data in the time series and the change of the predicted data in the time series.

[0108] In this embodiment, the time series (or dynamic series) refers to a series in which the values ​​of the same statistical indicator are arranged in the order of their occurrence time.

[0109] In this embodiment, a first vector can be constructed according to changes in actual data in a time series, and a second vector can be constructed according to changes in predicted data in a time series. The cosine value of the first vector and the second vector can be calculated as the similarity in this step. The Euclidean distance between the first vector and the second vector can also be calculated. The similarity in this step is determined based on the fact that the smaller the Euclidean distance, the greater the corresponding similarity. The corresponding distance value can also be calculated based on a dynamic time normalization algorithm for the values ​​of the actual data at each time point and the corresponding values ​​of the predicted data at each time point. The similarity in this step is determined based on the fact that the smaller the distance value, the greater the corresponding similarity.

[0110] S36: Determine whether the similarity is greater than or equal to a preset similarity threshold.

[0111] S37a. If the similarity is greater than or equal to the preset similarity threshold, the actual data is not abnormal.

[0112] S37b. If the similarity is less than the preset similarity threshold, the actual data is abnormal.

[0113] In this embodiment, if the similarity between the changes in the actual data in the time series and the changes in the predicted data in the time series is greater than or equal to the preset similarity threshold, it means that the predicted data obtained based on the historical data and the historical event parameters corresponding to the historical data are not much different from the actual data, so it can be considered that the historical event parameters and other possible abnormal events have not been abnormal or changed.

[0114] S38. If the actual data is abnormal, an abnormal fluctuation of the event will occur after the preset time.

[0115] In this embodiment, details about step S38 can be found in the description of step S15, and this embodiment will not be repeated here.

[0116] In this embodiment, this scheme determines whether the predicted data of the monitored indicator is accurate by calculating the similarity between the changes in the predicted data and the actual data in the time series. If the predicted data is accurate, it can be explained that the event corresponding to the historical event parameters has not changed after the preset time, and there is no change in the parameters of new events that causes the predicted data to change.

[0117] like Figure 4 As shown, for calculating the similarity between the change of the actual data in time series and the change of the predicted data in time series in step S35, this solution provides a similarity calculation method, and the calculation method includes the following steps:

[0118] S41. Based on a dynamic time normalization algorithm, a first distance between a change in actual data in a time series and a change in predicted data in a time series is calculated.

[0119] In this embodiment, the dynamic time warping algorithm is initially used to identify the similarity of speech. Its purpose is relatively simple, which is a method to measure the similarity of two time series of different lengths. For example, a correct pronunciation should contain all the phonemes that constitute the pronunciation and the correct order of phoneme connection. The duration of each phoneme is related to the phoneme itself and the speaker's condition. In order to improve the recognition rate and overcome the difference in pronunciation time for the same sound, the input speech signal is stretched or shortened until it is consistent with the length of the standard pattern. This process is called time warping. Since the time warping algorithm can also be used in other fields, it is mainly used in template matching, such as isolated word speech recognition (recognizing whether two segments of speech represent the same word), gesture recognition, data mining and information retrieval.

[0120] To explain the dynamic time warping algorithm, you can refer to the following example. We use numbers to represent the pitch. For example, the pitch of a word is 1-3-2-4. Now two people say this word. One person prolongs the first half and pronounces it as 1-1-3-3-2-4; the other person prolongs the second half and pronounces it as 1-3-2-2-4-4. Now we need to calculate the distance between the two sequences 1-1-3-3-2-4 and 1-3-2-2-4-4 (the smaller the distance, the higher the similarity). Because the two sequences represent the same word, we hope that the calculated distance is as small as possible, so that the probability of recognizing the two sequences as the same word is greater. First, the Euclidean distance between the two sequences is calculated using the traditional method, that is, the sum of the distances between the corresponding points of the two sequences is calculated as |1-1|+|1-3|+|3-2|+|3-2|+|2-4|+|4-4|=6; if we allow a point in a sequence to correspond to multiple consecutive points in another sequence (equivalent to extending the pronunciation time of the tone represented by this point), and then calculate the sum of the distances between the corresponding points as |1-1|+|1-1|+|3-3|+|3-3|+|2-2|+|2-2|+|4-4|+|4-4|=0; we call this approach of "making the points at a certain moment in the sequence correspond to the points at multiple consecutive moments in another moment" time regularization.

