High-dimensional kpi anomaly detection method and device, computer readable medium and equipment

Abstract

Embodiments of the present application provide a high-dimensional KPI anomaly detection method, device, computer readable medium and equipment. The method comprises: obtaining data of abnormal KPIs that have occurred in history, and performing clustering processing according to the curve shape similarity between each of the abnormal KPIs to determine a clustering center KPI of each clustering cluster obtained by clustering; performing abnormal fluctuation correlation analysis on the remaining abnormal KPIs that have not been successfully clustered to construct an abnormal fluctuation propagation chain; matching real-time data of a to-be-detected KPI with the clustering center KPI and the abnormal fluctuation propagation chain respectively to determine a first target detection KPI and a second target detection KPI, so as to call an abnormal detection model corresponding to the first target detection KPI and the second target detection KPI respectively to perform abnormal detection. The technical solution of the embodiments of the present application improves the abnormal detection efficiency of KPI, reduces the number of models that need to be trained and maintained, and can ensure the accuracy of the abnormal detection result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer and communication, in particular, to a high-dimensional KPI anomaly detection method and device, computer readable medium and equipment. BACKGROUND

[0002] With the development of mobile communication technology, the scale of mobile communication network is expanding, and the number of network elements is increasing by hundreds or thousands. How to ensure the stable and safe operation of the entire communication network system, and how to efficiently find and locate faults will become problems that operators need to face. In recent years, with the development of machine learning and deep learning technologies, AIOps (Artificial Intelligence for IT Operations) combining Internet artificial intelligence and operation and maintenance has emerged. Among them, the anomaly detection of key performance indicators (KPI) is a core technology of mobile communication intelligent operation and maintenance.

[0003] KPI is a kind of time series data. When the latest observation value in KPI deviates significantly from historical data, such as sudden rise, sudden drop, jitter and other phenomena, it often means that the related application and service have failed, and the failure needs to be eliminated in time before the failure expands the scope of influence. The traditional mobile communication network KPI anomaly detection is often detected by setting threshold for each KPI, but this method depends heavily on the experience of operation and maintenance experts, and with the complexity and heterogeneity of mobile communication network, the types of KPI are numerous, forming high-dimensional KPI data, and the traditional anomaly detection method has the problems of low efficiency and missed detection. SUMMARY

[0004] The embodiments of the present application provide a high-dimensional KPI anomaly detection method, device, computer readable medium and equipment, which can at least improve the KPI anomaly detection efficiency, reduce the number of models that need to be trained and maintained, and ensure the accuracy of the anomaly detection result.

[0005] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the present application.

[0006] According to an aspect of an embodiment of the present application, a high-dimensional KPI anomaly detection method is provided, which comprises:

[0007] Obtaining data of abnormal KPIs occurred in history, and performing clustering processing according to the curve shape similarity between each of the abnormal KPIs to determine a clustering center KPI of each clustering cluster obtained by clustering;

[0008] For the remaining abnormal KPIs that failed to cluster, perform abnormal fluctuation correlation analysis and construct an abnormal fluctuation propagation chain. The abnormal fluctuation propagation chain includes at least two abnormal KPIs with certain abnormal fluctuation correlation.

[0009] Real-time data of each KPI to be detected is obtained, and the data curves of each KPI to be detected are matched with the data curves of each cluster center KPI.

[0010] The KPI to be detected that matches any of the cluster center KPIs is identified as the first target detection KPI;

[0011] The KPI to be detected that does not match any of the cluster center KPIs is matched with the abnormal KPIs in each of the abnormal fluctuation propagation chains to determine the KPI to be detected that matches the same abnormal fluctuation propagation chain, and the KPI to be detected that first causes abnormal fluctuation among the KPIs to be detected that matches the same abnormal fluctuation propagation chain is determined as the second target detection KPI.

[0012] For the first target detection KPI, the anomaly detection model corresponding to the cluster center KPI that matches it is invoked to perform anomaly detection on the first target detection KPI, so as to obtain the first anomaly detection result of the first target detection KPI;

[0013] Based on the type of the second target detection KPI, an anomaly detection model corresponding to the type is invoked to perform anomaly detection on the second target detection KPI to obtain a second anomaly detection result for the second target detection KPI. The type includes fluctuation type, stable type, or periodic type.

[0014] According to one aspect of the embodiments of this application, an anomaly detection device for high-dimensional KPIs is provided, the device comprising:

[0015] The clustering module is used to obtain data on historically abnormal KPIs and perform clustering processing based on the similarity of curve shapes between the abnormal KPIs to determine the cluster center KPI of each cluster obtained by the clustering.

[0016] The propagation chain construction module is used to perform abnormal fluctuation correlation analysis on the remaining abnormal KPIs that failed to cluster, and construct an abnormal fluctuation propagation chain, wherein the abnormal fluctuation propagation chain includes at least two abnormal KPIs with a certain abnormal fluctuation correlation.

[0017] The first matching module is used to acquire real-time data of each KPI to be detected, and match the data curve of each KPI to be detected with the data curve of each cluster center KPI; and determine the KPI to be detected that matches any of the cluster center KPIs as the first target detection KPI.

