Abnormality detection method, device, equipment and medium

Abstract

The present disclosure provides an anomaly detection method that can be applied to the field of information security. The anomaly detection method includes: obtaining target data from a target server, the target data including target data collected in response to instructions from a centralized monitoring server, the target data including table segment data; based on the table segment data, determining the average growth of the table segment data within a preset time period to obtain a predicted growth relationship; comparing the predicted growth relationship with the daily growth of the full table segment data to obtain a growth difference; and generating an anomaly alarm message when the growth difference meets a preset condition. The present disclosure also provides an anomaly detection device, equipment, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular to an anomaly detection method, apparatus, device, medium, and program product. Background Art

[0002] A database is a warehouse that organizes, stores, and manages data according to data structures. A database not only stores and manages data but also manages various data required by users. A segment is an object that occupies disk storage space. Table segments are the most common, used to store business data. The size of a table segment is closely related to the volume of application traffic. When traffic fluctuates, the size of the table segment also fluctuates in a positive correlation. For database space capacity management, it is necessary to promptly detect abnormal table segment growth to address database performance issues.

[0003] Currently, anomaly detection at the table segment level has problems such as difficulty in determining the baseline and high false alarm rate. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides an anomaly detection method, apparatus, device, medium, and program product that can detect abnormal growth of a database in a timely manner.

[0005] According to the first aspect of the present disclosure, there is provided an anomaly identification method, comprising: acquiring target data from a target server, the target data comprising target data collected in response to instructions from a centralized monitoring server, the target data comprising table segment data; based on the table segment data, determining an average growth amount of the table segment data within a preset time period to obtain a predicted growth relationship; comparing the predicted growth relationship with the daily growth amount of the full table segment data to obtain a growth amount difference; and generating an anomaly alarm message when the growth amount difference meets a preset condition.

[0006] According to an embodiment of the present disclosure, wherein the target data also includes the data collection time, based on the table segment data, determining the average growth amount of the table segment data within a preset time period, and obtaining the predicted growth relationship includes: determining the user table segment data by deleting the system data and system user data in the table segment data; when the daily growth amount of the user table segment data within the preset time period is negative, determining the growth cycle of the table segment data according to the data collection time; determining a first average daily growth amount according to the growth cycle of the table segment data, the first average daily growth amount being the average daily growth amount of the table segment data within the growth cycle; when the daily growth amount of the user table segment data within the preset time period is positive, determining a second average daily growth amount, the second average daily growth amount being the average daily growth amount of the table segment data; and obtaining the predicted growth relationship based on the first average daily growth amount and the second average daily growth amount.

[0007] According to an embodiment of the present disclosure, when the daily growth amount of user table segment data is negative within a preset time period, determining the growth period of the table segment data according to the data collection time includes: determining the time difference data of the table segment data according to the data collection time; when the time difference data only meets the first preset condition, determining the growth period of the table segment data to be the first period; when the time difference data only meets the second preset condition, determining the growth period of the table segment data to be the second period; when the time difference data does not meet the first preset condition and does not meet the second preset condition, determining the growth period of the table segment data to be the third period.

[0008] According to an embodiment of the present disclosure, determining the first average daily growth amount based on the growth cycle of the table segment data also includes: marking the table segment data corresponding to the first cycle as a first cycle cleaning relationship based on the first cycle; marking the table segment data corresponding to the second cycle as a second cycle cleaning relationship based on the second cycle; marking the table segment data corresponding to the third cycle as a third cycle cleaning relationship based on the third cycle; and recording the table segment cleaning time corresponding to the first cycle, the second cycle and the third cycle.

[0009] According to an embodiment of the present disclosure, determining the first average daily growth amount according to the growth cycle of the table segment data includes: determining the first sub-average daily growth amount of the table segment data according to the first cycle; determining the second sub-average daily growth amount of the table segment data according to the second cycle; determining the third sub-average daily growth amount of the table segment data according to the third cycle; wherein the first average daily growth amount includes the first sub-average daily growth amount, the second sub-average daily growth amount and the third sub-average daily growth amount.

[0010] According to an embodiment of the present disclosure, the predicted growth relationship includes data cleaning type and predicted average daily growth; the data cleaning type includes first-cycle cleaning relationship, second-cycle cleaning relationship, third-cycle cleaning relationship and non-cleaning relationship; the predicted average daily growth includes first average daily growth and second average daily growth.

[0011] According to an embodiment of the present disclosure, wherein the full-scale segment data includes multiple single-scale segment data, comparing the predicted growth relationship with the daily growth of the full-scale segment data to obtain the growth difference includes: determining the data cleaning type of the single-scale segment data based on the full-scale segment data; determining the predicted average daily growth of the predicted growth relationship based on the data cleaning type; and comparing the predicted average daily growth with the daily growth of the single-scale segment data to obtain the growth difference.

[0012] According to an embodiment of the present disclosure, the predicted growth relationship is compared with the daily growth of the full-scale segment data to obtain the growth difference, which includes: obtaining a first data volume and a second data volume, the first data volume being the data volume of the full-scale segment data on the current day, and the second data volume being the data volume of the full-scale segment data on the previous day; determining the daily growth of the full-scale segment data based on the first data volume and the second data volume; and comparing the predicted growth relationship with the daily growth of the full-scale segment data to obtain the growth difference.

[0013] According to an embodiment of the present disclosure, obtaining target data from a target server includes: responding to a timed collection instruction from a centralized monitoring server, reading server data to be collected, the server data including first collection data and second collection data, the first collection data including an identifier of the target server, and the second collection data including an identifier of the target data; connecting to the target server based on the first collection data; and obtaining target data from the target server based on the second collection data.

[0014] According to a second aspect of the present disclosure, an anomaly detection device is provided, including: an acquisition module for acquiring target data of a target server, the target data including target data collected in response to an instruction of a centralized monitoring server, the target data including table segment data and data collection time; a determination module for determining the daily growth of table segment data within a preset time period based on the table segment data, and calculating the average daily growth of the table segment data, and generating a predicted daily growth mechanism table; and an alarm module for comparing the daily growth of the full table segment data with the predicted daily growth mechanism table, and generating an abnormal alarm message when the daily growth of the full table segment data exceeds a preset threshold.

