An anomaly detection method and device, and a computer readable storage medium

Abstract

Embodiments of the present application provide an abnormality detection method and device, and a computer readable storage medium, wherein the method comprises: performing periodic abnormality detection on a plurality of index data according to an abnormality detection period and a plurality of index abnormality thresholds issued by a server; if it is detected that at least one of the plurality of index data is abnormal, obtaining abnormal data and historical related data of a device; sending the abnormal data and the historical related data of the device to the server; receiving adjusted plurality of index abnormality thresholds sent by the server, and performing next abnormality detection based on the adjusted plurality of index abnormality thresholds. In the above scheme, the terminal performs periodic abnormality detection according to the abnormality detection period, reduces the number of data processed by the terminal, and can improve the speed of abnormality detection. At the same time, the terminal performs abnormality detection according to the adjusted plurality of index abnormality thresholds of the server, which can improve the accuracy of abnormality detection.

Description

Technical Field

[0001] This invention relates to the field of big data, and in particular to an anomaly detection method and apparatus, and a computer-readable storage medium. Background Technology

[0002] Current device anomaly detection solutions mainly involve continuously collecting data or logs from the terminal, then having the platform analyze and process the data using different strategies to determine whether an anomaly has occurred. Because of the continuous data collection and monitoring of this data from the terminal, existing solutions tend to be slow in detecting anomalies. Summary of the Invention

[0003] This invention provides an anomaly detection method and apparatus, as well as a computer-readable storage medium, which can improve the speed of anomaly detection.

[0004] The technical solution of this invention is implemented as follows: This invention provides an anomaly detection method applied to a terminal, the method comprising: Based on the anomaly detection cycle and multiple anomaly thresholds issued by the server, periodic anomaly detection is performed on multiple indicator data. If at least one of the multiple indicator data is detected to be abnormal, the abnormal data and the device's historical relevant data are obtained; the abnormality indicates that the indicator data is greater than the abnormal indicator value. The abnormal data and the historical relevant data of the device are sent to the server; The server receives adjusted threshold values ​​for multiple indicators, and performs the next anomaly detection based on these adjusted threshold values. These adjusted threshold values ​​are obtained by the server calculating the anomaly confidence level using historical data of the device, and adjusting at least one indicator threshold value when the anomaly confidence level indicates unreliability.

[0005] In the above scheme, before periodically detecting multiple indicator data based on the anomaly detection period and multiple indicator anomaly thresholds issued by the server, the method further includes: The system uses a soft probe to receive the anomaly detection period and the multiple indicator anomaly thresholds sent by the server.

[0006] In the above scheme, after uploading the abnormal data and the device's historical related data to the server, the method further includes: Receive anomaly repair information sent by the server; the anomaly repair information is obtained by the server after calculating the anomaly confidence level through the historical relevant data of the device, and based on the anomaly when the anomaly confidence level represents confidence; Based on the aforementioned anomaly repair information, the anomaly is repaired.

[0007] This invention provides an anomaly detection method applied to a server, the method comprising: Receive abnormal data and historical data of the device sent by the terminal; By using a preset anomaly analysis model, the historical relevant data of the device is analyzed to obtain the anomaly confidence level; the preset anomaly analysis model is used to calculate the anomaly confidence level of the device anomaly. If the anomaly credibility characterization indicates anomaly unreliability, then through the anomaly analysis model, at least one of the multiple indicator anomaly thresholds is adjusted to obtain adjusted multiple indicator anomaly thresholds; and the adjusted multiple indicator anomaly thresholds are sent to the terminal.

