Device abnormality detection method, device and electronic equipment

Abstract

The present application discloses a method, device and electronic device for detecting equipment anomalies. The method includes: obtaining service data obtained by classifying data in an optical line terminal device; determining target service data from the service data based on the indicator data corresponding to the service data; using a target detection model to perform anomaly detection on the optical line terminal device based on the target service data to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating the abnormal data in the target service data; and determining that an abnormality exists in the optical line terminal device when the anomaly score is greater than a preset score. The present application solves the technical problems of long processing time and low efficiency in traditional equipment operation and maintenance anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of intelligent operation and maintenance, and specifically, to a method, device and electronic equipment for detecting equipment anomalies. Background Art

[0002] As digital development gradually deepens, the equipment used by various units has gradually increased, 10 to 100 times compared to ten years ago. Even though operation and maintenance has evolved from manual operation and maintenance to tool operation and maintenance and platform operation and maintenance, it still cannot meet the current large-scale networking requirements for operation and maintenance. There is a big difference between the traditional operation and maintenance model and the intelligent operation and maintenance model. In terms of intelligence, traditional operation and maintenance includes four steps: detection, analysis, discovery (alarm), and disposal, none of which involve intelligent technology, resulting in technical problems such as long processing time and low efficiency of equipment operation and maintenance anomaly detection.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus and electronic device for detecting equipment anomalies, so as to at least solve the technical problems of long processing time and low efficiency in traditional equipment operation and maintenance anomaly detection.

[0005] According to one aspect of an embodiment of the present application, a method for detecting an abnormality of a device is provided, comprising: obtaining business data obtained by classifying data in an optical line terminal device; determining target business data from the business data based on indicator data corresponding to the business data; performing anomaly detection on the optical line terminal device using a target detection model based on the target business data to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating the abnormal data in the target business data; and determining that an abnormality exists in the optical line terminal device when the anomaly score is greater than a preset score.

[0006] Optionally, obtaining service data obtained after classifying data in an optical line terminal device includes: determining a plurality of decision vectors composed of data in the optical line terminal device, and determining a plurality of service types, wherein the vector length of each decision vector is the same, and the plurality of service types are service types to which the service data belongs; determining a first decision vector and a second decision vector from the plurality of decision vectors, wherein the first decision vector and the second decision vector are any one of the plurality of decision vectors; determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to a first service type, the second function is a function that the second decision vector belongs to a second service type, and the first service type and the second service type are any two service types among the plurality of service types; and determining the data in the first decision vector that meets a preset condition as service data corresponding to the first service type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

[0007] Optionally, determining a dominance relationship between a first function corresponding to a first decision vector and a second function corresponding to a second decision vector includes: determining that a dominance relationship exists between the first decision vector and the second decision vector when first function values ​​in the first function are less than or equal to second function values ​​in the second function, and when at least one of the first function values ​​is less than a value in the second function value; and determining that an equivalence relationship exists between the first decision vector and the second decision vector when the first function value and the second function value are equal.

[0008] Optionally, after determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector, the method further includes: determining that the first decision vector and the second decision vector cannot be compared when there is no dominance relationship and equivalence relationship between the first decision vector and the second decision vector.

[0009] Optionally, the business data includes at least one of the following: interactive network TV perception data, web browsing perception data, video experience perception data and game experience perception data; the indicator data includes at least one of the following: alarm period proportion, packet loss number, jitter number, error code number, playback jitter period proportion, and multiple types of delay data.

[0010] Optionally, target business data is determined from the business data based on indicator data corresponding to the business data, including: determining data whose indicator data corresponding to the business data is greater than a corresponding preset threshold as the target business data.

[0011] Optionally, the target detection model is obtained in the following manner: based on the historical business data in the training set, constructing an isolation tree corresponding to the abnormal data in the historical business data; determining the path length corresponding to each isolated tree; and determining the anomaly score of the historical business data based on at least the height of the isolated tree and the average value of the path length, wherein the value of the anomaly score is positively correlated with the degree of anomaly.

