Alarm method and device, electronic equipment and nonvolatile storage medium

Abstract

The application discloses an alarm method and device, electronic equipment and nonvolatile storage medium. The method comprises the following steps: obtaining a plurality of time sequence data determined by performance data in a network device; inputting the data obtained by preprocessing the plurality of time sequence data into a time convolution network and a long short-term memory network respectively for feature extraction, obtaining first feature data corresponding to the time convolution network and second feature data corresponding to the long short-term memory network; inputting target feature data obtained by fusing the first feature data and the second feature data into a full connection network to obtain a prediction value of the target feature data; and generating alarm information in the case that the prediction value meets a preset condition. The application solves the technical problem that in the related art, when a multivariate time sequence is predicted, the multi-feature information under a multi-feature extractor is not fused and screened, resulting in low prediction accuracy.

Description

Technical Field

[0001] This application relates to the field of multivariate time series prediction, and more specifically, to an alarm method, apparatus, electronic device, and non-volatile storage medium. Background Technology

[0002] Multivariate time series (MTS) prediction is a data mining task belonging to the time series prediction category. It involves extracting features from a target time series data and fusing auxiliary information from several associated time series to predict target values. MTS is widely used for forecasting and early warning in fields such as power, climate, finance, and networks, providing guidance for related planning, control, and optimization. However, CNN and LSTM-based methods often focus only on the temporal information features of multivariate time series data while neglecting its spatial information features, i.e., ignoring the relationships between different variables at the same time. Furthermore, when fusing features extracted by multiple feature extractors, effective filtering of information from different perspectives is often overlooked. Therefore, predictions based on multivariate time series data suffer from low accuracy.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides an alarm method, device, electronic device, and non-volatile storage medium to at least solve the technical problem in related technologies where prediction based on multivariate time series does not involve the fusion and filtering of multi-feature information from a multi-feature extractor, resulting in low prediction accuracy.

[0005] According to one aspect of the embodiments of this application, an alarm method is provided, comprising: acquiring multiple time-series data determined by performance data in a network device; inputting the preprocessed data of the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network; inputting the target feature data after fusing the first feature data and the second feature data into a fully connected network to obtain a predicted value of the target feature data; and generating alarm information when the predicted value meets preset conditions.

[0006] Optionally, preprocessing of multiple time-series data includes: dividing the multiple time-series data into a first time-series sequence and a second time-series sequence according to the acquisition order of the multiple time-series data, wherein the acquisition order of the second time-series sequence is after the first time-series sequence, and the first time-series sequence includes multiple first subseries obtained by sliding the multiple time-series data in the time dimension according to a first time window, and each first subseries includes multiple performance data.

[0007] Optionally, preprocessing of multiple time-series data includes: determining a set of time-series sequences, wherein the set of time-series sequences includes a first time-series sequence and a second time-series sequence; obtaining the maximum value, minimum value, and standard deviation of a target time-series sequence in the set of time-series sequences, wherein the target time-series sequence is any time-series sequence in the set of time-series sequences; determining the difference between the maximum value and the minimum value as a first difference; if the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, normalizing the data in the target time-series sequence using a first method; if the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, normalizing the data in the target time-series sequence using a second method.

[0008] Optionally, before inputting the preprocessed data from multiple time-series data into the temporal convolutional network and the long short-term memory network for feature extraction, the method further includes: determining the data in the time-series set as input data, wherein the input data is determined by the data in the first time-series and the second time-series; determining a first weight value for the first data based on the first data at the target time in the first time-series of the input data, wherein the target time is the time corresponding to any data in the first time-series, and the first weight value represents the weight of the first time-series in spatial information; determining the first target data after weighting the first data based on the first data and the first weight value; determining a second weight value for the second data based on the second data at the target time in the second time-series, wherein the second weight value represents the weight of the second time-series in spatial information; and determining the second target data after weighting the second data based on the second data and the second weight value.

[0009] Optionally, the preprocessed data from multiple time-series data are input into a temporal convolutional network and a long short-term memory network for feature extraction, including: inputting the first target data and the second target data into the long short-term memory network; determining the output of the hidden layer of the long short-term memory network at the target time as the third data, and determining the third weight value of the third data; determining the third target data after weighting the third data based on the third data and the third weight value, and determining the third target data as the second feature data corresponding to the long short-term memory network.

