A self-learning method, device and computer-readable storage medium for predictive model

Abstract

A self-learning method for a prediction model includes: obtaining a prediction boundary threshold of the prediction model, wherein the prediction model is a prediction model for network security situation awareness; continuously collecting data samples from N windows, where N≥2; calculating a deviation threshold interval based on the prediction boundary threshold and the collected data samples, wherein the deviation threshold interval is used to represent the threshold at which the data sample deviates from the prediction boundary threshold; determining whether the deviation value of the real-time data in each window exceeds the deviation threshold interval, and retraining and updating the prediction model if the deviation value of the real-time data is greater than the deviation threshold interval. The self-learning method for the prediction model described above can continuously collect real-time data, analyze the trend of data deviation, and automatically train and update the prediction model after determining that the real data deviates significantly from the baseline, thereby avoiding the waste of computing resources caused by setting the fixed model self-learning cycle too short, and the problem of model update lag caused by setting it too long.

Description

Technical Field

[0001] The present disclosure relates to, but is not limited to, information security technology, and more specifically, to a self-learning method, device, and computer-readable storage medium for a prediction model. Background Art

[0002] In the field of information security, network security situational awareness involves collecting data from security systems such as intrusion detection systems, log auditing systems, and terminal protection systems to assess the current network security situation and predict future trends. Forecasting is a key task in situational awareness, and algorithms such as time series, which build a baseline for forecasted trends based on historical data, are a primary method for trend prediction. During time series forecasting, it is essential to continuously refine the trend values ​​predicted by the time series model using observations. While the periodicity of many time series is relatively easy to accurately predict, trends can be easily influenced by recent, real-time random events. Using models trained on historical data with long time intervals can lead to significant deviations in the trend assessment of time series forecasts. This is particularly true when using time series methods for network security situational awareness forecasting, such as for trend predictions of the number of network security incidents or network traffic values, where the sampling time scale is often on the order of hours or even minutes.

[0003] Some situational awareness systems use periodic data re-collection to train models. However, this data is often completely irrelevant to current data, leading to numerous prediction anomalies and significant lags. Regularly training models automatically wastes computing resources and fails to model trends within or across cycles. Furthermore, automatic model training and updating can compromise accuracy due to corrupted data. Without automatic correction measures, the automatically updated model can become unusable. Summary of the Invention

[0004] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0005] The present disclosure provides a self-learning method for a prediction model, including:

[0006] Obtaining a prediction boundary threshold of a prediction model, wherein the prediction model is a prediction model for network security situation awareness;

[0007] Continuously collect data samples from N windows, N ≥ 2;

[0008] Calculating a deviation threshold interval according to the prediction boundary threshold and the collected data sample, wherein the deviation threshold interval is used to represent a threshold at which the data sample deviates from the prediction boundary threshold;

[0009] It is determined whether the deviation value of the real-time data in each window exceeds the deviation threshold interval. If the deviation value of the real-time data is greater than the deviation threshold interval, the prediction model is retrained and updated.

[0010] In an exemplary embodiment of the present disclosure, the continuously collecting data samples of N windows, where N≥2, includes:

[0011] Set the sliding window size and sliding distance;

[0012] The sliding window is slid forward according to a preset sliding distance to continuously collect data samples of N windows.

[0013] In an exemplary embodiment of the present disclosure, the calculating of the deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0014] Calculating a first deviation threshold interval according to the prediction boundary threshold and the collected data samples; and / or,

[0015] Calculating a third deviation threshold interval according to the prediction boundary threshold and the collected data samples;

[0016] The first deviation threshold interval is used to indicate the number of data samples that have deviated; and the third deviation threshold interval is used to indicate the total amount of deviation of the data samples that have deviated.

[0017] In an exemplary embodiment of the present disclosure, the calculating of the first deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0018] Calculate the number N1 of samples in each of the N windows whose data samples exceed the prediction boundary threshold;

[0019] Divide N1 by the total number of samples in each window N2 to obtain the deviation rate within each window;

[0020] The Gaussian distribution of the deviation rates within the N windows is calculated to obtain a first deviation threshold interval.

