Traffic data anomaly detection method and device, and traffic operation and maintenance system

Abstract

The application relates to a traffic data anomaly detection method and device and a traffic operation and maintenance system. The method comprises the following steps: obtaining traffic data to be detected from a traffic management business system, and extracting feature information of the traffic data to be detected; determining whether the traffic data to be detected is abnormal based on the feature information; if the traffic data to be detected is abnormal, it is determined that an associated device of the traffic data to be detected is abnormal, the working state of the traffic device is detected in an indirect mode, and the problem that the abnormal working state of the associated device of the traffic data cannot be detected in the prior art, so that the associated device fault cannot be found in time, is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent transportation, and in particular, to a traffic data anomaly detection method, a traffic data anomaly detection device, and a traffic operation and maintenance system. BACKGROUND

[0002] With the increasing traffic flow in cities, the demand for traffic data by traffic management is becoming increasingly complex and diversified. For example, traffic data such as vehicle passing data has a large amount of data and requires high timeliness; traffic violation data requires high accuracy and completeness. These requirements increase the demand for daily operation and maintenance monitoring of traffic monitoring and detection devices such as roadblocks, electric police, cameras, detectors, signal machines, and other traffic monitoring and detection devices in urban roads. However, traditional traffic device monitoring usually needs to directly access the hardware to monitor the hardware failure of traffic monitoring and detection devices. When the traffic monitoring system is complex and involves devices or platforms of multiple protocols, it is impossible to monitor the working status of the devices or platforms through direct access, so it is also impossible to troubleshoot and locate the associated devices, resulting in the inability to timely detect the failure of the associated devices.

[0003] Currently, there is no effective solution to the problem that the abnormal working status of traffic associated devices cannot be detected, resulting in the inability to timely detect the failure of the associated devices. SUMMARY

[0004] In this embodiment, a traffic data anomaly detection method, a traffic data anomaly detection device, and a traffic operation and maintenance system are provided to solve the problem that the abnormal working status of traffic associated devices cannot be detected in related technologies, resulting in the inability to timely detect the failure of the associated devices.

[0005] In a first aspect, a traffic data anomaly detection method is provided in this embodiment, and the method includes:

[0006] Obtaining traffic data to be detected from a traffic management business system, and extracting feature information of the traffic data to be detected;

[0007] Determining whether the traffic data to be detected is abnormal based on the feature information;

[0008] If the traffic data to be detected is abnormal, it is determined that the associated device of the traffic data to be detected is abnormal.

[0009] In some embodiments, the feature information includes at least one of continuity feature value, data volume feature value, timeliness feature value, completeness feature information, and validity feature value, and the determination of whether the traffic data to be detected is abnormal based on the feature information includes:

[0010] determine whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index.

[0011] In some embodiments, the continuity feature value corresponds to a continuity index, and the continuity feature value is determined based on a time interval of reporting of the different time period data of the traffic data to be detected. The determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index comprises:

[0012] obtaining a continuity index, the continuity index being determined based on a time interval of reporting of the different time period data of the historical traffic data;

[0013] if the continuity feature value does not conform to the continuity index of the corresponding time period, determining that the traffic data to be detected is abnormal.

[0014] In some embodiments, the obtaining a continuity index, the continuity index being determined based on a time interval of reporting of the different time period data of the historical traffic data comprises:

[0015] determining a historical reporting date same as a sequence day of a reporting date of the traffic data to be detected based on the reporting date of the traffic data to be detected;

[0016] obtaining corresponding historical traffic data based on the historical reporting date;

[0017] determining the continuity index based on the historical traffic data.

[0018] In some embodiments, the data volume feature value corresponds to a data volume index, and the data volume feature value is determined based on a data volume of reporting of the different time period data of the traffic data to be detected. The determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index comprises:

[0019] obtaining a data volume index, the data volume index being determined based on a data volume of reporting of the different time period data of the historical traffic data;

[0020] if the data volume feature value does not conform to the data volume index of the corresponding time period, determining that the traffic data to be detected is abnormal.

[0021] In some embodiments, the timeliness feature value corresponds to a timeliness index, and the timeliness feature value is determined based on a difference between a generation time and a storage time of the traffic data to be detected. The determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index comprises:

[0022] determine the timeliness index based on the preset delay threshold;

[0023] if the timeliness feature value does not meet the timeliness index, determine that the traffic data to be detected is abnormal.

[0024] In some embodiments, the integrity feature information corresponds to an integrity index; and the determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index comprises:

[0025] determine the integrity index based on a predetermined traffic data type;

[0026] if the integrity feature information does not meet the integrity index, determine that the traffic data to be detected is abnormal.

[0027] In some embodiments, the validity feature value corresponds to a validity index, and the validity feature value is determined based on a proportion of valid data of the traffic data to be detected; and the determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index comprises:

[0028] determine the validity index based on a preset validity threshold;

[0029] if the validity feature value does not meet the validity index, determine that the traffic data to be detected is abnormal.

[0030] In a second aspect, the present embodiment provides a traffic data anomaly detection device, which comprises:

[0031] an acquisition module configured to acquire traffic data to be detected from a traffic management business system, and extract feature information of the traffic data to be detected;

[0032] a first determination module configured to determine whether the traffic data to be detected is abnormal based on the feature information;

[0033] a second determination module configured to, if the traffic data to be detected is abnormal, determine that an associated device of the traffic data to be detected is abnormal.

[0034] In a third aspect, the present embodiment provides a traffic operation and maintenance system, which comprises an access device configured to access a traffic management business system through a data access service and acquire traffic data to be detected, a traffic data anomaly detection device configured to perform anomaly detection on the traffic data to be detected, as described in the first aspect above, and an alarm device configured to perform alarm based on a detection result.

