A service quality anomaly detection method, device and equipment

Abstract

The application provides a service quality anomaly detection method, device and equipment, the method comprises the following steps: obtaining service timing data; performing migration operation on a first preset number of data and a second preset number of data of the service timing data to obtain to-be-detected timing data; performing timing decomposition on the to-be-detected timing data to obtain random residuals of the to-be-detected timing data; inputting the to-be-detected timing data and the random residuals into a preset service quality detection model respectively to perform service quality anomaly detection processing, and obtaining a service quality anomaly detection result. The above scheme of the application can realize high-precision service quality anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, apparatus and equipment for detecting service quality anomalies. Background Technology

[0002] There are two approaches to detecting business quality anomalies: one is to use a supervised model, and the other is to use an empirical threshold or an unsupervised model.

[0003] Supervised business quality anomaly detection involves associating label data with feature data of the business process based on test results, obtaining training data, training the model based on a conventional supervised model, inputting the business quality features to be evaluated into the model, and obtaining evaluation labels. There are three techniques for business quality anomaly detection using experience thresholds or unsupervised methods: (1) Expert threshold: based on expert experience, thresholds are specified for some indicators, and an alarm is issued when the indicator is lower or higher than the threshold; (2) Dynamic threshold method: based on historical data, data analysis is performed on the indicators to obtain the upper limit threshold and lower limit threshold of the data, and an alarm is issued when the indicator exceeds the threshold range; (3) Temporal decomposition method: based on historical data, the feature indicators are decomposed temporally, the components after temporal decomposition are analyzed, and an alarm is issued for data at abnormal times.

[0004] The threshold-based detection method has poor robustness and cannot fully consider the characteristics and temporal features of each feature, making it ineffective for quality anomaly detection in high-precision services. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a method, apparatus, and equipment for detecting service quality anomalies. This enables high-precision detection of service quality anomalies.

[0006] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0007] A method for detecting business quality anomalies, the method comprising:

[0008] Obtain business time-series data;

[0009] A migration operation is performed on a first preset number of data points and a second preset number of data points of the business time series data to obtain the time series data to be detected;

[0010] The time series data to be detected is decomposed into time series data to obtain the random residuals of the time series data to be detected.

[0011] The time series data to be detected and the random residual are respectively input into a preset service quality detection model for service quality anomaly detection processing to obtain service quality anomaly detection results.

[0012] Optionally, a migration operation is performed on a first preset number of data points and a second preset number of data points of the business time-series data to obtain the time-series data to be detected, including:

[0013] From the historical data, obtain a first preset number of first historical data that matches the first preset number of data and a second preset number of second historical data that matches the second preset number of data;

[0014] The first preset number of first historical data, the business time sequence data, and the second preset number of second historical data are connected to obtain the time sequence data to be detected.

[0015] Optionally, obtaining a first preset number of first historical data matching the first preset number of data and a second preset number of second historical data matching the second preset number of data includes:

[0016] Obtain a first preset number of historical data that corresponds in time to the first preset number of data and has a similarity greater than a preset value, and a second preset number of historical data that corresponds in time to the second preset number of data and has a similarity greater than a preset value.

[0017] Optionally, the time-series data to be detected is subjected to time-series decomposition to obtain the random residuals of the time-series data to be detected, including:

[0018] Feature data trend extraction is performed on the time series data to be detected to obtain trend components;

[0019] The periodic components are calculated from the time series data to be detected to obtain the periodic components;

[0020] The random residual of the time series data to be detected is obtained based on the time series data to be detected, the trend component, and the periodic component.

[0021] Optionally, the random residual of the time series data to be detected is obtained based on the time series data to be detected, the trend component, and the periodic component, including:

[0022] The random residual of the time series data to be detected is obtained according to the formula: Random Residual = Time Series Data to be Detected - Trend Component - Periodic Component.