[0021] In an exemplary embodiment of the present disclosure, the calculating of the third deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0022] Calculating the Gaussian distribution of the deviation values ​​of all non-repeated data samples in the N windows to obtain a second deviation threshold interval; wherein the deviation value of the data sample is the difference between the true value of the data sample and the prediction boundary threshold;

[0023] Find data samples in each window whose deviation values ​​exceed the second deviation threshold interval, and calculate the sum of the deviation values ​​of the found data samples; calculate the Gaussian distribution of the sum of the deviation values ​​of the N windows to obtain the third deviation threshold interval.

[0024] In an exemplary embodiment of the present disclosure, determining whether the deviation value of the real-time data in each window exceeds the deviation threshold interval, and retraining and updating the prediction model if the deviation value of the real-time data is greater than the deviation threshold interval, includes:

[0025] Calculating the deviation rate of the real-time data in each window, and retraining and updating the prediction model when the deviation rate of the real-time data is greater than the first deviation threshold interval; or

[0026] Calculating the sum of the deviation values ​​of the real-time data in each window, and retraining and updating the prediction model when the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval; or

[0027] Calculate the deviation rate of the real-time data in each window and the sum of the deviation values ​​of the real-time data in each window. When the deviation rate of the real-time data is greater than the first deviation threshold interval and the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval, retrain the prediction model and update the prediction model.

[0028] In an exemplary embodiment of the present disclosure, before continuously collecting data samples of N windows, the method further includes:

[0029] Save the data sample according to the sampling time of the data sample, and determine whether there is a data sample record based on the timestamp of the data sample;

[0030] In the absence of data sample records, the missing records are marked as NA.

[0031] In an exemplary embodiment of the present disclosure, the method further includes:

[0032] In the case where dirty data pollution exists in the data sample, the Gaussian distribution of the data sample values ​​at the corresponding moments of the dirty data in all trend periods is calculated to obtain a fourth deviation threshold interval;

[0033] When the data sample value exceeds a fourth deviation threshold interval, replacing the data sample value with a normal distribution mean in the fourth deviation threshold interval; or

[0034] In the case where there is an NA record, the NA record is replaced by the normal distribution mean in the fourth deviation threshold interval.

[0035] An embodiment of the present disclosure further provides a method comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it can implement the self-learning method of the prediction model as described in any embodiment of the present disclosure.

[0036] The self-learning method and device of the prediction model of the embodiment of the present disclosure can automatically determine whether the real data deviates significantly from the baseline in a large number of times, and does not perform model self-learning based on a fixed time period, thereby avoiding the waste of computing resources caused by setting the fixed model self-learning period too short, and the problem of model update lag caused by setting it too long; 2) by judging the self-learning time by both the number of deviated data and the sum of the deviation thresholds, it is possible to avoid trend misjudgments caused by alarms generated by a small amount of abnormal data or alarms generated by a large amount of abnormal data near the boundary values, which is particularly suitable for trend prediction in security situation awareness with a short sampling statistical period of minutes and irregular burst business; 3) by automatically processing dirty data, the influence of missing values ​​and abnormal values ​​on the model training results during the self-learning process is avoided, thereby improving the accuracy of the model.

[0037] Still other aspects will become apparent upon reading and understanding the accompanying drawings and detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation to the technical solution of the present invention.

[0039] Figure 1 is a flow chart of a self-learning method of a prediction model according to an embodiment of the present disclosure;

[0040] Figure 2 is a flowchart of a self-learning method of a prediction model according to another embodiment of the present disclosure;

[0041] Figure 3 Schematic diagram of a self-learning device for a prediction model according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] The present disclosure describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present disclosure.

[0043] In the description of the present disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment described as "exemplary" or "for example" in the present disclosure should not be interpreted as being more preferred or advantageous than other embodiments. "And / or" in this article is a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. "Multiple" refers to two or more than two. In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present disclosure, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0044] When describing representative exemplary embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps in the specific order described. As will be understood by those skilled in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps performed in the order written, and those skilled in the art can readily understand that these sequences can vary and still remain within the spirit and scope of the disclosed embodiments.