[0035] Compared with the related art, the traffic data anomaly detection method provided in the embodiment, by obtaining the traffic data to be detected from the traffic management business system and extracting the feature information of the traffic data to be detected, obtaining various traffic data generated by each traffic device without directly connecting with the traffic device, and extracting the feature information used for determining whether the data meets the requirement, determining whether the traffic data to be detected is abnormal based on the feature information, taking the feature information as the basis for determining whether the traffic data meets the requirement, and determining that the associated device of the traffic data to be detected is abnormal if the traffic data to be detected is abnormal, determining whether the corresponding associated device is abnormal by whether the feature information meets the requirement, detecting the working state of the traffic device in an indirect manner, and solving the problem that the abnormal working state of the traffic associated device cannot be detected in the related art, and the problem that the associated device fault cannot be found in time.

[0036] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more clear and simple. BRIEF DESCRIPTION OF DRAWINGS

[0037] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The schematic embodiments of the present application and the description thereof are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0038] Figure 1 is a schematic diagram of an application environment of the traffic data anomaly detection method of some embodiments of the present application;

[0039] Figure 2 is a flowchart of the traffic data anomaly detection method of some embodiments of the present application;

[0040] Figure 3 is a flowchart of determining traffic data anomaly based on the continuity index of some embodiments of the present application;

[0041] Figure 4 is a flowchart of obtaining the continuity index of some embodiments of the present application;

[0042] Figure 5 is a schematic diagram of dividing the period based on the data volume of some embodiments of the present application;

[0043] Figure 6 is a flowchart of determining traffic data anomaly based on the data volume index of some embodiments of the present application;

[0044] Figure 7 is a flowchart of determining traffic data anomaly based on the timeliness index of some embodiments of the present application;

[0045] Figure 8is a flowchart of determining traffic data anomaly based on the integrity index according to some embodiments of the present application;

[0046] Figure 9 is a flowchart of determining traffic data anomaly based on the validity index according to some embodiments of the present application;

[0047] Figure 10 is a flowchart of the traffic data anomaly detection method according to some preferred embodiments of the present application;

[0048] Figure 11 is a structural block diagram of the traffic data anomaly detection apparatus according to some embodiments of the present application. DETAILED DESCRIPTION

[0049] In order to more clearly understand the objects, technical solutions and advantages of the present application, the present application will be described and explained in detail below in connection with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0050] Unless otherwise defined, technical terms or scientific terms used in the present application shall have the general meaning understood by a person with ordinary skill in the art to which the present application belongs. In the present application, "one", "a", "an", "the", "these" and similar words do not represent a quantitative limitation, and they can be singular or plural. In the present application, the terms "include", "contain", "have" and any variants thereof are intended to cover non-exclusive inclusion; for example, a process, method and system, product or device containing a series of steps or modules (units) are not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. In the present application, the terms "connected", "connected", "coupled" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. In the present application, "multiple" means two or more. The association between the associated objects is described by the term "and / or", which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. In general, the character " / " represents an "or" relationship between the associated objects. In the present application, the terms "first", "second", "third" and the like are only used to distinguish similar objects, and do not represent a specific order of the objects.

[0051] The traffic data anomaly detection method provided by the embodiments of the present application can be applied to, for example, Figure 1In the application environment shown, the computing device 104 can be used to implement the traffic data anomaly detection method of this application embodiment. The computing device 104 accesses the traffic management business system 102 through a data access service to obtain the traffic data stored in the traffic management business system 102. The computing device 104 can be, but is not limited to, a server, workstation, personal computer, smartphone, tablet computer, etc. The traffic management business system 102 can be, but is not limited to, an independent server or a server cluster composed of multiple servers. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the configuration of the aforementioned application environment. For example, the traffic management system 102 and the computing device 104 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated. Traffic data from the traffic management system 102 can be stored on a local server, or on the cloud or other network servers.

[0052] The control unit of the computing device 104 may include one or more processors and a memory for storing data. The processor may include, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The control unit may also include transmission devices and input / output devices for communication functions, enabling it to communicate with a remote server via a network and perform data processing and storage through the remote server.

[0053] This embodiment provides a method for detecting traffic data anomalies. Figure 2 This is a flowchart of a traffic data anomaly detection method according to some embodiments of this application, such as... Figure 2 As shown, the process includes the following steps:

[0054] Step S201: Obtain the traffic data to be detected from the traffic management business system and extract the feature information of the traffic data to be detected.

[0055] The traffic data to be detected can include, but is not limited to, data generated by front-end devices such as checkpoints, electronic police systems, cameras, and detectors, such as vehicle passage data and violation data; as well as data obtained through analysis based on data generated by front-end devices, such as intelligent secondary analysis data; and can also include audit result data, equipment data, and organizational data used for further analysis or statistical analysis of this data. Equipment data refers to the device's unique identification number, used to uniquely identify the device corresponding to the traffic data. Organizational data can be the organizational information of the device, such as the traffic police squadron, used to determine the device's installation location. Audit result data can be the results of manual review of violation data, etc.

[0056] Different types of traffic data can have different contents. For example, the passing vehicle data can include license plate number, snapshot time; the illegal data can include illegal event type, illegal snapshot picture; the intelligent secondary analysis data can include snapshot picture, intelligent recognition result, etc. The feature information is determined according to the type of the traffic data and the detection requirement of the user on the type of traffic data. For example, for the passing vehicle data, the feature information can be the number of the passing vehicle data generated in a time period in the same toll gate, to determine whether the toll gate works normally; or can be the interval between the generation time and the storage time of the passing vehicle data, to determine whether the associated equipment on the transmission path from the toll gate to the traffic management business system database transmits the data in time.

[0057] The feature information can be directly obtained from the traffic data to be detected of the traffic management business system, or can be obtained by calculating or counting the traffic data to be detected.

[0058] Step S202, based on the feature information, determining whether the traffic data to be detected is abnormal.

[0059] Different feature information reflects the real state of the traffic data to be detected in the production, transmission, processing, use and other links, and thus can be used to determine whether the traffic data is abnormal. For different types of detection requirements, the feature information can be determined in combination with the corresponding detection index, to determine whether the traffic data to be detected is abnormal.