[0023] Optionally, the time-series data to be detected and the random residual are respectively input into a preset service quality detection model for service quality anomaly detection processing to obtain service quality anomaly detection results, including:

[0024] The time series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results;

[0025] The random residual is input into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results;

[0026] Based on multiple first detection results and multiple second detection results, a business quality anomaly detection result is obtained.

[0027] Optionally, the time-series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results, including:

[0028] The time series data to be detected is input into the clustering model and autoencoder of the first business quality detection sub-model of the preset business quality detection model for classification processing, resulting in multiple first detection results.

[0029] Optionally, the random residual is input into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results, including:

[0030] The random residuals are input into the clustering model and autoencoder of the second business quality detection sub-model of the preset business quality detection model to classify the residual values ​​and obtain multiple second detection results.

[0031] Optionally, based on multiple first detection results and multiple second detection results, a service quality anomaly detection result is obtained, including:

[0032] A voting process is performed on multiple first detection results to obtain the first target detection result;

[0033] A voting process is performed on multiple second detection results to obtain a second target detection result;

[0034] The business quality anomaly detection result is obtained based on the first target detection result and the second target detection result.

[0035] Embodiments of the present invention also provide a business quality anomaly detection device, comprising:

[0036] The acquisition module is used to acquire business time-series data;

[0037] The processing module is used to perform migration operations on a first preset number of data and a second preset number of data of the business time series data to obtain the time series data to be detected; to perform time series decomposition on the time series data to be detected to obtain the random residual of the time series data to be detected; and to input the time series data to be detected and the random residual into a preset business quality detection model respectively for business quality anomaly detection processing to obtain the business quality anomaly detection result.

[0038] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above.

[0039] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above.

[0040] The above-described solution of the present invention has at least the following beneficial effects:

[0041] By performing a migration operation on a first preset number of data points at the beginning and a second preset number of data points at the end of the business time-series data, the time-series data to be detected is obtained. The time-series data to be detected is then decomposed to obtain the random residuals, which refer to the influence of various accidental factors on the time series, i.e., abnormal data points. The time-series data to be detected and the random residuals are then input into a preset business quality detection model for business quality anomaly detection processing to obtain business quality anomaly detection results. This solves the problem of some sample points being undetectable during time-series decomposition smoothing, enabling high-precision business quality anomaly detection. Attached Figure Description

[0042] Figure 1 This is a flowchart of the service quality anomaly detection method provided in this embodiment of the invention;

[0043] Figure 2 This refers to the time-series data to be detected in the service quality anomaly detection method provided in this embodiment of the invention;

[0044] Figure 3 It is the trend item of the time series data to be detected in the business quality anomaly detection method provided in this embodiment of the invention;

[0045] Figure 4 This refers to the seasonal item of the time-series data to be detected in the business quality anomaly detection method provided in this embodiment of the invention;

[0046] Figure 5 It refers to the random residual of the time-series data to be detected in the service quality anomaly detection method provided in this embodiment of the invention;

[0047] Figure 6 This is a schematic diagram of the preset business quality detection model in the business quality anomaly detection method provided in this embodiment of the invention;

[0048] Figure 7 This is a schematic diagram of the module block of the service quality anomaly detection device provided in the embodiment of the present invention. Detailed Implementation

[0049] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0050] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting service quality anomalies, including:

[0051] Step 11, obtain business time-series data; here, business time-series data can be XDR (External Data Representation) data of various business categories, such as HTTP (Hypertext Transfer Protocol) requests for various services such as high-precision voice and video, etc., which can be represented by D{D1, D2, ..., Dn-1, Dn}. The business time-series data D is time series data, including n data elements, D1, D2, ..., Dn-1, Dn, each data element representing business data at a certain moment;

[0052] Step 12: Perform a migration operation on the first preset number of data and the second preset number of data in the business time series data to obtain the time series data to be detected; here, the first preset number of data is like D1, D2, etc. in the above business time series data D, and the second preset number of data is like Dn-1, Dn, etc. in the above business time series data D.

