Model-based monitoring data display method, device, equipment and storage medium

Abstract

The present application relates to the field of artificial intelligence technology, and provides a model-based monitoring data display method, device, computer equipment and storage medium, the method comprising: responding to a user's request to view monitoring data, and verifying the user; if the verification is passed, establishing a connection between the called input module and each monitoring tool, and obtaining monitoring data from the monitoring tool based on the input module; determining a target abnormal prediction model from a plurality of abnormal prediction models generated by pre-training; performing abnormal analysis on each monitoring data based on the target abnormal prediction model to obtain a corresponding abnormal analysis result; annotating the status of each monitoring data based on the abnormal analysis result to obtain annotated monitoring data; and displaying the annotated monitoring data through a preset dashboard. The present application can improve the efficiency of obtaining and organizing monitoring data and the processing efficiency of abnormal analysis. The present application can also be applied to the field of blockchain, and the above-mentioned monitoring data can be stored on the blockchain.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and specifically to a model-based monitoring data display method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of network information technology, more and more businesses need to rely on business systems to handle, such as transfer business, payment business, and fee payment business. Usually, in order to ensure the normal operation of the business system, it is necessary to monitor certain indicator data of the business in order to promptly discover abnormal situations in the business. At present, for different business systems, operation and maintenance personnel usually need to use different monitoring tools to monitor the indicator data of different business systems accordingly to obtain monitoring data of different business systems. After obtaining the monitoring data of different business systems, various monitoring data must be manually analyzed and sorted for abnormalities to generate corresponding sorted data. This monitoring data processing method has a low degree of automation, low processing efficiency, and lacks intelligence, and it is difficult to meet people's growing high requirements for business system monitoring. Summary of the invention

[0003] The main purpose of this application is to provide a model-based monitoring data display method, device, computer equipment and storage medium, aiming to solve the technical problems of low automation, low processing efficiency and lack of intelligence in existing monitoring data processing methods.

[0004] The present application proposes a monitoring data display method based on a model, the method comprising the steps of:

[0005] If a monitoring data viewing request from a user is received, respond to the monitoring data viewing request and perform identity authentication and authority verification on the user based on the user information, a preset user authority data table, an operation authority score table, and standard posture information; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information;

[0006] If both the identity authentication and the permission authentication are passed, a connection is established between the called input module and each monitoring tool according to a preset rule, and corresponding monitoring data is obtained from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name;

[0007] Acquire multiple anomaly prediction models generated by pre-training, and determine a target anomaly prediction model from the anomaly prediction models; wherein each of the anomaly prediction models is generated by training according to a respective different training sample set, and each of the training sample sets includes a number of monitoring data samples and a category label corresponding to the monitoring data sample;

[0008] Performing anomaly analysis on each of the monitoring data based on the target anomaly prediction model to obtain an anomaly analysis result corresponding to each of the monitoring data;

[0009] Based on the abnormal analysis result, each of the monitoring data is marked with a corresponding state to obtain the marked monitoring data;

[0010] The annotated monitoring data is displayed through a preset dashboard.

[0011] Optionally, the step of performing identity authentication and authority verification processing on the user based on the user information, a preset user authority data table, an operation authority score table and standard posture information includes:

[0012] Determine whether the preset user authority data table stores designated user information that is the same as the user information;

[0013] If the designated user information is stored, query the permission validity period information corresponding to the designated user information from the user permission data table, and determine whether the current time is within the time interval corresponding to the permission validity period information;

[0014] If it is within the time interval corresponding to the permission validity period information, query the permission score corresponding to the specified user information from the user permission data table;

[0015] Querying the viewing authority score interval corresponding to the business operation of viewing the monitoring data from the operation authority score table;

[0016] Determining whether the permission score is within the viewing permission score range;

[0017] If the user is within the viewing permission score range, dynamic prompt information is displayed on the current interface, and gesture information input by the user based on the dynamic prompt information is obtained; wherein the gesture information includes hand movements and facial movements;

[0018] Determining whether the hand motion is the same as a pre-stored standard hand motion corresponding to the user information;

[0019] If the hand movement is the same as the standard hand movement, determining whether the facial movement is the same as a pre-stored standard facial movement corresponding to the user information;

[0020] If the facial motion information is the same as the standard facial motion information, it is determined that both the identity verification and the authority verification are passed; otherwise, it is determined that both the identity verification and the authority verification are not passed.

[0021] Optionally, the step of establishing a connection between the called input module and each monitoring tool according to a preset rule includes:

[0022] Acquire a product type of a designated monitoring tool based on the name of the monitoring tool; wherein the product type includes at least a first type, a second type, and a third type, and the designated monitoring tool is any one of all the monitoring tools;

[0023] If the product type is the first type, establishing a connection between the input module and the designated monitoring tool based on a first connection method corresponding to the first type;

[0024] If the product type is the second type, establishing a connection between the input module and the designated monitoring tool based on a second connection method corresponding to the second type;

[0025] If the product type is the third type, a connection is established between the input module and the designated monitoring tool based on a third connection method corresponding to the third type.

[0026] Optionally, the step of determining a target anomaly prediction model from the anomaly prediction models includes:

[0027] Obtain a preset test sample set;

[0028] Based on the test sample set, generating a comprehensive evaluation score for each of the abnormality prediction models according to a preset calculation rule;

[0029] Filter out a first abnormality prediction model whose comprehensive evaluation score is greater than a preset score threshold from all the abnormality prediction models;

[0030] Generate a predicted processing time of each of the first abnormality prediction models based on the test sample set;

[0031] Selecting a second abnormality prediction model with the shortest prediction processing time from the first abnormality prediction models;

[0032] The second abnormality prediction model is used as the target abnormality prediction model.

[0033] Optionally, the step of generating a comprehensive evaluation score of each of the abnormality prediction models based on the test sample set according to a preset calculation rule includes:

[0034] Inputting the test sample set into a third abnormality prediction model, and calculating the accuracy of the third abnormality prediction model; wherein the third abnormality prediction model is any one of all the abnormality prediction models;

[0035] Inputting the test sample set into a third anomaly prediction model, and calculating and generating a recall rate of the third anomaly prediction model;

[0036] Obtaining a first weight corresponding to the precision rate, and obtaining a second weight corresponding to the recall rate;

[0037] calculating a first ratio between the first weight and the second weight;

[0038] Based on the precision, the recall and the first ratio, a preset calculation formula is called to generate a comprehensive evaluation score of the third abnormality prediction model.

[0039] Optionally, the step of generating the predicted processing time of each of the first abnormality prediction models based on the test sample set includes:

[0040] Acquire the test sample set; wherein the test sample set includes a plurality of test sample data;

[0041] When the fourth prediction model obtains each of the test sample data, the processing time of the prediction results output by the fourth prediction model corresponding to each of the test sample data is counted respectively; wherein the fourth prediction model is any one of all the first abnormality prediction models;

[0042] Eliminate the first processing time with the largest value and the second processing time with the smallest value from all the processing times to obtain a corresponding third processing time;

[0043] Calculating a sum of all the third processing times and obtaining the number of all the third processing times;

[0044] calculating a second ratio between the sum and the amount;

[0045] The second ratio is used as the prediction processing time of the fourth prediction model.

[0046] Optionally, before the step of obtaining a plurality of pre-trained abnormality prediction models, the following steps are included:

[0047] Obtain a preset number of training sample sets, and randomly select a specified training sample set from the training sample sets; wherein the specified training sample set is any sample set among all the training sample sets, and the specified training sample set includes a number of specified monitoring data samples and a specified category label corresponding to the specified monitoring data sample;

[0048] The preset machine learning model is trained by using the specified monitoring data samples and the specified category labels to obtain a corresponding initial anomaly prediction model;

[0049] Obtaining a preset verification sample set, and performing an accuracy test on the initial abnormality prediction model based on the verification sample set to obtain a corresponding prediction accuracy rate;

[0050] Determining whether the prediction accuracy is greater than a preset accuracy threshold;

[0051] If yes, the initial anomaly prediction model is used as the anomaly prediction model corresponding to the specified training sample set.