[0010] Optionally, the preprocessed data from multiple time-series data are input into a temporal convolutional network and a long short-term memory network for feature extraction, including: inputting the first target data and the second target data into the temporal convolutional network; obtaining the fourth data output of the temporal convolutional network at the target time, and determining the fourth weight value of the fourth data; determining the fourth target data after weighting the fourth data based on the fourth data and the fourth weight value, and determining the fourth target data as the first feature data corresponding to the temporal convolutional network.

[0011] Optionally, the target feature data obtained by fusing the first feature data and the second feature data is input into a fully connected network to obtain the predicted value of the target feature data, including: fusing the first feature data and the second feature data using a gated residual network to obtain the target feature data; and inputting the target feature data into a fully connected network to obtain the predicted value of the target feature data, wherein the loss function of the fully connected network is determined by the predicted value and the true value of the target feature data.

[0012] According to another aspect of the embodiments of this application, an alarm device is also provided, comprising: an acquisition module, configured to acquire multiple time-series data determined by performance data in a network device; a first input module, configured to input preprocessed data of the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction, to obtain first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network; a second input module, configured to input target feature data fused from the first feature data and the second feature data into a fully connected network to obtain a predicted value of the target feature data; and a generation module, configured to generate alarm information when the predicted value meets preset conditions.

[0013] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a memory for storing program instructions; and a processor connected to the memory for executing program instructions to perform the following functions: acquiring multiple time-series data determined by performance data in a network device; inputting the preprocessed data of the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction to obtain first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network; inputting the target feature data after fusing the first feature data and the second feature data into a fully connected network to obtain a predicted value of the target feature data; and generating alarm information when the predicted value meets preset conditions.

[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-described alarm method by running the computer program.

[0015] In this embodiment, multiple time-series data determined by performance data from network devices are acquired; the preprocessed data is then input into a temporal convolutional network and a long short-term memory network for feature extraction, resulting in first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network; the target feature data, obtained by fusing the first and second feature data, is input into a fully connected network to obtain a predicted value of the target feature data; and an alarm message is generated when the predicted value meets preset conditions. This achieves the goal of fusing feature data from the temporal convolutional network and the long short-term memory network, thereby improving the prediction accuracy. This solves the technical problem in related technologies where predictions based on multivariate time series lack fusion and filtering of multi-feature information from multiple feature extractors, leading to low prediction accuracy. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a hardware structure block diagram of a computer terminal (or electronic device) for implementing an alarm method according to an embodiment of this application;

[0018] Figure 2 This is a flowchart of an alarm method according to an embodiment of this application;

[0019] Figure 3 This is a structural diagram of an alarm device according to an embodiment of this application. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] Time series datasets can be categorized based on the number of features: univariate time series and multivariate time series. In univariate time series, only one variable (feature) is observed at a time; for example, in rainfall prediction, only humidity is used for prediction. In multivariate time series, two or more variables (features) are observed at a time; for example, rainfall is predicted using features such as temperature, humidity, light intensity, wind speed, wind direction, and air pressure.

[0023] LSTM-FCN and ALSTM-FCN have achieved success in univariate time series classification problems, but they have not yet been applied to multivariate time series classification. Multivariate time series (MTS) is a data mining task for predicting time series data. By extracting features from the target time series data and fusing auxiliary information from several additional time series associated with the target time series, it predicts the target value. MTS is widely used for forecasting and early warning in fields such as power, climate, finance, and networks, providing guidance for the planning, control, and optimization of related data.

[0024] For example, IPTV uses correlated data over a period of time to monitor the health of key IPTV node devices, and promptly replaces critical substandard devices to avoid impacting user experience. The main challenges of multivariate time series forecasting lie in the nonlinearity and aperiodicity of time series data, as well as the complex internal relationships between variables.

[0025] Based on the current development of multivariate time series forecasting, methods can be categorized into classical approaches, machine learning-based approaches, and deep learning-based approaches. Classical multivariate time series forecasting methods typically rely on autoregressive models and their derivatives, further optimizing results through flexible exponential smoothing techniques. However, they inevitably suffer from overfitting and high computational costs when dealing with long-term series and multiple variables. Machine learning-based methods often employ alternative approaches such as linear support vector regression, random forests, ridge regression, and LASSO models, treating the time series forecasting problem as a general regression with time-varying parameters. However, machine learning-based models may not be able to capture the complex nonlinear dependencies between multiple variables.

