Abnormal data detection method and device, equipment and storage medium

Abstract

The application provides an abnormal data detection method and device, equipment and a storage medium, relates to the field of communication, and is used for solving the problem of low efficiency of detecting abnormal data. The method comprises the following steps: acquiring a to-be-detected data set, the to-be-detected data set comprising: a first data set corresponding to each historical moment in a plurality of historical moments, and one first data set comprising a plurality of types of data. According to a preset abnormal threshold and a first coefficient, the abnormal data proportion of each first data set is determined. According to the abnormal data proportion of each first data set and the first coefficient, a plurality of second coefficients are determined. According to the preset abnormal threshold and the plurality of second coefficients, a plurality of first abnormal data sets are determined from the to-be-detected data set, one second coefficient corresponding to one first abnormal data set. A target abnormal data set is determined from the plurality of first abnormal data sets, and the target abnormal data set is the union set of the plurality of first abnormal data sets.

Description

Technical Field

[0001] This application relates to the field of communications, and in particular to an abnormal data detection method, apparatus, device, and storage medium. Background Technology

[0002] In recent years, with the development of communication technology, a large amount of network data has emerged in communication networks. This includes network configuration data, performance data, service data, and anomaly data.

[0003] Currently, detecting abnormal data in communication network data requires first arranging the data chronologically to generate time-series data. Then, maintenance personnel analyze each data point in the time-series data to detect anomalies. However, this approach increases the workload for maintenance personnel when dealing with large volumes of communication network data, thus increasing the time required to detect anomalies and resulting in low efficiency. Summary of the Invention

[0004] This application provides an abnormal data detection method, apparatus, device, and storage medium to solve the problem of low efficiency in detecting abnormal data.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] According to a first aspect of this application, an abnormal data detection method is provided. The method includes:

[0007] An anomaly detection device (referred to as the "detection device") acquires a dataset to be detected, which includes: a first dataset corresponding to each historical time point from multiple historical time points, where each first dataset contains multiple data types. The detection device determines the proportion of anomalous data in each first dataset based on a preset anomaly threshold and a first coefficient. The detection device then determines multiple second coefficients based on the proportion of anomalous data in each first dataset and the first coefficient. Based on the preset anomaly threshold and the multiple second coefficients, the detection device identifies multiple first anomalous datasets from the dataset to be detected, with each second coefficient corresponding to one first anomalous dataset. Finally, the detection device identifies a target anomalous dataset from these multiple first anomalous datasets; the target anomalous dataset is the union of the multiple first anomalous datasets.

[0008] Optionally, the method described above, in which the detection device determines the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient, includes: the detection device determining abnormal data corresponding to each type among multiple types based on the preset anomaly threshold and the first coefficient; the detection device determining multiple second abnormal datasets based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data corresponding to each type, wherein each second abnormal dataset includes abnormal data corresponding to each type among multiple types at a historical time, and the multiple first datasets correspond to the multiple second abnormal datasets; and for each first dataset, the detection device determining the proportion of abnormal data in each first dataset according to a first operation, wherein the first operation includes: the detection device determining the proportion of abnormal data in the first subset dataset based on the number of data in the first subset dataset and the number of data in the first sub-abnormal dataset, wherein the first subset dataset is any dataset among the multiple first datasets, and the first sub-abnormal dataset is the dataset among the multiple second abnormal datasets that corresponds to the same historical time as the first subset dataset.

[0009] Optionally, the method described above for "the detection device determining a target abnormal dataset from multiple first abnormal datasets" includes: the detection device determining multiple third abnormal datasets from the multiple first abnormal datasets, wherein the proportion of real abnormal data in the third abnormal datasets is greater than a preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset. The detection device then determines a target abnormal dataset from the multiple third abnormal datasets, wherein the target abnormal dataset is the union of the multiple third abnormal datasets.

[0010] Optionally, the method described above for "the detection device determining multiple third abnormal datasets from multiple first abnormal datasets" includes: for multiple first abnormal datasets, the detection device determines multiple third abnormal datasets from the multiple first abnormal datasets according to a second operation, the second operation including: the detection device acquiring a target ratio, the target ratio being the proportion of real abnormal data in a second sub-abnormal dataset, the second sub-abnormal dataset being any dataset among the multiple first abnormal datasets. If the target ratio is greater than a preset real ratio threshold, the detection device uses the second sub-abnormal dataset as the third abnormal dataset. If the target ratio is less than the preset real ratio threshold, the detection device determines a fourth abnormal dataset based on the target ratio, the proportion of abnormal data in the first dataset corresponding to the second sub-abnormal dataset, a second coefficient corresponding to the second sub-abnormal dataset, and a preset abnormal threshold, and performs the second operation on the fourth abnormal dataset, the fourth abnormal dataset including the abnormal data in the second sub-abnormal dataset.

[0011] According to a second aspect of this application, an abnormal data detection device is provided, the device including an acquisition module and a processing module.

[0012] The module includes an acquisition module for acquiring the dataset to be detected, which includes a first dataset corresponding to each historical time point from multiple historical time points. Each first dataset contains multiple data types. The processing module determines the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient. The processing module also determines multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient. Furthermore, the processing module determines multiple first abnormal datasets from the dataset to be detected based on the preset anomaly threshold and the multiple second coefficients, with each second coefficient corresponding to one first abnormal dataset. Finally, the processing module determines a target abnormal dataset from the multiple first abnormal datasets, which is the union of the multiple first abnormal datasets.

[0013] Optionally, the processing module is further configured to determine the abnormal data corresponding to each of the multiple types based on a preset anomaly threshold and a first coefficient. The processing module is also configured to determine multiple second abnormal datasets based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data of each type. Each second abnormal dataset includes abnormal data corresponding to each of the multiple types at a given historical time. Multiple first datasets correspond to multiple second abnormal datasets. Specifically, the processing module is configured to determine the proportion of abnormal data in each first dataset according to a first operation. The first operation includes: determining the proportion of abnormal data in the first subset dataset based on the number of data in the first subset dataset and the number of data in the first sub-abnormal dataset. The first subset dataset is any dataset among the multiple first datasets, and the first sub-abnormal dataset is the dataset among the multiple second abnormal datasets that corresponds to the same historical time as the first subset dataset.

