Anomaly detection methods, devices, systems, electronic equipment and storage media

Abstract

This disclosure relates to an anomaly detection method, anomaly detection device, electronic device, and storage medium, and pertains to the field of data processing technology. The method includes: determining an indicator for anomaly detection; acquiring data of the indicator in real time, and determining a delay parameter value based on the time of acquiring the current data and historical data of the indicator, wherein the current data is the real-time data of the indicator at the current moment, and the historical data is the data of the indicator acquired previously; adjusting the data response time of the indicator in real time based on the parameter value of the delay parameter, and acquiring detection data of the indicator for anomaly detection based on the data response time; performing anomaly detection based on the detection data to obtain an anomaly detection result. This disclosure can adaptively adjust the data acquisition time, solving problems such as excessively long anomaly detection time and missed anomaly detection due to fluctuating data latency.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data processing, and particularly relates to an anomaly detection method, an anomaly detection device, an anomaly detection system, an electronic device and a storage medium. BACKGROUND

[0002] The target of anomaly detection is to find objects different from most objects, and the anomaly object is usually called an outlier, which is usually far away from other data points in the scatter plot of data. In the process of anomaly detection, the real-time of the acquired detection data will affect the accuracy of the detection result. Generally, the data at time T needs to be acquired at the next time, i.e., time T+1, but due to network delay, resource budget limitation, peak period cluster pressure and other factors, data delay is often increased, i.e., the data at time T cannot be acquired at time T+1, so that the anomaly detection data cannot be acquired, and the anomaly detection effect is affected.

[0003] The related technology mainly solves the above problem by the following method: improving the data source computing power of production data to avoid data source delay, prolonging the data acquisition time to ensure the integrity of the data at this moment, or shortening the data acquisition time to improve the timeliness of the data. However, the above scheme will bring the following problems: because the data size of production data at different times is different, blindly increasing the cluster computing power will cause waste of resources during the low peak period of data; increasing the data acquisition time can ensure the integrity of the data, but blindly prolonging the data acquisition time may make the fault discovery time longer, so that the loss cannot be stopped in time, and the influence of the fault is larger; reducing the data acquisition time can achieve the effect of quickly discovering anomalies in the case of normal data, but when the data delay is serious, a large number of false negatives will be caused, and the fault will be missed.

[0004] To solve the above problems, the present disclosure provides an anomaly detection method, an anomaly detection device, an anomaly detection system, an electronic device and a storage medium. SUMMARY

[0005] The present disclosure provides an anomaly detection method, an anomaly detection device, an anomaly detection system, an electronic device and a storage medium to at least solve the problems in the related art that because the data size of production data at different times is different, blindly increasing the cluster computing power will cause waste of resources during the low peak period of data; increasing the data acquisition time can ensure the integrity of the data, but blindly prolonging the data acquisition time may make the fault discovery time longer, so that the loss cannot be stopped in time, and the influence of the fault is larger; reducing the data acquisition time can achieve the effect of quickly discovering anomalies in the case of normal data, but when the data delay is serious, a large number of false negatives will be caused, and the fault will be missed. The technical scheme of the present disclosure is as follows:

[0006] According to a first aspect of the embodiments of the present disclosure, an anomaly detection method is provided, including: determining an index for anomaly detection; acquiring data of the index in real time, and determining a parameter value of a delay parameter according to a time of acquiring current data and historical data of the index, wherein the current data is real-time data of the index at a current time, and the historical data is data of the index acquired once before the current data; adjusting a data response time of the index in real time according to the parameter value of the delay parameter, and acquiring detection data of the index for anomaly detection based on the data response time; and performing anomaly detection based on the detection data to obtain an anomaly detection result.

[0007] Optionally, the acquiring the data of the index in real time includes: determining a time window and a scheduling interval; and acquiring the current data of the index at the current time with the time window every other calling interval.

[0008] Optionally, the determining the parameter value of the delay parameter according to the time of acquiring the current data and the historical data of the index includes: calculating a difference between the current time and a time of scheduling the historical data last time to obtain the parameter value of the delay parameter.

[0009] Optionally, after the anomaly detection result is obtained, the method further includes: determining whether an abnormal event exists according to the anomaly detection result, and notifying the user of the abnormal event through a preselected notification channel if the abnormal event exists.

