Multi-index intelligent dynamic threshold monitoring method and system

Abstract

The application provides a multi-index intelligent dynamic threshold monitoring method and system, comprising: obtaining monitoring historical data in the past time, converting the data into time sequence form after data cleaning; obtaining service characteristics, calculating the technical characteristics of the time sequence, and saving the technical characteristics and the service characteristics in a database; matching a time sequence prediction algorithm according to the technical characteristics and the service characteristics, querying parameters, and predicting monitoring index data in a future unit time by using the prediction algorithm; matching a monitoring strategy according to the technical characteristics and the service characteristics, calculating the upper limit and the lower limit of the threshold based on the prediction data, generating a dynamic threshold sequence in the future unit time, and saving the dynamic threshold sequence in the database; obtaining real-time data of the monitoring index, comparing the real-time data with the dynamic threshold sequence, meeting an alarm judgment strategy, and triggering an alarm. The application does not need to manually depend on business experience to formulate a monitoring strategy, has strong stability, saves labor cost, and can adaptively adjust the monitoring strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of business index and technical index monitoring, in particular, to a multi-index intelligent dynamic threshold monitoring method and system. BACKGROUND

[0002] A complete cloud computing system includes a large number of devices, and any abnormality of any device can affect the normal work of other devices, and even affect the good operation of the entire system. Therefore, the cloud computing system is often equipped with a device centralized management platform, which includes a business index and technical index monitoring and alarm system, which functions to collect the running status of a large number of devices of an information service system, to determine whether the devices are normally running with a certain monitoring strategy, and to notify the relevant operation and maintenance personnel when identifying that the devices have an abnormal tendency.

[0003] The typical conventional monitoring and alarm system in the industry usually includes the following processes: 1. Monitoring data collection: deploying monitoring data collection software and scripts on the monitored target devices, and storing the collected data in a database; 2. Monitoring strategy formulation: formulating business index threshold values and alarm determination strategies. A common strategy is to set a threshold value for a business index, and the data points of the business index of the monitoring point that exceed the threshold value are called abnormal points; set alarm analysis linkage strategies, such as more than 8 abnormal points in 10 consecutive monitoring data, 3 abnormal points in 5 consecutive monitoring data, etc., and when the abnormal points of the monitoring point meet the alarm determination logic, an alarm is generated; 3. Alarm indication: conveying alarm information to operation and maintenance personnel through PC, SMS, mobile terminal App push, mobile terminal public number push, etc.

[0004] The conventional business index monitoring and alarm system has the following problems: 1. It relies on operation and maintenance personnel to set fixed monitoring threshold values according to experience, and it is difficult to quantitatively ensure the accuracy of the threshold values, and the threshold values are often too high or too low. If the threshold value is too low or the analysis linkage strategy is too loose, it will result in too frequent alarms; if the threshold value is too high or the analysis linkage strategy is too strict, it will easily miss the alarm at that time, ignore the early performance failure phenomenon, and make the monitoring and alarm lose practical significance and even become an operation and maintenance burden; 2. For monitoring points with long-term trend changes, only after the monitoring appears false alarms or the user perceives system abnormalities can the threshold values be manually adjusted, and it is impossible to discover and timely change the monitoring strategy in advance to prevent false alarms and system abnormalities; 3. The business index alarm system often involves a large number of monitoring points, and a large number of human resources are needed to analyze and formulate monitoring and operation rules, which is costly and cumbersome.

[0005] Patent document CN107871190A (application number: CN201610849587.2) discloses a service index monitoring method and device, which can use statistical analysis of historical monitoring sample data of the to-be-monitored service index, automatically predict the upper and lower limit thresholds of the to-be-monitored data of the to-be-monitored service index, and determine whether the to-be-monitored data is abnormal data based on the predicted upper and lower limit thresholds; or, it can use a variable point detection method to identify abnormal data in the to-be-monitored time series data of the to-be-monitored service index. In this invention, the upper and lower limit thresholds of the service index monitoring are obtained by statistical analysis of the historical monitoring sample data of one or more historical same period points corresponding to the time point of the monitoring data. For example, in this scheme, the threshold upper and lower limit of a service index data at 3:00 today may be determined by the predicted value at 3:00 today and the historical same period data at 3:00 yesterday, or by the statistical analysis result of the predicted value at 3:00 today and the historical same period data at 3:00 of the previous week. This threshold setting method only considers the characteristics of the same period point when setting the threshold upper and lower limit of a time point relative to the predicted value, and ignores other time points. While monitoring data is a time series, the data of a time point is often related to other time data, and this approach ignores this information and is very sensitive to the quality of same period point data, with weak robustness. The invention uses variable point detection technology to determine abnormal data: based on the set variable point detection algorithm, the data acquisition unit acquires the variable point detection of the to-be-monitored time series data to determine whether there is a variable point in the to-be-monitored time series data. If there is a variable point, the data corresponding to the variable point time point in the to-be-monitored time series data is collected as candidate abnormal data. This method has a major defect in practical application: a to-be-monitored device may very likely carry out high-load operations at a fixed time every day, and when the device normally carries out daily operations, this time may be detected as a variable point and determined as candidate abnormal data, which greatly deviates from the actual situation.

[0006] Patent document CN108921355A (application number: CN201810752508.5) discloses a kind of alarm threshold setting method and device based on time series prediction model, comprising: obtaining the time series monitoring data of the monitoring index to be set;Determine the maximum value and minimum value under each time unit in time series monitoring data, to generate maximum value sequence and minimum value sequence;Create the time series prediction model of maximum value sequence and minimum value sequence;Using the time series prediction model of maximum value sequence and minimum value sequence, predict the change of the monitoring index to be set in future q time units, to obtain maximum value prediction sequence and minimum value prediction sequence;According to the initial threshold of the alarm threshold of the monitoring index to be set determined and maximum value prediction sequence and minimum value prediction sequence, obtain the alarm interval sequence of alarm threshold.The maximum value sequence and minimum value sequence of historical data are used to predict the maximum value sequence and minimum value sequence of the future in the application, and the alarm interval sequence of alarm threshold is obtained according to the initial threshold of the alarm threshold of the monitoring index to be set determined and maximum value prediction sequence and minimum value prediction sequence.The scheme is simple and fast enough, but there are some defects in prediction accuracy: the maximum / minimum value time series used for prediction is composed of the maximum / minimum value of the historical same period point of each period time point.That is, the scheme uses q time series to predict q time series, and the historical data is too small compared with the prediction data, and the prediction accuracy is low;Since this scheme aggregates historical data into a period by taking the maximum / minimum value of the same period, the characteristics between multiple periods of time series are ignored, which further reduces the prediction accuracy.Moreover, the scheme is very dependent on reasonable initial alarm threshold, and a large number of business experts are needed to set the initial alarm threshold. SUMMARY

[0007] In view of the defects in the prior art, the purpose of the present application is to provide a multi-index intelligent dynamic threshold monitoring method and system.

