An abnormality monitoring method, device, apparatus, and storage medium

Abstract

The embodiment of the application discloses an abnormality monitoring method, which comprises the following steps: acquiring a characteristic parameter corresponding to a target monitoring index of a monitoring object; calculating the characteristic parameter to obtain a target threshold; collecting a first index value of the target monitoring index; and determining whether the monitoring object is abnormal based on the first index value and the target threshold. The application considers the characteristics of the system to set the threshold, improves the accuracy of the abnormality alarm prompt, and ensures the monitoring efficiency of the system monitoring. The embodiment of the application also discloses an abnormality monitoring device, equipment and a storage medium.

Description

Technical Field

[0001] This application relates to the field of computer communication technology, and in particular to an anomaly monitoring method, apparatus, device, and storage medium. Background Technology

[0002] During system operation and maintenance, it is common practice to monitor one or more metrics in real time to detect system anomalies. Currently, common monitoring solutions typically set thresholds based on historical monitoring values. When a metric exceeds this threshold, an anomaly alarm is triggered.

[0003] However, when setting thresholds, only the relationship between historical values ​​of monitoring indicators and monitoring events is considered, ignoring the complexity of the system and the correlation between monitoring indicators. This makes the current monitoring method prone to false alarms, resulting in a high error rate for abnormal alarms.

[0004] Application content

[0005] To address the aforementioned technical problems, this application aims to provide an anomaly monitoring method, apparatus, device, and storage medium. This solves the problem of high error rates in current monitoring methods, fully considers system characteristics when setting thresholds, improves the accuracy of anomaly alarm prompts, and ensures the monitoring efficiency of the system.

[0006] The technical solution of this application is implemented as follows:

[0007] Firstly, an anomaly monitoring method, the method comprising:

[0008] Obtain the feature parameters corresponding to the target monitoring indicators of the monitored object;

[0009] The target threshold is obtained by calculating the feature parameters.

[0010] Collect the first indicator value of the target monitoring indicator;

[0011] Based on the first indicator value and the target threshold, it is determined whether the monitored object has any abnormalities.

[0012] Optionally, obtaining the feature parameters corresponding to the target monitoring indicators of the monitored object includes:

[0013] The feature parameters are obtained by acquiring one or more of the complex parameters, related parameters, and historical parameters corresponding to the target monitoring indicator.

[0014] Optionally, the target threshold is calculated by calculating the feature parameters, including:

[0015] Obtain historical monitoring data;

[0016] The complex parameter, the correlation parameter and the history parameter are obtained by calculation using the historical monitoring data and a target model C=γ1C1+γ2C2+γ3C3, wherein C1 is a complex parameter model used to calculate the complex parameter, C2 is a correlation parameter model used to calculate the correlation parameter, C3 is a history parameter model used to calculate the history parameter, γ1 is a weight coefficient of C1, γ2 is a weight coefficient of C2 and γ3 is a weight coefficient of C3, and the characteristic parameter comprises the complex parameter, the correlation parameter and the history parameter.

[0017] Optionally, before the complex parameter, the correlation parameter and the history parameter are obtained by calculation using the historical monitoring data and the target model C=γ1C1+γ2C2+γ3C3, the method further comprises:

[0018] determining a number P of sub-monitoring objects included in the monitoring object a ;

[0019] counting, from the sub-monitoring objects, reference monitoring objects having a correlation relationship with an i-th monitoring index, wherein i=1, 2, …, n, n represents a total number of monitoring indexes included in the monitoring object, and n is an integer greater than 1;

[0020] counting a number P of sub-monitoring objects included in the reference monitoring object i and a number M of all functions included in the reference monitoring object i ;

[0021] determining a number N of functions in the reference monitoring object having a correlation relationship with the i-th monitoring index i ;

[0022] determining a complex parameter model C1=1 / (1+e a ), P i , M i and N i , wherein α is a variable.

[0023] Optionally, before the complex parameter, the correlation parameter and the history parameter are obtained by calculation using the historical monitoring data and the target model C=γ1C1+γ2C2+γ3C3, the method further comprises:

[0024] determining a number m of monitoring indexes having a correlation relationship with the target monitoring index;

[0025] determining a correlation parameter model C2=1 / (1+e -β·m ), based on m, wherein β is a variable.

[0026] ​Optionally, before calculating the complex parameters, correlation parameters, and historical parameters using the historical monitoring data and the target model C = γ1C1 + γ2C2 + γ3C3, the method further includes:

[0027] Count the number L types of abnormal events that occurred in the historical monitoring data;

[0028] When calculating the abnormal events that occurred in the historical monitoring data, the standard deviation ρ of the i-th monitoring indicator is... i ;

[0029] Based on L and ρ i Determine the historical parameter model

[0030] Optionally, γ1 = γ2 = γ3 = 1.

[0031] The complex parameters, correlation parameters, and historical parameters are obtained by using the historical monitoring data and the target model C = γ1C1 + γ2C2 + γ3C3, including:

[0032] From the historical monitoring data, obtain the historical indicator values ​​corresponding to the target monitoring indicators when the abnormal event occurred;

[0033] Based on the historical index values, a linear regression analysis was performed on the target model C = γ1C1 + γ2C2 + γ3C3 to calculate α and β;

[0034] Using the obtained α and the complex parameter model The complex parameters are obtained by performing calculations.

[0035] Using the obtained β and the correlation parameter model C2 = 1 / (1+e -β·m The correlation parameters are obtained by performing calculations.

[0036] Using L, ρ i and historical parameter model The historical parameters are obtained through calculation.

[0037] Optionally, calculating the target threshold from the feature parameters includes:

[0038] The target threshold is obtained by calculating the complex parameter, the associated parameter, and the historical parameter using C = C1 + C2 + C3.

[0039] Optionally, before obtaining the feature parameters corresponding to the target monitoring indicators of the monitored object, the method further includes:

[0040] Obtain the second indicator value of the target monitoring indicator;

[0041] if the second index value is greater than or equal to a preset threshold, switching the working mode from the first monitoring state to a second monitoring state; wherein the acquisition frequency of the target monitoring index in the second monitoring state is greater than the acquisition frequency of the target monitoring index in the first monitoring state.

