Method, device and storage medium for detecting anomaly in periodic data

Abstract

The present application relates to the field of computer technology and discloses a method, device and storage medium for detecting anomalies in periodic data. The method comprises the following steps: determining a data difference based on predicted data corresponding to a current period and measured data corresponding to the current period; and determining that the measured data corresponding to the current period is abnormal if the data difference exceeds an abnormal difference threshold. The predicted data corresponding to the current period is obtained by inputting the measured data and measured period characteristics of at least one previous period into an abnormality detection model, wherein the abnormality detection model is trained based on the measured data of at least one historical period, the measured period characteristics corresponding to at least one historical period and the predicted data corresponding to at least one historical period. It should be noted that the historical period is earlier than at least one previous period, and the abnormal difference threshold is determined based on the predicted data and measured data corresponding to at least one previous period, so as to better detect anomalies and improve the accuracy of alarms.

Description

Technical Field

[0001] The present application relates to the field of computer technology and provides a method, device and storage medium for detecting anomalies in periodic data. Background Art

[0002] At present, as the scale of edge computing business continues to expand, the number of machines in edge clusters is also expanding. A very important point in edge computing technology is how to achieve monitoring and abnormal warning of each edge cluster machine. Thanks to the current development of related monitoring technologies, indicators of each edge cluster can be collected based on the Prometheus open source system.

[0003] However, how to monitor these clusters based on these indicators and detect anomalies in the indicators is also a very complex problem. On the one hand, these clusters are located in different regions and have different network environments and hardware configurations. On the other hand, the services carried by each cluster are also different. Therefore, when issuing warnings for a certain indicator, it is very difficult to detect anomalies for it. It is impossible to establish a unified threshold for processing. Moreover, some indicators have obvious periodicity. If a hard threshold is used to process them, it will greatly increase the number of false alarms. Therefore, the current monitoring and anomaly detection work in edge computing scenarios still has the following problems:

[0004] (1) It is impossible to formulate a unified threshold for all clusters, and existing methods cannot automatically adjust the threshold according to the different situations of each cluster.

[0005] (2) Existing methods cannot handle periodic data. Neither fixed thresholds nor existing dynamic adjustment methods can automatically adjust the thresholds well, resulting in an increase in false alarms. Summary of the Invention

[0006] The embodiments of the present application provide a method, device, and storage medium for performing anomaly detection on periodic data to improve the efficiency and accuracy of detection.

[0007] The specific technical solutions provided in this application are as follows:

[0008] In a first aspect, an embodiment of the present application provides a method for detecting anomalies in periodic data, comprising:

[0009] Determining a data difference based on predicted data corresponding to a current period and measured data corresponding to the current period; wherein the predicted data corresponding to the current period is obtained by inputting measured data and measured period characteristics of at least one previous period into an anomaly detection model; and the anomaly detection model is trained based on measured data of at least one historical period, measured period characteristics corresponding to the at least one historical period, and predicted data corresponding to the at least one historical period, wherein the historical period is earlier than the at least one previous period.

[0010] If the data difference exceeds an abnormal difference threshold, the measured data corresponding to the current cycle is determined to be abnormal, wherein the abnormal difference threshold is determined based on predicted data and measured data corresponding to at least one previous cycle.

[0011] Optionally, the anomaly detection model is trained by:

[0012] Using measured data of at least one historical period and measured period characteristics corresponding to at least one historical period as input parameters of a lasso regression model, and using predicted data corresponding to at least one historical period as output parameters of the lasso regression model;

[0013] Based on the input parameters and output parameters, the lasso regression model is trained, and the trained lasso regression model is used as an anomaly detection model.