[0010] According to a second aspect of the embodiments of the present disclosure, an anomaly detection apparatus is provided, including: an index determination module configured to determine an index for anomaly detection; a delay parameter value determination module configured to determine a parameter value of a delay parameter according to current data and historical data of the index, wherein the current data is real-time data of the index at a current time, and the historical data is data of the index acquired once before the current data; a detection data acquisition module configured to adjust a data response time of the index in real time according to the parameter value of the delay parameter, and acquire detection data of the index for anomaly detection based on the data response time; and an anomaly detection module configured to perform anomaly detection based on the detection data to obtain an anomaly detection result.

[0011] Optionally, the delay parameter value determination module is specifically configured to: determine a time window and a scheduling interval; acquire the current data of the index at the current time with the time window every other calling interval; and calculate a difference between the current time and a time of scheduling the historical data last time to obtain the parameter value of the delay parameter.

[0012] Optionally, the detection data obtaining module is specifically configured to: compare the parameter value of the delay parameter at the current time and the previous time, if the parameter value becomes larger, the data response time is correspondingly lengthened, and if the parameter value becomes smaller, the data response time is correspondingly shortened.

[0013] According to a third aspect of the embodiments of the present disclosure, an anomaly detection system is provided, comprising: a data providing module configured to calculate current data of an index for anomaly detection in real time; a data scheduling module configured to determine a parameter value of a delay parameter according to the current data and historical data of the index, and adjust a data response time of the index in real time according to the parameter value of the delay parameter, so as to obtain detection data of the index for anomaly detection based on the data response time; an algorithm detection module configured to perform anomaly detection according to the detection data of the index, and obtain an anomaly detection result; and an anomaly broadcasting module configured to determine whether there is an abnormal event according to the anomaly detection result, and perform anomaly broadcasting if there is an abnormal event.

[0014] According to a fourth aspect of the embodiments of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement any of the above methods.

[0015] According to a fifth aspect of the embodiments of the present disclosure, a storage medium is provided, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above methods.

[0016] According to a sixth aspect of the embodiments of the present disclosure, a computer program product is provided, when the computer program is executed by a processor, the computer program implements any of the above audio and video data display methods.

[0017] The technical solutions provided by the embodiments of the present disclosure at least bring the following beneficial effects:

[0018] In the abnormality detection method provided in the embodiments of the present disclosure, an index for abnormality detection is determined; a parameter value of a delay parameter is determined according to current data and historical data of the index, wherein the current data is real-time data of the index at a current time, and the historical data is data of the index acquired once before the current data; a data response time of the index is adjusted in real time according to the parameter value of the delay parameter, and detection data of the index for abnormality detection is acquired based on the data response time; and abnormality detection is performed based on the detection data to obtain an abnormality detection result. The present disclosure determines the parameter value of the delay parameter according to the current data and the historical data of the index, and adaptively adjusts the data response time according to the parameter value, so that the time for acquiring data can be adjusted in real time according to the current data delay state, thereby ensuring the timeliness and integrity of the acquired detection data. In addition, the present disclosure can adjust the data response time for acquiring the detection data in real time according to the delay parameter state, thereby reducing the problems of missed reporting of abnormal states, and too long time for discovering abnormality and missed reporting of abnormality caused by data source delay.

[0019] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure, and do not limit the present disclosure.

[0021] Figure 1 is a flowchart of an abnormality detection method according to an exemplary embodiment;

[0022] Figure 2 is a block diagram of an abnormality detection apparatus according to an exemplary embodiment;

[0023] Figure 3 is a flowchart of the overall process of performing abnormality detection by an abnormality detection system according to an exemplary embodiment;

[0024] Figure 4 is an architectural diagram of a data providing module of an abnormality detection system according to an exemplary embodiment;

[0025] Figure 5 is a structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] Example implementations are now described with reference to the drawings. Example implementations can, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example implementations to those skilled in the art. The described features, structures, or characteristics can be combined in one or more implementations. In the following description, numerous specific details are provided to give a thorough understanding of example implementations. One skilled in the relevant art will recognize, however, that the