[0060] Step S203, if the traffic data to be detected is abnormal, determining that the associated equipment of the traffic data to be detected is abnormal.

[0061] The associated equipment is a traffic equipment for producing, transmitting, processing and using the traffic data to be detected, and has a close relationship with the traffic data to be detected in business. If the traffic data is determined to be abnormal, the traffic equipment associated with the business link of the traffic data can also be abnormal. For example, if the number of passing vehicle data generated by a toll gate in a time period is abnormally reduced, it can be suspected that the snapshot module or the data storage module of the toll gate equipment fails; if the number of passing vehicle data generated by the toll gate is normal, but the interval between the generation time and the storage time of the passing vehicle data is abnormally increased, it can be suspected that the transmission equipment from the toll gate to the database fails, or the transmission network is interrupted, etc.

[0062] By the steps S201-S203, the traffic data to be detected is acquired from the traffic management service system, and the feature information of the traffic data to be detected is extracted, the various traffic data generated by each traffic device is acquired without directly connecting with the traffic device, and the feature information used for determining whether the data meets the requirement is extracted; whether the traffic data to be detected is abnormal is determined based on the feature information, the feature information is used as the basis for determining whether the traffic data meets the requirement; if the traffic data to be detected is abnormal, it is determined that the associated device of the traffic data to be detected is abnormal, whether the corresponding associated device is abnormal is determined by whether the feature information meets the requirement, the working state of the traffic device is detected in an indirect way, and the problem that the abnormal working state of the traffic associated device cannot be detected in the related art, resulting in that the associated device failure cannot be found in time, is solved.

[0063] In some embodiments, the feature information includes at least one of a continuity feature value, a data volume feature value, a timeliness feature value, integrity feature information, and a validity feature value, and the method of determining whether the traffic data to be detected is abnormal based on the feature information includes:

[0064] Based on the feature information and the corresponding detection index, whether the traffic data to be detected is abnormal is determined.

[0065] The continuity detection can be used for, but is not limited to, continuous reporting of traffic data such as passing vehicles and illegal data. The continuity detection can monitor the device channels corresponding to multiple traffic devices in real time to determine whether there is a phenomenon of long-time non-reporting of data in the device channels, for example, the problem of queue accumulation leading to failure to timely store data. The continuity feature value can be a reporting time interval of the traffic data, and the reporting time interval can be obtained based on the difference between the reporting times of each data. The time interval can be counted according to the combination of different data types, different device numbers, different dates, different time periods, and the like. Specifically, the reporting time interval of the passing vehicle data corresponding to the same card mouth device in different time periods within a day can be counted, or the average reporting time interval of the passing vehicle data of multiple card mouth devices in the same time period can be counted.

[0066] The data volume detection can be used for, but is not limited to, traffic data with large daily data volume such as passing vehicles and illegal data. The data volume detection can be used for periodic or aperiodic data volume statistics of the device channels corresponding to multiple traffic devices to determine whether there is data volume abnormality in the transmission channel, for example, data volume abnormality caused by network interruption and the like. The data volume feature value can be the data volume of a certain device channel within a preset time range, or the difference, the rising or falling ratio, and the like obtained by comparing the data volume with the historical data volume within a certain range.

[0067] The timeliness detection can be used for traffic data such as overpass data that has high requirements on data timeliness. The timeliness detection can monitor the device channel corresponding to a plurality of traffic devices in real time to determine whether there is a problem of data delay reporting in the device channel. The timeliness feature value can be a real-time monitoring value of a data production time and a warehousing time difference of the device channel, or can be an average value obtained by segmenting according to a time period or a data amount.

[0068] The integrity detection can be used for, but is not limited to, traffic data such as illegal data that has high requirements on integrity. The integrity detection can monitor each device channel in real time to determine whether the traffic data is complete. The integrity feature information can include license plate number, snapshot time, event type, whether the picture can be normally viewed, and the like. For example, if the traffic data sent by a device channel has a problem of missing key fields or the picture cannot be normally opened, it is considered that the traffic data of the channel is not complete, and the traffic device obtaining the traffic data can be abnormal.

[0069] The validity detection can be used for, but is not limited to, traffic data such as overpass data and illegal data that has high requirements on validity. The validity refers to the validity of the traffic data for event analysis or identification. For example, in actual application, a traffic front-end device captures a traffic illegal scene to obtain a snapshot picture and sends the snapshot picture to a traffic management business system. The traffic management business system manually audits the snapshot picture in the illegal data and records an audit result, and determines the validity of the data according to the audit result. Possible reasons for causing invalid data include abnormal snapshot function of the device, low snapshot image quality, abnormal data transmission, and the like. The validity feature value can be an effective data amount or an effective data ratio sent by the device channel.

[0070] The above feature information can be combined with a corresponding detection index to determine whether the traffic data is abnormal. The detection index can be a threshold value set according to requirements, for example, a timeliness threshold value is set in advance, when the difference between the data production time and the warehousing time in the device channel is greater than the timeliness threshold value, it is determined that the traffic data is abnormal; the detection index can be a threshold value obtained according to historical data statistics, for example, the continuity threshold value is obtained by statistics according to historical data, when the data reporting time interval in the device channel is greater than the continuity threshold value, it is determined that the traffic data is abnormal; the detection index can also be a pre-determined detection standard, for example, the integrity detection standard is pre-determined to include the integrity of the license plate number information and the snapshot time information, and the snapshot picture can be normally opened, when it is monitored in real time that the traffic data does not meet the integrity detection standard, it is determined that the traffic data is abnormal.

[0071] The traffic data anomaly detection method in the embodiment determines whether the to-be-detected traffic data is abnormal based on the feature information and the corresponding detection index, gives a clear determination mode for the anomaly determination of the traffic data, that is, determines the detection index according to the demand or the historical related data, and determines whether the traffic data is abnormal according to the comparison or comparison result of the feature information and the corresponding detection index, so as to determine whether the associated equipment is abnormal, thereby expanding the detection mode of the traffic data associated equipment working state detection.