[0012] According to another aspect of an embodiment of the present application, a device for detecting an abnormality of an equipment is also provided, including: an acquisition module, used to acquire business data obtained after classifying data in an optical line terminal device; a first determination module, used to determine target business data from the business data based on indicator data corresponding to the business data; a detection module, used to perform anomaly detection on the optical line terminal device based on the target business data using a target detection model to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating abnormal data in the target business data; and a second determination module, used to determine that an abnormality exists in the optical line terminal device when the anomaly score is greater than a preset score.

[0013] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions that implement the following functions: obtaining business data obtained after classifying data in an optical line terminal device; determining target business data from the business data based on indicator data corresponding to the business data; performing anomaly detection on the optical line terminal device using a target detection model based on the target business data to obtain anomaly scores, wherein the target detection model identifies anomalies by isolating the abnormal data in the target business data; and determining that an abnormality exists in the optical line terminal device when the anomaly score is greater than a preset score.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for detecting device abnormality by running the computer program.

[0015] In an embodiment of the present application, business data is obtained by classifying data in an optical line terminal device; target business data is determined from the business data based on indicator data corresponding to the business data; anomaly detection is performed on the optical line terminal device based on the target business data using a target detection model to obtain anomaly scores, wherein the target detection model identifies anomalies by isolating abnormal data in the target business data; when the anomaly score is greater than a preset score, it is determined that an abnormality exists in the optical line terminal device, thereby achieving the purpose of intelligently detecting the optical line terminal device, thereby realizing the technical effect of improving the efficiency of equipment anomaly detection, and further solving the technical problems of long processing time and low efficiency in traditional equipment operation and maintenance anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for detecting device anomalies according to an embodiment of the present application;

[0018] Figure 2 is a flow chart of a method for detecting device abnormality according to an embodiment of the present application;

[0019] Figure 3 It is a structural diagram of a device for detecting an abnormality of equipment according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] The device anomaly detection method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for detecting device abnormality is shown. Figure 1As shown, the computer terminal 10 (or electronic device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0023] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0024] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the device abnormality detection method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned device abnormality detection method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0025] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0026] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0027] It should be noted that, in some optional embodiments, the above Figure 1 The computer device (or electronic device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or electronic device).

[0028] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for detecting an abnormality of a device. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 2 is a flow chart of a method for detecting device abnormality according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0030] Step S202, obtaining service data obtained by classifying data in an optical line terminal device, wherein each optical line terminal device corresponds to one user;

[0031] Step S204, determining target business data from the business data according to the indicator data corresponding to the business data;

[0032] Step S206, based on the target service data, using the target detection model to perform anomaly detection on the optical line terminal device to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating abnormal data in the target service data;

[0033] Step S208: When the abnormality score is greater than the preset score, it is determined that the optical line terminal device is abnormal.

[0034] In the above steps S202 to S208, the data center collects massive amounts of user-level underlying probe data from the optical line terminal equipment (OLT equipment), and on this basis, data aggregation and classification are performed. The collected data can be divided into four parts in terms of business: IPTV perception data, web browsing perception data, video experience perception data, and game experience perception data. The business data is evaluated through different indicator data, and the two parts of IPTV perception and web browsing perception data with good data quality and high collection frequency (i.e., the above target business data) are selected as the basic data for the subsequent analysis and modeling (i.e., the above target detection model), and the OLT equipment is predicted to have faults or abnormalities based on the target detection model.

[0035] In step S202 of the above-mentioned device abnormality detection method, the service data obtained after classifying the data in the optical line terminal device is obtained, which specifically includes the following steps: determining multiple decision vectors composed of the data in the optical line terminal device, and determining multiple service types, wherein the vector length of each decision vector is the same, and the multiple service types are service types to which the service data belongs; determining a first decision vector and a second decision vector from the multiple decision vectors, wherein the first decision vector and the second decision vector are any one of the multiple decision vectors; determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to the first service type, the second function is a function that the second decision vector belongs to the second service type, and the first service type and the second service type are any two service types among the multiple service types; determining the data in the first decision vector that meets the preset condition as service data corresponding to the first service type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

[0036] In the above steps, determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector specifically includes the following steps: when the first function values ​​in the first function are all less than or equal to the second function values ​​in the second function, and at least one value in the first function values ​​is less than a value in the second function values, determining that there is a dominance relationship between the first decision vector and the second decision vector; when the first function value and the second function value are equal, determining that there is an equivalence relationship between the first decision vector and the second decision vector.