[0014] Optionally, the measured data corresponding to the current period is determined by:

[0015] Determine the current start time and the current end time corresponding to the current cycle;

[0016] Based on the current start time and the current end time, determine the current sliding window corresponding to the current period;

[0017] The original data stream is intercepted based on the current sliding window, and the intercepted multiple original data are determined as the measured data corresponding to the current period, wherein the original data stream is a collection of state data of the edge cluster during operation;

[0018] The measured data for at least one previous period is determined by:

[0019] determining a previous start time and a previous end time corresponding to at least one previous period;

[0020] Determining a previous sliding window corresponding to at least one previous period based on a previous start time and a previous end time;

[0021] The original data stream is intercepted based on the previous sliding window, and the intercepted multiple original data are determined as the measured data corresponding to at least one previous period.

[0022] Optionally, the measured periodic characteristics are determined by:

[0023] At each sampling moment preset in the current cycle, the corresponding target features are extracted from the measured data corresponding to the current cycle;

[0024] The measured periodic characteristics are determined based on the respective target characteristics.

[0025] Optionally, the data difference is determined by:

[0026] For each sampling moment in the current cycle, the following operations are performed: subtract the predicted data corresponding to the sampling moment from the measured data corresponding to the sampling moment to obtain a preselected difference value;

[0027] Superimpose the preselected differences at each sampling moment and take the average value based on the superimposed results;

[0028] The mean value was determined as the difference in the data.

[0029] Optionally, the abnormal difference threshold is determined by:

[0030] Inputting measured data corresponding to at least one historical period and measured period features corresponding to at least one historical period into an anomaly detection model to obtain predicted data corresponding to at least one historical period;

[0031] An abnormal difference threshold is determined based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period.

[0032] Optionally, determining the abnormal difference threshold based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period includes:

[0033] For each preset previous sampling moment in at least one historical period, the following operations are performed: subtracting the predicted data corresponding to the previous sampling moment from the measured data corresponding to the previous sampling moment to obtain a preselected previous difference value;

[0034] The preselected previous difference values ​​at each previous sampling moment are superimposed, a previous average value is obtained based on the superimposed previous results, and the previous average value is determined as the abnormal difference threshold.

[0035] In a second aspect, an embodiment of the present application further provides a device for detecting anomalies in periodic data, comprising:

[0036] a difference determination unit, configured to determine a data difference based on predicted data corresponding to a current period and measured data corresponding to the current period; wherein the predicted data corresponding to the current period is obtained by inputting measured data and measured period characteristics of at least one previous period into an anomaly detection model; and wherein the anomaly detection model is trained based on measured data of at least one historical period, measured period characteristics corresponding to the at least one historical period, and predicted data corresponding to the at least one historical period, wherein the historical period is earlier than the at least one previous period.

[0037] The abnormality determination unit is configured to determine that the measured data corresponding to the current cycle is abnormal if the data difference exceeds an abnormality difference threshold, wherein the abnormality difference threshold is determined based on the predicted data and the measured data corresponding to at least one previous cycle.

[0038] Optionally, the anomaly detection model is trained by:

[0039] Using measured data of at least one historical period and measured period characteristics corresponding to at least one historical period as input parameters of a lasso regression model, and using predicted data corresponding to at least one historical period as output parameters of the lasso regression model;

[0040] Based on the input parameters and output parameters, the lasso regression model is trained, and the trained lasso regression model is used as an anomaly detection model.

[0041] Optionally, the measured data corresponding to the current period is determined by:

[0042] Determine the current start time and the current end time corresponding to the current cycle;

[0043] Based on the current start time and the current end time, determine the current sliding window corresponding to the current period;

[0044] The original data stream is intercepted based on the current sliding window, and the intercepted multiple original data are determined as the measured data corresponding to the current period, wherein the original data stream is a collection of state data of the edge cluster during operation;

[0045] The measured data for at least one previous period is determined by:

[0046] determining a previous start time and a previous end time corresponding to at least one previous period;

[0047] Determining a previous sliding window corresponding to at least one previous period based on a previous start time and a previous end time;

[0048] The original data stream is intercepted based on the previous sliding window, and the intercepted multiple original data are determined as the measured data corresponding to at least one previous period.

[0049] Optionally, the measured periodic characteristics are determined by:

[0050] At each sampling moment preset in the current cycle, the corresponding target features are extracted from the measured data corresponding to the current cycle;

[0051] The measured periodic characteristics are determined based on the respective target characteristics.

