Early warning method and storage medium based on big data analysis

Abstract

The present invention relates to artificial intelligence technology, and provides an early warning method based on big data analysis. A preset algorithm is used to train data features of first original data, and a prediction model is constructed to achieve accurate prediction of business data for predicting the trend of data. The prediction model is used to perform trend prediction on second original data to obtain a predicted value of the second original data. If a difference set between the predicted value and the second original data is greater than a first dynamic threshold set, an alarm message is output. Based on the correlation between alarm items in the alarm message and the abnormal cause determined by the alarm message, an alarm strategy chain is constructed, and real-time alarm information in real-time business data is matched with target node information in the alarm strategy chain. The alarm message is sent to an early warning terminal according to the target node information. The fault location can be quickly located according to the alarm message, thereby improving the availability of the system.

Description

Technical Field

[0001] The present invention relates to the field of artificial rules, and in particular to an early warning method, device, computer equipment and storage medium based on big data analysis. Background Art

[0002] With the development of computer technology, a large amount of data has emerged, including data in different business scenarios. The growth of data in today's society is multi-faceted, including the growth of data volume, the diversity of data types or data sources, and the acceleration of data growth rate. Data is a continuously growing and increasingly complex data set, which is currently constantly challenging traditional data management systems. Faced with a huge amount of data, when data is abnormal, it may cause immeasurable losses, so it is becoming increasingly important to conduct early warning detection of abnormal data. The early warning strategy in the prior art generally uses simple value methods, moving average methods, etc., which are not applicable to many scenarios, have low prediction accuracy, are not "universal", and cannot adapt to indicators of different types, different sampling intervals, and different curve waveforms. In complex scenarios, the underreporting rate is too high to achieve the purpose of early warning, and the false alarm rate is too high to interfere with the operation and maintenance personnel when they participate in the processing. Therefore, the method of early warning of data in the prior art has the problems of a small application range and low accuracy of abnormal point detection. Summary of the invention

[0003] Based on this, it is necessary to provide an early warning method, device, computer equipment and storage medium based on big data analysis to address the above technical problems, so as to solve the problems that the method for early warning of data has a small application range and low accuracy in anomaly detection.

[0004] A first aspect of an embodiment of the present application provides an early warning method based on big data analysis, comprising:

[0005] Using a preset algorithm to train the data features of the first original data to construct a prediction model; wherein the preset algorithm is selected from a preset database according to the data features;

[0006] Performing trend prediction on the second original data by using the prediction model to obtain a predicted value of the second original data;

[0007] If the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, an alarm message is output; the alarm message is used to indicate an abnormality in the second original data;

[0008] Based on the correlation between the alarm items in the alarm information and the abnormal cause of the alarm information, an alarm strategy chain is constructed; wherein the correlation between the alarm items in the alarm information is obtained by analyzing the alarm information using the Apriori algorithm and the FP-Growth algorithm; the abnormal cause of the alarm information is obtained by a decision tree algorithm;

[0009] If the real-time alarm information in the real-time business data matches the target node information in the alarm strategy chain, the alarm information is sent to the alarm terminal according to the target node information.

[0010] A second aspect of the embodiment of the present application provides an early warning method and device based on big data analysis, including:

[0011] Training unit: using a preset algorithm to train the data features of the first original data to construct a prediction model; wherein the preset algorithm is selected from a preset database according to the data features;

[0012] Prediction unit: performing trend prediction on the second original data by using the prediction model to obtain a predicted value of the second original data;

[0013] Alarm unit: if the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, output alarm information; the alarm information is used to indicate an abnormality in the second original data;

[0014] Construction unit: construct an alarm strategy chain based on the association relationship between the alarm items in the alarm information and the abnormal cause of the alarm information; wherein the association relationship between the alarm items in the alarm information is obtained by analyzing the alarm information using the Apriori algorithm and the FP-Growth algorithm; the abnormal cause of the alarm information is obtained by a decision tree algorithm;

[0015] Sending unit: If the real-time alarm information in the real-time business data matches the target node information in the alarm strategy chain, the alarm information is sent to the alarm terminal according to the target node information.

[0016] A third aspect of an embodiment of the present application provides a computer device, comprising: a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, the computer instructions being used to enable the computer to execute each step of an early warning method based on big data analysis.

