An anomaly detection method

Abstract

The application provides an anomaly detection method, which comprises: acquiring at least one key performance indicator (KPI) corresponding to a first time point, wherein the KPI comprises at least one of the number of attempts, the number of successes or the number of failures; and performing system anomaly judgment on the system state at the first time point according to the at least one KPI and a state detection model, wherein the result of the anomaly judgment comprises a normal state and an abnormal state. By using the state detection model, the KPI in a single-user or small-user scenario is subjected to system state detection and further anomaly judgment, thereby overcoming the problem that the KPI in a single-user or small-user scenario has no statistical characteristics, improving the accuracy of system detection and avoiding misjudgment.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically, to an anomaly detection method and apparatus. Background Technology

[0002] With the introduction of 5G technology, networks have become more complex. Network anomaly detection, as a core function of network operation and maintenance, faces significant challenges in various scenarios. Traditional anomaly detection relies on monitoring key network performance indicators (KPIs) to identify anomalies. However, traditional scenarios assume a large number of users and high traffic volume within the network. Therefore, KPIs (such as success rate, traffic volume, and failure reasons) possess global statistical characteristics, effectively reflecting the current network status.

[0003] Beyond traditional scenarios, anomaly detection also needs to support more unique scenarios brought about by 5G network technology. For example, gray-scale verification, second-level monitoring, new service launches, and enterprise-level business scenarios place higher demands on anomaly detection. In these scenarios, the granularity of detection needs to be refined to a small group of users or even a single user group. Because the number of transactions in a single period is very small in scenarios involving a single user or a small number of users, KPIs lack statistical regularity. In such cases, traditional anomaly detection algorithms are almost unusable.

[0004] Current methods for detecting the behavior of a single user or a small number of users are mainly based on manual testing and investigation. However, this method has a very small verification volume and a long testing cycle, which cannot meet the current needs. In response to the problems that occur in the behavior scenarios of a single user or a small number of users, this application proposes an anomaly detection method. Summary of the Invention

[0005] This application provides an anomaly detection method that uses a state detection model to systematically detect and further judge anomalies in KPIs under single-user or small-user scenarios. This overcomes the problem of the lack of statistical characteristics of KPIs under single-user or small-user scenarios, which helps to improve the accuracy of system detection and avoid misjudgment.

[0006] Firstly, an anomaly detection method is provided. This method includes: acquiring at least one key performance indicator (KPI) corresponding to a first time moment, wherein the KPI includes at least one of the following: number of attempts, number of successes, or number of failures; judging the system state at the first time moment based on the at least one KPI and a state detection model, wherein the result of the anomaly judgment includes a normal state and an abnormal state, wherein the state detection model includes different defined system states, and the defined system state corresponding to the normal state includes: system normal or occasional anomaly; wherein the state detection model is trained based on at least one training KPI and multiple initial state parameter values, wherein the initial state parameter values ​​include initial Poisson distribution parameter values ​​and initial state transition probability values, and the initial state parameter values ​​are initial values ​​defined according to business logic corresponding to different defined system states.

[0007] By using a state detection model, KPIs in single-user or small-user scenarios are systematically detected and further anomaly judgments are made. This overcomes the problem of the lack of statistical characteristics of KPIs in single-user or small-user scenarios, which helps to improve the accuracy of system detection and avoid misjudgments.

[0008] In conjunction with the first aspect, in some implementations of the first aspect, the at least one KPI corresponds one-to-one with at least one Poisson distribution parameter, the different defined system states correspond to different parameter values ​​of the at least one Poisson distribution parameter, the transition probability of the defined system state at the first moment to another defined system state corresponds to the first state transition probability value, and the transition probability between defined system states corresponds to different state transition probability values.

[0009] The state detection model in this application is based on Poisson distribution parameters and state transition probability values ​​to detect online data, which can improve the accuracy of system state detection.

[0010] In conjunction with the first aspect, in some implementations of the first aspect, the state detection model is a Poisson Hidden Markov Model (PHMM).

[0011] The model in this application embodiment conforms to the Poisson distribution, which is more in line with reality. The model in this application embodiment can be an HMM model, or it can be a neural network model, etc.

[0012] In conjunction with the first aspect, in some implementations of the first aspect, the state transition probability includes any two of the following definitions of the transition probability between system states: system normal, occasional abnormality, continuous abnormality, and system crash.

[0013] The model in this application embodiment can define different system states, and there are different state transition probabilities between different system states. By considering the state transition probabilities simultaneously, the accuracy of model detection can be improved and misjudgments can be avoided.

[0014] In conjunction with the first aspect, in some implementations of the first aspect, the definition of system state includes system normal, occasional abnormal, continuous abnormal, and system crash, and the step of judging system abnormality of system state at the first moment based on the at least one KPI and the state detection model includes: inputting the at least one KPI into the state detection model; decoding the at least one KPI input into the state detection model using the Viterbi algorithm, and judging system abnormality of system state at the first moment.

[0015] Optionally, the model in this application embodiment can be a 4th-order PHMM model. In this case, the data after model detection can be decoded to obtain the system definition and system state, thereby further determining whether the system is abnormal.

[0016] In conjunction with the first aspect, in some implementations of the first aspect, the step of decoding at least one KPI input to the state detection model using the Viterbi algorithm and determining the system state at the first moment as an anomaly includes: when the defined system state corresponding to the first moment, obtained by decoding using the Viterbi algorithm, is either normal or intermittently abnormal, determining that the system state corresponding to the first moment is in a normal state; or, when the defined system state corresponding to the first moment, obtained by decoding using the Viterbi algorithm, is either continuously abnormal or system crash, determining that the system state at the first moment is in an abnormal state.

[0017] The model in this application embodiment can further determine whether the system is abnormal based on the defined system state obtained by online detection. Optionally, the online detection model can also output the defined system state obtained by the judgment.

[0018] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: determining the defined system state corresponding to the at least one training KPI, including: system normal, occasional abnormality, continuous abnormality, and system crash.

[0019] It should be understood that before training the model, it is necessary to confirm whether the training data is complete, such as whether it includes training data corresponding to the above four states. If the data is complete, a fourth-order PHMM model can be trained based on the training data.

[0020] In conjunction with the first aspect, in some implementations of the first aspect, the definition of system state includes system normality and occasional anomalies, and the step of judging system anomalies in the system state at the first moment based on the at least one KPI and the state detection model includes: using the state detection model to perform a sliding window judgment on at least one KPI corresponding to multiple moments, wherein the multiple moments include the first moment, to obtain first data, wherein the first moment corresponds to the end moment of the sliding window; using the state detection model to calculate the fitting probability of the first data using a forward algorithm; and judging system anomalies in the system state at the first moment based on the fitting probability of the first data.

[0021] Optionally, the online detection model in this application embodiment can be a second-order PHMM model. In this case, the defined system state can include normal system and occasional abnormality. Since the data detected by the PHMM model cannot be directly decoded at this time, the system can be judged as abnormal by fitting the detected data with the data in the model to calculate the probability. This can meet the needs of detection data under different circumstances.

[0022] In conjunction with the first aspect, in some implementations of the first aspect, the step of determining the system state at the first moment based on the fitting probability of the first data includes: when the fitting probability of the first data is less than a first threshold, determining that the system state at the first moment is in an abnormal state; or, when the fitting probability of the first data is greater than or equal to the first threshold, determining that the system state at the first moment is defined as normal or occasionally abnormal, and further determining that the system state at the first moment is in a normal state.

[0023] Since the second-order PHMM model only defines two system states, but the actual online detection data may include other states besides the two system states defined in the model, the system state can be further determined by judging the fitting probability between the online detection data and the data in the model.

[0024] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: determining the defined system state corresponding to the at least one training KPI, including: system normal and occasional abnormal.