[0121] Specifically, the steps of the dynamic time warping algorithm are: calculate the distance matrix between each point of the two sequences, and then find a path from the upper left corner to the lower right corner of the matrix so that the sum of the elements on the path is minimized.

[0122] In this embodiment, the distance between the corresponding actual data and the predicted data in the time series is calculated by a dynamic time normalization algorithm. The smaller the distance, the higher the similarity between the actual data and the predicted data.

[0123] S42. Obtain, based on the first distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series.

[0124] In this embodiment, since the first distance value can illustrate the similarity value of the changes between the actual data and the predicted data in the time series, the larger the first distance value is, the smaller the similarity value of the changes between the actual data and the predicted data in the time series is, and the smaller the first distance value is, the larger the similarity value of the changes between the actual data and the predicted data in the time series is, therefore, in this step, the inverse of the first distance value can be calculated as the similarity between the changes between the actual data in the time series and the changes between the predicted data in the time series, or a form can be generated to set corresponding similarity values ​​for different distance values, and the corresponding similarity can be obtained from the form according to the obtained first distance value.

[0125] like Figure 5As shown, for calculating the similarity between the change of the actual data in time series and the change of the predicted data in time series in step S35, this solution provides another similarity calculation method, which includes the following steps:

[0126] S51. Based on the Euclidean distance algorithm, calculate a second distance value between the change of the actual data in the time series and the change of the predicted data in the time series.

[0127] In this embodiment, in mathematics, the Euclidean distance or Euclidean metric is the "ordinary" (i.e., straight-line) distance between two points in Euclidean space. Using this distance, the Euclidean space becomes a metric space.

[0128] Referring to the description in the above embodiment, we use numbers to represent the pitch, for example, the pitch of a word is 1-3-2-4. Now two people say this word, one person prolongs the first half, and the pronunciation is 1-1-3-3-2-4; the other person prolongs the second half, and the pronunciation is 1-3-2-2-4-4. Now we need to calculate the distance between the two sequences 1-1-3-3-2-4 and 1-3-2-2-4-4 (the smaller the distance, the higher the similarity). Because the two sequences represent the same word, we hope that the calculated distance is as small as possible, so that the probability of identifying the two sequences as the same word is greater. First, use the traditional method to calculate the Euclidean distance of the two sequences, that is, calculate the sum of the distances between the corresponding points of the two sequences |1-1|+|1-3|+|3-2|+|3-2|+|2-4|+|4-4|=6; the above is the method of calculating the Euclidean distance.

[0129] In this embodiment, compared with the dynamic time normalization algorithm for calculating the first distance in the above-mentioned embodiment, for the dynamic time normalization algorithm, different indicators have different dimensions, and the distance between the two curves calculated by the traditional dynamic time normalization algorithm cannot set a unified threshold to measure the degree of distance. In this step, the second distance value between the change of actual data in time series and the change of predicted data in time series is calculated by the Euclidean distance algorithm. The distance value calculated by the Euclidean distance algorithm is the same as that of the dynamic time normalization algorithm. The smaller the distance value, the higher the similarity. However, the distance value obtained by the Euclidean distance is larger than the distance value obtained by the dynamic time normalization algorithm, and it is more prone to misjudgment.

[0130] S52. Obtain, based on the second distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series.

[0131] In this embodiment, since the second distance value can illustrate the similarity value of the changes between the actual data and the predicted data in the time series, the larger the second distance value is, the smaller the similarity value of the changes between the actual data and the predicted data in the time series is, and the smaller the second distance value is, the larger the similarity value of the changes between the actual data and the predicted data in the time series is, therefore, in this step, the inverse of the second distance value can be calculated as the similarity between the changes between the actual data in the time series and the changes between the predicted data in the time series, or a form can be generated to set corresponding similarity values ​​for different distance values, and the corresponding similarity can be obtained from the form according to the obtained second distance value.

[0132] like Figure 6 As shown, for calculating the similarity between the change of the actual data in time series and the change of the predicted data in time series in step S35, this solution provides another similarity calculation method, which includes the following steps:

[0133] S61. Based on a dynamic time normalization algorithm, a first distance value between a change in actual data in a time series and a change in predicted data in a time series is calculated.

[0134] In this embodiment, the distance between the corresponding actual data and the predicted data in the time series is calculated by a dynamic time normalization algorithm. The smaller the distance, the higher the similarity between the actual data and the predicted data.

[0135] S62. Based on the Euclidean distance algorithm, calculate a second distance value between a change in the actual data in the time series and a change in the predicted data in the time series.