[0037] In the above steps, after determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector, the method further includes: when there is no dominance relationship and equivalence relationship between the first decision vector and the second decision vector, determining that the first decision vector and the second decision vector cannot be compared.

[0038] In the embodiment of the present application, the user-level bottom probe data is collected from the OLT device in the data center network, and the collected data is put into the data classification model to obtain the Pareto optimal solution set. The collected data is aggregated in the Pareto optimal solution set in terms of business, and can be divided into four parts: IPTV perception, web browsing perception, video experience perception, and game experience perception. Specifically, the classification process of the above data classification model is as follows:

[0039] (1) Construct the objective function, f, which maps the n-dimensional decision space Ω to the k-dimensional target space. Usually, the objective function needs to include all optimization objectives of the optimization problem, and the decision space needs to cover the entire variable space.

[0040] minf(x)=(f 1 (x), f 2 (x), …, f k (x)), x∈Ω

[0041] (2) Pareto dominance: For two decision vectors x (i.e., the first decision vector mentioned above) and y (i.e., the second decision vector mentioned above), if f(x) (i.e., the first function mentioned above) is not greater than f(y) (i.e., the second function mentioned above) in any objective and is less than f(y) (i.e., the second function mentioned above) in at least one objective, then x dominates y. x dominates y, denoted as f(x)くf(y), or y is dominated by x. If x and y have a mutual dominance relationship, then x and y can be compared. If f(x) and f(y) are equal in all objectives, then x and y are equivalent. If x and y neither dominate each other nor are equivalent, then x and y cannot be compared.

[0042] Pareto dominance defines the relationship between the objective functions obtained by two different decision vectors, which makes it easy to compare the advantages and disadvantages of two decision vectors. If x dominates y, it means that x is stronger than y in the evaluation of all objective functions; otherwise, it means that y is stronger than x in the evaluation of all objective functions.

[0043] Pareto optimal solution set: If the decision vector x is not dominated by any vector in the decision space, then x is a Pareto optimal solution. The set of all Pareto optimal solutions constitutes the Pareto optimal solution set, also known as the non-inferior solution set.

[0044] The optimal solution set obtained through Pareto dominance is used to divide the data in the optical line terminal equipment into four types of business data: IPTV perception data, web browsing perception data, video experience perception data, and game experience perception data.

[0045] In the above-mentioned method for detecting device abnormalities, the business data includes at least one of the following: interactive network TV perception data, web browsing perception data, video experience perception data and game experience perception data; the indicator data includes at least one of the following: alarm period proportion, packet loss number, jitter number, error code number, playback jitter period proportion, and multiple types of delay data.

[0046] In step S204 of the above-mentioned method for detecting device abnormality, target business data is determined from the business data based on the indicator data corresponding to the business data, which specifically includes the following steps: data whose indicator data corresponding to the business data is greater than the corresponding preset threshold is determined as the target business data.

[0047] In an optional embodiment of the present application, IPTV perception data and web browsing perception data with better data quality and higher collection frequency can be used as target business data after evaluation, and as basic data for subsequent analysis and modeling. The characteristic fields used are: in the indicator data corresponding to the IPTV perception data, including: alarm period proportion, unicast alarm period proportion, multicast alarm period proportion, number of packet losses, number of jitters, number of error codes, and playback jitter period proportion; in the indicator data corresponding to the web browsing perception data, including: first screen delay, DNS delay, TCP connection delay, server response delay, and download delay.

[0048] In another optional embodiment, multiple indicator data corresponding to the above four types of business data (i.e., IPTV perception data, web browsing perception data, video experience perception data, and game experience perception data) can be obtained, and the relationship between each indicator data corresponding to different business data and the corresponding preset threshold value can be compared. The target business data can be determined according to the data volume of different business data and the number of indicator data corresponding to each indicator data of different business data that is greater than the corresponding preset threshold value. Specifically, the larger the data volume of the business data and the more the number of indicator data corresponding to each indicator data of the business data that is greater than the corresponding preset threshold value, the greater the possibility that the business data is determined as the target business data. For example, according to the above influencing factors for determining the target business data, multiple types of business data can be sorted, and the top two types of data can be determined as the target business data.