[0052] Optionally, the data difference is determined by:

[0053] For each sampling moment in the current cycle, the following operations are performed: subtract the predicted data corresponding to the sampling moment from the measured data corresponding to the sampling moment to obtain a preselected difference value;

[0054] Superimpose the preselected differences at each sampling moment and take the average value based on the superimposed results;

[0055] The mean value was determined as the difference in the data.

[0056] Optionally, the abnormal difference threshold is determined by:

[0057] Inputting measured data corresponding to at least one historical period and measured period features corresponding to at least one historical period into an anomaly detection model to obtain predicted data corresponding to at least one historical period;

[0058] An abnormal difference threshold is determined based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period.

[0059] Optionally, determining the abnormal difference threshold based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period includes:

[0060] For each preset previous sampling moment in at least one historical period, the following operations are performed: subtracting the predicted data corresponding to the previous sampling moment from the measured data corresponding to the previous sampling moment to obtain a preselected previous difference value;

[0061] The preselected previous difference values ​​at each previous sampling moment are superimposed, a previous average value is obtained based on the superimposed previous results, and the previous average value is determined as the abnormal difference threshold.

[0062] In a third aspect, a smart terminal includes:

[0063] a memory for storing executable instructions;

[0064] A processor is used to read and execute executable instructions stored in a memory to implement any method of the first aspect.

[0065] In a fourth aspect, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first aspects above.

[0066] The beneficial effects of this application are as follows:

[0067] To summarize, in an embodiment of the present application, a method, device, and storage medium for detecting anomalies in periodic data are provided. The method includes: determining a data difference based on predicted data corresponding to a current period and measured data corresponding to the current period. If the data difference exceeds an abnormality difference threshold, the measured data corresponding to the current period is determined to be abnormal. The predicted data corresponding to the above-mentioned current period is obtained by inputting the measured data and measured period characteristics of at least one previous period into an abnormality detection model, wherein the abnormality detection model is trained based on the measured data of at least one historical period, the measured period characteristics corresponding to at least one historical period, and the predicted data corresponding to at least one historical period. It should be noted that the historical period is earlier than at least one previous period, and the abnormality difference threshold is determined based on the predicted data and measured data corresponding to at least one previous period, so as to better detect anomalies and improve the accuracy of alarms.

[0068] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0070] Figure 1 Schematic diagram of the system architecture for detecting anomalies in periodic data in an embodiment of the present application;

[0071] Figure 2 Schematic diagram of the process of performing anomaly detection on periodic data in an embodiment of the present application;

[0072] Figure 3 Schematic diagram of the logical architecture of a device for detecting anomalies in periodic data according to an embodiment of the present application;

[0073] Figure 4 Schematic diagram of the physical structure of the smart terminal in the embodiment of the present application. DETAILED DESCRIPTION

[0074] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of the technical solutions of this application, but not all of them. Based on the embodiments described in this application document, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the technical solutions of this application.

[0075] The terms "first," "second," and the like in the description and claims of the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, such that the embodiments of the present invention described herein can be practiced using orders other than those illustrated or described herein.

[0076] The preferred embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0077] See Figure 1 As shown, in the embodiment of the present application, the system includes at least one intelligent terminal, which is used to detect the status data of the edge cluster (including multiple connected servers) to determine whether there is any abnormality in the machine in the edge cluster. The following is a detailed description.

[0078] See Figure 2 As shown, in the embodiment of the present application, the specific process of performing anomaly detection on periodic data is as follows:

[0079] Step 201: Determine a data difference based on the predicted data corresponding to the current cycle and the measured data corresponding to the current cycle. The predicted data corresponding to the current cycle is obtained by inputting measured data and measured cycle features from at least one previous cycle into an anomaly detection model. The anomaly detection model is trained based on measured data from at least one historical cycle, measured cycle features corresponding to the at least one historical cycle, and predicted data corresponding to the at least one historical cycle, where the historical cycle is earlier than the at least one previous cycle.