[0072] In some embodiments, the detection index corresponding to the continuity feature value is a continuity index, and the continuity feature value is determined based on a time interval of historical traffic data reported in different time periods. Figure 3 FIG. 4 is a flowchart of determining traffic data anomaly based on a continuity index according to some embodiments of the present application, as shown in FIG. 4, the flow includes the following steps: Figure 3

[0073] In step S301, a continuity index is obtained, which is determined based on a time interval of historical traffic data reported in different time periods.

[0074] In the embodiment, for the traffic equipment corresponding to the to-be-detected traffic data, the historical traffic data of the traffic equipment can be obtained and time period division can be performed, which can be divided into peak period and flat peak period according to the amount of data, or can be divided according to time, for example, one day is divided into 24 time periods according to hours. The average value of the time interval of the data reported in each time period is obtained, and the continuity index is determined according to the average value, for example, the average value is 1 minute, and the continuity index is less than or equal to 1 minute. The continuity index can also be determined as [μ-nσ, μ+nσ] according to the mean μ and the standard deviation σ of the time interval, and n can be set according to the demand.

[0075] In step S302, if the continuity feature value does not conform to the continuity index of the corresponding time period, it is determined that the to-be-detected traffic data is abnormal.

[0076] According to the threshold or threshold interval of the continuity index, it is determined whether the continuity feature value conforms.

[0077] Through the above steps S301-S302, the continuity index is obtained, which is determined based on a time interval of historical traffic data reported in different time periods, and the source and basis of the continuity index are clear. According to the threshold or threshold interval of the continuity index, it is determined whether the continuity feature value conforms, and whether the traffic data and the corresponding associated equipment are abnormal is determined through the continuity feature value, thereby expanding the detection mode of the traffic data associated equipment working state detection and improving the detection efficiency.

[0078] In some embodiments, Figure 4 ​is a flowchart of acquiring a continuity index of some embodiments of the present application, as shown in Figure 4 The flow includes the following steps:

[0079] Step S401, based on the reporting date of the traffic data to be detected, determine the historical reporting date in the historical traffic data that is the same as the weekly sequence day of the reporting date.

[0080] In practical applications, the reporting time continuity of traffic data may vary greatly on different dates and at different times. In order to more accurately determine the continuity index, the reporting date factor can be included in the determination process of the continuity index to more accurately determine whether the traffic data is abnormal. The reporting date can be obtained in the traffic data to be detected.

[0081] The same weekly sequence day means that the reporting date and the historical reporting date are the same day of the week. For example, in the case of reporting date being Monday, all the historical reporting dates corresponding to Monday in the historical traffic data of the device can be obtained.

[0082] Step S402, based on the historical reporting date, obtain the corresponding historical traffic data.

[0083] Step S403, determine the continuity index based on the historical traffic data.

[0084] Determine the continuity index according to the reporting time interval of the historical traffic data.

[0085] Through the above steps S401-S403, by obtaining the reporting date of the traffic data to be detected, the corresponding weekly sequence day is determined; by determining the historical reporting date in the historical traffic data that is the same as the weekly sequence day of the reporting date based on the reporting date, the corresponding historical reporting date is selected to avoid the difference in data reporting interval time caused by different weekly sequence days; by obtaining the corresponding historical traffic data based on the historical reporting date, the data source of the continuity index is obtained; by determining the continuity index based on the historical traffic data, the pertinence and accuracy of the continuity index are improved.

[0086] Further, in the above step S403, the continuity index of different time periods can also be determined by dividing the peak period and the flat period. The peak period and the flat period here are divided by the time distribution trend of the data. The method includes the following steps:

[0087] Step S11, based on a preset time interval, divide the reporting date into multiple micro time periods;

[0088] For example, 24 hours of a day can be divided into multiple micro time periods with 15 minutes as a sampling period.

[0089] Step S12: Based on the data reporting time of historical traffic data, determine the data volume X corresponding to the micro-period. i ;

[0090] Step S13: Generate a data volume sequence based on the time sequence of the micro-periods and the corresponding data volume;

[0091] This data sequence can be represented as {X1, X2, ..., X...} i , ..., X n}, 1≤i≤n.

[0092] Step S14: Perform ordered clustering on the data sequence to obtain at least two data segments;

[0093] Fisher's ordered clustering method or other ordered clustering segmentation methods can be used to perform ordered clustering segmentation on this data sequence, resulting in k data segments, where k ≥ 2. Ordered clustering segmentation can classify data without disrupting the data's order. In this embodiment, the data arranged in chronological order is not disrupted.

[0094] Step S15: Determine the corresponding time period based on the micro time periods corresponding to the data volume in at least two data segments;

[0095] Figure 5 This is a schematic diagram illustrating the time-segmentation based on data volume in some embodiments of this application, such as... Figure 5 As shown, based on the amount of data reported in different time periods, a day's 24 hours are divided into 6 time periods. Based on the average data reporting time interval of each time period, the continuity index corresponding to that time period is determined.

[0096] Step S16: Determine the continuity index for the period based on the reporting time interval of the historical traffic data corresponding to the period.

[0097] Through the above steps S11 to S16, the data volume of historical traffic data corresponding to the reporting date is statistically analyzed to obtain the basis for time period division; by dividing different time periods according to the data volume, the difference in data continuity caused by different time periods is avoided, which affects the accuracy of continuity indicators; by determining the continuity indicators of the time period based on the reporting time interval of the historical traffic data corresponding to the time period, the accuracy of judging whether traffic data and related traffic equipment are abnormal is improved.

[0098] In some of these embodiments, the detection index corresponding to the data volume feature value is the data volume index, and the data volume feature value is determined based on the data volume reported by the traffic data to be detected at different time periods. Figure 6 This is a flowchart illustrating the determination of traffic data anomalies based on data volume indicators in some embodiments of this application, such as... Figure 6 As shown, the process includes the following steps:

[0099] In step S601, a data volume index is obtained, which is determined based on the data volume reported by historical traffic data in different time periods.