[0014] Optionally, a processing module is specifically used to determine multiple third abnormal datasets from multiple first abnormal datasets. The proportion of real abnormal data in the third abnormal datasets is greater than a preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset. The processing module is also specifically used to determine a target abnormal dataset from the multiple third abnormal datasets. The target abnormal dataset is the union of the multiple third abnormal datasets.

[0015] Optionally, a processing module is specifically used to determine multiple third abnormal datasets from multiple first abnormal datasets according to a second operation. The second operation includes: obtaining a target ratio, where the target ratio is the proportion of real abnormal data in a second sub-abnormal dataset, and the second sub-abnormal dataset is any dataset among the multiple first abnormal datasets. If the target ratio is greater than a preset real ratio threshold, then the second sub-abnormal dataset is used as the third abnormal dataset. If the target ratio is less than the preset real ratio threshold, then a fourth abnormal dataset is determined based on the target ratio, the abnormal data proportion of the first dataset corresponding to the second sub-abnormal dataset, a second coefficient corresponding to the second sub-abnormal dataset, and a preset abnormal threshold. The second operation is then performed on the fourth abnormal dataset, where the fourth abnormal dataset includes the abnormal data in the second sub-abnormal dataset.

[0016] According to a third aspect of this application, an abnormal data detection apparatus is provided, comprising a processor and a memory. The processor and the memory are coupled. The memory is used to store one or more programs, the one or more programs including computer-executable instructions. When the abnormal data detection apparatus is running, the processor executes the computer-executable instructions stored in the memory to implement the abnormal data detection method as described in the first aspect and any possible implementation thereof.

[0017] According to a fourth aspect of this application, a computer-readable storage medium is provided, which stores instructions that, when executed on a computer, cause the computer to perform the abnormal data detection method described in the first aspect and any possible implementation thereof.

[0018] According to a fifth aspect of this application, a computer program product is provided, comprising a computer program that, when executed by a processor, causes the computer to implement the abnormal data detection method as described in the first aspect and any possible implementation thereof.

[0019] The technical problems that the abnormal data detection device, computer equipment, computer storage medium or computer program product can solve and the technical effects it can achieve can be found in the technical problems and effects solved in the first aspect above, and will not be repeated here.

[0020] The technical solution provided in this application offers at least the following advantages: The detection device acquires a dataset to be detected, which includes a first dataset corresponding to each historical time point across multiple historical time points, and each first dataset contains multiple types of data. Then, the detection device determines the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient. Next, the detection device determines multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient. Then, the detection device determines multiple first abnormal datasets from the dataset to be detected based on the preset anomaly threshold and the multiple second coefficients, with each second coefficient corresponding to one first abnormal dataset. Finally, the detection device determines a target abnormal dataset from the multiple first abnormal datasets, where the target abnormal dataset is the union of the multiple first abnormal datasets. In other words, the detection device can determine multiple abnormal datasets based on the proportion of abnormal data in the dataset corresponding to each historical time point across multiple historical time points, a preset anomaly threshold, and the first coefficients, and use the abnormal data from the union of the multiple abnormal datasets as the abnormal data in the dataset to be detected. This not only improves the efficiency of detecting abnormal data but also ensures that the detected abnormal data is genuine, thus improving the accuracy of the abnormal data. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.

[0022] Figure 1 A schematic diagram of a communication system provided in an embodiment of this application;

[0023] Figure 2 A flowchart illustrating an abnormal data detection method provided in an embodiment of this application;

[0024] Figure 3 A flowchart of another abnormal data detection method provided in the embodiments of this application;

[0025] Figure 4 A flowchart of another abnormal data detection method provided in the embodiments of this application;

[0026] Figure 5 A flowchart of another abnormal data detection method provided in the embodiments of this application;

[0027] Figure 6 A structural block diagram of an abnormal data detection device provided in an embodiment of this application;

[0028] Figure 7 This is a schematic diagram of the structure of an abnormal data detection device provided in an embodiment of this application;

[0029] Figure 8 A conceptual partial view of a computer program product provided for an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In this article, the character " / " generally indicates that the objects before and after it are in an "or" relationship. For example, A / B can be understood as A or B.

[0032] The terms “first” and “second” in the specification and claims of this application are used to distinguish different objects, rather than to describe a specific order of objects.

[0033] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the steps or modules listed, but may optionally include other steps or modules not listed, or may optionally include other steps or modules inherent to such process, method, product, or device.

[0034] Furthermore, in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design that is described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design options. Specifically, the use of the words "exemplary" or "for example" is intended to present concepts in a concrete manner.

[0035] Before providing a detailed description of the abnormal data detection method in this application, the implementation environment and application scenarios of this application will be introduced first.

[0036] First, the application scenarios of the embodiments of this application will be introduced.

[0037] The abnormal data detection method of this application embodiment is applied to scenarios involving the detection of abnormal data. In related technologies, when detecting abnormal data in communication network data, it is necessary to first arrange the communication network data in chronological order to generate time-series data. Then, maintenance personnel analyze the data in the time-series data one by one to detect abnormal data.

[0038] For example, communication network data includes data A, data B, and data C. Data A corresponds to time A, data B to time B, and data C to time C. Data A, data B, and data C are arranged in chronological order: time A-time B-time C, generating time-series data: data A-data B-data C. Then, maintenance personnel analyze each data point in the data A-data B-data C sequence to detect any abnormal data.

[0039] In summary, the current technical solutions increase the workload of maintenance personnel in analyzing communication network data when the data volume is large, which in turn increases the time required to detect abnormal data in the communication network data, resulting in low efficiency in detecting abnormal data.