[0053] Step 13: Perform time series decomposition on the time series data to be detected to obtain the random residuals of the time series data to be detected; here, random residuals refer to the influence of various accidental factors on the time series, which can reflect abnormal data in the business time series data, etc.

[0054] Step 14: Input the time series data to be detected and the random residual into the preset service quality detection model to perform service quality anomaly detection processing and obtain the service quality anomaly detection result.

[0055] In this embodiment, the business time-series data is obtained after preprocessing the original time-series data. In anomaly detection scenarios, the original time-series data often contains missing information, which may cause data clustering, grouping, deletion, or truncation. Therefore, it needs to be cleaned, mainly including steps such as handling missing values ​​and data deduplication. If the missing values ​​in the original time-series data exceed a certain proportion, such as more than half of the samples or variables, then the information contained in this sample or variable is limited. In this case, the entire sample or variable is removed from the data, i.e., the missing values ​​are deleted. Otherwise, the mean of nearby data samples is filled into the missing position as its value, or the mean of the existing data of the variable can be calculated and then filled into the missing position.

[0056] This embodiment obtains the time-series data to be detected by performing a migration operation on a first preset number of data points at the beginning and a second preset number of data points at the end of the time-series data. The time-series data to be detected is then decomposed to obtain the random residuals, which refer to the influence of various accidental factors on the time series, i.e., abnormal data points. The time-series data to be detected and the random residuals are then input into a preset service quality detection model for service quality anomaly detection processing to obtain the service quality anomaly detection results. This solves the problem of some sample points being undetectable during time-series decomposition smoothing, and enables high-precision service quality anomaly detection.

[0057] In an optional embodiment of the present invention, step 12 may include:

[0058] Step 121: In the historical data, obtain a first preset number of first historical data that matches the first preset number of data and a second preset number of second historical data that matches the second preset number of data.

[0059] Specifically, a first preset number of historical data that corresponds to the first preset number of data in time and has a similarity greater than a preset value is obtained, and a second preset number of historical data that corresponds to the second preset number of data in time and has a similarity greater than a preset value is obtained.

[0060] Step 122 connects the first preset number of first historical data, the business time sequence data, and the second preset number of second historical data to obtain the time sequence data to be detected.

[0061] In this embodiment, when using a time series decomposition algorithm to decompose business time-series data D, the algorithm needs to configure a periodicity n. (p)The parameters and smoothing parameter n will result in D1, D2, etc., at the beginning of the business time series data D, while Dn-1, Dn, etc., at the end will not have decomposition results. Historical data corresponding to D1 at a time and having a similarity higher than a preset value than D1 will be migrated into the business time series data. Similarly, historical data corresponding to D2 will be migrated into the business time series data, and historical data corresponding to Dn-1 and Dn will be migrated into the business time series data. This allows D1 and D2 to be decomposed based on their corresponding historical data, and Dn-1 and Dn to be decomposed based on their corresponding historical data. In other words, data that meets the time and similarity criteria at corresponding historical moments will be migrated to the time series data to be detected. This allows for effective time series decomposition of the business time series data D and enables relatively accurate prediction of anomalies.

[0062] The execution flow of a specific time series decomposition algorithm is as follows:

[0063] Input: Periodic n (p) The parameters and smoothing parameter n determine the start date Date0, time Time0, and the characteristic value Data0 of the number of HTTP requests at that time, and the counter count = 1;

[0064] Step 1: Read the HTTP request count feature value Data_temp0 of the time Time0 (Date0-7*count) in the historical data, and calculate threshold0 = |(Data_temp0-Data0) / Data0|;

[0065] Step 2: If threshold >= 10%, count = count + 1 and count <= 4, go to Step 1;

[0066] Step 3: If threshold >= 10%, count = count + 1 and count > 4, then count = 1;

[0067] Step 4: Otherwise, read the data Data_new (i.e., the first preset number of first historical data or the second preset number of second historical data) from the historical data with a length of () before the date and time Time0 of D0-7*count.