[0026] Deep learning uses neural networks as its basic structure, combining them to build deep networks that efficiently extract the intrinsic features and extrinsic relationships of data. Typical examples include using CNNs to extract local information and time-invariant features from multivariate time-series data, and using LSTMs to filter and forget information over long periods. Methods like MALSTM-FCN, which connect CNNs and LSTMs in parallel, employ multiple feature extractors to extract features from multivariate time-series data, fusing multi-perspective information to predict target values.

[0027] However, CNN and LSTM-based methods often focus only on the temporal information features of multivariate time-series data while neglecting its spatial information features, i.e., ignoring the relationships between different variables at the same time point. Furthermore, when fusing the extracted features using multiple feature extractors, they often neglect the effective filtering of information from different perspectives.

[0028] To address the issues of weak spatial information feature extraction and lack of fusion and filtering of multi-feature information under multi-feature extractors in multivariate time series prediction, and to achieve accurate prediction of target values ​​in the field of multivariate time series prediction, this application provides corresponding solutions, which are described in detail below.

[0029] The alarm method embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware block diagram of a computer terminal (or electronic device) for implementing an alarm method is shown. Figure 1As shown, the computer terminal 10 (or electronic device 10) may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0030] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be wholly or partially embodied in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuit may be a single, independent processing module, or may be wholly or partially integrated into any other element within the computer terminal 10 (or electronic device). As involved in the embodiments of this application, the data processing circuit serves as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the alarm method in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the alarm method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0032] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0033] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or electronic device).

[0034] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer device (or electronic device) shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1 This is only one instance of a particular specific instance, and is intended to illustrate the types of components that may exist in the aforementioned computer equipment (or electronic equipment).

[0035] In the above operating environment, this application provides an embodiment of an alarm method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] Figure 2 This is a flowchart of an alarm method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0037] Step S202: Obtain multiple time-series data determined by performance data from the network device;

[0038] Step S204: The preprocessed data of multiple time series data are input into the temporal convolutional network and the long short-term memory network respectively for feature extraction, to obtain the first feature data corresponding to the temporal convolutional network and the second feature data corresponding to the long short-term memory network.

[0039] Step S206: Input the target feature data after fusing the first feature data and the second feature data into the fully connected network to obtain the predicted value of the target feature data;

[0040] Step S208: If the predicted value meets the preset conditions, generate alarm information.

[0041] In steps S202 to S208 above, multiple time-series data consisting of performance data from network devices are acquired, the data is integrated according to time, and then preprocessing operations such as normalization are performed; then, a spatial and temporal attention LSTM-TCN network (i.e., the aforementioned long short-term memory network and temporal convolutional network) is constructed, and an improved gated convolutional network is used to fuse and filter information between multiple features. Appropriate hyperparameters, such as learning rate and batch size, are used to train and test the constructed network, and the trained network is used to predict the target feature data. Based on the prediction results, it is determined whether to generate alarm information.

[0042] In one optional embodiment, in a live streaming scenario, the performance data of the network device may be, for example, the number of online users in IPTV, current port traffic data, etc.; in a rainfall scenario, the performance data of the network device may be, for example, temperature data, wind direction data, air pressure data, etc.

[0043] In step S204 of the alarm method described above, multiple time-series data are preprocessed, specifically including the following steps: based on the acquisition order of the multiple time-series data, the multiple time-series data are divided into a first time-series sequence and a second time-series sequence, wherein the acquisition order of the second time-series sequence is after the first time-series sequence, and the first time-series sequence includes multiple first subseries obtained by sliding the multiple time-series data in the time dimension according to the first time window, and each first subseries includes multiple performance data.