[0080] As each machine in the edge cluster operates, the intelligent terminal continuously acquires status data. Given the cyclical nature of status data, time is pre-divided into cycles. As each machine in the edge cluster operates, different status data is acquired in each cycle. This status data is referred to as measured data. The length of these cycles is not specifically limited; each cycle can be the same or different. Due to the large number of machines in the edge cluster, the amount of measured data acquired in each cycle is also very large.

[0081] In order to measure whether the measured data for each of the above cycles is abnormal, in the embodiments of the present application, the measured data for each cycle and the measured cycle characteristics are respectively input into the anomaly detection model to obtain the predicted data corresponding to each cycle. The difference between the predicted data and the measured data corresponding to each cycle is used to determine whether the measured data is abnormal. For ease of detailed description, in the embodiments of the present application, the predicted data corresponding to the current cycle and the measured data corresponding to the current cycle are used for detailed description.

[0082] First, let's introduce the anomaly detection model. The anomaly detection model is trained based on the lasso regression model. The above anomaly detection model is trained in the following way:

[0083] (1) The measured data of at least one historical period and the measured period characteristics corresponding to at least one historical period are used as input parameters of the lasso regression model, and the predicted data corresponding to at least one historical period are used as output parameters of the lasso regression model.

[0084] In order to train the model so that it conforms to the development law of the above-mentioned state data as much as possible, during the implementation process, the measured data of the historical period and the measured period characteristics corresponding to the historical period are used as the input parameters of the lasso regression model, and the predicted data corresponding to the historical period are used as the output parameters of the lasso regression model, which serve as the basis for training.

[0085] To simplify the training calculation process, the number of historical cycles can be one. Preferably, measured data and corresponding measured period features from a historical cycle close to the current time are selected. This makes the trained anomaly detection model more effective. Of course, the number of historical cycles can also be multiple, that is, measured data and corresponding measured period features from multiple historical cycles are selected as input parameters. This makes the trained anomaly detection model more stable.

[0086] It should be noted that the historical period here is a period earlier than at least one previous period, that is, the time when the input parameters for training the lasso regression model are used is earlier than the previous period in which the prediction data corresponding to the current period can be trained.

[0087] Correspondingly, the output parameters of the lasso regression model are the predicted data corresponding to the above historical periods. It should be noted that, since the prediction process is to use current data to infer data for a period of time in the future, the predicted data corresponding to at least one historical period here is actually data inferred by using the measured data of the historical period and the measured period characteristics corresponding to the historical period. The time of occurrence of the measured data of the above historical period and the predicted data corresponding to the historical period are not completely consistent.

[0088] (2) Based on the input parameters and output parameters, the lasso regression model is trained, and the trained lasso regression model is used as an anomaly detection model.

[0089] After the input parameters and output parameters of the lasso regression model are determined, the lasso regression model is trained, that is, its internal parameters are adjusted to obtain a trained lasso regression model, and the trained lasso regression model is used as an anomaly detection model.

[0090] After determining the anomaly detection model to be used, the input data, that is, the measured data corresponding to the current period, is further determined. The measured data corresponding to the current period is determined in the following way:

[0091] 1) Determine the current start time and the current end time corresponding to the current cycle.

[0092] Since the number of machines included in the edge cluster is huge, in order to determine the measured data corresponding to the current cycle, during the implementation process, the current start time and the current end time corresponding to the current cycle are first determined within the time range, that is, the time length corresponding to the current cycle is determined.

[0093] 2) Based on the current start time and the current end time, determine the current sliding window corresponding to the current period.

[0094] After the time length corresponding to the current cycle is determined by the current start time and the current end time, a sliding window having the same time length as the above is selected as the current sliding window corresponding to the current cycle.

[0095] 3) The original data stream is intercepted based on the current sliding window, and the intercepted multiple original data are determined as the measured data corresponding to the current period, wherein the original data stream is a collection of state data of the edge cluster during operation.