[0015] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned abnormality detection method.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned abnormality detection method.

[0017] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, which implements the above-mentioned anomaly detection method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 A diagram schematically illustrates an application scenario of an anomaly detection method and an anomaly detection device according to an embodiment of the present disclosure;

[0020] Figure 2 The following schematically shows a flow chart of an anomaly detection method according to an embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram of obtaining a predicted growth relationship according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 4 A schematic diagram of determining a growth period of table segment data according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 Schematically shows a flow chart of a mark-cleaning relationship according to an embodiment of the present disclosure;

[0024] Figure 6 Schematically shows a flow chart for determining a first average daily growth amount according to an embodiment of the present disclosure;

[0025] Figure 7 A flowchart schematically illustrates a comparison of the predicted growth relationship with the daily growth of the full-scale segment data according to an embodiment of the present disclosure;

[0026] Figure 8 Schematically shows a flow chart of obtaining the growth difference according to an embodiment of the present disclosure;

[0027] Figure 9 Schematically shows a flow chart of acquiring target data from a target server according to an embodiment of the present disclosure;

[0028] Figure 10 Schematically shows a structural block diagram of an abnormality detection device according to an embodiment of the present disclosure; and

[0029] Figure 11 A block diagram of an electronic device suitable for implementing the abnormality detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0031] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0033] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0034] An embodiment of the present disclosure provides an anomaly identification method, including: obtaining target data from a target server, the target data including target data collected in response to instructions from a centralized monitoring server, the target data including table segment data; based on the table segment data, determining the average growth of the table segment data within a preset time period to obtain a predicted growth relationship; comparing the predicted growth relationship with the daily growth of the full table segment data to obtain a growth difference; and generating an abnormal alarm message when the growth difference meets a preset condition.

[0035] Figure 1 The following schematically illustrates an application scenario of an anomaly identification method and an anomaly detection device according to an embodiment of the present disclosure.

[0036] like Figure 1 As shown, the application scenario 100 according to this embodiment may include an anomaly detection method and an anomaly detection apparatus. A network 104 is used to provide a medium for a communication link between terminal devices 101, 102, 103 and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0037] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0038] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0039] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0040] It should be noted that the anomaly detection method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the anomaly detection device provided in the embodiments of the present disclosure can generally be set in the server 105. The anomaly detection method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the anomaly detection device provided in the embodiments of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0041] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0042] The following will be based on Figure 1 The scene described by Figures 2 to 9 The anomaly detection method of the disclosed embodiment is described in detail.

[0043] Figure 2 The flowchart of the abnormality detection method according to the embodiment of the present disclosure is schematically shown.

[0044] like Figure 2 As shown, the method of this embodiment includes operations S201 to S204.

[0045] In operation S201 , target data is acquired from a target server.

[0046] According to an embodiment of the present disclosure, upon receiving instructions from a centralized monitoring server, an anomaly detection device can collect target data from a target server. The centralized monitoring server is used to centrally monitor all servers. The instructions from the centralized monitoring server include collecting data from multiple target servers. The collected target data includes table segment data. Table segment data includes user name, table segment name, table partition name, table segment type, table space name, table segment byte count, table segment row count, table segment average row length, and the last time a table segment was analyzed.

[0047] In operation S202 , based on the table segment data, an average growth amount of the table segment data within a preset period is determined to obtain a predicted growth relationship.

[0048] According to an embodiment of the present disclosure, the table segment data includes multiple single-segment data, each of which includes a table segment type. After acquiring the table segment data, the average growth of the multiple single-segment data in the table segment data within a preset time period is determined, and then a predicted growth relationship is obtained. The predicted growth relationship can be expressed in various forms, for example, the predicted growth relationship can be a predicted growth table.

[0049] According to an embodiment of the present disclosure, the preset period can be one year, half a year, or three months. The specific selection is determined based on the actual needs of the detection. For example, the preset period can be 12 months. The average growth of the table segment data within 12 months is obtained, and the historical table segment data within 12 months is analyzed to obtain a predicted growth relationship.

[0050] In operation S203 , the predicted growth relationship is compared with the daily growth amount of the full-scale segment data to obtain a growth amount difference.

[0051] According to the embodiments of the present disclosure, the full table segment data is the actual measured full table segment data, including the user name, table segment name, and the number of table segment rows. The full table segment data includes multiple single table segment data, each of which has its own table segment name. After determining the single table segment data based on the full segment data, the daily growth of the single table segment data is compared with the corresponding table segment data in the predicted growth relationship to obtain the growth difference of the single table segment data, and finally the growth difference of the full table segment data is obtained.

[0052] According to an embodiment of the present disclosure, for example, after determining the table segment name of a single table segment data in the full table segment data, the data type of the table segment is determined in the predicted growth relationship. After determining the data type, the predicted growth relationship of the single table segment data is determined to obtain the difference in actual daily growth of the single table segment data and the growth amount of the predicted growth relationship.

[0053] In operation S204 , when the growth amount difference meets a preset condition, abnormality alarm information is generated.

[0054] According to the embodiments of the present disclosure, when the growth difference meets preset conditions, an abnormal growth in the full table segment data can be detected, and an abnormality alarm message needs to be generated to alert relevant testers. For example, the abnormality alarm message includes the table segment name, table segment type, and abnormal growth amount of the abnormal table segment in the full table segment data. For example, the form of generating the abnormality alarm message includes: pushing an abnormality detection flag, generating an abnormality log, etc.

[0055] According to an embodiment of the present disclosure, by setting a preset threshold, when the growth difference exceeds the preset threshold, it is considered that abnormal growth exists, and abnormal alarm information is generated. The preset threshold can be set according to the predicted growth relationship. For example, when the growth difference exceeds 80% of the average daily growth of the single table segment data, the single table segment data has abnormal growth and it is necessary to generate abnormal alarm information. It should be noted that the specific growth amount can be set according to actual needs. For example, the predicted threshold can be 80%, 100%, 120%, etc. of the average daily growth of the table segment data of this data type in the predicted growth relationship.