[0100] In this embodiment, for the traffic device corresponding to the traffic data to be detected, historical traffic data of the traffic device on the same ordinal day can be obtained, or further time period division is performed, and the data volume of the corresponding historical traffic data in the same ordinal day and the same time period is obtained through statistics. The data volume index is calculated according to the mean value of the data volume. The index can be a threshold value or a threshold value interval.

[0101] In step S602, if the data volume feature value does not conform to the data volume index of the corresponding time period, it is determined that the traffic data to be detected is abnormal.

[0102] According to the threshold value or threshold value interval of the data volume index, it is determined whether the data volume feature value conforms.

[0103] Through the above steps S601-S602, by obtaining the data volume index determined based on the data volume reported by the historical traffic data in different time periods, the source and basis of obtaining the data volume index are clear. By determining that the traffic data to be detected is abnormal if the data volume feature value does not conform to the data volume index of the corresponding time period, the detection method of the traffic data correlation device working state detection is expanded, and the detection efficiency is improved.

[0104] In some embodiments, the detection index corresponding to the timeliness feature value is a timeliness index, and the timeliness feature value is determined based on the difference between the generation time and the storage time of the traffic data to be detected. Figure 7 is a flowchart for determining traffic data abnormality based on a timeliness index according to some embodiments of the present application, as shown in Figure 7 The flowchart includes the following steps:

[0105] In step S701, a timeliness index is determined based on a pre-set delay threshold value.

[0106] In actual application, the delay threshold value can be set according to the demand, and the delay threshold value is used as the timeliness index. The timeliness feature value can be equal to the difference between the generation time and the storage time of the traffic data.

[0107] In step S702, if the timeliness feature value does not conform to the timeliness index, it is determined that the traffic data to be detected is abnormal.

[0108] When the timeliness feature value is greater than the timeliness index, it is determined that the traffic data to be detected is abnormal; or when the timeliness feature value is negative, it indicates that the front-end device has not performed time correction, and the traffic data can also be determined to be abnormal, and the channel alarm is triggered to remind the device to perform time correction.

[0109] Through the steps S701-S702, the timeliness index is determined based on the pre-set delay threshold, the source and basis of the timeliness index are clear, and if the timeliness feature value does not meet the timeliness index, it is determined that the traffic data to be detected is abnormal, the detection method of the traffic data correlation equipment working state detection is expanded, and the detection efficiency is improved.

[0110] In some embodiments, the detection index corresponding to the integrity feature information is an integrity index. Figure 8 is a flowchart of determining traffic data anomaly based on the integrity index according to some embodiments of the present application, as shown in the figure, the flow includes the following steps: Figure 8

[0111] Step S801, determine the integrity index based on the pre-determined traffic data type.

[0112] In practical applications, the integrity index can be defined according to the needs, for example, whether the information of the traffic data type such as license plate number, snapshot time, event type, and whether the picture can be normally viewed is complete. When any one of the information is missing or cannot be obtained, it is determined that the integrity feature information does not meet the integrity index.

[0113] Step S802, if the integrity feature information does not meet the integrity index, it is determined that the traffic data to be detected is abnormal.

[0114] Through the steps S801-S802, the integrity index is determined based on the pre-determined traffic data type, the source and basis of the integrity index are clear, and if the integrity feature information does not meet the integrity index, it is determined that the traffic data to be detected is abnormal, the detection method of the traffic data correlation equipment working state detection is expanded, and the detection efficiency is improved.

[0115] In some embodiments, the detection index corresponding to the validity feature value is an effectiveness index, and the validity feature value is determined based on the effective data proportion of the traffic data to be detected. Figure 9 is a flowchart of determining traffic data anomaly based on the effectiveness index according to some embodiments of the present application, as shown in the figure, the flow includes the following steps: Figure 9

[0116] Step S901, determine the effectiveness index based on the pre-set effectiveness threshold.

[0117] ​​In actual application, the effectiveness threshold can be set according to the requirement, and the effectiveness threshold is used as the effectiveness index. The effectiveness characteristic value can be equal to the ratio of the effective data amount to the total data amount in the channel traffic data. For example, the total amount of illegal data in each channel is detected, and the amount of data passed by manual review is obtained, so as to calculate the proportion of effective illegal data; for example, the total amount of passing vehicle data in each channel is detected, and the amount of successful intelligent secondary analysis data is obtained, so as to calculate the proportion of successful analysis data.

[0118] In step S902, if the effectiveness characteristic value does not meet the effectiveness index, it is determined that the traffic data to be detected is abnormal.

[0119] When the effectiveness characteristic value is less than the effectiveness index, it is determined that the traffic data to be detected is abnormal.

[0120] Through the above steps S901-S902, the effectiveness index is determined based on the pre-set effectiveness threshold, the source and basis of the effectiveness index are clear, and the detection method of the traffic data correlation equipment working state detection is expanded, and the detection efficiency is improved.

[0121] The preferred embodiment will be described and explained below.

[0122] Figure 10 is a flowchart of the traffic data anomaly detection method of the preferred embodiment. As shown in Figure 10 , the flowchart includes the following steps:

[0123] In step S1001, traffic data to be detected is obtained from a traffic management business system. The traffic data is not limited to passing vehicle data, illegal data, intelligent secondary analysis data, review results, and device / organization data, and the obtained form is not limited to business platform docking, database docking, and the like.

[0124] In step S1002, a date same as a date of the day of the traffic data to be detected is obtained from historical traffic data.

[0125] In step S1003, historical traffic data corresponding to the date is obtained.

[0126] In step S1004, the Fisher ordered sample clustering method is used to divide the date into multiple time periods based on the data amount corresponding to each time period in the historical traffic data.

[0127] In step S1005, the data reporting time interval mean μ1 and the standard deviation σ1 corresponding to each time period are obtained, and the continuity index corresponding to the time period is determined as [μ1-3σ1, μ1+3σ1].