[0027] Furthermore, the accompanying drawings are only intended to illustrate the present disclosure and are not necessarily drawn to scale. The same reference label or sign can be used throughout the drawings to refer to the same or like parts, and thus repeated description thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities, which do not necessarily have to correspond to physically or logically independent entities. The functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0028] The objective of anomaly detection is to find objects that are different from most of the objects, which are usually called outliers, and which are usually far away from other data points in the scatter plot of data. In the process of anomaly detection, the real-time of the acquired detection data will affect the accuracy of the detection result. Usually, the data at time T needs to be acquired at the next time, i.e., time T+1. However, due to network delay, resource budget limitation, peak period cluster pressure and other factors, data delay is often increased, i.e., the data at time T cannot be acquired at time T+1, so that the anomaly detection data cannot be acquired, and the anomaly detection effect is affected.

[0029] In view of the above unstable data delay, the related art mainly solves the problem in the following three ways: scheme one: avoiding data source delay by improving the data source computing power of production data; scheme two: ensuring the integrity of the data at this moment by prolonging the data acquisition time; scheme three: improving the timeliness of the data by shortening the data acquisition time. However, the above schemes all have certain problems, for example, for scheme one, because the data size of production data at different moments is different, blindly increasing the cluster computing power will cause waste of resources during the low peak period of data; for scheme two, although increasing the data acquisition time can ensure the integrity of the data, blindly prolonging the data acquisition time may make the time to discover the fault longer, thereby causing the inability to stop loss in time and making the influence of the fault larger; for scheme three: although reducing the data acquisition time can achieve the effect of quickly discovering abnormalities under normal data conditions, when the data delay is serious, it will cause a large number of false negatives, causing the omission of faults.

[0030] In order to solve the problems in the above schemes, the present disclosure provides an anomaly detection method, an anomaly detection device, an anomaly detection system, an electronic device and a storage medium. The technical solutions of the embodiments of the present disclosure are described in detail as follows:

[0031] The embodiments of the present disclosure first provide an anomaly detection method, as shown in the accompanying drawings, Figure 1 The anomaly detection method specifically includes the following steps:

[0032] Step S110: determining an index for anomaly detection.

[0033] Step S120: acquiring data of the index in real time, and determining a parameter value of a delay parameter according to the time of the current data and the historical data of the index, wherein the current data is real-time data of the index at the current time, and the historical data is data of the index acquired once before the current data;

[0034] Step S130: adjusting the data response time of the index in real time according to the parameter value of the delay parameter, and acquiring detection data of the index for anomaly detection based on the data response time;

[0035] Step S140: performing anomaly detection based on the detection data to obtain an anomaly detection result.

[0036] In the abnormality detection method provided in the embodiments of the present disclosure, the parameter value of the delay parameter is determined according to the current data and the historical data of the index, and the data response time is adaptively adjusted according to the parameter value, so that the data acquisition time can be adjusted in real time according to the current data delay state, thereby ensuring the timeliness and integrity of the acquired detection data. In addition, the data response time for acquiring detection data can be adjusted in real time according to the delay parameter state, reducing the problems of missed reporting of abnormal states and too long time for discovering abnormalities caused by data source delay and abnormality missed reporting.

[0037] In the following, in another embodiment, the above steps are described in more detail.

[0038] In step S110, an index for abnormality detection is determined.

[0039] The target of the above abnormality detection is to find objects different from most objects, and the abnormal object is usually called an outlier, which is usually far away from other data points in the scatter plot of data. Through abnormality detection, abnormal events in the business scenario can be discovered in time for processing, reducing losses.

[0040] In the embodiments of the present disclosure, the above index is a parameter that can be used to determine whether an abnormal event exists, and the index is determined by the actual business scenario for abnormality detection. The index can be one or more. For example, in an e-commerce scenario, the above index can be the click rate or / and purchase rate of a certain product, and the present disclosure does not make special limitations on this.

[0041] Exemplarily, the above method of determining the index for abnormality detection can be implemented as follows: the real-time data of the index is operated according to the calculation rule of the index and is stored. Specifically, assuming that the above index is the click rate of a product, the process can be as follows: the real-time data of the click rate index is aggregated and operated, and the calculated data is stored in hbase (a distributed column-oriented open source database).

[0042] In step S120, the data of the above index is acquired in real time, and the parameter value of the delay parameter is determined according to the time when the current data and the historical data of the index are acquired, wherein the current data is the real-time data of the index at the current time, and the historical data is the data of the index acquired once before the current data.