[0056] According to an embodiment of the present disclosure, an Oracle database is selected as the target database. After the target data of the Oracle database is collected, the table segment data of the Oracle database is determined. Based on the table segment data of the Oracle database, the daily growth of the table segment data in the Oracle database over a period of 12 months is determined. After calculating the average daily growth, a predicted growth relationship for the table segment data is generated. After obtaining the full table segment data of the Oracle database, the predicted growth relationship is compared with the daily growth of the full table segment data. When the growth difference exceeds a preset threshold, an alarm message is generated. The preset threshold can be 100% of the average daily growth of the corresponding data in the predicted growth relationship.

[0057] The present disclosure provides an anomaly detection method that can predict the growth of database table segment data by processing historical data to obtain a predicted growth relationship. The method compares the actual full table segment data with the predicted growth relationship to detect abnormal growth in the database table segment data, resolving the issues of unstable anomaly detection baselines and high false alarm rates at the table segment level. Furthermore, the predicted growth relationship obtained by the present disclosure can detect and record database table segment data in real time. When performance issues arise in the database, timely problem analysis can be performed based on the recorded predicted growth relationship, reducing the time required to find the problem.

[0058] Figure 3 A schematic diagram of obtaining a predicted growth relationship according to an embodiment of the present disclosure is schematically shown.

[0059] like Figure 3 As shown, the method of this embodiment includes operations S301 to S305.

[0060] In operation S301, user table segment data is determined by deleting system data and system user data in the table segment data.

[0061] According to an embodiment of the present disclosure, table segment data includes user table segment data and system table segment data, and system table segment data includes system data and system user data. After obtaining the table segment data, the system data and system user data are determined based on the user name and table segment name. The system data and system table segment data in the table segment data are deleted to obtain the user table segment data. For example, the table segment data may be a table segment list, which includes the user name, table segment name, table segment type, etc. When data filtering is required, the corresponding table segment data can be found based on the table segment name and user name in the table segment list.

[0062] In operation S302 , when the daily growth amount of the user table segment data is negative within a preset period, a growth cycle of the table segment data is determined according to the data collection time.

[0063] According to an embodiment of the present disclosure, the target data also includes a data collection time, which is the collection time of the table segment data. Based on the collection time of the target data, the anomaly detection device can obtain the daily growth of the user table segment data and the system table segment data in the table segment data. The daily growth of the user table segment data can represent the growth of the number of users within a preset time period, and the daily growth of the user table segment data can be positive or negative. When the daily growth of the user table segment data is negative, the user table segment data needs to be cleaned up in order to clean up the space occupied by the system in a timely manner. It should be noted that although data with negative daily growth needs to be cleaned up, other cleaning information can be obtained from the negative daily growth data before the data is cleaned up, such as the regularity of the cleaning day, analysis of external factors that cause the negative cleaning day growth, etc. Based on the data collection time, it can also be determined whether the table segment data has date similarity, and the user table segment data with negative daily growth can be processed to determine the growth cycle of the table segment data.

[0064] In operation S303 , a first average daily growth amount is determined according to a growth cycle of the table segment data.

[0065] According to embodiments of the present disclosure, by comparing the data collection time of table segment data, it is possible to determine the date similarity of the table segment data, determine the growth cycle of the table segment data, and then calculate the average daily growth of the table segment data within the growth cycle. When the daily growth of user table segment data is negative, a first average daily growth of the table segment data is obtained. The first average daily growth is the average daily growth of the table segment data within the growth cycle. User table segment data can have multiple growth cycles.

[0066] According to embodiments of the present disclosure, user table segment data can have multiple date similarities, and the corresponding user table segment data can have multiple growth cycles. For example, if the data collection time for negative daily growth is always on the 1st of each month, the growth cycle of the user table segment data is one month; if the data collection time for negative daily growth is every Wednesday with a two-week interval, the growth cycle of the user table segment data is two weeks.

[0067] In operation S304 , when the daily increment of the user table segment data is positive within the preset period, a second average daily increment is determined, where the second average daily increment is the average daily increment of the table segment data.

[0068] According to an embodiment of the present disclosure, when the daily growth rate of user table segment data is positive, it indicates that the table segment data can be processed and the user volume growth analysis can be performed. A positive daily growth rate of user table segment data indicates that the table segment data does not need to be cleared. The system can analyze based on the positive growth of the user volume and adopt corresponding analysis strategies. The table segment data with a positive daily growth rate is processed to obtain a second average daily growth rate. The second average daily growth rate is the average daily growth rate of the table segment data, and there is no need to determine the growth cycle.

[0069] In operation S305 , a predicted growth relationship is obtained based on the first average daily growth amount and the second average daily growth amount.

[0070] According to an embodiment of the present disclosure, the first average daily growth is the average daily growth of the table segment data with a negative daily growth during the growth period, and the second average daily growth is the average daily growth of the table segment data with a positive daily growth. Based on the first average daily growth and the second average daily growth, the average daily growth under different circumstances can be obtained. After obtaining the average daily growth under different circumstances, a comprehensive predicted growth relationship can be obtained. The predicted growth relationship can predict the daily growth of the table segment data in different time periods and can be used as a standard for judging whether there is an abnormality in the daily growth.

[0071] Figure 4 The following schematically illustrates a method for determining a growth period of table segment data according to an embodiment of the present disclosure.

[0072] like Figure 4 As shown, the method of this embodiment includes operations S401 to S404.

[0073] In operation S401 , time difference data of table segment data is determined according to data collection time.

[0074] According to an embodiment of the present disclosure, the target data includes table segment data and data collection time, and there is a one-to-one relationship between the table segment data and the data collection time. The table segment data includes multiple single table segment data, and the single table segment data is subtracted according to the data collection time to obtain single table segment time difference data about the single table segment data. The time difference data of the table segment data includes multiple single table segment time difference data. The time difference data can represent the time difference relationship between two table segment data and can determine whether there is a growth cycle between the two table segment data. For example, when the time difference data of the single table segment data is 7, it indicates that the single table segment data may have a time similarity with a growth cycle of 7; when the time difference data is 10, it indicates that the single table segment data may have a time similarity with a growth cycle of 10. It should be noted that the time difference data can also be 5, 28, 30, etc., and is not limited to 7 and 10 as described above.