[0040] To address the aforementioned issues, this application provides an anomaly detection method. A network device acquires a dataset to be detected, which includes multiple types of data corresponding to each historical time point (i.e., a first dataset). Based on a preset anomaly threshold and a first coefficient, the network device determines multiple anomaly datasets (i.e., second anomaly datasets) from each first dataset. Then, the network device determines multiple second coefficients based on the number of data points in the multiple second anomaly datasets, the number of data points in the corresponding first datasets, and the first coefficient. Next, the network device determines multiple first anomaly datasets from the dataset to be detected based on the preset anomaly threshold and the multiple second coefficients, with each second coefficient corresponding to one first anomaly dataset. Finally, the network device determines a target anomaly dataset from the multiple first anomaly datasets, where the target anomaly dataset is the union of the multiple first anomaly datasets. This approach not only improves the efficiency of anomaly detection but also ensures that the detected anomaly data is genuine, thus improving the accuracy of anomaly detection.

[0041] The implementation environment of the embodiments of this application is described below.

[0042] Figure 1 A schematic diagram of a communication system provided in an embodiment of this application is shown below. Figure 1 As shown, the communication system may include: a network device (such as server 101 or base station) and at least one base station (such as base station 102 or base station 103). Base station 102 (or base station 103) may send a dataset to be detected to server 101. Server 101 may then receive the dataset from base station 102 (or base station 103) and identify any abnormal data within the dataset.

[0043] In some embodiments, server 101 can communicate with base station 102 and base station 103 via wired / wireless communication.

[0044] For example, server 101 can communicate with base stations 102 and 103 via satellite communication. Alternatively, server 101 can communicate with base stations 102 and 103 via spread spectrum microwave communication. Or, server 101 can communicate with base stations 102 and 103 via data radio communication.

[0045] The base station (such as base station 102) can include various forms of base stations, such as macro base stations, micro base stations (also known as small stations), relay stations, access points, etc. Specifically, it can be an access point (AP) in a Wireless Local Area Network (WLAN), a base station (BTS) in a Global System for Mobile Communications (GSM) or Code Division Multiple Access (CDMA), a base station (NodeB, NB) in a Wideband Code Division Multiple Access (WCDMA) network, an evolved Node B (eNB or eNodeB) in LTE, a relay station or access point, or a next-generation Node B (gNB) in vehicle-mounted equipment, wearable devices, and future 5G networks, or a base station in future evolved Public Land Mobile Network (PLMN) networks, etc.

[0046] After introducing the application scenarios and implementation environment of the embodiments of this application, the abnormal data detection method provided by the embodiments of this application will be described in detail below in conjunction with the above implementation environment.

[0047] The methods described in the following embodiments can all be implemented in the aforementioned application scenarios. The following embodiments use a server as the execution entity as an example, and the embodiments of this application are described in detail with reference to the accompanying drawings.

[0048] Figure 2 This is a flowchart illustrating an abnormal data detection method according to an exemplary embodiment. For example... Figure 2 As shown, the method may include S201-S205.

[0049] S201. The server obtains the dataset to be tested.

[0050] The dataset to be detected may include: the first dataset corresponding to each historical moment from multiple historical moments. The first dataset may include various types of data.

[0051] It should be noted that the embodiments of this application do not limit the type of data. For example, various types of data may include: base station power consumption data, signal transmission power, signal transmission rate, and number of user terminals, etc.

[0052] In one possible implementation, the server can periodically acquire the dataset to be detected.

[0053] For example, the server can define multiple historical moments using a one-day period (i.e., from 00:00 to 24:00 each day) as a time cycle and set time intervals. Then, the server can select the data corresponding to each of the multiple historical moments as the first dataset. Alternatively, the server can retrieve data once every preset time interval, with each retrieved data constituting a first dataset.

[0054] For example, as shown in Table 1, a dataset to be detected is presented with a time period of one day (24 hours) and a time interval of 4 hours. The dataset to be detected includes multiple historical moments and multiple first datasets. The multiple historical moments can include: 04:00, 08:00, 12:00, 16:00, 20:00, and 24:00. At 04:00, the signal transmission power is 12 watts, the signal transmission rate is 3 bits / second, and the number of user terminals is 1. That is, the first dataset corresponding to 04:00 includes 12, 3, and 1. Similarly, the first dataset corresponding to 08:00 includes 5, 3, and 4; the first dataset corresponding to 12:00 includes 7, 9, and 6; the first dataset corresponding to 16:00 includes 14, 12, and 10; the first dataset corresponding to 20:00 includes 16, 15, and 17; and the first dataset corresponding to 24:00 includes 1, 17, and 2.

[0055] Table 1 Dataset to be detected

[0056]

[0057] Optionally, the server can determine the dataset to be detected as multiple second datasets based on the type of data. A second dataset can include data of the same type at different times.

[0058] For example, referring to Table 1, the signal transmission power at 04:00, 08:00, 12:00, 16:00, 20:00, and 24:00 is 12 watts, 5 watts, 7 watts, 14 watts, 16 watts, and 1 watt, respectively. Therefore, the second dataset corresponding to the signal transmission power is 12, 5, 7, 14, 16, and 1. Similarly, the second dataset corresponding to the signal transmission rate is 3, 3, 9, 12, 15, and 17, and the second dataset corresponding to the number of user terminals is 1, 4, 6, 10, 17, and 2.

[0059] S202. The server determines the proportion of abnormal data in each first dataset based on the preset abnormal threshold and the first coefficient.

[0060] In this embodiment of the application, the proportion of abnormal data in the first dataset is the ratio between the number of abnormal data in the first dataset and the total number of data in the first dataset.

[0061] For example, the first dataset includes data A, data B, and data C. Data A and data C are outliers, so the proportion of outliers in the first dataset is...

[0062] In some embodiments, such as Figure 3 As shown, in this abnormal data detection method, S202 may include S301-S303.

[0063] S301. The server determines the abnormal data corresponding to each type among multiple types based on the preset abnormal threshold and the first coefficient.

[0064] In one possible design, the preset anomaly threshold can be obtained through the interquartile range (IQR). The server can arrange the data of the first type in ascending order, divide the arranged data into four equal parts, and determine the data at the three dividing points. The first type can be any of several types.

[0065] In one possible design, the positions of the three dividing points can be represented by Formula 1, Formula 2, and Formula 3, respectively.

[0066]

[0067]

[0068]

[0069] Where Q1 represents the position of the first dividing point, Q2 represents the position of the second dividing point, Q3 represents the position of the third dividing point, and n represents the number of data points.