[0025] It should be understood that before training the model, it is necessary to confirm whether the training data is complete. For example, if the training data only includes the two states mentioned above, or if the training data is incomplete, a second-order PHMM model is trained based on the incomplete training data. Based on the second-order PHMM model, different state judgment methods are adopted to adapt to the needs of different situations.

[0026] In conjunction with the first aspect, in some implementations of the first aspect, the method further includes: outputting a defined system state corresponding to the first moment, wherein the defined system state includes at least one of the following: system normal, occasional abnormality, continuous abnormality, and system crash.

[0027] Optionally, the state detection model in this embodiment can also output the detected system state corresponding to the online data.

[0028] In conjunction with the first aspect, in some implementations of the first aspect, the transition probabilities between any two defined system states, namely, the transition probabilities between occasional anomalies, between persistent anomalies, between system crashes and occasional anomalies, between normal systems and persistent normal systems, between system crashes and persistent anomalies, between normal systems and persistent crashes, and between occasional anomalies and system crashes, are forcibly set to 0.

[0029] It should be understood that the state detection model in this application takes into account the transition probabilities between system states, which can further improve the accuracy of state detection. Moreover, according to business logic, the transition probabilities between certain states should be forced to be 0.

[0030] In conjunction with the first aspect, in some implementations of the first aspect, when the result of the system anomaly judgment is an abnormal state, the method further includes: sending a first message, the first message including the result of the anomaly judgment.

[0031] Optionally, when the state detection model of this application detects that the system state corresponding to the online data at a certain moment is in an abnormal state, it can report the abnormal result so that the system abnormality can be further processed.

[0032] Secondly, an anomaly detection device is provided, comprising: an acquisition module for acquiring at least one key performance indicator (KPI) corresponding to a first time moment, wherein the KPI includes at least one of the number of attempts, the number of successes, or the number of failures; and a processing module for judging the system state at the first time moment based on the at least one KPI and a state detection model, wherein the result of the anomaly judgment includes a normal state and an abnormal state, wherein the state detection model includes different defined system states, and the defined system states corresponding to the normal state include: system normal or occasional anomaly; wherein the state detection model is trained based on at least one training KPI and multiple initial state parameter values, wherein the initial state parameter values ​​include initial Poisson distribution parameter values ​​and initial state transition probability values, and the initial state parameter values ​​are initial values ​​defined according to business logic corresponding to different defined system states.

[0033] In conjunction with the second aspect, in some implementations of the second aspect, the at least one KPI corresponds one-to-one with at least one Poisson distribution parameter, the different defined system states correspond to different parameter values ​​of the at least one Poisson distribution parameter, the transition probability of the defined system state at the first moment to another defined system state corresponds to the first state transition probability value, and the transition probability between defined system states corresponds to different state transition probability values.

[0034] In conjunction with the second aspect, in some implementations of the second aspect, the state detection model is a Poisson Hidden Markov Model (PHMM).

[0035] In conjunction with the second aspect, in some implementations of the second aspect, the state transition probability includes any two of the following definitions of the transition probability between system states: system normal, occasional abnormality, continuous abnormality, and system crash.

[0036] In conjunction with the second aspect, in some implementations of the second aspect, the defined system state includes system normal, occasional abnormal, continuous abnormal, and system crash, and the processing module is specifically used to: input the at least one KPI into the state detection model; decode the at least one KPI input into the state detection model using the Viterbi algorithm, and determine the system abnormality of the system state at the first moment.

[0037] In conjunction with the second aspect, in some implementations of the second aspect, the processing module is specifically used to: determine that the system state corresponding to the first moment is in a normal state when the defined system state obtained by decoding through the Viterbi algorithm is either normal or intermittently abnormal; or determine that the system state at the first moment is in an abnormal state when the defined system state obtained by decoding through the Viterbi algorithm is either continuously abnormal or system crash.

[0038] In conjunction with the second aspect, in some implementations of the second aspect, the processing module is further configured to: determine the defined system state corresponding to the at least one training KPI, including: system normal, occasional abnormality, continuous abnormality, and system crash.

[0039] In conjunction with the second aspect, in some implementations of the second aspect, the defined system state includes system normal and occasional abnormality, and the processing module is specifically used to: use the state detection model to perform a sliding window judgment on at least one KPI corresponding to multiple time points, wherein the multiple time points include the first time point, to obtain first data, wherein the first time point corresponds to the end time of the sliding window; use the state detection model to calculate the fitting probability of the first data using a forward algorithm; and make a system abnormality judgment on the system state at the first time point based on the fitting probability of the first data.

[0040] In conjunction with the second aspect, in some implementations of the second aspect, the processing module is specifically used to: determine that the system state corresponding to the first time moment is in an abnormal state when the fitting probability of the first data is less than the first threshold, or, when the fitting probability of the first data is greater than or equal to the first threshold, determine that the system state corresponding to the first time moment is defined as normal or occasional abnormal, and further determine that the system state corresponding to the first time moment is in a normal state.

[0041] In conjunction with the second aspect, in some implementations of the second aspect, the processing module is further configured to: determine that the defined system state corresponding to the at least one training KPI includes: system normal and occasional abnormality.

[0042] In conjunction with the second aspect, in some implementations of the second aspect, the device further includes: an output module for outputting a defined system state corresponding to the first moment, wherein the defined system state includes at least one of the following: system normal, occasional abnormality, continuous abnormality, and system crash.

[0043] In conjunction with the second aspect, in some implementations of the second aspect, the transition probabilities between any two defined system states, namely, from occasional exception to occasional exception, from continuous exception to occasional exception, from system crash to occasional exception, from system normal to continuous normal, from system crash to continuous exception, from system normal to continuous crash, and from occasional exception to system crash, are forcibly set to 0.

[0044] In conjunction with the second aspect, in some implementations of the second aspect, when the result of the system anomaly judgment is an abnormal state, the device further includes: a sending module, used to send a first message, the first message including the result of the anomaly judgment.

[0045] Thirdly, a communication device is provided, which has the function of implementing the methods described in the above aspects. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0046] Fourthly, a communication device is provided, comprising: a processor; the processor being coupled to a memory for calling and running a computer program from the memory to perform the methods in any possible implementation of the foregoing aspects.

[0047] Fifthly, a communication device is provided, comprising a processor and a memory for storing a computer program, the processor for calling and running the computer program from the memory, causing the communication device to perform the methods in any possible implementation of the foregoing aspects.

[0048] Sixthly, an apparatus (e.g., a system-on-a-chip) is provided, comprising a processor for supporting the communication device in implementing the functions involved in the foregoing aspects. In one possible design, the apparatus further comprises a memory for storing program instructions and data necessary for the communication device. When the apparatus is a system-on-a-chip, it may be composed of chips or may include chips and other discrete devices.

[0049] In a seventh aspect, a computer-readable storage medium is provided for storing a computer program including instructions for performing methods as described in the foregoing aspects or any possible implementations thereof.

[0050] Eighthly, a computer program product is provided, comprising a computer program that, when run on a computer device, causes the computer device to perform the methods described in the above aspects.

[0051] These or other aspects of this application will become more apparent from the description of the following embodiments. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of an anomaly detection method according to an embodiment of this application.

[0053] Figure 2 This is an architecture diagram of an anomaly detection according to an embodiment of this application.

[0054] Figure 3 This is a schematic diagram of the Poisson parameter distribution curve corresponding to the normal state of a system according to an embodiment of this application.

[0055] Figure 4 This is a schematic diagram of the Poisson parameter distribution curve corresponding to an occasional abnormal state in an embodiment of this application.

[0056] Figure 5 This is a schematic diagram of the Poisson parameter distribution curve corresponding to a continuous abnormal state in an embodiment of this application.

[0057] Figure 6 This is a schematic diagram of the Poisson parameter distribution curve corresponding to a system crash state according to an embodiment of this application.

[0058] Figure 7 This is a state transition diagram in an HMM model according to an embodiment of this application.

[0059] Figure 8 This is a state transition diagram in another HMM model of this application embodiment.