[0008] According to the multi-index intelligent dynamic threshold monitoring method provided by the application, the following steps are included:

[0009] Step S1: obtaining monitoring historical data in past time, which is converted into time series form after data cleaning;

[0010] Step S2: obtaining business characteristics, calculating technical characteristics of time series, and saving technical characteristics and business characteristics in database;

[0011] Step S3: according to technical characteristics and business characteristics, matching time series prediction algorithm, querying parameters, and using prediction algorithm to predict monitoring index data in future unit time;

[0012] Step S4: According to the technical features and business features, the monitoring strategy is matched, the threshold upper limit and lower limit are calculated based on the prediction data, the dynamic threshold sequence in future unit time is generated, and is saved in the database;

[0013] Step S5: Real-time data of the monitoring index is obtained, the real-time data and the dynamic threshold sequence are compared, the alarm determination strategy is met, and the alarm is triggered.

[0014] Preferably, in the step S1:

[0015] The historical collection data of a plurality of monitoring points is obtained, and is analyzed one by one. The collection data of the analysis object monitoring point is the original data collected in p time, and the data amount is n;

[0016] The collection time interval interval of the monitoring point is obtained;

[0017] When multiple data appear in the interval time window, there are repeated records, the first data point in the interval time window is retained, and the rest is discarded;

[0018] When there is no data in the interval time window, the naive prediction and interpolation method is used to fill in;

[0019] For data with a value greater than the value range of the monitoring index data, the upper limit of the corresponding index value range is taken as the cleaned data;

[0020] For data with a value less than the value range of the monitoring index data, the lower limit of the corresponding index value range is taken as the cleaned data;

[0021] The monitoring data described in the subsequent steps are all time series data y after cleaning.

[0022] Preferably, in the step S2:

[0023] The business information of the index is obtained as the business feature, the technical feature of the time series is calculated, and the technical feature and the business feature are saved in the database:

[0024] The business information of the monitoring index is obtained, including the upper limit of the value, the lower limit of the value, and the data time interval;

[0025] ADF test is used to judge whether the cleaned monitoring index time series data has stationarity;

[0026] The autocorrelation function value of the monitoring index data is calculated, and the period T of the data is determined according to the peak point of the autocorrelation function value and the business feature;

[0027] The business data mutation point is detected, and then the regularity mutation subsequence of the business data is detected, which is called mutation period MP;

[0028] The interquartile range IQR4 and the interdecile range IQR10 of the monitoring index data are calculated by a statistical method;

[0029] The above features are saved in a feature database.

[0030] Preferably, in the step S3:

[0031] According to the technical features and business features corresponding to the monitoring data, a suitable time series prediction algorithm is matched, parameters of the algorithm are obtained by querying the technical features and business features, and the prediction algorithm is used to predict the monitoring index data in a future unit time:

[0032] According to the algorithm characteristics, a scene suitable for each time series prediction algorithm is extracted;

[0033] The business features and technical features of the monitoring index are obtained, a mapping relationship between the data features and the adaptive algorithm is established, and the prediction algorithm suitable for the monitoring index is automatically adapted;

[0034] Different prediction algorithms require different parameters, a mapping relationship between the monitoring index data features and the prediction algorithm parameters is prepared in advance, the prediction algorithm parameters are automatically selected, and the prediction algorithm predicts a prediction result y of q unit times pred Save to the database.

[0035] Preferably, in the step S4:

[0036] The monitoring index data features IQR10, IQR4 and the upper limit max are obtained, the threshold sensitivity criterion k is calculated based on these features, and if the upper limit of the business data is not clear, the maximum value of the business data is taken as max;

[0037] Taking k as the criterion, the dynamic threshold upper and lower limits of the business data in the future q unit times are determined in combination with the feature variance of the business data;

[0038] The monitoring system recommends a suitable alarm determination strategy for the monitoring index according to the time interval between two data points of the time series data;

[0039] The data in the time window corresponding to the MP mutation period adopts a loose first-level dynamic threshold sensitivity and alarm determination strategy;

[0040] The recommended alarm determination strategy is deployed to the monitoring alarm module.

[0041] Preferably, in the step S5:

[0042] The required monitoring strategy is read from the database, the alarm determination strategy is deployed, the real-time data of the monitoring index is obtained, the real-time data and the corresponding dynamic threshold sequence in the database are compared, the alarm determination strategy is satisfied, and the alarm is triggered:

[0043] Obtain real-time data of the monitoring index, compare the real-time data with the upper and lower limits of the dynamic threshold corresponding to the time point, and if the real-time data point exceeds the upper and lower limit range, mark the real-time data point as an abnormal point;

[0044] After determining whether each data point is an abnormal point, it is determined whether an alarm is triggered at the current time according to the recommended alarm determination strategy, and if the triggering condition is met, the alarm is triggered.

[0045] According to the multi-index intelligent dynamic threshold monitoring system provided by the application, the following are provided:

[0046] Module M1: Obtain monitoring historical data in the past time, and convert the data into a time series form after data cleaning;

[0047] Module M2: Obtain business characteristics, calculate technical characteristics of the time series, and save the technical characteristics and business characteristics in the database;

[0048] Module M3: According to the technical characteristics and business characteristics, match the time series prediction algorithm, query the parameters, and use the prediction algorithm to predict the monitoring index data in the future unit time;

[0049] Module M4: According to the technical characteristics and business characteristics, match the monitoring strategy, calculate the upper and lower limits of the threshold based on the predicted data, generate a dynamic threshold sequence in the future unit time, and save it in the database;

[0050] Module M5: Obtain real-time data of the monitoring index, compare the real-time data with the dynamic threshold sequence, and if the alarm determination strategy is met, trigger the alarm.

[0051] Preferably, in the module M1:

[0052] Obtain historical collection data of multiple monitoring points, analyze them one by one, and record the collection data of the analysis object point as original data collected in p time, and the data amount is n;

[0053] Obtain the collection time interval interval set by the monitoring point;

[0054] When multiple data appear in the interval time window, there are repeated records, and the first data point in the interval time window is retained, and the rest is discarded;

[0055] When there is no data in the interval time window, the data is filled by using the naive prediction and interpolation method;

[0056] For data with a value greater than the value range of the monitoring index data, the upper limit of the corresponding index value range is taken as the cleaned data;

[0057] For data with a value less than the value range of the monitored indicator data, the lower limit of the corresponding indicator value range is taken as the cleaned data;

[0058] The monitoring data described in the subsequent steps are all cleaned time series data y.