[0017] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to perform each step of the early warning method based on big data analysis.

[0018] Implementing the early warning method based on big data analysis provided in the embodiment of the present application has the following beneficial effects:

[0019] The present invention relates to artificial intelligence technology, and provides an early warning method based on big data analysis. A preset algorithm is used to train data features of first original data, and a prediction model is constructed to achieve accurate prediction of business data for predicting the trend of data. The prediction model is constructed through data features, and is applicable to any complex scenario. The prediction model is used to predict the trend of second original data, and a prediction value of the second original data is obtained. The prediction value is compared with the second original data. If a difference set between the prediction value and the second original data is greater than a first dynamic threshold set, an alarm message is output, and data abnormalities are checked according to the alarm message. An alarm strategy chain is constructed based on the association between alarm items in the alarm message and the abnormal cause of the alarm message, and real-time alarm information in real-time business data is matched with target node information in the alarm strategy chain. The alarm message is sent to an early warning terminal according to the target node information. The fault location can be quickly and accurately located according to the alarm message, and the availability of the system is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0021] Figure 1 This is a flowchart of an early warning method based on big data analysis in an embodiment of the present application;

[0022] Figure 2 It is a structural block diagram of an early warning method device based on big data analysis provided in an embodiment of the present application;

[0023] Figure 3 It is a structural block diagram of a server-side device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] The early warning method based on big data analysis involved in this application is applied in the field of artificial intelligence and can be executed by the server.

[0026] See also Figure 1 , Figure 1 A flowchart for implementing an early warning method based on big data analysis provided in an embodiment of the present application is shown.

[0027] like Figure 1 As shown, an early warning method based on big data analysis includes:

[0028] S11: Using a preset algorithm to train the data features of the first original data to construct a prediction model; wherein the preset algorithm is selected from a preset database based on the data features.

[0029] In step S11, the first original data is part of the historical application data in the business scenario, and the first original data is preprocessed and analyzed, and data features are obtained through relevant technologies. The preset algorithm is selected from a preset database according to the data features, and the preset database contains a variety of preset algorithms, such as radial basis neural network algorithm, LSTM network algorithm, RNN algorithm, etc. The data features of the first original data are trained using the preset algorithm to construct a prediction model.

[0030] In this embodiment, the first original data is the historical data in the bank transaction process. For example, when a customer applies for a loan, the bank's account manager needs to collect and enter a large amount of data information such as the customer's corporate or personal basic information, financial statements, guarantee information, and collateral information. In the process of integrating information related to credit business, commercial banks are mainly faced with information asymmetry and the risk of loan fraud caused by it. Different business scenarios contain different data, which are large and diverse. After processing these data, the data characteristics of the first original data are obtained as time series characteristics.

[0031] In this embodiment, the preset algorithm selects the LSTM network algorithm. The LSTM network can learn long-term dependent information. The LSTM network model has good generalization when using training sequences of regular languages ​​and simple non-regular languages. LSTM has shown certain capabilities and success in dealing with complex problems with long-term characteristics and has been widely used. LSTM can learn long-term information and is suitable for processing time series data. It can also easily extract abstract, high-level information or metrics from images or sequential data. It has internal feedback connections and can be used to classify, process and predict time series data. Each unit in the LSTM network consists of three information flow regulators: forget gate, input gate and output gate. After training, the input gate controls which inputs are important enough. The forget gate determines how long the state memory should be retained and how to add new information from the current input to the unit state, and the output gate determines how much memory is used to produce the output. Together, they allow the network to remember information from the past while discarding unnecessary information.

[0032] It should be noted that, depending on the business scenario, the corresponding data features are also different, and the prediction model can be divided into stable, periodic and non-periodic types. A stable prediction model is a time series in which the mean and variance have no systematic changes and the periodic changes are strictly eliminated. A periodic prediction model is a time series in which the mean and variance show periodic changes. A non-periodic prediction model is a time series in which the mean and variance have no regular changes.

[0033] In this embodiment, taking user savings card transactions as an example, savings card transactions generally show seasonal periodic changes. In the peak season, the savings card transaction amount is large, and in the off-season, the savings card transaction amount will be relatively reduced. Therefore, the prediction model obtained through LSTM network training is a periodic prediction model.