[0044] In this embodiment, for N time-series data, the first N-1 data are selected as an additional time-series sequence (i.e., the first time-series sequence mentioned above), and the Nth data is selected as the target time-series sequence (i.e., the second time-series sequence mentioned above). The N data are slid along the time dimension according to a time window T (i.e., the first time window mentioned above), resulting in an additional time-series sequence where N-1 ≥ 1. The first subsequence above is represented by X = (x 1 ,x 2 ,..,x N-1 ) T Representing all additional time series sequences with N-1 time windows of T, denoted by Y = (y1, y2, ..., y...). T () represents the target time series with a time window of T, i.e., the Nth data point. The (T+1)th value of the target time series within the (T+1)th time window is used as the predicted target value y. T+1 And construct training and testing sets.

[0045] In step S204 of the above alarm method, multiple time-series data are preprocessed, specifically including the following process: determining a set of time-series sequences, wherein the set of time-series sequences includes a first time-series sequence and a second time-series sequence; obtaining the maximum value, minimum value, and standard deviation of a target time-series sequence in the set of time-series sequences, wherein the target time-series sequence is any time-series sequence in the set of time-series sequences; determining the difference between the maximum value and the minimum value as the first difference; if the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, normalizing the data in the target time-series sequence using a first method; if the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, normalizing the data in the target time-series sequence using a second method.

[0046] In this embodiment, the data in the additional time series sequence and the target time series sequence are filled with a preset value FV; for each time series sequence i of the N time series data (i.e., the target time series sequence in the above time series sequence set), its maximum value max is obtained. i minimum value min i and standard deviation std i If max i -min i and std i If the absolute value of the difference (i.e. the first difference mentioned above) exceeds the preset difference threshold diff_threshold, then data normalization method a (i.e. the first method mentioned above) is used for the i-th time series; otherwise, data normalization method b (i.e. the second method mentioned above) is used.

[0047] Data normalization method a: for each j-th value of time series i Normalization is performed using a formula. Normalize the values ​​to between 0 and 1.

[0048] Data normalization method b: for each j-th value of time series i Normalization is performed using a formula. Normalize the values ​​to between 0 and 1.

[0049] In step S204 of the above alarm method, before inputting the preprocessed data of multiple time-series data into the temporal convolutional network and the long short-term memory network for feature extraction, the method further includes the following steps: determining the data in the time-series set as input data, wherein the input data is determined by the data in the first time-series and the second time-series; determining the first weight value of the first data based on the first data of the target time in the first time-series in the input data, wherein the target time is the time corresponding to any data in the first time-series, and the first weight value represents the weight of the first time-series in spatial information; determining the first target data after weighting the first data based on the first data and the first weight value; determining the second weight value of the second data based on the second data of the target time in the second time-series, wherein the second weight value represents the weight of the second time-series in spatial information; and determining the second target data after weighting the second data based on the second data and the second weight value.

[0050] In step S204 of the above alarm method, the preprocessed data of multiple time series data are input into a temporal convolutional network and a long short-term memory network for feature extraction. Specifically, the steps include: inputting the first target data and the second target data into the long short-term memory network; determining the output of the hidden layer of the long short-term memory network at the target time as the third data, and determining the third weight value of the third data; determining the third target data after weighting the third data based on the third data and the third weight value, and determining the third target data as the second feature data corresponding to the long short-term memory network.

[0051] In step S204 of the above alarm method, the preprocessed data of multiple time series data are respectively input into a temporal convolutional network and a long short-term memory network for feature extraction. Specifically, the steps include: inputting the first target data and the second target data into the temporal convolutional network; obtaining the fourth data of the output of the temporal convolutional network at the target time and determining the fourth weight value of the fourth data; determining the fourth target data after weighting the fourth data based on the fourth data and the fourth weight value, and determining the fourth target data as the first feature data corresponding to the temporal convolutional network.

[0052] In this embodiment, a network is constructed comprising two parallel branches: LSTM (i.e., the aforementioned Long Short-Term Memory network) and TCN (i.e., the aforementioned Temporal Convolutional Network). Each input is [X,Y], meaning the input data consists of an additional temporal sequence (X) and a target temporal sequence (Y). For ease of explanation, the input data [X,Y] is denoted as X. int The features extracted from the two branch networks are input into the gated residual network. The effective information of the features is fused and filtered. Then the fused features are output to the fully connected network to output the predicted target value.