[0042] Optionally, the method further comprises:

[0043] if the first index value is greater than or equal to the target threshold, determining that the monitoring object has an abnormality;

[0044] or, if the number of times that the first index value is greater than or equal to the target threshold within a unit time exceeds a preset number of times, determining that the monitoring object has an abnormality.

[0045] Optionally, after the working mode is switched from the first monitoring state to the second monitoring state if the second index value is greater than or equal to a preset threshold, the method further comprises:

[0046] if the first index value is less than the preset threshold or the number of times that the first index value is greater than or equal to the preset threshold within a limited time is less than a preset number of times, switching the working mode from the second monitoring state to the first monitoring state.

[0047] In a second aspect, an abnormality monitoring device is provided, which comprises a first acquisition unit, a calculation unit, an acquisition unit and a determination unit; wherein:

[0048] the first acquisition unit is configured to acquire a characteristic parameter corresponding to a target monitoring index of a monitoring object;

[0049] the calculation unit is configured to calculate the characteristic parameter to obtain a target threshold;

[0050] the acquisition unit is configured to acquire a first index value of the target monitoring index of the monitoring object;

[0051] the determination unit is configured to determine whether the monitoring object has an abnormality based on the first index value and the target threshold.

[0052] In a third aspect, an abnormality monitoring device is provided, which comprises a memory, a processor and a communication bus; wherein:

[0053] the communication bus is configured to realize the communication connection between the processor and the memory;

[0054] the processor is configured to execute an abnormality monitoring program stored in the memory to realize the following steps:

[0055] obtaining a feature parameter corresponding to a target monitoring index of a monitoring object;

[0056] performing calculation on the feature parameter to obtain a target threshold value;

[0057] collecting a first index value of the target monitoring index;

[0058] determining whether the monitoring object has an abnormality based on the first index value and the target threshold value.

[0059] In a fourth aspect, a storage medium storing one or more programs, which are executable by one or more processors to implement the steps of the abnormality monitoring method according to any one of the preceding aspects.

[0060] The abnormality monitoring method, device, equipment and storage medium provided by the embodiments of the present application obtain a feature parameter corresponding to a target monitoring index of a monitoring object, perform calculation on the feature parameter to obtain a target threshold value, then collect a first index value of the target monitoring index of the monitoring object, and determine whether the monitoring object has an abnormality based on the first index value and the target threshold value. In this way, the feature parameter representing the complex characteristics of the monitoring object is calculated to obtain a target threshold value, and the first index value obtained based on the target monitoring index of the monitoring object and the target threshold value are used to determine whether the monitoring object has an abnormality, which solves the problem that the threshold value set in the current monitoring method is only set by the user according to experience, resulting in a high error rate of abnormality alarm, and achieves setting of the threshold value by fully considering the characteristics of the system, improves the accuracy of abnormality alarm prompt, and ensures the monitoring efficiency of system monitoring. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 a flowchart of an abnormality monitoring method provided by an embodiment of the present application;

[0062] Figure 2 a flowchart of another abnormality monitoring method provided by an embodiment of the present application;

[0063] Figure 3 a flowchart of still another abnormality monitoring method provided by an embodiment of the present application;

[0064] Figure 4 a flowchart of an abnormality monitoring method provided by another embodiment of the present application;

[0065] Figure 5 a flowchart of another abnormality monitoring method provided by another embodiment of the present application;

[0066] Figure 6 a structural diagram of an abnormality monitoring device provided by an embodiment of the present application;

[0067] Figure 7 Another abnormality monitoring device provided by an embodiment of the present application is shown in the structure diagram.

[0068] Figure 8 Another abnormality monitoring device provided by an embodiment of the present application is shown in the structure diagram. DETAILED DESCRIPTION

[0069] It should be noted that "one", "another" and "yet another" mentioned in the description of the drawings are not limited to a certain embodiment. In some application scenarios, the embodiments in the present application can be combined arbitrarily without conflict.

[0070] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application.

[0071] An embodiment of the present application provides an abnormality monitoring method, referring to Figure 1 The method is applied to an abnormality monitoring device, and the method comprises the following steps:

[0072] Step 101: Obtain a characteristic parameter corresponding to a target monitoring index of a monitoring object.

[0073] In the embodiments of the present application, the monitoring object is an object monitored by the abnormality monitoring device, for example, an operating system or an application program running in the abnormality monitoring device. In some application scenarios, the monitoring object can also be another device independent of the abnormality monitoring device, for example, an industrial production process device, etc. At this time, the abnormality monitoring device can comprise a system composition structure of the monitoring object, specifically, a system composition structure diagram of the monitoring object, etc. so as to perform subsequent analysis and processing.

[0074] The characteristic parameter is used to represent the complex characteristics of the monitoring object. The complex characteristics of the monitoring object can be determined by the composition structure and / or the functional structure of the monitoring object. The corresponding characteristic parameter has a certain corresponding relationship with the target monitoring index of the monitoring object, for example, the characteristic parameter has a certain degree of influence on the target monitoring index. The characteristic parameter can be an empirical value set according to at least the target monitoring index of the monitoring object, and / or is obtained by calculating different characteristic parameter models.

[0075] Step 102: Calculate the characteristic parameter to obtain a target threshold value.

[0076] In the embodiments of the present application, the abnormality monitoring device performs calculation and analysis on the obtained characteristic parameter to obtain a target threshold value corresponding to the target monitoring index. The target threshold value is used to compare the index value of the target monitoring index when the monitoring object in the monitoring device is monitored, so as to determine whether the monitoring object is abnormal.

[0077] Step 103, collecting a first index value of the target monitoring index of the monitoring object.

[0078] In the embodiment of the present application, the abnormality monitoring device can collect the value of the target monitoring index according to a certain sampling period to obtain the first index value.