[0018] The second matching module is used to match the KPI to be detected that does not match any of the cluster center KPIs with the abnormal KPIs in each of the abnormal fluctuation propagation chains, determine the KPI to be detected that matches the same abnormal fluctuation propagation chain, and determine the KPI to be detected that first causes abnormal fluctuation among the KPIs to be detected that matches the same abnormal fluctuation propagation chain as the second target detection KPI.

[0019] The processing module is configured to, for the first target detection KPI, call the anomaly detection model corresponding to the cluster center KPI that matches it to perform anomaly detection on the first target detection KPI, so as to obtain a first anomaly detection result of the first target detection KPI; and, according to the type of the second target detection KPI, call the anomaly detection model corresponding to the type to perform anomaly detection on the second target detection KPI, so as to obtain a second anomaly detection result of the second target detection KPI, wherein the type includes fluctuation type, stable type or periodic type.

[0020] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the anomaly detection method for high-dimensional KPIs as described in the above embodiments.

[0021] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the high-dimensional KPI anomaly detection method as described in the above embodiments.

[0022] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the high-dimensional KPI anomaly detection method provided in the above embodiments.

[0023] In some embodiments of this application, the technical solutions are provided by acquiring historical abnormal KPI data and performing clustering processing based on the similarity of curve shapes between abnormal KPIs to determine the cluster center KPI of each cluster obtained by clustering. Abnormal fluctuation correlation analysis is performed on the remaining abnormal KPIs that have not been successfully clustered to construct an abnormal fluctuation propagation chain. The abnormal fluctuation propagation chain includes at least two abnormal KPIs with certain abnormal fluctuation correlation. Real-time data for each target KPI is acquired, and the data curve of each target KPI is matched with the data curve of each cluster center KPI. The target KPI that matches any cluster center KPI is identified as the first target KPI. The target KPI that does not match any cluster center KPI is matched with the abnormal KPIs in each abnormal fluctuation propagation chain to identify the target KPIs that match the same abnormal fluctuation propagation chain. The target KPI that first caused the abnormal fluctuation among the target KPIs matching the same abnormal fluctuation propagation chain is identified as the second target KPI. For the first target KPI, the anomaly detection model corresponding to its matching cluster center KPI is invoked to perform anomaly detection on the first target KPI to obtain the first anomaly detection result. Based on the type of the second target KPI, the corresponding anomaly detection model is invoked to perform anomaly detection on the second target KPI to obtain the second anomaly detection result.

[0024] Therefore, it is unnecessary to build an anomaly detection model for each KPI. The anomaly detection model corresponding to the cluster center KPI can be used to detect at least one matching first target KPI, reducing the number of models that need to be trained and maintained. Furthermore, for KPIs to be detected within the same anomaly propagation chain, since the anomalies of KPIs within the same chain are correlated (an anomaly in a previous KPI will cause a corresponding anomaly in subsequent KPIs), anomaly detection only needs to be performed on the KPI that first caused the anomaly. This not only reduces the number of detections and improves detection efficiency but also ensures the accuracy of the anomaly detection results.

[0025] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0027] Figure 1 A flowchart illustrating an anomaly detection method for high-dimensional KPIs according to an embodiment of this application is shown.

[0028] Figure 2 An embodiment according to this application is shown. Figure 1 A flowchart illustrating the process of determining the KPIs of each cluster center in a high-dimensional KPI anomaly detection method.

[0029] Figure 3 An embodiment according to this application is shown. Figure 1 A flowchart illustrating step S120 in the anomaly detection method for high-dimensional KPIs;

[0030] Figure 4 An embodiment of this application is shown. Figure 3 A heatmap of correlation coefficients obtained after using a high-dimensional KPI anomaly detection method;

[0031] Figure 5 This is a schematic diagram of the network structure of a variational autoencoder based on a bidirectional long short-term memory network according to an embodiment of the present invention;

[0032] Figure 6 A block diagram of an anomaly detection device for high-dimensional KPIs according to an embodiment of this application is shown;

[0033] Figure 7 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0035] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0036] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0037] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0038] It should be noted that the high-dimensional KPI anomaly detection method provided in this application embodiment is generally executed by a server, and correspondingly, the high-dimensional KPI anomaly detection device is generally located in the server. However, in other embodiments of this application, terminal devices (such as one or more of smartphones, tablets, desktop computers, and portable computers) may also have similar functions to the server, thereby executing the high-dimensional KPI anomaly detection method provided in this application embodiment.

[0039] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0040] Figure 1 A flowchart illustrating an anomaly detection method for high-dimensional KPIs according to an embodiment of this application is shown. (Refer to...) Figure 1 As shown, this high-dimensional KPI anomaly detection method includes at least steps S110 to S170, which are described in detail below:

[0041] In step S110, data of historically abnormal KPIs are obtained, and clustering is performed based on the similarity of curve shapes among the abnormal KPIs to determine the cluster center KPI of each cluster obtained by clustering.