[0049] In the above-mentioned device anomaly detection method, the target detection model is obtained in the following manner: based on the historical business data in the training set, an isolation tree corresponding to the abnormal data in the historical business data is constructed; the path length corresponding to each isolated tree is determined; and based on at least the height of the isolated tree and the average value of the path length, the anomaly score of the historical business data is determined, wherein the value of the anomaly score is positively correlated with the degree of anomaly.

[0050] In an embodiment of the present application, the above-mentioned target detection model may be, for example, an isolation forest model, which is used as a method for judging the poor quality (or abnormality) of OLT equipment or single users. The isolation forest model can give an abnormality score value according to the path length of the sample. The closer the abnormality score value is to 1, the greater the probability that the sample is judged as an abnormal sample. Specifically, the core design idea of ​​the isolation forest model is to define anomalies as outliers that are easily isolated, that is, sample points with a relatively sparse density in the data space distribution. Based on this feature, if a random hyperplane is selected to cut each subspace, and the cycle continues until there is only one data point in each subspace, then normal samples in densely distributed areas will need to be cut many times before stopping, while abnormal data in sparse areas can be easily cut out.

[0051] The general process of the isolated forest model is to randomly select feature i and segmentation value p to segment the sample data X until convergence is reached (the convergence condition is usually one of the following conditions: the tree depth reaches the maximum limit, all samples are isolated in one node, and all feature values ​​in the node are the same). Through the above steps, multiple iTrees are established, and then the anomaly score is calculated by the following formula:

[0052]

[0053] Among them, h(x) is the height of x on each isolated tree, and c(ψ) is the average path length when the number of samples ψ is given, which is used to standardize the path length h(x) of sample x. When s(x,ψ) is closer to 1, that is, the depth of the sample in each tree in the isolation forest is shallower, the sample is more likely to be an abnormal sample.

[0054] After using the single-user feature and the isolation forest model to output the abnormality score, the threshold (i.e., the preset score) can be used to determine whether the perception of each single user is abnormal. If the abnormality score exceeds the preset score, it means that the perception data of the single user (i.e., the OLT device corresponding to the user) is abnormal. If the abnormality score does not exceed the preset score, it means that the perception data of the single user is normal. In another optional embodiment, if each optical line terminal device corresponds to multiple users, it is necessary to consider how to reflect the quality difference judgment result of the single user to the quality difference degree of the OLT and calculate the abnormality score of the OLT. If each optical line terminal device corresponds to multiple users, the embodiment of the present application chooses to perform a bin discretization operation on the single-user abnormality score under each OLT, and then calculates the entropy value as the abnormality score of the OLT. Since the vast majority of single users perceive normally, when the value of the OLT is large, more users fall into the bucket with a larger single-user abnormality score, that is, the larger the OLT abnormality score, the more single users under the OLT are abnormal.

[0055] The device anomaly detection method provided in the embodiment of the present application incorporates intelligent algorithms or models in each step of operation and maintenance, such as the above-mentioned isolation forest model, data classification model, etc., which can shorten the time for discovering and solving problems.

[0056] Figure 3 is a structural diagram of a device for detecting an abnormality of a device according to an embodiment of the present application, such as Figure 3 As shown, the device comprises:

[0057] An acquisition module 302 is used to acquire service data obtained by classifying data in an optical line terminal device, wherein each optical line terminal device corresponds to a user;

[0058] A first determination module 304 is used to determine target business data from the business data according to the indicator data corresponding to the business data;

[0059] A detection module 306 is used to perform anomaly detection on the optical line terminal device according to the target service data using a target detection model to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating abnormal data in the target service data;

[0060] The second determining module 308 is configured to determine that an abnormality exists in the optical line terminal device when the abnormality score is greater than a preset score.