[0060] Figure 9 This is an architecture diagram of a fourth-order model anomaly detection according to an embodiment of this application.

[0061] Figure 10 This is another architecture diagram for anomaly detection in this application.

[0062] Figure 11 This is a schematic diagram of the structure of an anomaly detection device according to an embodiment of this application.

[0063] Figure 12 This is another structural schematic diagram of an anomaly detection device according to an embodiment of this application. Detailed Implementation

[0064] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0065] The technical solutions of this application embodiment can be applied to various computer network systems and communication network systems, such as telecommunication networks, service networks, transmission networks, packet switching networks, 2G / 3G / 4G core networks, 5th generation (5G) network communication systems, and future evolving communication network systems.

[0066] With the introduction of 5G-related technologies, networks have become more complex. Network anomaly detection, as a core function of network operation and maintenance, faces significant challenges in various scenarios. Traditional anomaly detection relies on monitoring key network performance indicators (KPIs) to identify anomalies. However, traditional scenarios assume a large number of users and high traffic volume within the network, thus relying on KPIs with global statistical characteristics to effectively reflect the current network status.

[0067] In addition to traditional scenarios, anomaly detection still needs to support more special scenarios brought about by 5G network technology. Such as gray-scale verification, second-level monitoring, new service launch and enterprise-level business scenarios, which put forward higher requirements for anomaly detection. The following are some scenarios of single-user or small-scale user behavior that may be involved in this application: (1) Gray-scale verification

[0068] When launching a new service, a small group of users needs to be brought in for testing and validation. To ensure comprehensive validation coverage, users need to be further segmented for testing. For example, segmenting users by phone brand will result in a significantly larger number of Apple users compared to other brands. When validating services for niche phone brands, the number of users will be even smaller, sometimes even a single user.

[0069] (2) Second-level monitoring

[0070] To meet requirements such as low latency, networks are deployed to quickly fulfill different business needs, thus requiring high-frequency data statistics and collection to ensure second-level monitoring. However, as the time interval for data statistics shortens, the volume of business occurring within the statistical period also decreases sharply, meaning that the number of users within the statistical period is very small, or even a single user.

[0071] (3) New business launch

[0072] After a new service is launched, users will gradually connect. In the initial stage after launch, the number of users is very small, or even just one user. At this time, it is necessary to identify problems as soon as possible, reduce the scope of the failure, and quickly carry out loss-mitigation operations such as rollback and reset.

[0073] (4) Enterprise-level business

[0074] In enterprise-level businesses, the number of users is relatively small, but once a problem occurs, the impact is enormous.

[0075] The above scenarios place higher demands on anomaly detection:

[0076] 1) Real-time performance: Shorter anomaly detection cycle;

[0077] 2) Fine granularity: The granularity of anomaly detection needs to be refined to a small group of users or even a single user.

[0078] In scenarios involving only a single user or a small number of user behaviors, the limited number of transactions per cycle results in KPIs lacking statistical regularity. For example, transaction volume may approach single digits or even remain at zero for extended periods, rendering success rate calculations meaningless. In such cases, traditional anomaly detection algorithms are almost entirely inapplicable because they typically rely on fitting KPIs to make predictions and then applying thresholds. However, given the lack of statistical characteristics in these scenarios, traditional fitting methods are meaningless, and threshold-based judgments are even less applicable.

[0079] Current methods for detecting the behavior of a single user or a small number of users are mainly based on manual testing and investigation. However, this method has a very small verification volume and a long testing cycle, which cannot meet the current needs. In response to the problems that occur in the behavior scenarios of a single user or a small number of users, this application proposes an anomaly detection method.

[0080] This application provides an anomaly detection method that utilizes a state detection model trained based on business-related knowledge, including Poisson distribution parameters and state transition probabilities, to detect KPIs in scenarios involving a single user or a small number of users. This allows for the judgment of the system state corresponding to at least one KPI at a certain moment and further anomaly detection. This overcomes the problem of KPIs lacking statistical characteristics in scenarios involving a single user or a small number of users, thereby improving the accuracy of system detection and avoiding misjudgments.

[0081] The anomaly detection method provided in the embodiments of this application can be applied to various scenarios under single-user or small-scale user behavior described above, and this application does not limit it.

[0082] It should be understood that the anomaly detection method provided in the embodiments of this application can be executed by network management platforms or network monitoring platforms in various network systems. Alternatively, the anomaly detection method in the embodiments of this application can also be embedded in the modules of the service itself. After detecting online data, it can perform automated processing based on the detection results to achieve self-healing or avoidance. This application does not limit this.

[0083] Figure 1 A schematic diagram of an anomaly detection method according to an embodiment of this application is shown. Figure 1 As shown:

[0084] S101, obtain at least one key performance indicator (KPI) corresponding to the first moment.

[0085] As one example, the KPI includes at least one of the following: number of attempts, number of successes, or number of failures.

[0086] Optionally, the embodiments of this application may use a single KPI input or multiple KPI inputs for comprehensive judgment. It should be understood that the KPIs in the embodiments of this application may include other KPIs related to the number of times, and are not limited to the above three cases.

[0087] S102, based on the at least one KPI and the state detection model, perform a system anomaly judgment on the system state at the first moment.

[0088] As an example, the result of the anomaly judgment includes normal state and abnormal state. The state detection model includes different defined system states. The defined system states corresponding to the normal state include: system normal or occasional abnormal. The at least one KPI corresponds one-to-one with at least one Poisson distribution parameter. The different defined system states correspond to different parameter values ​​of the at least one Poisson distribution parameter. The transition probability of the defined system state at the first moment to another defined system state corresponds to the first state transition probability value. The transition probability between defined system states corresponds to different state transition probability values.

[0089] The state detection model in this embodiment defines different system states, such as normal system and occasional abnormal system. Optionally, it may also include persistent abnormal system and system crash. During online detection, the state detection model can determine the degree of matching between the online detection data and the data corresponding to the defined system states in the model, thereby determining the system state at the first moment. The final determined system state may include a normal state or an abnormal state. For example, if the state detection model detects that the KPI corresponding to the first moment matches the data for a normal system, it can determine that the system state at the first moment is a normal state.

[0090] Different KPIs can be associated with different types of Poisson distribution parameters. For example, for the number of successes, the corresponding parameter can be the success occurrence density, and for the number of failures, the corresponding parameter can be the failure occurrence density. Furthermore, since the state detection model in this embodiment defines different system states, different Poisson distribution parameter values ​​for each KPI can correspond to different system states. For example, when the KPIs detected online by the state detection model include the number of successes and the number of failures, when the defined system state is normal, the Poisson distribution parameter value corresponding to the number of successes can be 4, and the Poisson distribution parameter value corresponding to the number of failures can be 0.2. As another example, when the defined system state is occasional anomaly, the Poisson distribution parameter value corresponding to the number of failures can be 2, and the Poisson distribution parameter value corresponding to the number of successes can be 6; when the defined system state is continuous anomaly, the Poisson distribution parameter value corresponding to the number of failures... The distribution parameter value can be 3, and the Poisson distribution parameter value corresponding to the number of successes can be 8. When the system state is defined as system crash, the Poisson distribution parameter value corresponding to the number of failures can be 0.1, and the Poisson distribution parameter value corresponding to the number of successes can be 0.2. When the state detection model performs online detection on online data, it can match the online detection data with the Poisson distribution parameters corresponding to each KPI in each defined system state. If the match is successful, the defined system state at that moment can be determined, and the final system state can be further determined. The values ​​in each state are just examples, and they can be adjusted according to the training data in actual applications. This application embodiment does not limit this.