[0096] After determining the current sliding window, the original data stream is intercepted using the current sliding window. Here, the original data stream is the collection of all state data generated by each machine in the edge cluster over time. By intercepting the original data stream using the current sliding window, multiple pieces of raw data corresponding to the time period of the current sliding window can be obtained.

[0097] Likewise, the measured data for at least one previous period is determined as follows:

[0098] 1] Determine a previous start time and a previous end time corresponding to at least one previous cycle.

[0099] Since the number of machines included in the edge cluster is huge, in order to determine the measured data corresponding to at least one previous period, during the implementation process, the previous start time and the previous end time corresponding to at least one previous period are first determined within the time range, that is, the time length corresponding to at least one previous period is determined.

[0100] 2] Based on the previous start time and the previous end time, determine a previous sliding window corresponding to at least one previous cycle.

[0101] Accordingly, after the time length corresponding to at least one previous cycle is determined by the previous start time and the previous end time, a sliding window consistent with the above time length is selected as the previous sliding window corresponding to the at least one previous cycle.

[0102] 3] intercepting the original data stream based on the previous sliding window, and determining the intercepted multiple original data as the measured data corresponding to at least one previous period.

[0103] After determining the previous sliding window, we use it to intercept the raw data stream. Here, the raw data stream is the collection of all state data generated over time by each machine in the edge cluster. By intercepting the raw data stream with the previous sliding window, we can obtain multiple raw data points corresponding to the period of time in the previous sliding window.

[0104] After determining the measured data corresponding to the current cycle, another input data needs to be determined, namely the measured cycle characteristics. The measured cycle characteristics are determined in the following way:

[0105] [1] At each sampling moment preset in the current cycle, the corresponding target features are extracted from the measured data corresponding to the current cycle.

[0106] Considering that different types of edge clusters may have different measured period characteristics, during the implementation process, in order to extract the characteristics from the measured data, multiple sampling moments will be set in the current period in advance, and the corresponding target features will be extracted from the measured data corresponding to the current period according to the preset sampling moments. The specific extraction methods will not be repeated here.

[0107] [2] Determine the measured periodic characteristics based on the various target characteristics.

[0108] After extracting multiple target features from the measured data corresponding to the current cycle, each target feature can be refined through classification, aggregation, etc. to determine the measured cycle feature. During implementation, this measured cycle feature is fed into the anomaly detection model as another input data.

[0109] After inputting the measured data and measured period features of at least one previous period into the anomaly detection model, the predicted data corresponding to the current period is obtained, and the data difference is further determined based on the predicted data and the measured data.

[0110] Specifically, the data difference is determined by:

[0111] (1) For each sampling moment in the current cycle, perform the following operations: subtract the predicted data corresponding to the sampling moment from the measured data corresponding to the sampling moment to obtain a preselected difference value.

[0112] Because the amount of measured and predicted data is enormous, the implementation requires subtracting the measured and predicted data at the same time. At each sampling moment in the current cycle, the following operations are performed: The predicted data corresponding to the sampling moment is obtained, and the measured data corresponding to the sampling moment is obtained. The predicted and measured data at the same sampling moment are then subtracted to obtain a preselected difference value. This allows for multiple preselected difference values ​​to be obtained at multiple sampling moments.

[0113] (2) Superimposing the preselected differences at each sampling moment and taking the average value based on the superimposed result.

[0114] Taking into account the different number of sampling moments included in each cycle, in order to make a unified consideration for each cycle, during the implementation process, the pre-selected differences of each sampling moment are superimposed, that is, the sum of each pre-selected difference is calculated, and then the average value is taken based on the superimposed result, that is, the average calculation is performed after the summation.

[0115] (3) Determine the mean value as the data difference.

[0116] During implementation, the average value obtained in the above steps is determined as the data difference, that is, the data difference is the average value of the difference between the predicted data and the measured data in each period.

[0117] Step 202: If the data difference exceeds an abnormal difference threshold, the measured data corresponding to the current cycle is determined to be abnormal, wherein the abnormal difference threshold is determined based on the predicted data and the measured data corresponding to at least one previous cycle.