[0075] According to an embodiment of the present disclosure, still using an Oracle database as an example, table segment data is a table segment list, which includes single-segment data for multiple table segment names. The data in the single-segment data is arranged in chronological order of collection time. The data collection time of the next row of data in the single-segment data is subtracted from the data collection time of the previous row of data. This subtraction is performed row by row for all data using the above method to obtain time difference data. For example, if the table segment name of the single-segment data is A, and the time difference data corresponding to table segment A is 7, this indicates that table segment A has a time similarity of 7 growth cycles.

[0076] In operation S402 , when the time difference data only satisfies the first preset condition, it is determined that the growth period of the table segment data is the first period.

[0077] According to an embodiment of the present disclosure, the first preset condition may be that the time difference data is not equal to 7, 28, 29, 30, or 31. When the time difference data only meets the first preset condition, it indicates that the table segment data corresponding to the time difference data does not have weekly or monthly similarity. The table segment data is determined to be table segment data with a growth period of the first period, where the first period is one day.

[0078] In operation S403 , when the time difference data only satisfies the second preset condition, it is determined that the growth period of the table segment data is the second period.

[0079] According to an embodiment of the present disclosure, the second preset condition may be that the time difference data is equal to 7. When the time difference data only meets the second preset condition, it indicates that the table segment data corresponding to the time difference data has weekly similarity. The table segment data is determined to be table segment data with a growth period of the second period, where the second period is one week.

[0080] According to an embodiment of the present disclosure, after determining the first period, the table segment data with a growth period of the first period is extracted from the total table segment data to generate table segment data that does not include a growth period of the first period. The table segment data that does not include a growth period of the first period is further judged. At this time, when there is table segment data in the remaining table segment data that meets the second preset condition, it is determined that the growth period of the table segment data is the second period. The table segment data with a growth period of the second period is then extracted from the remaining table segment data to generate table segment data that does not include a growth period of the first period and does not include a growth period of the second period, and subsequent processing is performed. Since there is a one-to-one relationship between the table segment data and the data collection time, and the time difference data is obtained based on the data collection time, the corresponding time difference data can be obtained based on the table segment data, and the corresponding table segment data can also be obtained based on the time difference data. For example, the table segment data includes table segment A, table segment B, and table segment C, and the time difference data includes 7 and 30. When the time difference data is 7, table segment A and table segment B can be found according to the table segment name recorded in the time difference data, that is, the time difference data of table segment A and table segment B is 7; according to the table segment name recorded in the time difference data 30, table segment C can be found, that is, the time difference data of table segment C is 30.

[0081] In operation S404 , when the time difference data does not satisfy the first preset condition and does not satisfy the second preset condition, it is determined that the growth period of the table segment data is the third period.

[0082] According to an embodiment of the present disclosure, when the time difference data does not meet both the first and second preset conditions, it indicates that the table segment data corresponding to the time difference data does not have weekly similarity and does not meet the first cycle (day). Therefore, the time difference data meets monthly cycle similarity, and the growth cycle of the table segment data is determined to be the third cycle, which is one month. It should be noted that one month in this case can include 28 days, 29 days, 30 days, and 31 days.

[0083] For example, the total segment data includes segment data A with a first growth cycle, segment data B with a second growth cycle, and other segment data C. The total time difference data includes time difference data A1, time difference data B1, and time difference data C1. When time difference data A1 only satisfies the first preset condition, segment data A corresponding to time difference data A1 is extracted, and the growth cycle of segment data A is determined to be the first cycle. The remaining segment data only includes segment data B and segment data C, and the remaining time difference data only includes time difference data B1 and time difference data C1. When time difference data B1 only satisfies the second preset condition, segment data B corresponding to time difference data B1 is extracted, and the growth cycle of segment data B is determined to be the second cycle. The remaining segment data only includes segment data C, and the remaining time difference data only includes time difference data C1. When time difference data C1 does not satisfy both the first and second preset conditions, the growth cycle of segment data C is determined to be the third cycle.

[0084] Figure 5 The flowchart of marking and cleaning relationship according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 5 As shown, the method of this embodiment includes operations S501 to S504.

[0086] In operation S501 , according to a first cycle, table segment data corresponding to the first cycle is marked as a first cycle cleanup relationship.

[0087] According to an embodiment of the present disclosure, based on determining the first cycle, table segment data with a growth cycle of the first cycle is marked as being in a first cycle cleanup relationship.

[0088] In operation S502 , according to the second cycle, the table segment data corresponding to the second cycle is marked as a second cycle cleanup relationship.

[0089] In operation S503 , according to the third cycle, the table segment data corresponding to the third cycle is marked as a third cycle cleanup relationship.

[0090] According to an embodiment of the present disclosure, after obtaining the actual full-scale segment data, the data cleaning relationship in the full-scale segment data is determined, and then the actual daily growth of the full-scale segment data is compared with the predicted growth relationship through the periodic cleaning relationship to obtain the growth difference. For example, after obtaining the full-scale segment data, the data cleaning relationship of the single-scale segment data in the full-scale segment data is determined to be the second-period cleaning relationship, and the predicted daily growth corresponding to the second-period cleaning relationship in the predicted growth relationship is determined based on the second-period cleaning relationship. The actual daily growth of the single-scale segment data is compared with the predicted daily growth to obtain the single-scale segment growth difference, and then the growth difference of the full-scale segment data is obtained.

[0091] In operation S504 , the table segment cleaning times corresponding to the first cycle, the second cycle, and the third cycle are recorded.

[0092] According to the embodiments of the present disclosure, after marking the table segment data corresponding to the growth cycle, the table segment cleanup time corresponding to the growth cycle is recorded, which can be used to analyze the table segment data with negative growth. For example, if the growth cycle is one week, and Wednesday is the table segment cleanup time every week, based on the table segment cleanup time, staff can identify other factors affecting Wednesday. After determining the influencing factors, appropriate actions can be taken to improve business.

[0093] Figure 6 The flowchart of determining the first average daily growth amount according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 6 As shown, the method of this embodiment includes operations S601 to S603.

[0095] In operation S601 , a first sub-average daily growth amount of table segment data is determined according to a first period.

[0096] According to an embodiment of the present disclosure, when the first period is one day, the table segment data corresponding to the first period is processed to calculate the first sub-average daily growth amount of the table segment data.

