A data processing method, device and equipment

Abstract

The present invention provides a data processing method, device and equipment, wherein the data processing method comprises: obtaining indicator data of at least two network indicators; obtaining preset parameters according to the indicator data; obtaining network indicator anomaly detection results according to the preset parameters; wherein the preset parameters include at least one of the following parameters: multi-indicator joint parameters for the at least two indicators; single sampling point parameters for a single time point of each network indicator of a preset type in the at least two indicators; multi-sampling point parameters for a time window of each network indicator of a preset type in the at least two indicators, the time window including at least two time points. This solution solves the problem that the data processing solution for anomaly detection of network timing indicators in the prior art is labor-intensive and has low accuracy.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method, device and equipment. Background Art

[0002] At present, "distinguishing anomalies and reducing false positives" is the key demand of existing network operation and maintenance personnel. Under the fixed threshold mechanism, in order to avoid missed detections, operation and maintenance personnel will set the threshold more conservatively, resulting in a large number of false positives and unnecessary labor costs. Other existing technical solutions mostly build models for the statistical characteristics of indicators, and then use the models to judge whether a single sampling point of the indicator is abnormal. In actual operation and maintenance work, a large number of operation and maintenance indicators have different importance. For non-important indicators, their anomalies do not need special treatment; for important indicators, slight and short-term anomalies of a single sampling point do not need special treatment, so the existing methods will produce a large number of false positives.

[0003] As can be seen from the above, the data processing solutions for anomaly detection of network indicators in the prior art have problems such as being labor-intensive and having low accuracy. Summary of the invention

[0004] The purpose of the present invention is to provide a data processing method, device and equipment to solve the problems of labor-intensive and low accuracy in the data processing scheme for abnormality detection of network timing indicators in the prior art.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides a data processing method, including:

[0006] Obtain indicator data for at least two network indicators;

[0007] According to the indicator data, a preset parameter is obtained;

[0008] According to the preset parameters, the network indicator anomaly detection results are obtained;

[0009] The preset parameters include at least one of the following parameters:

[0010] A multi-indicator joint parameter for the at least two indicators;

[0011] Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators;

[0012] For the multiple sampling point parameters of the time window of each network indicator of the preset type in the at least two indicators, the time window includes at least two time points.

[0013] Optionally, obtaining a network indicator anomaly detection result according to preset parameters includes:

[0014] In the case where it is determined that the magnitude relationship between at least one of the multi-indicator joint parameter and the first threshold satisfies the first condition, the magnitude relationship between at least one of the single sampling point parameter and the second threshold satisfies the second condition, and the magnitude relationship between at least one of the multi-sampling point parameter and the third threshold satisfies the third condition, determining that the network indicator anomaly detection result is high-level normal;

[0015] In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level;

[0016] When it is determined that only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, the network indicator anomaly detection result is determined to be low-level normal.

[0017] Optionally, also include:

[0018] Update the reference threshold value according to the data of the network indicator within a preset period;

[0019] The reference threshold includes at least one of a first threshold, a second threshold, a third threshold, a fourth threshold, a fifth threshold and a sixth threshold.

[0020] Optionally, obtaining preset parameters according to the indicator data includes:

[0021] Determining a network indicator of a preset type from the at least two network indicators;

[0022] According to the network indicator of the preset type, determining indicator data of the network indicator of the preset type from the indicator data;

[0023] According to the indicator data of the preset type of network indicator, the single sampling point parameter and / or the multiple sampling point parameters of each preset type of network indicator are respectively obtained.

[0024] Optionally, the window size of the time window is an integer multiple of the sampling period.

[0025] An embodiment of the present invention further provides a data processing device, including:

[0026] A first acquisition module, used to acquire indicator data of at least two network indicators;

[0027] A first processing module, used to obtain preset parameters according to the indicator data;

[0028] The second processing module is used to obtain the network indicator anomaly detection result according to the preset parameters;

[0029] The preset parameters include at least one of the following parameters:

[0030] A multi-indicator joint parameter for the at least two indicators;

[0031] Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators;

[0032] For the multiple sampling point parameters of the time window of each network indicator of the preset type in the at least two indicators, the time window includes at least two time points.