[0043] In this step, the parameter value of the delay parameter is determined by the real-time data and the historical data of the above index, wherein the delay parameter is used to represent the data delay state, and the parameter value of the delay parameter becomes larger, representing that the data delay becomes smaller. The parameter value becomes larger, representing that the data delay becomes larger. The current data is the real-time data of the index at the current time, and the historical data is the data acquired once before the current data.

[0044] For example, the process of acquiring the data of the aforementioned indicators in real time can be implemented as follows: determining the time window and scheduling interval; acquiring the current data of the aforementioned indicators at the current moment using the time window at each of the aforementioned call intervals. Preferably, embodiments of this disclosure can also perform quality checks on the acquired indicator data to ensure that the acquired data meets quality requirements.

[0045] The above method of determining the delay parameter value based on the current and historical data of the obtained indicator can be achieved as follows: calculate the difference between the current time and the time of the previous scheduling historical data to obtain the delay parameter value.

[0046] The above process will be explained in detail below using the scenario shown in Table 1 as an example:

[0047]

[0048] In the actual scenario shown in Table 1, the data acquisition time window is 5 minutes, and the system schedules the data for the above indicators at a time interval of 1 minute. For example, the system can retrieve the indicator data from the HBase database based on the data retrieval logic of the above indicators. The above △ represents the latency parameter, which is the difference between the current data acquisition time and the historical data acquisition time. A larger value for this latency parameter indicates a smaller data latency, while a larger value indicates a larger data latency. For example, if the current data obtained in the fifth scheduling session is unchanged from the historical data obtained in the fourth scheduling session, it proves that the data latency has increased.

[0049] For unstable data sources, i.e., data sources with fluctuating data latency, inappropriate data acquisition timing can lead to long anomaly detection times or missed anomaly reports. Therefore, in this embodiment of the present disclosure, it is preferable to use the data acquisition time as the system's overall time, rather than using real time, and use a variable Δ to record the data latency status so that the system can automatically adjust the data acquisition time automatically based on the variable Δ, thereby reducing the problems of long anomaly detection times or missed anomaly reports caused by inaccurate manual configuration of data latency.

[0050] In step S130, the data response time of the indicator is adjusted in real time according to the parameter value of the delay parameter, and the detection data of the indicator used for anomaly detection is obtained based on the data response time.

[0051] In this embodiment of the disclosure, the aforementioned data response time is the response time for acquiring detection data used for anomaly detection. After determining the parameter value of the delay parameter through the above steps, this embodiment of the disclosure can adjust the data response time in real time based on the parameter value of the delay parameter, and acquire detection data based on the data response time.

[0052] Taking the scenario shown in Table 1 above as an example, the initial value of the delay parameter is 0. From the first to the fourth scheduling, the data status is normal, and the delay is 1 minute. Therefore, the detection data is acquired at 1-minute intervals. In the fifth scheduling, since Δ = 0, Δ decreases, indicating that the data delay increases to 2 minutes. The current data acquired at this time is not the latest data of the indicator, so the data response time of the detection data is extended by 2 minutes accordingly. In the sixth scheduling, Δ = 0, which remains unchanged, representing a constant data delay. The delay increases by 1 minute to 3 minutes, and the data response time of the detection data is extended by 3 minutes accordingly. The scheduling at other times is similar, and the data response time of the indicator is adjusted in real time according to the parameter value of the delay parameter.

[0053] In step S140, anomaly detection is performed based on the detection data to obtain anomaly detection results.

[0054] In this step, anomaly detection is performed based on the detection data to obtain anomaly detection results. For example, anomaly detection algorithms can be used to process the aforementioned detection data to obtain anomaly detection results. This disclosure does not specifically limit the anomaly detection algorithm described above; for example, anomaly detection can employ model-based techniques, nearest neighbor-based techniques, or density-based techniques, etc.

[0055] In another embodiment, after obtaining the above-mentioned anomaly detection results, this disclosure can further determine whether an anomaly has occurred in the system based on the anomaly detection results, and broadcast the anomaly event to the user when an anomaly occurs, so as to handle the anomaly event in a timely manner and reduce the losses caused by the anomaly event. Specifically, this process can be as follows: anomaly events are formed according to the detection results and strategies; preferably, the anomaly events can be rendered in a readable visual format, and the rendered results can be transmitted to the user through the selected notification channel, so that the user can discover the fault in time and stop the loss in time.