[0070] Then, the server determines the preset anomaly threshold corresponding to the first type of data based on the data at the first segmentation point and the data at the third segmentation point. The preset anomaly threshold is the difference between the data at the first segmentation point and the data at the third segmentation point.

[0071] For example, as shown in Table 2, a dataset to be detected is presented with a time period of one day (24 hours) and a time interval of 1.6 hours. The dataset to be detected includes multiple historical moments and multiple first datasets. The multiple historical moments may include: 01:36, 03:12, 04:48, 06:24, 08:00, 09:36, 11:12, 12:48, 14:24, 16:00, 17:36, 19:12, 20:48, 22:24, and 24:00. At 01:36, the signal transmission power is 12 watts, the signal transmission rate is 3 bits / second, and the number of user terminals is 15. That is, the first dataset corresponding to 01:36 includes 12, 3, and 15. Similarly, the first dataset corresponding to 03:12 includes 11, 5, and 14; the first dataset corresponding to 04:48 includes 14, 9, and 12; the first dataset corresponding to 06:24 includes 13, 12, and 10; the first dataset corresponding to 08:00 includes 13, 15, and 18; the first dataset corresponding to 09:36 includes 1, 17, and 9; the first dataset corresponding to 11:12 includes 2, 10, and 12; and the first dataset corresponding to 12:48 includes 11, 18, and 12. The first dataset corresponding to 14:24 includes 25, 6, and 14; the first dataset corresponding to 16:00 includes 15, 25, and 15; the first dataset corresponding to 17:36 includes 16, 11, and 14; the first dataset corresponding to 19:12 includes 15, 16, and 20; the first dataset corresponding to 20:48 includes 37, 1, and 14; the first dataset corresponding to 22:24 includes 15, 33, and 23; and the first dataset corresponding to 24:00 includes 9, 4, and 13. The server arranges the data of type signal transmission power in ascending order, resulting in 1-2-9-11-11-12-13-13-14-15-15-15-16-25-37. Among these, the data Q′1 corresponding to the first segmentation point Q1 is 11, and the data Q′3 corresponding to the third segmentation point Q3 is 15. Therefore, the preset anomaly threshold for the data of type signal transmission power is 4.

[0072] Similarly, the server arranges the data of type signal transmission rate in ascending order, resulting in 1-3-4-5-6-9-10-11-12-15-16-17-18-25-33. Among them, the data Q′1 corresponding to the position of the first dividing point Q1 is 5, and the data Q′3 corresponding to the position of the third dividing point Q3 is 17. Therefore, the preset abnormal threshold for the data of type signal transmission rate is 12.

[0073] The server arranges the data of type number of user terminals in ascending order, resulting in 9-10-12-12-12-13-14-14-14-14-15-15-18-20-23. Among them, the data Q′1 corresponding to the first dividing point Q1 is 12, and the data Q′3 corresponding to the third dividing point Q3 is 15. Therefore, the preset abnormal threshold corresponding to the data of type signal transmission power is 3.

[0074] Table 2 Dataset to be detected

[0075]

[0076] It should be noted that the preset abnormal threshold can also be set by the operation and maintenance personnel, and this application embodiment does not limit this.

[0077] In one possible implementation, each data type corresponds to a preset anomaly threshold. The server can determine the abnormal data for each of the multiple data types based on the preset anomaly threshold and a first coefficient. The abnormal data for each of the multiple data types can be represented by Formula 4.

[0078] X a >[Q′ 3a +k1×(IQR a )]∪X a <[Q′ 1a -k1×(IQR a Formula 4.

[0079] Among them, X a IQR is used to represent abnormal data corresponding to type a among multiple types. a Q′ is used to represent the preset anomaly threshold corresponding to the a-th type among multiple types. 3a Q′ is used to represent the data corresponding to the position of the third dividing point in the data of type a. 1a This is used to represent the data corresponding to the position of the first dividing point in the data of type a. k1 is used to represent the first coefficient, and k1 defaults to 1.

[0080] For example, taking the first dataset corresponding to each historical moment in the multiple historical moments shown in Table 2 as an example, the abnormal data corresponding to the signal transmission power type includes 1, 2, 25, and 37, the abnormal data corresponding to the signal transmission rate type includes 33, and the abnormal data corresponding to the number of user terminals type includes 20 and 23.

[0081] S302. The server determines multiple second abnormal datasets based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data of each type.

[0082] Among them, a second abnormal dataset includes abnormal data corresponding to each of the multiple types at a historical moment, and multiple first datasets correspond to multiple second abnormal datasets.

[0083] For example, consider the first dataset corresponding to each historical time in the multiple historical times shown in Table 2. If the abnormal data corresponding to signal transmission power includes 37, the abnormal data corresponding to signal transmission rate includes 33, and the abnormal data corresponding to the number of user terminals includes 23, and the historical time corresponding to abnormal data 37 (signal transmission power) is 20:48, the historical time corresponding to abnormal data 33 (signal transmission rate) is 22:24, and the historical time corresponding to abnormal data 23 (number of user terminals) is 22:24, then the server determines that the second abnormal dataset corresponding to historical time 20:48 includes 37, and the second abnormal dataset corresponding to historical time 22:24 includes 33 and 23. The second abnormal dataset corresponding to historical time 20:48 is a subset of the first dataset corresponding to historical time 20:48, and the second abnormal dataset corresponding to historical time 22:24 is a subset of the first dataset corresponding to historical time 22:24.

[0084] In some embodiments, for each first dataset, the proportion of outlier data in each first dataset is determined according to a first operation. The first operation includes: S303.

[0085] S303. The server determines the proportion of abnormal data in the first subset based on the number of data in the first subset and the number of data in the first abnormal subset.

[0086] The first subset of datasets is any dataset from multiple first datasets, and the first sub-abnormal dataset is the dataset from multiple second abnormal datasets that corresponds to the same historical time as the first subset of datasets.