[0034] As an embodiment of the present application, step S11 specifically includes:

[0035] The first original data is processed by using principal component analysis technology to obtain data features of the first original data; the data features of the first original data are trained by a preset algorithm to construct a prediction model.

[0036] In this embodiment, the principal component analysis technology is used to extract data features from the first original data. The principal component analysis technology can try to regroup the original variables into a new set of several independent comprehensive variables, and at the same time, according to actual needs, several fewer sum variables can be taken out to reflect as much information as possible from the original variables. For example, a set of n-dimensional data, each dimension has a data feature, but in the actual application process, the dimensional data features that have a smaller impact on the data features can be ignored, and only the dimensional data features that have a greater impact on the data features are calculated, which reduces the dimension of the data and obtains the main data features.

[0037] It should be noted that before the feature extraction process, the first raw data needs to be preprocessed and analyzed. Data preprocessing is to supplement, clean and calculate the raw data. Data analysis uses a distributed database or a distributed computing cluster to perform ordinary analysis and classification aggregation on the massive data stored therein to meet most common analysis needs. Data cleaning is to clean the wrong data in the database, because the data in the database is a collection of data for a certain subject. These data are extracted from multiple business systems and contain historical data. In this way, it is inevitable that some data are wrong data and some data conflict with each other, so it is necessary to clean the wrong data and conflicting data. For example, in the loan application process, if text information appears in the ID card information in the personal basic information, it is considered to be wrong data, and the ID card information data in the personal basic information is cleaned. Data supplementation is to improve the missing data. For example, in the bank transaction process, the data of each transaction is important data for reference in the prediction. When the transaction data is missing, it will affect the prediction of future transactions, and the complete transaction data needs to be supplemented. Data preprocessing standardizes the data. Entering a large value may slow down the learning speed, so StandardScaler is used to scale the standardized data. StandardScaler standardization normalizes the data for each dimension.

[0038] S12: Perform trend prediction on the second original data using the prediction model to obtain a predicted value of the second original data.

[0039] In step S12, the second original data is another part of historical data in the application that is different from the first original data. The second original data is substituted into the prediction model to obtain the predicted value of the second original data. For example, for two weeks of bank savings card transaction data, when the prediction model is obtained by training the first week's original data, the first week's original data is the first original data, and the second week's original data is predicted to obtain the predicted value, then the second week's original data is the second original data.

[0040] In this embodiment, the second original data is the transaction data of the bank savings card. The data prediction model is obtained through the LSTM network, and the second original data of the savings card transaction amount is predicted to obtain a predicted value. In this embodiment, the savings card transaction amount per minute is taken as a node, and the predicted value of each node is obtained through the prediction model.

[0041] S13: If the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, output an alarm message.

[0042] In step S13, both the predicted value and the second original data contain multiple data. When the predicted value and the second original data are compared, the difference obtained is a difference set. By comparing the data in the difference set with the data in the dynamic first threshold set, the difference set is greater than the data in the dynamic first threshold set. If the difference set is greater than the data in the dynamic first threshold set, it is considered that there is an abnormality in the second original data, and an alarm message is output. The alarm message is a kind of alarm behavior, and the alarm message can be output according to different rules. For example, in order to eliminate the misjudgment of sudden abnormal situations, an alarm message can be generated when three abnormal situations occur continuously.

[0043] In this embodiment, the second original data of the savings card transaction amount is predicted to obtain a predicted value, and compared with the second original data value, a difference set between the predicted value and the second original data value is obtained, and the data in the difference set is selected to be greater than the threshold data in the dynamic first threshold set. In this embodiment, when setting the dynamic first threshold, different thresholds are set according to different times, and the threshold changes with time. For example, in the process of data transaction, it is considered that the transaction data during the day is larger and the transaction data at night is smaller, and the maximum limit of the difference between the predicted result and the original data value is also different. When the transaction data is larger, the fluctuation range limit between the predicted value and the original data can be smaller, and when the transaction data is smaller, the fluctuation range limit between the predicted value and the original data can be larger. Therefore, different thresholds are set according to different times. In this embodiment, at 8:00-20:00, the threshold is set to 5% of the original data. When the difference between the predicted value and the original data or the difference between the original data and the predicted value is greater than 5% of the original data, the point is considered to be an abnormal point. At 20:00-8:00, the threshold is set to 10% of the original data. When the difference between the predicted value and the original data or the difference between the original data and the predicted value is greater than 10% of the original data, the point is considered an abnormal point. According to the abnormal point, the alarm information is output.