[0042] Among them, abnormal KPIs are KPIs that have historically shown abnormal data, which can be collected from abnormal KPIs that have been processed by operations and maintenance experts.

[0043] In this embodiment, it should be understood that KPI data is time-series data. Anomalies can cause sudden spikes, drops, or fluctuations, resulting in corresponding changes in the curves of the abnormal KPIs. Therefore, the curve shape corresponding to each abnormal KPI can be determined based on its data. Based on the curve shapes of different abnormal KPIs, the curve shape similarity between them can be calculated. Clustering is then performed based on this curve shape similarity to obtain each cluster, and the cluster center KPI for each cluster is determined.

[0044] Please refer to Figure 2 , Figure 2 An embodiment according to this application is shown. Figure 1 The flowchart illustrating the process of determining the KPIs of each cluster center in the high-dimensional KPI anomaly detection method is shown below. Figure 2 As shown, determining the KPIs for each cluster center includes at least steps S210 to S230, detailed below:

[0045] In step S210, the data of each of the abnormal KPIs are preprocessed, and the preprocessing includes at least missing value processing, outlier removal and standardization processing in sequence.

[0046] In this embodiment, based on the acquired data of each abnormal KPI, the KPI data is preprocessed. This preprocessing includes at least, in sequence, missing value handling, outlier removal, and standardization. For example, missing value handling can be performed using multinomial interpolation for missing data in historical data; outlier removal can be performed using statistical methods such as box plots or 3-Sigma; and standardization can be performed using zero-mean standardization.

[0047] In step S220, the time series of the preprocessed abnormal KPIs are subjected to pairwise curve similarity calculation to obtain a curve shape similarity matrix.

[0048] In this embodiment, cross-correlation is used to calculate the sliding inner product between two anomalous KPIs. This method is inherently robust to phase deviations, thus allowing the use of a cross-correlation-based similarity measurement algorithm. Specifically, for two anomalous KPI time series of length n... and And displacement s, the standardized cross-correlation NCC and the curve shape similarity measure SSM are calculated using the following formulas:

[0049]

[0050]

[0051] in,

[0052] It should be understood that the NCC value ranges from [-1, 1], and therefore the curve shape similarity measure SSM ranges from [0, 2]. A value of 0 indicates that the two curves have exactly the same shape, and the smaller the SSM value, the higher the shape similarity between the two curves. The calculated curve shape similarity measure SSM is used as matrix elements to obtain the curve shape similarity matrix.

[0053] In step S230, based on the curve shape similarity matrix, a clustering algorithm is used to cluster the abnormal KPIs with similar curve shapes, and the cluster center KPI of each cluster is determined.

[0054] In this embodiment, the DBSCAN clustering algorithm (Density-Based Spatial Clustering of Applications with Noise) can be used. DBSCAN is a density-based spatial clustering algorithm that divides regions with sufficient density into clusters and discovers clusters of arbitrary shapes in a noisy spatial database. It defines a cluster as the largest set of density-connected points. After obtaining the clusters, the cluster center KPIs of each cluster are determined. It should be understood that the curve shapes of outlier KPIs belonging to the same cluster have a high degree of shape similarity to the cluster center KPIs of that cluster. In other embodiments, other clustering algorithms can also be used for clustering, and no particular limitation is made.

[0055] Please continue to refer to this. Figure 1 In step S120, the remaining abnormal KPIs that failed to cluster are subjected to abnormal fluctuation correlation analysis to construct an abnormal fluctuation propagation chain, wherein the abnormal fluctuation propagation chain includes at least two abnormal KPIs with certain abnormal fluctuation correlation.

[0056] In this embodiment, if any abnormal KPIs fail to cluster successfully, an abnormal fluctuation correlation analysis is performed on the remaining abnormal KPIs to determine the degree of correlation between their abnormal fluctuations. An abnormal fluctuation propagation chain is constructed based on at least two abnormal KPIs with a certain degree of correlation. It should be understood that if an abnormal KPI within the same abnormal fluctuation propagation chain experiences abnormal fluctuations earlier, it will cause subsequent abnormal KPIs to experience corresponding abnormal fluctuations, or one abnormal KPI experiencing abnormal fluctuations will simultaneously cause another abnormal KPI to experience abnormal fluctuations. Therefore, by only detecting the KPI that first caused the abnormal fluctuation, it is possible to determine whether subsequent KPIs will experience abnormal fluctuations, thus significantly reducing the amount of detection required.

[0057] based on Figure 1 The embodiment shown, Figure 3 An embodiment according to this application is shown. Figure 1 The flowchart of step S120 in the high-dimensional KPI anomaly detection method is shown below. (Refer to...) Figure 3 As shown, step S120 includes at least steps S310 to S350, which are described in detail below:

[0058] In step S310, a time series prediction algorithm is used to predict the remaining abnormal KPIs that have not been successfully clustered, so as to obtain the prediction sequence corresponding to each abnormal KPI.

[0059] In this embodiment, time series prediction algorithms can be used to predict the remaining outlier KPIs that failed to cluster, thereby obtaining the predicted sequences corresponding to each outlier KPI. In one example, time series prediction algorithms such as Holt-winters (cubic exponential smoothing), Wavelet decomposition, or TimeSeries Decomposition can be used for prediction.