[0052] The present application also provides a monitoring data display device based on a model, comprising:

[0053] A verification module, for responding to a monitoring data viewing request from a user, and performing identity authentication and authority verification on the user based on user information, a preset user authority data table, an operation authority score table, and standard posture information, if the monitoring data viewing request is received; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information;

[0054] A connection module, used for establishing a connection between the called input module and each monitoring tool according to a preset rule if both the identity verification and the authority verification are passed, and obtaining corresponding monitoring data from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name;

[0055] A first determination module is used to obtain a plurality of abnormality prediction models generated by pre-training, and determine a target abnormality prediction model from the abnormality prediction models; wherein each of the abnormality prediction models is generated by training according to a respective different training sample set, and each of the training sample sets includes a plurality of monitoring data samples and a category label corresponding to the monitoring data sample;

[0056] An analysis module, used for performing an anomaly analysis on each of the monitoring data based on the target anomaly prediction model to obtain an anomaly analysis result corresponding to each of the monitoring data;

[0057] A labeling module, used for labeling the corresponding status of each monitoring data based on the abnormal analysis result to obtain the labeled monitoring data;

[0058] The display module is used to display the annotated monitoring data through a preset dashboard.

[0059] The present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0060] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0061] The model-based monitoring data display method, device, computer equipment and storage medium provided in this application have the following beneficial effects:

[0062] The model-based monitoring data display method, device, computer equipment and storage medium provided in the present application, after receiving the user's monitoring data viewing request and completing the verification process for the user, will first establish a connection between the preset input module and each monitoring tool, and obtain the corresponding monitoring data from the monitoring tool based on the input module, and then use the target abnormality prediction model determined from the multiple abnormality prediction models generated by pre-training to perform abnormal analysis on each of the monitoring data to obtain the abnormal analysis results corresponding to each of the monitoring data, and then perform corresponding state annotation on each of the monitoring data based on the abnormal analysis results to obtain the annotated monitoring data, and finally display the annotated monitoring data through a preset dashboard. Through the use of the input module and the abnormality prediction model, the present application can realize the acquisition of monitoring data corresponding to the monitoring tool in an automated manner, and automatically perform abnormal analysis and corresponding state annotation on the obtained monitoring data, which greatly reduces the manual workload, effectively improves the efficiency of monitoring data acquisition and sorting, improves the processing efficiency of abnormal analysis of monitoring data, and improves the convenience and intelligence of monitoring data display. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flowchart of a monitoring data display method based on a model according to an embodiment of the present application;

[0064] Figure 2 is a structural schematic diagram of a monitoring data display device based on a model according to an embodiment of the present application;

[0065] Figure 3 It is a schematic diagram of the structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0066] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. Basic artificial intelligence technologies include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. Artificial intelligence software technology includes computer vision technology, robotics, biometrics, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0067] Reference Figure 1 , a monitoring data display method based on a model in an embodiment of the present application includes:

[0068] S10: If a monitoring data viewing request from a user is received, respond to the monitoring data viewing request and perform identity authentication and authority verification on the user based on user information, a preset user authority data table, an operation authority score table, and standard posture information; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information;

[0069] S20: If both the identity verification and the authority verification are passed, a connection between the called input module and each monitoring tool is established according to a preset rule, and corresponding monitoring data is obtained from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name;

[0070] S30: Acquire multiple anomaly prediction models generated by pre-training, and determine a target anomaly prediction model from the anomaly prediction models; wherein each of the anomaly prediction models is generated by training according to a different training sample set, and each of the training sample sets includes a number of monitoring data samples and a category label corresponding to the monitoring data sample;

[0071] S40: performing an abnormality analysis on each of the monitoring data based on the target abnormality prediction model to obtain an abnormality analysis result corresponding to each of the monitoring data;

[0072] S50: marking the corresponding status of each monitoring data based on the abnormal analysis result to obtain the marked monitoring data;

[0073] S60: Displaying the annotated monitoring data through a preset dashboard.

[0074] As described in the above steps S10 to S60, the execution subject of the embodiment of the method is a model-based monitoring data display device. In practical applications, the above model-based monitoring data display device can be implemented by a virtual device, such as software code, or by a physical device with relevant execution code written or integrated, and can interact with the user through a keyboard, mouse, remote control, touchpad or voice control device. The model-based monitoring data display device in this embodiment can effectively improve the efficiency of monitoring data acquisition and sorting, improve the processing efficiency of abnormal analysis of monitoring data, and intelligently and conveniently realize the visual display of monitoring data. Specifically, if a user's monitoring data viewing request is received, the monitoring data viewing request is responded to, and the user is authenticated and authenticated based on user information, a preset user authority data table, an operation authority score table and standard posture information. Among them, the monitoring data viewing request is a request input by the user for viewing the monitoring data collected by the relevant monitoring tool. The monitoring data viewing request carries the monitoring tool name and the user information. The relevant monitoring tool can be found according to the monitoring tool name. The user information may include user name or user ID information. In addition, the specific implementation process of user verification will be further described in subsequent specific embodiments and will not be repeated here.

[0075] If both identity authentication and permission verification are passed, a connection between the called input module and each monitoring tool is established according to the preset rules, and corresponding monitoring data is obtained from the monitoring tool based on the input module. Wherein, the monitoring tool has a corresponding relationship with the monitoring tool name. Wherein, the monitoring data obtained from the monitoring tool through the input module may at least include the following data: monitoring source, monitoring status, monitoring tool name, monitoring category, and update time. In addition, the specific implementation process of establishing the connection between the called input module and each monitoring tool according to the preset rules will be further described in the subsequent specific embodiments, which will not be repeated here. Then obtain multiple abnormal prediction models generated by pre-training, and determine the target abnormal prediction model from the abnormal prediction model. Wherein, each of the abnormal prediction models is generated by training according to different training sample sets, and each of the training sample sets includes several monitoring data samples and category labels corresponding to the monitoring data samples. In addition, the training generation process of the abnormal prediction model and the determination process of the target abnormal prediction model will be further described in the subsequent specific embodiments.

[0076] Afterwards, an abnormal analysis is performed on each of the monitoring data based on the target abnormal prediction model to obtain an abnormal analysis result corresponding to each of the monitoring data. Among them, the abnormal analysis result includes data without abnormality and data with abnormality. Performing an abnormal analysis on each of the monitoring data based on the target abnormal prediction model means that the obtained monitoring data is input into the target abnormal prediction model, and the abnormal analysis result corresponding to the monitoring data is output through the target abnormal prediction model. Specifically, the target abnormal prediction model is a random forest model. After the monitoring data is input into the target abnormal prediction model, each CART decision tree contained in the target abnormal prediction model will classify the monitoring data to output the corresponding prediction classification result. It will first start to judge from the root node of the current CART decision tree, and then traverse the entire CART decision tree to make a prediction classification result for the monitoring data. By analogy, the next CART decision tree is selected to repeat the same judgment process until all CART decision trees in the target abnormal prediction model output the prediction classification result. Finally, the random forest uses the principle of minority obeys majority to take the prediction classification result of the largest number of votes as the abnormal analysis result corresponding to the monitoring data. Subsequently, the corresponding status of each monitoring data is annotated based on the abnormal analysis result to obtain the annotated monitoring data. If the abnormal analysis result of the monitoring data is that there is no abnormality in the data, the monitoring data can be annotated in green to identify the monitoring data as normal data through the green annotation, and if the abnormal analysis result of the monitoring data is that there is an abnormality in the data, the monitoring data can be annotated in red to identify the monitoring data as abnormal data through the red annotation. By annotating the abnormal data with respect to the abnormal status, the user can clearly view the abnormal status of the monitoring data, thereby improving the user's experience.