[0044] It should be noted that the dynamic threshold setting depends on the specific situation according to different business scenarios or different types of data. When setting the threshold according to time, different thresholds can be set according to different time periods. For example, when setting the periodic prediction model, if the data increases or decreases first within a period, when setting the threshold, the threshold is set according to the period and the threshold is set based on the original data. Then, the percentage of the threshold as the original data decreases first and then increases. The setting of dynamic thresholds improves the real-time accuracy of quasi-prediction and expands the scope of application.

[0045] As an embodiment of the present application, step S13 specifically includes:

[0046] In a preset period, the predicted value and the second original data are averaged to obtain an average predicted value and an average second original data in the period; when a difference set between the average predicted value and the average second original data in the period is greater than a first dynamic threshold set, an abnormal period point is obtained;

[0047] Output alarm information according to the abnormal period point and the preset period threshold.

[0048] In this embodiment, when the predicted value is compared with the original data, in order to reduce the complexity of the calculation, the average value over a period of time is used as the comparison object. For example, the average value every 5 minutes is used as the comparison object. The average predicted value is compared with the average second original data with a period of 5 minutes. This dynamic sliding window can weaken the impact of some glitches.

[0049] In this embodiment, after obtaining the abnormal periodic point, the position of the abnormal periodic point is recorded, and the number of abnormal periodic points is continuously obtained. According to the convergence strategy, when multiple abnormal points appear continuously, it is considered that an alarm occurs. When the number of consecutive abnormal periodic points is greater than the preset periodic threshold, an alarm message is output. For example, when three abnormal periodic points appear continuously, the data is considered to be abnormal and an alarm is generated. Selecting multiple consecutive abnormal periodic points for convergence can eliminate prominent abnormal points caused by sudden reasons. For example, if the data is abnormal at a certain moment due to network reasons, and then the network returns to normal, the abnormal point is considered to be a prominent abnormal point and an alarm message cannot be generated. Outputting alarm information through the convergence strategy improves the accuracy of the output alarm information and weakens the burr phenomenon in the data.

[0050] S14: constructing an alarm strategy chain based on the association relationship between the alarm items in the alarm information and the abnormal cause of the alarm information.

[0051] In step S14, the cause of the alarm information is the root cause of abnormal data. There are many reasons for data anomaly. When the CPU is loaded, the database CPU usage rate has exceeded 100%. At the same time, the number of slow query logs is large, which will cause data anomaly. When the interface changes or the field does not exist, the interface data anomaly occurs. When the data is redundant, the integrity and consistency of the image data are affected. When querying the database, data anomaly occurs. When the middleware connects to the database and the connection is not released, it continues to grow, causing internal exhaustion, resulting in data anomaly, etc. There are many reasons for data anomaly. The decision tree is used to classify the reasons for data anomaly, determine the abnormal reasons, and build an alarm strategy chain. The alarm strategy chain reflects the relationship between alarm information. When an alarm message appears, according to the alarm strategy chain, the upcoming alarm message can be predicted.

[0052] In this embodiment, the alarm information is obtained based on the second original data as a training set, and the reasons for generating the alarm information are analyzed. The characteristics of data anomalies generated by different reasons are different. For example, when the CPU load generates data anomalies, data anomalies are generally generated during peak hours, which are alarm information A. Therefore, the characteristics of data anomalies are generally in a fixed time period and last for a short time. When the middleware is connected to the database and the connection is not released, it continues to grow, causing internal exhaustion, and the characteristics of the data anomaly are continuous anomalies, which are alarm information B, and the time is long. The decision tree algorithm is used to obtain the abnormal reasons corresponding to different alarm information. Then determine the association between different alarm information. For example, if there is an association between alarm information A and alarm information B, an alarm strategy chain about alarm information A and alarm information B is constructed.

[0053] As an embodiment of the present application, step S14 specifically includes:

[0054] Classify and analyze each alarm item in the alarm information, and use a decision tree algorithm to obtain the abnormal cause of the alarm item; use the Apriori algorithm and the FP-Growth algorithm, as well as the abnormal cause of the alarm item, through data mining technology to obtain the correlation between the alarm items in the alarm information; use the correlation between the alarm items in the alarm information as an alarm strategy chain.