[0060] In step S320, the abnormal fluctuation feature sequence of each abnormal KPI is extracted based on the difference between the actual time series of the abnormal KPI and the corresponding predicted sequence.

[0061] In this embodiment, R = {r1, ..., r} m Let} represent a KPI time series. The predicted series generated by the time series forecasting algorithm is P = {p, ..., p}. m}, then the abnormal fluctuation characteristic sequence is E={ε1,…,ε m}, where ε i =r i -p i ,1≤i≤n.

[0062] In step S330, the correlation coefficient between the abnormal fluctuation feature sequences is determined by performing a correlation calculation on each pair of abnormal fluctuation feature sequences.

[0063] In this embodiment, the correlation coefficient between abnormal fluctuation feature sequences is determined by performing a correlation calculation on each pair of abnormal fluctuation feature sequences based on the abnormal fluctuation feature sequences corresponding to each abnormal KPI.

[0064] Specifically, in one embodiment of this application, two abnormal fluctuation feature sequences of length l are assumed to be...

[0065] M = {m1, m2, ..., m} l} and N = {n1, n2, ..., n l Given a fixed abnormal fluctuation feature sequence N, let an abnormal fluctuation feature sequence M be shifted over N. Calculate the inner product of the abnormal fluctuation feature sequence M after each shift of s units. The abnormal fluctuation feature sequence M shifted by s units can be expressed as:

[0066]

[0067] The abnormal fluctuation characteristic sequence M is calculated using the following formula. s The similarity coefficient Corr between N and N:

[0068]

[0069] By iterating through all values ​​of s, a vector of length 2l-1 is obtained. Let the minimum and maximum values ​​of the vector be minCorr and maxCorr, respectively, corresponding to the shift values ​​s1 and s2. Then, the similarity coefficient between the abnormal fluctuation feature sequences M and N is determined as follows:

[0070]

[0071] In the above formula, the CORR value ranges from -1 to 1. The CORR value indicates that a value closer to 1 or -1 signifies a stronger correlation between the abnormal fluctuation characteristic sequences M and N. A positive CORR value indicates that the abnormal fluctuation characteristic sequences M and N have the same fluctuation direction, meaning they are positively correlated. A negative CORR value indicates that the abnormal fluctuation characteristic sequences M and N have opposite fluctuation directions, meaning they are negatively correlated. Analysis of s < 0 or s ≥ 0 can determine whether the abnormal fluctuations occur simultaneously or sequentially.

[0072] In step S340, the correlation coefficients are used as matrix elements to construct an abnormal fluctuation correlation matrix.

[0073] In this embodiment, the correlation coefficient CORR value is used as a matrix element to construct an abnormal fluctuation correlation matrix.

[0074] In step S350, the abnormal fluctuation correlation matrix is ​​clustered according to a clustering algorithm to construct an abnormal fluctuation propagation chain, and the abnormal KPI that first causes the abnormal fluctuation in each abnormal fluctuation propagation chain is determined.

[0075] In this embodiment, the DBSCAN clustering algorithm can also be used to cluster the abnormal fluctuation correlation matrix to construct the abnormal fluctuation propagation chain and determine the abnormal KPI that first caused the abnormal fluctuation in each abnormal fluctuation propagation chain.

[0076] Specifically, Figure 4 An embodiment of this application is shown. Figure 3 A heatmap of correlation coefficients obtained after using a high-dimensional KPI anomaly detection method.

[0077] Please refer to Figure 4 Suppose there are 16 abnormal KPIs that failed to cluster. Figure 4The values ​​of the small and medium squares represent the absolute values ​​of the CORR values ​​of two abnormal KPIs. Through clustering algorithms, KPIs 1 to 10 can be clustered into one class, and KPIs 11 to 16 can be clustered into another class, thereby constructing the abnormal fluctuation propagation chain and identifying the KPI that first experienced an abnormal fluctuation.

[0078] In one example, the construction of the anomalous fluctuation propagation chain can be divided into the following two cases:

[0079] 1) If the absolute values ​​of the CORR values ​​between KPI pairs are all 1, it indicates that these KPIs are absolutely correlated. Then, based on the order of abnormal fluctuations, the abnormal fluctuation propagation chain is derived, and the KPI that first experienced an abnormal fluctuation (i.e., the most important KPI) is identified. Taking four KPIs as an example, finding the KPI that first experienced an abnormal fluctuation can be divided into the following cases:

[0080] Table 1

[0081]

[0082]

[0083] Note: x→y indicates that x fluctuates abnormally before y; This indicates that both x and y are experiencing abnormal fluctuations simultaneously.

[0084] 2) If the absolute values ​​of the CORR values ​​between KPI pairs are not all 1, the KPIs need to be classified into levels. If the absolute values ​​of the CORR values ​​of a KPI with other KPIs are all greater than 0.97, then the level is 1; if the absolute values ​​of the CORR values ​​with other KPIs are less than 0.97, then the level is 2; if the absolute values ​​of the CORR values ​​with other KPIs are two or more less than 0.97, then the level is 3. This is because the abnormal fluctuation characteristics of KPIs of level 3 are different from those of other KPIs. An abnormal fluctuation propagation chain is constructed separately for KPIs of level 3, while KPIs of level 1 and level 2 can be constructed together.