[0128] Step S1006, according to the time period division mode, the reporting time interval of the to-be-detected traffic data in each time period is counted as a continuity characteristic value;

[0129] Step S1007, in the case where the continuity characteristic value does not fall within the continuity index [μ1-3σ1, μ1+3σ1] range of the corresponding time period, it is determined that the to-be-detected traffic data is abnormal;

[0130] Step S1008, the data quantity mean μ2 and the standard deviation σ2 of the data corresponding to the same date as the reporting date of the to-be-detected traffic data in the historical traffic data are counted, and the data quantity index is determined as [μ2-3σ2, μ2+3σ2];

[0131] Step S1009, the data quantity of the reporting date of the to-be-detected traffic data is counted as a data quantity characteristic value;

[0132] Step S1010, in the case where the data quantity characteristic value does not fall within the data quantity index [μ2-3σ2, μ2+3σ2] range, it is determined that the to-be-detected traffic data is abnormal;

[0133] Step S1011, the timeliness index of the traffic data is determined as a pre-set delay threshold;

[0134] Step S1012, the difference between the data generation time and the storage time interval of the to-be-detected traffic data is counted as a timeliness characteristic value;

[0135] Step S1013, in the case where the difference is greater than the delay threshold, it is determined that the to-be-detected traffic data is abnormal;

[0136] Step S1014, the completeness index of the traffic data includes the completeness of any one of the four pieces of information of license plate number, snapshot time, event type, and whether the picture is normally viewed;

[0137] Step S1015, the above four pieces of information of the to-be-detected traffic data are detected;

[0138] Step S1016, in the case where any one of the four pieces of information is incomplete, it is determined that the to-be-detected traffic data is abnormal;

[0139] Step S1017, the validity index of the traffic data is determined as a pre-set validity threshold;

[0140] Step S1018, the ratio of the valid data quantity and the total data quantity of the to-be-detected traffic data is counted as a validity characteristic value;

[0141] Step S1019, in the case where the ratio is less than the validity threshold, it is determined that the to-be-detected traffic data is abnormal;

[0142] Step S1020, according to any determination result of steps S1007, S1010, S1013, S1016, S1019, it is determined that the associated equipment of the traffic data to be detected is abnormal.

[0143] Through the above steps S1001 to S1020, the traffic data to be detected is obtained by connecting with the traffic management business system data, the data source for determining abnormal data is obtained without directly connecting with the traffic equipment; the historical traffic data of the same week sequence day as the traffic data to be detected is obtained, and the time period is divided for statistics, the corresponding continuity index is obtained, and the continuity characteristic value of the traffic data to be detected is obtained according to the time period division, and the two are compared correspondingly, which improves the accuracy of the abnormal data determination; the characteristic value is detected based on the timeliness, integrity and effectiveness indexes set in advance, which expands the mode of abnormal data determination; the working state of the traffic equipment is detected in an indirect way, which solves the problem that the abnormal working state of the traffic associated equipment cannot be detected in the related art, and the associated equipment failure cannot be found in time.

[0144] It should be noted that the steps shown in the above process or the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from here.

[0145] In some embodiments, the present application also provides a traffic data anomaly detection device for implementing the above embodiments and preferred embodiments, which have been described and will not be repeated. The terms "module", "unit", "sub-unit" and the like used below can be a combination of software and / or hardware that can implement a predetermined function.

[0146] In some embodiments, Figure 11 is a structural block diagram of the traffic data anomaly detection device of the present embodiment, as Figure 11 shown, the device comprises:

[0147] The acquisition module 1101 is configured to acquire the traffic data to be detected from the traffic management business system, and extract the feature information of the traffic data to be detected.

[0148] The first determination module 1102 is configured to determine whether the traffic data to be detected is abnormal based on the feature information.

[0149] The second determination module 1103 is configured to determine that the associated equipment of the traffic data to be detected is abnormal if the traffic data to be detected is abnormal.

[0150] The traffic data anomaly detection apparatus in the embodiment, through the obtaining module 1101, obtains the traffic data to be detected from the traffic management business system, and extracts the feature information of the traffic data to be detected, obtains various traffic data generated by each traffic device without directly connecting with the traffic device, and extracts the feature information for determining whether the data meets the requirements; through the first determination module 1102, based on the feature information, determine whether the traffic data to be detected is abnormal, the feature information is used as the basis for determining whether the traffic data meets the requirements; if the traffic data to be detected is abnormal, the second determination module 1103 is used to determine that the associated device of the traffic data to be detected is abnormal, whether the corresponding associated device is abnormal is determined by whether the feature information meets the requirements, the working state of the traffic device is detected in an indirect way, and the problem that the abnormal working state of the traffic associated device cannot be detected in the related art, which leads to the problem that the associated device fault cannot be found in time, is solved.

[0151] In some embodiments, the feature information includes at least one of a continuity feature value, a data volume feature value, a timeliness feature value, integrity feature information, and a validity feature value, and the first determination module includes a determination submodule, which is configured to determine whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index.

[0152] The traffic data anomaly detection apparatus in the embodiment determines whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index through the determination submodule, and gives a clear determination method for the abnormality determination of the traffic data, that is, determines the detection index according to the demand or historical related data, and determines whether the traffic data is abnormal according to the comparison or comparison result of the feature information and the corresponding detection index, so as to determine whether the associated device is abnormal, thereby expanding the detection method of the traffic data associated device working state detection.

[0153] In some embodiments, the continuity feature value corresponds to a continuity index, and the continuity feature value is determined based on the time interval of the data reported by the different time period data of the traffic data to be detected; the determination submodule includes a first obtaining unit and a first determination unit, the first obtaining unit is configured to obtain the continuity index, which is determined based on the time interval of the historical traffic data reported by the different time period data, and the first determination unit is configured to determine that the traffic data to be detected is abnormal if the continuity feature value does not meet the continuity index of the corresponding period.