[0056] Accordingly, this disclosure also provides a block diagram of an anomaly detection device. For example... Figure 2 As shown, the anomaly detection device includes an index determination module 210, a delay parameter value determination module 220, a detection data acquisition module 230, and an anomaly detection module 240. Wherein:

[0057] The indicator determination module 210 is used to determine the indicators used for anomaly detection;

[0058] The delay parameter value determination module 220 is used to acquire the data of the above indicators in real time, and determine the parameter value of the delay parameter based on the time of acquiring the current data and historical data of the above indicators. The current data is the real-time data of the indicator at the current time, and the historical data is the data of the indicator acquired before the current data.

[0059] The detection data acquisition module 230 is used to adjust the data response time of the indicator in real time according to the parameter value of the delay parameter, and to acquire the detection data of the indicator used for anomaly detection based on the data response time.

[0060] The anomaly detection module 240 is used to perform anomaly detection based on the detection data and obtain anomaly detection results.

[0061] Regarding the apparatus in the above embodiments, the specific manner in which each unit or module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0062] Furthermore, this disclosure also provides an anomaly detection system, which includes the following modules:

[0063] The data providing module is used to calculate the current data of the metrics used for anomaly detection in real time;

[0064] The data scheduling module is used to determine the value of the delay parameter based on the acquisition time of the current and historical data of the indicator, and to adjust the data response time of the indicator in real time based on the value of the delay parameter, so as to obtain the detection data of the indicator used for anomaly detection based on the data response time.

[0065] The algorithm detection module is used to perform anomaly detection based on the detection data of the indicators and obtain the anomaly detection results;

[0066] The anomaly reporting module is used to determine whether there is an abnormal event based on the anomaly detection results. If an abnormal event is found, an anomaly report will be broadcast.

[0067] Below, in conjunction with Figure 3 and Figure 4 The above-described anomaly detection system will be described in detail in a specific embodiment. Wherein, Figure 3 The overall flowchart for executing the above anomaly detection method in the above anomaly detection system is as follows: Figure 4 A schematic diagram of the architecture of the module that provides the above data.

[0068] Taking e-commerce business metrics as an example, the pre-calculation module (i.e., the data providing module mentioned above) first calculates the real-time data of the metric according to its calculation rules and then stores it in HBase. Figure 3 Step 1; then, the data scheduling module obtains the e-commerce metric according to the system configuration, and retrieves the latest N points of data (LastN data) of the metric from the metric database (hbase) according to the data retrieval logic of the metric, corresponding to Figure 3Steps 2 to 4 in the process; upon receiving the data retrieval request, the pre-calculation and indicator library immediately provides the aforementioned LastN data, and after data quality verification, hands the data over to the data scheduling module, corresponding to... Figure 3 Steps 5 and 6 in the process; the data scheduling module performs anomaly detection based on the data that has passed quality inspection and stores the algorithm detection results, which corresponds to Figure 3 Steps 7 and 8; the anomaly broadcasting module composes anomaly events based on the detection results and strategies, and performs visual rendering of the anomaly events, corresponding to... Figure 3 Steps 9 to 12 in the process; the rendered result is then passed on to the user through the selected notification channel, corresponding to... Figure 3 Step 13 in the process allows users to handle abnormal events in a timely manner and reduce losses.

[0069] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0070] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this disclosure. See below for details. Figure 5 It shows a schematic diagram of a structure suitable for implementing the electronic device 500 in the embodiments of this disclosure. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0071] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503 to implement the voice control method as described in the embodiments of this disclosure. The RAM 503 also stores various programs and data required for the operation of the electronic device 500. The processing device 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0072] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0073] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts, thereby implementing the voice control method as described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0074] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0075] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0076] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0077] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to:

[0078] Determine the metrics to be used for anomaly detection;

[0079] The data of the above indicators are acquired in real time, and the parameter value of the delay parameter is determined based on the time of acquisition of the current data and historical data of the above indicators. The current data is the real-time data of the indicator at the current time, and the historical data is the data of the indicator acquired before the current data.