[0097] In operation S602 , a second sub-average daily growth amount of the table segment data is determined according to the second period.

[0098] According to an embodiment of the present disclosure, when the first period is one week, the table segment data corresponding to the second period is processed to calculate the second sub-average daily growth of the table segment data. When calculating the second sub-average daily growth, it is necessary to delete the table segment data for the day of the table segment cleanup time, and calculate the second sub-average daily growth excluding the table segment data for the day of the table segment cleanup time. For example, when the second period is one week and the table segment cleanup time is Wednesday, the second sub-average daily growth is calculated based on the table segment data corresponding to the other six days excluding Wednesday.

[0099] In operation S603 , a third sub-average daily growth amount of the segment data is determined according to the third period.

[0100] According to an embodiment of the present disclosure, when the first cycle is one month, the table segment data corresponding to the third cycle is processed to calculate the third sub-average daily growth of the table segment data. When calculating the third sub-average daily growth, it is also necessary to delete the table segment data on the day of the table segment cleaning time, and calculate the second sub-average daily growth that does not include the table segment data on the day of the table segment cleaning time, but the calculated average date is based on the 29-day average standard. For example, when the third cycle is one month, the table segment cleaning time is the 15th of each month, and the month is January, which has 31 days. At this time, the table segment data on the 15th is cleaned up, and based on the 29-day average standard, all daily growth amounts are summed up and divided by 29 to obtain the second sub-average daily growth.

[0101] According to an embodiment of the present disclosure, the predicted growth relationship includes a data cleanup type and a predicted average daily growth amount. The data cleanup type is used to compare the daily growth amount of the full table segment data with the predicted average daily growth amount of the corresponding data cleanup type in the predicted growth relationship. The predicted average daily growth amount includes a first average daily growth amount and a second average daily growth amount. The first average daily growth amount includes a first sub-average daily growth amount, a second sub-average daily growth amount, and a third sub-average daily growth amount.

[0102] According to an embodiment of the present disclosure, data cleaning types include a first-period cleaning relationship, a second-period cleaning relationship, a third-period cleaning relationship, and a non-cleaning relationship. When the daily growth of user table segment data is positive, the second average daily growth is obtained and the user table segment data with a positive daily growth is marked as a non-cleaning relationship.

[0103] According to an embodiment of the present disclosure, the predicted growth relationship is a predicted value obtained based on historical data, and the predicted growth relationship is updated every day according to the new data entered, ensuring that the predicted growth relationship can be updated in time according to changes in the database.

[0104] The present invention processes the table segment data with negative growth amounts, and obtains the predicted growth relationship by deleting the table segment data corresponding to the day of table segment cleaning time. This can ensure that the predicted average daily growth amount is not affected by unstable data on the data cleaning day, and can accurately determine whether there is abnormal growth in the table segment data, thereby solving the problem of unstable baseline in anomaly detection.

[0105] Figure 7 A flowchart is schematically shown for comparing the predicted growth relationship with the daily growth amount of the full-scale segment data according to an embodiment of the present disclosure.

[0106] like Figure 7 As shown, the method of this embodiment includes operations S701 to S703.

[0107] In operation S701 , a data cleaning type of single-segment data is determined based on full-segment data.

[0108] According to an embodiment of the present disclosure, the full-volume segment data includes multiple single-segment data, each of which includes its own segment name, data collection time, number of segment rows, and other data. The actual daily growth of the single-segment data can be determined based on the full-volume segment data. When the actual daily growth is positive, the type of the single-segment data is determined to be a non-cleaning relationship; when the actual daily growth is negative, the type of the single-segment data is determined to be a periodic cleaning relationship. When the actual daily growth is negative, the growth period of the single-segment data is determined based on the data collection time, and the type of the single-segment data is determined to be a first-cycle cleaning relationship, a second-cycle cleaning relationship, or a third-cycle cleaning relationship.

[0109] In operation S702 , based on the data cleaning type, a predicted average daily growth amount of the predicted growth relationship is determined.

[0110] According to an embodiment of the present disclosure, after determining the data cleansing type of the table segment data, a predicted average daily growth corresponding to the cleansing type in a predicted growth relationship is determined based on the data cleansing type. After determining the predicted average daily growth, the actual daily growth is compared with the predicted average daily growth.

[0111] In operation S703 , the predicted average daily growth amount is compared with the daily growth amount of the single-segment data to obtain a growth amount difference.

[0112] According to an embodiment of the present disclosure, after determining the predicted average daily growth, the daily growth of the single-segment data is compared with the predicted average daily growth to obtain the growth difference between the predicted average daily growth and the daily growth of the single-segment data, so as to judge the growth difference and determine whether there is abnormal growth.

[0113] Figure 8 The flowchart of obtaining the growth difference according to an embodiment of the present disclosure is schematically shown.

[0114] like Figure 8 As shown, the method of this embodiment includes operations S801 to S803.

[0115] In operation S801 , a first data volume and a second data volume are acquired.

[0116] According to an embodiment of the present disclosure, the first data volume is the data volume of the full-scale segment data on the current day, and the second data volume is the data volume of the full-scale segment data on the previous day. The first data volume and the second data volume are data collected by the anomaly detection device in response to instructions from the centralized monitoring server.

[0117] In operation S802 , a daily growth amount of full-scale segment data is determined based on the first data amount and the second data amount.

[0118] According to an embodiment of the present disclosure, the first data amount is subtracted from the second data amount to obtain the actual daily growth amount of the full-scale segment data, which is used for comparison with the predicted growth relationship.

[0119] In operation S803 , the predicted growth relationship is compared with the daily growth amount of the full-scale segment data to obtain a growth amount difference.

[0120] According to the embodiments of the present disclosure, the obtained growth difference can be positive or negative. When the growth difference is positive, it indicates that the current full-scale segment data has increased positively compared to the predicted value; when the growth difference is negative, it indicates that the current full-scale segment data has decreased negatively compared to the predicted value.

[0121] Figure 9 The flowchart of acquiring target data from a target server according to an embodiment of the present disclosure is schematically shown.

[0122] like Figure 9 As shown, the method of this embodiment includes operations S901 to S903.