[0085] Simultaneously, each KPI is assigned a score based on the absolute value of its CORR. A CORR absolute value of 1 scores 10, a CORR absolute value of 0.99 scores 9, and so on. A CORR absolute value of 0.90 or lower scores 0. It should be noted that the above figures are merely illustrative examples, and those skilled in the art can determine the corresponding threshold for the correlation coefficient based on prior experience; no special limitations are imposed in this regard.

[0086] Then, find the KPI that first exhibited abnormal fluctuations according to the following rules:

[0087] First, according to the abnormal fluctuation propagation chain, if two KPIs experience abnormal fluctuations in a sequential order, the KPI that fluctuates abnormally first is the desired one; if two KPIs fluctuate abnormally at the same time, the levels of the two KPIs are determined, and the KPI with the higher level is the KPI that fluctuated abnormally first; otherwise, if the levels of the two KPIs are the same, the scores of the two KPIs are determined, and the KPI with the higher score is the KPI that fluctuated abnormally first.

[0088] by Figure 4 Taking KPIs 11 through 16 as an example, KPIs 13, 14, and 16 are at level 1, KPIs 11 and 12 are at level 2, and KPI 15 is at level 3. Therefore, KPIs 11, 12, 13, 14, and 16 together form an abnormal fluctuation propagation chain. At the same time, KPI 11 has a score of 39, KPI 12 has a score of 38, KPI 13 has a score of 42, KPI 14 has a score of 39, and KPI 16 has a score of 42. Based on the scores, the KPI that first experienced abnormal fluctuation can be found. KPI 15 is a separate abnormal fluctuation propagation chain.

[0089] In one embodiment of this application, before determining the correlation coefficient between the abnormal fluctuation feature sequences by performing a correlation calculation on each pair of the abnormal fluctuation feature sequences, the method further includes:

[0090] After standardizing each abnormal fluctuation feature sequence with zero mean, the abnormal fluctuation features are amplified using the following formula:

[0091]

[0092] Where c is the growth rate, d is the cutoff value of the function f, and c and d are fixed values.

[0093] In this embodiment, since the abnormal fluctuation characteristics of different KPIs have different values, it is necessary to standardize each feature to zero mean. Furthermore, the above formula can reduce the impact of noise on the extracted abnormal fluctuation characteristics, weaken small fluctuations, and amplify large fluctuations.

[0094] Please continue to refer to this. Figure 1 In step S130, real-time data of each KPI to be detected is obtained, and the data curves of each KPI to be detected are matched with the data curves of each cluster center KPI.

[0095] In one embodiment, real-time data of each KPI to be detected can be collected in real time, and the shape similarity distance between the data curve corresponding to each KPI and the data curve of each cluster center KPI can be calculated. If the shape similarity distance between the data curve of a certain KPI to be detected and the data curve of a certain cluster center KPI is less than 0.2, then the cluster center KPI matches the KPI to be detected; otherwise, they do not match. It should be noted that those skilled in the art can determine the corresponding judgment threshold based on prior experience, and no special limitation is made in this regard.

[0096] In step S140, the KPI to be detected that matches any of the cluster center KPIs is determined as the first target detection KPI.

[0097] In step S150, the KPIs to be detected that do not match any of the cluster center KPIs are matched with the abnormal KPIs in each of the abnormal fluctuation propagation chains to determine the KPIs to be detected that match the same abnormal fluctuation propagation chain, and the KPI to be detected that first causes abnormal fluctuations among the KPIs to be detected that match the same abnormal fluctuation propagation chain is determined as the second target detection KPI.

[0098] In this embodiment, for a KPI to be detected that does not match any cluster center KPI, it can be compared with anomaly KPIs in the anomaly propagation chain to determine whether the KPI to be detected matches the anomaly propagation chain. For example, if a KPIA to be detected does not match any cluster center KPI, but a certain anomaly propagation chain includes KPIA, then it means that the KPIA to be detected matches the anomaly propagation chain. KPIs to be detected corresponding to the same anomaly propagation chain can be grouped together, and the KPI to be detected that first exhibits an anomaly from the same group can be identified as the second target detection KPI.

[0099] In step S160, for the first target detection KPI, the anomaly detection model corresponding to the cluster center KPI that matches it is invoked to perform anomaly detection on the first target detection KPI, so as to obtain the first anomaly detection result of the first target detection KPI.

[0100] In this embodiment, for a first target detection KPI, an anomaly detection model corresponding to its matching cluster center KPI can be invoked to perform anomaly detection on that first target detection KPI. In one example, a corresponding anomaly detection model can be pre-built and trained based on the data of each cluster center KPI. The data of the cluster center KPI should include normal data as much as possible so that the anomaly detection model can learn the normal pattern of the curve, thereby improving the accuracy of anomaly detection. It should be understood that because the curve shape of the first target detection KPI is highly similar to the curve shape of the cluster center KPI, anomaly detection can be directly performed on the first target detection KPI using the anomaly detection model corresponding to that cluster center KPI. Furthermore, multiple first target detection KPIs corresponding to the same cluster center KPI can all be detected using the above-mentioned anomaly detection model, thereby reducing the cost of model building.