[0045] In related technologies, the prediction model of network security situation awareness cannot be automatically updated after being deployed to the inference engine, resulting in inaccurate prediction models and a large number of false alarms; moreover, under short sampling cycles, trends change quickly, and regular or manual retraining and deployment of models cannot adapt to rapidly changing trends; furthermore, the automatic collection, training and updating of models may have the impact of dirty data on model accuracy.

[0046] In order to solve the problems existing in the traditional prediction model, the present disclosure proposes a self-learning method for the prediction model. Figure 1 Shown, including:

[0047] Step 110: Obtain a prediction boundary threshold of a prediction model, where the prediction model is a prediction model for network security situation awareness;

[0048] Step 120, continuously collecting data samples of N windows, where N≥2;

[0049] Step 130, calculating a deviation threshold interval based on the prediction boundary threshold and the collected data sample, wherein the deviation threshold interval is used to represent a threshold at which the data sample deviates from the prediction boundary threshold;

[0050] Step 140 , determining whether the deviation value of the real-time data in each window exceeds the deviation threshold interval. If the deviation value of the real-time data is greater than the deviation threshold interval, retraining the prediction model and updating the prediction model.

[0051] The self-learning method of the prediction model of the embodiment of the present disclosure can continuously collect real-time data, analyze the trend of data deviation, and automatically train and update the prediction model after determining that the real data deviates significantly from the baseline, thereby avoiding the waste of computing resources caused by setting the fixed model self-learning cycle too short and the problem of model update lag caused by setting it too long.

[0052] In an exemplary embodiment of the present disclosure, the step 120 of continuously collecting data samples from N windows, where N≥2, includes:

[0053] Set the sliding window size and sliding distance;

[0054] The sliding window is slid forward according to a preset sliding distance to continuously collect data samples of N windows.

[0055] In an exemplary embodiment of the present disclosure, the step 130 of calculating the deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0056] Calculating a first deviation threshold interval according to the prediction boundary threshold and the collected data samples; and / or,

[0057] Calculating a third deviation threshold interval according to the prediction boundary threshold and the collected data samples;

[0058] The first deviation threshold interval is used to indicate the number of data samples that have deviated; and the third deviation threshold interval is used to indicate the total amount of deviation of the data samples that have deviated.

[0059] In an exemplary embodiment of the present disclosure, the calculating of the first deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0060] Calculate the number N1 of samples in each of the N windows whose data samples exceed the prediction boundary threshold;

[0061] Divide N1 by the total number of samples in each window N2 to obtain the deviation rate within each window;

[0062] The Gaussian distribution of the deviation rates within the N windows is calculated to obtain a first deviation threshold interval.

[0063] In an exemplary embodiment of the present disclosure, the calculating of the third deviation threshold interval according to the prediction boundary threshold and the collected data samples includes:

[0064] Calculating the Gaussian distribution of the deviation values ​​of all non-repeated data samples in the N windows to obtain a second deviation threshold interval; wherein the deviation value of the data sample is the difference between the true value of the data sample and the prediction boundary threshold;

[0065] Find data samples in each window whose deviation values ​​exceed the second deviation threshold interval, and calculate the sum of the deviation values ​​of the found data samples; calculate the Gaussian distribution of the sum of the deviation values ​​of the N windows to obtain the third deviation threshold interval.

[0066] In an exemplary embodiment of the present disclosure, the step 140 of determining whether the deviation value of the real-time data in each window exceeds the deviation threshold interval, and retraining and updating the prediction model if the deviation value of the real-time data is greater than the deviation threshold interval, includes:

[0067] Calculating the deviation rate of the real-time data in each window, and retraining and updating the prediction model when the deviation rate of the real-time data is greater than the first deviation threshold interval; or

[0068] Calculating the sum of the deviation values ​​of the real-time data in each window, and retraining and updating the prediction model when the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval; or

[0069] Calculate the deviation rate of the real-time data in each window and the sum of the deviation values ​​of the real-time data in each window. When the deviation rate of the real-time data is greater than the first deviation threshold interval and the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval, retrain the prediction model and update the prediction model.