[0123] In operation S901 , in response to a timing collection instruction from a centralized monitoring server, server data to be collected is read.

[0124] According to an embodiment of the present disclosure, when the centralized monitoring server issues a collection instruction at regular intervals, the anomaly detection device can respond to the collection instruction and read the server data to be collected. The server data includes first collection data and second collection data, the first collection data includes the identification of the target server, and the second collection data includes the identification of the target data. For example, the first collection data includes a list of servers to be collected, and the list of servers to be collected includes the identifications or names of multiple servers that need to perform data collection. The second collection data includes the identification of the target data of the server to be collected, for example, including a data collection list of server A, and the data collection list includes a user name, a table segment name, etc.

[0125] According to an embodiment of the present disclosure, the centralized monitoring service can initiate a collection instruction at 1:00 a.m. daily or at the end of working hours, with the specific time being determined based on actual circumstances. Upon receiving the scheduled collection instruction from the centralized server, the anomaly detection device responds to the collection instruction and reads the server data to be collected.

[0126] In operation S902 , a target server is connected based on the first collected data.

[0127] According to an embodiment of the present disclosure, after reading the identifier of the target server to be collected, the anomaly detection device establishes a connection with the target server, and the connection can be established by calling an interface.

[0128] In operation S903 , target data is acquired from the target server according to the second collected data.

[0129] According to an embodiment of the present disclosure, after establishing a connection with the target server, the anomaly detection device can collect data from the target server according to the identifier of the target data in the second collected data. After completing the collection of the target data in the second collected data, the connection with the target server is disconnected.

[0130] According to an embodiment of the present disclosure, after collecting target data from a first target server, the anomaly detection device disconnects from that target server and then, based on the first collected data, reconnects to the next target server and collects target data using the second collected data. The anomaly detection device continues collecting data from multiple target servers in this manner until it completes data collection from all target servers in the first collected data, at which point the collection task ends.

[0131] Based on the above abnormality detection method, the present disclosure also provides an abnormality detection device. Figure 10 The device is described in detail.

[0132] Figure 10 The following schematically shows a structural block diagram of an abnormality detection device according to an embodiment of the present disclosure.

[0133] like Figure 10 As shown, the abnormality detection device 1000 of this embodiment includes an acquisition module 1001 , a first determination module 1002 , a second determination module 1003 and a generation module 1004 .

[0134] The acquisition module 1001 is used to acquire target data from the target server, wherein the target data includes target data collected in response to instructions from the centralized monitoring server, and the target data includes table segment data. In one embodiment, the acquisition module 1001 can be used to perform the operation S201 described above, which will not be repeated here.

[0135] The first determining module 1002 is configured to determine the average growth of the table segment data within a preset period based on the table segment data to obtain a predicted growth relationship. In one embodiment, the first determining module 1002 may be configured to perform the operation S202 described above, which will not be described in detail here.

[0136] The second determination module 1003 is used to compare the predicted growth relationship with the daily growth of the full table segment data to obtain the growth difference. In one embodiment, the second determination module 1003 can be used to perform the operation S203 described above, which will not be repeated here.

[0137] Generating module 1004 is configured to compare the daily growth of the full-scale segment data with the predicted daily growth mechanism table and generate an abnormality alarm message if the daily growth of the full-scale segment data exceeds a preset threshold. In one embodiment, generating module 1004 can be configured to perform operation S204 described above and will not be further described here.

[0138] According to an embodiment of the present disclosure, the first determination module 1002 may further include a first determination submodule, a second determination submodule, a third determination submodule, a fourth determination submodule, and a prediction submodule.

[0139] The first determination submodule is used to determine the user table segment data by deleting the system data and system user data in the table segment data. In one embodiment, the first determination submodule can be used to perform Figure 3 Operation S301 is described.

[0140] The second determining submodule is used to determine the growth period of the table segment data according to the data collection time when the daily growth amount of the user table segment data is negative within the preset period. In one embodiment, the second determining submodule can be used to perform Figure 3 Operation S302 is described.

[0141] The third determination submodule is used to determine the first average daily growth amount according to the growth cycle of the table segment data. In one embodiment, the third determination submodule can be used to perform Figure 3 Operation S303 is described.

[0142] The fourth determination submodule is used to determine the second average daily growth amount when the daily growth amount of the user table segment data is positive within the preset period, and the second average daily growth amount is the average daily growth amount of the table segment data. In one embodiment, the fourth determination submodule can be used to execute Figure 3 Operation S304 is described.

[0143] The prediction submodule is used to obtain a predicted growth relationship based on the first average daily growth amount and the second average daily growth amount. In one embodiment, the prediction submodule can be used to perform Figure 3 Operation S305 is described.

[0144] According to an embodiment of the present disclosure, the second determining submodule may include a difference determining unit, a first determining unit, a second determining unit, and a third determining unit.

[0145] The difference determination unit is used to determine the time difference data of the table segment data according to the data collection time. In one embodiment, the difference determination unit can be used to perform Figure 4 Operation S401 is described.

[0146] The first determining unit is used to determine that the growth period of the table segment data is the first period when the time difference data only meets the first preset condition. In one embodiment, the first determining unit can be used to perform Figure 4 Operation S402 is described.

[0147] The second determining unit is used to determine that the growth period of the table segment data is the second period when the time difference data only meets the second preset condition. In one embodiment, the second determining unit can be used to perform Figure 4 Operation S403 is described.

[0148] The third determining unit is used to determine that the growth period of the table segment data is the third period when the time difference data does not meet the first preset condition and does not meet the second preset condition. In one embodiment, the third determining unit can be used to perform Figure 4 Operation S404 is described.

[0149] According to an embodiment of the present disclosure, the third determining submodule includes a first relationship determining unit, a second relationship determining unit, a third relationship determining unit, and a recording unit.

[0150] The first relationship determination unit is used to mark the table segment data corresponding to the first cycle as the first cycle cleaning relationship according to the first cycle. In one embodiment, the first relationship determination unit can be used to perform Figure 5 Operation S501 is described.

[0151] The second relationship determination unit is used to mark the table segment data corresponding to the second cycle as the second cycle cleanup relationship according to the second cycle. In one embodiment, the second relationship determination unit can be used to perform Figure 5 Operation S502 is described.