[0077] Finally, the annotated monitoring data is displayed through a preset kanban. After the annotated monitoring data is obtained, the annotated monitoring data can be stored in a database to complete the safe storage of the data. In addition, when the annotated monitoring data is displayed through a preset kanban, the kanban can be divided into a plurality of areas corresponding to the monitoring tools, and there is a one-to-one correspondence between the areas and the monitoring tools, and then the corresponding monitoring data is displayed in each area, so as to improve the intelligence and standardization of data display and improve the user experience. Specifically, the number of monitoring tools and the importance score of each monitoring tool can be obtained first. The importance score refers to the importance of the data that the monitoring tool needs to monitor, and the importance score of each monitoring tool can be pre-set according to actual needs. Then, according to the number of monitoring data, the kanban is divided into a plurality of display areas of the same number, and the area of ​​each display area is different. According to the importance score of each monitoring tool, the area of ​​each display area is determined, and the larger the importance score, the larger the area of ​​the display area. And the monitoring data collected by the monitoring tool is displayed in the corresponding display area according to the importance score, that is, the monitoring data of the monitoring tool with the largest importance score will be displayed in the display area with the largest area, and the monitoring data of the monitoring tool with the second largest importance score will be displayed in the display area with the second largest area, and so on, until the display of all monitoring data is completed. Among them, multiple layouts of the display area of ​​the kanban board can also be pre-set, and then multiple designated layouts matching the number of monitoring tools can be screened out from all layouts, and then the selection information of the multiple designated layouts can be displayed to the user, so that the user can select the target layout required by the user for display, or the layout most commonly used or most recently used by the user can be selected from the user's layout selection record as the target layout for this time. After determining the target layout, the monitoring data is displayed on the kanban board based on the target layout. The existing data display adopts fixed information display, and will not be visually prioritized according to the importance of the data. The data display lacks intelligence, and the user cannot check important data in time, and the user experience is not good. In response to the problems existing in the above-mentioned data display method, after obtaining the monitoring data through various monitoring tools, a matching layout will be set according to the number of monitoring tools and the importance of each monitoring data. In the dashboard, a large display area will be set for high-importance monitoring data, and a small display area will be set for low-importance monitoring data. This will help users to view more important data first, making data push display more intelligent and more in line with user needs.

[0078] Through the use of the input module and the anomaly prediction model, this embodiment can realize the acquisition of monitoring data corresponding to the monitoring tool in an automated manner, as well as automatic anomaly analysis and corresponding status labeling of the obtained monitoring data, which greatly reduces the manual workload, effectively improves the efficiency of monitoring data acquisition and organization, improves the processing efficiency of anomaly analysis of monitoring data, and improves the convenience and intelligence of monitoring data display.

[0079] Furthermore, in one embodiment of the present application, the above step S10 includes:

[0080] S100: Determine whether the preset user authority data table stores designated user information that is the same as the user information;

[0081] S101: If the designated user information is stored, query the permission validity period information corresponding to the designated user information from the user permission data table, and determine whether the current time is within the time interval corresponding to the permission validity period information;

[0082] S102: If the time interval is within the time interval corresponding to the permission validity period information, query the permission score corresponding to the specified user information from the user permission data table;

[0083] S103: Querying the viewing authority score interval corresponding to the business operation of viewing the monitoring data from the operation authority score table;

[0084] S104: Determine whether the authority score is within the viewing authority score range;

[0085] S105: If the user is within the viewing permission score range, display dynamic prompt information on the current interface, and obtain gesture information input by the user based on the dynamic prompt information; wherein the gesture information includes hand movements and facial movements;

[0086] S106: determining whether the hand motion is the same as a pre-stored standard hand motion corresponding to the user information;

[0087] S107: If the hand movement is the same as the standard hand movement, determining whether the facial movement is the same as a pre-stored standard facial movement corresponding to the user information;

[0088] S108: If the facial motion information is the same as the standard facial motion information, it is determined that both the identity verification and the authority verification are passed; otherwise, it is determined that both the identity verification and the authority verification are not passed.

[0089] As described in the above steps S100 to S108, the step of performing identity authentication and authority verification on the user based on the user information, the preset user authority data table, the operation authority score table and the standard posture information may specifically include: firstly, determining whether the preset user authority data table stores the designated user information identical to the user information. Wherein, the user authority data table is a first data table pre-created to record legal user information, the authority score corresponding to each legal user information, and the authority validity period information corresponding to the authority score of each legal user. If so, query the authority validity period information corresponding to the designated user information from the user authority data table, and determine whether the current time is within the time interval corresponding to the authority validity period information. Wherein, the authority validity period information is information corresponding to the time limit of the user's authority score. For example, it can be stipulated that a user of a certain identity has certain permissions within a certain time period, or it can be stipulated that a user of a certain identity has a certain time length for using a certain permission. In addition, the purpose of verifying the current time is to determine the validity period of the current user's authority score. If the current time is within the time interval corresponding to the authority validity period information, it indicates that the user's authority score is still in a valid state. If the current time is not within the time interval corresponding to the permission validity period information, it indicates that the user's permission score is currently in an invalid state. If so, query the permission score corresponding to the specified user information from the user permission data table. And query the viewing permission score interval corresponding to the business operation of viewing monitoring data from the operation permission score table. Among them, the operation permission score table is a pre-created second data table that records various business operations and permission score intervals corresponding to various business operations. Then determine whether the permission score is within the viewing permission score interval. If so, display dynamic prompt information on the current interface, and obtain the posture information input by the user based on the dynamic prompt information. Among them, the posture information includes hand movements and facial movements. The dynamic prompt information is used to prompt the user to enter corresponding posture information, such as blinking, closing eyes, pursing lips, nodding and other information. In addition, the standard posture information may include standard hand movement information and standard facial movement information. The standard facial movement information may include standard blinking information and standard mouth movement. The standard blinking information may be composed of eye texture features, eyelid dynamic features, eyeball display area features, etc. The standard mouth information may be composed of dynamic curvature of the mouth corners, muscle texture dynamic features, etc. The standard hand movement information is a specific hand movement preset by the user corresponding to the user information. Then, it is determined whether the hand movement is the same as the pre-stored standard hand movement corresponding to the user information. Among them, it can be determined whether the above hand movement information meets the verification standard based on the standard hand movement information to determine whether the hand movement information is the same as the standard hand movement information.If so, it is determined whether the facial action is the same as the pre-stored standard facial action corresponding to the user information. Wherein, it can be determined whether the facial action information meets the verification standard based on the standard facial action information to determine whether the facial action information is the same as the standard facial action information. If so, it is determined that both the identity authentication and the authority authentication are passed, otherwise it is determined that both the identity authentication and the authority authentication are not passed. In this embodiment, after receiving the user's monitoring data viewing request, the user will first be subject to authority verification and identity authentication processing, that is, the user's authority score and authority validity period information are obtained by querying the user authority data table, and the viewing authority score interval of the business operation corresponding to the viewing monitoring data is queried through the operation authority score table, and then the authority score is compared with the viewing authority score interval, and it is determined whether the current time is within the time interval corresponding to the authority validity period information, and the user is subjected to identity authentication processing on the posture information, so as to complete the user's verification processing through multiple verification methods, thereby improving the accuracy of the verification processing. Only when the user has passed all the verifications will further responses be made to the monitoring data viewing requests entered by the user. This can effectively avoid providing monitoring data viewing services to illegal users or unauthorized users, effectively ensure the security of monitoring data, and improve the processing security of monitoring data viewing and display.

