Method, device and computer storage medium for anomaly detection

Abstract

Disclosed is an FFT-IFFT-based outlier detection method using validity detection, comprising: when the difference between data indicated by a point in an original time series and data indicated by a corresponding point in a first time series processed by FFT, high-frequency filtering, and IFFT is greater than a first predetermined threshold, interpolating the point in the original time series to obtain a second time series; applying the FFT, high-frequency filtering, and IFFT to the second time series to obtain a third time series; and when the difference between data indicated by a point in the original time series and data indicated by a corresponding point in the third time series is greater than a first predetermined threshold, determining the point in the original time series as an outlier in the original time series. Also disclosed are an outlier detection method based on slowly varying data features, an outlier interval detection method based on a dynamic sliding window, corresponding anomaly detection devices, and computer storage media.

Description

Technical Field

[0001] The present disclosure relates to the field of machine learning, and more particularly to a method, device, and computer storage medium for anomaly detection. Background Art

[0002] With the diversification of traffic plans, the impact of traffic services on network load is becoming increasingly severe. This is especially true with the massive number of IoT connections, which places higher demands on network management and monitoring, and the challenges facing network management systems are growing. When monitoring traffic data, outliers often contaminate normal traffic data. For example, in systems that use machine learning models to predict future traffic trends by learning from past traffic data, outliers can interfere with the learning model, reducing the accuracy of future predictions. In practical applications, outliers are often removed before further analysis and processing, necessitating anomaly detection.

[0003] The goal of anomaly detection is to identify outliers that deviate from the general data distribution. Therefore, anomaly detection can be considered a classification problem under data imbalance. Classification problems can be divided into supervised and unsupervised learning problems depending on whether or not labels are present. However, in real-world situations, since anomaly detection problems often lack labels and the training data does not clearly identify outliers, unsupervised learning must be used.

[0004] Currently, common anomaly detection methods include statistical and probabilistic models, linear models, proximity-based models (also called distance-based models), and nonlinear models. Their characteristics are shown in Table 1 below:

[0005]

[0006]

[0007] Table 1

[0008] The anomaly detection methods listed in Table 1 above are more suitable for non-time series data with normal distribution: the positions of anomalies are significantly deviated from the positions of normal points. For example, Figure 1a and Figure 1b Schematic diagrams of detecting outliers using the PCA algorithm and the KNN algorithm are shown respectively.

[0009] However, network traffic data is a kind of time series data, which mainly consists of four parts: trend, cyclical, seasonal, and irregular data.

[0010] Trends are long-term patterns in time series.

[0011] Cyclic patterns show upward and downward movement along a given trend;

[0012] Seasonal patterns reflect regular fluctuations due to seasonal factors and people's habits;

[0013] Since network traffic data is time series data, there are certain numerical differences between peaks and troughs.

[0014] First, the cyclical nature of time series will result in peaks and troughs within the cycle. If a data point in a trough is close to its peak, simply using the above method without considering the time factor may result in the trough being considered normal, leading to inaccurate detection.

[0015] At the same time, the trend factor of the time series will cause the data to change over time, and the overall trend is uncertain. For example, for data with a downward overall trend, the minimum value of all data is not necessarily an outlier.

[0016] Therefore, the existing anomaly detection methods mentioned above face major challenges such as low anomaly detection precision and recall when applied to time series data such as network traffic data. Summary of the Invention

[0017] To this end, the present disclosure provides a method, device, and computer storage medium for anomaly detection, which enables effective anomaly detection, particularly for time series data, thereby achieving high precision and recall.

[0018] According to a first aspect of the present disclosure, there is provided an anomaly detection method. The anomaly detection method comprises: applying FFT (Fast Fourier Transform), high-frequency filtering and IFFT (Inverse Fast Fourier Transform) to an original time series to obtain a first time series, wherein the point on the original time series indicates data detected within the detection period of the node; respectively comparing the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series; when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is greater than a first predetermined threshold, interpolating the point in the original time series to obtain a second time series; applying the FFT, high-frequency filtering and IFFT to the second time series to obtain a third time series; and when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is greater than the first predetermined threshold, determining the point in the original time series as an anomaly point of the original time series.

[0019] In an exemplary embodiment, interpolating the point in the original time series includes: replacing the value indicated by the point in the original time series with an average value of data indicated by adjacent points of the point in the original time series.

[0020] In an exemplary embodiment, the first predetermined threshold is set to a predetermined integer multiple of a standard deviation of a difference between data indicated by a point in the original time series and data indicated by a corresponding point in the first time series.

[0021] In an exemplary embodiment, the anomaly detection method further includes: for a moment in a detection cycle of a node,

[0022] Extracting data detected at the moments of each detection cycle within a detection period to generate a time series of the moments, wherein points on the time series of the moments indicate data detected at the moments in the corresponding detection cycles; calculating the distance between each point on the time series of the moments and adjacent points; comparing the calculated maximum distance with a second predetermined threshold; and, if the maximum distance is greater than the second predetermined threshold, determining the point with the maximum distance as an abnormal point.

[0023] In an exemplary embodiment, the anomaly detection method further includes: repeating the calculation, comparison, and determination operations for other points in the time series of the moment except the anomaly point until the maximum distance does not exceed a second predetermined threshold, or the number of determined anomaly points exceeds a third predetermined threshold.

[0024] In an exemplary embodiment, the distance between each point and an adjacent point is the average of the distances between the point and the previous point and the next point.

[0025] In an exemplary embodiment, before calculating the distance between each point on the time series at the moment and the adjacent points, the data indicated by the point on the time series at the moment is preprocessed, and the preprocessing includes at least one of the following: discarding all NaN (non-number) values; and normalizing the data.

[0026] In an exemplary embodiment, the second predetermined threshold is set by a grid method.

[0027] In an exemplary embodiment, the anomaly detection method further includes:

[0028] For a time series with an abnormal point, setting a first window, wherein the first window takes the first abnormal point as a starting position; and

[0029] For the first window, an operation of determining an abnormal interval is performed, and the operation of determining the abnormal interval includes: determining whether the number of abnormal points in the first window reaches a fourth predetermined threshold; when the number of abnormal points in the first window reaches the fourth predetermined threshold, expanding the first window by a predetermined length to obtain a second window; continuously performing the operation of expanding the window by the predetermined length until at least one of the following conditions is met: the number of abnormal points in the window does not increase after being expanded for a predetermined number of consecutive times, or the window after continuous expansion reaches a maximum window threshold, or the number of abnormal points in the window does not reach the fourth predetermined threshold; and determining the window before the continuous expansion as an abnormal interval.