[0008] In the above scheme, the historical data related to the device includes: the device's historical online status and the device's historical user activity status; The step of analyzing the device-related data using a preset anomaly analysis model to obtain the anomaly confidence level includes: Based on the historical online status of the device and the historical user activity status of the device, calculate the online rate and the activity rate of the device within the historical time period, respectively. Based on the first preset threshold and the online rate within the historical time period, the first calculation result is determined through the preset anomaly analysis model; Based on the second preset threshold and the activity rate within the historical time period, the second calculation result is determined through the preset anomaly analysis model; If the current anomaly is not the first anomaly, then obtain the confidence levels of multiple historical anomalies within the historical time period; and calculate the anomaly standard deviation within the historical time period based on the multiple historical anomaly confidence levels. Based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period, the credibility of the anomaly is determined using the preset anomaly analysis model. If the current anomaly is the first anomaly, the credibility of the anomaly is determined by the preset anomaly analysis model based on the first calculation result and the second calculation result.

[0009] In the above scheme, after analyzing the historical relevant data of the device through a preset anomaly analysis model to obtain the anomaly confidence level, the method further includes: If the anomaly confidence level is greater than a third preset threshold, then the anomaly confidence level indicates an abnormally reliable level; or, If the anomaly credibility is not greater than a third preset threshold, then the anomaly credibility indicates that the anomaly is not credible.

[0010] In the above scheme, after determining the anomaly confidence level based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period using the preset anomaly analysis model, the method further includes: If the anomaly credibility indicates that the anomaly is credible, then the current anomaly is matched with a preset anomaly database to obtain a matching result; If the matching result is successful, a first alarm message is generated, and based on the first alarm message, the anomaly repair information corresponding to the current anomaly is determined from the preset repair library. If the matching result fails, a second alarm message is generated. Based on the second alarm message, the anomaly repair information corresponding to the current anomaly is obtained. The anomaly repair information is obtained after analyzing and repairing the device anomaly based on the second alarm message. Send the anomaly repair information corresponding to the current anomaly to the terminal.

[0011] This invention provides a terminal, which includes a detection unit, a first acquisition unit, a first transmission unit, and a first reception unit; wherein, The detection unit is used to periodically detect multiple indicator data according to the abnormal detection cycle issued by the server and multiple indicator abnormal thresholds. The first acquisition unit is used to acquire abnormal data and historical related data of the device if at least one of the plurality of indicator data is abnormal; the abnormality indicates that the indicator data is greater than the abnormal value of the indicator. The first sending unit is used to send the abnormal data and the historical related data of the device to the server; The first receiving unit is used to receive the adjusted multiple indicator abnormality thresholds sent by the server and to perform the next abnormality detection; the adjusted multiple indicator abnormality thresholds are obtained by the server through calculation of the abnormality credibility characterization when the device is untrustworthy using historical relevant data.

[0012] This invention provides a server, which includes a second receiving unit, a second acquiring unit, and a second sending unit; wherein, The second receiving unit is used for receiving abnormal data of the device and historical related data of the device sent by the terminal; The second acquisition unit is used to analyze the historical relevant data of the device through a preset anomaly analysis model to obtain the anomaly confidence level; the preset anomaly analysis model is used to calculate the anomaly confidence level of the device anomaly. The second sending unit is configured to, if the anomaly credibility characterization is unreliable, adjust at least one of the multiple indicator anomaly thresholds through the anomaly analysis model to obtain adjusted multiple indicator anomaly thresholds; and send the adjusted multiple indicator anomaly thresholds to the terminal.

[0013] This invention provides a terminal, the terminal comprising: The first memory is used to store executable instructions; A first processor is configured to execute executable instructions stored in the first memory. When the executable instructions are executed, the first processor executes the anomaly detection method.

[0014] This invention provides a server, the server comprising: The second memory is used to store executable instructions; The second processor is configured to execute executable instructions stored in the second memory. When the executable instructions are executed, the second processor executes the anomaly detection method.

[0015] This invention provides a computer-readable storage medium storing executable instructions. When the executable instructions are executed by a first processor or a second processor, they are used to cause the first processor to execute the anomaly detection method described on the terminal side; or, to cause the second processor to execute the anomaly detection method described on the server side.