[0154] The traffic data anomaly detection device in the embodiment acquires the continuity index through the first acquisition unit, the continuity index is determined based on time intervals of data reported in different time periods of historical traffic data, and the source and basis of the continuity index are clear. The first determination unit determines whether the continuity characteristic value is consistent according to the threshold or threshold interval of the continuity index, and determines whether the traffic data and the corresponding associated device are abnormal through the continuity characteristic value, thereby expanding the detection method of the traffic data associated device working state detection and improving the detection efficiency.

[0155] In some embodiments, the first acquisition unit includes a first determination subunit, an acquisition subunit, and a second determination subunit. The first determination subunit is configured to determine a historical reporting date that is the same as a weekly sequence date of a reporting date of the traffic data to be detected based on the reporting date. The acquisition subunit is configured to acquire corresponding historical traffic data based on the historical reporting date. The second determination subunit is configured to determine the continuity index based on the historical traffic data.

[0156] The traffic data anomaly detection device in the embodiment acquires the reporting date of the traffic data to be detected through the first determination subunit, and determines the corresponding weekly sequence date. The historical reporting date that is the same as the weekly sequence date of the reporting date is determined based on the reporting date, and the corresponding historical reporting date is selected to avoid differences in data reporting interval time caused by different weekly sequence dates. The corresponding historical traffic data is acquired based on the historical reporting date through the acquisition subunit to obtain the data source of the continuity index. The continuity index is determined based on the historical traffic data through the second determination subunit to improve the pertinence and accuracy of the continuity index.

[0157] In some embodiments, the detection index corresponding to the data volume characteristic value is a data volume index, and the data volume characteristic value is determined based on data volumes reported in different time periods of the traffic data to be detected. The determination sub-module includes a second acquisition unit and a second determination unit. The second acquisition unit is configured to acquire the data volume index, which is determined based on data volumes reported in different time periods of historical traffic data. The second determination unit is configured to determine that the traffic data to be detected is abnormal if the data volume characteristic value does not conform to the data volume index of the corresponding time period.

[0158] The traffic data anomaly detection device in the embodiment acquires the data volume index through the second acquisition unit, the data volume index is determined based on data volumes reported in different time periods of historical traffic data, and the source and basis of the data volume index are clear. If the data volume characteristic value does not conform to the data volume index of the corresponding time period, the second determination unit is used to determine that the traffic data to be detected is abnormal, thereby expanding the detection method of the traffic data associated device working state detection and improving the detection efficiency.

[0159] In some embodiments, the detection index corresponding to the timeliness feature value is a timeliness index, and the timeliness feature value is determined based on a difference between the generation time and the storage time of the traffic data to be detected. The determination submodule includes a third acquisition unit and a third determination unit. The third acquisition unit is configured to determine the timeliness index based on a pre-set delay threshold. The third determination unit is configured to determine that the traffic data to be detected is abnormal if the timeliness feature value does not meet the timeliness index.

[0160] The traffic data anomaly detection apparatus in the embodiment determines the timeliness index based on the pre-set delay threshold through the third acquisition unit, and clearly determines the source and basis of the timeliness index. If the timeliness feature value does not meet the timeliness index, the third determination unit is used to determine that the traffic data to be detected is abnormal, thereby expanding the detection method of the traffic data correlation device working state detection and improving the detection efficiency.

[0161] In some embodiments, the detection index corresponding to the integrity feature information is an integrity index. The determination submodule includes a fourth acquisition unit and a fourth determination unit. The fourth acquisition unit is configured to determine the integrity index based on a pre-determined traffic data type. The fourth determination unit is configured to determine that the traffic data to be detected is abnormal if the integrity feature information does not meet the integrity index.

[0162] The traffic data anomaly detection apparatus in the embodiment determines the integrity index based on the pre-determined traffic data type through the fourth acquisition unit, and clearly determines the source and basis of the integrity index. If the integrity feature information does not meet the integrity index, the fourth determination unit is used to determine that the traffic data to be detected is abnormal, thereby expanding the detection method of the traffic data correlation device working state detection and improving the detection efficiency.

[0163] In some embodiments, the determination submodule includes a fifth acquisition unit and a fifth determination unit. The fifth acquisition unit is configured to determine an effectiveness index based on a pre-set effectiveness threshold. The fifth determination unit is configured to determine that the traffic data to be detected is abnormal if the effectiveness feature value does not meet the effectiveness index.

[0164] The traffic data anomaly detection apparatus in the embodiment determines the effectiveness index based on the pre-set effectiveness threshold through the fifth acquisition unit, and clearly determines the source and basis of the effectiveness index. If the effectiveness feature value does not meet the effectiveness index, the fifth determination unit is used to determine that the traffic data to be detected is abnormal, thereby expanding the detection method of the traffic data correlation device working state detection and improving the detection efficiency.

[0165] In some embodiments, the application further provides a traffic operation and maintenance system, comprising: an access device configured to access a traffic management service system through a data access service and obtain traffic data to be detected; the traffic data anomaly detection device in the above embodiments configured to perform anomaly detection on the traffic data to be detected; and an alarm device configured to perform alarm based on the detection result.

[0166] The traffic operation and maintenance system in the present embodiment accesses the traffic management service system through the access device, obtains various traffic data generated by each traffic device without directly connecting with the traffic device; the traffic data anomaly detection device extracts feature information of the data to be detected and corresponding historical data from the traffic data, determines whether the traffic data to be detected is abnormal based on the feature information, and further determines whether the associated traffic device is abnormal; the alarm device generates a corresponding alarm signal to prompt maintenance of the associated traffic device determined to be abnormal.

[0167] In addition, in combination with the traffic data anomaly detection method provided in the above embodiments, a storage medium can also be provided in the present embodiment to realize the method. The storage medium stores a computer program; and the computer program is executed by a processor to realize any one of the traffic data anomaly detection methods in the above embodiments.

[0168] It should be noted that the specific examples in the present embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein again.