[0118] During implementation, after determining the data difference, we use this data difference to further determine whether the measured data corresponding to the current cycle is abnormal. The measurement standard for the data difference is the abnormal difference threshold.

[0119] Taking into account the correlation between measured data, during implementation, the abnormal difference threshold is determined by a historical period earlier than at least one previous period. The abnormal difference threshold is determined in the following way:

[0120] 1) Inputting measured data corresponding to at least one historical period and measured period features corresponding to at least one historical period into an anomaly detection model to obtain predicted data corresponding to at least one historical period.

[0121] During the implementation process, in order to obtain the anomaly difference threshold, we must first obtain the predicted data corresponding to the historical period. The specific method is: extract the corresponding measured period characteristics from the above historical period, and then input the measured data corresponding to the above historical period and the corresponding measured period characteristics into the anomaly detection model to obtain the predicted data corresponding to the historical period.

[0122] It should be noted that, in order to make the abnormal difference threshold more accurate, the number of the above historical periods can be one or more.

[0123] 2) Determining an abnormal difference threshold based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period.

[0124] During the implementation process, after obtaining the forecast data corresponding to the historical period and the measured data corresponding to the historical period, the abnormal difference threshold can be determined.

[0125] Specifically, determining the abnormal difference threshold includes:

[0126] 1] For each preset previous sampling moment in at least one historical period, perform the following operations: subtract the predicted data corresponding to the previous sampling moment from the measured data corresponding to the previous sampling moment to obtain a preselected previous difference value.

[0127] Similarly, during implementation, it is necessary to perform a subtraction between the measured data and the predicted data at the same time. For each previous sampling time within at least one historical period, the following operations are performed: the predicted data corresponding to the previous sampling time is obtained, and the measured data corresponding to the previous sampling time is obtained. The predicted data and the measured data at the same previous sampling time are subtracted to obtain a preselected previous difference value, thereby obtaining multiple corresponding preselected previous difference values ​​at multiple previous sampling times.

[0128] 2] Superimpose the preselected previous difference values ​​of each previous sampling moment, obtain the previous average value based on the superimposed previous results, and determine the previous average value as the abnormal difference threshold.

[0129] Similarly, considering that the number of previous sampling moments included in each cycle is different, in order to make unified considerations for each cycle, during the implementation process, the pre-selected previous differences of each previous sampling moment are superimposed, that is, the sum of each pre-selected previous difference is calculated, and then the average value is taken based on the superimposed result, that is, the average calculation is performed after the summation, and the calculated previous average value is determined as the abnormal difference threshold.

[0130] Based on the same inventive concept, see Figure 3 As shown, an embodiment of the present application provides a device for detecting anomalies in periodic data, including:

[0131] The difference determination unit 301 is configured to determine a data difference based on the predicted data corresponding to the current period and the measured data corresponding to the current period; wherein the predicted data corresponding to the current period is obtained by inputting the measured data and measured period characteristics of at least one previous period into an anomaly detection model; and the anomaly detection model is trained based on the measured data of at least one historical period, the measured period characteristics corresponding to the at least one historical period, and the predicted data corresponding to the at least one historical period, wherein the historical period is earlier than the at least one previous period.

[0132] The abnormality determination unit 302 is configured to determine that the measured data corresponding to the current cycle is abnormal if the data difference exceeds an abnormality difference threshold, wherein the abnormality difference threshold is determined based on the predicted data and the measured data corresponding to at least one previous cycle.

[0133] Optionally, the anomaly detection model is trained by:

[0134] Using measured data of at least one historical period and measured period characteristics corresponding to at least one historical period as input parameters of a lasso regression model, and using predicted data corresponding to at least one historical period as output parameters of the lasso regression model;

[0135] Based on the input parameters and output parameters, the lasso regression model is trained, and the trained lasso regression model is used as an anomaly detection model.