[0061] In the acquisition module in the above-mentioned device for detecting abnormality of the equipment, the service data obtained after classifying the data in the optical line terminal equipment is acquired, which specifically includes the following processes: determining multiple decision vectors composed of the data in the optical line terminal equipment, and determining multiple service types, wherein the vector length of each decision vector is the same, and the multiple service types are service types to which the service data belongs; determining a first decision vector and a second decision vector from the multiple decision vectors, wherein the first decision vector and the second decision vector are any one of the multiple decision vectors; determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to the first service type, the second function is a function that the second decision vector belongs to the second service type, and the first service type and the second service type are any two service types among the multiple service types; determining the data in the first decision vector that meets the preset condition as service data corresponding to the first service type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

[0062] In the acquisition module in the above-mentioned device for detecting abnormality of the equipment, determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector specifically includes the following process: when the first function values ​​in the first function are all less than or equal to the second function values ​​in the second function, and at least one value in the first function values ​​is less than the value in the second function values, determining that there is a dominance relationship between the first decision vector and the second decision vector; when the first function value and the second function value are equal, determining that there is an equivalence relationship between the first decision vector and the second decision vector.

[0063] In the acquisition module in the above-mentioned equipment abnormality detection device, after determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector, the acquisition module is also used to determine that the first decision vector and the second decision vector cannot be compared when there is no dominance relationship and equivalence relationship between the first decision vector and the second decision vector.

[0064] In the above-mentioned device for detecting abnormalities of the equipment, the business data includes at least one of the following: interactive network TV perception data, web browsing perception data, video experience perception data and game experience perception data; the indicator data includes at least one of the following: the proportion of alarm time periods, the number of packet losses, the number of jitters, the number of error codes, the proportion of playback jitter time periods, and multiple types of delay data.

[0065] In the first determination module in the above-mentioned device abnormality detection apparatus, target business data is determined from the business data based on the indicator data corresponding to the business data, which specifically includes the following process: data whose indicator data corresponding to the business data is greater than the corresponding preset threshold is determined as the target business data.

[0066] In the above-mentioned device for detecting anomalies of equipment, the target detection model is obtained in the following manner: based on the historical business data in the training set, an isolation tree corresponding to the abnormal data in the historical business data is constructed; the path length corresponding to each isolated tree is determined; and based on at least the height of the isolated tree and the average value of the path length, the anomaly score of the historical business data is determined, wherein the value of the anomaly score is positively correlated with the degree of anomaly.

[0067] It should be noted that Figure 3 The device abnormality detection device shown is used to perform Figure 2 The device abnormality detection method shown in the figure, therefore the relevant explanations in the above-mentioned device abnormality detection method are also applicable to the device abnormality detection device, and will not be repeated here.

[0068] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following device abnormality detection method by running the computer program: obtaining service data obtained after classifying data in an optical line terminal device, wherein each optical line terminal device corresponds to a user; determining target service data from the service data based on indicator data corresponding to the service data; performing abnormality detection on the optical line terminal device using a target detection model based on the target service data to obtain an abnormality score, wherein the target detection model identifies the abnormality by isolating the abnormal data in the target service data; and determining that an abnormality exists in the optical line terminal device when the abnormality score is greater than a preset score.

[0069] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0070] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0071] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0072] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0073] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0074] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or an optical line terminal device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0075] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting device abnormality, characterized in that: include: Acquiring service data obtained by classifying data in an optical line terminal device; Determining target business data from the business data according to the indicator data corresponding to the business data; According to the target service data, a target detection model is used to perform anomaly detection on the optical line terminal device to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating abnormal data in the target service data; When the abnormality score is greater than a preset score, determining that the optical line terminal device has an abnormality; The method of obtaining service data obtained after classifying data in an optical line terminal device comprises: determining a plurality of decision vectors composed of the data in the optical line terminal device, and determining a plurality of service types, wherein the vector length of each decision vector is the same, and the plurality of service types are service types to which the service data belongs; determining a first decision vector and a second decision vector from the plurality of decision vectors, wherein the first decision vector and the second decision vector are any one of the plurality of decision vectors; determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to a first service type, the second function is a function that the second decision vector belongs to a second service type, and the first service type and the second service type are any two of the plurality of service types; and determining the data in the first decision vector that meets a preset condition as service data corresponding to the first service type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

2. The method according to claim 1, characterized in that Determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector includes: When the first function values ​​in the first function are all less than or equal to the second function values ​​in the second function, and at least one value in the first function values ​​is less than a value in the second function values, determining that there is a dominance relationship between the first decision vector and the second decision vector; When the first function value and the second function value are equal, it is determined that there is an equivalent relationship between the first decision vector and the second decision vector.