[0070] The self-learning method of the prediction model of the embodiment of the present disclosure can avoid trend misjudgment caused by alarms generated by a small amount of abnormal data or alarms generated by a large amount of abnormal data near the boundary value by judging the self-learning time simultaneously based on the number of deviated data and the sum of the deviation threshold intervals. It is particularly suitable for trend prediction in security situation awareness with a short period of minutes as the sampling statistical period and the presence of irregular burst business.

[0071] In an exemplary embodiment of the present disclosure, before continuously collecting data samples of N windows in step 120, the method further includes:

[0072] Save the data sample according to the sampling time of the data sample, and determine whether there is a data sample record based on the timestamp of the data sample;

[0073] In the absence of data sample records, the missing records are marked as NA.

[0074] In an exemplary embodiment of the present disclosure, the method further includes:

[0075] In the case where dirty data pollution exists in the data sample, the Gaussian distribution of the data sample values ​​at the corresponding moments of the dirty data in all trend periods is calculated to obtain a fourth deviation threshold interval;

[0076] When the data sample value exceeds a fourth deviation threshold interval, replacing the data sample value with a normal distribution mean in the fourth deviation threshold interval; or

[0077] In the case where there is an NA record, the NA record is replaced by the normal distribution mean in the fourth deviation threshold interval.

[0078] The self-learning method of the prediction model of the embodiment of the present disclosure avoids the influence of missing values ​​and outliers on the model training results during the self-learning process by automatically processing dirty data, thereby improving the accuracy of the model.

[0079] In an exemplary embodiment of the present disclosure, Figure 2 As shown in the figure, the baseline prediction model of the number of network requests of a server is used as an example to illustrate the self-learning method of the prediction model in network security situation awareness. After the prediction model is trained based on historical data, it is deployed and run on the self-learning workflow engine. The specific process is as follows:

[0080] 1) Continuously receive sampled data samples. Assume that the sampling time is every minute. After each data sample is received, it will be determined whether there is a confirmed data sample record based on the timestamp of the data sample. Missing records are recorded as NA (Not Available);

[0081] 2) Build a prediction model and set the sliding window size. In this embodiment, it is set to 60 minutes, and the sliding mode is to slide forward 30 minutes at a time;

[0082] 3) continuously collecting data from N=96 windows;

[0083] 4) Calculate the number of samples N1 in each of the 96 windows whose true data exceeds the prediction boundary threshold given by the model in step 1, and then divide the number of samples N1 by the total number of samples N2 to obtain the deviation rate in each window. For a total of 96 deviation rate data, calculate its Gaussian distribution and obtain the threshold interval of the deviation rate in the window, mu1±3sigma1, which is recorded as the first deviation threshold interval;

[0084] 5) Calculate the deviation values ​​of all non-repeated data contained in the 96 windows, a total of 2880 data samples, calculate the difference between these data samples that exceeds the prediction boundary threshold given by the model in step 1, and then calculate the Gaussian distribution of these differences to obtain the threshold interval of sample deviation value mu2±3sigma2, recorded as the second deviation threshold interval;

[0085] 6) Select data samples in each window whose deviation values ​​exceed mu2±3sigma2, and calculate the sum of the deviation values ​​of these data samples. A total of 96 data of the sum of the deviation values ​​of data samples exceeding the deviation threshold in the windows are obtained. The Gaussian distribution of the sum is calculated to obtain the threshold interval mu3±3sigma3, which is recorded as the third deviation threshold interval. This completes the calculation of the prediction model.