[0152] The third relationship determination unit is used to mark the table segment data corresponding to the third period as the third period cleaning relationship according to the third period. In one embodiment, the third relationship determination unit can be used to perform Figure 5 Operation S503 is described.

[0153] The recording unit is used to record the table segment cleaning time corresponding to the first cycle, the second cycle and the third cycle. In one embodiment, the recording unit can be used to perform Figure 5 Operation S504 is described.

[0154] According to an embodiment of the present disclosure, the third determining submodule further includes a first increment determining unit, a first increment determining unit, and a first increment determining unit.

[0155] The first increment determination unit is used to determine the first sub-average daily increment of the table segment data according to the first period. In one embodiment, the first increment determination unit can be used to perform Figure 6 Operation S601 is described.

[0156] The second increment determination unit is used to determine the second sub-average daily increment of the table segment data according to the second period. In one embodiment, the second increment determination unit can be used to perform Figure 6 Operation S602 is described.

[0157] The third increment determination unit is used to determine the third sub-average daily increment of the table segment data according to the third period. In one embodiment, the third increment determination unit can be used to perform Figure 6 Operation S603 is described.

[0158] According to an embodiment of the present disclosure, the second determining module 1003 includes a first actual quantity determining submodule, a second actual quantity determining submodule, and a third actual quantity determining submodule.

[0159] The first actual amount determination submodule is used to determine the data cleaning type of the single table segment data based on the full table segment data. In one embodiment, the first actual amount determination submodule can be used to perform Figure 7 Operation S701 is described.

[0160] The second actual amount determination submodule is used to determine the predicted average daily growth of the predicted growth relationship based on the data cleaning type. In one embodiment, the second actual amount determination submodule can be used to perform Figure 7 Operation S702 is described.

[0161] The third actual amount determination submodule is used to compare the predicted average daily growth with the daily growth of the single table segment data to obtain the growth difference. In one embodiment, the third actual amount determination submodule can be used to perform Figure 7 Operation S703 is described.

[0162] According to an embodiment of the present disclosure, the second determining module 1003 includes a first increment determining submodule, a second increment determining submodule, and a third increment determining submodule.

[0163] The first increment determination submodule is used to obtain the first data amount and the second data amount. In one embodiment, the first increment determination submodule can be used to perform Figure 8 Operation S801 is described.

[0164] The second growth amount determination submodule is used to determine the daily growth amount of the full table segment data based on the first data amount and the second data amount. In one embodiment, the second growth amount determination submodule can be used to perform Figure 8 Operation S802 is described.

[0165] The third growth determination submodule is used to compare the predicted growth relationship with the daily growth of the full-scale segment data to obtain the growth difference. In one embodiment, the third growth determination submodule can be used to perform Figure 8 Operation S803 is described.

[0166] According to an embodiment of the present disclosure, the acquisition module 1001 includes a first acquisition submodule, a second acquisition submodule, and a third acquisition submodule.

[0167] The first acquisition submodule is used to read the server data to be collected in response to the timed collection instruction from the centralized monitoring server. In one embodiment, the first acquisition submodule can be used to execute Figure 9 Operation S903 is described.

[0168] The second acquisition submodule is used to connect to the target server based on the first collected data. In one embodiment, the second acquisition submodule can be used to execute Figure 9 Operation S902 is described.

[0169] The third acquisition submodule is used to acquire target data from the target server based on the second collected data. In one embodiment, the third acquisition submodule can be used to execute Figure 9 Operation S903 is described.

[0170] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 1001, the first determination module 1002, the second determination module 1003, the generation module 1004, the first determination submodule, the second determination submodule, the third determination submodule, the fourth determination submodule, the prediction submodule, the difference determination unit, the first determination unit, the second determination unit, the third determination unit, the first relationship determination unit, the second relationship determination unit, the third relationship determination unit, the recording unit, the first increment determination unit, the first increment determination unit, the first increment determination unit, the first actual amount determination submodule, the second actual amount determination submodule, the third actual amount determination submodule, the first increment determination submodule, the second increment determination submodule, the third increment determination submodule, the first acquisition submodule, the second acquisition submodule, and the third acquisition submodule can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, an acquisition module 1001, a first determination module 1002, a second determination module 1003, a generation module 1004, a first determination submodule, a second determination submodule, a third determination submodule, a fourth determination submodule, a prediction submodule, a difference determination unit, a first determination unit, a second determination unit, a third determination unit, a first relationship determination unit, a second relationship determination unit, a third relationship determination unit, a recording unit, a first growth amount determination unit, a first growth amount determination unit, a first growth amount determination unit, a first actual amount determination submodule, a second actual amount determination submodule, a third actual amount determination submodule, a first actual amount determination submodule, a second actual amount determination submodule, a second actual amount determination submodule, a first ... At least one of the first increment determination submodule, the second increment determination submodule, the third increment determination submodule, the first acquisition submodule, the second acquisition submodule and the third acquisition submodule can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware, or in an appropriate combination of any of them.Alternatively, at least one of the acquisition module 1001, the first determination module 1002, the second determination module 1003, the generation module 1004, the first determination submodule, the second determination submodule, the third determination submodule, the fourth determination submodule, the prediction submodule, the difference determination unit, the first determination unit, the second determination unit, the third determination unit, the first relationship determination unit, the second relationship determination unit, the third relationship determination unit, the recording unit, the first increment determination unit, the first increment determination unit, the first increment determination unit, the first actual amount determination submodule, the second actual amount determination submodule, the third actual amount determination submodule, the first increment determination submodule, the second increment determination submodule, the third increment determination submodule, the first acquisition submodule, the second acquisition submodule and the third acquisition submodule can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0171] Figure 11 A block diagram of an electronic device suitable for implementing the abnormality detection method according to an embodiment of the present disclosure is schematically shown.

[0172] like Figure 11 As shown, the electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 into a random access memory (RAM) 1103. The processor 1101 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include an onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0173] Various programs and data required for the operation of the electronic device 1100 are stored in the RAM 1103. The processor 1101, the ROM 1102, and the RAM 1103 are connected to each other via a bus 1104. The processor 1101 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 1102 and / or the RAM 1103. It should be noted that the programs may also be stored in one or more memories other than the ROM 1102 and the RAM 1103. The processor 1101 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0174] According to an embodiment of the present disclosure, electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to bus 1104. Electronic device 1100 may further include one or more of the following components connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 1108 including a hard disk; and a communication section 1109 including a network interface card such as a LAN card or a modem. Communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. Removable media 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in drive 1110 as needed, so that computer programs read from the removable media can be installed into storage section 1108 as needed.