[0087] For example, multiple first datasets include dataset A, dataset B, and dataset C, and multiple second abnormal datasets include dataset D, dataset E, and dataset F. The historical time corresponding to dataset A is the same as the historical time corresponding to dataset D, the historical time corresponding to dataset B is the same as the historical time corresponding to dataset E, and the historical time corresponding to dataset C is the same as the historical time corresponding to dataset F. If the number of data points in dataset A is 3, the number of data points in dataset B is 5, the number of data points in dataset C is 7, the number of data points in dataset D is 2, the number of data points in dataset E is 5, and the number of data points in dataset F is 1, then the server determines the proportion of abnormal data in dataset A to be [percentage missing]. The proportion of outliers in dataset A is 1.

[0088] Understandably, the server can determine the abnormal data corresponding to each of the multiple types based on a preset anomaly threshold and a first coefficient. Then, based on the abnormal data corresponding to each type and the historical time corresponding to that abnormal data, the server determines multiple second abnormal datasets. Each second abnormal dataset includes the abnormal data corresponding to each of the multiple types at a given historical time. Multiple first datasets correspond to multiple second abnormal datasets. Next, for each first dataset, the server determines the proportion of abnormal data in each first dataset according to a first operation. The first operation includes: the server determining the proportion of abnormal data in the first subset dataset based on the number of data in the first subset dataset and the number of data in the first sub-abnormal dataset. The first subset dataset is any dataset among the multiple first datasets, and the first sub-abnormal dataset is the dataset among the multiple second abnormal datasets that corresponds to the same historical time as the first subset dataset. In this way, the server can perform different operations on the first coefficient based on the proportion of abnormal data in each first dataset, improving the operability of the proportion of abnormal data in multiple first datasets and the first coefficient (see S203 for details, which will not be elaborated here).

[0089] S203. The server determines multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient.

[0090] Among them, multiple second coefficients can be represented by Formula 5.

[0091] k 2b =k1+p b Formula 5.

[0092] Where, k 2b Used to represent p among multiple second coefficients b The corresponding second coefficient, p b This is used to represent the proportion of outlier data in the first dataset corresponding to the b-th historical moment among multiple historical moments.

[0093] For example, the proportions of outlier data in multiple first datasets include p1 and p2. Where p1 is... p2 is If k1 is 1, then the server confirms the second coefficient k corresponding to p1. 21 for The second coefficient k corresponding to p2 22 for

[0094] S204. The server determines multiple first abnormal datasets from the dataset to be detected based on a preset abnormal threshold and multiple second coefficients.

[0095] In this case, each second coefficient corresponds to a first abnormal dataset.

[0096] In one possible implementation, the server can determine the abnormal data in each of the multiple first abnormal datasets based on a preset abnormal threshold and multiple second coefficients.

[0097] In one possible design, the anomalous data in the first anomalous dataset can be represented by Equation 6.

[0098] X b >[Q′ 3a +k 2b ×(IQR a )]∪X b <[Q′ 1a -k 2b ×(IQR a Formula 6.

[0099] Among them, X b Used to represent k 2b The abnormal data in the corresponding first abnormal dataset.

[0100] For example, consider the first dataset corresponding to each historical moment in the multiple historical moments shown in Table 2. Multiple second coefficients include k. 21 and k 22 Among them, k 21 Corresponding to the first abnormal dataset A, k 22 Corresponding to the first abnormal dataset B. If k 21 for k22 is The server then determines that the first abnormal dataset A includes 1, 2, 20, 25, 23, and 37, and the first abnormal dataset B includes 1, 2, 23, 25, and 37.

[0101] In some embodiments, the server may record the type and historical time corresponding to each abnormal data in the first abnormal dataset.

[0102] S205. The server determines the target abnormal dataset from multiple first abnormal datasets.

[0103] The target abnormal dataset is the union of multiple first abnormal datasets.

[0104] For example, multiple first abnormal datasets include dataset A, dataset B, and dataset C. If dataset A includes 2, 12, and 41, dataset B includes 3 and 21, and dataset C includes 11, then the target abnormal datasets determined by the server include 2, 3, 11, 12, 21, and 41.

[0105] The technical solution provided by the above embodiments brings at least the following beneficial effects: The server acquires a dataset to be detected, which includes a first dataset corresponding to each historical time in multiple historical time periods, and each first dataset includes multiple types of data. Then, the server determines the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient. Then, the server determines multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient. Then, the server determines multiple first abnormal datasets from the dataset to be detected based on the preset anomaly threshold and the multiple second coefficients, with one second coefficient corresponding to one first abnormal dataset. Then, the server determines a target abnormal dataset from the multiple first abnormal datasets, where the target abnormal dataset is the union of the multiple first abnormal datasets. In other words, the server can determine multiple abnormal datasets based on the proportion of abnormal data in the dataset corresponding to each historical time in multiple historical time periods, a preset anomaly threshold, and a first coefficient, and use the abnormal data of the union of the multiple abnormal datasets as the abnormal data in the dataset to be detected. This not only improves the efficiency of detecting abnormal data but also ensures that the detected abnormal data is genuine abnormal data, thus improving the accuracy of the abnormal data.

[0106] In some embodiments, such as Figure 4 As shown, in this abnormal data detection method, S205 may include S401-S402.

[0107] S401. The server determines multiple third-abnormal datasets from multiple first-abnormal datasets.

[0108] Among them, the proportion of real abnormal data in the third abnormal dataset is greater than the preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset.

[0109] In one possible implementation, the server can determine the proportion of truly anomalous data in each first anomalous dataset. Then, the server can compare this proportion with a preset true proportion threshold. Finally, the server will use the first anomalous dataset where the proportion of truly anomalous data is greater than the preset true proportion threshold as the third anomalous dataset.

[0110] For example, multiple first-abnormal datasets include dataset A, dataset B, and dataset C. Dataset A includes data A and data B; dataset B includes data C, data D, and data E; and dataset C includes data F. Furthermore, in dataset A, data A is real anomalous data and data B is non-real anomalous data; in dataset B, data C and data D are both real anomalous data and data E is non-real anomalous data; and in dataset C, data F is real anomalous data. Therefore, the percentage of real anomalous data in dataset A is... The percentage of truly outlier data in dataset B is: The proportion of real outlier data in dataset C is 1%. If the preset threshold for the real outlier proportion is... The server then determines that dataset C is the third abnormal dataset.