[0101] In step S170, according to the type of the second target detection KPI, the anomaly detection model corresponding to the type is invoked to perform anomaly detection on the second target detection KPI to obtain the second anomaly detection result of the second target detection KPI. The type includes fluctuation type, stable type or periodic type.

[0102] In an exemplary embodiment of this application, KPI data can be divided into three categories: periodic KPIs, volatile KPIs, and stable KPIs. Periodic KPIs exhibit relatively complete periodic characteristics. Stable KPIs show that most data remain in a relatively stable state with small fluctuations, and only a few data points exhibit sudden changes and fluctuations. Volatile KPIs do not show a corresponding pattern over time and fluctuate unpredictably.

[0103] Depending on the type of KPI data, different unsupervised algorithms can be used to build and train anomaly detection models. Before model training, the training data undergoes preprocessing and feature extraction. Specifically, preprocessing includes missing value imputation, duplicate value handling, outlier removal, data smoothing and denoising, and zero-mean standardization. Missing value imputation can be performed using polynomial interpolation; duplicate value handling can utilize the characteristics of set data structures for inspection and removal; outlier removal can employ statistical methods such as box plots and 3-Sigma; and data smoothing can use methods such as local linear regression. Furthermore, for periodic KPI data, to better enable the model to learn its numerical patterns, time-series KPI data is segmented using overlapping time windows of equal length.

[0104] The extractable KPI features can be categorized as follows: statistical features, which calculate the mean, median, mode, maximum, minimum, variance, and quantiles over a certain period; difference features, which calculate the difference between the current time point and the previous time point or the same time point in the previous period; and time features, which determine the current time point as the hour of the day, the day of the week, whether it is daytime, whether it is a weekend, and whether it is a holiday.

[0105] For periodic KPIs, algorithms such as the Holt-Winters prediction model and the XGBoost regression model can be used. For volatile KPIs, algorithms such as the Gaussian mixture model can be trained. For stable KPIs, algorithms such as setting thresholds can be used directly.

[0106] As a preferred embodiment, periodic KPIs can employ a variational autoencoder based on a bidirectional long short-term memory network, such as... Figure 5 This is a schematic diagram of the network structure of a variational autoencoder based on a bidirectional long short-term memory network according to an embodiment of the present invention. Specifically, the left half is the encoder, which consists of a single layer of bidirectional long short-term memory network. The sequence X is represented by μ through the encoder. Z (i.e., mean) and σ Z (i.e., standard deviation), then sample Z (i.e., latent variable), and finally reconstruct the sequence through a decoder. The decoder is a structure symmetrical to the encoder, and its loss function is as follows:

[0107]

[0108] It should be noted that because the KPI data underwent outlier removal preprocessing before model training, the variational autoencoder based on the bidirectional long short-term memory network learns data features under anomaly-free conditions. When anomalies occur, the true value at a certain moment may deviate significantly from the predicted value of the variational autoencoder based on the long short-term memory network. Therefore, a threshold interval needs to be determined to determine whether the true value at that moment is an anomaly. After training the variational autoencoder based on the bidirectional long short-term memory network to obtain the predicted value at each moment, the deviation between each predicted value and the true value at that moment is calculated to obtain a deviation sequence. Then, the 3-sigma method is used to obtain the threshold interval of the deviation sequence for anomaly detection.

[0109] As a preferred embodiment, the fluctuating KPI adopts a Gaussian mixture model, which is expressed as follows:

[0110]

[0111] Where, α k α is the coefficient. k ≥0, Let be the probability density function of the k-th Gaussian distribution.

[0112] It should be noted that the preprocessed KPI data is input into a Gaussian mixture model for training. This yields the Gaussian mixture model parameters, and the probability of each data point within the overall distribution is calculated. Box plots are then used to determine the upper and lower thresholds of these probabilities. During anomaly detection, these probability thresholds are combined to determine whether an anomaly has occurred.

[0113] In an exemplary embodiment of this application, if there are certain KPIs to be detected that do not have a matching cluster center KPI and do not correspond to any abnormal fluctuation propagation chain, then an anomaly detection model corresponding to the type of the KPI to be detected can be invoked to perform anomaly detection to avoid missed detection.

[0114] Based on the foregoing embodiments, in one embodiment of this application, the anomaly detection method for high-dimensional KPIs further includes:

[0115] If the first target detection result and / or the second target detection result indicate an anomaly, the severity of the anomaly is determined based on the duration of the anomaly.

[0116] In this embodiment, if it is determined that the real-time data of the first target detection KPI or the second target detection KPI is abnormal, the severity of the abnormality can be determined according to the duration of the abnormality. In one example, the severity can be divided into severe abnormality, moderate abnormality and minor abnormality, so that maintenance personnel can deal with it in a timely manner and avoid the performance indicators from continuing to deteriorate.