[0053] In the LSTM branch, input X int The output is the second feature data F. lstm The LSTM uses a single-layer LSTM network and employs a spatial attention mechanism for weighting. The spatial attention mechanism weights the input additional time sequence X, focusing on the data x at time t (the target time mentioned above). t (i.e., the first data mentioned above) is weighted using the following formula:

[0054] c t =W c x t +b c

[0055]

[0056] Among them, c t Indicates the calculation of the first weight value The first intermediate value, W c b represents the first constant used to calculate the first intermediate value. c This represents the second constant used to calculate the first intermediate value. Both the first and second constants are configurable. Any additional time series at any given time has its corresponding weight value; therefore, the weighted result (the first target data) is:

[0057]

[0058] Similarly, for the target time series, the second weight value is obtained using the above weighting formula. Then, based on the second data and the second weight value at the target time in the target time series, the second target data after weighting the second data is obtained.

[0059] The spatial attention mechanism described above is used to weight the additional time series to enhance the spatial information interaction between them, as well as between the target time series. The weighted additional time series and the target time series (i.e., the first and second target data mentioned above) are input into an LSTM. The hidden layer output of the LSTM at each time step (i.e., the target time step mentioned above) is weighted using a temporal attention mechanism. t (i.e., the third data mentioned above) is the hidden layer output of the LSTM at time t, and is weighted using the following formula:

[0060] d t =W d h t +b d

[0061]

[0062]

[0063] Where, d t This indicates the calculation of the third weight value β. t The second intermediate value, W d b represents the third constant used to calculate the second intermediate value. d This represents the fourth constant used to calculate the second intermediate value. The third and fourth constants mentioned above are configurable. β t This represents the third weight value mentioned above. This represents the data for the third objective mentioned above.

[0064] By using a weighted approach based on time attention, we can enhance the interaction of temporal information between time series.

[0065] In the TCN branch, enter X. int The output is the first feature data F. tcn .

[0066] Two TCN blocks are used to construct dilated causal convolutions. Before inputting into the TCN blocks, a spatial attention mechanism is used for weighting to obtain the first and second target data mentioned above. The spatial attention weighting mechanism has been described above and will not be repeated here. The weighted additional temporal sequence (i.e., the first target data) and the target temporal sequence (i.e., the second target data) are input into the TCN together. The TCN block contains dilated causal convolutions, residual connections, and ReLU activation functions to obtain temporal information features. Dilated convolutions allow the TCN to obtain a larger field of view, effectively preventing the network from becoming too deep, while causal convolutions allow the TCN to obtain temporal feature information. Residual connections are used to avoid gradient vanishing.

[0067] The TCN output is weighted using a time attention mechanism, g t The feature vector (i.e., the fourth data point) at time t (i.e., the target time mentioned above) output by the TCN is weighted using the following formula:

[0068] e t =W e g t +b e

[0069]

[0070]

[0071] Among them, e t This indicates the calculation of the fourth weight value γ. t The third intermediate value, W e b represents the fifth constant used to calculate the third intermediate value. eThis represents the sixth constant used to calculate the third intermediate value. The fifth and sixth constants mentioned above are configurable. γ t This represents the fourth weight value mentioned above. This represents the data for the fourth objective mentioned above.

[0072] By using a weighted approach based on time attention, the interaction of temporal information between time sequences can be deepened.

[0073] In step S206 of the above alarm method, the target feature data after fusing the first feature data and the second feature data is input into a fully connected network to obtain the predicted value of the target feature data. Specifically, this includes the following steps: using a gated residual network to fuse the first feature data and the second feature data to obtain the target feature data; inputting the target feature data into a fully connected network to obtain the predicted value of the target feature data, wherein the loss function of the fully connected network is determined by the predicted value and the true value of the target feature data.

[0074] In this embodiment of the application, a gated residual network is used to combine the features F obtained from the LSTM branch and the TCN branch. lstm and F tcn The effective information is filtered and integrated to determine the target feature data. Specifically, the target feature data is determined by the following formula:

[0075] F grn =layerNorm(W1F lstm +W2F tcn +GLU(W3ELU(W4F lstm +W5F tcn +b3)+b2)+b1)

[0076] Where W1 to W5 represent settable constants, and b1 to b3 also represent settable constants. ELU stands for Gated Linear Unit, specifically: GLU(a) = σ(W a,1 a+b a,1 )⊙(W a,2 a+b a,2 ), where σ is the sigmoid activation function, ⊙ is the matrix dot product, and W a,1 W a,2 b a,1 b a,2 All of these are settable constants.