[0068] Step 5 (Step 1): Connect Data_new and Data0 to obtain Data (time series data to be detected);

[0069] Output: Data.

[0070] In an optional embodiment of the present invention, step 13 may include:

[0071] Step 131: Extract feature data trends from the time series data to be detected to obtain trend components;

[0072] Step 132: Calculate the periodic components of the time series data to be detected to obtain the periodic components;

[0073] Step 133: Obtain the random residual of the time series data to be detected based on the time series data to be detected, the trend component, and the periodic component.

[0074] Specifically, according to the formula: Random Residual = Time Series Data to be Detected - Trend Component - Periodic Component, the residual component of the time series data to be detected, i.e., the random residual, is obtained.

[0075] In this embodiment, the periodic component is regressed using the aforementioned time series decomposition algorithm. Then, the original sequence and the periodic component are subtracted to obtain the de-periodic component (containing residual noise). Finally, this component is smoothed to remove noise, yielding the trend component. The residual component is obtained by subtracting the periodic component from the original sequence and then subtracting the trend component.

[0076] The algorithm consists of an inner loop and an outer loop. The inner loop primarily handles feature data trend fitting and calculation of periodic components. The outer loop mainly adjusts robust weights. The results include the long-term trend, seasonality, and random residuals. The trend (long-term trend) refers to a sustained trend in a certain direction over a period of time, representing a long-term characteristic. The seasonality refers to data fluctuations caused by seasonal or periodic changes, representing a periodic characteristic. The random residuals refer to the influence of various random factors on the time series.

[0077] like Figure 2 The image shows the time series data to be detected; Figure 3 The trend term of the time series data to be detected; Figure 4 For the seasonal item of the time series data to be tested, Figure 5 The random residuals of the time series data to be detected; from Figures 2 to 4 It can be seen that, Figure 2 The outliers, outliers, outliers, and outliers in the time series data to be detected are... Figure 5 The corresponding position in the data is represented by the random residuals, indicating the outlier.

[0078] The execution flow of a specific time series decomposition algorithm is as follows, illustrated using a time series represented by the number of HTTP requests:

[0079] Input: Traffic size and number of HTTP requests;

[0080] Step 1: Detrend removal, i.e., removing the trend from the previous iteration from the time series data to be tested. In the initial case

[0081] Step 2: Periodic subsequence smoothing. Perform LOESS regression on each subsequence, extending the cycle by one period before and after each subsequence. The smoothing parameter is n. (s) The smoothing result is

[0082] Step 3: Low-throughput filtering of periodic subsequences, i.e., filtering the smoothed results from Step 2. Perform sequentially the process of length n (p) n (p) The moving average of 3 is then applied, followed by a calculation with parameter n. (l) LOESS regression yields a sequence of length N.

[0083] Step 4: Remove the trend from the smoothed periodic subsequence.

[0084] Step 5: Eliminate the cycle

[0085] Step 6: Trend smoothing, external circulation adjusts robust weights in logistic regression;

[0086] Step 7: If the trend converges, end; otherwise, go to Step 1.

[0087] Output: Long-term trend, seasonality, and random residuals;

[0088] Where, n (p) n is the number of samples in one period. (s) n is the smoothing parameter for LOESS in Step 2. (l) The LOESS smoothing parameter in Step 3;

[0089] By performing time-series decomposition on the migrated traffic volume and HTTP request count, relevant periods can be extracted from the data, and the residual fluctuations at each point in the sequence within each period can be calculated. The trend term decomposes the approximate changes and fluctuations in traffic volume and HTTP request count over the duration; the periodic term mainly reflects the data fluctuations within the period, and differs from the trend term in that it reflects data fluctuations at different time scales. Randomness in the residual term is contained within the ordered periods, fluctuating within a certain range.