[0079] Step 104, determining whether the monitoring object has an abnormality based on the first index value and the target threshold value.

[0080] In the embodiment of the present application, the abnormality monitoring device judges and analyzes the first index value and the target threshold value, and determines whether the monitoring object has an abnormality according to the relationship between the first index value and the target threshold value. Further, in some application scenarios, when the monitoring object has an abnormality, the abnormality monitoring device can generate corresponding alarm prompt information, thereby realizing alarm prompting for the user.

[0081] The abnormality monitoring method provided by the embodiment of the present application obtains the feature parameter corresponding to the target monitoring index of the monitoring object, calculates the feature parameter to obtain the target threshold value, then collects the first index value of the target monitoring index of the monitoring object, and determines whether the monitoring object has an abnormality based on the first index value and the target threshold value. In this way, the feature parameter representing the complex characteristics of the monitoring object is calculated to obtain the target threshold value, and whether the monitoring object has an abnormality is determined based on the first index value collected for the target monitoring index of the monitoring object and the target threshold value, which solves the problem that the threshold value set in the current monitoring method is only set by the user according to experience, resulting in a high abnormality alarm error rate, realizes setting of the threshold value by fully considering the characteristics of the system, improves the accuracy of the abnormality alarm prompt, and ensures the monitoring efficiency of the system monitoring.

[0082] Based on the foregoing embodiment, the embodiment of the present application provides an abnormality monitoring method, which refers to FIG. 2. Figure 2 The method is applied to an abnormality monitoring device, and the method includes the following steps:

[0083] Step 201, obtaining any one or more of a complex parameter, an associated parameter and a historical parameter corresponding to a target monitoring index to obtain a feature parameter.

[0084] In the embodiment of the present application, the complex parameter of the monitoring object is determined by the complexity of the monitoring object. The relationship between the complex parameter of the monitoring object and the monitoring index of the monitoring object is that the more complex the monitoring object is, the larger the change range of the monitoring index of the monitoring object is, and the corresponding monitoring threshold values of different monitoring indexes have a large discrete type. The complexity of the monitoring object can be determined according to the component of the monitoring object and / or the function of the component of the monitoring object.

[0085] The correlation parameter of the target monitoring index of the monitoring object is a number of other monitoring indexes having a correlation relationship with the target monitoring index among all monitoring indexes of the monitoring object. The influence of the correlation parameter of the corresponding target monitoring index on the target threshold corresponding to the target monitoring index is that the more other monitoring indexes having a correlation relationship with the target monitoring index, the greater the discreteness of the target threshold corresponding to the target monitoring index. The correlation relationship between the monitoring index and other monitoring indexes is generally an influence relationship between the monitoring index and other monitoring indexes when the monitoring index and other monitoring indexes influence each other.

[0086] The history parameter of the target monitoring index of the monitoring object is that the higher the discrete degree between each monitoring index of the monitoring object when an abnormal event occurs in the historical monitoring data of the monitoring object, the greater the discreteness of the target threshold of the target monitoring index.

[0087] It should be noted that in the embodiments of the present application, the obtained feature parameters include the complexity parameter, the correlation parameter and the history parameter corresponding to the target monitoring index.

[0088] Step 202, calculating the feature parameters to obtain the target threshold.

[0089] In the embodiments of the present application, any one or more of the complexity parameter, the correlation parameter and the history parameter corresponding to the target monitoring index are calculated to obtain the target threshold. The specific calculation method may, for example, be weighted summation.

[0090] Step 203, collecting the first index value of the target monitoring index of the monitoring object.

[0091] In the embodiments of the present application, the abnormal monitoring device collects the value of the target monitoring index of the monitoring object according to a certain collection frequency to obtain the first index value.

[0092] Step 204, determining whether the monitoring object has an abnormality based on the first index value and the target threshold.

[0093] In the embodiments of the present application, the abnormal monitoring device judges the first index value and the target threshold to determine whether the monitoring object has an abnormality. If the first index value is greater than or equal to the target threshold, it is determined that the monitoring object has an abnormality. If the first index value is less than the target threshold, it is determined that the monitoring object has no abnormality.

[0094] It should be noted that the same steps and the same content in the present embodiment and other embodiments are described with reference to the descriptions in other embodiments, which will not be repeated here.

[0095] The abnormality monitoring method provided in the embodiments of the present application comprises the following steps: obtaining a characteristic parameter corresponding to a target monitoring index of a monitoring object, and calculating the characteristic parameter to obtain a target threshold value; then collecting a first index value of the target monitoring index of the monitoring object, and determining whether the monitoring object is abnormal based on the first index value and the target threshold value. In this way, the characteristic parameter representing the complex characteristics of the monitoring object is calculated to obtain the target threshold value, and the first index value obtained based on the target monitoring index of the monitoring object and the target threshold value are used to determine whether the monitoring object is abnormal, thereby solving the problem that the threshold value set in the current monitoring method is only set by the user according to experience, resulting in a high error rate of abnormality alarm, and achieving setting of the threshold value by fully considering the characteristics of the system, improving the accuracy of abnormality alarm and ensuring the monitoring efficiency of the system.

[0096] Based on the foregoing embodiments, the embodiments of the present application provide an abnormality monitoring method, as shown in Figure 3 The method is applied to an abnormality monitoring device, and the method comprises the following steps:

[0097] Step 301: Obtain historical monitoring data of a monitoring object.

[0098] In the embodiments of the present application, the monitoring object is taken as an example of a system, and the sub-monitoring objects of the monitoring object include the component structure and / or the component function of the monitoring object.

[0099] Step 302: Calculate using the historical monitoring data and a target model C=γ1C1+γ2C2+γ3C3 to obtain a complex parameter, a correlation parameter and a history parameter.

[0100] C1 is a complex parameter model used to calculate the complex parameter, C2 is a correlation parameter model used to calculate the correlation parameter, C3 is a history parameter model used to calculate the history parameter, γ1 is a weight coefficient of C1, γ2 is a weight coefficient of C2 and γ3 is a weight coefficient of C3, and the characteristic parameter comprises the complex parameter, the correlation parameter and the history parameter.