[0059] Preferably, in the module M2:

[0060] The business information of the indicator is obtained as the business feature, the technical feature of the time series is calculated, and the technical feature and the business feature are saved in the database:

[0061] The business information of the monitored indicator is obtained, including the upper limit of the value, the lower limit of the value, and the data time interval;

[0062] ADF test is used to determine whether the cleaned monitored indicator time series data is stationary;

[0063] The autocorrelation function value of the monitored indicator data is calculated, and the period T of the data is determined according to the peak point of the autocorrelation function value and the business feature;

[0064] The business data mutation point is detected, and then the regularity mutation subsequence of the business data is detected, which is called the mutation period MP;

[0065] The interquartile range IQR4 and the interdecile range IQR10 of the monitored indicator data are calculated by statistical methods;

[0066] The above features are saved in the feature database.

[0067] Preferably, in the module M3:

[0068] According to the technical feature and the business feature corresponding to the indicator monitoring data, a suitable time series prediction algorithm is matched, the parameters of the algorithm are obtained by querying the technical feature and the business feature, and the prediction algorithm is used to predict the monitored indicator data in the future unit time:

[0069] According to the characteristics of the algorithm, the scene suitable for each time series prediction algorithm is extracted;

[0070] The business feature and the technical feature of the monitored indicator are obtained, the mapping relationship between the data feature and the adaptive algorithm is established, and the prediction algorithm suitable for the monitored indicator is automatically adapted;

[0071] Different prediction algorithms require different parameters, the mapping relationship between the monitored indicator data feature and the prediction algorithm parameter is prepared in advance, the prediction algorithm parameter is automatically selected, and the prediction algorithm predicts the prediction result y of q unit times pred Save to the database.

[0072] Preferably, in the module M4:

[0073] Obtain monitoring index data features IQR10, IQR4 and upper limit max, calculate threshold sensitivity criterion k with these features, and if the upper limit of the business data is not clear, take the maximum value of the business data as max;

[0074] Take k as the criterion, and determine the upper and lower limits of the dynamic threshold of the business data in the future q unit time according to the feature variance of the business data;

[0075] The monitoring system recommends a suitable alarm determination strategy for the monitoring index according to the time interval between two data points of the time sequence data;

[0076] The data in the time window corresponding to the MP mutation period adopts a loose first-level dynamic threshold sensitivity and alarm determination strategy;

[0077] Deploy the recommended alarm determination strategy to the monitoring alarm module.

[0078] Preferably, in the module M5:

[0079] Read the required monitoring strategy from the database, deploy the alarm determination strategy, obtain the real-time data of the monitoring index, compare the real-time data with the corresponding dynamic threshold sequence in the database, and if the alarm determination strategy is met, trigger the alarm:

[0080] Obtain the real-time data of the monitoring index, compare it with the dynamic threshold upper and lower limits of the corresponding time point, and if it exceeds the upper and lower limit range, mark this real-time data point as an abnormal point;

[0081] After determining whether each data point is an abnormal point, determine whether the alarm is triggered at the current time according to the recommended alarm determination strategy, and if the triggering condition is met, alarm.

[0082] Compared with the prior art, the present application has the following beneficial effects:

[0083] 1. No need for manual dependence on business experience to formulate monitoring strategies, strong stability, greatly reducing monitoring deployment time and saving labor cost;

[0084] 2. For the case of business change of the monitoring measuring point, the monitoring strategy can be adaptively adjusted by analyzing the feature change of the monitoring data, without the need for manual continuous tracking of the monitoring alarm effect and adjustment of the strategy;

[0085] 3. Suitable for monitoring of various technical indexes and business indexes, integrated with various time sequence prediction algorithms, automatically selecting a suitable algorithm suitable for various technical indexes, strong scalability and easy to use for large-scale monitoring;

[0086] 4. Using the change point detection technology to detect historical data, detecting the time period when the above-mentioned device starts to work regularly, and taking a more tolerant monitoring strategy for this time period, the monitoring effect is accurate, the false alarm and missed alarm situation is less, and the early phenomenon of performance failure and potential abnormality of the device ignored by the traditional monitoring system can be found;

[0087] 5. When setting the upper and lower limits of the monitoring threshold value of the service index data at a certain time, the predicted value, the historical same period point characteristics and the overall characteristics of the historical data are comprehensively considered, which is more accurate and robust;

[0088] 6. Using multiple periods of historical data for prediction, the periodic information in the historical data is sufficiently extracted. BRIEF DESCRIPTION OF DRAWINGS

[0089] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings:

[0090] Figure 1 A possible overall flowchart for an embodiment of the present application;

[0091] Figure 2 A possible device arrangement schematic diagram for an embodiment of the present application;

[0092] Figure 3 A possible flowchart for mutation period detection in an embodiment of the present application. DETAILED DESCRIPTION

[0093] The present application will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present application. These all belong to the protection scope of the present application.

[0094] Example 1

[0095] According to the multi-index intelligent dynamic threshold monitoring method provided by the present application, the following steps are included:

[0096] Step S1: Obtain the monitoring historical data in the past time, and convert it to time series form after data cleaning;

[0097] Step S2: Obtain the service characteristics, calculate the technical characteristics of the time series, and save the technical characteristics and the service characteristics in the database;

[0098] Step S3: According to the technical characteristics and the service characteristics, match the time series prediction algorithm, query the parameters, and use the prediction algorithm to predict the monitoring index data in the future unit time;

[0099] Step S4: According to the technical features and business features, the monitoring strategy is matched, the upper and lower thresholds are calculated based on the prediction data, the dynamic threshold sequence in future unit time is generated, and is saved in the database;

[0100] Step S5: Real-time data of the monitoring index is obtained, and the real-time data and the dynamic threshold sequence are compared. If the alarm determination strategy is met, the alarm is triggered.

[0101] Specifically in the step S1:

[0102] The historical collection data of a plurality of monitoring points is obtained, which is analyzed one by one. The collection data of the analysis object point is the original data collected in p time, and the data amount is n;

[0103] The collection time interval interval of the monitoring point is obtained;

[0104] When multiple data appear in the interval time window, there are repeated records, the first data point in the interval time window is retained, and the rest is discarded;

[0105] When there is no data in the interval time window, the naive prediction and interpolation method is used to fill in;

[0106] For data with a value greater than the value range of the monitoring index data, the upper limit of the corresponding index value range is taken as the cleaned data;

[0107] For data with a value less than the value range of the monitoring index data, the lower limit of the corresponding index value range is taken as the cleaned data;

[0108] The monitoring data described in the subsequent steps are all cleaned time series data y.