[0090] In an optional embodiment of the present invention, step 14 may include:

[0091] Step 141: Input the time series data to be detected into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results;

[0092] Specifically, the time-series data to be detected is input into the clustering model and autoencoder of the first business quality detection sub-model of the preset business quality detection model for classification processing, resulting in multiple first detection results.

[0093] Step 142: Input the random residual into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results;

[0094] Specifically, the random residuals are input into the clustering model and autoencoder of the second business quality detection sub-model of the preset business quality detection model to classify the residual values ​​and obtain multiple second detection results.

[0095] Step 143: Based on multiple first detection results and multiple second detection results, obtain the business quality anomaly detection result;

[0096] Specifically, multiple first detection results are voted on to obtain the first target detection result;

[0097] A voting process is performed on multiple second detection results to obtain a second target detection result;

[0098] The business quality anomaly detection result is obtained based on the first target detection result and the second target detection result.

[0099] like Figure 6 As shown, the time series data to be detected obtained after data migration is input into the clustering model and autoencoder of the first business quality detection sub-model of the preset business quality detection model for classification processing, and multiple first detection results are obtained, such as result 0, result 1, and result 0.

[0100] The time series data to be detected is decomposed into time series to obtain random residuals of the time series data to be detected. The random residuals are then input into the clustering model and autoencoder of the second business quality detection sub-model of the preset business quality detection model for classification processing to obtain multiple first detection results, such as result 1, result 0, and result 1.

[0101] A voting process is performed on multiple first detection results to obtain a first target detection result; for example, a voting process is performed on result 0, result 1, and result 0 to obtain the first target detection result as result 0.

[0102] A voting process is performed on multiple second detection results to obtain a second target detection result; for example, a voting process is performed on result 1, result 0, and result 1 to obtain result 1 as the second target detection result.

[0103] Based on the first target detection result and the second target detection result, the business quality anomaly detection result is obtained. For example, if result 0 and result 1 are ORed, result 1 is obtained, and the business quality anomaly detection result is output.

[0104] In this embodiment, the random residuals of traffic volume (time series data to be detected) and the number of HTTP requests are processed using ensemble learning. After processing by multiple base models (common unsupervised training models such as kmeans++ and autoencoder algorithms), the classification result label of each sample residual value is obtained, such as result 0 or result 1 as mentioned above. The kmeans++ algorithm first initializes k cluster centers, then continuously calculates the distance between the sample and the k cluster centers. The sample belongs to the category of the cluster center to which it is closest, and then recalculates the cluster centers until they no longer change. The autoencoder algorithm is based on the backpropagation algorithm and optimization methods (such as gradient descent), using the input data itself as supervision to guide the neural network to learn the mapping relationship and obtain a reconstructed output. For the HTTP request success rate, the above method and multiple weak classifier ensemble learning algorithms are used to obtain the anomaly threshold. Then, a combination strategy for classification problems in ensemble learning—the voting method—is used to obtain the predicted output. This method reduces variance by integrating multiple models, thereby improving the robustness of the model.

[0105] The above embodiments of the present invention optimize the problem of business quality anomaly detection while fully considering the characteristics of each feature, improving model accuracy and theoretical support; in predicting results, voting and calculating the average anomaly probability are adopted to solve the problem of poor robustness of the method of using a single dynamic threshold for detection; in the problem of data migration time series decomposition, it is used to solve the problem that some sample points cannot be detected in the time series decomposition smoothing, and migrates the data that meets the time and similarity conditions in the historical data to the data to be detected, solving the problem of insufficient sample points when a small number of samples are decomposed using STL components.