[0033] Optionally, the second processing module includes:

[0034] A first determination submodule is used to determine that the network indicator anomaly detection result is high-level normal when it is determined that the size relationship between at least one of the multi-indicator joint parameters and the first threshold satisfies the first condition, the size relationship between at least one of the single sampling point parameters and the second threshold satisfies the second condition, and the size relationship between at least one of the multi-sampling point parameters and the third threshold satisfies the third condition;

[0035] In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level;

[0036] When it is determined that only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, the network indicator anomaly detection result is determined to be low-level normal.

[0037] Optionally, also include:

[0038] A first updating module, used to update the reference threshold value according to the data of the network indicator within a preset period;

[0039] The reference threshold includes at least one of a first threshold, a second threshold, a third threshold, a fourth threshold, a fifth threshold and a sixth threshold.

[0040] Optionally, the first processing module includes:

[0041] A second determining submodule, configured to determine a network indicator of a preset type from the at least two network indicators;

[0042] A third determining submodule, configured to determine, according to the network indicator of the preset type, indicator data of the network indicator of the preset type from the indicator data;

[0043] The first acquisition submodule is used to respectively acquire the single sampling point parameter and / or multiple sampling point parameters of each preset type of network indicator according to the indicator data of the preset type of network indicator.

[0044] Optionally, the window size of the time window is an integer multiple of the sampling period.

[0045] An embodiment of the present invention further provides a data processing device, including: a processor;

[0046] The processor is used to obtain indicator data of at least two network indicators;

[0047] According to the indicator data, a preset parameter is obtained;

[0048] According to the preset parameters, the network indicator anomaly detection results are obtained;

[0049] The preset parameters include at least one of the following parameters:

[0050] A multi-indicator joint parameter for the at least two indicators;

[0051] Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators;

[0052] For the multiple sampling point parameters of the time window of each network indicator of the preset type in the at least two indicators, the time window includes at least two time points.

[0053] Optionally, the processor is specifically configured to:

[0054] In the case where it is determined that the magnitude relationship between at least one of the multi-indicator joint parameter and the first threshold satisfies the first condition, the magnitude relationship between at least one of the single sampling point parameter and the second threshold satisfies the second condition, and the magnitude relationship between at least one of the multi-sampling point parameter and the third threshold satisfies the third condition, determining that the network indicator anomaly detection result is high-level normal;

[0055] In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level;

[0056] When it is determined that only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, the network indicator anomaly detection result is determined to be low-level normal.

[0057] Optionally, the processor is further configured to:

[0058] Update the reference threshold value according to the data of the network indicator within a preset period;

[0059] The reference threshold includes at least one of a first threshold, a second threshold, a third threshold, a fourth threshold, a fifth threshold and a sixth threshold.

[0060] Optionally, the processor is specifically configured to:

[0061] Determining a network indicator of a preset type from the at least two network indicators;

[0062] According to the network indicator of the preset type, determining indicator data of the network indicator of the preset type from the indicator data;

[0063] According to the indicator data of the preset type of network indicator, the single sampling point parameter and / or the multiple sampling point parameters of each preset type of network indicator are respectively obtained.

[0064] Optionally, the window size of the time window is an integer multiple of the sampling period.

[0065] An embodiment of the present invention further provides a data processing device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned data processing method is implemented.

[0066] An embodiment of the present invention further provides a readable storage medium on which a program is stored. When the program is executed by a processor, the steps in the above-mentioned data processing method are implemented.

[0067] The beneficial effects of the above technical solution of the present invention are as follows:

[0068] In the above scheme, the data processing method obtains the indicator data of at least two network indicators; obtains the preset parameters according to the indicator data; obtains the network indicator anomaly detection result according to the preset parameters; wherein the preset parameters include at least one of the following parameters: a multi-indicator joint parameter for the at least two indicators; a single sampling point parameter for a single time point of each network indicator of a preset type in the at least two indicators; a multi-sampling point parameter for a time window of each network indicator of a preset type in the at least two indicators, wherein the time window includes at least two time points; it is possible to automatically monitor and discover abnormal conditions in network operation and maintenance performance indicators (i.e., the above network indicators), thereby saving manpower, improving monitoring efficiency, timely discovering, locating, and resolving anomalies, and ensuring network performance; and the anomalies of network indicators can be considered from multiple dimensions of single-point / short-term anomalies and multi-point / long-term anomalies, thereby improving detection accuracy and reducing false detection rate; it is a good solution to the problem that the data processing scheme for anomaly detection of network timing indicators in the prior art is labor-intensive and has low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a flow chart of a data processing method in an embodiment of the present invention;