[0030] In an exemplary embodiment, the anomaly detection method further includes: if the number of anomalies in the first window does not reach a fourth predetermined threshold, translating the first window to a third window, the third window having the second anomaly as a starting position and having the same length as the first window; determining whether the number of anomalies in the third window reaches a fourth predetermined threshold; if the number of anomalies in the third window reaches the fourth predetermined threshold, expanding the third window by a predetermined length to obtain a fourth window; continuously performing the operation of expanding the window by a predetermined length until at least one of the following conditions is met: the number of anomalies in the window does not increase after being expanded for a predetermined number of consecutive times, or the window after continuous expansion reaches the maximum window threshold, or the number of anomalies in the window does not reach the fourth predetermined threshold; and determining the window before continuous expansion as an abnormal interval.

[0031] In an exemplary embodiment, the fourth predetermined threshold is proportional to the current window length.

[0032] According to a second aspect of the present disclosure, an anomaly detection device is provided. The anomaly detection device comprises: a processor; and a memory storing computer instructions, wherein when executed by the processor, the computer instructions cause the anomaly detection device to perform the method according to the first aspect of the present disclosure.

[0033] According to a third aspect of the present disclosure, a computer storage medium is provided, storing computer instructions, which, when executed by at least one processor, cause the at least one processor to perform the method according to the first aspect of the present disclosure.

[0034] According to the technical solution of the embodiment of the present disclosure, a first time series is obtained by applying FFT, high-frequency filtering and IFFT to the original time series, and when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is greater than a predetermined threshold, the point in the original time series is interpolated to obtain a second time series, and then FFT, high-frequency filtering and IFFT are applied to the second time series to obtain a third time series, and when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is greater than the predetermined threshold, the point in the original time series is determined as an abnormal point of the original time series, which can effectively avoid false detection of abnormal points (that is, misjudging a normal point as an abnormal point).

[0035] By extracting the data detected at a certain moment in each detection cycle within the detection period for a node to generate a time series at that moment, calculating the distance between each point in the time series at that moment and the adjacent points, and determining the point with the maximum distance as an abnormal point when the calculated maximum distance is greater than a predetermined threshold, that is, using the slow-changing characteristics of the previous and next data points in the time series at a specific moment to determine the abnormal point at that moment in a certain period, and then obtaining the abnormal point of the original time series at each moment, it can effectively avoid missing the detection of abnormal points (that is, misjudging the abnormal point as a normal point).

[0036] In addition, by applying a dynamic sliding window to the time series with abnormal points to determine the abnormal interval, the longer abnormal period caused by device restart can be effectively detected, further reducing the missed detection rate and improving the accuracy and recall rate of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1a and Figure 1b Schematic diagrams of detecting outliers using the PCA algorithm and the KNN algorithm are schematically shown respectively;

[0038] Figure 2a 、 2b 2c and 2d schematically show the trend graphs of the number of attached users indicator for three days, one month and the Spring Festival period respectively;

[0039] Figure 3 A two-day trend chart of the number of attachment requests indicator is schematically shown;

[0040] Figure 4 Schematically shows a flow chart of an outlier detection method based on FFT-IFFT using validity detection according to an exemplary embodiment of the present disclosure;

[0041] Figure 5a 、 5b5c and 5c schematically show the original sequence diagram, the low-frequency part sequence diagram and the high-frequency part sequence diagram of the time series before FFT-IFFT high-frequency filtering respectively;

[0042] Figure 6a and 6b Schematically illustrating the effect of the FFT-IFFT based outlier detection method without applying the validity detection according to the exemplary embodiment of the present disclosure and applying the validity detection according to the exemplary embodiment of the present disclosure respectively;

[0043] Figure 7 The flowchart of the method for detecting abnormal points based on slowly varying characteristics of data according to an exemplary embodiment of the present disclosure is schematically shown;

[0044] Figure 8 Schematically illustrates an example diagram of calculating the distance between a point and adjacent points according to an exemplary embodiment of the present disclosure;

[0045] Figure 9 Schematically shows the effect of applying the outlier detection method based on slowly varying data features according to an exemplary embodiment of the present disclosure;

[0046] Figure 10 The flowchart of the abnormal interval detection method based on the dynamic sliding window according to the exemplary embodiment of the present disclosure is schematically shown;

[0047] Figure 11 Schematically illustrates an example of applying a dynamic sliding window to detect abnormal intervals for a time series with abnormal points according to an exemplary embodiment of the present disclosure;

[0048] Figure 12a and 12b Schematically illustrating the effect diagrams of the abnormal interval detection method without applying the dynamic sliding window according to the exemplary embodiment of the present disclosure and applying the dynamic sliding window according to the exemplary embodiment of the present disclosure respectively;

[0049] Figure 13 Schematically illustrates the accuracy and recall of detecting abnormal intervals using a dynamic sliding window according to an exemplary embodiment of the present disclosure;

[0050] Figure 14 A diagram schematically illustrates the relationship between attached users and success rate and network events;

[0051] Figure 15 Schematically showing a performance comparison diagram of applying the IForest algorithm, the KNN algorithm, and the anomaly detection method according to an exemplary embodiment of the present disclosure;

[0052] Figure 16Schematically shows a structural block diagram of an abnormality detection device according to an exemplary embodiment of the present disclosure;

[0053] Figure 17 Schematically shows a structural block diagram of an abnormality detection device according to another exemplary embodiment of the present disclosure;

[0054] Figure 18 Schematically shows a structural block diagram of an abnormal section detection device according to an exemplary embodiment of the present disclosure; and

[0055] Figure 19 The figure schematically shows a structural block diagram of an abnormality detection device according to another exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0056] As mentioned above, the anomaly detection scheme proposed in the present disclosure is mainly aimed at data with time series characteristics, which mainly have characteristics such as trend, periodicity, seasonality and irregularity. It should be understood that the application scenarios of the present disclosure are applicable to all anomaly data detection, including but not limited to mobile communication networks, fixed networks, the Internet of Things, and various vertical manufacturers. The anomaly detection scheme according to the present disclosure will be described in detail below with reference to specific examples. In the following description of the present disclosure, business traffic data will be used as an example of time series data. It should be understood that the time series data involved in the present disclosure is not limited to this, but can cover any data with the above-mentioned time series characteristics.

[0057] Assume that the service flow data targeted by the exemplary embodiment of the present disclosure is based on a 15-minute granularity, that is, there are 96 service flow data for a node in a day. For example, some data of the number of attached users indicator of a certain MME (mobility management entity) node of a certain operator is shown in Table 2 below:

[0058]

[0059] Table 2

[0060] For example, see Figures 2a-2c and Figure 3 A graphical representation of at least one characteristic of time series data is given.