[0086] 7) Use the prediction model to judge the real-time data trend. Whenever the received data samples fill the window, calculate the deviation rate a in the window and the sum of the deviation values ​​b of the data samples that exceed the second deviation threshold interval mu2±3sigma2. If a exceeds the first deviation threshold interval mu1±3sigma1 and b also exceeds the third deviation threshold interval mu3±3sigma3, return a signal to the process control engine indicating that the model needs to be retrained and restart the prediction model building. Otherwise, continue to receive data to judge the next window;

[0087] 8) Retrain the model to determine whether there are trend cycles of dirty data contamination in the received data. Calculate the Gaussian distribution of the data sample values ​​at the corresponding moments in all trend cycles and set the threshold under the Gaussian model, which is recorded as the fourth deviation threshold interval (for example, using mu4±3sigma4 as the threshold interval). If there are NA records or data samples exceeding the threshold interval mu4±3sigma4, use the normal distribution mean mu4 of the sample value instead;

[0088] 9) If the cumulative number of trend cycles reaches the number required for model training, model training is performed and the model is updated. Otherwise, data collection continues until sufficient training data is accumulated.

[0089] The prediction model self-learning method of the embodiment of the present invention can automatically determine whether the real data deviates significantly from the baseline in a large number of times, and does not perform model self-learning based on a fixed time period, thereby avoiding the waste of computing resources caused by setting the fixed model self-learning period too short, and the problem of model update lag caused by setting it too long; 2) by judging the self-learning time by both the number of deviated data and the sum of the deviation thresholds, it can avoid trend misjudgment caused by alarms generated by a small amount of abnormal data or alarms generated by a large amount of abnormal data near the boundary value, which is particularly suitable for trend prediction in security situation awareness with a short sampling statistical period of minutes and irregular burst business; 3) by automatically processing dirty data, the influence of missing values ​​and abnormal values ​​on the model training results during the self-learning process is avoided, thereby improving the accuracy of the model.

[0090] An embodiment of the present disclosure also provides a self-learning device for a prediction model, such as Figure 3 As shown, it includes a memory 6 and a processor 5, wherein the memory 6 stores a computer program, and when the processor 5 executes the computer program, it can implement the self-learning method of the prediction model as described in any embodiment of the present disclosure.

[0091] An embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the self-learning method of the prediction model as described in any embodiment of the present disclosure is implemented.

[0092] In any one or more of the above exemplary embodiments of the present disclosure, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted via a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may include a computer-readable storage medium corresponding to a tangible medium such as a data storage medium, or a communication medium that facilitates the transmission of a computer program from one place to another, such as according to a communication protocol. In this way, the computer-readable medium may generally correspond to a non-transitory tangible computer-readable storage medium or a communication medium such as a signal or carrier wave. The data storage medium may be any available medium that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures for implementing the techniques described in the present disclosure. The computer program product may include a computer-readable medium.

[0093] By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage, flash memory, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. Furthermore, any connection may also be referred to as a computer-readable medium. For example, if instructions are transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwaves, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwaves are included in the definition of medium. However, it should be understood that computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other transient (transient) media, but rather refer to non-transient tangible storage media. As used herein, disk and optical disk include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, or Blu-ray disc, among others, where disks typically reproduce data magnetically, while optical discs use lasers to reproduce data optically. Combinations of the above should also be included within the scope of computer-readable media.

[0094] Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Thus, the term "processor," as used herein, may refer to any of the aforementioned structures or any other structure suitable for implementing the techniques described herein. Additionally, in some aspects, the functionality described herein may be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into a combined codec. Furthermore, the techniques may be fully implemented in one or more circuits or logic elements.

[0095] The technical solutions of the embodiments of the present disclosure can be implemented in a wide range of at least two devices or equipment, including wireless mobile phones, integrated circuits (ICs), or a set of ICs (e.g., chipsets). Various components, modules, or units are described in the embodiments of the present disclosure to emphasize the functional aspects of the devices configured to perform the described techniques, but they do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units can be combined in a codec hardware unit or provided by a collection of interoperable hardware units (including one or more processors as described above) in combination with appropriate software and / or firmware.