[0136] Optionally, the measured data corresponding to the current period is determined by:

[0137] Determine the current start time and the current end time corresponding to the current cycle;

[0138] Based on the current start time and the current end time, determine the current sliding window corresponding to the current period;

[0139] The original data stream is intercepted based on the current sliding window, and the intercepted multiple original data are determined as the measured data corresponding to the current period, wherein the original data stream is a collection of state data of the edge cluster during operation;

[0140] The measured data for at least one previous period is determined by:

[0141] determining a previous start time and a previous end time corresponding to at least one previous period;

[0142] Determining a previous sliding window corresponding to at least one previous period based on a previous start time and a previous end time;

[0143] The original data stream is intercepted based on the previous sliding window, and the intercepted multiple original data are determined as the measured data corresponding to at least one previous period.

[0144] Optionally, the measured periodic characteristics are determined by:

[0145] At each sampling moment preset in the current cycle, the corresponding target features are extracted from the measured data corresponding to the current cycle;

[0146] The measured periodic characteristics are determined based on the respective target characteristics.

[0147] Optionally, the data difference is determined by:

[0148] For each sampling moment in the current cycle, the following operations are performed: subtract the predicted data corresponding to the sampling moment from the measured data corresponding to the sampling moment to obtain a preselected difference value;

[0149] Superimpose the preselected differences at each sampling moment and take the average value based on the superimposed results;

[0150] The mean value was determined as the difference in the data.

[0151] Optionally, the abnormal difference threshold is determined by:

[0152] Inputting measured data corresponding to at least one historical period and measured period features corresponding to at least one historical period into an anomaly detection model to obtain predicted data corresponding to at least one historical period;

[0153] An abnormal difference threshold is determined based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period.

[0154] Optionally, determining the abnormal difference threshold based on the predicted data corresponding to at least one historical period and the measured data corresponding to at least one historical period includes:

[0155] For each preset previous sampling moment in at least one historical period, the following operations are performed: subtracting the predicted data corresponding to the previous sampling moment from the measured data corresponding to the previous sampling moment to obtain a preselected previous difference value;

[0156] The preselected previous difference values ​​at each previous sampling moment are superimposed, a previous average value is obtained based on the superimposed previous results, and the previous average value is determined as the abnormal difference threshold.

[0157] Based on the same inventive concept, see Figure 4As shown, an embodiment of the present application provides a smart terminal, including: a memory 401 for storing executable instructions; a processor 402 for reading and executing the executable instructions stored in the memory, and executing any one of the methods of the first aspect above.

[0158] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first aspects above.

[0159] To summarize, in an embodiment of the present application, a method, device, and storage medium for detecting anomalies in periodic data are provided. The method includes: determining a data difference based on predicted data corresponding to a current period and measured data corresponding to the current period. If the data difference exceeds an abnormality difference threshold, the measured data corresponding to the current period is determined to be abnormal. The predicted data corresponding to the above-mentioned current period is obtained by inputting the measured data and measured period characteristics of at least one previous period into an abnormality detection model, wherein the abnormality detection model is trained based on the measured data of at least one historical period, the measured period characteristics corresponding to at least one historical period, and the predicted data corresponding to at least one historical period. It should be noted that the historical period is earlier than at least one previous period, and the abnormality difference threshold is determined based on the predicted data and measured data corresponding to at least one previous period, so as to better detect anomalies and improve the accuracy of alarms.

[0160] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program product systems. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product system implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program product systems according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0162] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0164] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for detecting anomalies in periodic data, characterized in that: The method comprises: Determine a data difference based on the predicted data corresponding to the current cycle and the measured data corresponding to the current cycle; wherein the predicted data corresponding to the current cycle is obtained after inputting the measured data and measured cycle characteristics of at least one previous cycle into an anomaly detection model; the anomaly detection model is trained based on the measured data of at least one historical cycle, the measured cycle characteristics corresponding to the at least one historical cycle, and the predicted data corresponding to the at least one historical cycle, wherein the historical cycle is earlier than the at least one previous cycle, different types of edge clusters have different measured cycle characteristics, and the measured cycle characteristics are determined in the following manner: at each sampling time preset in the current cycle, corresponding target features are extracted from the measured data corresponding to the current cycle, and the measured cycle characteristics are determined based on each of the target features; If the data difference exceeds an abnormal difference threshold, the measured data corresponding to the current cycle is determined to be abnormal, wherein the abnormal difference threshold is determined based on predicted data and measured data corresponding to at least one previous cycle.