[0061] Figure 2a 、 2b 2c schematically show trend graphs of the number of attached users over three days, one month, and the Spring Festival period as examples of time series data, and Figure 3 A two-day trend graph of the attachment request count indicator is schematically shown as another example of time series data.

[0062] from Figure 2aAs can be seen from the three-day trend chart of the number of attached users, the range of change within one day is large, and there are many abnormal jump points (points shown with "+"). Figure 2b The one-month trend chart of the number of attached users shows that, in addition to individual jump points, there are also abnormal intervals caused by certain equipment operations, and the duration of the abnormal period is uncertain. Figure 2c The Spring Festival trend chart of the number of attached users shows that there are changes that deviate from the normal trend due to the holiday effect before and after the Spring Festival (2019 / 02 / 04-2019 / 02 / 10), but this holiday trend is normal and not an abnormal point. Figure 3 It can be seen from the two-day trend chart of the attachment request number indicator that the data of the attachment request number indicator is more unstable than the attached user number indicator, and there are many small jumps.

[0063] Anomalies in a time series are data points that deviate from the normal trend (excluding holiday trends). For example, anomalies can be categorized into the following three types:

[0064] 1. Individual hops: Traffic may experience individual hops due to, for example, hot events, temporary adjustments to O&M (operation and maintenance) configuration data, or temporary abnormalities on the website server.

[0065] 2. Abnormal intervals caused by user migration due to device restarts - For example, when a node device restarts, the data in the corresponding time period will experience large fluctuations, specifically manifested as a sudden drop in data that cannot be restored to normal levels in a short period of time;

[0066] 3. An abnormal period of time caused by the restart of certain devices in the same area, which causes some users to be transferred to this device - specifically manifested as a sudden increase in data of varying magnitude.

[0067] For the detection of outliers, the exemplary embodiments of the present disclosure provide two detection methods:

[0068] 1) An outlier detection method based on FFT-IFFT using validity detection, and

[0069] 2) Outlier detection method based on slowly changing characteristics of data.

[0070] In addition, for a time series with abnormal points, an exemplary embodiment of the present disclosure further provides an abnormal interval detection method based on a dynamic sliding window.

[0071] It should be understood that the above two outlier detection methods and the abnormal interval detection method based on the dynamic sliding window proposed in the exemplary embodiments of the present disclosure can be used individually or in combination according to actual needs. The present disclosure does not make any restrictions on this. The use of the above methods alone or in any combination is within the scope of protection of the present disclosure.

[0072] For example, in an exemplary embodiment, according to actual needs, after the outliers are detected by applying the FFT-IFFT-based outlier detection method using validity detection, the dynamic sliding window-based outlier interval detection method can also be applied to determine the outlier interval.

[0073] In another exemplary embodiment, according to actual needs, after the abnormal point detection method based on the slowly varying characteristics of the data is applied to detect the abnormal point, if necessary, the abnormal interval detection method based on the dynamic sliding window can also be applied to determine the abnormal interval.

[0074] In another exemplary embodiment, according to actual needs, after detecting outliers by applying both an FFT-IFFT-based outlier detection method using validity detection and an outlier detection method based on slowly varying characteristics of data, the outliers detected by the two outlier detection methods can be unioned to obtain a time series with outliers, and an outlier interval detection method based on a dynamic sliding window can be applied to the time series to determine the outliers.

[0075] In another exemplary embodiment, according to actual needs, certain weights can be given to the FFT-IFFT-based outlier detection method using validity detection and the data slowly varying feature-based outlier detection method to detect outliers, and the outliers detected by the above two outlier detection methods are unioned to obtain a time series with outliers, and then the dynamic sliding window-based outlier interval detection method is applied to the time series to determine the outlier interval.

[0076] The following will describe in detail the above two outlier detection methods and the outlier interval detection method using a dynamic sliding window with reference to the accompanying drawings.

[0077] See also Figure 4 , which schematically shows a flow chart of an outlier detection method 400 based on FFT-IFFT using validity detection according to an exemplary embodiment of the present disclosure.

[0078] First, in step S401 , FFT, high-frequency filtering, and IFFT processing are applied to the original time series to obtain a first time series, wherein the points on the original time series indicate data detected within a detection period of a node.

[0079] Specifically, FFT processing is used to transform the points on the original time series from the time domain to the frequency domain, extract the characteristics of the time series in the frequency domain, and remove the high-frequency part through high-frequency filtering (i.e., noise reduction), and then restore the frequency domain data back to the time domain data through IFFT to obtain the first time series.

[0080] Figure 5a 、 5b 5c and 5d schematically show the original sequence diagram of the time series before FFT-IFFT high-frequency filtering, and the low-frequency part sequence diagram and high-frequency part sequence diagram of the time series respectively. Figures 5a-5c As can be seen from the figure, the data points with significant changes in the high-frequency part of the time series correspond to the outliers in the original time series. Therefore, by removing the high-frequency part, the outliers can be effectively removed.

[0081] Next, in step S403 , the data indicated by each point in the original time series is compared with the data indicated by the corresponding point in the first time series.

[0082] When the difference between the data indicated by a point in the original time series and the data indicated by the corresponding point in the first time series is greater than a predetermined threshold (represented herein by TH1), method 400 proceeds to step S405, where it is determined whether this is the second time to perform FFT, high-frequency filtering, IFFT processing and data comparison operations.

[0083] In an exemplary embodiment, TH1 is set to a predetermined integer multiple of the standard deviation of the difference between the data of the corresponding point in the original time series and the data indicated by the point in the first time series.

[0084] Obviously, the FFT, high-frequency filtering, IFFT processing, and data comparison operations in method 400 have only been performed once, so method 400 proceeds to step S407, where the point in the original time series is regarded as a quasi-outlier point, and these quasi-outlier points are interpolated to obtain a second time series.

[0085] Specifically, interpolating the point in the original time series may include replacing the value indicated by the point in the original time series with an average value of data indicated by adjacent points (a previous point and a subsequent point) of the point in the original time series.

[0086] Then, the method 400 returns to step S401 and applies FFT, high-frequency filtering, and IFFT processing to the second time series again to obtain a third time series.

[0087] In step S403 , the data indicated by the points in the original time series are compared with the data indicated by the corresponding points in the third time series.

[0088] When the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is still greater than TH1, the method 400 proceeds to step S405, where it is determined that this is the second time to perform FFT, high-frequency filtering, IFFT processing and data comparison operations, and thus the method 400 proceeds to step S409, where the point in the original time series is determined to be an abnormal point of the original time series.