[0090] Furthermore, in one embodiment of the present application, the above step S20 includes:

[0091] S200: Acquire a product type of a designated monitoring tool based on the name of the monitoring tool; wherein the product type includes at least a first type, a second type, and a third type, and the designated monitoring tool is any one of all the monitoring tools;

[0092] S201: If the product type is the first type, establishing a connection between the input module and the designated monitoring tool based on a first connection method corresponding to the first type;

[0093] S202: If the product type is the second type, establishing a connection between the input module and the designated monitoring tool based on a second connection method corresponding to the second type;

[0094] S203: If the product type is the third type, establishing a connection between the input module and the designated monitoring tool based on a third connection method corresponding to the third type.

[0095] As described in the above steps S200 to S203, the step of establishing a connection between the called input module and each monitoring tool according to the preset rules may specifically include: obtaining the product type of the specified monitoring tool based on the name of the monitoring tool. Wherein, the product type includes at least the first type, the second type and the third type, and the specified monitoring tool is any one of all the monitoring tools. In addition, a monitoring tool type mapping table is pre-created, and the mapping table stores the name of each monitoring tool and the product type corresponding to the name of each monitoring tool. Thus, the product type of the specified monitoring tool can be queried through the mapping table. In addition, the first type may be a monitoring tool based on a traditional Web, the second type may be a commercial monitoring tool, and the third type may be a monitoring tool for data subscription, etc. If the product type is the first type, a connection between the input module and the specified monitoring tool is established based on the first connection method corresponding to the first type. Wherein, the first connection method may be a local docking method, that is, directly calling the input module in the rule configuration of the traditional Web monitoring tool to connect the two. If the product type is the second type, a connection is established between the entry module and the designated monitoring tool based on a second connection method corresponding to the second type. Wherein, the second method may be a script-calling driven method. Since the monitoring rule configurations in commercial monitoring tools are all packaged, it is necessary to set a script-calling driven mode to call the entry module to connect the two. The entry module supports Python tool extensions, and related scripts can be written and generated by developers according to actual needs and stored in the device. If the product type is the third type, a connection is established between the entry module and the designated monitoring tool based on a third connection method corresponding to the third type. Wherein, the third method is an API docking method, in which the monitoring tool for data subscription is docked through the API process inside the entry module to complete the connection between the two, and then the entry module can subscribe to the data of the monitoring tool through the API process. In this embodiment, for monitoring tools of different product types, a connection method corresponding to the product type of each monitoring tool will be used to establish a connection with the entry module to ensure the successful connection between the entry module and each monitoring tool, which is beneficial for the subsequent rapid acquisition of corresponding monitoring data from the monitoring tool corresponding to the name of the monitoring tool based on the entry module, thereby improving the efficiency and intelligence of acquiring monitoring data from different sources.

[0096] Furthermore, in one embodiment of the present application, the above step S30 includes:

[0097] S300: Obtain a preset test sample set;

[0098] S301: Based on the test sample set, generating a comprehensive evaluation score of each of the abnormality prediction models according to a preset calculation rule;

[0099] S302: Filtering out a first abnormality prediction model whose comprehensive evaluation score is greater than a preset score threshold from all the abnormality prediction models;

[0100] S303: generating a predicted processing time of each of the first abnormality prediction models based on the test sample set;

[0101] S304: Filtering out a second abnormality prediction model with the shortest prediction processing time from the first abnormality prediction models;

[0102] S305: Using the second abnormality prediction model as the target abnormality prediction model.

[0103] As described in the above steps S300 to S305, the step of determining the target abnormal prediction model from the abnormal prediction model may specifically include: first obtaining a preset test sample set. Wherein, the test sample set may be generated based on the training sample set, such as randomly obtaining data with a preset numerical ratio from the training sample set as the test sample set, and the preset numerical ratio may be set according to actual needs, for example, it may be set to 20%. In addition, the test sample set includes a plurality of test sample data, and a category label corresponding to each of the test sample data. Then, based on the test sample set, the comprehensive evaluation score of each of the abnormal prediction models is generated according to the preset calculation rules. Wherein, the specific implementation process of calculating and generating the comprehensive evaluation score will be further described in the subsequent specific embodiments, and will not be repeated here. Then, the first abnormal prediction model whose comprehensive evaluation score is greater than the preset score threshold is screened out from all the abnormal prediction models. Wherein, the value of the preset score threshold is not specifically limited and can be set according to actual needs. Subsequently, the prediction processing time of each of the first abnormal prediction models is generated based on the test sample set. Among them, the specific implementation process of calculating and generating the predicted processing time will be further described in the subsequent specific embodiments, which will not be repeated here. Finally, the second abnormal prediction model with the shortest predicted processing time is screened out from the first abnormal prediction model, and the second abnormal prediction model is used as the target abnormal prediction model. This embodiment generates the comprehensive evaluation score and predicted processing time of each abnormal prediction model by using a preset test sample set, and then determines the target abnormal prediction model based on the obtained comprehensive evaluation score and predicted processing time. Since the obtained target abnormal prediction model has a higher comprehensive evaluation score and faster processing efficiency, the subsequent use of the target abnormal prediction model to perform abnormal prediction on the monitoring data can effectively improve the data accuracy of the abnormal analysis results corresponding to the monitoring data, and improve the processing efficiency of the abnormal analysis of the monitoring data.

[0104] Furthermore, in an embodiment of the present application, the above step S301 includes:

[0105] S3010: inputting the test sample set into a third abnormality prediction model, and calculating the accuracy of the third abnormality prediction model; wherein the third abnormality prediction model is any one of all the abnormality prediction models;

[0106] S3011: inputting the test sample set into a third anomaly prediction model, and calculating and generating a recall rate of the third anomaly prediction model;

[0107] S3012: Obtain a first weight corresponding to the precision rate, and obtain a second weight corresponding to the recall rate;

[0108] S3013: Calculate a first ratio between the first weight and the second weight;

[0109] S3014: Based on the precision, the recall and the first ratio, a preset calculation formula is called to generate a comprehensive evaluation score of the third abnormality prediction model.

[0110] As described in the above steps S3010 to S3014, the step of generating the comprehensive evaluation score of each of the abnormal prediction models according to the preset calculation rules based on the test sample set may specifically include: first, inputting the test sample set into the third abnormal prediction model, and calculating the precision of the third abnormal prediction model. Wherein, the third abnormal prediction model is any one of all the abnormal prediction models. And inputting the test sample set into the third abnormal prediction model, and calculating the recall of the third abnormal prediction model. Specifically, the precision and recall can be calculated by a confusion matrix (or error matrix). The confusion matrix is ​​used to measure the accuracy of a classifier. For a two-classification problem, its samples are divided into four situations: true positive examples (TruePositive), false positive examples (FalsePositive), true negative examples (TrueNegative), and false negative examples (FalseNegative) according to the combination of the true category and the predicted category of the classifier. The confusion matrix (ConfusionMatrix) can be as follows:

[0111]