[0070] Figure 2 The specific application process of the data processing method in the embodiment of the present invention is shown in FIG. Figure 1 ;

[0071] Figure 3 The specific application process of the data processing method in the embodiment of the present invention is shown in FIG. Figure 2 ;

[0072] Figure 4 This is a schematic diagram of the structure of a data processing device in an embodiment of the present invention;

[0073] Figure 5 Schematic diagram of the structure of a data processing device in an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0075] The present invention aims to solve the problem that the data processing scheme for abnormality detection of network timing indicators in the existing technology is labor-intensive and has low accuracy, and provides a data processing method, such as Figure 1 As shown, including:

[0076] Step 11: Obtain indicator data of at least two network indicators;

[0077] Step 12: Obtaining preset parameters according to the indicator data;

[0078] Step 13: Obtain the network indicator anomaly detection result according to preset parameters; wherein the preset parameters include at least one of the following parameters: a multi-indicator joint parameter for the at least two indicators; a single sampling point parameter for a single time point of each network indicator of a preset type in the at least two indicators; a multi-sampling point parameter for a time window of each network indicator of a preset type in the at least two indicators, wherein the time window includes at least two time points.

[0079] In the embodiment of the present invention, a warning operation of a corresponding level may also be performed according to the network indicator anomaly detection result, which is not limited here.

[0080] The data processing method provided by the embodiment of the present invention obtains indicator data of at least two network indicators; obtains preset parameters according to the indicator data; obtains network indicator anomaly detection results according to the preset parameters; wherein the preset parameters include at least one of the following parameters: multi-indicator joint parameters for the at least two indicators; single sampling point parameters for a single time point of each network indicator of a preset type in the at least two indicators; multi-sampling point parameters for a time window of each network indicator of a preset type in the at least two indicators, the time window including at least two time points; it is capable of automatically monitoring and discovering abnormal conditions in network operation and maintenance performance indicators (i.e., the above-mentioned network indicators), thereby saving manpower, improving monitoring efficiency, timely discovering, locating, and solving anomalies, and ensuring network performance; and the anomalies of network indicators can be considered from multiple dimensions of single-point / short-term anomalies and multi-point / long-term anomalies, thereby improving detection accuracy and reducing false detection rate; it well solves the problem of manpower consumption and low accuracy in the data processing scheme for anomaly detection of network timing indicators in the prior art.

[0081] In an embodiment of the present invention, obtaining the network indicator anomaly detection result according to the preset parameters includes: determining that the network indicator anomaly detection result is high-level normal when it is determined that the size relationship between at least one of the multi-indicator joint parameters and the first threshold satisfies the first condition, the size relationship between at least one of the single sampling point parameters and the second threshold satisfies the second condition, and the size relationship between at least one of the multi-sampling point parameters and the third threshold satisfies the third condition; determining that the network indicator anomaly detection result is medium-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the fourth threshold satisfies the fourth condition and the size relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition; determining that the network indicator anomaly detection result is low-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition.

[0082] Among them, at least one parameter (which can be a multi-indicator joint parameter, a single sampling point parameter or a multi-sampling point parameter) can be understood as a parameter corresponding to a single sampling moment (or time window) or multiple consecutive sampling moments (or time windows), which is not limited here.

[0083] The second threshold may include two sub-values, namely, upper and lower limits; the fourth threshold may be the same as the first threshold, the fourth condition may be the same as the first condition, the fifth threshold may be the same as the second threshold, the fifth condition may be the same as the second condition, the sixth threshold may be the same as the third threshold, and / or the sixth condition may be the same as the third condition.

[0084] Furthermore, the data processing method also includes: updating the reference threshold based on the data of the network indicator within a preset period; wherein the reference threshold includes: at least one of the first threshold, the second threshold, the third threshold, the fourth threshold, the fifth threshold and the sixth threshold.

[0085] This can further improve the accuracy of detection.