[0101] In the embodiments of the present application, the first weight coefficient γ1, the second weight coefficient γ2 and the third weight coefficient γ3 are specifically used to determine which one or which ones of the complex parameter, the correlation parameter and the history parameter are used to determine the target threshold value, that is, the values of the first weight coefficient, the second weight coefficient and the third weight coefficient can be 0 or 1.

[0102] Step 303: Calculate the characteristic parameter to obtain a target threshold value.

[0103] Step 304: Collect a first index value of the target monitoring index.

[0104] Step 305, determining whether the monitored object is abnormal based on the first index value and the target threshold value.

[0105] In other embodiments of the present application, step 305 can be implemented by step a11 or step a12:

[0106] Step a11, if the first index value is greater than or equal to the target threshold value, it is determined that the monitored object is abnormal.

[0107] Step a12, if the number of times that the first index value is greater than or equal to the target threshold value in a unit time period exceeds a preset number of times, it is determined that the monitored object is abnormal.

[0108] In embodiments of the present application, the unit time period can be an empirical value set according to experience, which can be changed in actual application scenarios.

[0109] In other embodiments of the present application, before the abnormality monitoring device executes step 302, it is further used to execute the following steps:

[0110] Step 306, determining the number P of sub-monitored objects included in the monitored object a .

[0111] In embodiments of the present application, determining the number of sub-monitored objects included in the monitored object refers to determining the number of all sub-monitored objects included in the monitored object, obtaining a fourth value. For example, the abnormality monitoring device determines the number of all sub-monitored objects included in the system, obtaining a fourth value, denoted as P a In some application scenarios, the sub-monitored object can be obtained by dividing the monitored object according to functions.

[0112] Step 307, from the sub-monitored objects, counting reference monitored objects having an association relationship with the i-th monitoring index.

[0113] Wherein, i = 1, 2, …, n, n represents the total number of monitoring indexes included in the monitored object, and n is an integer greater than 1.

[0114] In embodiments of the present application, the reference monitored object refers to a sub-monitored object that has an impact on each monitoring index.

[0115] Step 308, counting the number P of sub-monitored objects included in the reference monitored object i and the number M of all functions included in the reference monitored object i .

[0116] For example, taking a system including a total of n monitored objects as an example, where n is a positive integer, the number of sub-monitored objects included in the reference monitored object corresponding to the i-th monitoring index can be denoted as P iThe number of functions included in each reference monitoring object refers to the number of all functions included in all sub-monitoring objects included in each reference monitoring object. Assuming that the reference monitoring object corresponding to the i-th monitoring index includes three sub-monitoring objects E, F and G, then M i is the number of all functions included in the three sub-monitoring objects E, F and G.

[0117] Step 309, determining the number N of functions in the reference monitoring object having a correlation relationship with the i-th monitoring index i .

[0118] In the embodiment of the present application, from all functions included in the reference monitoring object corresponding to the i-th monitoring index, the number of functions having an influence on the i-th monitoring index is determined, denoted as N i .

[0119] Step 310, determining the complex parameter model C1=1 / (1+e a ) based on P i , M i and N i .

[0120] Wherein, α is a variable.

[0121] In the embodiment of the present application, the symbol ∑ in the complex parameter model C1=1 / (1+e is an accumulation symbol.

[0122] Step 311, determining the number m of monitoring indexes having a correlation relationship with the target monitoring index.

[0123] Step 312, determining the correlation parameter model C2=1 / (1+e -β·m ) based on m.

[0124] In the embodiment of the present application, the correlation parameter model can be denoted as C2=1 / (1+e -β·m ), wherein: e is Euler number.

[0125] Step 313, counting the type number L of abnormal events occurring in the historical monitoring data.

[0126] Step 314, calculating the standard deviation p i of the i-th monitoring index when the abnormal event occurring in the historical monitoring data.

[0127] Step 315, determining the historical parameter model C3=1 / (1+e i ) based on L and p

[0128] Correspondingly, in the embodiment of the present application, step 302 can be implemented by steps b11-b16:

[0129] Step b11: Determine γ1 = γ2 = γ3 = 1.

[0130] Step b12: Obtain the historical indicator values ​​corresponding to the target monitoring indicators when the abnormal event occurred from the historical monitoring data.

[0131] In this embodiment of the application, a certain amount of historical indicator values ​​corresponding to the target monitoring indicator when the abnormal event occurs are obtained from historical monitoring data.

[0132] Step b13: Based on historical index values, perform linear regression analysis on the target model C = γ1C1 + γ2C2 + γ3C3 to calculate α and β.

[0133] Step b14: Use the obtained α and complex parameter model Calculations are performed to obtain complex parameters.

[0134] Step b15: Using the obtained β and correlation parameter model C2 = 1 / (1+e -β·m The correlation parameters are obtained by performing calculations.

[0135] Step b16, using L, ρ i and historical parameter model Calculations are performed to obtain historical parameters.

[0136] Correspondingly, step 303 can be implemented by the following steps: using C = C1 + C2 + C3 to calculate the complex parameters, associated parameters, and historical parameters to obtain the target threshold.

[0137] In other embodiments of this application, reference is made to Figure 4 As shown, before executing step 301, the anomaly monitoring device also performs the following steps:

[0138] Step 316: Obtain the second indicator value of the target monitoring indicator.

[0139] In this embodiment of the application, when the abnormal monitoring device is in the first monitoring state, the index value of the target monitoring index is collected according to the first collection frequency to obtain the second index value.

[0140] Step 317: If the value of the second indicator is greater than or equal to the preset threshold, switch the working mode from the first monitoring state to the second monitoring state.

[0141] In the second monitoring state, the collection frequency of target monitoring indicators is greater than that in the first monitoring state.