[0016] This invention provides an anomaly detection method and apparatus, and a computer-readable storage medium. The method includes: periodically detecting anomalies in multiple indicator data according to an anomaly detection cycle and multiple indicator anomaly thresholds issued by a server; if an anomaly is detected in at least one of the multiple indicator data, acquiring the anomaly data and historical relevant data of the device; the anomaly indicates that the indicator data is greater than the indicator anomaly value; sending the anomaly data and the historical relevant data of the device to the server; receiving adjusted multiple indicator anomaly thresholds sent by the server, and performing the next anomaly detection based on the adjusted multiple indicator anomaly thresholds. In the above scheme, the terminal performs periodic anomaly detection according to the anomaly detection cycle, analyzing only the periodically collected multiple indicator data, reducing the amount of data processed by the terminal and improving the speed of anomaly detection. Simultaneously, the terminal performs anomaly detection based on the adjusted multiple indicator anomaly thresholds from the server, which improves the accuracy of anomaly detection. Attached Figure Description

[0017] Figure 1 This invention provides an optional flowchart of an anomaly detection method. Figure 1 ; Figure 2 This invention provides an optional flowchart of an anomaly detection method. Figure 2 ; Figure 3 This invention provides an optional flowchart of an anomaly detection method. Figure 3 ; Figure 4 This invention provides an optional flowchart of an anomaly detection method. Figure 4 ; Figure 5 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention. Figure 1 ; Figure 6 A schematic diagram of the server structure is provided for an embodiment of the present invention. Figure 1 ; Figure 7 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention. Figure 2 ; Figure 8 A schematic diagram of the server structure is provided for an embodiment of the present invention. Figure 2 . Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0019] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Figure 1 This is an optional flowchart of an anomaly detection method provided by an embodiment of the present invention. Figure 1 , will combine Figure 1 The steps shown are explained.

[0020] S101. Based on the anomaly detection cycle and multiple indicator anomaly thresholds issued by the server, perform periodic anomaly detection on multiple indicator data.

[0021] In some embodiments of the present invention, the multiple indicator anomaly thresholds are multiple indicator-specific anomaly thresholds; these multiple indicators include Central Processing Unit (CPU) utilization, packet loss rate, and network latency, etc. The anomaly detection period is a preset time period.

[0022] In some embodiments of the present invention, the terminal can perform periodic anomaly detection on multiple indicator data of the device according to the anomaly detection period and multiple indicator anomaly thresholds issued by the server.

[0023] For example, the anomaly detection cycle can be once every two hours, once every hour, or once every 30 minutes. The anomaly detection cycle can be set according to the device's performance. Among the multiple anomaly thresholds, the anomaly threshold for CPU utilization is 50%, the anomaly threshold for packet loss rate is 5%, and the anomaly threshold for network latency is 2%.

[0024] S102. If at least one of the multiple indicator data is detected to be abnormal, the abnormal data and the historical relevant data of the device are obtained; the abnormality is characterized by the indicator data being greater than the indicator abnormality threshold.

[0025] In some embodiments of the present invention, "at least one indicator data is abnormal among multiple indicator data" means that at least one indicator data exceeds its corresponding abnormal threshold.

[0026] In some embodiments of the present invention, the terminal performs anomaly detection on multiple indicator data. If at least one indicator data among the multiple indicator data is detected to exceed its corresponding anomaly threshold, the abnormal data and historical related data of the device are obtained.

[0027] For example, the terminal performs anomaly detection on multiple metrics, obtaining a CPU utilization rate of 48%, a packet loss rate of 6%, and a network latency of 1.9%. Since the anomaly thresholds for CPU utilization are 50%, packet loss rate is 5%, and network latency is 2%, the packet loss rate exceeds these thresholds, indicating a device anomaly. The terminal then acquires historical relevant data and anomaly data from the device.

[0028] S103. Send the abnormal data and the device's historical data to the server.