[0086] In an embodiment of the present invention, obtaining preset parameters based on the indicator data includes: determining a network indicator of a preset type from the at least two network indicators; determining indicator data of the network indicator of the preset type from the indicator data based on the network indicator of the preset type; and obtaining single sampling point parameters and / or multiple sampling point parameters of each network indicator of the preset type based on the indicator data of the network indicator of the preset type.

[0087] The preset types of network indicators correspond to commonly understood important network indicators.

[0088] In the embodiment of the present invention, the window size of the time window is an integer multiple of the sampling period.

[0089] This can ensure the accuracy of detection to a certain extent.

[0090] The data processing method provided by the embodiment of the present invention is further described below.

[0091] In response to the above technical problems, an embodiment of the present invention provides a data processing method, which can be specifically combined with single-point anomaly rapid detection, time series multi-point anomaly scoring and multi-indicator joint single-point anomaly scoring to achieve a multi-dimensional multi-algorithm integrated anomaly detection method for network time series indicators (i.e., the above network indicators). It should be noted here that both the box plot and VAE (variational autoencoder) algorithms judge anomalies based on the statistical distribution characteristics of indicator data, and are unsupervised algorithms that do not require labeling information.

[0092] Specifically, the solution provided by the embodiment of the present invention is as follows Figure 2As shown (the counter in the figure represents the above indicator data, the anomaly score anomaly score1 represents the multi-indicator joint parameter, the anomaly indication anomalindication 1 represents the single sampling point parameter, and anomaly score2 represents the multi-sampling point parameter), the following operations are involved:

[0093] 1. The values ​​of n (at least two) network indicators sampled at a certain time point are combined into an indicator vector, and a multi-indicator joint anomaly score is performed (i.e., network indicator anomaly detection is performed based on multi-indicator joint parameters). Then, the multi-indicator joint anomaly score value anomaly score_1(t) can be calculated for each sampling moment, where t is the sampling moment point determined under a certain sampling period. The multi-indicator joint anomaly score can use the deep learning generation algorithm VAE to give a quantitative score for the degree of anomaly of each indicator vector. Specifically, it can be judged at at least one moment of multiple indicators.

[0094] 2. According to the preset rules, select important network indicators from n network indicators for key analysis. If a total of m important indicators are selected, m analysis processes are run in parallel. In each process, single sampling point anomaly detection and time series multi-sampling point anomaly scoring are performed on the network indicator at the same time (i.e., network indicator anomaly detection is performed based on single sampling point parameters and multi-sampling point parameters at a single time point).

[0095] a) Single sampling point anomaly detection: Calculate the statistical distribution of the network indicator at each sampling time point, set the upper and lower limits of the anomaly judgment (i.e. the second threshold and the fifth threshold mentioned above), and if the upper and lower limits are exceeded, it is considered that a single point anomaly has occurred. A box plot algorithm based on statistical distribution characteristics can be used, or other statistics-based algorithms can be used. Specifically, it can be judged on at least one sampling time of a single important indicator.

[0096] b) Time series multi-sampling point anomaly scoring: Set an anomaly evaluation time window for the sampling point time series of the network indicator. The window size is an integer multiple of the sampling period and the window size is configurable. Give a quantitative score to the degree of anomaly of the sampling value vector of the network indicator in the time window before the current sampling moment. The deep learning generation algorithm VAE can be used, or other algorithms that can quantify the degree of anomaly can be used. Specifically, it can be to judge at least one time window of a single important indicator, and the time window includes at least two moments.

[0097] 3. Integrated Judgment: Configurable multi-level anomaly warnings can be set, which are divided into multiple levels according to the false positive rate from low to high, such as level 1, level 2, and level 3. Or, according to the operation and maintenance requirements, judgment conditions can be generated by combining anomaly score1, anomaly score2, and anomaly indication1. Under different levels, the anomaly judgment thresholds for the same parameter can be configured with different values. For example, it can be divided into three levels and related judgment conditions as follows:

[0098] a) Level 1: The false positive rate is the lowest (corresponding to the high-level normal result of the above network metric anomaly detection). It is judged by combining anomaly score 1, anomaly score 2, and anomaly indication. For example, the judgment conditions are:

[0099] Anomaly score 1 < thres (threshold) 1, and,

[0100] There is one or more important network metrics with anomaly indication == true (that is, satisfying the relationship condition with the threshold), and,

[0101] Anomaly score 2 of the above important network metrics < thres2.