[0106] like Figure 7 As shown, embodiments of the present invention also provide a business quality anomaly detection device 70, comprising:

[0107] Module 71 is used to acquire business time-series data;

[0108] The processing module 72 is used to perform migration operations on a first preset number of data and a second preset number of data of the business time series data to obtain the time series data to be detected; to perform time series decomposition on the time series data to be detected to obtain the random residual of the time series data to be detected; and to input the time series data to be detected and the random residual into a preset business quality detection model to perform business quality anomaly detection processing to obtain the business quality anomaly detection result.

[0109] Optionally, a migration operation is performed on a first preset number of data points and a second preset number of data points of the business time-series data to obtain the time-series data to be detected, including:

[0110] From the historical data, obtain a first preset number of first historical data that matches the first preset number of data and a second preset number of second historical data that matches the second preset number of data;

[0111] The first preset number of first historical data, the business time sequence data, and the second preset number of second historical data are connected to obtain the time sequence data to be detected.

[0112] Optionally, obtaining a first preset number of first historical data matching the first preset number of data and a second preset number of second historical data matching the second preset number of data includes:

[0113] Obtain a first preset number of historical data that corresponds in time to the first preset number of data and has a similarity greater than a preset value, and a second preset number of historical data that corresponds in time to the second preset number of data and has a similarity greater than a preset value.

[0114] Optionally, the time-series data to be detected is subjected to time-series decomposition to obtain the random residuals of the time-series data to be detected, including:

[0115] Feature data trend extraction is performed on the time series data to be detected to obtain trend components;

[0116] The periodic components are calculated from the time series data to be detected to obtain the periodic components;

[0117] The random residual of the time series data to be detected is obtained based on the time series data to be detected, the trend component, and the periodic component.

[0118] Optionally, the random residual of the time series data to be detected is obtained based on the time series data to be detected, the trend component, and the periodic component, including:

[0119] The random residual of the time series data to be detected is obtained according to the formula: Random Residual = Time Series Data to be Detected - Trend Component - Periodic Component.

[0120] Optionally, the time-series data to be detected and the random residual are respectively input into a preset service quality detection model for service quality anomaly detection processing to obtain service quality anomaly detection results, including:

[0121] The time series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results;

[0122] The random residual is input into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results;

[0123] Based on multiple first detection results and multiple second detection results, a business quality anomaly detection result is obtained.

[0124] Optionally, the time-series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results, including:

[0125] The time series data to be detected is input into the clustering model and autoencoder of the first business quality detection sub-model of the preset business quality detection model for classification processing, resulting in multiple first detection results.

[0126] Optionally, the random residual is input into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results, including:

[0127] The random residuals are input into the clustering model and autoencoder of the second business quality detection sub-model of the preset business quality detection model to classify the residual values ​​and obtain multiple second detection results.

[0128] Optionally, based on multiple first detection results and multiple second detection results, a service quality anomaly detection result is obtained, including:

[0129] A voting process is performed on multiple first detection results to obtain the first target detection result;

[0130] A voting process is performed on multiple second detection results to obtain a second target detection result;

[0131] The business quality anomaly detection result is obtained based on the first target detection result and the second target detection result.

[0132] It should be noted that this device is a device corresponding to the above method. All implementation methods in the above method embodiments are also applicable to the embodiments of this device and can achieve the same technical effect.

[0133] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0134] Embodiments of the present invention also provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0135] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0136] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0137] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0140] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0141] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above-described series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0142] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0143] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting business quality anomalies, characterized in that, The method includes: Acquire service time-series data; wherein, the service time-series data includes Hypertext Transfer Protocol requests for voice and video services; A migration operation is performed on a first preset number of data points and a second preset number of data points of the business time series data to obtain the time series data to be detected; Perform time series decomposition on the time series data to be detected to obtain the random residuals of the time series data to be detected; The time series data to be detected and the random residual are respectively input into a preset service quality detection model to perform service quality anomaly detection processing, and the service quality anomaly detection result is obtained. The first preset number of data points and the second preset number of data points of the business time-series data are migrated to obtain the time-series data to be detected, including: From the historical data, obtain a first preset number of first historical data that matches the first preset number of data and a second preset number of second historical data that matches the second preset number of data; The first preset number of first historical data, the business time sequence data, and the second preset number of second historical data are connected to obtain the time sequence data to be detected.