[0112] Based on the confusion matrix, the precision and recall can be calculated according to the following formula: precision P = TP / (TP+FP), indicating that both the real situation and the predicted result are true / the predicted result is true; recall R = TP / (TP+FN), indicating that both the real situation and the predicted result are true / the real situation is true. Then obtain the first weight corresponding to the precision, and obtain the second weight corresponding to the recall. Among them, there is no specific limitation on the values ​​of the first weight and the second weight, which can be set according to actual needs. For example, the first weight is 1, the second weight is 0.5, or the first weight is 0.5, the second weight is 1, and so on. Then calculate the first ratio between the first weight and the second weight. Among them, the first ratio refers to the value obtained by dividing the first weight by the second weight. Finally, based on the precision, the recall and the first ratio, call the preset calculation formula to generate the comprehensive evaluation score of the third abnormal prediction model. The comprehensive evaluation score of the third abnormal prediction model is calculated by combining the precision, recall, and the ratio between the precision and recall of the third abnormal prediction model, and the comprehensive evaluation score is used to characterize the data comprehensive processing capability of the third abnormal prediction model. Specifically, the precision, recall, and first ratio can be substituted into a preset calculation formula to generate a corresponding comprehensive evaluation score. The calculation formula is specifically: in, is the first ratio, P is the precision, and R is the recall. For example, if the precision is 0.9, the recall is 0.8, the first weight of the precision is 1, and the second weight of the recall is 0.5, then the first ratio is 1 / 0.5=2. In this embodiment, by generating the precision and recall rate of the third abnormal prediction model based on the test sample set, the calculation formula related to the recall rate and the recall rate can be used to quickly generate the comprehensive evaluation score of the third abnormal prediction model, which is conducive to the subsequent rapid and accurate determination of the target abnormal prediction model from all abnormal prediction modules based on the comprehensive evaluation score of the third abnormal prediction model obtained. Since the comprehensive evaluation score corresponds to the evaluation value of the data comprehensive processing capability of the model, the target abnormal prediction model finally determined has a high data comprehensive processing capability and processing efficiency, so that when the target abnormal prediction model is used to predict and process the monitoring data, it can effectively improve the processing efficiency of the abnormal analysis processing of the monitoring data on the basis of ensuring the accuracy of the abnormal analysis results output by the target abnormal prediction model.

[0113] Furthermore, in an embodiment of the present application, the above step S303 includes:

[0114] S3030: Acquire the test sample set; wherein the test sample set includes a plurality of test sample data;

[0115] S3031: when the fourth prediction model obtains each of the test sample data, respectively counting the processing time of the prediction results output by the fourth prediction model corresponding to each of the test sample data; wherein the fourth prediction model is any one of all the first abnormality prediction models;

[0116] S3032: Eliminate the first processing time with the largest value and the second processing time with the smallest value from all the processing times to obtain a corresponding third processing time;

[0117] S3033: Calculate the sum of all the third processing times, and obtain the number of all the third processing times;

[0118] S3034: Calculate a second ratio between the sum and the number;

[0119] S3035: Using the second ratio as the prediction processing time of the fourth prediction model.

[0120] As described in the above steps S3030 to S3035, the step of generating the prediction processing time of each of the first abnormal prediction models based on the test sample set may specifically include: first obtaining the test sample set. Wherein, the test sample set includes a plurality of test sample data. Then, when the fourth prediction model obtains each of the test sample data, the processing time of the prediction results output by the fourth prediction model corresponding to each of the test sample data is respectively counted. Wherein, the fourth prediction model is any one of all the first abnormal prediction models. Specifically, if the time when the fourth prediction model receives the test sample data x is T1, and the time when the fourth prediction model successfully outputs the prediction result y of the test sample data x is T2, then the processing time of the fourth prediction model corresponding to the verification sample data x is T=T2-T1. For example, if the fourth prediction model includes 6 test sample data C1, C2, C3, C4, C5, and C6, the statistical method of the above processing time is used to calculate each test sample data, and it can be obtained that the processing time of C1 is 1.2s, the processing time of C2 is 1.5s, the processing time of C3 is 1.8s, the processing time of C4 is 1.6s, the processing time of C5 is 1.1s, and the processing time of C6 is 0.8s. Then, the first processing time with the largest value and the second processing time with the smallest value are removed from all the processing times to obtain the corresponding third processing time. Among them, referring to the above example, it can be obtained that the first processing time is 1.8s for the processing time of C3, and the second processing time is 0.8s for the processing time of C6, so that the third processing time includes the processing time of C1 of 1.2s, the processing time of C2 of 1.5s, the processing time of C4 of 1.6s, and the processing time of C5 of 1.1s. Subsequently, the sum of all the third processing times is calculated, and the number of all the third processing times is obtained. Among them, referring to the above example, it can be calculated that the sum of all the third processing times = 1.2 + 1.5 + 1.6 + 1.1 = 5.4s, and the number of the third processing times is 4. Finally, the second ratio between the sum and the number is calculated. And the second ratio is used as the predicted processing time of the fourth prediction model. Among them, referring to the above example, it can be calculated that the predicted processing time of the fourth prediction model = 5.4 / 4 = 1.35s. By eliminating the first processing time with the largest value and the second processing time with the smallest value, and then calculating the average value of all the remaining third processing times as the corresponding predicted processing time, the generated processing time can be less susceptible to the extreme values ​​in the processing time, which is conducive to improving the accuracy of the obtained predicted processing time.In this embodiment, the prediction processing time of each first abnormal prediction model can be quickly calculated by using the test sample set, which is conducive to the subsequent screening of all abnormal prediction models based on the prediction processing time and the comprehensive evaluation score of each abnormal prediction model to generate the final target abnormal prediction model, and then the received monitoring data can be accurately predicted and processed based on the target abnormal prediction model to generate the corresponding abnormal analysis results. Because the target abnormal prediction model obtained by screening based on the abnormal prediction model has a high data comprehensive processing capability and processing efficiency, when the target abnormal prediction model is used to predict the monitoring data, it can effectively improve the processing efficiency of the abnormal analysis processing of the monitoring data on the basis of ensuring the accuracy of the abnormal analysis results output by the target abnormal prediction model.

[0121] Furthermore, in an embodiment of the present application, before the above step S30, the following steps are included:

[0122] S310: Obtain a preset number of training sample sets, and randomly select a specified training sample set from the training sample sets; wherein the specified training sample set is any sample set among all the training sample sets, and the specified training sample set includes a number of specified monitoring data samples and specified category labels corresponding to the specified monitoring data samples;

[0123] S311: training a preset machine learning model using the specified monitoring data samples and the specified category labels to obtain a corresponding initial anomaly prediction model;

[0124] S312: Obtain a preset verification sample set, and perform an accuracy test on the initial abnormality prediction model based on the verification sample set to obtain a corresponding prediction accuracy rate;

[0125] S313: Determine whether the prediction accuracy is greater than a preset accuracy threshold;

[0126] S314: If yes, use the initial anomaly prediction model as the anomaly prediction model corresponding to the specified training sample set.