2. The method according to claim 1, wherein The anomaly detection model is trained in the following way: Using the measured data of the at least one historical period and the measured period characteristics corresponding to the at least one historical period as input parameters of the lasso regression model, and using the predicted data corresponding to the at least one historical period as output parameters of the lasso regression model; The lasso regression model is trained based on the input parameters and the output parameters, and the trained lasso regression model is used as the anomaly detection model.

3. The method according to claim 1, wherein The measured data corresponding to the current period is determined by: Determine a current start time and a current end time corresponding to the current cycle; Determining a current sliding window corresponding to the current period based on the current start time and the current end time; Intercepting the original data stream based on the current sliding window, and determining the intercepted multiple original data as the measured data corresponding to the current period, wherein the original data stream is a collection of state data of the edge cluster during operation; The measured data of the at least one previous cycle is determined by: determining a previous start time and a previous end time corresponding to the at least one previous period; Determining a previous sliding window corresponding to the at least one previous period based on the previous start time and the previous end time; The original data stream is intercepted based on the previous sliding window, and the intercepted multiple original data are determined as the measured data corresponding to the at least one previous period.

4. The method according to claim 3, wherein The data difference is determined in the following way: For each of the sampling moments in the current cycle, performing the following operations: subtracting the predicted data corresponding to the sampling moment from the measured data corresponding to the sampling moment to obtain a preselected difference value; superimposing the preselected differences at the respective sampling moments, and taking an average value based on the superimposed results; The average value is determined as the data difference value.

5. The method according to any one of claims 1 to 3, characterized in that: The abnormal difference threshold is determined by: Inputting the measured data corresponding to the at least one historical period and the measured period features corresponding to the at least one historical period into an anomaly detection model to obtain predicted data corresponding to the at least one historical period; The abnormal difference threshold is determined based on the predicted data corresponding to the at least one historical period and the measured data corresponding to the at least one historical period.

6. The method according to claim 5, wherein The determining the abnormal difference threshold based on the predicted data corresponding to the at least one historical period and the measured data corresponding to the at least one historical period includes: For each preset previous sampling moment in the at least one historical period, performing the following operations: subtracting the predicted data corresponding to the previous sampling moment from the measured data corresponding to the previous sampling moment to obtain a preselected previous difference value; The preselected previous difference values ​​at the previous sampling moments are superimposed, a previous average value is obtained based on the superimposed previous results, and the previous average value is determined as the abnormal difference threshold.

7. A device for detecting anomalies in periodic data, characterized in that: include: A difference determination unit is configured to determine a data difference based on the predicted data corresponding to the current cycle and the measured data corresponding to the current cycle; wherein the predicted data corresponding to the current cycle is obtained by inputting the measured data and measured cycle characteristics of at least one previous cycle into an anomaly detection model; the anomaly detection model is trained based on the measured data of at least one historical cycle, the measured cycle characteristics corresponding to the at least one historical cycle, and the predicted data corresponding to the at least one historical cycle, wherein the historical cycle is earlier than the at least one previous cycle, different types of edge clusters have different measured cycle characteristics, and the measured cycle characteristics are determined in the following manner: at each sampling moment preset in the current cycle, corresponding target features are extracted from the measured data corresponding to the current cycle, and the measured cycle characteristics are determined based on each of the target features; An abnormality determination unit is used to determine that the measured data corresponding to the current cycle is abnormal if the data difference exceeds an abnormal difference threshold, wherein the abnormal difference threshold is determined based on the predicted data and the measured data corresponding to at least one previous cycle.

8. An intelligent terminal, characterized in that: include: a memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that When the instructions in the storage medium are executed by a processor, the processor is enabled to perform the method according to any one of claims 1 to 6.

Images