[0175] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0176] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1102 and / or RAM 1103 described above and / or one or more memories other than ROM 1102 and RAM 1103.

[0177] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the item recommendation method provided by the embodiments of the present disclosure.

[0178] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 1101. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0179] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 1109, and / or installed from removable media 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0180] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1109 and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0181] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, languages such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0182] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0183] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0184] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for detecting anomalies, comprising: Acquiring target data from a target server, the target data including target data collected in response to an instruction from a centralized monitoring server, the target data including table segment data; Based on the table segment data, determining an average growth amount of the table segment data within a preset time period to obtain a predicted growth relationship; Comparing the predicted growth relationship with the daily growth of the full-scale segment data to obtain a growth difference; and When the growth difference meets the preset conditions, an abnormal alarm message is generated; The target data also includes the data collection time. Based on the table segment data, the average growth of the table segment data within a preset period is determined to obtain the predicted growth relationship, including: Determine user table segment data by deleting system data and system user data in the table segment data; When the daily growth amount of the user table segment data is negative within a preset period, determining the growth period of the table segment data according to the data collection time; Determining a first average daily growth amount according to a growth cycle of the table segment data, where the first average daily growth amount is an average daily growth amount of the table segment data during the growth cycle; If the daily growth amount of the user table segment data is positive within the preset time period, determining a second average daily growth amount, where the second average daily growth amount is the average daily growth amount of the table segment data; and The predicted growth relationship is obtained based on the first average daily growth amount and the second average daily growth amount.

2. The method according to claim 1, wherein When the daily growth amount of the user table segment data is negative within a preset period, determining the growth period of the table segment data according to the data collection time includes: Determining time difference data of the table segment data according to the data collection time; When the time difference data only satisfies the first preset condition, determining that the growth period of the table segment data is the first period; When the time difference data only satisfies the second preset condition, determining that the growth period of the table segment data is the second period; When the time difference data does not satisfy the first preset condition and does not satisfy the second preset condition, it is determined that the growth period of the table segment data is a third period.

3. The method according to claim 2, wherein: Determining the first average daily growth amount according to the growth cycle of the table segment data further includes: According to the first cycle, the table segment data corresponding to the first cycle is marked as a first cycle cleanup relationship; According to the second cycle, the table segment data corresponding to the second cycle is marked as a second cycle cleanup relationship; According to the third period, marking the table segment data corresponding to the third period as a third period cleanup relationship; and The table segment cleaning times corresponding to the first period, the second period, and the third period are recorded.

4. The method according to claim 3, wherein: Determining the first average daily growth amount according to the growth cycle of the table segment data includes: determining a first sub-average daily growth amount of the table segment data according to the first period; determining a second sub-average daily growth amount of the table segment data according to the second period; Determining a third sub-average daily growth amount of the table segment data according to the third period; The first average daily increase includes the first sub-average daily increase, the second sub-average daily increase and the third sub-average daily increase.

5. The method according to claim 3, wherein The predicted growth relationship includes data cleaning type and predicted average daily growth; The data cleaning types include the first cycle cleaning relationship, the second cycle cleaning relationship, the third cycle cleaning relationship and the non-cleaning relationship; The predicted average daily growth includes the first average daily growth and the second average daily growth.

6. The method according to claim 5, wherein: The full-segment data includes multiple single-segment data. The predicted growth relationship is compared with the daily growth of the full-segment data to obtain the growth difference including: Determining a data cleaning type for the single table segment data based on the full table segment data; determining a predicted average daily growth amount of the predicted growth relationship based on the data cleaning type; The predicted average daily growth amount is compared with the daily growth amount of the single table segment data to obtain a growth amount difference.

7. The method according to claim 1, wherein Comparing the predicted growth relationship with the daily growth of the full table segment data, the growth differences include: Obtaining a first data volume and a second data volume, wherein the first data volume is the data volume of the full table segment data on the current day, and the second data volume is the data volume of the full table segment data on the previous day; Determine a daily growth rate of the full table segment data based on the first data volume and the second data volume; The predicted growth relationship is compared with the daily growth of the full-scale segment data to obtain the growth difference.

8. The method according to claim 1, wherein Obtaining target data from the target server includes: In response to a timed collection instruction from a centralized monitoring server, the server data to be collected is read, wherein the server data includes first collected data and second collected data, wherein the first collected data includes an identifier of a target server, and the second collected data includes an identifier of the target data; Connecting to the target server based on the first collected data; and Target data is acquired from the target server according to the second collected data.

9. An anomaly detection device comprising: An acquisition module, which acquires target data from a target server, wherein the target data includes target data collected in response to an instruction from a centralized monitoring server, and the target data includes table segment data; A first determining module determines, based on the table segment data, an average growth amount of the table segment data within a preset period to obtain a predicted growth relationship; A second determination module compares the predicted growth relationship with the daily growth of the full-scale segment data to obtain a growth difference; and A generating module, which generates abnormal alarm information when the growth difference meets a preset condition; The target data also includes data collection time. The average growth of the table segment data within a preset period is determined based on the table segment data to obtain the predicted growth relationship, which includes: Determine user table segment data by deleting system data and system user data in the table segment data; When the daily growth amount of the user table segment data is negative within a preset period, determining the growth period of the table segment data according to the data collection time; Determining a first average daily growth amount according to a growth cycle of the table segment data, where the first average daily growth amount is an average daily growth amount of the table segment data during the growth cycle; If the daily growth amount of the user table segment data is positive within the preset time period, determining a second average daily growth amount, where the second average daily growth amount is the average daily growth amount of the table segment data; and The predicted growth relationship is obtained based on the first average daily growth amount and the second average daily growth amount.

10. An electronic device comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium storing computer-executable instructions, wherein the instructions are used to implement the method according to any one of claims 1 to 8 when executed.

12. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images