[0055] In this embodiment, the decision tree is a decision analysis method that is based on the known probability of occurrence of various situations, and is used to construct a decision tree to obtain the probability that the expected value of the net present value is greater than or equal to zero, evaluate the project risk, and judge its feasibility. It is a graphical method that intuitively uses probability analysis. In machine learning, a decision tree is a prediction model that represents a mapping relationship between object attributes and object values. Here, the data anomaly is the object attribute, and the cause of the anomaly is the object value. The decision tree algorithm is used to obtain the mapping relationship between the data anomaly and the cause of the anomaly. Then determine the association between different alarm information. For example, if there is alarm information A, alarm information B and alarm information C, the association between alarm information A, alarm information B and alarm information C is obtained by Apriori and FP-Growth algorithms. If there is an association between alarm information A, alarm information B and alarm information C, when one of the alarm information is detected, alarm information B and alarm information C can be predicted. For example, if data anomalies occur due to database redundancy and alarm information A is generated, and at the same time, data anomalies occur due to CPU load and alarm information B is generated, the Apriori and FP-Growth algorithms show that alarm information A and alarm information B are associated, and alarm information A and alarm information B generate an alarm strategy chain. Then, when alarm information A is detected, alarm information B can be predicted based on the alarm strategy chain.

[0056] S15: If the real-time alarm information in the real-time business data matches the target node information in the alarm policy chain, the alarm information is sent to the alarm terminal according to the target node information.

[0057] In step S15, the real-time alarm information is the alarm information generated by comparing the prediction model with the real-time business data, which is matched with the obtained alarm strategy chain, and the remaining alarm information associated with the alarm strategy chain is obtained, and then the early warning information is sent through the configuration system. The creators, editors, and publishers of the content in the configuration system use the content management system to submit, modify, approve, and publish content. When the early warning information is generated, the early warning information is sent to the early warning terminal through the configuration system.

[0058] In this embodiment, when the alarm policy chain is obtained, alarm information A is associated with alarm information B and alarm information C. When the real-time alarm information in the real-time service data is alarm information A, alarm information A matches the target node alarm information A in the alarm policy chain, and the obtained warning information is alarm information B and alarm information C. The configuration system sends alarm information B and alarm information C to the warning terminal. After receiving the warning information, the configuration system sends the warning information to the warning terminal.

[0059] As an embodiment of the present application, step S15 specifically includes:

[0060] By comparing the difference set between the predicted value of the real-time business data and the real-time business data with the first dynamic threshold set, real-time alarm information is obtained; by matching the real-time alarm information with the target node information in the alarm strategy chain, node information associated with the target node information is searched in the alarm strategy chain to obtain the associated node alarm information of the target node in the alarm strategy chain;

[0061] In this embodiment, the predicted value of the real-time business data is compared with the real-time business data to obtain real-time alarm information. For example, during the data monitoring process, the real-time business data is 100, the predicted value of the real-time business data is 50, and the difference between the real-time business data and the predicted value of the real-time business data is greater than the threshold in the dynamic first threshold set, and a real-time alarm information A is generated. The alarm information A is found from the alarm strategy chain, and the alarm information A in the alarm strategy chain is the target node information. According to the target node information, the associated node alarm information of the target node in the alarm strategy chain is obtained, and the target warning terminal is specified in the configuration system, and the warning information is sent to the target warning terminal using the configuration system.

[0062] The present application provides an early warning method based on big data analysis, which uses a preset algorithm to train data features of first original data, builds a prediction model, realizes accurate prediction of business data, and is used to predict the trend of data. The prediction model is used to predict the trend of second original data to obtain a predicted value of the second original data, and the predicted value is compared with the second original data. If the difference set between the predicted value and the second original data is greater than a first dynamic threshold set, an alarm message is output, and data anomalies are checked according to the alarm information. Based on the association between each alarm item in the alarm information and the abnormal cause of the alarm information, an alarm strategy chain is constructed. The alarm strategy chain describes the association between each alarm information, which is helpful for monitoring the alarm information, and matches the real-time alarm information in the real-time business data with the target node information in the alarm strategy chain. The alarm information is sent to the early warning terminal according to the target node information. The fault location can be quickly located according to the alarm information, thereby improving the availability of the system.