[0136] In this embodiment, compared with the dynamic time normalization algorithm for calculating the first distance in the above steps, for the dynamic time normalization algorithm, different indicators have different dimensions, and the distance between the two curves calculated by the traditional dynamic time normalization algorithm cannot set a unified threshold to measure the degree of distance. In this step, the second distance value between the change of actual data in time series and the change of predicted data in time series is calculated by the Euclidean distance algorithm. The distance value calculated by the Euclidean distance algorithm is the same as that of the dynamic time normalization algorithm. The smaller the distance value, the higher the similarity. However, the distance value obtained by the Euclidean distance is larger than the distance value obtained by the dynamic time normalization algorithm, and it is more prone to misjudgment.

[0137] S63: Calculate a relative deviation between the first distance value and the second distance value, and determine whether the relative deviation is greater than a preset threshold.

[0138] In this embodiment, based on the description in the above embodiment, it can be known that the dynamic time warping algorithm can effectively avoid the misjudgment in the Euclidean distance algorithm, but the dynamic time warping algorithm is also prone to the calculated distance value causing the judgment that two different sequences are similar. For example, the two sequences 1-7-2-4 and 1-2-7-4, the distance value calculated by the dynamic time warping algorithm is 3, and the distance value calculated by the Euclidean distance is 10. Compared with the Euclidean distance, the distance value calculated by the dynamic time warping algorithm is very small, and this is still the distance value calculated when the sequence is short. Once the length of the sequence increases, the difference between the two calculations will also increase. Therefore, blindly using dynamic time warping or Euclidean distance will have the risk of misjudgment.

[0139] In this embodiment, this scheme combines the dynamic time normalization algorithm and the Euclidean distance algorithm to determine whether the relative deviation between the first distance value and the second distance value is greater than a preset threshold value. If the relative deviation is large, it means that the difference between the first distance value and the second distance value is large. According to the principle of the dynamic event normalization algorithm, at this time, the first distance value can be better used to illustrate the similarity between the actual data and the predicted data in the time series. If the relative deviation is small, it means that the difference between the first distance value and the second distance value is small. At this time, the second distance value calculated based on the Euclidean distance algorithm can be better used to illustrate the similarity between the actual data and the predicted data in the time series.

[0140] S64a. When the relative deviation value is greater than a preset threshold, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained according to the first distance value.

[0141] S64b. When the relative deviation value is less than or equal to the preset threshold, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained according to the second distance value.

[0142] In this embodiment, in combination with the differences caused by the dynamic time normalization algorithm and the Euclidean distance calculation method, according to the relative deviation value of the first distance value and the second distance value and the preset threshold, when the difference between the first distance value and the second distance value is large, it means that the distance value calculated by the dynamic time normalization algorithm can better reflect the similarity. When the difference between the first distance value and the second distance value is small, the distance value calculated by the Euclidean distance algorithm can be used to determine the similarity between the actual data and the predicted data in the time series.

[0143] In this embodiment, the ratio of the first distance value to the second distance value can be calculated as the basis for judging the similarity. Compared with the DTW distance, the difference in dimensions between different data indicators is avoided, and judgment of data of different orders of magnitude is achieved. For example, when the indicator is time and when the indicator is temperature, the Euclidean distance calculated by the two indicators and the distance of the dynamic time warping algorithm are completely not of the same order of magnitude. Therefore, the difference in dimensions between different data indicators can be avoided by calculating the ratio of the first distance value to the second distance value and determining the similarity between the predicted data and the actual data according to the ratio.

[0144] like Figure 7 As shown, an embodiment of the present invention provides a method for detecting abnormal fluctuations of events. Figure 7 As shown, the detection method comprises the following steps:

[0145] S71. Obtain historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data.

[0146] In this embodiment, details about step S71 can be found in the description of step S11, and this embodiment will not be repeated here.

[0147] S72. Determine a corresponding prediction model according to the periodicity of the historical data in the time series.

[0148] In this embodiment, details about step S72 can be found in the description of step S12, and this embodiment will not be repeated here.

[0149] S73. Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time period after the preset time.

[0150] In this embodiment, details about step S73 can be found in the description of step S13, and this embodiment will not be repeated here.

[0151] S74, obtaining actual data of the monitored indicator within a preset time period after a preset time, and determining whether the predicted data is abnormal based on the actual data;

[0152] In this embodiment, details about step S74 can be found in the description of step S14, and this embodiment will not be repeated here.