[0169] It should be understood that the specific embodiments described herein are only used to explain the application, but not to limit it. According to the embodiments provided in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0170] Obviously, the drawings are only some examples or embodiments of the present application, and those of ordinary skill in the art can also apply the present application to other similar situations without creative labor. In addition, it can be understood that although the work done in the development process may be complex and long, some design, manufacture or production changes made by those of ordinary skill in the art according to the technical content disclosed in the present application are only routine technical means and should not be regarded as insufficient disclosure of the present application.

[0171] The word "implementation" in this application refers to the specific features, structures, or characteristics described in connection with an implementation can be included in at least one implementation of the present application. The phrase appears in various places throughout the specification is not necessarily meant to refer to the same implementation, nor is it meant to imply that the features, structures, or characteristics so described can not be implemented in other implementations. It will be apparent to those having ordinary skill in the art that the implementations described herein can be combined with other implementations without losing the intended effect.

[0172] The above-described implementations only express several implementation manners of the present application, which are described in detail and specifically, but cannot be understood as the limitation of the patent protection scope. It should be pointed out that for ordinary skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, which all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A traffic data anomaly detection method, characterized in that, The method comprises: obtaining traffic data to be detected from a traffic management service system, and extracting feature information of the traffic data to be detected, the feature information comprising a continuity characteristic value; determining whether the traffic data to be detected is abnormal based on the feature information and a corresponding detection index; if the traffic data to be detected is abnormal, determining that an associated device of the traffic data to be detected is abnormal; wherein the detection index corresponding to the continuity characteristic value is a continuity index, and the continuity index is determined in the following manner: obtaining historical traffic data corresponding to a reporting date of the traffic data to be detected; dividing the reporting date into a plurality of micro time periods based on a preset time interval; determining data volume corresponding to the micro time periods based on data reporting times of the historical traffic data; generating a data volume sequence based on time sequences of the micro time periods and the data volume corresponding to the micro time periods; performing ordered cluster segmentation on the data volume sequence to obtain at least two data segments; determining corresponding time periods based on the micro time periods corresponding to the data volume in the at least two data segments; determining the continuity index corresponding to the time periods based on reporting time intervals of the historical traffic data corresponding to the time periods.

2. The method of claim 1, wherein, The feature information comprises at least one of a continuity characteristic value, a data volume characteristic value, a timeliness characteristic value, completeness characteristic information, and an effectiveness characteristic value.

3. The method of claim 2, wherein, The continuity characteristic value is determined based on time intervals of reporting data of different time periods of the traffic data to be detected; and the determination of whether the traffic data to be detected is abnormal based on the feature information and a corresponding detection index comprises: obtaining a continuity index determined based on time intervals of reporting data of different time periods of historical traffic data; if the continuity characteristic value does not conform to the continuity index of the corresponding time period, determining that the traffic data to be detected is abnormal.

4. The method of claim 3, wherein, The obtaining of the continuity index determined based on time intervals of reporting data of different time periods of historical traffic data comprises: determining a historical reporting date same as a sequence date of the reporting date of the traffic data to be detected based on the reporting date of the traffic data to be detected; obtaining corresponding historical traffic data based on the historical reporting date; determining the continuity index based on the historical traffic data.

5. The method of claim 2, wherein, The detection index corresponding to the data volume characteristic value is a data volume index, and the data volume characteristic value is determined based on data volume reported by different time periods of the traffic data to be detected; and the determination of whether the traffic data to be detected is abnormal based on the feature information and a corresponding detection index comprises: obtaining a data volume index determined based on data volume reported by different time periods of historical traffic data; if the data volume characteristic value does not conform to the data volume index of the corresponding time period, determining that the traffic data to be detected is abnormal.

6. The method of claim 2, wherein, The detection index corresponding to the timeliness feature value is a timeliness index, and the timeliness feature value is determined based on a difference between a generation time and a storage time of the traffic data to be detected; and the determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index includes: determining the timeliness index based on a pre-set delay threshold; if the timeliness feature value does not conform to the timeliness index, determining that the traffic data to be detected is abnormal.

7. The method of claim 2, wherein, The detection index corresponding to the integrity feature information is an integrity index; and the determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index includes: determining the integrity index based on a pre-determined traffic data type; if the integrity feature information does not conform to the integrity index, determining that the traffic data to be detected is abnormal.

8. The method of claim 2, wherein, The detection index corresponding to the validity feature value is a validity index, and the validity feature value is determined based on a proportion of valid data of the traffic data to be detected; and the determining whether the traffic data to be detected is abnormal based on the feature information and the corresponding detection index includes: determining the validity index based on a pre-set validity threshold; if the validity feature value does not conform to the validity index, determining that the traffic data to be detected is abnormal. 9.A traffic data anomaly detection apparatus, characterized by comprising: The traffic data anomaly detection device includes: an acquisition module configured to acquire traffic data to be detected from a traffic management business system, and extract feature information of the traffic data to be detected, the feature information including a continuity feature value; a first determination module configured to determine whether the traffic data to be detected is abnormal based on the feature information, wherein the detection index corresponding to the continuity feature value is a continuity index, and the continuity index is determined in the following manner: historical traffic data corresponding to a reporting date of the traffic data to be detected is acquired; the reporting date is divided into a plurality of micro time periods based on a pre-set time interval; data volume corresponding to the micro time periods is determined based on data reporting times of the historical traffic data; a data volume sequence is generated based on time sequences of the micro time periods and the data volume corresponding to the micro time periods; the data volume sequence is subjected to ordered cluster segmentation to obtain at least two data segments; time periods corresponding to the data volume in the at least two data segments are determined; and a continuity index corresponding to the time periods is determined based on reporting time intervals of the historical traffic data corresponding to the time periods; a second determination module configured to determine that a related device of the traffic data to be detected is abnormal if the traffic data to be detected is abnormal.

10. A traffic operation system, characterized by comprising: The traffic operation and maintenance system includes: an access device configured to access a traffic management business system through a data access service and acquire traffic data to be detected, a traffic data anomaly detection device as claimed in claim 9 configured to perform anomaly detection on the traffic data to be detected, and an alarm device configured to perform alarm based on a detection result.

Images