[0077] When using fully connected networks for data prediction, it is necessary to select relevant hyperparameters, such as the number of iterations and the learning rate, train the model using a training set, use the mean squared error as the loss function, train the network using backpropagation and gradient descent (Adam) methods, and store the trained network. The mean squared error loss function is:

[0078]

[0079] in, For the predicted value, y T+1 This is the actual value.

[0080] Existing LSTM-FCN-based networks only focus on the temporal dimension features of multivariate time series data, neglecting spatial features. The alarm method provided in this application extracts spatial features from time series data using an attention mechanism, focusing on the interaction and importance of different data points at the same time. Furthermore, the fusion of features extracted by multiple feature extractors typically prioritizes fusion, ignoring the biases of different extractors, which may lead to reduced accuracy due to the inclusion of unnecessary information. By using an improved gated residual network, features are fused while simultaneously filtering and discarding information, maximizing the retention of effective features' impact on the final result.

[0081] The alarm method provided in this application uses time-series-based anomaly detection technology, which can be applied to IPTV prediction and early warning scenarios. This case can be used for the prediction and early warning of multivariate time-series data in related IPTV applications. Furthermore, a model is built based on historical time-series data from various devices. Based on data within a set time period, the future predicted values ​​of key devices are predicted, providing support for subsequent production actions. The detection and early warning of key devices allows for timely notification of abnormal situations and advance preparation.

[0082] Figure 3 This is a structural diagram of an alarm device according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0083] The acquisition module 302 is used to acquire multiple time-series data determined by performance data in the network device;

[0084] The first input module 304 is used to input the preprocessed data of multiple time series data into the temporal convolutional network and the long short-term memory network respectively for feature extraction, so as to obtain the first feature data corresponding to the temporal convolutional network and the second feature data corresponding to the long short-term memory network.

[0085] The second input module 306 is used to input the target feature data after fusing the first feature data and the second feature data into the fully connected network to obtain the predicted value of the target feature data.

[0086] The generation module 308 is used to generate alarm information when the predicted value meets preset conditions.

[0087] In the first input module of the alarm device, multiple time-series data are preprocessed, specifically including the following process: according to the acquisition order of multiple time-series data, the multiple time-series data are divided into a first time-series sequence and a second time-series sequence, wherein the acquisition order of the second time-series sequence is after the first time-series sequence, and the first time-series sequence includes multiple first sub-series obtained by sliding multiple time-series data in the time dimension according to a first time window, and each first sub-series includes multiple performance data.

[0088] In the first input module of the aforementioned alarm device, multiple time-series data are preprocessed, specifically including the following steps: determining a set of time-series sequences, wherein the set of time-series sequences includes a first time-series sequence and a second time-series sequence; obtaining the maximum value, minimum value, and standard deviation of a target time-series sequence in the set of time-series sequences, wherein the target time-series sequence is any time-series sequence in the set of time-series sequences; determining the difference between the maximum value and the minimum value as a first difference; if the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, normalizing the data in the target time-series sequence using a first method; if the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, normalizing the data in the target time-series sequence using a second method.

[0089] In the first input module of the aforementioned alarm device, before the preprocessed data from multiple time-series data are input into the temporal convolutional network and the long short-term memory network for feature extraction, the first input module is further used to determine the data in the time-series set as input data, wherein the input data is determined by the data in the first time-series and the second time-series; based on the first data at the target time in the first time-series in the input data, a first weight value of the first data is determined, wherein the target time is the time corresponding to any data in the first time-series, and the first weight value represents the weight of the first time-series in spatial information; based on the first data and the first weight value, the first target data after weighting the first data is determined; based on the second data at the target time in the second time-series, a second weight value of the second data is determined, wherein the second weight value represents the weight of the second time-series in spatial information; based on the second data and the second weight value, the second target data after weighting the second data is determined.