[0091] In this embodiment, the final result of the state detection model's judgment of the system state is not only related to the Poisson distribution parameter and the sequential relationship of the online detection data, but also to the transition probability between the defined system states. For example, if the state detection model detects that the Poisson distribution parameter values ​​corresponding to the number of successes and failures are basically consistent at multiple times, these values ​​can correspond to two states: occasional anomaly and continuous anomaly. However, according to business logic, the occasional anomaly state cannot occur continuously. In this case, the state detection model will judge the system defined state at these multiple times as continuous anomaly. Compared with the method of judging solely based on the Poisson distribution parameter value, this embodiment also adds the state transition probability as a judgment criterion, further improving the accuracy of the system state judgment and avoiding misjudgment.

[0092] As an example, the state detection model in this application embodiment can be a Poisson Hidden Markov Model (PHMM), or alternatively, a neural network model, etc. This application embodiment does not limit this.

[0093] As an example, the state transition probability includes any two of the following definitions of the transition probability between system states: system normal, occasional abnormality, continuous abnormality, and system crash.

[0094] It should be understood that the transition probability between any two defined system states includes not only the case of transition probabilities between different defined system states, but also the case of the same defined system state maintaining the current defined system state.

[0095] As an example, the state detection model is trained based on at least one training KPI and multiple initial state parameter values. The initial state parameter values ​​include initial Poisson distribution parameter values ​​and initial state transition probability values. The initial state parameter values ​​are initial values ​​defined according to business logic, corresponding to different defined system states.

[0096] The state detection model in this application embodiment can cover different situations, and the process of online detection and system state determination by the state detection model under different situations is different.

[0097] As an example, when the state detection model defines four system states, after online detection of the data, the state detection model can determine the system state according to the processing method of the HMM model in the prior art. Specifically, the defined system states include system normal, occasional abnormal, continuous abnormal, and system crash. The system abnormality judgment of the system state at the first moment based on the at least one KPI and the state detection model includes: inputting the at least one KPI into the state detection model; decoding the at least one KPI input into the state detection model using the Viterbi algorithm; and judging the system abnormality of the system state at the first moment.

[0098] Before determining the system anomaly in the system state at the first moment, the state detection model also needs to determine the defined system state corresponding to the first moment. Specifically, the step of decoding at least one KPI input to the state detection model using the Viterbi algorithm and determining the system anomaly in the system state at the first moment includes: when the defined system state corresponding to the first moment obtained by decoding using the Viterbi algorithm is normal or intermittently abnormal, the system state corresponding to the first moment is determined to be in a normal state; or when the defined system state corresponding to the first moment obtained by decoding using the Viterbi algorithm is continuously abnormal or the system is down, the system state at the first moment is determined to be in an abnormal state.

[0099] It should be understood that, since different defined system states in the embodiments of this application correspond to different Poisson distribution parameter values, when the state detection model performs online detection, it will match the KPI data at the first moment with the data of each defined system state in the model. If the match is successful, the defined system state corresponding to the current first moment will be determined.

[0100] For this situation, before obtaining the state detection model that defines the four system states, the training data will be judged first. Specifically, the method also includes: determining the defined system states corresponding to the at least one training KPI, including: system normal, occasional abnormality, continuous abnormality, and system crash.

[0101] As another example, when the state detection model only defines two different system states, but the actual online detection data may contain states different from the defined system states, if the existing technology is still used to process the HMM model, the final determined system state may not match the actual situation. For example, when the state detection model only defines two system states: normal system and occasional abnormal system, but the online detection data also includes situations of continuous abnormality or system crash, if the data detected by the state detection model is still decoded and the system state is determined, the final result may not match the actual situation. In this case, the state of the system can be determined by fitting the detection data.

[0102] Specifically, the defined system state includes normal system and occasional abnormal system, and the system abnormality judgment based on the at least one KPI and the state detection model at the first moment includes: using the state detection model to perform a sliding window judgment on at least one KPI corresponding to multiple moments, wherein the multiple moments include the first moment, to obtain first data, wherein the first moment corresponds to the end moment of the sliding window; using the state detection model to calculate the fitting probability of the first data using a forward algorithm; and judging the system abnormality based on the fitting probability of the first data at the first moment.

[0103] The state detection model detects the fitting probability between online data and the data corresponding to each defined system state in the model. When the fitting probability is greater than the threshold, it is determined that the defined system state at the first moment matches the defined system state in the state detection model; otherwise, it does not match, and the state of the system is further determined.

[0104] Specifically, the step of determining the system state at the first moment based on the fitting probability of the first data includes: when the fitting probability of the first data is less than a first threshold, determining that the system state at the first moment is in an abnormal state; or when the fitting probability of the first data is greater than or equal to the first threshold, determining that the system state at the first moment is defined as normal or occasionally abnormal, and further determining that the system state at the first moment is in a normal state.

[0105] It should be understood that this first threshold can be calculated during the training phase using a trained state detection model to perform fitting probabilities on all sliding windows of the training data. For example, if the training data length is L and the sliding window is w, L-w+1 fitting probabilities p1, ..., p(L-w+1) can be obtained. Assuming the training data is normal data, the fitting probability range for normal data is then calculated, with the mean being p. mean The standard deviation is p std p threshold =p mean -k*p std Here, k is a control parameter; the smaller k is, the more sensitive the algorithm is; the larger k is, the less sensitive the algorithm is. The fitting probability should be converted to db (i.e., assuming the obtained fitting probability is x, the fitting probability after conversion to db is 10*logx), because the original probability is only between [0, 1], but after conversion to db, its range is between [-∞, 0]. Thus, there is no problem of k values ​​exceeding the range. It should be understood that the above conversion method of fitting probability can refer to existing technologies, and this application will not elaborate further here.

[0106] It should be understood that this application involves a variety of different definitions of system states, and the transition probability values ​​between different definitions of system states are different. However, it is necessary to forcibly limit the transition probability of certain states. For example, according to the business logic definition, it is set that system crashes cannot directly jump to occasional exceptions and persistent exceptions, or persistent exceptions cannot return to occasional exceptions according to the definition. In these two cases, it is necessary to force their transition probability to 0.

[0107] Specifically, among the transition probabilities between any two defined system states, the transition probabilities between occasional anomalies, continuous anomalies, system crashes, continuous normal systems, system crashes, continuous anomalies, and occasional anomalies are forcibly set to 0.

[0108] When the state detection model determines that the system state corresponding to the first moment is in an abnormal state, the abnormal state can be reported, so that the system can be further processed. Specifically, when the result of the system abnormality judgment is an abnormal state, the method further includes: sending a first message, the first message including the result of the abnormality judgment.

[0109] Optionally, the state detection model can also output the determined defined system state. Specifically, the method further includes: outputting the defined system state corresponding to the first moment, wherein the defined system state includes at least one of the following: system normal, occasional abnormality, continuous abnormality, and system crash.

[0110] This application embodiment utilizes a state detection model, including Poisson distribution parameters and state transition probabilities, trained based on business-related knowledge, to detect KPIs in scenarios involving a single user or a small number of users. This model can then detect the system state corresponding to at least one KPI at a certain moment and further perform anomaly judgment. This overcomes the problem of KPIs lacking statistical characteristics in scenarios involving a single user or a small number of users, which helps improve the accuracy of system detection and avoids misjudgments.

[0111] Figure 2 An architecture diagram of an anomaly detection according to an embodiment of this application is shown. Figure 2 As shown, the architecture diagram includes an offline training module 210 and an online detection module 220.

[0112] 1. Offline training module 210

[0113] In the offline training module 210, offline data is used for model training. It should be understood that offline data can be trained based on an abstract original model. The Baum-Welch algorithm can be used to train the PHMM model.

[0114] It should be understood that the offline training data in the embodiments of this application can be a single indicator or multiple indicator inputs. The type of KPI can include: number of attempts, number of successes, number of failures, etc., but this application is not limited to this.