[0089] Here, the process of determining quasi-outliers in step S407, interpolating them to obtain a second time series, and then performing FFT, high-frequency filtering, and IFFT processing on the second time series in steps S401 and S403, and then comparing it with the original time series to obtain the second-screened outliers is called validity testing. Validity testing can effectively avoid false detection of outliers (i.e., misidentifying normal points as outliers), as the quasi-outliers identified by the initial FFT, high-frequency filtering, and IFFT processing, and comparison with the original time series, may be false positives.

[0090] Figure 6a and 6b The effect diagrams of the FFT-IFFT based outlier detection method without applying the validity detection according to the exemplary embodiment of the present disclosure and applying the validity detection according to the exemplary embodiment of the present disclosure are schematically shown, where the points indicated by “+” are outliers marked in two ways respectively.

[0091] Here, the FFT-IFFT-based outlier detection method without applying validity detection includes the following steps: applying FFT, high-frequency filtering, and IFFT processing to the original time series to obtain a first time series; comparing the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series; and determining the point in the original time series as an outlier when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is greater than a predetermined threshold.

[0092] like Figure 6a As shown in the figure, the FFT-IFFT-based outlier detection method without validity detection will have many falsely detected outliers. Figure 6b As shown in FIG, the FFT-IFFT-based outlier detection method with validity detection can eliminate falsely detected outliers, thereby reducing the probability of false detection.

[0093] The following will refer to Figure 7 , an outlier detection method 700 based on slowly varying features of data according to an exemplary embodiment of the present disclosure is described.

[0094] Although time series data exhibits peaks and troughs within each detection cycle, extracting data from fixed moments in each detection cycle to form a time series at that moment typically results in relatively flat changes in the data indicated by the points in the time series at that moment—that is, a slowly varying characteristic. However, outliers are often significantly distant from adjacent points in the time series at that specific moment. Therefore, this exemplary embodiment of the present disclosure proposes an outlier detection method that leverages this slowly varying characteristic of data.

[0095] First, in step S701, for a moment in the detection cycle of the node, the data detected at that moment in each detection cycle within the detection period is extracted from the original time series to generate a time series of the moment, and the points on the time series of the moment indicate the data detected at the moment in the corresponding detection cycle.

[0096] Optionally, in step S702 , the data indicated by the point in the time series at the moment is preprocessed.

[0097] The pre-processing may include at least one of the following:

[0098] discard all NaN values; and

[0099] The data were normalized.

[0100] Next, in step S703 , the distance between each point in the time series at that moment and the adjacent point is calculated.

[0101] Specifically, refer to Figure 8 The distance between each point (for example, point A) and the adjacent points (for example, B, C) in the time series at that moment is the average of the distance (d1) between the point (A) and the previous point (B) and the distance (d2) between the point (A) and the next point (C), that is, (d1+d2) / 2.

[0102] In step S705, the calculated maximum distance is compared with a predetermined threshold (herein represented by TH2). The maximum distance here refers to the maximum value among the distances calculated for each point in the time series at that moment.

[0103] In an exemplary embodiment, TH2 may be set by a grid method.

[0104] In the case that the maximum distance is greater than TH2 (“Yes” from S705 ), the method 700 proceeds to step S707 , where the point with the maximum distance is determined as an outlier.

[0105] In step S709 , the abnormal point is removed from the time series at that moment.

[0106] Next, for the other points in the time series at that moment except for the abnormal point, the preprocessing in step S702, the calculation in S703, the comparison in S705, and the determination in S707 are repeated until the calculated maximum distance does not exceed TH2, or the number of abnormal points determined exceeds a predetermined threshold (represented by TH3) (to prevent too many abnormal points from being detected) (from "No" in S705).

[0107] At this point, all abnormal points in the time series at that moment can be determined.

[0108] It is understood that, assuming that in this exemplary embodiment of the present disclosure, a detection period of one day and a granularity of 15 minutes are used, 96 time series will be generated, representing, for example, time series at 00:00, 00:15, ..., 23:45. By executing the above method 700 for each time series, all anomalies in the time series at each of the 96 moments can be determined, and their collection represents all anomalies in the original time series.

[0109] Figure 9 The effect diagram of applying the abnormal point detection method based on the slowly changing characteristics of data according to the exemplary embodiment of the present disclosure is schematically shown, wherein the “·” represents a normal point and the “+” represents an abnormal point detected by the method 700. Figure 9 It can be seen that most of the outliers can be detected accurately, that is, the missed detection of outliers (misjudging outliers as normal points) can be effectively avoided.

[0110] In order to further reduce the missed detection rate, improve the accuracy of anomaly detection, and improve the recall rate, exemplary embodiments of the present disclosure further provide a method for detecting abnormal intervals by applying a dynamic sliding window algorithm to a time series with detected abnormal points.

[0111] See below Figure 10 and 11 , an abnormal interval detection method based on a dynamic sliding window according to an exemplary embodiment of the present disclosure is described.

[0112] Figure 10 The flowchart of the abnormal interval detection method 1000 based on a dynamic sliding window according to an exemplary embodiment of the present disclosure is schematically shown.

[0113] In step S1001 , a first window is set for a time series with an abnormal point, where the first abnormal point is used as a starting position.

[0114] For the first window, an operation of determining an abnormal interval is performed in steps S1003 to S1011 .

[0115] Specifically, in step S1003 , it is determined whether the number of abnormal points in the first window reaches a predetermined threshold (here, represented by TH4 ).

[0116] When the number of outliers in the first window reaches TH4 ("Yes" in S1003), the method 1000 proceeds to step S1005, where the first window is expanded by a predetermined length to obtain a second window.

[0117] The operation of expanding the window by a predetermined length is continuously performed until at least one of the following conditions is satisfied ("Yes" from S1007):

[0118] The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or

[0119] The continuously enlarged window reaches the maximum window threshold, or

[0120] The number of outliers in the window does not reach TH4.

[0121] TH4 is variable and proportional to the current window length. For example, TH4 can be 1 / 3 of the current window length.

[0122] At this point, the method 1000 proceeds to step S1009 , where the window before the continuous expansion is determined as an abnormal interval.

[0123] When the number of outliers in the first window does not reach TH4 ("No" from S1003), method 1000 proceeds to step S1011, where the first window is translated to a third window, which has the second outlier as the starting position and has the same length as the first window.

[0124] For the third window, the above-mentioned operation of determining the abnormal interval is performed in steps S1003 to S1011.

[0125] Specifically, in step S1003 , it is determined whether the number of abnormal points in the third window reaches TH4.

[0126] When the number of outliers in the third window reaches TH4 ("Yes" in S1003), the method 1000 proceeds to step S1005, where the third window is expanded by a predetermined length to obtain a fourth window.