[0090] In the first input module of the aforementioned alarm device, the preprocessed data from multiple time-series data are input into a temporal convolutional network and a long short-term memory network for feature extraction. Specifically, the process includes the following steps: inputting the first target data and the second target data into the long short-term memory network; determining the output of the hidden layer of the long short-term memory network at the target time as the third data, and determining the third weight value of the third data; based on the third data and the third weight value, determining the third target data after weighting the third data, and determining the third target data as the second feature data corresponding to the long short-term memory network.

[0091] In the first input module of the aforementioned alarm device, the preprocessed data of multiple time-series data are respectively input into a temporal convolutional network and a long short-term memory network for feature extraction. Specifically, the process includes the following steps: inputting the first target data and the second target data into the temporal convolutional network; obtaining the fourth data output of the temporal convolutional network at the target time and determining the fourth weight value of the fourth data; determining the fourth target data after weighting the fourth data based on the fourth data and the fourth weight value, and determining the fourth target data as the first feature data corresponding to the temporal convolutional network.

[0092] In the second input module of the alarm device, the target feature data after fusing the first feature data and the second feature data is input into a fully connected network to obtain the predicted value of the target feature data. Specifically, the process includes the following steps: using a gated residual network to fuse the first feature data and the second feature data to obtain the target feature data; inputting the target feature data into a fully connected network to obtain the predicted value of the target feature data, wherein the loss function of the fully connected network is determined by the predicted value and the true value of the target feature data.

[0093] The alarm device provided in this application uses time-series-based anomaly detection technology, which can be applied to IPTV prediction and early warning scenarios. This case can be used for the prediction and early warning of multivariate time-series data in related IPTV applications. Furthermore, a model is built based on historical time-series data from various devices. Based on data within a set time period, the future predicted values ​​of key devices are predicted, providing support for subsequent production actions. The detection and early warning of predicted key devices allows for timely notification of abnormal situations and advance preparation.

[0094] It should be noted that, Figure 3 The alarm device shown is used to perform Figure 2 The alarm method shown above is also applicable to this alarm device, and will not be repeated here.

[0095] This application embodiment also provides a non-volatile storage medium, which includes a stored computer program. The device containing the non-volatile storage medium executes the following alarm method by running the computer program: acquiring multiple time-series data determined by performance data from a network device; inputting preprocessed data from the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction, obtaining first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network; inputting the target feature data obtained by fusing the first and second feature data into a fully connected network to obtain a predicted value of the target feature data; and generating alarm information when the predicted value meets preset conditions.

[0096] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0097] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0099] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0100] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0101] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0102] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An alarm method, characterized in that, include: Acquire multiple time-series data determined by performance data from network devices, wherein, in a live streaming scenario, the performance data includes at least one of the following: the number of online users in IPTV, port traffic data; The preprocessed data from the multiple time-series data are input into a temporal convolutional network and a long short-term memory network for feature extraction, respectively, to obtain first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network. A time-series sequence set is determined, comprising a first time-series sequence and a second time-series sequence. The maximum value, minimum value, and standard deviation of a target time-series sequence in the time-series sequence set are obtained, wherein the target time-series sequence is any one of the time-series sequences in the set. The difference between the maximum value and the minimum value is determined as a first difference. If the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, a first method is used to normalize the data in the target time-series sequence. If the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, a second method is used to normalize the data in the target time-series sequence. The normalization formulas used in the first and second methods are different. The target feature data, obtained by fusing the first feature data and the second feature data, is input into a fully connected network to obtain the predicted value of the target feature data. An alarm message is generated if the predicted value meets the preset conditions.

2. The method according to claim 1, characterized in that, Preprocessing of the multiple time-series data includes: Based on the acquisition order of the multiple time-series data, the multiple time-series data are divided into a first time-series sequence and a second time-series sequence, wherein the acquisition order of the second time-series sequence is after that of the first time-series sequence. The first time-series sequence includes multiple first sub-series obtained by sliding the multiple time-series data along the time dimension according to a first time window, and each first sub-series includes multiple performance data.

3. The method according to claim 1, characterized in that, Before inputting the preprocessed data from the multiple time-series data into the temporal convolutional network and the long short-term memory network for feature extraction, the method further includes: The data in the time series sequence set is determined as the input data, wherein the input data is determined by the data in the first time series sequence and the second time series sequence; Based on the first data of the first time series in the input data at the target time, a first weight value of the first data is determined, wherein the target time is the time corresponding to any data in the first time series, and the first weight value represents the weight of the first time series in spatial information; Based on the first data and the first weight value, determine the first target data after weighting the first data; Based on the second data of the target time in the second time series, a second weight value of the second data is determined, wherein the second weight value represents the weight of the second time series on the spatial information; Based on the second data and the second weight value, the second target data after weighting the second data is determined.