[0142] In other embodiments of this application, reference is made to Figure 5 As shown, after executing step 305, the anomaly monitoring device also executes the following steps:

[0143] In step 318, if the first index value is less than the preset threshold value or the number of times that the first index value is greater than or equal to the preset threshold value is less than the preset number of times within the limited time, the working mode is switched from the second monitoring state to the first monitoring state.

[0144] In the embodiments of the present application, the limited time can be determined according to actual experience, and can be changed in actual application scenarios.

[0145] It should be noted that step 318 can also be executed after any one of steps 317, and the present disclosure does not limit the step.

[0146] It should be noted that the descriptions of the same steps and the same contents in the embodiments of the present application can refer to the descriptions in other embodiments, and the present disclosure does not limit the steps.

[0147] The abnormality monitoring method provided by the embodiments of the present application obtains the feature parameter corresponding to the target monitoring index of the monitoring object, calculates the feature parameter to obtain the target threshold value, then collects the first index value of the target monitoring index of the monitoring object, and determines whether the monitoring object has an abnormality based on the first index value and the target threshold value. In this way, the feature parameter representing the complex characteristics of the monitoring object is calculated to obtain the target threshold value, and the first index value obtained based on the target monitoring index of the monitoring object and the target threshold value are used to determine whether the monitoring object has an abnormality, which solves the problem that the threshold value set in the current monitoring method is only set by the user according to experience, resulting in a high error rate of abnormality alarm, and achieves setting the threshold value by fully considering the characteristics of the system, improves the accuracy of abnormality alarm prompt, and ensures the monitoring efficiency of the system monitoring.

[0148] Based on the foregoing embodiments, the embodiments of the present application provide an abnormality monitoring device, which can be applied to Figures 1 to 5 In the abnormality monitoring method provided by the corresponding embodiments, referring to Figure 6 As shown in the figure, the abnormality monitoring device 4 can include a first acquisition unit 41, a calculation unit 42, a collection unit 43, and a determination unit 44, wherein:

[0149] The first acquisition unit 41 is configured to obtain a feature parameter corresponding to a target monitoring index of a monitoring object.

[0150] The calculation unit 42 is configured to calculate the feature parameter to obtain a target threshold value.

[0151] The collection unit 43 is configured to collect a first index value of the target monitoring index of the monitoring object.

[0152] The determination unit 44 is configured to determine whether the monitoring object has an abnormality based on the first index value and the target threshold value.

[0153] In other embodiments of the present application, the first acquisition unit is specifically configured to:

[0154] Obtain any one or more of the complex parameter, the correlation parameter and the historical parameter corresponding to the target monitoring indicator, to obtain the feature parameter.

[0155] In other embodiments of the present application, the first acquisition unit comprises an acquisition module and a calculation module, wherein:

[0156] The acquisition module is configured to acquire historical monitoring data of the monitoring object;

[0157] The calculation module is configured to perform calculation using the historical monitoring data and a target model C=γ1C1+γ2C2+γ3C3 to obtain the complex parameter, the correlation parameter and the historical parameter, wherein C1 is a complex parameter model used to calculate the complex parameter, C2 is a correlation parameter model used to calculate the correlation parameter, C3 is a historical parameter model used to calculate the historical parameter, γ1 is a weight coefficient of C1, γ2 is a weight coefficient of C2 and γ3 is a weight coefficient of C3, and the feature parameter comprises the complex parameter, the correlation parameter and the historical parameter.

[0158] In other embodiments of the present application, the calculation module in the first acquisition unit further comprises a first determination module, a first statistical module and a second determination module, which are specifically configured to:

[0159] The first determination module is configured to determine the number P of sub-monitoring objects included in the monitoring object a ;

[0160] The first statistical module is configured to count, from the sub-monitoring objects, reference monitoring objects having a correlation relationship with the i-th monitoring indicator, wherein i=1, 2, …, n, n represents the total number of monitoring indicators included in the monitoring object, and n is an integer greater than 1;

[0161] The first statistical module is further configured to count the number P of sub-monitoring objects included in the reference monitoring object i and the number M of all functions included in the reference monitoring object i ;

[0162] The first determination module is further configured to determine the number N of functions in the reference monitoring object having a correlation relationship with the i-th monitoring indicator i ;

[0163] The second determination module is configured to determine the complex parameter model C1 based on P a , P i , M i and N i . wherein α is a variable.

[0164] In other embodiments of the present application, the first determining module and the second determining module are further specifically used for:

[0165] The first determining module is further used for determining the number m of monitoring indicators having a correlation relationship with the target monitoring indicator.

[0166] The second determining module is further used for determining, based on m, the correlation parameter model C2 = 1 / (1+e -β·m ), where β is a variable.

[0167] In other embodiments of the present application, the first determining module, the first statistical module and the second determining module are further specifically used for:

[0168] Statistically counting the type number L of abnormal events occurring in the historical monitoring data.

[0169] Calculating the standard deviation ρ i of the i-th monitoring indicator when the abnormal event occurs in the historical monitoring data; and i determining, based on L and ρ

[0170] In other embodiments of the present application, γ1 = γ2 = γ3 = 1,

[0171] The calculating module is specifically used for:

[0172] Obtaining, from the historical monitoring data, a historical indicator value corresponding to the target monitoring indicator when the abnormal event occurs;

[0173] Performing linear regression analysis on the target model C = γ1C1 + γ2C2 + γ3C3 based on the historical indicator value, to obtain α and β;

[0174] Using the obtained α and the complex parameter model C3 = α to perform calculation, to obtain the complex parameter;

[0175] Using the obtained β and the correlation parameter model C2 = 1 / (1+e -β·m ) to perform calculation, to obtain the correlation parameter;

[0176] Using L, ρ i and the historical parameter model C1 = L / ρ to perform calculation, to obtain the historical parameter.

[0177] In other embodiments of the present application, the calculating unit is specifically used for:

[0178] Using C = C1 + C2 + C3 to calculate the complex parameter, the correlation parameter and the historical parameter, to obtain the target threshold value.