[0127] The operation of expanding the window by a predetermined length is continuously performed until at least one of the following conditions is satisfied ("Yes" from S1007):

[0128] The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or

[0129] The continuously enlarged window reaches the maximum window threshold,

[0130] The number of outliers in the window does not reach TH4.

[0131] At this point, the method 1000 proceeds to step S1009 , where the window before the continuous expansion is determined as an abnormal interval.

[0132] After an abnormal interval is determined, the window of the abnormal interval can be further translated to reach a fifth window, which starts at the next abnormal point after the window of the abnormal interval and has the same length as the first window.

[0133] Next, for the fifth window, the above-mentioned operation of determining the abnormal interval is performed in steps S1003 to S1011.

[0134] Figure 11 The example of applying a dynamic sliding window to detect abnormal intervals for a time series with abnormal points according to an exemplary embodiment of the present disclosure is schematically shown. Figure 11 In , a set of multiple white and gray blocks represents the time series, where each block represents a data point, the white block represents the detected normal point, and the gray block represents the detected abnormal point.

[0135] exist Figure 11 In the example shown, a smaller initial window a is first set, and the starting position of the window is the first abnormal point ( Figure 11 (The first gray block on the left in the figure), when the number of abnormal points in window a reaches TH4, window a is expanded; otherwise, it continues to move forward until the starting position of the window is the second abnormal point. Therefore, the step size of each window movement is uncertain;

[0136] Assuming that the number of abnormal points in window a does not reach TH4, that is, window a is not an abnormal interval, then window a moves to window b, and the length of window b is equal to that of window a.

[0137] If the number of outliers in window b reaches TH4 at this time, window b is expanded to window c.

[0138] Assuming that window c still meets the requirement of the number of outliers reaching TH4, window c is further expanded to window d. If at least one of the following conditions is met: the number of outliers in window d does not increase after a predetermined number of consecutive expansions, or the continuously expanded window reaches the maximum window threshold, or the number of outliers in window d does not reach TH4, window d is considered not an outlier interval, and window c is determined to be an outlier interval. Next, window c is jumped out, and the search continues for the next outlier point as the starting point of the next window aa.

[0139] It should be understood that the window cannot be expanded indefinitely. When the maximum window threshold is reached, it cannot be expanded further.

[0140] Figure 12a and 12b Effect diagrams of an abnormal interval detection method without applying the dynamic sliding window according to an exemplary embodiment of the present disclosure and with applying the dynamic sliding window according to an exemplary embodiment of the present disclosure are schematically shown respectively.

[0141] See also Figure 12a Without applying the abnormal interval detection method of the dynamic sliding window according to the exemplary embodiment of the present disclosure, only some abnormal points can be detected (in Figure 12a In the case of applying the abnormal interval detection method of the dynamic sliding window according to the exemplary embodiment of the present disclosure, the abnormal interval can be detected (in Figure 12b This enables the detection of most outliers, thereby improving the recall rate.

[0142] Figure 13 The figure schematically illustrates the accuracy and recall of detecting abnormal intervals using a dynamic sliding window according to an exemplary embodiment of the present disclosure.

[0143] Different initial sliding window lengths correspond to different recall rates and accuracy rates. When the initial sliding window length changes, the recall rate and accuracy rate also change accordingly. Taking into account the adverse effects of network traffic anomalies, combined with the characteristics of the time series data targeted by the exemplary embodiments of the present disclosure, that is, most of the abnormal intervals last for more than half a day (12*4 data points), and generally do not exceed 7 days (7*24*4 data points), an initial sliding window length with a high recall rate and relatively high accuracy is usually selected, that is, 25, and the threshold TH4 of the abnormal interval is set to 1 / 3 of the window length, the maximum window threshold is set to the number of data points in 7 days (7*24*4), and the length of each expansion of the abnormal interval is set to a random number between (5, 7).

[0144] See also Figure 14 , which schematically illustrates the relationship between attached users and success rate and network events. A one-week measurement dataset from one MME node with live traffic can be selected for verification. Network events are intermixed with additional KPI (Key Performance Indicator) degradations. KPI timestamps below a defined threshold (90%) are expected to be flagged as outliers.

[0145] Figure 15 A performance comparison diagram schematically illustrates the application of the IForest algorithm, the KNN algorithm, and the anomaly detection method according to an exemplary embodiment of the present disclosure.

[0146] from Figure 15 It can be seen that the IForest algorithm and the KNN algorithm have very low recall rates and F1 values ​​(F-measure, where α=1), which means that these two algorithms can only detect fewer anomalies. The anomaly detection method according to the exemplary embodiment of the present disclosure has a high recall rate, accuracy rate, and F1 value, which can meet the needs of anomaly detection in network traffic data.

[0147] Table 3 below also lists the detection results of outliers using the IForest algorithm, the KNN algorithm, and the outlier detection method according to an exemplary embodiment of the present disclosure.

[0148]

[0149] Table 3

[0150] It can be seen that the anomaly detection method according to the exemplary embodiment of the present disclosure can effectively avoid missed detection and false detection of anomalies in time series data, and improve the accuracy and recall rate of anomaly detection.

[0151] Below, we will refer to Figure 16 、 17 18 describe the structure of an abnormality detection device according to an exemplary embodiment of the present disclosure.

[0152] Figure 16 The figure schematically shows a structural block diagram of an abnormality detection device 1600 according to an exemplary embodiment of the present disclosure. Figure 16 The anomaly detection device 1600 may perform as previously described with reference to Figure 4 The FFT-IFFT-based outlier detection method 400 using validity detection according to an exemplary embodiment of the present disclosure is described. Therefore, some detailed descriptions of the anomaly detection device 1600 may refer to the corresponding descriptions in the FFT-IFFT-based outlier detection method 400 using validity detection as described above.

[0153] like Figure 16 As shown, the anomaly detection device 1600 may include: a processing unit 1601 , a comparison unit 1603 , an interpolation unit 1605 and a determination unit 1607 .

[0154] The processing unit 1601 is configured to apply FFT, high frequency filtering and IFFT to the original time series to obtain a first time series, wherein the points on the original time series indicate data detected within a detection period of the node.

[0155] The comparison unit 1603 is configured to compare the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series.

[0156] The interpolation unit 1605 is configured to interpolate the point in the original time series to obtain a second time series when the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is greater than TH1.

[0157] In an exemplary embodiment, the interpolation unit 1605 is configured to replace the value indicated by the point in the original time series with an average value of data indicated by adjacent points of the point in the original time series.

[0158] In an exemplary embodiment, the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is a predetermined integer multiple of the standard deviation.