[0115] This application embodiment can model the currently detected system based on an Hidden Markov Model (HMM) and define different system states for the current system. These defined system states can also be referred to as defined system states. Optionally, the defined system states in this application can include: system normal, occasional anomaly, persistent anomaly, or system crash. It should be understood that the system states defined in this application can be determined based on actual training data. For example, if the training data is complete, sufficient data can be obtained for training under each state, resulting in a model corresponding to all defined system states, such as a 4th-order model. The defined system states include: system normal, occasional anomaly, persistent anomaly, or system crash. Alternatively, if the training data is incomplete, because the probability of persistent anomalies and system crashes is very small, training data for these two states cannot be obtained, making it difficult to train a good 4th-order HMM model. Therefore, the original 4th-order HMM model needs to be simplified to a 2nd-order HMM model, defining only the system normal and occasional anomaly states.

[0116] The KPI distribution involved in this application embodiment follows a Poisson distribution. Therefore, the state detection model in this application embodiment can be a Poisson hidden markov model (PHMM).

[0117] The specific reasoning process is as follows:

[0118] First, model the training data. The training data can include the number of attempts, the number of successes, the number of failures, etc. Since the modeling method and results for frequency-based KPIs are similar, only the modeling process for the number of failures is shown here; the others can be deduced similarly.

[0119] Suppose that the probability of a user's service success is p, and the probability of failure is q = 1 - p. With the system parameters remaining constant, if a user attempts to access the service a total of n times, then the probability of failing k times follows a binomial distribution B(n, p), as follows:

[0120]

[0121] However, since the total number of times a user connects is unknown (n times), we use the fault occurrence density λ = nq instead, then:

[0122]

[0123] According to the Poisson limit theorem, a general probability distribution can be obtained by making n→∞. The following limits are known:

[0124]

[0125]

[0126]

[0127] Therefore, we can conclude that:

[0128]

[0129] Therefore, the number of failures follows a Poisson distribution, where the Poisson distribution parameter λ is the failure density. The results for the number of successes and attempts can be deduced similarly, with λ representing the success density and attempt density, respectively.

[0130] Generally speaking, the larger λ is, the more the probability distribution tends to the right and becomes shorter and wider. This can be understood as an increase in business volume, a higher density of failures within a unit statistical period, and a larger coverage area of ​​the number of failures.

[0131] Compared to other distributions, such as the Gaussian distribution, the most reasonable aspect of the Poisson distribution is that its defined range is always positive (0, +∞), meaning that the number of failures, etc., cannot be negative. For example, the domain of the Gaussian distribution is (-∞, +∞), and both the Gaussian and Poisson distributions are necessarily symmetric. If a Gaussian distribution is used for data modeling, with the business volume approaching 0, the mean also approaches 0, and the Gaussian distribution would cover a large area of ​​negative values. This is clearly unreasonable; however, the Poisson distribution does not have this problem.

[0132] To better understand the definition of system state, specific examples are given below. In this embodiment, the training data is a 2D KPI (number of failures and number of successes) for illustration. However, the 2D KPI training in this application is merely illustrative and is not limited thereto.

[0133] During the training of the model, the λ values ​​corresponding to the number of successes and failures will be obtained. Since different system states are defined in this application embodiment, the λ values ​​corresponding to the number of successes and failures for different system states can be obtained (e.g., λ1 and λ2). It should be understood that the λ parameter values ​​corresponding to each system state in the model trained by this application need to be given reasonable initial values ​​(λ3 and λ4). These initial values ​​are defined according to the business logic and correspond to different system states. For example, they can be the initial values ​​of λ in Tables 1-4 below. For example, for the system state of normal operation, (λ3, λ4) can be (0.2, 4); for the system state of occasional abnormality, (λ3, λ4) can be (2, 6); for the system state of continuous abnormality, (λ3, λ4) can be (3, 8); and for the system state of system crash, (λ3, λ4) can be (0.1, 0.2). The specific values ​​can be adjusted according to the actual situation and business logic. This application does not limit this.

[0134] The Poisson distribution parameters corresponding to the KPIs under various defined system states are described below:

[0135] 1) System is normal

[0136] When the system is functioning normally, there are occasionally a few failures, while the number of successes remains within the normal range. Table 1 shows the correspondence between KPIs and time points under normal system conditions. The system is consistently in a normal state, with failure count λ = 0.2 and success count λ = 4. Figure 3 The diagram shows the Poisson distribution curves corresponding to the number of failures λ = 0.2 and the number of successes λ = 4. It should be understood that the curves are plotted based on the Poisson distribution probability density function. For details, please refer to the prior art. In the embodiments of this application, the λ corresponding to the number of failures and the number of successes can be values ​​defined according to business logic. The λ can also be appropriately adjusted according to the actual training data. This application does not limit this.

[0137] Table 1. Correspondence between KPI and Time Period

[0138] A B C Timestamp Number of failures Number of successes 10:30 0 30 10:31 1 24 10:32 0 10 10:33 1 33 10:34 0 23 10:35 0 19 10:36 0 23 10:37 1 11 10:38 0 22 10:39 0 32

[0139] 2) Occasional abnormalities

[0140] During occasional anomalies, the number of failures will suddenly increase compared to normal; since users will retry, the number of successes will be slightly higher. Because occasional anomalies are mostly system fluctuations that quickly heal themselves, there is no need to report the anomaly, and the system is considered to be in an anomaly-free state. Table 2 shows the correspondence between KPIs and time during occasional anomaly states. As shown in Table 2, at 10:35, an occasional anomaly occurs, at which time the number of failures λ = 2 and the number of successes λ = 6. Figure 4 The Poisson distribution curves corresponding to the number of failures λ=2 and the number of successes λ=6 are shown. It should be understood that these curves are plotted based on the Poisson distribution probability density function, and specific details can be found in existing technologies.

[0141] Table 2. Correspondence between KPI and Time Period

[0142] A B C Timestamp Number of failures Number of successes 10:30 0 30 10:31 1 20 10:32 0 23 10:33 1 32 10:34 0 27 10:35 10 60 10:36 1 40 10:37 0 23 10:38 0 11 10:39 1 36

[0143] 3) Continuous Anomalies: During a continuous anomaly, the number of failures is significantly higher than usual and remains so; due to multiple retries by users, the number of successes is significantly higher. At this point, the system clearly has a problem and needs to be reported as an anomaly. Table 3 shows the correspondence between KPIs and time during a continuous anomaly state. As shown in Table 3, from 10:32 to 10:37, a continuous anomaly occurs, at which time the number of failures λ = 3 and the number of successes λ = 8. Figure 5 The Poisson distribution curves corresponding to the number of failures λ=3 and the number of successes λ=8 are shown. It should be understood that these curves are plotted based on the Poisson distribution probability density function, and specific details can be found in existing technologies.

[0144] Table 3. Correspondence between KPI and Time Period

[0145] A B C Timestamp Number of failures Number of successes 10:30 0 30 10:31 1 20 10:32 1 23 10:33 11 32 10:34 14 27 10:35 10 60 10:36 15 40 10:37 20 23 10:38 0 11 10:39 1 36

[0146] 4) System Downtime: When the system crashes, it can no longer operate normally or users are no longer using the service, and both the number of successes and failures approach 0. At this point, the system clearly has a problem and an anomaly needs to be reported. Table 4 shows the correspondence between KPIs and time points under continuous anomaly conditions. As shown in Table 4, the system is continuously in a downtime state, with failure count λ = 0.1 and success count λ = 0.2. Figure 6 The Poisson distribution curves corresponding to the number of failures λ = 0.1 and the number of successes λ = 0.2 are shown. It should be understood that these curves are plotted based on the Poisson probability density function, and specific details can be found in existing techniques.

[0147] Table 4. Correspondence between KPI and Time Period

[0148] A B C Timestamp Number of failures Number of successes 10:30 0 0 10:31 0 0 10:32 0 0 10:33 0 1 10:34 0 0 10:35 1 0 10:36 0 0 10:37 0 1 10:38 0 0 10:39 0 0

[0149] It should be understood that the aforementioned Poisson distribution parameter values ​​correspond to the parameter values ​​of the 4th-order state detection model when the training data is complete. As mentioned above, when the training data is incomplete, the model can be simplified to obtain a 2nd-order state detection model. At this time, the Poisson distribution parameter values ​​corresponding to the defined system state of the 2nd-order model can also change accordingly. This application does not limit this.