[0102] Each of the above judgment conditions can be for a single sampling moment (that is, a single parameter value of the network metric), or the accumulated value of consecutive multiple sampling moments (that is, multiple parameter values of the network metric).

[0103] b) Level 2: The false positive rate is relatively low (corresponding to the medium-level normal result of the above network metric anomaly detection). It is judged by combining anomaly score 1 and anomaly indication:

[0104] Anomaly score 1 < thres3, and,

[0105] There is one or more important network metrics with anomaly indication == true.

[0106] Each of the above judgment conditions can be for a single sampling moment or the accumulated value of consecutive multiple sampling moments

[0107] c) Level 3: The false positive rate is the highest (corresponding to the low-level normal result of the above network metric anomaly detection). It is judged only based on anomaly score 1:

[0108] Anomaly score 1 < thres4.

[0109] Each of the above judgment conditions can be a single sampling moment, or an accumulated value of multiple consecutive sampling moments.

[0110] It is noted here that the judgment conditions for the size relationship between the above parameters and the threshold are only examples and are not limiting. The relationship between each parameter and the threshold may be greater than or less than the relationship to meet the judgment conditions; the threshold may be updated periodically or triggered by a preset condition.

[0111] The scheme provided by the embodiment of the present invention is specifically illustrated below with examples, taking the box plot method to determine the single sampling point parameters as an example, and taking the VAE method to determine the multi-index joint parameters and the multi-sampling point parameters as an example.

[0112] like Figure 3 As shown in the figure (anomaly indication 2 indicates the anomaly detection result of the network indicator), the following operations are involved:

[0113] 1. For multi-index vectors, multi-index VAE is used to score the abnormality at a single sampling moment.

[0114] 2. When anomaly score 1 exceeds the threshold, the latest anomaly threshold value (for example, there are 96 sets of thresholds) can be calculated for each 15-minute period for all important network performance indicators according to the classic statistical method (box plot), and the current sample can be quickly judged according to the corresponding latest anomaly threshold (i.e., anomaly indication 1 is obtained).

[0115] 3. When one or more important network indicators indicate an abnormality, a large-time-scale anomaly quantitative assessment based on VAE is initiated, and the large-time-scale samples corresponding to the subsequent multiple sampling moments (such as a sample vector composed of 96 sampling points) are scored for anomaly (i.e., anomaly score 2 is obtained). The trend and cumulative value of the anomaly scores at the above multiple sampling moments can be judged. Since the occurrence of continuous anomalies will cause the anomaly score to decrease monotonically, and the more severe the anomaly, the lower the anomaly score, if the anomaly score decreases monotonically or the cumulative value is lower than the threshold, it can be considered that a "serious alarm" has occurred.

[0116] As can be seen from the above, the solution provided by the embodiment of the present invention involves:

[0117] 1. Multi-dimensional and multi-algorithm integrated anomaly detection method;

[0118] 2. Combine the multi-indicator joint anomaly scoring with the individual anomaly scoring of important indicators;

[0119] 3. Combining single-time point anomaly scoring with continuous multi-time point anomaly scoring;

[0120] 4. Configurable multi-level abnormal warnings, input combinations for each level, and judgment conditions for each level;

[0121] 5. Any parameter in the configurable combination of preset parameters can be used to generate judgment conditions, and the judgment threshold of the parameters can be configured.

[0122] In summary, the solution provided by the embodiment of the present invention automatically monitors and discovers abnormal situations in network operation and maintenance performance indicators (i.e., the above-mentioned network indicators) by combining classical mathematical and statistical analysis methods with AI (artificial intelligence) algorithms, can distinguish the importance of network indicators, quantify the severity of abnormalities, and reduce the false positive rate, thereby saving manpower, improving monitoring efficiency, and timely discovering, locating, and solving abnormalities to ensure network performance; specifically:

[0123] (1) It can distinguish the importance of network indicators;

[0124] (2) It can distinguish between minor and major abnormalities;

[0125] (3) It is possible to distinguish between single-point anomalies and multiple-point anomalies, and / or short-term anomalies and long-term anomalies.