[0063] See also Figure 2 , Figure 2 : is a block diagram of the device structure of an early warning method based on big data analysis provided in an embodiment of the present application. In this embodiment, the server side includes 5 units for executing Figure 1 For details of the steps in the corresponding embodiments, please refer to Figure 1 as well as Figure 1 For the convenience of explanation, only the parts related to this embodiment are shown. Figure 2The early warning method device 20 based on big data analysis includes: a training unit 21, a prediction unit 22, an alarm unit 23, a construction unit 24, and a sending unit 25, wherein:

[0064] A training unit 21 is used to train the data features of the first original data using a preset algorithm to construct a prediction model;

[0065] A prediction unit 22, configured to perform trend prediction on the second original data by using the prediction model to obtain a predicted value of the second original data;

[0066] an alarm unit 23, configured to output an alarm message if the difference set between the predicted value and the second original data is greater than a first dynamic threshold set;

[0067] A construction unit 24 is used to construct an alarm strategy chain based on the association relationship between the alarm items in the alarm information and the abnormal cause of the alarm information;

[0068] The sending unit 25 is configured to send the warning information to the warning terminal according to the target node information if the real-time warning information in the real-time service data matches the target node information in the warning policy chain.

[0069] As an embodiment of the present application, the early warning method device 20 based on big data analysis also includes:

[0070] The first execution unit 26 is used to process the first original data using the principal component analysis technology to obtain data features of the first original data; and to train the data features of the first original data using a preset algorithm to construct a prediction model.

[0071] The second execution unit 27 is used to average the predicted value and the second original data within a preset period to obtain an average predicted value and an average second original data within the period; when the difference set between the average predicted value and the average second original data within the period is greater than the first dynamic threshold set, an abnormal period point is obtained; and according to the abnormal period point and the preset period threshold, an alarm message is output.

[0072] As an embodiment of the present application, the alarm unit is specifically used to obtain abnormal data in the second original data based on the predicted value and the second original data, and the first dynamic threshold set, and to obtain abnormal cycle points based on the abnormal data and a preset cycle, and to output alarm information through the abnormal cycle points and the preset cycle threshold when the number of consecutive occurrences of the abnormal cycle points is greater than the preset cycle threshold.

[0073] The third execution unit 28 is used to classify and analyze each alarm item in the alarm information, and use a decision tree algorithm to obtain the abnormal cause of the alarm item; use an Apriori algorithm and an FP-Growth algorithm, through data mining technology, and the abnormal cause of the alarm item to obtain the correlation between the alarm items in the alarm information; use the correlation between the alarm items in the alarm information as an alarm strategy chain.

[0074] The fourth execution unit 29 is used to obtain real-time alarm information by comparing the difference set between the predicted value of the real-time business data and the real-time business data with the first dynamic threshold set; by matching the real-time alarm information with the target node information in the alarm policy chain, searching the alarm policy chain for node information associated with the target node information to obtain the associated node alarm information of the target node in the alarm policy chain; based on the associated node alarm information, using the configuration system to send the alarm information to the alarm terminal.

[0075] It should be understood that Figure 2 In the structural block diagram of the device of the early warning method based on big data analysis, each unit is used to execute Figure 1 The steps in the corresponding embodiments, and for Figure 1 Each step in the corresponding embodiment has been explained in detail in the above embodiment. Figure 1 as well as Figure 1 The relevant descriptions in the corresponding embodiments are not repeated here.