[0109] Specifically in the step S2:

[0110] The business information of the index is obtained as the business feature, the technical feature of the time series is calculated, and the technical feature and the business feature are saved in the database:

[0111] The business information of the monitoring index is obtained, including the upper limit of the value, the lower limit of the value, and the data time interval;

[0112] ADF test is used to determine whether the cleaned monitoring index time series data has stationarity;

[0113] The autocorrelation function value of the monitoring index data is calculated, and the period T of the data is determined according to the peak point of the autocorrelation function value and the business feature;

[0114] Detecting the mutation point of the service data, and then detecting the regular mutation subsequence of the service data, referred to as a mutation period MP;

[0115] The interquartile range IQR4 and the interdecile range IQR10 of the monitoring index data are calculated by a statistical method;

[0116] The above features are saved in a feature database.

[0117] Specifically in the step S3:

[0118] According to the technical features and business features corresponding to the monitoring index data, a suitable time series prediction algorithm is matched, the parameters of the algorithm are obtained by querying the technical features and business features, and the prediction algorithm is used to predict the monitoring index data in the future unit time:

[0119] According to the algorithm characteristics, the scene suitable for each time series prediction algorithm is refined;

[0120] The business features and technical features of the monitoring index are obtained, the mapping relationship between the data features and the adaptive algorithm is established, and the prediction algorithm suitable for the monitoring index is automatically adapted;

[0121] Different prediction algorithms require different parameters, and the mapping relationship between the monitoring index data features and the prediction algorithm parameters is prepared in advance, the prediction algorithm parameters are automatically selected, and the prediction algorithm predicts the prediction result y of q unit times pred Save to the database.

[0122] Specifically in the step S4:

[0123] The monitoring index data features IQR10, IQR4 and the maximum value max are obtained, the threshold sensitivity criterion k is calculated based on these features, and if the upper limit of the business data is not clear, the maximum value of the business data is taken as max;

[0124] Taking k as the criterion, the dynamic threshold upper and lower limits of the business data in the future q unit times are determined in combination with the feature variance of the business data;

[0125] The monitoring system recommends a suitable alarm judgment strategy for the monitoring index according to the time interval between two data points of the time series data;

[0126] The data in the time window corresponding to the MP mutation period adopts a loose first-level dynamic threshold sensitivity and alarm judgment strategy;

[0127] The recommended alarm judgment strategy is deployed to the monitoring alarm module.

[0128] Specifically in the step S5:

[0129] Read the required monitoring strategy from the database, deploy the alarm decision strategy; obtain the real-time data of the monitoring index, compare the real-time data with the corresponding dynamic threshold sequence in the database, and if the alarm decision strategy is met, an alarm is triggered:

[0130] Obtain the real-time data of the monitoring index, and compare it with the upper and lower limits of the dynamic threshold at the corresponding time point. If the real-time data point exceeds the upper and lower limit range, the real-time data point is marked as an abnormal point.

[0131] After determining whether each data point is an abnormal point, it is determined whether an alarm is triggered at the current time according to the recommended alarm decision strategy. If the triggering condition is met, an alarm is triggered.

[0132] Example 2

[0133] Embodiment 2 is a preferred example of Embodiment 1, which more specifically illustrates the present application.

[0134] A person skilled in the art can understand the multi-index intelligent dynamic threshold monitoring method provided by the present application as a specific implementation of a multi-index intelligent dynamic threshold monitoring system, that is, the multi-index intelligent dynamic threshold monitoring system can be realized by executing the steps of the multi-index intelligent dynamic threshold monitoring method.

[0135] According to the multi-index intelligent dynamic threshold monitoring system provided by the present application, the system comprises:

[0136] Module M1: Obtain monitoring historical data in the past time, and convert the data into a time sequence form after data cleaning;

[0137] Module M2: Obtain business characteristics, calculate technical characteristics of the time sequence, and save the technical characteristics and business characteristics in a database;

[0138] Module M3: According to the technical characteristics and business characteristics, match a time sequence prediction algorithm, query parameters, and use the prediction algorithm to predict monitoring index data in a future unit time;

[0139] Module M4: According to the technical characteristics and business characteristics, match a monitoring strategy, calculate upper and lower limits of the threshold based on the prediction data, generate a dynamic threshold sequence in a future unit time, and save the dynamic threshold sequence in a database;

[0140] Module M5: Obtain real-time data of the monitoring index, compare the real-time data with the dynamic threshold sequence, and if the alarm decision strategy is met, an alarm is triggered.

[0141] Specifically, in the module M1:

[0142] Obtain historical collection data of a plurality of monitoring measurement points, analyze them one by one, and record the collection data of the analysis object measurement point as original data collected in p time, and the data amount is n;

[0143] Obtain the collection time interval interval of the monitoring point setting;

[0144] If multiple data appear within the interval time window, there is repeated recording, and the first data point within the interval time window is retained, and the rest is discarded;

[0145] If there is no data within the interval time window, a naive prediction and interpolation method is used to fill in;

[0146] For data with a value greater than the value range of the monitoring index data, the upper limit of the corresponding index value range is taken as the cleaned data;

[0147] For data with a value less than the value range of the monitoring index data, the lower limit of the corresponding index value range is taken as the cleaned data;

[0148] The monitoring data described in the subsequent steps are all cleaned time series data y.

[0149] Specifically in the module M2:

[0150] Obtain the business information of the index as the business feature, calculate the technical feature of the time series, and save the technical feature and the business feature in the database:

[0151] Obtain the business information of the monitoring index, including the upper limit of the value, the lower limit of the value, and the data time interval;

[0152] Use ADF test to determine whether the cleaned monitoring index time series data has stationarity;

[0153] Calculate the autocorrelation function value of the monitoring index data, and determine the period T of the data according to the peak point of the autocorrelation function value and the business feature;

[0154] Detect the mutation point of the business data, and further detect the regularity mutation subsequence of the business data, called mutation period MP;

[0155] Calculate the quartile range IQR4 and decile range IQR10 of the monitoring index data by statistical method;

[0156] Save the above features in the feature database.