[0159] The processing unit 1601 is further configured to apply the FFT, high frequency filtering and IFFT to the second time series to obtain a third time series.

[0160] The comparing unit 1603 is further configured to compare the data indicated by the points in the original time series with the data indicated by the corresponding points in the third time series.

[0161] The determining unit 1607 is configured to determine a point in the original time series as an abnormal point in the original time series when a difference between data indicated by a point in the original time series and data indicated by a corresponding point in the third time series is greater than TH1.

[0162] Figure 17 Schematically shows a structural block diagram of an abnormality detection device 1700 according to another exemplary embodiment of the present disclosure. Figure 17 The abnormality detection device 1700 may perform as previously described with reference to Figure 9 The anomaly detection method 900 based on data slowly varying features according to an exemplary embodiment of the present disclosure is described. Therefore, some detailed descriptions of the anomaly detection device 1700 may refer to the corresponding descriptions in the aforementioned anomaly detection method 900 based on data slowly varying features.

[0163] like Figure 17 As shown, the anomaly detection device 1700 may include: a sequence generating unit 1701 , a calculating unit 1703 , a comparing unit 1705 and a determining unit 1707 .

[0164] The sequence generation unit 1701 is configured to extract, for a moment in a detection cycle of a node, the data detected at the moment in each detection cycle within the detection period from the original time series to generate a time series of the moment, and the points on the time series of the moment indicate the data detected at the moment in the corresponding detection cycle.

[0165] The calculation unit 1703 is configured to calculate the distance between each point and an adjacent point in the time series of the moment.

[0166] In an exemplary embodiment, the distance between each point and an adjacent point is the average of the distances between the point and the previous point and the next point.

[0167] The comparing unit 1705 is configured to compare the calculated maximum distance with TH2.

[0168] In an exemplary embodiment, TH2 is set by a grid method.

[0169] The determining unit 1707 is configured to determine the point with the maximum distance as an abnormal point when the maximum distance is greater than TH2.

[0170] The calculation unit 1703, the comparison unit 1705, and the determination unit 1707 are further configured to repeat the calculation, comparison, and determination operations for other points in the time series at the moment except the abnormal point until the maximum distance does not exceed TH2 or the number of determined abnormal points exceeds TH3.

[0171] In an exemplary embodiment, the anomaly detection device 1700 may further include a processing unit 1702 configured to pre-process the data indicated by the points in the time series at the time moments before the calculation unit 1603 calculates the distance between each point in the time series at the time moments and its adjacent points.

[0172] In an exemplary embodiment, the preprocessing includes at least one of the following:

[0173] discard all NaN values; and

[0174] The data were normalized.

[0175] Although the present disclosure illustrates two separate anomaly detection devices 1600 and 1700, respectively, as an anomaly detection device for executing the FFT-IFFT-based anomaly detection method 400 employing validity detection and an anomaly detection device for executing the data slowly varying feature-based anomaly detection method 900, it should be understood that they may be implemented in either two separate devices or in the same device, and the present disclosure does not impose any limitation thereto.

[0176] Figure 18 The figure schematically shows a structural block diagram of an abnormal section detection device 1800 according to an exemplary embodiment of the present disclosure. Figure 18 The abnormal interval detection device 1800 can perform the above-mentioned Figure 10 The abnormal interval detection method 1000 based on a dynamic sliding window according to an exemplary embodiment of the present disclosure is described. Therefore, some detailed descriptions of the abnormal interval detection device 1800 can refer to the corresponding descriptions in the abnormal interval detection method 1000 based on a dynamic sliding window as described above.

[0177] like Figure 18 As shown, the abnormal interval detection device 1800 may include: a window setting unit 1801 , a comparison unit 1803 , a window enlarging unit 1805 and a determination unit 1807 .

[0178] The window setting unit 1801 is configured to: set a first window for a time series with an abnormal point, where the first window takes the first abnormal point as a starting position.

[0179] The comparing unit 1803 is configured to determine, for the first window, whether the number of outliers in the first window reaches TH4. In an exemplary embodiment, TH4 is proportional to the current window length.

[0180] The window expansion unit 1805 is configured to, when the number of outliers in the first window reaches TH4, expand the first window by a predetermined length to obtain a second window; and continuously expand the window by the predetermined length until at least one of the following conditions is satisfied:

[0181] The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or

[0182] The continuously enlarged window reaches the maximum window threshold,

[0183] The number of outliers in the window does not reach a fourth predetermined threshold; and

[0184] The determining unit 1807 is configured to determine the window before the continuous expansion as an abnormal interval.

[0185] The window setting unit 1801 is further configured to, when the number of outliers in the first window does not reach TH4, translate the first window to a third window, where the third window takes the second outlier as a starting position and has the same length as the first window.

[0186] The comparing unit 1803 is further configured to determine, for the third window, whether the number of abnormal points in the third window reaches TH4.

[0187] The window expansion unit 1805 is further configured to, when the number of outliers in the third window reaches TH4, expand the third window by a predetermined length to obtain a fourth window; and continuously expand the window by the predetermined length until at least one of the following conditions is satisfied:

[0188] The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or

[0189] The continuously enlarged window reaches the maximum window threshold,

[0190] The number of outliers in the window does not reach TH4.

[0191] The determining unit 1807 is further configured to determine the window before the continuous expansion as an abnormal interval.

[0192] After determining an abnormal interval, the window setting unit 1801 is further configured to: continue to translate the window of the abnormal interval to reach a fifth window, which takes the next abnormal point after the window of the above abnormal interval as the starting position and has the same length as the first window.

[0193] Although the present disclosure shows that the above-mentioned abnormal interval detection method 1000 based on the dynamic sliding window is performed by a separate abnormal interval detection device 1800, it should be understood that in an exemplary embodiment, Figure 18 The abnormal interval detection device 1800 shown may include Figure 16 The abnormality detection device 1600 shown or Figure 17 The anomaly detection device 1700 shown may be included in an anomaly detection device that performs the FFT-IFFT-based anomaly detection method 400 using validity detection and the anomaly detection method 900 based on data slowly varying features, implemented as a single device.

[0194] The following will refer to Figure 19 , the structure of an abnormality detection device according to another exemplary embodiment of the present disclosure is described. Figure 19 Schematically shows a structural block diagram of an abnormality detection device 1900 according to another exemplary embodiment of the present disclosure. Figure 19 The anomaly detection device 1900 in the embodiment can respectively execute the FFT-IFFT-based outlier detection method 400 using validity detection according to an exemplary embodiment of the present disclosure, the outlier detection method 900 based on slowly varying data features according to an exemplary embodiment of the present disclosure, and the abnormal interval detection method 1000 based on a dynamic sliding window according to an exemplary embodiment of the present disclosure. Therefore, some detailed descriptions of the anomaly detection device 1900 can refer to the corresponding descriptions of the aforementioned methods 400, 900, and 1000.