2. The business quality anomaly detection method according to claim 1, characterized in that, Obtaining a first preset number of first historical data matching the first preset number of data and a second preset number of second historical data matching the second preset number of data includes: Obtain a first preset number of historical data that corresponds in time to the first preset number of data and has a similarity greater than a preset value, and a second preset number of historical data that corresponds in time to the second preset number of data and has a similarity greater than a preset value.

3. The business quality anomaly detection method according to claim 1, characterized in that, The time series data to be detected is decomposed into time series data to obtain random residuals of the time series data to be detected, including: Feature data trend extraction is performed on the time series data to be detected to obtain trend components; The periodic components are calculated from the time series data to be detected to obtain the periodic components; The random residual of the time series data to be detected is obtained based on the time series data to be detected, the trend component, and the periodic component.

4. The business quality anomaly detection method according to claim 3, characterized in that, Based on the time series data to be detected, the trend component, and the periodic component, the random residual of the time series data to be detected is obtained, including: The random residual of the time series data to be detected is obtained according to the formula: Random Residual = Time Series Data to be Detected - Trend Component - Periodic Component.

5. The business quality anomaly detection method according to claim 1, characterized in that, The time-series data to be detected and the random residuals are respectively input into a preset service quality detection model for service quality anomaly detection processing to obtain service quality anomaly detection results, including: The time series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing to obtain multiple first detection results; The random residual is input into the second service quality detection sub-model of the preset service quality detection model for processing to obtain multiple second detection results; Based on multiple first detection results and multiple second detection results, a business quality anomaly detection result is obtained.

6. The business quality anomaly detection method according to claim 5, characterized in that, The time-series data to be detected is input into the first service quality detection sub-model of the preset service quality detection model for processing, resulting in multiple first detection results, including: The time series data to be detected is input into the clustering model and autoencoder of the first business quality detection sub-model of the preset business quality detection model for classification processing, resulting in multiple first detection results.

7. The business quality anomaly detection method according to claim 5, characterized in that, The random residuals are input into the second service quality detection sub-model of the preset service quality detection model for processing, resulting in multiple second detection results, including: The random residuals are input into the clustering model and autoencoder of the second business quality detection sub-model of the preset business quality detection model to classify the residual values ​​and obtain multiple second detection results.

8. The business quality anomaly detection method according to claim 5, characterized in that, Based on multiple first detection results and multiple second detection results, a service quality anomaly detection result is obtained, including: A voting process is performed on multiple first detection results to obtain the first target detection result; A voting process is performed on multiple second detection results to obtain a second target detection result; The business quality anomaly detection result is obtained based on the first target detection result and the second target detection result.

9. A business quality anomaly detection device, characterized in that, include: An acquisition module is used to acquire business time-series data; wherein, the business time-series data includes Hypertext Transfer Protocol requests for voice and video services; The processing module is used to perform migration operations on a first preset number of data and a second preset number of data of the business time series data to obtain the time series data to be detected; to perform time series decomposition on the time series data to be detected to obtain the random residual of the time series data to be detected; and to input the time series data to be detected and the random residual into a preset business quality detection model to perform business quality anomaly detection processing to obtain the business quality anomaly detection result. Specifically, a migration operation is performed on a first preset number of data points and a second preset number of data points of the business time-series data to obtain the time-series data to be detected, including: From the historical data, obtain a first preset number of first historical data that matches the first preset number of data and a second preset number of second historical data that matches the second preset number of data; The first preset number of first historical data, the business time sequence data, and the second preset number of second historical data are connected to obtain the time sequence data to be detected.

10. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, A storage instruction that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1 to 8.

Images