[0157] Specifically in the module M3:

[0158] According to the technical feature and the business feature corresponding to the index monitoring data, match the appropriate time series prediction algorithm, query the parameters of the algorithm through the technical feature and the business feature, and use the prediction algorithm to predict the monitoring index data in the future unit time:

[0159] According to the algorithm characteristics, the time series prediction algorithm suitable for the scene is refined;

[0160] The business characteristics and technical characteristics of the monitoring indicators are obtained, the mapping relationship between the data characteristics and the adaptive algorithm is established, and the prediction algorithm suitable for the monitoring indicators is automatically adapted;

[0161] Different prediction algorithms require different parameters, the mapping relationship between the monitoring indicator data characteristics and the prediction algorithm parameters is prepared in advance, the prediction algorithm parameters are automatically selected, and the prediction algorithm predicts the prediction result y of q unit time pred Save to the database.

[0162] Specifically in the module M4:

[0163] The monitoring indicator data characteristics IQR10, IQR4 and the upper limit max are obtained, the threshold sensitivity criterion k is calculated based on these characteristics, if the upper limit of the business data is not clear, the maximum value of the business data is taken as max;

[0164] Taking k as the criterion, the dynamic threshold upper and lower limits of the business data in the future q unit time are determined in combination with the characteristic variance of the business data;

[0165] The monitoring system recommends a suitable alarm judgment strategy for the monitoring indicator according to the time interval between two data points of the time series data;

[0166] The data in the time window corresponding to the MP mutation period adopts a loose first-level dynamic threshold sensitivity and alarm judgment strategy;

[0167] The recommended alarm judgment strategy is deployed to the monitoring alarm module.

[0168] Specifically in the module M5:

[0169] The required monitoring strategy is read from the database, the alarm judgment strategy is deployed, the real-time data of the monitoring indicator is obtained, and the real-time data and the corresponding dynamic threshold sequence in the database are compared. If the alarm judgment strategy is met, the alarm is triggered:

[0170] The real-time data of the monitoring indicator is obtained, and compared with the dynamic threshold upper and lower limits of the corresponding time point. If it exceeds the upper and lower limit range, the real-time data point is marked as an abnormal point;

[0171] After determining whether each data point is an abnormal point, it is determined whether the alarm is triggered at the current time according to the recommended alarm judgment strategy. If the triggering condition is met, the alarm is triggered.

[0172] Example 3

[0173] Embodiment 3 is a preferred example of embodiment 1, which more specifically illustrates the present application.

[0174] The application provides a multi-index intelligent dynamic threshold monitoring system.

[0175] Using time series analysis technology, historical data of the monitoring index in the past p periods is analyzed, technical features of the data are refined, combined with business features, according to the mapping rules between the features and the algorithm, a time series prediction algorithm integrated in the system is automatically selected to predict the values of the business index in the future q periods;

[0176] Combined with the technical features, business features and predicted values of the business index, the best monitoring strategy of the business index is automatically and intelligently generated, including a dynamic monitoring threshold and an alarm determination strategy;

[0177] For a monitoring point with a long-term trend change, the change of the monitoring data is intelligently identified, and the monitoring strategy is adaptively changed;

[0178] The system is suitable for various business indexes and technical indexes, and has strong universality.

[0179] The scheme comprises the following basic steps:

[0180] Step one: historical monitoring data in the past p time is obtained, and after data cleaning, the data is converted into a standard time series form. This step is completed by a data acquisition module and a data cleaning module;

[0181] Step two: this step is completed in a feature acquisition module. Part of the business information of the index is obtained as business features, and the technical features of the time series are calculated; the technical features and the business features are saved in a database;

[0182] Step three: this step is completed in a prediction module. According to the technical features and the business features corresponding to the index monitoring data, a suitable time series prediction algorithm is matched, the parameters of the algorithm are obtained by querying the technical features and the business features, and the prediction algorithm is used to predict the monitoring index data in the future q unit time;

[0183] Step four: this step is completed in a monitoring strategy matching module. According to the technical features and the business features, a monitoring strategy (including a threshold calculation method and an alarm determination strategy) is matched, the upper limit and the lower limit of the threshold are calculated based on the predicted data, a dynamic threshold sequence in the future q unit time is generated, and the dynamic threshold sequence is saved in the database;

[0184] Step five: this step is completed in a monitoring alarm module. The required monitoring strategy is read from the database, the alarm determination strategy is deployed to the monitoring alarm module, real-time data of the monitoring index is obtained, the real-time data is compared with the corresponding dynamic threshold sequence in the database, and if the alarm determination strategy is met, an alarm is triggered.

[0185] Further, the step one is specifically:

[0186] 11. Obtain historical collection data of multiple monitoring points, analyze one by one. The collection data of the analysis object monitoring point is the original data collected in p time, and the data amount is n;

[0187] 12. Obtain the collection time interval interval set by the monitoring point;

[0188] 13. If multiple data appear in the interval time window, it is considered that there is repeated recording in this minute, and the first data point in the i time window is retained, and the rest is discarded;

[0189] 14. In the case of no data in the interval time window, use naive prediction, interpolation and other methods to fill in;

[0190] 15. For data greater than / less than the value range of the monitoring index data, take the upper limit / lower limit of the corresponding index value range as the cleaned data.

[0191] The monitoring data described in the subsequent steps are all time series data y after cleaning.

[0192] Further, the second step is specifically:

[0193] 21. Obtain business information of the monitoring index, including but not limited to upper limit of value, lower limit of value, data time interval;

[0194] 22. Use ADF test to judge whether the cleaned monitoring index time series data has stationarity;

[0195] 23. Calculate the autocorrelation function value of the monitoring index data, and determine the period T of the data according to the peak point of the autocorrelation function value and the business characteristics;

[0196] 24. Use a change point detection algorithm to detect the mutation point of the business data, and further detect the regularity mutation subsequence of the business data, called mutation period MP;

[0197] 26. Calculate the quartile range IQR4 and decile range IQR10 of the monitoring index data by statistical method;

[0198] 27. Save the above features in the feature database.

[0199] Further, the third step is specifically:

[0200] 31. Deeply study the time series prediction algorithm, and extract the scenes suitable for each algorithm according to the algorithm characteristics;

[0201] 32. Obtain the business characteristics and technical characteristics of the monitoring index, establish the mapping relationship between the data characteristics and the adaptive algorithm, and realize the automatic adaptation of the prediction algorithm suitable for the monitoring index;

[0202] 33. Different prediction algorithms require different parameters, the scheme described in the present application pre-establishes the mapping relationship of monitoring indicator data characteristics to prediction algorithm parameters, automatically selects prediction algorithm parameters, and the prediction algorithm predicts the prediction result y of q unit time pred Save to database.