[0195] like Figure 19 As shown, the anomaly detection device 1900 includes a processing unit or processor 1901, which can be a single unit or a combination of multiple units for executing different steps of the method; a memory 1903, which stores computer-executable instructions. When the instructions are executed by the processor 1901, the anomaly detection device 1900 can execute the method 400, and / or the method 900, and / or the method 1000. For the sake of simplicity, only the schematic structure of the anomaly detection device 1900 according to the exemplary embodiment of the present disclosure is described here, and the above-mentioned references are omitted. Figure 4 、 9 The details have been detailed in methods 400, 900 and 1000 described in detail.

[0196] The abnormality detection device 1900 performs Figure 4 In the embodiment of the FFT-IFFT-based outlier detection method 400 using validity detection, when the instructions are executed by the processor 1901, the anomaly detection device 1900 performs the following operations:

[0197] Applying FFT, high frequency filtering, and IFFT to the original time series to obtain a first time series, wherein points on the original time series indicate data detected within a detection period for the node;

[0198] respectively comparing the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series;

[0199] When the difference between the data indicated by a point in the original time series and the data indicated by a corresponding point in the first time series is greater than TH1, interpolating the point in the original time series to obtain a second time series;

[0200] Applying the FFT, high frequency filtering, and IFFT to the second time series to obtain a third time series; and

[0201] When the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is greater than TH1, the point in the original time series is determined as an abnormal point in the original time series.

[0202] In an exemplary embodiment, interpolating the point in the original time series includes: replacing the value indicated by the point in the original time series with an average value of data indicated by adjacent points of the point in the original time series.

[0203] In an exemplary embodiment, TH1 is set to a predetermined integer multiple of the standard deviation of the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series.

[0204] The abnormality detection device 1900 performs Figure 9 In the embodiment of the described method 900 for detecting anomalies based on slowly varying characteristics of data, when the instructions are executed by the processor 1901, the anomaly detection device 1900 performs the following operations: for a moment in a detection cycle of a node,

[0205] extracting data detected at the time instants of each detection cycle within the detection period from the original time series to generate a time series of the time instants, wherein a point on the time series of the time instants indicates data detected at the time instants in the corresponding detection cycle;

[0206] Calculate the distance between each point and adjacent points in the time series of the moment;

[0207] Compare the calculated maximum distance with TH2; and

[0208] In the case where the maximum distance is greater than TH2, the point having the maximum distance is determined as an abnormal point.

[0209] In an exemplary embodiment, when the instruction is executed by the processor 1901, it also causes the anomaly detection device 1900 to perform the following operations: for other points in the time series of the moment except the anomaly point, repeat the calculation, comparison and determination operations until the maximum distance does not exceed TH2, or the number of determined anomaly points exceeds TH3.

[0210] In an exemplary embodiment, the distance between each point and an adjacent point is the average of the distances between the point and the previous point and the next point.

[0211] In an exemplary embodiment, when the instruction is executed by the processor 1901, it also causes the anomaly detection device 1900 to perform the following operations: before calculating the distance between each point on the time series at the moment and the adjacent point, preprocess the data indicated by the point on the time series at the moment.

[0212] The preprocessing may include at least one of the following: discarding all NaN values; and normalizing the data.

[0213] In an exemplary embodiment, TH2 is set by a grid method.

[0214] The abnormality detection device 1900 performs Figure 10In the embodiment of the described abnormal interval detection method 1000 based on a dynamic sliding window, when the instructions are executed by the processor 1901, the abnormality detection device 1900 performs the following operations:

[0215] For a time series with an abnormal point, setting a first window, wherein the first window takes the first abnormal point as a starting position; and

[0216] For the first window, an operation of determining an abnormal interval is performed, where the operation of determining the abnormal interval includes:

[0217] Determining whether the number of outliers in the first window reaches TH4;

[0218] When the number of abnormal points in the first window reaches TH4, the first window is expanded by a predetermined length to obtain a second window;

[0219] Continuously expanding the window by a predetermined length until the number of abnormal points in the window does not increase after the window is expanded for a predetermined number of times or the continuously expanded window reaches a maximum window threshold; and

[0220] The window before the continuous expansion is determined as the abnormal interval.

[0221] When the instructions are executed by the processor 1901, the anomaly detection device 1900 further performs the following operations:

[0222] If the number of outliers in the first window does not reach TH4, the first window is shifted to a third window, where the third window starts at the second outlier and has the same length as the first window.

[0223] Determining whether the number of outliers in the third window reaches TH4;

[0224] When the number of abnormal points in the third window reaches TH4, the third window is expanded by a predetermined length to obtain a fourth window;

[0225] The operation of expanding the window by a predetermined length is continuously performed until at least one of the following conditions is met:

[0226] The number of outliers in the window does not increase after the predetermined number of consecutive expansions, or the window reaches the maximum window threshold after consecutive expansions, or

[0227] The number of outliers within the window does not reach TH4; and

[0228] The window before the continuous expansion is determined as the abnormal interval.

[0229] In an exemplary embodiment, when the instruction is executed by the processor 1901, it also causes the anomaly detection device 1900 to perform the following operations: continue to translate the window serving as the abnormal interval to reach a fifth window, wherein the fifth window has the next abnormal point after the window serving as the abnormal interval as a starting position and has the same length as the first window; and perform the operation of determining the abnormal interval for the fifth window.

[0230] As described above, the anomaly detection method according to the exemplary embodiments of the present disclosure can effectively avoid missed detection and false detection of anomalies in time series data, thereby improving the accuracy and recall rate of anomaly detection.

[0231] The program running on the device according to the present disclosure may be a program that controls a central processing unit (CPU) to enable a computer to implement the functions of the embodiments of the present disclosure. The program or the information processed by the program may be temporarily stored in a volatile memory (such as a random access memory RAM), a hard disk drive (HDD), a non-volatile memory (such as a flash memory), or other memory systems.

[0232] The program for realizing each embodiment function of the present disclosure can be recorded on a computer-readable recording medium. The corresponding function can be realized by making a computer system read the program recorded on the recording medium and executing these programs. The so-called "computer system" herein can be a computer system embedded in the device, and can include an operating system or hardware (such as a peripheral device). "Computer-readable recording medium" can be a semiconductor recording medium, an optical recording medium, a magnetic recording medium, a short-term dynamic storage program recording medium or any other recording medium that is computer-readable.