[0126] The embodiment of the present invention also provides a data processing device, such as Figure 4 As shown, including:

[0127] A first acquisition module 41, used to acquire indicator data of at least two network indicators;

[0128] A first processing module 42, used to obtain preset parameters according to the indicator data;

[0129] The second processing module 43 is used to obtain a network indicator anomaly detection result according to preset parameters;

[0130] The preset parameters include at least one of the following parameters:

[0131] A multi-indicator joint parameter for the at least two indicators;

[0132] Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators;

[0133] For the multiple sampling point parameters of the time window of each network indicator of the preset type in the at least two indicators, the time window includes at least two time points.

[0134] The data processing device provided by the embodiment of the present invention obtains indicator data of at least two network indicators; obtains preset parameters according to the indicator data; obtains network indicator anomaly detection results according to the preset parameters; wherein the preset parameters include at least one of the following parameters: multi-indicator joint parameters for the at least two indicators; single sampling point parameters for a single time point of each network indicator of a preset type in the at least two indicators; multi-sampling point parameters for a time window of each network indicator of a preset type in the at least two indicators, the time window including at least two time points; it can realize automatic monitoring and discovery of abnormal conditions in network operation and maintenance performance indicators (i.e., the above-mentioned network indicators), thereby saving manpower, improving monitoring efficiency, timely discovering, locating, and solving anomalies, and ensuring network performance; and the anomalies of network indicators can be considered from multiple dimensions of single-point / short-term anomalies and multi-point / long-term anomalies, thereby improving detection accuracy and reducing false detection rate; it well solves the problem of manpower consumption and low accuracy in the data processing scheme for anomaly detection of network timing indicators in the prior art.

[0135] In an embodiment of the present invention, the second processing module includes: a first determining submodule, for determining that the network indicator abnormality detection result is high-level normal when it is determined that the size relationship between at least one of the multi-indicator joint parameters and the first threshold satisfies the first condition, the size relationship between at least one of the single sampling point parameters and the second threshold satisfies the second condition, and the size relationship between at least one of the multi-sampling point parameters and the third threshold satisfies the third condition; determining that the network indicator abnormality detection result is medium-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the fourth threshold satisfies the fourth condition and the size relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition; determining that the network indicator abnormality detection result is low-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition.

[0136] Furthermore, the data processing device also includes: a first update module, used to update the reference threshold based on the data of the network indicator within a preset period; wherein the reference threshold includes: at least one of the first threshold, the second threshold, the third threshold, the fourth threshold, the fifth threshold and the sixth threshold.

[0137] In an embodiment of the present invention, the first processing module includes: a second determination submodule, used to determine a network indicator of a preset type from the at least two network indicators; a third determination submodule, used to determine indicator data of the network indicator of the preset type from the indicator data according to the network indicator of the preset type; and a first acquisition submodule, used to respectively acquire single sampling point parameters and / or multiple sampling point parameters of each network indicator of the preset type according to the indicator data of the network indicator of the preset type.

[0138] In the embodiment of the present invention, the window size of the time window is an integer multiple of the sampling period.

[0139] Among them, the implementation embodiments of the above-mentioned data processing method are all applicable to the embodiments of the data processing device and can achieve the same technical effects.

[0140] The embodiment of the present invention also provides a data processing device, such as Figure 5 As shown, it includes: a processor;

[0141] The processor 51 is used to obtain indicator data of at least two network indicators;

[0142] According to the indicator data, a preset parameter is obtained;

[0143] According to the preset parameters, the network indicator anomaly detection results are obtained;

[0144] The preset parameters include at least one of the following parameters:

[0145] A multi-indicator joint parameter for the at least two indicators;

[0146] Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators;

[0147] For the multiple sampling point parameters of the time window of each network indicator of the preset type in the at least two indicators, the time window includes at least two time points.

[0148] In the embodiment of the present invention, the data processing device may further include a transceiver communicating with the processor, which is not limited herein.