[0203] Further, the fourth step is specifically:

[0204] 41. Obtain monitoring indicator data characteristics IQR10, IQR4 and value upper limit max, calculate threshold sensitivity criterion k with these characteristics, and if the upper limit of service data is not clear, take the maximum value of service data as max;

[0205] 42. Determine the dynamic threshold upper and lower limits of service data in the future q unit time with k as the criterion and in combination with the characteristic variance of service data;

[0206] 43. The monitoring system described in the present application recommends a suitable alarm judgment strategy for the monitoring indicator according to the time interval between two data points of time series data;

[0207] 44. Use a more relaxed first-level dynamic threshold sensitivity and alarm judgment strategy for the data in the time window corresponding to the MP mutation period;

[0208] 45. Deploy the alarm judgment strategy recommended in step 43 to the monitoring alarm module.

[0209] Further, the fifth step is specifically:

[0210] 51. Obtain real-time data of the monitoring indicator, compare it with the dynamic threshold upper and lower limits of the corresponding time point, and if it exceeds the upper and lower limit range, mark this real-time data point as an abnormal point;

[0211] 52. After determining whether a data point is an abnormal point, determine whether the current time triggers an alarm according to the alarm judgment strategy of step 43, and if the triggering condition is met, alarm.

[0212] Example 4

[0213] Embodiment 4 is a preferred example of Embodiment 1, which more specifically illustrates the present application.

[0214] In order to solve the problems existing in the traditional monitoring alarm system, the present application proposes a multi-indicator intelligent dynamic threshold monitoring system. As shown in the flowchart Figure 1 The flowchart is a possible flowchart of the multi-indicator intelligent dynamic threshold monitoring system proposed in the present application example; as shown in the device structure diagram Figure 2 is a possible device structure diagram in this implementation example.

[0215] The S101 step involves two modules. One is the M1-1 data acquisition module that acquires monitoring data of the monitoring point p duration and saves it to the database S202. The other is the M1-2 data cleaning module that cleans the data and converts it into a standard time series. The subsequent processes use only the cleaned time series data, which is saved to the database S202.

[0216] It should be understood that the M1-1 data acquisition module and the M1-2 data cleaning module in the above Figure 2 Figure 1 The modules M1 are composed of the M1-1 data acquisition module and the M1-2 data cleaning module in the above

[0217] Specifically, the M1-1 data acquisition module acquires historical acquisition data of x (x e N) monitoring points S201-i (i e [1, x], i e N) for the past p time, and analyzes each monitoring point one by one. The acquisition data of the analysis object monitoring point is the original data collected internally, and the data volume is n. The acquisition time interval interval of the monitoring point is obtained to perform data cleaning. There are three ways to clean data, corresponding to three different situations:

[0218] For the case where multiple data appear within the interval time, it is considered that there are repeated records in this minute, and the first record within the interval time is retained, and the rest is deleted.

[0219] For the case where there is no data within the interval time, naive prediction, interpolation, etc. are used to fill in.

[0220] For data with a value greater than / less than the value range of the monitoring index, the upper / lower limit of the value range of the monitoring index is taken as the cleaned data.

[0221] The S102 step acquires the business characteristics of the time series data, calculates the technical characteristics of the time series data, and records the characteristics in the database.

[0222] Specifically, this step is performed by the M2 feature acquisition module. First, the business characteristics are acquired from the database, including but not limited to the upper limit of the value, the lower limit of the value, and the data time interval. The business characteristics are manually filled by business personnel and saved in the database. This is a necessary step for building an information service system, and is not an additional workload brought by the monitoring system of the present application.

[0223] Then, the technical characteristics are calculated by mathematical statistics, including but not limited to stationarity, periodicity, mutation period, quartile distance IQR4, decile distance IQR10, and mean.

[0224] ​Wherein IQR4, IQR10 and mean are obtained by conventional statistical methods; stationarity is obtained by ADF stationarity test;

[0225] Wherein the calculation method of periodicity is specifically, calculating the autocorrelation coefficient sequence acf of the time series, and obtaining the autocorrelation coefficient sequence peak point acfp through a peak detection algorithm i (i∈N), comparing the peak value with a preset threshold of autocorrelation coefficient, if the peak value is greater than the preset threshold, then the time length corresponding to the peak point is the period of the time series.

[0226] For example, Figure 3 Wherein the detection method of mutation period is specifically, in some embodiments of the present application, the monitoring index historical data period is T, the time length corresponding to the time series y is p, the data amount corresponding to the period T is m, and y is divided into n segments according to the period time length i (i∈[1,n],i∈N), n is the integer part of p divided by T. The mutation points of y i are detected, the first point and the last point of y i are also regarded as mutation points. Then, according to one segment between every two mutation points, y is divided into multiple sub-sequences, and the outlier sub-sequence y ij is marked, wherein:

[0227] i∈[1,n],i∈N

[0228] j∈[1,m-1],j∈N

[0229]

[0230] In some other embodiments, the monitoring index historical data does not have periodicity, then this step directly outputs 0, i.e. no mutation period.

[0231] Further, the specific method of dividing the time series into n segments is: in some embodiments, the time length p corresponding to the time series y is an integer multiple of the period T, then y is divided into n=p / T sub-sequences; in some other embodiments, p is not an integer multiple of T, then starting from the first time point data of y, y is divided into sub-sequences with a time length of T, until the remaining sub-sequence length is less than T, the remaining sub-sequence is discarded, i.e. the first n*T data points of y are divided into n segments for analysis, n is the integer part of p / T.

[0232] Taking the starting time of each period as 0 time, comparing the time of the mutation segment in all periods relative to 0 time, if y i1j1 and y i2j2 have intersection relative to 0 time, then y i1j1 ∪y i2j2The corresponding time period is the mutation screening period; if a mutation period does not intersect with all mutation periods of other cycles, the mutation period is discarded. The set of all mutation screening periods is the mutation period MP of the monitoring index data. MP can effectively reveal the operation time regularity of the monitoring point device; MP is a technical feature.

[0233] S103 is performed by the M3 prediction module. First, read the time series data features from the database S202, use the pre-trained routing algorithm, automatically select the prediction algorithm and parameters suitable for the monitoring index historical data according to the features, predict the monitoring data in the future q time length, and save to the database. The prediction algorithm includes but is not limited to linear regression, exponential smoothing algorithm, ARIMA and Prophet;

[0234] S104 is performed by the M4 monitoring strategy matching module. Get the features of the monitoring index historical time series data from the database, automatically match the monitoring strategy, including dynamic threshold upper and lower limit sensitivity and alarm judgment strategy; get the predicted value of the business feature from the database, generate the dynamic threshold of the monitoring index in the future q time according to the predicted value and the dynamic threshold upper and lower limit sensitivity, and store it in the database S202;

[0235] Specifically, first, get the variance σ, interquartile range IQR4, decile range IQR10, and maximum value max of the monitoring index historical time series data from the database. In some implementation cases, the monitoring index does not have a clear maximum value, in which case the maximum value of the historical data is max.