[0111] S402, The server determines the target abnormal dataset from multiple third-party abnormal datasets.

[0112] The target abnormal dataset is the union of multiple third abnormal datasets.

[0113] It is understandable that by identifying multiple third abnormal datasets from multiple first abnormal datasets, and then identifying a target abnormal dataset from multiple third abnormal datasets, the accuracy of abnormal data in the third abnormal datasets can be improved, which in turn can improve the accuracy of abnormal data in the target abnormal datasets.

[0114] In some embodiments, for a plurality of first anomalous datasets, a plurality of third anomalous datasets are determined from the plurality of first anomalous datasets according to a second operation. The second operation includes steps S501-S504.

[0115] like Figure 5 As shown, in this abnormal data detection method, S401 may include:

[0116] S501, The server obtains the target ratio.

[0117] The target ratio is the proportion of real abnormal data in the second sub-abnormal dataset, which is any dataset from multiple first abnormal datasets.

[0118] It should be noted that the embodiments disclosed herein do not limit the method for obtaining the target ratio. For example, the server can filter abnormal data to determine the real abnormal data in order to obtain the target ratio. Alternatively, maintenance personnel can determine the real abnormal data from the second sub-abnormal dataset and obtain the target ratio; the server can then receive the operation from the maintenance personnel to input the target ratio into the server and obtain the target ratio.

[0119] S502. The server determines whether the target ratio is greater than the preset true ratio threshold.

[0120] In some embodiments, the server stores a preset true ratio threshold. The server can determine whether the target ratio is greater than the preset true ratio threshold based on the preset true ratio threshold and the target ratio. If the target ratio is greater than the preset true ratio threshold, the server executes S503. If the target ratio is not greater than the preset true ratio threshold, the server executes S504.

[0121] For example, the preset true ratio threshold for server storage is: If the target ratio A is If the server determines that the target ratio A is greater than the preset true ratio threshold, the server executes S503. If the target ratio B is... If the server determines that the target ratio B is not greater than the preset real ratio threshold, the server executes S504.

[0122] It is understandable that by distinguishing each of the multiple first abnormal datasets according to whether the target proportion is greater than a preset true proportion threshold, each first abnormal dataset can be differentiated. In this way, the server can perform different operations on different first abnormal datasets, improving the operability of multiple first abnormal datasets (see S503 or S504 for details, which will not be elaborated here).

[0123] S503, The server uses the second sub-abnormal dataset as the third abnormal dataset.

[0124] In some embodiments, after S502, the abnormal data detection method may further include S504.

[0125] S504. The server determines the fourth abnormal dataset based on the target ratio, the abnormal data ratio of the first dataset corresponding to the second sub-abnormal dataset, the second coefficient corresponding to the second sub-abnormal dataset, and the preset abnormal threshold.

[0126] The fourth anomaly dataset includes the anomaly data from the second sub-anomaly dataset.

[0127] In one possible implementation, the server can determine the fourth anomalous dataset according to three steps (i.e., step one, step two, and step three). Step one, step two, and step three are described below.

[0128] Step one: The server can determine the third coefficient corresponding to the second sub-abnormal dataset based on the target ratio, the abnormal data ratio of the first dataset corresponding to the second sub-abnormal dataset, and the second coefficient corresponding to the second sub-abnormal dataset. The third coefficient corresponding to the second sub-abnormal dataset can be represented by Formula seven.

[0129]

[0130] Where, k 3b Used to represent q among multiple third coefficients b The corresponding third coefficient, q b This is used to represent the target proportion corresponding to the b-th first abnormal dataset among multiple first abnormal datasets.

[0131] Step two: The server can determine the updated proportion of abnormal data in the first dataset corresponding to the second sub-abnormal dataset based on the target proportion and the proportion of abnormal data in the first dataset corresponding to the second sub-abnormal dataset. The updated proportion of abnormal data in the first dataset corresponding to the second sub-abnormal dataset can be expressed by Formula eight.

[0132]

[0133] Where, p′ b This is used to represent the proportion of outlier data in the first dataset corresponding to the b-th historical moment among multiple updated historical moments.

[0134] Step 3: The server can determine the abnormal data in the fourth abnormal dataset corresponding to the third coefficient of the second sub-abnormal dataset based on the third coefficient and the preset abnormal threshold. The abnormal data in the fourth abnormal dataset corresponding to the third coefficient can be represented by Formula 9.

[0135] X′ b >[Q′ 3a +k 3b ×(IQR a )]∪X′ b <[Q′ 1a -k 3b ×(IQR a Formula Nine.

[0136] Where, X′ b Used to represent k 3b The abnormal data in the corresponding fourth abnormal dataset.

[0137] It should be noted that, in the embodiments of this application, after determining the fourth abnormal dataset, a second operation can be performed on the fourth abnormal dataset to determine multiple third abnormal datasets.

[0138] Understandably, the server, based on a preset anomaly threshold, can designate a second sub-abnormal dataset with a target proportion greater than the preset threshold as the third abnormal dataset. Furthermore, the server can determine a fourth abnormal dataset based on the target proportion of the second sub-abnormal dataset (whose target proportion is not greater than the preset threshold), the abnormal data proportion of the first dataset corresponding to the second sub-abnormal dataset, the second coefficient corresponding to the second sub-abnormal dataset, and the preset anomaly threshold. The server then performs a second operation on the fourth abnormal dataset until the proportion of truly abnormal data in the determined dataset exceeds the preset anomaly threshold, and this dataset is then designated as the third abnormal dataset. This improves the accuracy of the abnormal data in the third abnormal dataset, thereby improving the accuracy of the abnormal data in the target abnormal dataset.

[0139] This application embodiment can divide the above-described abnormal data detection device into functional modules based on the method example described above. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0140] Figure 6 This is a structural block diagram illustrating an abnormal data detection device according to an exemplary embodiment. (Refer to...) Figure 6 The abnormal data detection device 600 includes an acquisition module 601 and a processing module 602.