[0150] In the process of training the model, in addition to considering the Poisson distribution parameter λ corresponding to the KPI, this embodiment of the application further considers the transition probability between any two defined system states, thereby improving the accuracy of system state judgment and avoiding misjudgment. Taking occasional anomalies and continuous anomalies as examples, as shown in Tables 2 and 3 and their corresponding λ values, the number of occurrences and the corresponding λ values ​​are not significantly different in the states of occasional and continuous anomalies. If the system state is judged solely based on the Poisson distribution parameter, the final judgment result of the model may be incorrect, i.e., occasional anomalies may be judged as continuous anomalies, or continuous anomalies may be misjudged as occasional anomalies. This embodiment of the application further considers the sequential relationship of the training data in Table 4, because according to business logic, occasional anomalies cannot occur consecutively in the data sequence. As shown in Table 3, the number of failures in the period from 10:33 to 10:37 exceeds the normal level. At this time, considering the sequential relationship of the sequence (further, i.e., the state transition probability in this embodiment of the application) can avoid misjudgment. Specifically, the transition probability between various system states is described in an exemplary manner below:

[0151] Figure 7 A state transition diagram in a state detection model according to an embodiment of this application is shown, such as... Figure 7 As shown, the system in this embodiment transitions between four defined system states, with different Poisson distribution parameters corresponding to different defined system states. For example... Figure 7 As shown in the state transition diagram, the direction and probability of state transition are represented by unidirectional arrows and probability values, and the sum of the probabilities of each state transition is 1.

[0152] Table 5 shows the data based on... Figure 7 The state transition probability matrix A, integrated from the state transition diagram, is represented by a_(i,j), where a_1,2 represents the transition probability from system normality to occasional anomaly. Based on business knowledge, the following settings are made:

[0153] Table 5 State Transition Probability Matrix A

[0154] System normal occasional abnormalities Continuous abnormality System crash System normal 0.9 0.1 0 0 occasional abnormalities 0.8 0 0.2 0 Continuous abnormality 0.2 0 0.7 0.1 System crash 0.2 0 0 0.8

[0155] Note: The bolded parts represent cases where the value is forced to 0.

[0156] 1) When the system is normal, the probability of maintaining normal operation at the next time step is relatively high, a_1,1 = 0.9, but there is a small probability of transitioning to an intermittent anomaly, a_1,2 = 0.1. We assume that the system must go through an intermittent anomaly before transitioning to a persistent anomaly, and cannot transition directly, i.e., a_1,3 = 0. At the same time, the system cannot directly transition from normal operation to system crash, i.e., a_1,4 = 0.

[0157] 2) In the event of an occasional anomaly, the system will most likely return to its normal state (a_2,1 = 0.8) at the next moment, but there is still a certain probability that it will become a persistent anomaly (a_2,3 = 0.2). Here, we assume that a persistent anomaly must transition from an occasional anomaly. According to the definition of an occasional anomaly, the occasional anomaly state cannot be persistent, i.e., a_2,2 = 0. At the same time, an occasional anomaly cannot directly jump to a system crash (a_2,4 = 0).

[0158] 3) In the event of a persistent anomaly, at the next moment, according to the definition, it is highly likely that the system will remain in a persistent anomaly state, a_3,4 = 0.7; there is a certain probability that the system will return to normal, a_3,1 = 0.2; but there is also a certain probability that the system will crash, a_3,4 = 0.1. At the same time, according to the definition, a persistent anomaly cannot return to an occasional anomaly, i.e., a_3,2 = 0.

[0159] 4) When the system crashes, there is a high probability that the system will remain in a crash state (a_4,4 = 0.8), and a certain probability that it will return to normal operation (a_4,1 = 0.2). We set that a system crash cannot directly jump to intermittent or persistent exceptions (a_4,2 = a_4,3 = 0).

[0160] The transition probabilities a_(i,j) = 0 are forced transition probabilities, meaning they are forced to be 0 during model training because, according to business logic definitions, the transition probabilities between certain system states are 0. Other transition probabilities can be obtained from the training data. Similar to the Poisson distribution parameters (λ1,λ2) of the training state outputs, reasonable initial values ​​need to be given, which can be referred to as the state transition probability matrix A in Table 6.

[0161] The above Figure 7 For the state transition diagram assuming complete training data, as described above, when the training data is incomplete, such as when training data corresponding to continuous anomalies and system crashes cannot be obtained, the model needs to be simplified to a second-order Hidden Markov Model (HMM). In this case, the definition of the state transitions corresponding to the system states will also change. Specifically, Figure 8 The state transition diagram for the second-order model is shown in Table 6, which shows the state transition diagram for the second-order model. Figure 8 The corresponding state transition probability matrix A:

[0162] Table 6 State Transition Probability Matrix A

[0163] System normal occasional abnormalities System normal 0.9 0.1 occasional abnormalities 0.8 0

[0164] Note: The bolded parts represent cases where the value is forced to 0.

[0165] The specific content is similar to the state transition probability in the fourth-order model, and will not be elaborated further in the embodiments of this application.

[0166] In the training model of this application embodiment, Poisson distribution is used for data modeling. Compared with other distributions, such as Gaussian distribution, the range defined in the model of this application embodiment is always positive, and the model design is more reasonable. Furthermore, in the model training process, this application embodiment not only takes into account the Poisson distribution parameters, but also the sequential relationship, and further takes into account the transition probability between system states, thereby improving the accuracy of system state determination and avoiding misjudgment of state.

[0167] 2. Online detection module 220

[0168] The online detection module 220 may further include a detection module 221 and a judgment module 222. The detection module 221 can use a trained state detection model to detect online data, and the judgment module 222 processes the online detection data to determine whether the system is in an abnormal state. The system state may include a normal state and an abnormal state.

[0169] Optionally, the state detection model can also output the judgment result of intermediate states (i.e., the defined system state mentioned above), such as whether the system is in normal, occasional abnormal, continuous abnormal, or system crash.

[0170] It should be understood that when performing detection, the online detection module in this application embodiment will match the online data with the data in the model, and then further determine the state of the system.

[0171] As one possible implementation, when the trained state detection model is a fourth-order model, the online detection data can be decoded to obtain the defined system state corresponding to the online data.

[0172] in, Figure 9 An architecture diagram of a fourth-order model for anomaly detection according to an embodiment of this application is given, as follows: Figure 9 As shown, with Figure 2 Similar to the architecture described above, this application further refines the architecture in a 4th-order model. Specifically, the trained PHMM model can decode the online detection data into hidden states, i.e., the defined system states, using the Viterbi algorithm. Then, the judgment module 922 judges the system state to determine whether the system is in an abnormal state.

[0173] It should be understood that the system state at a certain moment determined by the state detection model in this application embodiment is different from the defined system state defined in the model. This application embodiment will determine the system state based on the defined system state corresponding to the online data detected by the model. For example, the system state at a certain moment determined in this application embodiment can be a normal state or an abnormal state. Optionally, when the defined system state corresponding to the online data is a normal system or an occasional abnormality, the final determined system state can be a normal state. Correspondingly, when the defined system state corresponding to the online data is a continuous abnormality or a system crash, the final determined system state can be an abnormal state.

[0174] Specifically, the judgment module 922 determines whether the system is abnormal based on the detected defined system status. Data corresponding to continuous abnormality and system crash can be directly judged as abnormal. As shown in Table 7, the data from 10:30 to 10:32 can be considered as normal system; 10:33 is judged as intermittent abnormality; the data from 10:34 to 10:37 is judged as continuous abnormality and needs to be reported; the data from 10:38 to 10:41 is judged as system crash and needs to be reported; the system returns to normal after 10:42.