[0179] ​In other embodiments of the present application, as shown in Figure 7 Before the first acquisition unit 41, the abnormality monitoring apparatus can further include a second acquisition unit 45 and a switching unit 46, wherein:

[0180] The second acquisition unit is configured to acquire a second index value of the target monitoring index.

[0181] The switching unit is configured to switch the working mode from the first monitoring state to a second monitoring state if the second index value is greater than or equal to a preset threshold value, wherein the collection frequency of the target monitoring index in the second monitoring state is greater than the collection frequency of the target monitoring index in the first monitoring state.

[0182] In other embodiments of the present application, the determination unit is specifically configured to:

[0183] If the first index value is greater than or equal to the target threshold value, it is determined that the monitored object has an abnormality.

[0184] Alternatively, if the number of times that the first index value is greater than or equal to the target threshold value within a unit time exceeds a preset number of times, it is determined that the monitored object has an abnormality.

[0185] In other embodiments of the present application, the switching unit is further configured to:

[0186] If it is detected that the first index value is less than the preset threshold value, or the number of times that the first index value is greater than or equal to the preset threshold value within a limited time is less than a preset number of times, the working mode is switched from the second monitoring state to the first monitoring state.

[0187] It should be noted that the specific implementation process of information interaction between the units and modules in the abnormality monitoring apparatus in the present embodiment can refer to the implementation process in the corresponding embodiment of the abnormality monitoring method provided in the present application, which will not be described here in detail. Figures 1 to 5 The implementation process in the corresponding embodiment of the abnormality monitoring method provided in the present application, which will not be described here in detail.

[0188] The abnormality monitoring apparatus provided in the embodiments of the present application acquires the characteristic parameter corresponding to the target monitoring index of the monitored object, calculates the characteristic parameter to obtain the target threshold value, and then acquires the first index value of the target monitoring index of the monitored object, and determines whether the monitored object has an abnormality based on the first index value and the target threshold value. In this way, the characteristic parameter representing the complex characteristics of the monitored object is calculated to obtain the target threshold value, and the first index value obtained based on the target monitoring index of the monitored object and the target threshold value are used to determine whether the monitored object has an abnormality, which solves the problem that the threshold value set in the current monitoring method is only set by the user according to experience, resulting in a high error rate of abnormality alarm, and achieves setting the threshold value by fully considering the characteristics of the system, improves the accuracy of abnormality alarm prompt, and ensures the monitoring efficiency of the system monitoring.

[0189] Based on the foregoing embodiments, the embodiments of the present application provide an anomaly monitoring device, which can be applied to Figures 1 to 5 The anomaly monitoring method provided by the corresponding embodiments refers to Figure 8 As shown in the figure, the anomaly monitoring device 5 can include a processor 51, a memory 52 and a communication bus 53, wherein:

[0190] The communication bus 53 is used to realize the communication connection between the processor 51 and the memory 52.

[0191] The processor 51 is used to execute the anomaly monitoring program stored in the memory 52 to realize the following steps:

[0192] Obtain the characteristic parameters corresponding to the target monitoring indicators of the monitoring object;

[0193] Calculate the characteristic parameters to obtain the target threshold value;

[0194] Collect the first indicator value of the target monitoring indicators of the monitoring object;

[0195] Determine whether the monitoring object has an anomaly based on the first indicator value and the target threshold value.

[0196] In other embodiments of the present application, the characteristic parameters corresponding to the target monitoring indicators of the monitoring object include:

[0197] Any one or more of the complex parameters, the correlation parameters and the historical parameters corresponding to the target monitoring indicators.

[0198] In other embodiments of the present application, the characteristic parameters corresponding to the target monitoring indicators of the monitoring object include the complex parameters, the correlation parameters and the historical parameters corresponding to the target monitoring indicators.

[0199] When the processor executes the characteristic parameters corresponding to the target monitoring indicators of the monitoring object, the following steps can be used to realize it:

[0200] Obtain the historical monitoring data of the monitoring object;

[0201] Use the historical monitoring data and the target model C=γ1C1+γ2C2+γ3C3 to calculate to obtain the complex parameters, the correlation parameters and the historical parameters, wherein C1 is a complex parameter model used to calculate the complex parameters, C2 is a correlation parameter model used to calculate the correlation parameters, C3 is a historical parameter model used to calculate the historical parameters, γ1 is the weight coefficient of C1, γ2 is the weight coefficient of C2 and γ3 is the weight coefficient of C3, and the characteristic parameters include the complex parameters, the correlation parameters and the historical parameters.

[0202] In other embodiments of the present application, the processor can also be used to execute the following steps to realize the determination of C1:

[0203] determining the number P of sub-monitoring objects included in the monitoring object a ;

[0204] from the sub-monitoring objects, counting reference monitoring objects having an association relationship with the i-th monitoring index, where i=1, 2, …, n, n represents the total number of monitoring indexes included in the monitoring object, and n is an integer greater than 1;

[0205] counting the number P of sub-monitoring objects included in the reference monitoring object i and the number M of all functions included in the reference monitoring object i ;

[0206] determining the number N of functions in the reference monitoring object having an association relationship with the i-th monitoring index i ;

[0207] determining a complexity parameter model based on P a , P i , M i and N i where α is a variable.

[0208] In other embodiments of the present application, the processor can also be used to perform the following steps to realize the determination of C2:

[0209] determining the number m of monitoring indexes having an association relationship with the target monitoring index;

[0210] determining an association parameter model C2=1 / (1+e -β·m ) based on m, where β is a variable.

[0211] In other embodiments of the present application, the processor can also be used to perform the following steps to realize the determination of C3:

[0212] counting the number L of types of abnormal events occurring in the historical monitoring data;

[0213] calculating the standard deviation ρ i of the i-th monitoring index when the abnormal event occurs in the historical monitoring data; and determining a history parameter model i based on L and ρ i

[0214] In other embodiments of the present application, γ1=γ2=γ3=1,

[0215] When the processor performs the steps to calculate the complexity parameter, the association parameter and the history parameter using the historical monitoring data and the target model C=γ1C1+γ2C2+γ3C3, the following steps can be used to realize:

[0216] Obtain the historical indicator values ​​corresponding to the target monitoring indicators when the abnormal event occurred from historical monitoring data;

[0217] Based on historical index values, linear regression analysis was performed on the target model C = γ1C1 + γ2C2 + γ3C3 to calculate α and β.