[0153] S75. When the actual data is abnormal, obtain the actual data and actual event parameters within a preset time after the preset moment; the actual data is the data of the event whose parameters have changed compared with those before the preset moment; the actual event parameters are the parameters of the event whose parameters have changed compared with those before the preset moment.

[0154] S76. Add the actual data into the historical data to form new historical data; and add the actual event parameters into the historical event parameters to form new historical event parameters; based on the historical data and the historical event parameters corresponding to the historical data, re-predict the secondary prediction data of the monitored indicator within the preset time after the preset time.

[0155] In this embodiment, when it is determined that the predicted data is abnormal, the parameters of the event whose parameters have changed within a preset time period after a preset moment compared with before the preset moment are obtained as actual event parameters. If the predicted data is abnormal, when the prediction model is correct, it means that the parameters of the event have changed. Due to the change in the parameters of the event, there is a large difference between the actual data and the predicted data.

[0156] In this embodiment, when it is determined that the predicted data is abnormal, the parameters of the event whose parameters have changed are taken as actual event parameters and added to the historical event parameters. Through the historical data and the new historical event parameters corresponding to the historical data, the secondary predicted data of the monitored indicator within the preset time length is re-predicted. The method of predicting the secondary predicted data can be the same as the method of obtaining the predicted data in the above embodiment.

[0157] S77. Determine whether the actual data is abnormal based on the secondary prediction data.

[0158] In this embodiment, judging whether the secondary prediction data is abnormal based on the actual data can refer to the method of judging whether the prediction data is abnormal based on the actual data in the above embodiment, and this step will not be repeated.

[0159] S78a. If the actual data is not abnormal, the event corresponding to the actual event parameter is regarded as an abnormal event.

[0160] S78b. If the actual data is abnormal, then the event corresponding to the actual data and the actual event parameter is not abnormal.

[0161] In this embodiment, if the actual data is not abnormal, it means that the difference between the predicted data and the actual data is indeed caused by the change in the parameters of the event. Therefore, the event corresponding to the actual event parameters can be regarded as an abnormal event. The abnormal event is not limited to the event corresponding to the historical event parameters, but can also be the event parameters corresponding to other events that have not been observed before. After the abnormal event is determined, it can be convenient for users to handle it in a timely and targeted manner, thereby improving the ability to prevent abnormal events.

[0162] The functions of the device in the embodiment of the present invention have been described in the above method embodiment, so for details not provided in the description of this embodiment, please refer to the relevant description in the above embodiment, and no further description will be given here.

[0163] like Figure 8 As shown, an embodiment of the present invention provides an event abnormal fluctuation detection system, and the detection system includes: a first acquisition unit 11, a prediction unit 12, a second acquisition unit 13 and a judgment unit 14.

[0164] In this embodiment, the first acquisition unit 11 is used to acquire historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data.

[0165] In this embodiment, the prediction unit 12 is used to determine the corresponding prediction model according to the periodicity of the historical data in the time series; based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, the prediction data of the monitored indicator within a preset time period after the preset time is predicted.

[0166] In this embodiment, the second acquisition unit 13 is used to acquire actual data of the monitored indicator within a preset time period after a preset time.

[0167] In this embodiment, the judgment unit 14 is used to judge whether the actual data is abnormal according to the predicted data; if the actual data is abnormal, it is determined that an abnormal fluctuation of the event occurs after a preset time.

[0168] In this embodiment, the prediction unit 12 is specifically used to determine whether the historical data is periodic based on the changes of the historical data in the time series; if the historical data is periodic, then based on the periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time after the preset moment is predicted; if the historical data is not periodic, then based on the non-periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time after the preset moment is predicted.

[0169] In this embodiment, the judgment unit 14 is specifically used to calculate the similarity between the change of the actual data in the time series and the change of the predicted data in the time series; judge whether the similarity is greater than or equal to the preset similarity threshold; if the similarity is greater than or equal to the preset similarity threshold, the actual data is not abnormal; if the similarity is less than the preset similarity threshold, the actual data is abnormal.

[0170] In this embodiment, the event abnormal fluctuation detection system also includes: a calculation unit, which is used to calculate the first distance value between the change of actual data in the time series and the change of predicted data in the time series based on the dynamic time normalization algorithm; according to the first distance value, obtain the similarity between the change of actual data in the time series and the change of predicted data in the time series.

[0171] Compared with the above embodiment, the calculation unit can also be used to calculate the second distance value between the change of actual data in time series and the change of predicted data in time series based on the Euclidean distance algorithm; according to the second distance value, the similarity between the change of actual data in time series and the change of predicted data in time series is obtained.