[0175] Optionally, after detecting online data, the PHMM model in this application embodiment can report the abnormal state data so that the abnormal state of the system can be further processed. Optionally, this application embodiment can also output the defined system state of the detected online data so as to further understand the specific state of the system.

[0176] Table 7 and Time Correspondence Table

[0177] A B C D Timestamp Number of failures Number of successes Hidden state 10:30 0 30 System normal 10:31 1 20 System normal 10:32 1 23 System normal 10:33 11 32 occasional abnormalities 10:34 14 27 Continuous abnormality 10:35 10 60 Continuous abnormality 10:36 15 40 Continuous abnormality 10:37 20 23 Continuous abnormality 10:38 0 1 Continuous abnormality 10:39 1 0 Continuous abnormality 10:40 0 1 Continuous abnormality 10:41 1 0 Continuous abnormality 10:42 0 23 System normal 10:43 0 11 System normal 10:44 1 23 System normal 10:45 0 33 System normal

[0178] Note: The bolded parts correspond to abnormal states that need to be reported.

[0179] As another possible implementation, when the training data is incomplete and the resulting model is a 2nd-order PHMM model—for example, when the training data only corresponds to normal system conditions and occasional anomalies—the resulting 2nd-order PHMM model does not define persistent anomalies and system crashes. Therefore, when performing anomaly detection, it cannot directly decode and output the hidden state like a 4th-order PHMM model. In anomaly detection of the 2nd-order PHMM model, a sliding window judgment is required on the online data. Then, a forward algorithm is used to calculate the fitting probability of the detected data in the sliding window. When the fitting probability is less than a set threshold, it is judged as an anomaly.

[0180] like Figure 10 Another anomaly detection architecture diagram according to an embodiment of this application is shown, such as... Figure 10 As shown, with Figure 9 Unlike the decoding in other embodiments, the model in this example needs to use window sliding to calculate the fitting probability of the online data when performing online detection.

[0181] Specifically, as shown in Table 8, which shows the correspondence between at least one KPI and various time points, the sliding window width can be set to 6 time points each time (the window width can be specified according to the actual situation). Then, the fitting probability of the data in each window and the data in the model is calculated. Based on the preset threshold, the degree of matching between the online data and the model data is judged. As shown in Table 8, the threshold can be set to -50dB. If the data fitting probability is -33dB within the sliding window from 10:30 to 10:35, it can be judged as normal and no anomaly is reported. When the window slides to 10:37 to 10:43, the fitting probability is -117.2dB, which is less than the threshold, so an anomaly is reported.

[0182] When calculating the fitting probability for at least one KPI and its corresponding time step, a forward algorithm can be used. This algorithm fits the data of at least one KPI corresponding to multiple time steps within a sliding window to the Hidden Markov Model (HMM). Specifically, according to the order of time steps within the sliding window, the KPI data corresponding to each time step is matched with the defined system state, and the matching probability for all time steps is calculated sequentially. After calculating the matching probability for all time steps within the sliding window, a comprehensive probability of all sequences matching the system state can be finally calculated. The method for calculating the matching probability at each time step can refer to existing methods for calculating matching probabilities, and this application does not limit it in this regard.

[0183] Table 8. Correspondence between KPI and Time Period

[0184] Serial Number A B C 1 Timestamp Number of failures Number of successes 2 10:30 0 30 3 10:31 1 20 4 10:32 1 23 5 10:33 1 32 6 10:34 0 27 7 10:35 1 60 8 10:36 15 33 9 10:37 20 23 10 10:38 30 32 11 10:39 22 52 12 10:40 15 31 13 10:41 23 42 14 10:42 0 0 15 10:43 0 0 16 10:44 1 1 17 10:45 0 1 18 10:46 0 0 19 10:47 1 0 20 10:48 0 0

[0185] Note: The window width can be set to 6. The smaller the calculated logarithm of the fit probability, the lower the fit probability.

[0186] In this embodiment, the preset threshold can be calculated by using a trained PHMM model to perform fitting probability calculations for all sliding windows on the training data. For example, if the training data length is L and the sliding window is w, L-w+1 fitting probabilities p1, ..., p(L-W+1) can be obtained. The training data is considered normal data, and the range of fitting probabilities for normal data is calculated, with the mean value being p. mean The standard deviation is p std Calculate the threshold p threshold (db) is as follows:

[0187] p threshold =p mean -k*p std

[0188] Where k is a control parameter; the smaller k is, the more sensitive the algorithm is; the larger k is, the less sensitive the algorithm is.

[0189] It should be understood that the method used in this application embodiment to calculate the fitting probability of online detection data and data in the model can refer to the prior art, and this application embodiment does not limit it.

[0190] Figure 11 A schematic diagram of an anomaly detection device according to an embodiment of this application is shown, such as... Figure 11 As shown, the device 1100 includes an acquisition module 1101 and a processing module 1102. The device 1100 can be used to implement the online detection and anomaly judgment functions of the system involved in any of the above method embodiments.

[0191] The device 1100 can be used as an anomaly detection device to process KPIs and execute the steps of online detection and anomaly judgment of KPIs by the anomaly detection device in the above method embodiment. The acquisition module 1101 can be used to support the device 110011 in communication, for example, to perform... Figure 1 The receiving action performed by the anomaly detection device, the processing module 1102 can be used to support the device 1100 in performing the processing actions in the above method, such as performing... Figure 1 The processing actions are performed by the anomaly detection device. The device 1100 may also include an output module and a transmission module, for example, to perform... Figure 1 The output and transmission actions are performed by the anomaly detection device. Specifically, please refer to the following description:

[0192] The acquisition module 1101 is used to acquire at least one key performance indicator (KPI) corresponding to the first moment, wherein the KPI includes at least one of the number of attempts, the number of successes, or the number of failures; the processing module 1102 is used to perform system anomaly judgment on the system state at the first moment based on the at least one KPI and the state detection model, wherein the result of the anomaly judgment includes a normal state and an abnormal state, wherein the state detection model includes different defined system states, and the defined system states corresponding to the normal state include: system normal or occasional anomaly; wherein the state detection model is trained based on at least one training KPI and multiple initial state parameter values, wherein the initial state parameter values ​​include initial Poisson distribution parameter values ​​and initial state transition probability values, and the initial state parameter values ​​are initial values ​​defined according to business logic corresponding to different defined system states.

[0193] Optionally, the at least one KPI corresponds one-to-one with at least one Poisson distribution parameter, the different defined system states correspond to different parameter values ​​of the at least one Poisson distribution parameter, the transition probability of the defined system state at the first moment to another defined system state corresponds to the first state transition probability value, and the transition probability between defined system states corresponds to different state transition probability values.

[0194] Optionally, the state detection model is a Poisson Hidden Markov Model (PHMM).

[0195] Optionally, the state transition probability includes any two of the following definitions of the transition probability between system states: system normal, occasional abnormality, continuous abnormality, and system crash.

[0196] Optionally, the defined system state includes system normal, occasional abnormal, continuous abnormal, and system crash. The processing module is specifically used to: input the at least one KPI into the state detection model; decode the at least one KPI input into the state detection model using the Viterbi algorithm; and determine the system abnormality of the system state at the first moment.

[0197] Optionally, the processing module is specifically used to: determine that the system state corresponding to the first moment is in a normal state when the defined system state obtained by decoding through the Viterbi algorithm is either normal or intermittently abnormal; or determine that the system state at the first moment is in an abnormal state when the defined system state obtained by decoding through the Viterbi algorithm is either continuously abnormal or system crash.

[0198] Optionally, the processing module is further configured to: determine the defined system state corresponding to the at least one training KPI, including: system normal, occasional abnormality, continuous abnormality, and system crash.

[0199] Optionally, the defined system state includes normal system and occasional anomaly, and the processing module is specifically used to: use the state detection model to perform a sliding window judgment on at least one KPI corresponding to multiple time points, wherein the multiple time points include the first time point, to obtain first data, wherein the first time point corresponds to the end time of the sliding window; use the state detection model to calculate the fitting probability of the first data using the forward algorithm; and judge the system state at the first time point as abnormal based on the fitting probability of the first data.