[0218] Using the obtained α and complex parameter model Calculations are performed to obtain the complex parameter C1;

[0219] The model C2 = 1 / (1+e) is obtained using β and correlation parameters. -β·m The correlation parameter C2 is obtained by performing calculations.

[0220] Using L, ρ i and historical parameter model Calculations were performed to obtain the historical parameter C3.

[0221] In other embodiments of this application, when the processor performs the step of calculating the feature parameters to obtain the target threshold, it can be achieved through the following steps:

[0222] The target threshold is obtained by calculating the complex parameter C1, the associated parameter C2, and the historical parameter C3 using the formula C = C1 + C2 + C3.

[0223] In other embodiments of this application, before the processor executes the step of obtaining the feature parameters corresponding to the target monitoring index of the monitored object, it is further configured to perform the following steps:

[0224] Obtain the second indicator value of the target monitoring indicator;

[0225] If the value of the second indicator is greater than or equal to the preset threshold, the working mode will be switched from the first monitoring state to the second monitoring state; wherein, the collection frequency of the target monitoring indicator in the second monitoring state is greater than the collection frequency of the target monitoring indicator in the first monitoring state.

[0226] In other embodiments of this application, when the processor executes steps based on a first indicator value and a target threshold to determine whether the monitored object is abnormal, it can also be used to execute the following steps:

[0227] If the value of the first indicator is greater than or equal to the target threshold, it is determined that the monitored object is abnormal;

[0228] Alternatively, if the number of times the first indicator value is greater than or equal to the target threshold exceeds a preset number within a unit of time, it is determined that the monitored object is abnormal.

[0229] In other embodiments of the present application, the processor, after switching the working mode from the first monitoring state to the second monitoring state if the second index value is greater than or equal to the preset threshold, can be further configured to perform the following steps:

[0230] If the first index value is less than the preset threshold or the number of times that the first index value is greater than or equal to the preset threshold is less than the preset number of times within the limited time, the working mode is switched from the second monitoring state to the first monitoring state.

[0231] It should be noted that the specific implementation process of information interaction between each component in the abnormality monitoring device in the present embodiment can refer to the implementation process of the abnormality monitoring method provided in the corresponding embodiment. Figures 1 to 5 The implementation process of the abnormality monitoring method provided in the corresponding embodiment will not be described here.

[0232] The abnormality monitoring device provided in the present application obtains a characteristic parameter corresponding to a target monitoring index of a monitoring object, calculates the characteristic parameter to obtain a target threshold, and then acquires a first index value of the target monitoring index of the monitoring object, and determines whether the monitoring object has an abnormality based on the first index value and the target threshold. In this way, the characteristic parameter representing the complex characteristics of the monitoring object is calculated to obtain the target threshold, and the first index value obtained based on the target monitoring index of the monitoring object and the target threshold are used to determine whether the monitoring object has an abnormality, which solves the problem that the threshold set in the current monitoring method is only set by the user according to experience, resulting in a high error rate of abnormality alarm, and achieves setting the threshold by fully considering the characteristics of the system, improves the accuracy of abnormality alarm prompt, and ensures the monitoring efficiency of the system monitoring.

[0233] Based on the foregoing embodiments, the embodiments of the present application provide a computer readable storage medium, referred to as a storage medium, which stores one or more programs executable by one or more processors to implement the steps of the method described with reference to the foregoing embodiments. Figures 1 to 5 The implementation process of the abnormality monitoring method provided in the corresponding embodiment will not be described here.

[0234] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can be in the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer usable program code.

[0235] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0236] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0237] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0238] The above description is only preferred embodiment of the present application, but not used to limit the protection range of the present application.

Claims

1. An anomaly monitoring method characterized by, The method comprises: obtaining a characteristic parameter corresponding to a target monitoring index of a monitoring object; calculating the characteristic parameter to obtain a target threshold value; collecting a first index value of the target monitoring index; determining whether the monitoring object is abnormal based on the first index value and the target threshold value; wherein the characteristic parameter corresponding to the target monitoring index of the monitoring object comprises a complex parameter, a correlation parameter and a historical parameter corresponding to the target monitoring index; obtaining a characteristic parameter corresponding to a target monitoring index of a monitoring object comprises: obtaining historical monitoring data of the monitoring object; adopting the historical monitoring data and a target model performing calculation to obtain the complex parameter, the correlation parameter and the historical parameter, wherein, a complex parameter model for calculating the complex parameter is denoted as , a correlation parameter model for calculating the correlation parameter is denoted as , a historical parameter model for calculating the historical parameter is denoted as , is a weight coefficient of , is a weight coefficient of and is a weight coefficient of , the characteristic parameter includes the complex parameter, the correlation parameter and the historical parameter, is a number of sub-monitoring objects included in the monitoring object, is a number of sub-monitoring objects included in a reference monitoring object, is a number of all functions included in the reference monitoring object, is a number of functions in the reference monitoring object having a correlation relationship with the i th monitoring index, m is a number of monitoring indexes having a correlation relationship with the target monitoring index, and L is a type number of abnormal events occurring in the historical monitoring data, is a standard deviation of the i th monitoring index when an abnormal event occurs in the historical monitoring data, and α and β are variables.

2. The method of claim 1, wherein, the determination method of C1 comprises: determining a number of sub-monitoring objects included in the monitoring object ; from the sub-monitoring object, the reference monitoring object having an association relationship with the i-th monitoring index is counted, wherein i=1, 2, …, n, n represents the total number of monitoring indexes included in the monitoring object, and n is an integer greater than 1; counting the number of sub-monitoring objects included in the reference monitoring object and the number of all functions included in the reference monitoring object ; determining the number of functions in the reference monitoring object that have a correlation relationship with the ith monitoring indicator ; Based on , , and , a complex parameter model is determined, where α is a variable.