[0233] The various features or functional modules of the devices used in the above embodiments can be implemented or executed by circuits (e.g., single-chip or multi-chip integrated circuits). The circuits designed to perform the functions described in this specification may include a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination of the above devices. The general-purpose processor may be a microprocessor, or any existing processor, controller, microcontroller, or state machine. The above circuits may be digital circuits or analog circuits. In the case where new integrated circuit technologies have emerged to replace existing integrated circuits due to advances in semiconductor technology, one or more embodiments of the present disclosure may also be implemented using these new integrated circuit technologies.

[0234] As described above, the embodiments of the present disclosure have been described in detail with reference to the accompanying drawings. However, the specific structure is not limited to the above-mentioned embodiments, and the present disclosure also includes any design changes that do not deviate from the main purpose of the present disclosure. In addition, various modifications can be made to the present disclosure within the scope of the claims, and embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present disclosure. In addition, components with the same effect described in the above-mentioned embodiments can be replaced with each other.

[0235] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features having similar functions disclosed in this application.

Claims

1. An anomaly detection method (400) for use in at least one of a mobile communication network, a fixed network, an Internet of Things, and a vertical vendor, comprising: Obtain network traffic data in the form of raw time series; Applying (S401) a fast Fourier transform (FFT), a high frequency filter, and an inverse fast Fourier transform (IFFT) to the original time series to obtain a first time series, wherein points on the original time series indicate data detected within a detection period for the node; Comparing the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series (S403); When the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the first time series is greater than a first predetermined threshold, interpolating the point in the original time series (S407) to obtain a second time series; Applying (S401) the FFT, high frequency filtering and IFFT to the second time series to obtain a third time series; as well as When the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is greater than the first predetermined threshold, the point in the original time series is determined (S409) as an abnormal point in the original time series.

2. The anomaly detection method (400) according to claim 1, wherein: Interpolating the point in the original time series (S407) includes: The value indicated by the point in the original time series is replaced by the average value of the data indicated by the adjacent points of the point in the original time series.

3. The anomaly detection method (400) according to claim 1 or 2, wherein: The first predetermined threshold is set to a predetermined integer multiple of a standard deviation of a difference between data indicated by a point in the original time series and data indicated by a corresponding point in the first time series.

4. The anomaly detection method (700) according to claim 1, further comprising: For a moment in the detection cycle of a node, extracting data detected at the instants of each detection cycle within the detection period to generate (S701) a time series of the instants, wherein a point on the time series of the instants indicates data detected at the instants in the corresponding detection cycle; Calculating (S703) the distance between each point and the adjacent points in the time series of the moment; Comparing the calculated maximum distance with a second predetermined threshold (S705); as well as In the case that the maximum distance is greater than a second predetermined threshold, the point having the maximum distance is determined ( S707 ) as an abnormal point.

5. The anomaly detection method (700) according to claim 4, further comprising: For other points in the time series of the moment except the abnormal point, the operations of calculating, comparing and determining are repeated until the maximum distance does not exceed the second predetermined threshold, or the number of determined abnormal points exceeds a third predetermined threshold.

6. The anomaly detection method (700) according to claim 4, wherein: The distance between each point and its adjacent points is the average of the distances between the point and the previous and next points.

7. The anomaly detection method (700) according to any one of claims 4 to 6, wherein: Before calculating the distance between each point on the time series at the moment and an adjacent point, preprocessing (S702) is performed on the data indicated by the point on the time series at the moment, wherein the preprocessing includes at least one of the following: Discard all non-numeric NaN values; as well as The data were normalized.

8. The anomaly detection method (700) according to any one of claims 4 and 5, wherein the second predetermined threshold is set by a grid method.

9. The anomaly detection method (1000) according to claim 1, further comprising: For a time series with an abnormal point, setting (S1001) a first window, wherein the first window takes the first abnormal point as a starting position; as well as For the first window, an operation of determining an abnormal interval is performed, where the operation of determining the abnormal interval includes: determining ( S1003 ) whether the number of outliers in the first window reaches a fourth predetermined threshold; When the number of abnormal points in the first window reaches a fourth predetermined threshold, the first window is expanded (S1005) by a predetermined length to obtain a second window; The operation of expanding the window (S1005) by a predetermined length is continuously performed until at least one of the following conditions is satisfied: The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or The continuously enlarged window reaches the maximum window threshold, or The number of outliers in the window does not reach a fourth predetermined threshold; and The window before the continuous expansion is determined ( S1009 ) as an abnormal section.

10. The anomaly detection method (1000) according to claim 9, further comprising: If the number of outliers in the first window does not reach a fourth predetermined threshold, the first window is translated (S1011) to a third window, where the third window takes the second outlier as a starting position and has the same length as the first window; determining ( S1003 ) whether the number of outliers in the third window reaches a fourth predetermined threshold; When the number of abnormal points in the third window reaches a fourth predetermined threshold, the third window is expanded (S1005) by a predetermined length to obtain a fourth window; The operation of expanding the window (S1005) by a predetermined length is continuously performed until at least one of the following conditions is satisfied: The number of outliers within the window does not increase after the window is expanded a predetermined number of times, or The continuously enlarged window reaches the maximum window threshold, or The number of outliers in the window does not reach a fourth predetermined threshold; and The window before the continuous expansion is determined ( S1009 ) as an abnormal section.

11. The anomaly detection method (1000) according to claim 9 or 10, wherein the fourth predetermined threshold is proportional to the current window length.

12. An anomaly detection device (1800) for a mobile communication network, a fixed network, an Internet of Things, or a vertical manufacturer, comprising: Processor(1801); as well as A memory (1803) stores computer instructions, which, when executed by the processor (1801), cause the anomaly detection device (1800) to perform the following operations: Applying a fast Fourier transform (FFT), a high-frequency filter, and an inverse fast Fourier transform (IFFT) to the network traffic data in the form of an original time series to obtain a first time series, wherein points on the original time series indicate data detected within a detection period of the node; respectively comparing the data indicated by each point in the original time series with the data indicated by the corresponding point in the first time series; When a difference between data indicated by a point in the original time series and data indicated by a corresponding point in the first time series is greater than a first predetermined threshold, interpolating the point in the original time series to obtain a second time series; Applying the FFT, high frequency filtering, and IFFT to the second time series to obtain a third time series; as well as When the difference between the data indicated by the point in the original time series and the data indicated by the corresponding point in the third time series is greater than the first predetermined threshold, the point in the original time series is determined as an abnormal point in the original time series. 13 . A computer storage medium storing computer instructions, wherein when the computer instructions are executed by at least one processor, the at least one processor is caused to perform the anomaly detection method according to claim 1 .

Images