4. The method according to claim 3, characterized in that, The preprocessed data from the multiple time-series datasets are then input into a temporal convolutional network and a long short-term memory network for feature extraction, including: The first target data and the second target data are input into the long short-term memory network; The output of the hidden layer of the Long Short-Term Memory Network at the target time is determined as the third data, and the third weight value of the third data is determined. Based on the third data and the third weight value, the third target data after weighting the third data is determined, and the third target data is determined as the second feature data corresponding to the long short-term memory network.

5. The method according to claim 4, characterized in that, The preprocessed data from the multiple time-series datasets are then input into a temporal convolutional network and a long short-term memory network for feature extraction, including: The first target data and the second target data are input into the temporal convolutional network; Obtain the fourth data of the output of the temporal convolutional network at the target time, and determine the fourth weight value of the fourth data; Based on the fourth data and the fourth weight value, the fourth target data after weighting the fourth data is determined, and the fourth target data is determined as the first feature data corresponding to the temporal convolutional network.

6. The method according to claim 5, characterized in that, The target feature data, obtained by fusing the first feature data and the second feature data, is input into a fully connected network to obtain the predicted value of the target feature data, including: The first feature data and the second feature data are fused using a gated residual network to obtain the target feature data; The target feature data is input into the fully connected network to obtain the predicted value of the target feature data, wherein the loss function of the fully connected network is determined by the predicted value and the true value of the target feature data.

7. An alarm device, characterized in that, include: The acquisition module is used to acquire multiple time-series data determined by performance data in the network device, wherein, in the network live streaming scenario, the performance data includes at least one of the following: the number of online users in the network TV and port traffic data; A first input module is used to input the preprocessed data of the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction, to obtain first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network. The module includes: determining a set of time-series sequences, wherein the set of time-series sequences includes a first time-series sequence and a second time-series sequence; obtaining the maximum value, minimum value, and standard deviation of a target time-series sequence in the set of time-series sequences, wherein the target time-series sequence is any one of the time-series sequences in the set of time-series sequences; determining the difference between the maximum value and the minimum value as a first difference; if the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, normalizing the data in the target time-series sequence using a first method; if the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, normalizing the data in the target time-series sequence using a second method. The normalization formulas used in the first method and the second method are different. The second input module is used to input the target feature data after fusing the first feature data and the second feature data into the fully connected network to obtain the predicted value of the target feature data. The generation module is used to generate alarm information when the predicted value meets preset conditions.

8. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor, connected to the memory, is configured to execute program instructions to perform the following functions: acquire multiple time-series data determined by performance data from a network device, wherein, in a live streaming scenario, the performance data includes at least one of the following: the number of online users in a network TV, port traffic data; input preprocessed data from the multiple time-series data into a temporal convolutional network and a long short-term memory network respectively for feature extraction, obtaining first feature data corresponding to the temporal convolutional network and second feature data corresponding to the long short-term memory network, wherein, a time-series sequence set is determined, wherein the time-series sequence set includes a first time-series sequence and a second time-series sequence; acquire the maximum value, minimum value, and standard deviation of a target time-series sequence in the time-series sequence set, wherein the target time-series sequence is the... Any time series in the time series set; the difference between the maximum value and the minimum value is determined as the first difference; if the absolute value of the difference between the first difference and the standard deviation is greater than a preset difference threshold, the data in the target time series is normalized using a first method; if the absolute value of the difference between the first difference and the standard deviation is less than or equal to the preset difference threshold, the data in the target time series is normalized using a second method, wherein the normalization formulas used in the first method and the second method are different; the target feature data after fusing the first feature data and the second feature data is input into a fully connected network to obtain the predicted value of the target feature data; if the predicted value meets a preset condition, an alarm message is generated.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored computer program, wherein the device containing the non-volatile storage medium executes the alarm method according to any one of claims 1 to 6 by running the computer program.

Images