[0127] As described in steps S310 to S314 above, before the step of obtaining a plurality of pre-trained abnormality prediction models, a training generation process for the abnormality prediction model may also be included. Specifically, first obtain a preset number of training sample sets, and randomly select a specified training sample set from the training sample set. Among them, the specified training sample set is any sample set among all the training sample sets, and the specified training sample set includes several specified monitoring data samples, and a specified category label corresponding to the specified monitoring data sample. Then, the preset machine learning model is trained with the specified monitoring data samples and the specified category label to obtain the corresponding initial abnormality prediction model. Among them, the machine learning model includes a LogisticRegression (logistic regression) model, a Randomforest (random forest) model, and a Naivebayes (naive Bayes) model, etc. It is preferred to use a random forest model (also called a random forest classifier) ​​as the machine learning model. Random forest is a classifier that uses samples to train multiple decision trees and predict sample results. The training process of the decision tree adopts a top-down recursive method. The basic idea is to use information entropy as a measure to build a tree with the fastest entropy decrease until the entropy value of the leaf node is zero. At this time, the samples of each leaf node belong to the same category. When a new sample is input, each decision tree in the random forest judges and votes separately, and the one with the most votes is used as the final classification result. Through the integrated learning and majority voting mechanism of decision trees, random forest has good noise resistance and is not easy to overfit, and can better judge the abnormal state of monitoring data. When the machine learning model is a random forest model, specifically, the process of training the random forest model through the specified monitoring data sample and the specified category label to obtain the corresponding initial abnormal prediction model may include: step one, first initialize the random forest model. First, set the parameters of the bagging framework, including the maximum number of iterations of the weak learner, whether to perform replacement sampling on the sample set to build the tree, and whether to use out-of-bag samples to evaluate the quality of the model; specifically, set n_estimators = 50, that is, the maximum number of iterations of the weak learner is 50, and 50 decision trees are generated to form a random forest; set bootstrap = true, that is, the sub-sample set is obtained by replacement sampling. The rest of the parameters take the default values. Then, set the decision tree parameters, including the maximum number of features considered when building the decision tree model, the maximum depth of the decision tree, and the measure of impurity; specifically, set criterion = gini, that is, set the best segmentation attribute judgment method used when generating the decision tree to gini, use the Gini coefficient to calculate the impurity of the node, and other parameters take the default values. The calculation formula of the Gini coefficient is: Among them, Gini(D) represents the Gini coefficient, D represents a given node, there are a total of K types of labels, k represents any classification of the label, represents the proportion of label k on the node, p kThe probability that the representative sample belongs to the k-th class label. Step 2: Use the random forest algorithm to train the specified monitoring data samples included in the specified training sample set and the corresponding specified class labels to generate a random forest classification model; the specified monitoring data samples include the following 5 feature data: monitoring source, monitoring status, monitoring tool name, monitoring category, update time; the specified class labels may include that the data is abnormal and that the data is not abnormal. First, use the bagging ensemble algorithm to randomly extract m samples from the specified training sample set; among them, assuming that there are n training samples in the specified training sample set, randomly extract m training samples from the specified training samples using the bootstrap method to form a new training set, and m is less than n. Then, randomly select i features from all features d (i < d), and select the best splitting attribute from k features as the node to build a CART decision tree; among them, when building a CART decision tree, randomly select i features (k < 5), and then select the best splitting attribute from i features as the node to build a CART decision tree; after that, repeat the above two steps 50 times to build 50 CART decision trees to form a random forest classification model, that is, the initial anomaly prediction model. Among them, the generation of the CART decision tree is a process of recursively constructing a binary decision tree. CART uses the Gini coefficient minimization criterion for feature selection to generate a binary tree. After training and generating a random forest classification model. By inputting the monitoring data to be processed into the trained random forest classification model, each decision tree in the random forest will give the anomaly analysis result of the monitoring data. The random forest, based on the principle of the minority obeying the majority, outputs the anomaly analysis result with more votes as the final predicted result, so as to complete the anomaly analysis and prediction of the monitoring data with high accuracy. After that, obtain the preset validation sample set, and perform an accuracy test on the initial anomaly prediction model based on the validation sample set to obtain the corresponding prediction accuracy rate. Finally, judge whether the prediction accuracy rate is greater than the preset accuracy threshold. If so, use the initial anomaly prediction model as the anomaly prediction model corresponding to the specified training sample set. Specifically, after training the machine learning model for a period of time to obtain the initial anomaly prediction model, use the validation sample set to perform an accuracy test on the initial anomaly prediction model, that is, input several validation samples in the validation sample set into the initial anomaly prediction model. After inputting any one test sample into the initial anomaly prediction model, each decision tree included in the initial anomaly prediction model will classify the test sample to output the corresponding predicted classification result, that is, start judging from the root node of the current CART decision tree in the initial anomaly prediction model, traverse the entire CART decision tree, so as to make the predicted classification result for the test sample, and so on, select the next CART decision tree to repeat the same judgment process until all CART decision trees have output the predicted classification results.Then, based on the principle of minority obeys majority, the random forest will take the prediction classification result with the largest number of votes as the final prediction label result corresponding to the test sample. The initial abnormal prediction model predicts the prediction label result of each verification sample, and compares the prediction label result of each verification sample with the category label marked on the verification sample. If they are consistent, the initial abnormal prediction model accurately predicts the verification sample. If they are inconsistent, the initial abnormal prediction model predicts the verification sample incorrectly, thereby statistically obtaining the prediction accuracy of the initial abnormal prediction model (prediction accuracy = the number of verification samples with accurate predictions / the total number of verification samples). If the obtained prediction accuracy meets the set accuracy requirement, that is, it is greater than the accuracy threshold, the initial abnormal prediction model converges, thereby ending the training of the initial abnormal prediction model, and the initial abnormal prediction model that has ended the training is used as the abnormal prediction model, and is used to perform abnormal analysis and identification on the monitoring data. Furthermore, if the prediction accuracy is less than or equal to the accuracy threshold, it means that the training of the trained initial abnormality prediction model has not reached the preset standard. It may be that the number of samples in the training sample set used for training is too small or the number of samples in the verification sample set is too small. Therefore, in this case, the preset number of specified monitoring data samples is increased (that is, the number of samples is increased, for example, a fixed number is increased each time or a random number is increased each time), and then the above-mentioned training steps and testing steps are re-executed on this basis. The cycle is executed until the model accuracy of the trained initial abnormality prediction model is greater than the preset accuracy threshold, and the model training is terminated. This embodiment trains and verifies the preset machine learning model based on a training sample set including specified monitoring data samples and specified category labels corresponding to the monitoring data samples, so as to intelligently and quickly generate an anomaly prediction model that meets actual usage needs. This is beneficial for subsequent anomaly analysis of the monitoring data based on the anomaly prediction model when monitoring data corresponding to the monitoring tool is obtained, and then the anomaly analysis results corresponding to each monitoring data are accurately and quickly generated. This is beneficial for the subsequent display of the anomaly analysis results of the monitoring data while displaying the monitoring data, so that the user can perform corresponding processing according to the anomaly analysis results of each monitoring data, thereby improving the intelligence of the monitoring data display and the user experience.

[0128] The model-based monitoring data display method in the embodiment of the present application can also be applied to the blockchain field, such as storing the above monitoring data and other data on the blockchain. By using the blockchain to store and manage the above monitoring data, the security and non-tamperability of the above monitoring data can be effectively guaranteed.

[0129] The above-mentioned blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0130] Reference Figure 2 In one embodiment of the present application, a monitoring data display device based on a model is also provided, including:

[0131] Verification module 1 is used for responding to a monitoring data viewing request from a user, and performing identity authentication and authority verification on the user based on user information, a preset user authority data table, an operation authority score table, and standard posture information if a monitoring data viewing request is received; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information;

[0132] A connection module 2 is used to establish a connection between the called input module and each monitoring tool according to a preset rule if both the identity verification and the authority verification are passed, and obtain corresponding monitoring data from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name;

[0133] The first determination module 3 is used to obtain a plurality of abnormal prediction models generated by pre-training, and determine a target abnormal prediction model from the abnormal prediction models; wherein each of the abnormal prediction models is generated by training according to a respective different training sample set, and each of the training sample sets includes a plurality of monitoring data samples and a category label corresponding to the monitoring data sample;

[0134] An analysis module 4 is used to perform an anomaly analysis on each of the monitoring data based on the target anomaly prediction model to obtain an anomaly analysis result corresponding to each of the monitoring data;

[0135] A labeling module 5, used for labeling the corresponding status of each monitoring data based on the abnormal analysis result to obtain the labeled monitoring data;

[0136] The display module 6 is used to display the annotated monitoring data through a preset signboard.