[0076] In one embodiment, a computer device is provided. The computer device is a server, and its internal structure diagram can be as follows: Figure 3 As shown. The computer device 30 includes a processor 31, an internal memory 33, and a network interface 34 connected through a system bus 32. Among them, the processor 31 of the computer device is used to provide computing and control capabilities. The memory of the computer device 30 includes a readable storage medium 35 and an internal memory 33. The readable storage medium 35 stores an operating system 36, a computer-readable instruction 37, and a database 38. The internal memory 33 provides an environment for the operation of the operating system 36 and the computer-readable instruction 37 in the readable storage medium 35. The database 38 of the computer device 30 is used to store data involved in the early warning method based on big data analysis. The network interface 33 of the computer device 30 is used to communicate with an external terminal through a network connection. When the computer-readable instruction 37 is executed by the processor 31, an early warning method based on big data analysis is implemented. The readable storage medium 35 provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0077] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer-readable instructions are executed, they may include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0078] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0079] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. An early warning method based on big data analysis, characterized in that: include: Using a preset algorithm to train the data features of the first original data to construct a prediction model; wherein the preset algorithm is selected from a preset database according to the data features; Performing trend prediction on the second original data by using the prediction model to obtain a predicted value of the second original data; If the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, an alarm message is output; the alarm message is used to indicate an abnormality in the second original data; Classify and analyze each alarm item in the alarm information, and use a decision tree algorithm to obtain the abnormal cause of the alarm item; Using the Apriori algorithm and the FP-Growth algorithm, as well as the abnormal causes of the alarm items, and data mining technology, the correlation between the alarm items in the alarm information is obtained; The association relationship between the alarm items in the alarm information is used as an alarm strategy chain; wherein the association relationship between the alarm items in the alarm information is obtained by analyzing the alarm information using the Apriori algorithm and the FP-Growth algorithm; the abnormal cause of the alarm information is obtained by a decision tree algorithm; By comparing the difference set between the predicted value of the real-time business data and the real-time business data with the first dynamic threshold set, real-time alarm information is obtained; By matching the real-time alarm information with the target node information in the alarm strategy chain, searching for node information associated with the target node information in the alarm strategy chain, and obtaining the associated node alarm information of the target node in the alarm strategy chain; Based on the associated node warning information, the configuration system is used to send warning information to the warning terminal.

2. The early warning method based on big data analysis according to claim 1, characterized in that: The method of using a preset algorithm to train the data features of the first original data to construct a prediction model includes: Processing the first original data using principal component analysis technology to obtain data features of the first original data; The data features of the first original data are trained using a preset algorithm to construct a prediction model.

3. The early warning method based on big data analysis according to claim 1, characterized in that: If the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, outputting alarm information includes: Within a preset period, averaging the predicted value and the second original data to obtain an average predicted value and average second original data within the period; When the difference set between the average predicted value and the average second original data within the period is greater than the first dynamic threshold set, an abnormal period point is obtained; Output alarm information according to the abnormal period point and the preset period threshold.

4. The early warning method based on big data analysis as claimed in claim 3, characterized in that: The outputting of alarm information according to the abnormal period point and the preset period threshold includes: When the number of consecutive occurrences of the abnormal periodic points is greater than the preset periodic threshold, an alarm message is output.

5. The early warning method based on big data analysis according to claim 1, characterized in that: The sending of warning information to the warning terminal by using the configuration system based on the associated node warning information includes: Based on the associated node alarm information, a target early warning terminal is specified in the configuration system, and the early warning information is sent to the target early warning terminal.

6. An early warning device based on big data analysis, characterized in that: Training unit: using a preset algorithm to train the data features of the first original data to construct a prediction model; wherein the preset algorithm is selected from a preset database according to the data features; Prediction unit: performing trend prediction on the second original data by using the prediction model to obtain a predicted value of the second original data; Alarm unit: if the difference set between the predicted value and the second original data is greater than the first dynamic threshold set, output alarm information; the alarm information is used to indicate an abnormality in the second original data; Construction unit: classify and analyze each alarm item in the alarm information, and obtain the abnormal cause of the alarm item by using a decision tree algorithm; Using the Apriori algorithm and the FP-Growth algorithm, as well as the abnormal causes of the alarm items, and data mining technology, the correlation between the alarm items in the alarm information is obtained; The association relationship between the alarm items in the alarm information is used as an alarm strategy chain; wherein the association relationship between the alarm items in the alarm information is obtained by analyzing the alarm information using the Apriori algorithm and the FP-Growth algorithm; the abnormal cause of the alarm information is obtained by a decision tree algorithm; The sending unit compares the difference set between the predicted value of the real-time service data and the real-time service data with the first dynamic threshold set to obtain real-time alarm information; By matching the real-time alarm information with the target node information in the alarm strategy chain, searching for node information associated with the target node information in the alarm strategy chain, and obtaining the associated node alarm information of the target node in the alarm strategy chain; Based on the associated node warning information, the configuration system is used to send warning information to the warning terminal.

7. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, characterized in that: The computer-readable instructions are readable instructions of the early warning method described in any one of claims 1-5 generated by an engine.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which are used to cause the computer to execute the steps of any one of the methods described in claims 1-5.

Images