[0117] Therefore, based on the foregoing embodiments, the high-dimensional KPI anomaly detection method provided in this application reduces modeling costs and ensures detection effectiveness while reducing the detection workload by finding the similarity of KPI curves and the correlation of abnormal fluctuations. Furthermore, by establishing an unsupervised model, anomalies can be detected efficiently, accurately, and promptly, facilitating subsequent fault location and handling by maintenance personnel.

[0118] The following describes an embodiment of the apparatus described in this application, which can be used to execute the anomaly detection method for high-dimensional KPIs described in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the high-dimensional KPI anomaly detection method described in the above embodiments of this application.

[0119] Figure 6 A block diagram of an anomaly detection apparatus for high-dimensional KPIs according to an embodiment of this application is shown.

[0120] Reference Figure 6 As shown, a high-dimensional KPI anomaly detection device according to an embodiment of this application includes:

[0121] Clustering module 610 is used to acquire data of historically abnormal KPIs and perform clustering processing based on the similarity of curve shapes between the abnormal KPIs to determine the cluster center KPI of each cluster obtained by clustering.

[0122] The propagation chain construction module 620 is used to perform abnormal fluctuation correlation analysis on the remaining abnormal KPIs that have not been successfully clustered, and construct an abnormal fluctuation propagation chain, wherein the abnormal fluctuation propagation chain includes at least two abnormal KPIs with a certain abnormal fluctuation correlation.

[0123] The first matching module 630 is used to acquire real-time data of each KPI to be detected, and match the data curve of each KPI to be detected with the data curve of each cluster center KPI; and determine the KPI to be detected that matches any of the cluster center KPIs as the first target detection KPI.

[0124] The second matching module 640 is used to match the KPI to be detected that does not match any of the cluster center KPIs with the abnormal KPIs in each of the abnormal fluctuation propagation chains, determine the KPI to be detected that matches the same abnormal fluctuation propagation chain, and determine the KPI to be detected that first causes abnormal fluctuation among the KPIs to be detected that matches the same abnormal fluctuation propagation chain as the second target detection KPI.

[0125] The processing module 650 is configured to, for the first target detection KPI, call the anomaly detection model corresponding to the cluster center KPI that matches it to perform anomaly detection on the first target detection KPI, so as to obtain a first anomaly detection result of the first target detection KPI; and, according to the type of the second target detection KPI, call the anomaly detection model corresponding to the type to perform anomaly detection on the second target detection KPI, so as to obtain a second anomaly detection result of the second target detection KPI, wherein the type includes fluctuating, stable or periodic.

[0126] Figure 7 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0127] It should be noted that, Figure 7 The computer system of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0128] like Figure 7As shown, the computer system includes a Central Processing Unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 702 or programs loaded from storage portion 708 into Random Access Memory (RAM) 703, such as performing the methods described in the above embodiments. The RAM 703 also stores various programs and data required for system operation. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An Input / Output (I / O) interface 705 is also connected to the bus 704.

[0129] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0130] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs various functions defined in the system of this application.

[0131] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0133] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0134] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0135] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0136] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0137] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0138] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for anomaly detection of high-dimensional KPIs, characterized in that, The method comprises the following steps: acquiring historical data of abnormal KPIs, and performing clustering processing on the abnormal KPIs according to curve shape similarities between the abnormal KPIs to determine cluster center KPIs of each cluster obtained by clustering; performing abnormal fluctuation correlation analysis on remaining abnormal KPIs that are not successfully clustered to construct abnormal fluctuation propagation chains, the abnormal fluctuation propagation chains comprising at least two abnormal KPIs having a certain abnormal fluctuation correlation; acquiring real-time data of each KPI to be detected, and matching data curves of each KPI to be detected with data curves of each cluster center KPI respectively; determining a KPI to be detected that matches any cluster center KPI as a first target detection KPI; matching a KPI to be detected that does not match any cluster center KPI with abnormal KPIs in each abnormal fluctuation propagation chain, determining a KPI to be detected that matches the same abnormal fluctuation propagation chain, and determining a KPI to be detected that first causes abnormal fluctuation among KPIs to be detected that match the same abnormal fluctuation propagation chain as a second target detection KPI; performing abnormal detection on the first target detection KPI by calling an abnormal detection model corresponding to the cluster center KPI matched with the first target detection KPI to obtain a first abnormal detection result of the first target detection KPI; performing abnormal detection on the second target detection KPI by calling an abnormal detection model corresponding to a type of the second target detection KPI to obtain a second abnormal detection result of the second target detection KPI, the type including a fluctuation type, a stable type or a periodic type.

2. The method of claim 1, wherein, The method comprises the following steps: performing preprocessing on data of each abnormal KPI, the preprocessing comprising at least sequentially missing value processing, abnormal value elimination and standardization processing; performing curve similarity calculation on time series of the abnormal KPIs after preprocessing two by two to obtain a curve shape similarity matrix; performing clustering on abnormal KPIs having similar curve shapes by using a clustering algorithm according to the curve shape similarity matrix, and determining cluster center KPIs of each cluster obtained by clustering.