[0137] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0138] Furthermore, in one embodiment of the present application, the verification module 1 includes:

[0139] A first judging unit, used to judge whether the preset user authority data table stores designated user information identical to the user information;

[0140] A first query unit is used to query the permission validity period information corresponding to the specified user information from the user permission data table if the specified user information is stored, and determine whether the current time is within the time interval corresponding to the permission validity period information;

[0141] A second query unit is used to query the authority score corresponding to the specified user information from the user authority data table if the time interval corresponds to the authority validity period information;

[0142] A third query unit, configured to query the operation authority score table to obtain a viewing authority score interval corresponding to the business operation of viewing the monitoring data;

[0143] A second judgment unit, used to judge whether the permission score is within the viewing permission score range;

[0144] A display unit, used to display dynamic prompt information on the current interface if the user is within the viewing permission score range, and obtain the gesture information input by the user based on the dynamic prompt information; wherein the gesture information includes hand movements and facial movements;

[0145] a third judging unit, configured to judge whether the hand motion is the same as a pre-stored standard hand motion corresponding to the user information;

[0146] a fourth determination unit, configured to determine whether the facial movement is the same as a pre-stored standard facial movement corresponding to the user information if the hand movement is the same as the standard hand movement;

[0147] The first determination unit is used to determine that both the identity verification and the authority verification have passed if the facial action information is the same as the standard facial action information, and otherwise determine that both the identity verification and the authority verification have not passed.

[0148] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0149] Furthermore, in one embodiment of the present application, the connection module 2 includes:

[0150] A first acquisition unit is used to acquire a product type of a designated monitoring tool based on the name of the monitoring tool; wherein the product type includes at least a first type, a second type and a third type, and the designated monitoring tool is any one of all the monitoring tools;

[0151] A first connection unit, configured to establish a connection between the input module and the designated monitoring tool based on a first connection method corresponding to the first type if the product type is the first type;

[0152] A second connection unit, configured to establish a connection between the input module and the designated monitoring tool based on a second connection method corresponding to the second type if the product type is the second type;

[0153] The third connection unit is used to establish a connection between the input module and the designated monitoring tool based on a third connection method corresponding to the third type if the product type is the third type.

[0154] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0155] Furthermore, in an embodiment of the present application, the determination module 3 includes:

[0156] A second acquisition unit, used to acquire a preset test sample set;

[0157] A first generating unit, configured to generate a comprehensive evaluation score of each of the abnormality prediction models based on the test sample set and according to a preset calculation rule;

[0158] A first screening unit, used to screen out a first abnormality prediction model having a comprehensive evaluation score greater than a preset score threshold from all the abnormality prediction models;

[0159] A second generating unit, configured to generate a predicted processing time of each of the first abnormality prediction models based on the test sample set;

[0160] A second screening unit, configured to screen out a second abnormality prediction model having a minimum prediction processing time from the first abnormality prediction models;

[0161] The first determining unit is configured to use the second abnormality prediction model as the target abnormality prediction model.

[0162] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0163] Furthermore, in one embodiment of the present application, the first generating unit includes:

[0164] A first calculation subunit is used to input the test sample set into a third abnormality prediction model, and calculate the accuracy of the third abnormality prediction model; wherein the third abnormality prediction model is any one of all the abnormality prediction models;

[0165] A second calculation subunit is used to input the test sample set into a third abnormality prediction model, and calculate and generate a recall rate of the third abnormality prediction model;

[0166] A first acquisition subunit, used to acquire a first weight corresponding to the precision rate, and to acquire a second weight corresponding to the recall rate;

[0167] a third calculation subunit, configured to calculate a first ratio between the first weight and the second weight;

[0168] A generating subunit is used to call a preset calculation formula to generate a comprehensive evaluation score of the third abnormality prediction model based on the precision, the recall and the first ratio.

[0169] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0170] Furthermore, in one embodiment of the present application, the second generating unit includes:

[0171] A second acquisition subunit is used to acquire the test sample set; wherein the test sample set includes a plurality of test sample data;

[0172] A statistical subunit, for respectively counting the processing time of the prediction results output by the fourth prediction model corresponding to each of the test sample data when the fourth prediction model acquires each of the test sample data; wherein the fourth prediction model is any one of all the first abnormality prediction models;

[0173] A processing subunit, configured to remove the first processing time with the largest value and the second processing time with the smallest value from all the processing times, to obtain a corresponding third processing time;

[0174] a third acquisition subunit, configured to calculate a sum of all the third processing times and acquire a quantity of all the third processing times;

[0175] a third calculating subunit, configured to calculate a second ratio between the sum and the quantity;

[0176] A determination subunit is configured to use the second ratio as the prediction processing time of the fourth prediction model.

[0177] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0178] Furthermore, in one embodiment of the present application, the above-mentioned model-based monitoring data display device includes:

[0179] An acquisition module is used to acquire a preset number of training sample sets, and randomly select a specified training sample set from the training sample sets; wherein the specified training sample set is any sample set among all the training sample sets, and the specified training sample set includes a number of specified monitoring data samples, and a specified category label corresponding to the specified monitoring data sample;

[0180] A training module, used to train a preset machine learning model through the specified monitoring data samples and the specified category labels to obtain a corresponding initial anomaly prediction model;

[0181] A testing module, used to obtain a preset verification sample set, and perform an accuracy test on the initial abnormality prediction model based on the verification sample set to obtain a corresponding prediction accuracy rate;

[0182] A judgment module, used to judge whether the prediction accuracy is greater than a preset accuracy threshold;

[0183] The second determining module is configured to, if yes, use the initial abnormality prediction model as the abnormality prediction model corresponding to the designated training sample set.

[0184] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the model-based monitoring data display method in the aforementioned embodiment, and will not be repeated here.

[0185] Reference Figure 3 In an embodiment of the present application, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3As shown. The computer device includes a processor, a memory, a network interface, a display screen, an input device and a database connected through a system bus. Among them, the processor designed for the computer device is used to provide computing and control capabilities. The memory of the computer device includes a storage medium and an internal memory. The storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the storage medium. The database of the computer device is used to store user information, standard posture information, monitoring data, target abnormality prediction model, abnormal analysis results and annotated monitoring data. The network interface of the computer device is used to communicate with an external terminal through a network connection. The display screen of the computer device is an indispensable graphic output device in the computer, which is used to convert digital signals into optical signals so that text and graphics are displayed on the screen of the display screen. The input device of the computer device is the main device for information exchange between the computer and the user or other devices, and is used to transmit data, instructions and certain sign information to the computer. When the computer program is executed by the processor, a model-based monitoring data display method is implemented.

[0186] The processor executes the steps of the model-based monitoring data display method:

[0187] If a user's monitoring data viewing request is received, the monitoring data viewing request is responded to, and the identity authentication and permission verification processing are performed on the user based on the user information, the preset user permission data table, the operation permission score table and the standard posture information; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information; if the identity authentication and permission verification are both passed, a connection between the called input module and each monitoring tool is established according to the preset rules, and corresponding monitoring data is obtained from the monitoring tool based on the input module; wherein the monitoring tool and the monitoring tool name have a corresponding relationship; obtain multiple abnormal prediction models generated by pre-training, and determine a target abnormal prediction model from the abnormal prediction models; wherein each of the abnormal prediction models is generated by training according to different training sample sets, and each of the training sample sets includes several monitoring data samples and category labels corresponding to the monitoring data samples; perform abnormal analysis on each of the monitoring data based on the target abnormal prediction model to obtain abnormal analysis results corresponding to each of the monitoring data; perform corresponding status annotation on each of the monitoring data based on the abnormal analysis results to obtain annotated monitoring data; and display the annotated monitoring data through a preset dashboard.

[0188] Those skilled in the art will understand that Figure 3The structure shown in is merely a block diagram of a portion of the structure related to the present application scheme, and does not constitute a limitation on the devices and computer equipment to which the present application scheme is applied.