Claims

1. A self-learning method for a prediction model, comprising: Obtaining a prediction boundary threshold of a prediction model, wherein the prediction model is a prediction model for network security situation awareness; Continuously collect data samples from N windows, N ≥ 2; The data samples are collected from network requests; Calculating a deviation threshold interval based on the prediction boundary threshold and the collected data samples, including: calculating a first deviation threshold interval based on the prediction boundary threshold and the collected data samples; and / or calculating a third deviation threshold interval based on the prediction boundary threshold and the collected data samples; wherein the deviation threshold interval is used to represent a threshold value at which the data sample deviates from the prediction boundary threshold, the first deviation threshold interval is used to represent the number of data samples that deviate, and the third deviation threshold interval is used to represent the total amount of deviation of the data samples that deviate; It is determined whether the deviation value of the real-time data in each window exceeds the deviation threshold interval. If the deviation value of the real-time data is greater than the deviation threshold interval, the prediction model is retrained and updated.

2. The self-learning method of the prediction model according to claim 1, characterized in that: The continuously collecting data samples of N windows, where N≥2, includes: Set the sliding window size and sliding distance; The sliding window is slid forward according to a preset sliding distance to continuously collect data samples of N windows.

3. The self-learning method of the prediction model according to claim 1, characterized in that: The calculating a first deviation threshold interval according to the prediction boundary threshold and the collected data sample includes: Calculate the number N1 of samples in each of the N windows whose data samples exceed the prediction boundary threshold; Divide N1 by the total number of samples in each window N2 to obtain the deviation rate within each window; The Gaussian distribution of the deviation rates within the N windows is calculated to obtain a first deviation threshold interval.

4. The self-learning method of the prediction model according to claim 1, characterized in that: The calculating a third deviation threshold interval according to the prediction boundary threshold and the collected data sample includes: Calculating the Gaussian distribution of the deviation values ​​of all non-repeated data samples in the N windows to obtain a second deviation threshold interval; wherein the deviation value of the data sample is the difference between the true value of the data sample and the prediction boundary threshold; Find data samples in each window whose deviation values ​​exceed the second deviation threshold interval, and calculate the sum of the deviation values ​​of the found data samples; calculate the Gaussian distribution of the sum of the deviation values ​​of the N windows to obtain the third deviation threshold interval.

5. The self-learning method of the prediction model according to claim 3 or 4, characterized in that: The determining whether the deviation value of the real-time data in each window exceeds the deviation threshold interval, and retraining and updating the prediction model if the deviation value of the real-time data is greater than the deviation threshold interval, includes: Calculating the deviation rate of the real-time data in each window, and retraining and updating the prediction model when the deviation rate of the real-time data is greater than the first deviation threshold interval; or Calculating the sum of the deviation values ​​of the real-time data in each window, and retraining and updating the prediction model when the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval; or Calculate the deviation rate of the real-time data in each window and the sum of the deviation values ​​of the real-time data in each window. When the deviation rate of the real-time data is greater than the first deviation threshold interval and the sum of the deviation values ​​of the real-time data is greater than the third deviation threshold interval, retrain the prediction model and update the prediction model.

6. The self-learning method of the prediction model according to claim 1, characterized in that: Before continuously collecting data samples from N windows, the method further includes: Save the data sample according to the sampling time of the data sample, and determine whether there is a data sample record based on the timestamp of the data sample; In the absence of data sample records, the missing records are marked as NA.

7. The self-learning method of the prediction model according to claim 6, characterized in that: The method further includes: In the case where dirty data pollution exists in the data sample, the Gaussian distribution of the data sample values ​​at the corresponding moments of the dirty data in all trend periods is calculated to obtain a fourth deviation threshold interval; When the data sample value exceeds a fourth deviation threshold interval, replacing the data sample value with a normal distribution mean in the fourth deviation threshold interval; or In the case where there is an NA record, the NA record is replaced by the normal distribution mean in the fourth deviation threshold interval.

8. A self-learning device for a prediction model, comprising a processor and a memory storing a computer program, wherein: When the processor executes the computer program, it is capable of implementing the self-learning method of the prediction model according to any one of claims 1 to 7.

9. A non-transitory computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, it is capable of implementing the self-learning method of the prediction model according to any one of claims 1 to 7.

Images