3. The method of claim 2, wherein, the determination method of C2 comprises: determining the number m of monitoring indexes having an association relationship with the target monitoring index; determining a correlation parameter model based on m where β is a variable.

4. The method of claim 3, wherein, the determination method of C3 comprises: counting the type number L of abnormal events occurring in the historical monitoring data; a standard deviation of the ith monitoring indicator when an abnormal event occurs in the historical monitoring data ; Based on L and , determine a historical parameter model .

5. The method of claim 4, wherein, = = =1； using the historical monitoring data and the target model performing calculations to obtain the complex parameters, the correlation parameters, and the historical parameters, including: obtaining a historical index value corresponding to the target monitoring index when an abnormal event occurs from the historical monitoring data; Based on the historical index values, the target model is subjected to linear regression analysis to calculate α and β; using the obtained alpha and the complex parameter model performing a calculation to obtain the complex parameter; using the obtained β and the correlation parameter model performing a calculation to obtain the correlation parameter; L, and the historical parameter model performing a calculation to obtain the historical parameter.

6. The method of claim 5, wherein, the calculation of the characteristic parameter to obtain a target threshold value comprises: Adopting The complex parameter, the correlation parameter and the history parameter are calculated to obtain the target threshold.

7. The method of claim 1, wherein, before the obtaining of the characteristic parameter corresponding to the target monitoring index of the monitoring object, the method further comprises: obtaining a second index value of the target monitoring index; if the second index value is greater than or equal to a preset threshold value, switching the working mode from the first monitoring state to the second monitoring state; wherein the collection frequency of the target monitoring index in the second monitoring state is greater than the collection frequency of the target monitoring index in the first monitoring state.

8. The method of claim 1, wherein, the determination of whether the monitoring object is abnormal based on the first index value and the target threshold value comprises: if the first index value is greater than or equal to the target threshold value, it is determined that the monitoring object is abnormal; or, if the number of times that the first index value is greater than or equal to the target threshold value in a unit time exceeds a preset number of times, it is determined that the monitoring object is abnormal.

9. The method of claim 7, wherein, after the switching of the working mode from the first monitoring state to the second monitoring state if the second index value is greater than or equal to a preset threshold value, the method further comprises: if the first index value is less than the preset threshold value or the number of times that the first index value is greater than or equal to the preset threshold value is less than a preset number of times within a limited time, the working mode is switched from the second monitoring state to the first monitoring state.

10. An anomaly monitoring apparatus characterized by comprising: The device comprises a first acquisition unit, a calculation unit, a collection unit and a determination unit; wherein: the first acquisition unit is used to obtain a characteristic parameter corresponding to a target monitoring index of a monitoring object; the calculation unit is used to calculate the characteristic parameter to obtain a target threshold value; the collection unit is used to collect a first index value of the target monitoring index of the monitoring object; the determination unit is used to determine whether the monitoring object is abnormal based on the first index value and the target threshold value; The feature parameters corresponding to the target monitoring indicators of the monitored object include: complex parameters, correlation parameters, and historical parameters corresponding to the target monitoring indicators. Specifically, the determining unit is used to acquire historical monitoring data of the monitored object; and to use the historical monitoring data and the target model. Calculations are performed to obtain the complex parameters, the correlation parameters, and the historical parameters, wherein, The complex parameter model used to calculate the complex parameters is denoted as... , The correlation parameter model used to calculate the correlation parameters is denoted as... , The historical parameter model used to calculate the historical parameters is denoted as . , for Weighting coefficients for Weighting coefficients and for The weighting coefficients, wherein the feature parameters include the complex parameters, the correlation parameters, and the historical parameters. The number of sub-monitoring objects included in the monitored object. For reference, the number of sub-monitoring objects included in the monitored object, The number of all functions included in the reference monitoring object. Let m be the number of functions in the reference monitoring object that are associated with the i-th monitoring indicator, m be the number of monitoring indicators that are associated with the target monitoring indicator, and L be the number of types of abnormal events that occurred in the historical monitoring data. When an abnormal event occurs in the historical monitoring data, the standard deviation of the i-th monitoring indicator is given, where α and β are variables.

11. An anomaly monitoring device, characterized by, the device comprises a memory, a processor and a communication bus; wherein: The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the abnormality monitoring program stored in the memory to realize the following steps: obtaining a characteristic parameter corresponding to a target monitoring index of a monitoring object; calculating the characteristic parameter to obtain a target threshold value; collecting a first index value of the target monitoring index; determining whether the monitoring object is abnormal based on the first index value and the target threshold value; The characteristic parameter corresponding to the target monitoring index of the monitoring object includes a complex parameter, a correlation parameter and a historical parameter corresponding to the target monitoring index. Obtaining a characteristic parameter corresponding to a target monitoring index of a monitoring object includes: obtaining historical monitoring data of the monitoring object; adopting the historical monitoring data and a target model performing calculation to obtain the complex parameter, the correlation parameter and the historical parameter, wherein, a complex parameter model for calculating the complex parameter is denoted as , a correlation parameter model for calculating the correlation parameter is denoted as , a historical parameter model for calculating the historical parameter is denoted as , is a weight coefficient of , is a weight coefficient of and is a weight coefficient of , the feature parameter includes the complex parameter, the correlation parameter and the historical parameter, is a number of sub-monitoring objects included in the monitoring object, is a number of sub-monitoring objects included in a reference monitoring object, is a number of all functions included in the reference monitoring object, is a number of functions in the reference monitoring object having a correlation relationship with the i th monitoring index, m is a number of monitoring indexes having a correlation relationship with the target monitoring index, and L is a number of types of abnormal events occurring in the historical monitoring data, is a standard deviation of the i th monitoring index when an abnormal event occurs in the historical monitoring data, and α and β are variables.

12. A storage medium, characterized by The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize the steps of the abnormality monitoring method in any one of claims 1 to 9.

Images