[0080] The data response time of the indicator is adjusted in real time based on the parameter value of the delay parameter, and the detection data of the indicator used for anomaly detection is obtained based on the data response time;

[0081] Anomaly detection is performed based on the detection data to obtain anomaly detection results.

[0082] Optionally, when one or more of the above-described procedures are executed by the electronic device, the electronic device may also perform other steps described in the above embodiments.

[0083] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0084] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0085] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0086] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0087] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0088] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0089] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0090] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. An anomaly detection method characterized by, The method comprises the following steps: determining an index for anomaly detection, the index being a commodity click rate; obtaining data of the index in real time, and calculating a difference between a current time and a time of historical data last scheduled according to current data of the index, to obtain a parameter value of a delay parameter, wherein the current data is real-time data of the index at the current time, the historical data is data of the index obtained last time before the current data, the delay parameter is used to represent a state of index data delay, and the parameter value of the delay parameter becomes larger, representing that the index data delay becomes smaller; monitoring a change trend of the parameter value of the delay parameter, if the parameter value of the delay parameter becomes smaller compared with a previous time, extending a data response time of the index, and if the parameter value of the delay parameter becomes larger compared with the previous time, shortening the data response time of the index; obtaining detection data of the index for anomaly detection based on the adjusted data response time; performing anomaly detection based on the detection data to obtain an anomaly detection result.

2. The abnormality detection method according to claim 1, characterized by, The method further comprises the following steps after obtaining the anomaly detection result: judging whether there is an abnormal event according to the anomaly detection result, and if there is the abnormal event, notifying the user of the abnormal event through a preselected notification channel. The method comprises the following steps:

3. The abnormality detection method according to claim 1, characterized by, an index determination module, configured to determine an index for anomaly detection, the index being a commodity click rate; a delay parameter value determination module, configured to obtain data of the index in real time, and calculate a difference between a current time and a time of historical data last scheduled according to current data of the index, to obtain a parameter value of a delay parameter, wherein the current data is real-time data of the index at the current time, the historical data is data of the index obtained last time before the current data, the delay parameter is used to represent a state of index data delay, and the parameter value of the delay parameter becomes larger, representing that the index data delay becomes smaller; 4. An abnormality detection device characterized by comprising: a detection data obtaining module, configured to monitor a change trend of the parameter value of the delay parameter, if the parameter value of the delay parameter becomes smaller compared with a previous time, extend a data response time of the index, and if the parameter value of the delay parameter becomes larger compared with the previous time, shorten the data response time of the index, and obtain detection data of the index for anomaly detection based on the adjusted data response time; an anomaly detection module, configured to perform anomaly detection based on the detection data to obtain an anomaly detection result. The delay parameter value determination module is specifically configured to: determine a time window and a scheduling interval; obtain the current data of the index at the current time with the time window every other scheduling interval.

5. The abnormality detection device according to claim 4, characterized by The method comprises the following steps: a data providing module, configured to calculate current data of an index for anomaly detection in real time, the index being a commodity click rate, and the current data being real-time data of the index at the current time. ​ 6. An anomaly detection system characterized by, ​ ​ The data scheduling module is configured to calculate a difference between a current time and a time of previous scheduling historical data according to current data of the index, to obtain a parameter value of a delay parameter, the historical data being data of the index acquired once before the current data, the delay parameter being used to represent a state of index data delay, the parameter value of the delay parameter becoming larger representing that the index data delay becomes smaller, and to monitor a change trend of the parameter value of the delay parameter, if the parameter value of the delay parameter is smaller than that of a previous time, to prolong a data response time of the index, and if the parameter value of the delay parameter is larger than that of the previous time, to shorten the data response time of the index, to obtain detection data of the index for anomaly detection based on the adjusted data response time, and to perform anomaly detection according to the detection data of the index to obtain an anomaly detection result. The algorithm detection module is configured to perform anomaly detection according to the detection data of the index to obtain an anomaly detection result. The anomaly reporting module is configured to determine whether there is an abnormal event according to the anomaly detection result, and to perform anomaly reporting if there is an abnormal event.

7. An electronic device, comprising: The method comprises: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method of any one of claims 1 to 3.

8. A storage medium, when instructions in the storage medium are executed by a processor of an electronic device, enabling the electronic device to perform the method of any one of claims 1 to 3.

Images