[0141] The acquisition module 601 is used to acquire the dataset to be detected, which includes a first dataset corresponding to each historical time point from multiple historical time points. Each first dataset includes multiple types of data. The processing module 602 is used to determine the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient. The processing module 602 is also used to determine multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient. The processing module 602 is also used to determine multiple first abnormal datasets from the dataset to be detected based on the preset anomaly threshold and the multiple second coefficients, with one second coefficient corresponding to one first abnormal dataset. The processing module 602 is also used to determine a target abnormal dataset from the multiple first abnormal datasets, where the target abnormal dataset is the union of the multiple first abnormal datasets.

[0142] Optionally, processing module 602 is further configured to determine the abnormal data corresponding to each type among multiple types based on a preset abnormal threshold and a first coefficient. Processing module 602 is also configured to determine multiple second abnormal datasets based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data corresponding to each type. Each second abnormal dataset includes the abnormal data corresponding to each type among multiple types at a historical time. Multiple first datasets correspond to multiple second abnormal datasets. Specifically, processing module 602 is configured to determine the proportion of abnormal data in each first dataset according to a first operation. The first operation includes: determining the proportion of abnormal data in the first subset dataset based on the number of data in the first subset dataset and the number of data in the first sub-abnormal dataset. The first subset dataset is any dataset among multiple first datasets, and the first sub-abnormal dataset is the dataset among multiple second abnormal datasets that corresponds to the same historical time as the first subset dataset.

[0143] Optionally, processing module 602 is specifically used to determine multiple third abnormal datasets from multiple first abnormal datasets, wherein the proportion of real abnormal data in the third abnormal datasets is greater than a preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset. Processing module 602 is also specifically used to determine a target abnormal dataset from the multiple third abnormal datasets, wherein the target abnormal dataset is the union of the multiple third abnormal datasets.

[0144] Optionally, processing module 602 is specifically used to determine multiple third abnormal datasets from multiple first abnormal datasets according to a second operation. The second operation includes: obtaining a target ratio, where the target ratio is the proportion of real abnormal data in a second sub-abnormal dataset, and the second sub-abnormal dataset is any dataset among the multiple first abnormal datasets. If the target ratio is greater than a preset real ratio threshold, then the second sub-abnormal dataset is used as the third abnormal dataset. If the target ratio is less than the preset real ratio threshold, then a fourth abnormal dataset is determined according to the target ratio, the abnormal data proportion of the first dataset corresponding to the second sub-abnormal dataset, the second coefficient corresponding to the second sub-abnormal dataset, and the preset abnormal threshold, and the second operation is performed on the fourth abnormal dataset, where the fourth abnormal dataset includes the abnormal data in the second sub-abnormal dataset.

[0145] Figure 7 This is a schematic diagram of the hardware structure of an anomaly data detection device according to an exemplary embodiment. The anomaly data detection device may include a processor 702, which executes application code to implement the anomaly data detection method of this application.

[0146] The processor 702 may be a central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0147] like Figure 7 As shown, the abnormal data detection device may further include a memory 703. The memory 703 stores the application code that executes the scheme of this application, and its execution is controlled by the processor 702.

[0148] Memory 703 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 703 may exist independently and be connected to processor 702 via bus 704. Memory 703 may also be integrated with processor 702.

[0149] like Figure 7 As shown, the abnormal data detection device may further include a communication interface 701, wherein the communication interface 701, processor 702, and memory 703 may be coupled to each other, for example, through a bus 704. The communication interface 701 is used for information exchange with other devices, for example, supporting information exchange between the abnormal data detection device and other devices.

[0150] It should be pointed out that, Figure 7 The device structure shown does not constitute a limitation on the abnormal data detection device, except Figure 7 In addition to the components shown, the abnormal data detection device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0151] In actual implementation, the functions implemented by processing module 602 can be derived by... Figure 7 The processor 702 shown calls the program code in memory 703 to implement this.

[0152] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor of a computer device, enable the computer to perform the abnormal data detection method provided in the embodiments described above. For example, the computer-readable storage medium may be a memory 703 including instructions, which may be executed by a processor 702 of a computer device to complete the method. Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, RAM, CD-ROM, magnetic tape, floppy disk, or optical data storage device.

[0153] Figure 8 A conceptual partial view of a computer program product provided in an embodiment of this application is shown schematically. The computer program product includes a computer program for executing computer processes on a computing device.

[0154] In one embodiment, the computer program product is provided using a signal bearer medium 800. The signal bearer medium 800 may include one or more program instructions that, when executed by one or more processors, can provide the above-mentioned... Figure 2 , Figure 3 , Figure 4 and Figure 5 The described function or part of the function. Therefore, for example, refer to... Figure 2 In the embodiment shown, one or more features of S201 to S205 can be fulfilled by one or more instructions associated with the signal carrying medium 800. Furthermore, Figure 8 The program instructions in the document also describe example instructions.

[0155] In some examples, the signal carrying medium 800 may include a computer-readable medium 801, such as, but not limited to, a hard disk drive, a compact disc (CD), a digital video disc (DVD), a digital magnetic tape, a memory, a read-only memory (ROM), or a random access memory (RAM), etc.

[0156] In some implementations, the signal carrying medium 800 may include a computer recordable medium 802, such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, and so on.

[0157] In some implementations, the signal carrying medium 800 may include a communication medium 803, such as, but not limited to, digital and / or analog communication media (e.g., fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0158] The signal-bearing medium 800 can be transmitted by a wireless communication medium 803. One or more program instructions can be, for example, computer-executable instructions or logical implementation instructions.

[0159] In some examples, such as targeting Figure 7 The described abnormal data detection device can be configured to provide various operations, functions, or actions in response to one or more program instructions in a computer-readable medium 801, a computer-recordable medium 802, and / or a communication medium 803.