[0149] The data processing device provided by the embodiment of the present invention obtains indicator data of at least two network indicators; obtains preset parameters according to the indicator data; obtains network indicator anomaly detection results according to the preset parameters; wherein the preset parameters include at least one of the following parameters: multi-indicator joint parameters for the at least two indicators; single sampling point parameters for a single time point of each network indicator of a preset type in the at least two indicators; multi-sampling point parameters for a time window of each network indicator of a preset type in the at least two indicators, wherein the time window includes at least two time points; it is capable of automatically monitoring and discovering abnormal conditions in network operation and maintenance performance indicators (i.e., the above-mentioned network indicators), thereby saving manpower, improving monitoring efficiency, timely discovering, locating, and solving anomalies, and ensuring network performance; and the anomalies of network indicators can be considered from multiple dimensions of single-point / short-term anomalies and multi-point / long-term anomalies, thereby improving detection accuracy and reducing false detection rate; it well solves the problem of labor consumption and low accuracy in the data processing scheme for anomaly detection of network timing indicators in the prior art.

[0150] In an embodiment of the present invention, the processor is specifically used to: determine that the network indicator anomaly detection result is high-level normal when it is determined that the size relationship between at least one of the multi-indicator joint parameters and the first threshold satisfies the first condition, the size relationship between at least one of the single sampling point parameters and the second threshold satisfies the second condition, and the size relationship between at least one of the multi-sampling point parameters and the third threshold satisfies the third condition; determine that the network indicator anomaly detection result is medium-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the fourth threshold satisfies the fourth condition and the size relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition; determine that the network indicator anomaly detection result is low-level normal when only the size relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition.

[0151] Furthermore, the processor is also used to: update the reference threshold based on the data of the network indicator within a preset period; wherein the reference threshold includes: at least one of the first threshold, the second threshold, the third threshold, the fourth threshold, the fifth threshold and the sixth threshold.

[0152] In an embodiment of the present invention, the processor is specifically used to: determine a network indicator of a preset type from the at least two network indicators; determine indicator data of the network indicator of the preset type from the indicator data according to the network indicator of the preset type; and obtain single sampling point parameters and / or multiple sampling point parameters of each network indicator of the preset type according to the indicator data of the network indicator of the preset type.

[0153] In the embodiment of the present invention, the window size of the time window is an integer multiple of the sampling period.

[0154] Among them, the implementation embodiments of the above-mentioned data processing method are all applicable to the embodiments of the data processing device and can achieve the same technical effects.

[0155] An embodiment of the present invention further provides a data processing device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the above-mentioned data processing method is implemented.

[0156] Among them, the implementation embodiments of the above-mentioned data processing method are all applicable to the embodiments of the data processing device and can achieve the same technical effects.

[0157] An embodiment of the present invention further provides a readable storage medium on which a program is stored. When the program is executed by a processor, the steps in the above-mentioned data processing method are implemented.

[0158] Among them, the implementation embodiments of the above-mentioned data processing method are all applicable to the embodiments of the readable storage medium and can achieve the same technical effects.

[0159] It should be noted that many functional components described in this specification are referred to as modules / sub-modules in order to more particularly emphasize the independence of their implementation methods.

[0160] In the embodiment of the present invention, module / submodule can be implemented with software so that it can be performed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of this module.

[0161] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0162] When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

[0163] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary personnel in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: include: Obtain indicator data for at least two network indicators; According to the indicator data, a preset parameter is obtained; According to the preset parameters, the network indicator anomaly detection results are obtained; The preset parameters include at least one of the following parameters: A multi-indicator joint parameter for the at least two indicators; Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators; Multiple sampling point parameters of a time window for each network indicator of a preset type in the at least two indicators, the time window including at least two time points; The network indicator anomaly detection result is obtained according to the preset parameters, including: In the case where it is determined that the magnitude relationship between at least one of the multi-indicator joint parameter and the first threshold satisfies the first condition, the magnitude relationship between at least one of the single sampling point parameter and the second threshold satisfies the second condition, and the magnitude relationship between at least one of the multi-sampling point parameter and the third threshold satisfies the third condition, determining that the network indicator anomaly detection result is high-level normal; In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level; In the case where it is determined that only the magnitude relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, determining that the network indicator anomaly detection result is low-level normal; Among them, warning operations of corresponding levels are performed according to the abnormal detection results of network indicators.

2. The data processing method according to claim 1, characterized in that: Also includes: Update the reference threshold value according to the data of the network indicator within a preset period; The reference threshold includes at least one of a first threshold, a second threshold, a third threshold, a fourth threshold, a fifth threshold and a sixth threshold.