3. The method of claim 2, wherein, The method comprises the following steps: Using a similarity measure algorithm based on cross-correlation, for two abnormal KPI time series of length n and and displacement s, the normalized cross-correlation NCC and the curve shape similarity measure SSM are calculated using the following equations: wherein performing curve similarity calculation on time series of the abnormal KPIs after preprocessing two by two to obtain a curve shape similarity matrix, comprising:

4. The method of claim 1, wherein, taking the calculated curve shape similarity measure SSM as a matrix element to obtain a curve shape similarity matrix. The method comprises the following steps: performing prediction on the remaining abnormal KPIs that are not successfully clustered by using a time series prediction algorithm to obtain prediction sequences corresponding to each abnormal KPI; extracting abnormal fluctuation feature sequences of each abnormal KPI according to differences between real time series of the abnormal KPIs and the corresponding prediction sequences; According to the abnormal fluctuation feature sequence two by two, the abnormal fluctuation feature correlation calculation is performed, and the correlation coefficient between the abnormal fluctuation feature sequences is determined. The correlation coefficient is taken as a matrix element to construct an abnormal fluctuation correlation matrix. According to the clustering algorithm, the abnormal fluctuation correlation matrix is clustered to construct an abnormal fluctuation propagation chain, and the abnormal KPI that first causes abnormal fluctuation in each abnormal fluctuation propagation chain is determined.

5. The method of claim 4, wherein, According to the abnormal fluctuation feature sequence two by two, the abnormal fluctuation feature correlation calculation is performed, and the correlation coefficient between the abnormal fluctuation feature sequences is determined, including: Let two abnormal fluctuation feature sequences with length l be M = {m1, m2, …, m l} and N = {n1, n2, …, n l}, fix the abnormal fluctuation feature sequence N, let the abnormal fluctuation feature sequence M translate on the abnormal fluctuation feature sequence N, and calculate the inner product of the abnormal fluctuation feature sequence M when it translates s units each time, wherein the abnormal fluctuation feature sequence M that translates s units is represented as: The abnormal fluctuation feature sequence M is calculated by the following formula s The correlation coefficient Corr of M and N: Traverse all values of s to obtain a vector with a length of 2l-1, and let the minimum value and the maximum value of the vector be minCorr and maxCorr, respectively, corresponding to the shifted values s1 and s2. Then, the correlation coefficient between the abnormal fluctuation feature sequences M and N is determined as:

6. The method of claim 4, wherein, Before the abnormal fluctuation feature sequence two by two, the abnormal fluctuation feature correlation calculation is performed, and the correlation coefficient between the abnormal fluctuation feature sequences is determined, the method further includes: After zero-mean standardization of each abnormal fluctuation feature sequence, the abnormal fluctuation feature amplification is performed through the following formula: Wherein, c is the growth rate, d is the cut-off value of the function f, and c and d are fixed numerical values.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: If the first target detection KPI and / or the second target detection KPI indicates an abnormality, the severity of the abnormality is determined according to the duration of the abnormality.

8. An abnormality detection device for high-dimensional KPIs, characterized by comprising: Including: The clustering module is configured to obtain data of abnormal KPIs that have occurred in history, and perform clustering processing according to the curve shape similarity between the abnormal KPIs to determine a clustering center KPI of each clustering cluster obtained by clustering; The propagation chain construction module is configured to perform abnormal fluctuation correlation analysis on the remaining abnormal KPIs that have not been successfully clustered to construct an abnormal fluctuation propagation chain, the abnormal fluctuation propagation chain including at least two abnormal KPIs having a certain abnormal fluctuation correlation; The first matching module is configured to obtain real-time data of each to-be-detected KPI, and match the data curve of each to-be-detected KPI with the data curve of each clustering center KPI respectively; and determine a to-be-detected KPI that matches any clustering center KPI as a first target detection KPI; The second matching module is configured to match a to-be-detected KPI that does not match any clustering center KPI with abnormal KPIs in each abnormal fluctuation propagation chain, determine a to-be-detected KPI that matches the same abnormal fluctuation propagation chain, and determine a to-be-detected KPI that first causes abnormal fluctuation in the to-be-detected KPIs that match the same abnormal fluctuation propagation chain as a second target detection KPI; The processing module is configured to, for the first target detection KPI, call an abnormality detection model corresponding to the clustering center KPI matched with the first target detection KPI to perform abnormality detection on the first target detection KPI to obtain a first abnormality detection result of the first target detection KPI; According to a type of the second target detection KPI, an anomaly detection model corresponding to the type is called to perform anomaly detection on the second target detection KPI to obtain a second anomaly detection result of the second target detection KPI, and the type includes a fluctuation type, a stability type, or a periodic type.

9. A computer readable medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the anomaly detection method for high-dimensional KPIs according to any one of claims 1 to 7.

10. An electronic device, comprising: Comprise: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the anomaly detection method for high-dimensional KPIs according to any one of claims 1 to 7.

Images