[0160] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0162] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the constituent units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0163] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0164] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, essentially, or the part that contributes to the prior art, or a complete or partial classification of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0165] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An abnormal data detection method, characterized in that, The method includes: Obtain the dataset to be detected, which includes: a first dataset corresponding to each historical moment in multiple historical moments, and a first dataset includes multiple types of data; the multiple types of data include base station energy consumption data, signal transmission power, signal transmission rate and number of user terminals; Based on the preset anomaly threshold and the first coefficient, determine the proportion of abnormal data in each first dataset; Based on the proportion of outlier data in each first dataset and the first coefficient, a plurality of second coefficients are determined; Based on the preset anomaly threshold and the plurality of second coefficients, a plurality of first anomaly datasets are determined from the dataset to be detected, wherein one second coefficient corresponds to one first anomaly dataset; Determining a target abnormal dataset from the plurality of first abnormal datasets includes: determining a plurality of third abnormal datasets from the plurality of first abnormal datasets, wherein the proportion of real abnormal data in the third abnormal datasets is greater than a preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset; The target abnormal dataset is determined from the plurality of third abnormal datasets, wherein the target abnormal dataset is the union of the plurality of third abnormal datasets; The step of determining multiple third abnormal datasets from the multiple first abnormal datasets includes: For the plurality of first abnormal datasets, the plurality of third abnormal datasets are determined from the plurality of first abnormal datasets according to the second operation, the second operation including: obtaining a target ratio, the target ratio being the proportion of real abnormal data in the second sub-abnormal dataset, the second sub-abnormal dataset being any dataset among the plurality of first abnormal datasets; If the target ratio is greater than the preset true ratio threshold, then the second sub-abnormal dataset is used as the third abnormal dataset. If the target ratio is less than the preset true ratio threshold, then based on the target ratio, the abnormal data ratio of the first dataset corresponding to the second sub-abnormal dataset, the second coefficient corresponding to the second sub-abnormal dataset, and the preset abnormal threshold, a fourth abnormal dataset is determined, and the second operation is performed on the fourth abnormal dataset to determine the plurality of third abnormal datasets; the fourth abnormal dataset includes the abnormal data in the second sub-abnormal dataset.

2. The method according to claim 1, characterized in that, The step of determining the proportion of abnormal data in each first dataset based on a preset anomaly threshold and a first coefficient includes: Based on the preset anomaly threshold and the first coefficient, determine the abnormal data corresponding to each of the multiple types of data; Based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data corresponding to each type, multiple second abnormal datasets are determined. Each second abnormal dataset includes abnormal data corresponding to each of the multiple types at a historical time. The multiple first datasets correspond to the multiple second abnormal datasets. For each of the first datasets, the proportion of outlier data in each first dataset is determined according to a first operation, wherein the first operation includes: The proportion of abnormal data in the first subset is determined based on the number of data in the first subset and the number of data in the first sub-abnormal dataset. The first subset is any dataset among the plurality of first datasets, and the first sub-abnormal dataset is the dataset among the plurality of second abnormal datasets that corresponds to the same historical time as the first subset.

3. An abnormal data detection device, characterized in that, The device includes: The acquisition module is used to acquire the dataset to be detected. The dataset to be detected includes: a first dataset corresponding to each historical moment in multiple historical moments, and each first dataset includes multiple types of data; the multiple types of data include base station energy consumption data, signal transmission power, signal transmission rate, and number of user terminals. The processing module is used to determine the proportion of abnormal data in each first dataset based on a preset abnormality threshold and a first coefficient. The processing module is further configured to determine multiple second coefficients based on the proportion of abnormal data in each first dataset and the first coefficient; The processing module is further configured to determine multiple first abnormal datasets from the dataset to be detected based on the preset abnormal threshold and the multiple second coefficients, wherein one second coefficient corresponds to one first abnormal dataset; The processing module is further configured to determine a target abnormal dataset from the plurality of first abnormal datasets, including: determining a plurality of third abnormal datasets from the plurality of first abnormal datasets, wherein the proportion of real abnormal data in the third abnormal datasets is greater than a preset real proportion threshold, and one third abnormal dataset corresponds to one first abnormal dataset. The target abnormal dataset is determined from the plurality of third abnormal datasets, wherein the target abnormal dataset is the union of the plurality of third abnormal datasets; The step of determining multiple third abnormal datasets from the multiple first abnormal datasets includes: For the plurality of first abnormal datasets, the plurality of third abnormal datasets are determined from the plurality of first abnormal datasets according to the second operation, the second operation including: obtaining a target ratio, the target ratio being the proportion of real abnormal data in the second sub-abnormal dataset, the second sub-abnormal dataset being any dataset among the plurality of first abnormal datasets; If the target ratio is greater than the preset true ratio threshold, then the second sub-abnormal dataset is used as the third abnormal dataset. If the target ratio is less than the preset true ratio threshold, then based on the target ratio, the abnormal data ratio of the first dataset corresponding to the second sub-abnormal dataset, the second coefficient corresponding to the second sub-abnormal dataset, and the preset abnormal threshold, a fourth abnormal dataset is determined, and the second operation is performed on the fourth abnormal dataset to determine the plurality of third abnormal datasets; the fourth abnormal dataset includes the abnormal data in the second sub-abnormal dataset.

4. The apparatus according to claim 3, characterized in that, The processing module is further configured to determine the abnormal data corresponding to each of the multiple types based on the preset abnormal threshold and the first coefficient; The processing module is further configured to determine multiple second abnormal datasets based on the abnormal data corresponding to each type and the historical time corresponding to the abnormal data corresponding to each type. Each second abnormal dataset includes abnormal data corresponding to each of the multiple types at a historical time. The multiple first datasets correspond to the multiple second abnormal datasets. The processing module is specifically configured to, for each first dataset, determine the proportion of abnormal data in each first dataset according to a first operation, wherein the first operation includes: The proportion of abnormal data in the first subset is determined based on the number of data in the first subset and the number of data in the first sub-abnormal dataset. The first subset is any dataset among the plurality of first datasets, and the first sub-abnormal dataset is the dataset among the plurality of second abnormal datasets that corresponds to the same historical time as the first subset.

5. An abnormal data detection device, characterized in that, include: Processor and memory; The processor and the memory are coupled; The memory is used to store one or more programs, the one or more programs including computer execution instructions. When the abnormal data detection device is running, the processor executes the computer execution instructions stored in the memory to cause the abnormal data detection device to perform the abnormal data detection method as described in any one of claims 1-2.

6. A computer-readable storage medium storing instructions, characterized in that, When the computer executes the instructions, the computer performs the abnormal data detection method as described in any one of claims 1-2.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal data detection method according to any one of claims 1-2.

Images