[0172] Compared with the above embodiment, the calculation unit can also be used to calculate the first distance value between the change of actual data in time series and the change of predicted data in time series based on the dynamic time normalization algorithm; calculate the second distance value between the change of actual data in time series and the change of predicted data in time series based on the Euclidean distance algorithm; calculate the relative deviation value between the first distance value and the second distance value, and determine whether the relative deviation value is greater than a preset threshold; when the relative deviation value is greater than the preset threshold, obtain the similarity between the change of actual data in time series and the change of predicted data in time series according to the first distance value; when the relative deviation value is less than or equal to the preset threshold, obtain the similarity between the change of actual data in time series and the change of predicted data in time series according to the second distance value.

[0173] In this embodiment, the time abnormal fluctuation detection system also includes: an abnormal event determination unit, which is used to obtain actual data and actual event parameters within a preset time after a preset moment when the actual data is abnormal; the actual data is data of an event whose parameters have changed compared with before the preset moment; the actual event parameters are parameters of an event whose parameters have changed compared with before the preset moment; the actual data is added to the historical data to form new historical data; and the actual event parameters are added to the historical event parameters to form new historical event parameters; based on the historical data and the historical event parameters corresponding to the historical data, re-predict the secondary prediction data of the monitored indicator within a preset time after the preset moment; based on the secondary prediction data, determine whether the actual data is abnormal; if the actual data is not abnormal, the event corresponding to the actual data and the actual event parameters is taken as an abnormal event; if the actual data is abnormal, the event corresponding to the actual data and the actual event parameters is not abnormal.

[0174] like Fig. 9 As shown, an embodiment of the present invention provides an electronic device, including a processor 1110, a communication interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other through the communication bus 1140;

[0175] Memory 1130, used for storing computer programs;

[0176] The processor 1110 is used to implement the following steps when executing the program stored in the memory 1130:

[0177] Obtain the historical data of the monitored indicator before the preset time and the historical event parameters corresponding to the historical data;

[0178] Determine a corresponding prediction model according to the periodicity of the historical data in the time series;

[0179] Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after the preset time;

[0180] Acquire actual data of the monitored indicator within a preset time period after a preset time, and determine whether the actual data is abnormal based on the predicted data;

[0181] If the actual data is abnormal, it is determined that an abnormal fluctuation of the event occurs after the preset time.

[0182] In the electronic device provided by the embodiment of the present invention, the processor 1110 realizes data prediction for the monitored indicators through historical data and corresponding historical event parameters by executing the program stored in the memory 1130, and determines the abnormal situation of the predicted data through the actual data of the monitored indicators. Once the predicted data does not match the actual data, it means that the event parameters have changed at this time. Furthermore, it is also possible to determine whether the event with changed parameters is the event corresponding to the historical event parameters based on whether the historical event parameters change after a preset time, so that users can know in time whether an event that can affect the monitored indicators and has not been paid attention to has occurred, thereby reducing the workload of staff for investigation and reducing the impact of emergencies.

[0183] The communication bus 1140 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0184] The communication interface 1120 is used for communication between the above electronic device and other devices.

[0185] The memory 1130 may include a random access memory 1130 (RAM), or may include a non-volatile memory 1130 (non-volatile memory), such as at least one disk memory 1130. Optionally, the memory 1130 may also be at least one storage device located away from the processor 1110.

[0186] The above-mentioned processor 1110 can be a general-purpose processor 1110, including a central processing unit 1110 (CPU), a network processor 1110 (NP), etc.; it can also be a digital signal processor 1110 (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0187] An embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors 1110 to implement the event abnormal fluctuation detection method of any of the above embodiments.

[0188] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidStateDisk (SSD)), etc.

[0189] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal fluctuations of an event, characterized in that: The detection method comprises: Obtain the historical data of the monitored indicator before the preset time and the historical event parameters corresponding to the historical data; Determine a corresponding prediction model according to the periodicity of the historical data in the time series; Based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after the preset time; Acquire actual data of the monitored indicator within a preset time period after a preset time, and determine whether the actual data is abnormal based on the predicted data; If the actual data is abnormal, it is determined that an abnormal fluctuation of the event occurs after the preset time; The detection method further comprises: When the actual data is abnormal, the actual data and actual event parameters within a preset time period after the preset time are obtained; the actual data is the data of the event whose parameters have changed compared with those before the preset time; the actual event parameters are the parameters of the event whose parameters have changed compared with those before the preset time; Adding the actual data to the historical data to form new historical data; and adding the actual event parameters to the historical event parameters to form new historical event parameters; Re-predicting the secondary prediction data of the monitored indicator within a preset time period after a preset time according to the historical data and the historical event parameters corresponding to the historical data; Determining whether the actual data is abnormal according to the secondary prediction data; If the actual data is not abnormal, treating the event corresponding to the actual data and the actual event parameter as an abnormal event; If the actual data is abnormal, then the event corresponding to the actual data and the actual event parameter is not abnormal.