[0236] Then calculate the threshold sensitivity criterion k = (IQR10-IQR4) / max. With k as the criterion, determine the business data dynamic threshold upper and lower limit width margin, then the dynamic threshold upper limit of the business data in the future q unit time is y pred +margin; the dynamic threshold lower limit is y pred -margin. In some implementation cases, the mapping relationship between criterion k and margin is as follows:

[0237] Table 1 Mapping relationship table between criterion k and margin in some embodiments

[0238]

[0239] It should be understood that the present application is not limited to the above mapping relationship, in other implementation cases, the mapping relationship between k and margin does not involve the standard deviation, but uses other technical features, which is determined by the characteristics of the monitoring index data.

[0240] According to the snapshot period (the time interval between two data points) of the time series data, a suitable alarm decision strategy is recommended for the monitoring indicator. For the threshold in the time period corresponding to the MP mutation period, a more relaxed first-level dynamic threshold sensitivity and alarm decision strategy is adopted. The recommended alarm decision strategy is deployed to the monitoring alarm module.

[0241] Data points exceeding the upper and lower limits of the dynamic threshold are called abnormal points. In some embodiments, the alarm decision strategy recommended by the present application includes, but is not limited to, the following strategies:

[0242] When the time interval is at the minute level, the alarm decision strategy of "triggering an alarm if 15 out of 15 consecutive data points are abnormal" is recommended;

[0243] When the time interval is at the hour level, the alarm decision strategy of "triggering an alarm if 3 out of 3 consecutive data points are abnormal" is recommended;

[0244] When the time interval is at the day level or above, the alarm decision strategy of "triggering an alarm if 1 out of 1 consecutive data point is abnormal" is recommended.

[0245] S105 is executed by the M5 monitoring alarm module. The module reads the monitoring strategy corresponding to the monitoring indicator from the database S202, deploys the alarm decision strategy to the monitoring server S204-i (i∈N), and implements the strategy distribution. The S204-i monitoring server obtains the real-time data of the monitoring indicator, compares the real-time data with the corresponding dynamic threshold sequence in the database, and if the alarm decision strategy is met, an alarm is triggered.

[0246] It should be understood that in the present embodiment, the M1-2, M2, M3, and M4 modules are deployed in the S203 computing center. The S203 computing center can be a single computing device or a server cluster. All of the M1-2, M2, M3, and M4 modules can be deployed on each device in the computing center, or a number of modules can be distributed and deployed on each machine.

[0247] Similarly, the other modules involved in the present application can also be implemented by a single server, and if necessary, can also be implemented in a cluster manner. All modules can be deployed on each server, or the modules can be distributed and deployed on multiple servers. The present application does not limit this.

[0248] The above embodiments are explained to facilitate understanding of the spirit and principles of the present application, and the present application is not limited in the implementation manner. The implementation manner of the present application can be used in other applicable scenarios, such as internet advertising business monitoring scenarios, decision support scenarios, business prediction scenarios, and the like, which are not described herein.

[0249] The embodiments described in the present application have no language, software and hardware restrictions, and can be implemented by various hardware processors executing program instructions based on the spirit and principles of the present application, such as computers running Windows operating system, computers running Linux operating system, computing devices running IOS system, computing devices running Android system, quantum computers, and the like, executing program instructions written in Java, Python, C++, and the like.

[0250] Those skilled in the art know that, in addition to implementing the system, device and each module thereof provided by the present application in the form of pure computer readable program code, the same program can also be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and each module thereof provided by the present application can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing methods and structures within the hardware component.

[0251] The specific embodiments of the present application are described above. It should be understood that the present application is not limited to the specific embodiments described above, and various changes or modifications can be made by those skilled in the art within the scope of the claims, without affecting the essential content of the present application. The embodiments of the present application and the features in the embodiments can be arbitrarily combined with each other without conflict.

Claims

1. A multi-indicator intelligent dynamic threshold monitoring method, characterized in that, Comprising: Step S1: obtaining monitoring historical data in the past time, converting the data to time series form after data cleaning; Step S2: obtaining business characteristics, calculating technical characteristics of time series, saving technical characteristics and business characteristics in the database; obtaining business information of the index as business characteristics, calculating technical characteristics of time series, saving technical characteristics and business characteristics in the database; Step S3: matching time series prediction algorithm according to technical characteristics and business characteristics, querying parameters, and predicting monitoring index data in future unit time using the prediction algorithm; Step S4: according to the technical characteristics and business characteristics, matching the monitoring strategy, taking the prediction data as the benchmark, calculating the upper and lower limits of the threshold, generating the dynamic threshold sequence in the future unit time, and saving it in the database; Step S5: obtaining real-time data of the monitoring index, comparing real-time data and dynamic threshold sequence, meeting the alarm judgment strategy, then triggering the alarm; In the step S4: Acquiring monitoring index data features, quartile distance , quartile distance , and upper limit of value , calculating threshold sensitivity criterion with these features, if the upper limit of business data is not clear, taking the maximum value of business data as ; by As a criterion, the characteristic variance of the business data is used to determine the future performance of the business data. The upper and lower limits of the dynamic threshold per unit time; The monitoring system recommends a suitable alarm judgment strategy for the monitoring index according to the time interval between two data points of the time series data; For Data within the time window corresponding to the mutation period adopts a relaxed first-level dynamic threshold sensitivity and alarm determination strategy; Deploy the recommended alarm judgment strategy to the monitoring alarm module; Detecting the mutation point of the business data by using the mutation point detection algorithm, and then detecting the regularity mutation subsequence of the business data, called mutation period .

2. The multi-criteria intelligent dynamic threshold monitoring method of claim 1, wherein, In the step S1: The historical collection data of a plurality of monitoring points are acquired, analyzed one by one, and the collection data of the analysis object monitoring point is The original data collected within the time period, and the data volume is ; Acquisition monitoring point setting acquisition time interval ; If multiple data points occur within the time window, then there are duplicate records, and the first one is kept If multiple data points occur within the time window, then there are duplicate records, and the first one is kept When there is no data in the time window, the naive prediction and interpolation method are used to fill in. For data with a value greater than the value range of the monitoring index data, take the upper limit of the corresponding index value range as the cleaned data; For data with a value less than the value range of the monitoring index data, take the lower limit of the corresponding index value range as the cleaned data; The monitoring data described in the subsequent steps are all cleaned time series data .