[0200] Optionally, the processing module is specifically used to: determine that the system state corresponding to the first time moment is in an abnormal state when the fitting probability of the first data is less than the first threshold, or determine that the system state corresponding to the first time moment is defined as normal or occasional abnormal when the fitting probability of the first data is greater than or equal to the first threshold, and further determine that the system state corresponding to the first time moment is in a normal state.

[0201] Optionally, the processing module is further configured to: determine the defined system state corresponding to the at least one training KPI, including: normal system and occasional abnormality.

[0202] Optionally, the device further includes: an output module for outputting a defined system state corresponding to the first time moment, wherein the defined system state includes at least one of the following: system normal, occasional abnormality, continuous abnormality, and system crash.

[0203] Optionally, in the transition probabilities between any two defined system states, the transition probabilities between occasional anomalies, continuous anomalies, system crashes, continuous normal systems, system crashes, continuous anomalies, and occasional anomalies are forcibly set to 0.

[0204] Optionally, when the result of the system anomaly determination is an abnormal state, the device further includes: a sending module, used to send a first message, the first message including the result of the anomaly determination.

[0205] Figure 12 This diagram illustrates another structural schematic of an anomaly detection device according to an embodiment of this application. The communication device 1200 can be used to implement the anomaly detection method described in the above method embodiments. The communication device 1200 can be a chip or a network device.

[0206] The communication device 1200 includes one or more processors 1201, which can support the communication device 1200 in implementing... Figure 1 The anomaly detection method is described. The processor 1201 can be a general-purpose processor or a dedicated processor. For example, the processor 1201 can be a central processing unit (CPU) or a baseband processor. The baseband processor can be used to process communication data, and the CPU can be used to control the communication device (e.g., network equipment, terminal equipment, or chip), execute software programs, and process the data of the software programs. The communication device 1200 may also include a transceiver unit 1205 for implementing signal input (reception) and output (transmission).

[0207] For example, the communication device 1200 may be a chip, the transceiver unit 1205 may be the input and / or output circuit of the chip, or the transceiver unit 1205 may be the communication interface of the chip, and the chip may be a component of a terminal device, network device or other wireless communication device.

[0208] The communication device 1200 may include one or more memories 1202, which store a program 1204. The program 1204 can be executed by a processor 1201 to generate instructions 1203, causing the processor 1201 to execute the method described in the above method embodiments according to the instructions 1203. Optionally, the memory 1202 may also store data. Optionally, the processor 1201 may also read data stored in the memory 1202, which may be stored at the same memory address as the program 1204, or the data may be stored at a different memory address than the program 1204.

[0209] The processor 1201 and memory 1202 can be configured separately or integrated together, for example, integrated on a single board or system on chip (SOC).

[0210] The communication device 1200 may also include a transceiver unit 1205. The transceiver unit 1205 may be referred to as a transceiver, transceiver circuit, or transceiver.

[0211] It should be understood that the steps of the above method embodiments can be implemented by hardware logic circuits or software instructions in the processor 1201. The processor 1201 may be a CPU, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, such as discrete gate, transistor logic devices, or discrete hardware components.

[0212] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0213] The methods in the embodiments of this application, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution or part of the technical solution of this application can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The storage medium includes at least: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, and other media capable of storing program code. The above descriptions are merely specific embodiments of this application, but the protection scope of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. An anomaly detection method characterized by, The method comprises: acquiring at least one key performance indicator (KPI) corresponding to a first time point, wherein the KPI comprises at least one of the number of attempts, the number of successes or the number of failures of a user's service; performing system anomaly judgment on the system state at the first time point according to the at least one KPI and a state detection model, wherein the result of the anomaly judgment comprises a normal state and an abnormal state, and wherein the state detection model comprises different defined system states, and the defined system state corresponding to the normal state comprises system normal or occasional anomaly; wherein the state detection model is trained based on at least one training KPI and a plurality of initial state parameter values, the initial state parameter values comprise initial Poisson distribution parameter values and initial state transition probability values, and the initial state parameter values are initial values corresponding to different defined system states defined according to service logic.

2. The method of claim 1, wherein, The at least one KPI corresponds to at least one Poisson distribution parameter one by one, the different defined system states correspond to different parameter values of the at least one Poisson distribution parameter, the transition probability of the defined system state at the first time point to another defined system state corresponds to a first state transition probability value, and the transition probability between the defined system states corresponds to different state transition probability values.

3. The method according to claim 1 or 2, characterized in that, The state detection model is a Poisson hidden Markov (PHMM) model.

4. The method according to claim 1 or 2, characterized in that, The defined system states comprise system normal, occasional anomaly, continuous anomaly, system downtime, and The system anomaly judgment on the system state at the first time point according to the at least one KPI and the state detection model comprises: inputting the at least one KPI into the state detection model; decoding the at least one KPI input into the state detection model by a Viterbi algorithm, and performing system anomaly judgment on the system state at the first time point.

5. The method of claim 4, wherein, The decoding of the at least one KPI input into the state detection model by the Viterbi algorithm and the system anomaly judgment on the system state at the first time point comprise: when the defined system state corresponding to the first time point decoded by the Viterbi algorithm is system normal or occasional anomaly, it is determined that the system state corresponding to the first time point is in a normal state, or when the defined system state corresponding to the first time point decoded by the Viterbi algorithm is continuous anomaly or system downtime, it is determined that the system state at the first time point is in an abnormal state.

6. The method of claim 4, wherein, The method further comprises: determining that the defined system state corresponding to the at least one training KPI comprises system normal, occasional anomaly, continuous anomaly and system downtime.

7. The method according to claim 1 or 2, characterized in that, The defined system states comprise system normal and occasional anomaly, and The system anomaly judgment on the system state at the first time point according to the at least one KPI and the state detection model comprises: performing sliding window judgment on at least one KPI corresponding to a plurality of time points by the state detection model, wherein the plurality of time points comprise the first time point, to obtain first data, wherein the first time point corresponds to the end time point of the sliding window; The state detection model is used to perform fitting probability calculation on the first data by using a forward algorithm; According to the fitting probability of the first data, the system state at the first time is determined to be abnormal.

8. The method of claim 7, wherein, The system state at the first time is determined to be abnormal according to the fitting probability of the first data, including: When the fitting probability of the first data is less than a first threshold, it is determined that the system state corresponding to the first time is in an abnormal state, or When the fitting probability of the first data is greater than or equal to the first threshold, it is determined that the system state corresponding to the first time is in a normal state or an occasional abnormal state, and it is further determined that the system state corresponding to the first time is in a normal state.

9. The method of claim 7, wherein, The method further comprises: Determining the definition system state corresponding to the at least one training KPI includes: system normal and occasional abnormal.

10. The method of claim 1 or 2, wherein, The method further comprises: Output the definition system state corresponding to the first time, the definition system state including at least one of the following: System normal, occasional abnormal, persistent abnormal, system down.

11. The method of claim 1 or 2, wherein, Among the transition probabilities between any two definition system states, the transition probabilities between the occasional abnormal, persistent abnormal, system down, system normal, system down, system normal, occasional abnormal, and system down are forced to be 0.

12. The method of claim 1 or 2, wherein, When the result of the system abnormality judgment is an abnormal state, The method further comprises: Sending a first message, the first message including the result of the abnormality judgment.

13. An apparatus for anomaly detection, the apparatus comprising: Including: A processor, The processor is coupled with the memory, and is used to call and run a computer program from the memory to execute the method of any one of claims 1-12.

14. A computer-readable storage medium, characterized in that, The computer readable medium stores a computer program for execution by a device, the computer program including program instructions for executing the method of any one of claims 1-12.

15. A chip, characterized by The chip includes a processor and a data interface, the processor reading program instructions stored on the memory through the data interface to execute the method of any one of claims 1-12.

Images