2. The method for detecting abnormal fluctuations of events according to claim 1, characterized in that: Determining a corresponding prediction model according to the periodicity of the historical data in a time series includes: Judging whether the historical data has periodicity according to the changes of the historical data in the time series; If the historical data is periodic, then based on the periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time after the preset time is predicted; If the historical data is not periodic, based on a non-periodic algorithm model, according to the historical data and the historical event parameters corresponding to the historical data, the predicted data of the monitored indicator within a preset time period after the preset time is predicted.

3. The method for detecting abnormal fluctuations of events according to claim 1, characterized in that: The determining whether the actual data is abnormal according to the predicted data includes: Calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series; Determining whether the similarity is greater than or equal to a preset similarity threshold; If the similarity is greater than or equal to the preset similarity threshold, then the actual data is not abnormal; If the similarity is less than a preset similarity threshold, the actual data is abnormal.

4. The method for detecting abnormal fluctuations of events according to claim 3, characterized in that: The calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes: Calculating a first distance value between a change in the actual data in the time series and a change in the predicted data in the time series based on a dynamic time normalization algorithm; According to the first distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained.

5. The method for detecting abnormal fluctuations of events according to claim 3, characterized in that: The calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes: Calculating a second distance value between a change in the actual data in time series and a change in the predicted data in time series based on a Euclidean distance algorithm; According to the second distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained.

6. The method for detecting abnormal fluctuations of events according to claim 3, characterized in that: The calculating the similarity between the change of the actual data in the time series and the change of the predicted data in the time series includes: Calculating a first distance value between a change in the actual data in the time series and a change in the predicted data in the time series based on a dynamic time normalization algorithm; Calculating a second distance value between a change in the actual data in time series and a change in the predicted data in time series based on a Euclidean distance algorithm; Calculating a relative deviation between the first distance value and the second distance value, and determining whether the relative deviation is greater than a preset threshold; When the relative deviation value is greater than a preset threshold, obtaining, according to the first distance value, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series; When the relative deviation value is less than or equal to a preset threshold, the similarity between the change of the actual data in the time series and the change of the predicted data in the time series is obtained according to the second distance value.

7. An event abnormal fluctuation detection system, characterized in that: The detection system comprises: A first acquisition unit is used to acquire historical data of the monitored indicator before a preset time and historical event parameters corresponding to the historical data; A prediction unit, configured to determine a corresponding prediction model according to the periodicity of the historical data in a time series; based on the prediction model, according to the historical data and the historical event parameters corresponding to the historical data, predict the predicted data of the monitored indicator within a preset time after a preset time; The second acquisition unit is used to acquire actual data of the monitored indicator within a preset time after a preset time; A judgment unit, configured to judge whether the actual data is abnormal according to the predicted data; if the actual data is abnormal, then judging that an abnormal fluctuation of an event occurs after a preset time; An abnormal event determination unit is used to obtain actual data and actual event parameters within a preset time period after a preset moment when the actual data is abnormal; the actual data is data of an event whose parameters have changed compared with those before the preset moment; the actual event parameters are parameters of an event whose parameters have changed compared with those before the preset moment; Adding the actual data to the historical data to form new historical data; and adding the actual event parameters to the historical event parameters to form new historical event parameters; Re-predicting the secondary prediction data of the monitored indicator within a preset time period after a preset time according to the historical data and the historical event parameters corresponding to the historical data; Determining whether the actual data is abnormal according to the secondary prediction data; If the actual data is not abnormal, treating the event corresponding to the actual data and the actual event parameter as an abnormal event; If the actual data is abnormal, then the event corresponding to the actual data and the actual event parameter is not abnormal.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to implement the event abnormal fluctuation detection method described in any one of claims 1 to 6 when executing a program stored in a memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the event abnormal fluctuation detection method described in any one of claims 1 to 6.

Images