[0189] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, a model-based monitoring data display method is implemented, specifically:

[0190] If a user's monitoring data viewing request is received, the monitoring data viewing request is responded to, and the identity authentication and permission verification processing are performed on the user based on the user information, the preset user permission data table, the operation permission score table and the standard posture information; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information; if the identity authentication and permission verification are both passed, a connection between the called input module and each monitoring tool is established according to the preset rules, and corresponding monitoring data is obtained from the monitoring tool based on the input module; wherein the monitoring tool and the monitoring tool name have a corresponding relationship; obtain multiple abnormal prediction models generated by pre-training, and determine a target abnormal prediction model from the abnormal prediction models; wherein each of the abnormal prediction models is generated by training according to different training sample sets, and each of the training sample sets includes several monitoring data samples and category labels corresponding to the monitoring data samples; perform abnormal analysis on each of the monitoring data based on the target abnormal prediction model to obtain abnormal analysis results corresponding to each of the monitoring data; perform corresponding status annotation on each of the monitoring data based on the abnormal analysis results to obtain annotated monitoring data; and display the annotated monitoring data through a preset dashboard.

[0191] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in the present application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

Claims

1. A monitoring data display method based on a model, characterized in that: include: If a monitoring data viewing request from a user is received, respond to the monitoring data viewing request and perform identity authentication and authority verification on the user based on the user information, a preset user authority data table, an operation authority score table, and standard posture information; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information; If both the identity authentication and the permission authentication are passed, a connection is established between the called input module and each monitoring tool according to a preset rule, and corresponding monitoring data is obtained from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name; Acquire multiple anomaly prediction models generated by pre-training, and determine a target anomaly prediction model from the anomaly prediction models; wherein each of the anomaly prediction models is generated by training according to a respective different training sample set, and each of the training sample sets includes a number of monitoring data samples and a category label corresponding to the monitoring data sample; Performing anomaly analysis on each of the monitoring data based on the target anomaly prediction model to obtain an anomaly analysis result corresponding to each of the monitoring data; Based on the abnormal analysis result, each of the monitoring data is marked with a corresponding state to obtain the marked monitoring data; Displaying the annotated monitoring data through a preset dashboard; The step of determining a target anomaly prediction model from the anomaly prediction models comprises: Obtain a preset test sample set; Based on the test sample set, generating a comprehensive evaluation score for each of the abnormality prediction models according to a preset calculation rule; Filter out a first abnormality prediction model whose comprehensive evaluation score is greater than a preset score threshold from all the abnormality prediction models; Generate a predicted processing time of each of the first abnormality prediction models based on the test sample set; Selecting a second abnormality prediction model with the shortest prediction processing time from the first abnormality prediction models; using the second abnormality prediction model as the target abnormality prediction model; The step of generating a comprehensive evaluation score of each of the abnormality prediction models based on the test sample set according to a preset calculation rule comprises: Inputting the test sample set into a third abnormality prediction model, and calculating the accuracy of the third abnormality prediction model; wherein the third abnormality prediction model is any one of all the abnormality prediction models; Inputting the test sample set into a third anomaly prediction model, and calculating and generating a recall rate of the third anomaly prediction model; Obtaining a first weight corresponding to the precision rate, and obtaining a second weight corresponding to the recall rate; calculating a first ratio between the first weight and the second weight; Based on the precision, the recall and the first ratio, a preset calculation formula is called to generate a comprehensive evaluation score of the third abnormality prediction model.

2. The monitoring data display method based on the model according to claim 1, characterized in that: The step of performing identity authentication and authority verification on the user based on the user information, the preset user authority data table, the operation authority score table and the standard posture information includes: Determine whether the preset user authority data table stores designated user information that is the same as the user information; If the designated user information is stored, query the permission validity period information corresponding to the designated user information from the user permission data table, and determine whether the current time is within the time interval corresponding to the permission validity period information; If it is within the time interval corresponding to the permission validity period information, query the permission score corresponding to the specified user information from the user permission data table; Querying the viewing authority score interval corresponding to the business operation of viewing the monitoring data from the operation authority score table; Determining whether the permission score is within the viewing permission score range; If the user is within the viewing permission score range, dynamic prompt information is displayed on the current interface, and gesture information input by the user based on the dynamic prompt information is obtained; wherein the gesture information includes hand movements and facial movements; Determining whether the hand motion is the same as a pre-stored standard hand motion corresponding to the user information; If the hand movement is the same as the standard hand movement, determining whether the facial movement is the same as a pre-stored standard facial movement corresponding to the user information; If the facial motion information is the same as the standard facial motion information, it is determined that both the identity verification and the authority verification are passed; otherwise, it is determined that both the identity verification and the authority verification are not passed.

3. The monitoring data display method based on the model according to claim 1 is characterized in that: The step of establishing a connection between the called input module and each monitoring tool according to a preset rule includes: Acquire a product type of a designated monitoring tool based on the name of the monitoring tool; wherein the product type includes at least a first type, a second type, and a third type, and the designated monitoring tool is any one of all the monitoring tools; If the product type is the first type, establishing a connection between the input module and the designated monitoring tool based on a first connection method corresponding to the first type; If the product type is the second type, establishing a connection between the input module and the designated monitoring tool based on a second connection method corresponding to the second type; If the product type is the third type, a connection is established between the input module and the designated monitoring tool based on a third connection method corresponding to the third type.

4. The monitoring data display method based on the model according to claim 1 is characterized in that: The step of generating the predicted processing time of each first abnormality prediction model based on the test sample set includes: Acquire the test sample set; wherein the test sample set includes a plurality of test sample data; When the fourth prediction model obtains each of the test sample data, the processing time of the prediction results output by the fourth prediction model corresponding to each of the test sample data is counted respectively; wherein the fourth prediction model is any one of all the first abnormality prediction models; Eliminate the first processing time with the largest value and the second processing time with the smallest value from all the processing times to obtain a corresponding third processing time; Calculating a sum of all the third processing times and obtaining the number of all the third processing times; calculating a second ratio between the sum and the amount; The second ratio is used as the prediction processing time of the fourth prediction model.

5. The monitoring data display method based on the model according to claim 1, characterized in that: Before the step of obtaining the plurality of abnormality prediction models generated by pre-training, the method includes: Obtain a preset number of training sample sets, and randomly select a specified training sample set from the training sample sets; wherein the specified training sample set is any sample set among all the training sample sets, and the specified training sample set includes a number of specified monitoring data samples and a specified category label corresponding to the specified monitoring data sample; The preset machine learning model is trained by using the specified monitoring data samples and the specified category labels to obtain a corresponding initial anomaly prediction model; Obtaining a preset verification sample set, and performing an accuracy test on the initial abnormality prediction model based on the verification sample set to obtain a corresponding prediction accuracy rate; Determining whether the prediction accuracy is greater than a preset accuracy threshold; If yes, the initial anomaly prediction model is used as the anomaly prediction model corresponding to the specified training sample set.

6. A model-based monitoring data display device, used to execute the method according to any one of claims 1 to 5, characterized in that: include: A verification module, for responding to a monitoring data viewing request from a user, and performing identity authentication and authority verification on the user based on user information, a preset user authority data table, an operation authority score table, and standard posture information, if the monitoring data viewing request is received; wherein the monitoring data viewing request carries the name of the monitoring tool and the user information; A connection module, used for establishing a connection between the called input module and each monitoring tool according to a preset rule if both the identity verification and the authority verification are passed, and obtaining corresponding monitoring data from the monitoring tool based on the input module; wherein the monitoring tool has a corresponding relationship with the monitoring tool name; A first determination module is used to obtain a plurality of abnormality prediction models generated by pre-training, and determine a target abnormality prediction model from the abnormality prediction models; wherein each of the abnormality prediction models is generated by training according to a respective different training sample set, and each of the training sample sets includes a plurality of monitoring data samples and a category label corresponding to the monitoring data sample; An analysis module, used for performing an anomaly analysis on each of the monitoring data based on the target anomaly prediction model to obtain an anomaly analysis result corresponding to each of the monitoring data; A labeling module, used for labeling the corresponding status of each monitoring data based on the abnormal analysis result to obtain the labeled monitoring data; The display module is used to display the annotated monitoring data through a preset dashboard.

7. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images