3. The multi-criteria intelligent dynamic threshold monitoring method of claim 1, wherein, In the step S2: Obtain the business information of the monitoring index, including the upper limit of the value, the lower limit of the value, and the data time interval; Use ADF test to determine whether the cleaned monitoring index time series data is stationary; The autocorrelation function value of the monitoring index data is calculated, and the peak point of the autocorrelation function value and the service characteristics are used to determine the period of the data ; The interquartile range of the monitoring index data is calculated by a statistical method and the decile range 10; Save the above technical characteristics and business characteristics in the feature database.

4. The multi-criteria intelligent dynamic threshold monitoring method of claim 1, wherein, In the step S3: According to the technical characteristics and business characteristics corresponding to the index monitoring data, match the appropriate time series prediction algorithm, query the parameters of the algorithm according to the technical characteristics and business characteristics, and use the prediction algorithm to predict the monitoring index data in the future unit time: According to the characteristics of the algorithm, extract the scenes suitable for each time series prediction algorithm; Obtain the business characteristics and technical characteristics of the monitoring index, establish the mapping relationship between data characteristics and adaptive algorithms, and realize the automatic adaptation of the prediction algorithm suitable for the monitoring index; Different prediction algorithms require different parameters, the mapping relationship between the monitoring index data characteristics and the prediction algorithm parameters is prepared in advance, the prediction algorithm parameters are automatically selected, and the prediction algorithm is predicted the prediction result of one unit time saved to the database.

5. The multi-criteria intelligent dynamic threshold monitoring method of claim 1, wherein, In the step S5: Read the required monitoring strategy from the database, deploy the alarm judgment strategy; obtain real-time data of the monitoring index, compare real-time data and corresponding dynamic threshold sequence in the database, meet the alarm judgment strategy, then trigger the alarm: Obtain real-time data of the monitoring index, compare with the dynamic threshold upper and lower limits of the corresponding time point, if it exceeds the upper and lower limit range, mark this real-time data point as an abnormal point; After determining whether each data point is an abnormal point, determine whether the alarm is triggered at the current time according to the recommended alarm judgment strategy, if the trigger condition is met, alarm.

6. A multi-indicator intelligent dynamic threshold monitoring system, characterized in that, Comprising: Module M1: obtaining monitoring historical data in the past time, converting the data to time series form after data cleaning; Module M2: Obtain service characteristics, calculate technical characteristics of time series, save technical characteristics and service characteristics in database; Obtain business information of indicators as service characteristics, calculate technical characteristics of time series, save technical characteristics and service characteristics in database; Module M3: According to technical characteristics and service characteristics, match time series prediction algorithm, query parameters, and use the prediction algorithm to predict monitoring indicator data in future unit time; Module M4: According to technical characteristics and service characteristics, match monitoring strategy, calculate upper and lower limits of threshold based on prediction data, generate dynamic threshold sequence in future unit time, and save in database; Module M5: Obtain real-time data of monitoring indicators, compare real-time data and dynamic threshold sequence, and trigger alarm if alarm judgment strategy is met; In the module M4: Acquiring monitoring index data features, quartile range , quartile range and upper limit of value , calculating threshold sensitivity criterion with these features , if the upper limit of business data is not clear, taking the maximum value of business data as ; by As a criterion, the characteristic variance of the business data is used to determine the future performance of the business data. The upper and lower limits of the dynamic threshold per unit time; The monitoring system recommends a suitable alarm judgment strategy for the monitoring indicator according to the time interval between two data points of the time series data; For Data within the time window corresponding to the mutation period adopts a relaxed first-level dynamic threshold sensitivity and alarm determination strategy; Deploy the recommended alarm judgment strategy to the monitoring alarm module; Detecting the mutation point of the business data by using the mutation point detection algorithm, and then detecting the regularity mutation subsequence of the business data, called mutation period .

7. The multi-criteria intelligent dynamic threshold monitoring system of claim 6, wherein, In the module M1: The historical collection data of a plurality of monitoring points are acquired, analyzed one by one, and the collection data of the analysis object monitoring point is The original data collected within the time period, and the data volume is ; Acquisition monitoring point setting acquisition time interval ; If multiple data points occur within the time window, then there are duplicate records, and the first one is kept If multiple data points occur within the time window, then there are duplicate records, and the first one is kept When there is no data in the time window, the naive prediction and interpolation method are used to fill in. For data with a value greater than the value range of the monitoring indicator data, take the upper limit of the corresponding indicator value range as the cleaned data; For data with a value less than the value range of the monitoring indicator data, take the lower limit of the corresponding indicator value range as the cleaned data; The monitoring data described in the subsequent steps are all cleaned time series data .

8. The multi-criteria intelligent dynamic threshold monitoring system of claim 6, wherein, In the module M2: Obtain business information of monitoring indicators, including upper limit of value, lower limit of value, and data time interval; Use ADF test to determine whether the cleaned monitoring indicator time series data is stationary; The autocorrelation function value of the monitoring index data is calculated, and the peak point of the autocorrelation function value and the service characteristics are used to determine the period of the data ; The interquartile range of the monitoring index data is calculated by statistical methods and the decile range 10; Save the above technical characteristics and business characteristics in the feature database.

9. The multi-criteria intelligent dynamic threshold monitoring system of claim 6, wherein, In the module M3: According to the technical characteristics and business characteristics of the indicator monitoring data, match the appropriate time series prediction algorithm, query the parameters of the algorithm according to the technical characteristics and business characteristics, and use the prediction algorithm to predict the monitoring indicator data in future unit time: According to the characteristics of the algorithm, extract the suitable scenarios for each time series prediction algorithm; Obtain the business characteristics and technical characteristics of the monitoring indicators, establish the mapping relationship between the data characteristics and the adaptive algorithm, and realize the automatic adaptation of the prediction algorithm suitable for the monitoring indicators; Different prediction algorithms require different parameters, and the mapping relationship between the monitoring index data characteristics and the prediction algorithm parameters is prepared in advance, the prediction algorithm parameters are automatically selected, and the prediction algorithm predicts the prediction result of one unit time saved to the database; In the module M5: Read the required monitoring strategy from the database, deploy the alarm judgment strategy, obtain real-time data of monitoring indicators, compare real-time data and corresponding dynamic threshold sequence in the database, and trigger alarm if the alarm judgment strategy is met: Obtain real-time data of monitoring indicators, compare with dynamic threshold upper and lower limits at corresponding time points, and if it exceeds the upper and lower limit range, mark this real-time data point as an abnormal point; After determining whether each data point is an abnormal point, determine whether to trigger an alarm at the current time according to the recommended alarm judgment strategy, and if the triggering condition is met, alarm.

Images