3. The data processing method according to claim 1, characterized in that: The step of obtaining preset parameters according to the indicator data includes: Determining a network indicator of a preset type from the at least two network indicators; According to the network indicator of the preset type, determining indicator data of the network indicator of the preset type from the indicator data; According to the indicator data of the preset type of network indicator, the single sampling point parameter and / or the multiple sampling point parameters of each preset type of network indicator are respectively obtained.

4. The data processing method according to claim 1, characterized in that: The window size of the time window is an integer multiple of the sampling period.

5. A data processing device, characterized in that: include: A first acquisition module, used to acquire indicator data of at least two network indicators; A first processing module, used to obtain preset parameters according to the indicator data; The second processing module is used to obtain the network indicator anomaly detection result according to the preset parameters; The preset parameters include at least one of the following parameters: A multi-indicator joint parameter for the at least two indicators; Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators; Multiple sampling point parameters of a time window for each network indicator of a preset type in the at least two indicators, the time window including at least two time points; The second processing module comprises: A first determination submodule is used to determine that the network indicator anomaly detection result is high-level normal when it is determined that the size relationship between at least one of the multi-indicator joint parameters and the first threshold satisfies the first condition, the size relationship between at least one of the single sampling point parameters and the second threshold satisfies the second condition, and the size relationship between at least one of the multi-sampling point parameters and the third threshold satisfies the third condition; In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level; In the case where it is determined that only the magnitude relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, determining that the network indicator anomaly detection result is low-level normal; Among them, warning operations of corresponding levels are performed according to the abnormal detection results of network indicators.

6. The data processing device according to claim 5, characterized in that: Also includes: A first updating module, used to update the reference threshold value according to the data of the network indicator within a preset period; The reference threshold includes at least one of a first threshold, a second threshold, a third threshold, a fourth threshold, a fifth threshold and a sixth threshold.

7. The data processing device according to claim 5, characterized in that: The first processing module comprises: A second determining submodule, configured to determine a network indicator of a preset type from the at least two network indicators; A third determining submodule, configured to determine, according to the network indicator of the preset type, indicator data of the network indicator of the preset type from the indicator data; The first acquisition submodule is used to respectively acquire the single sampling point parameter and / or multiple sampling point parameters of each preset type of network indicator according to the indicator data of the preset type of network indicator.

8. The data processing device according to claim 5, characterized in that: The window size of the time window is an integer multiple of the sampling period.

9. A data processing device, characterized in that: include: processor; The processor is used to obtain indicator data of at least two network indicators; According to the indicator data, a preset parameter is obtained; According to the preset parameters, the network indicator anomaly detection results are obtained; The preset parameters include at least one of the following parameters: A multi-indicator joint parameter for the at least two indicators; Single sampling point parameters at a single time point for each network indicator of a preset type in the at least two indicators; Multiple sampling point parameters of a time window for each network indicator of a preset type in the at least two indicators, the time window including at least two time points; The network indicator anomaly detection result is obtained according to the preset parameters, including: In the case where it is determined that the magnitude relationship between at least one of the multi-indicator joint parameter and the first threshold satisfies the first condition, the magnitude relationship between at least one of the single sampling point parameter and the second threshold satisfies the second condition, and the magnitude relationship between at least one of the multi-sampling point parameter and the third threshold satisfies the third condition, determining that the network indicator anomaly detection result is high-level normal; In the case where it is determined that only the magnitude relationship between at least one of the multi-index joint parameters and the fourth threshold satisfies the fourth condition and the magnitude relationship between at least one of the single sampling point parameters and the fifth threshold satisfies the fifth condition, determining that the network indicator anomaly detection result is normal at a medium level; In the case where it is determined that only the magnitude relationship between at least one of the multi-indicator joint parameters and the sixth threshold satisfies the sixth condition, determining that the network indicator anomaly detection result is low-level normal; Among them, warning operations of corresponding levels are performed according to the abnormal detection results of network indicators.

10. A data processing device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the data processing method according to any one of claims 1 to 4 is implemented.

11. A readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps in the data processing method according to any one of claims 1 to 4 are implemented.

Images