3. The method according to claim 2, characterized in that After determining the dominance relationship between the first function corresponding to the first decision vector and the second function corresponding to the second decision vector, the method further includes: When the dominance relationship and the equivalence relationship do not exist between the first decision vector and the second decision vector, it is determined that the first decision vector and the second decision vector cannot be compared.

4. The method according to claim 1, characterized in that: The business data includes at least one of the following: interactive network TV perception data, web browsing perception data, video experience perception data and game experience perception data; the indicator data includes at least one of the following: alarm period proportion, packet loss number, jitter number, error code number, playback jitter period proportion, and multiple types of delay data.

5. The method according to claim 4, characterized in that Determining target business data from the business data according to indicator data corresponding to the business data includes: The indicator data corresponding to the business data that is greater than the corresponding preset threshold is determined as the target business data.

6. The method according to claim 1, characterized in that The target detection model is obtained in the following way: Based on the historical business data in the training set, construct an isolation tree corresponding to the abnormal data in the historical business data; Determine the path length corresponding to each isolated tree; The abnormality score of the historical business data is determined at least based on the height of the isolated tree and the average value of the path length, wherein the value of the abnormality score is positively correlated with the degree of abnormality.

7. A device for detecting abnormality of equipment, characterized in that: include: An acquisition module, used to acquire service data obtained after classifying data in an optical line terminal device; A first determination module, configured to determine target business data from the business data according to indicator data corresponding to the business data; A detection module, configured to perform anomaly detection on the optical line terminal device according to the target service data using a target detection model to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating abnormal data in the target service data; A second determination module, configured to determine that an abnormality exists in the optical line terminal device when the abnormality score is greater than a preset score; The acquisition module is also used to determine multiple decision vectors composed of data in the optical line terminal device, and determine multiple service types, wherein the vector length of each decision vector is the same, and the multiple service types are service types to which the service data belongs; determine a first decision vector and a second decision vector from the multiple decision vectors, wherein the first decision vector and the second decision vector are any one of the multiple decision vectors; determine a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to a first service type, and the second function is a function that the second decision vector belongs to a second service type, and the first service type and the second service type are any two service types among the multiple service types; determine the data in the first decision vector that meets a preset condition as service data corresponding to the first service type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

8. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is connected to the memory and is used to execute program instructions that implement the following functions: obtaining service data obtained after classifying data in an optical line terminal device; determining target service data from the service data according to indicator data corresponding to the service data; performing anomaly detection on the optical line terminal device using a target detection model according to the target service data to obtain an anomaly score, wherein the target detection model identifies anomalies by isolating the anomaly data in the target service data; determining that an anomaly exists in the optical line terminal device when the anomaly score is greater than a preset score; obtaining service data obtained after classifying data in the optical line terminal device, including: determining a plurality of decision vectors composed of data in the optical line terminal device, and determining a plurality of service types, wherein the vector length of each decision vector is the same, and the plurality of service types are type is the business type to which the business data belongs; determining a first decision vector and a second decision vector from the multiple decision vectors, wherein the first decision vector and the second decision vector are both any one of the multiple decision vectors; determining a dominance relationship between a first function corresponding to the first decision vector and a second function corresponding to the second decision vector, wherein the first function is a function that the first decision vector belongs to a first business type, the second function is a function that the second decision vector belongs to a second business type, and the first business type and the second business type are any two business types among the multiple business types; determining the data in the first decision vector that meets the preset conditions as business data corresponding to the first business type, wherein the preset condition is that the first decision vector is not dominated by the second decision vector.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the device abnormality detection method according to any one of claims 1 to 6 by running the computer program.

Images