[0029] In some embodiments of the present invention, the historical online status of the device and the historical user activity status of the device are considered.

[0030] S104. Receive the adjusted multiple indicator abnormality thresholds sent by the server, and perform the next abnormality detection based on the adjusted multiple indicator abnormality thresholds; the adjusted multiple indicator abnormality thresholds are obtained by the server calculating the abnormality credibility through the historical relevant data of the device, and adjusting the abnormality threshold of at least one indicator when the abnormality credibility characterizes as untrustworthy.

[0031] In some embodiments of the present invention, the terminal can receive adjusted multiple indicator anomaly thresholds sent by the server, and perform the next anomaly detection according to the adjusted multiple indicator anomaly thresholds and the anomaly detection cycle. The adjusted multiple indicator anomaly thresholds are obtained by the server calculating the anomaly credibility through the device's historical relevant data, and adjusting at least one indicator anomaly threshold when the anomaly credibility indicates unreliability.

[0032] For example, the adjusted abnormal thresholds for several metrics include an abnormal threshold of 50% for CPU utilization, an abnormal threshold of 6% for packet loss rate, and an abnormal threshold of 3% for network latency.

[0033] Understandably, by performing periodic anomaly detection based on a specific cycle, and analyzing only the periodically collected data on multiple metrics, the terminal reduces the amount of data it processes, thus improving the speed of anomaly detection. Simultaneously, by using the server-adjusted anomaly thresholds for multiple metrics for anomaly detection, the terminal can improve the accuracy of anomaly detection.

[0034] In some embodiments of the present invention, S105 is executed before S101, as follows: S105. Receive the anomaly detection cycle and multiple indicator anomaly thresholds sent by the server via a soft probe.

[0035] In some embodiments of the present invention, the soft probe is located on the terminal, which can establish interconnection between the server and the terminal device.

[0036] In some embodiments of the present invention, the terminal can receive the anomaly detection period and multiple indicator anomaly thresholds issued by the server through a soft probe.

[0037] In some embodiments of the present invention, S106-S107 are also executed after S103, as follows: S106. Receive the anomaly repair information sent by the server.

[0038] In some embodiments of the present invention, the anomaly repair information is obtained based on the anomaly after the server calculates the anomaly credibility using the historical relevant data of the device, and the anomaly credibility characterizes credibility.

[0039] S107. Repair the anomaly based on the anomaly repair information.

[0040] In some embodiments of the present invention, the terminal repairs the anomaly based on the received anomaly repair information so that the device can operate normally.

[0041] Understandably, the terminal can repair the anomalies in the device based on the anomaly repair information sent by the server, thus enabling the device to work normally.

[0042] In some embodiments of the present invention Figure 2 This is an optional flowchart of an anomaly detection method provided by an embodiment of the present invention. Figure 2 , will combine Figure 2 The steps shown are explained.

[0043] S201, Receive abnormal data of the device and historical data related to the device sent by the terminal.

[0044] S202. By using a preset anomaly analysis model, analyze the historical data of the equipment to obtain the anomaly confidence level.

[0045] In some embodiments of the present invention, a preset anomaly analysis model is used to calculate the anomaly confidence level of device anomalies. Historical relevant data of the device includes: the device's historical online status and the device's historical user activity status.

[0046] In some embodiments of the present invention, the server calculates the device's online rate and activity rate within a historical time period based on the device's historical online status and the device's historical user activity status. The server determines a first calculation result based on a first preset threshold and the online rate within the historical time period using a preset anomaly analysis model; it determines a second calculation result based on a second preset threshold and the activity rate within the historical time period using the preset anomaly analysis model; if the current anomaly represents the first anomaly, the server determines the anomaly confidence level based on the first and second calculation results using the preset anomaly analysis model; if the current anomaly represents a non-first anomaly, the server obtains multiple historical anomaly confidence levels within the historical time period; and calculates the anomaly standard deviation within the historical time period based on the multiple historical anomaly confidence levels; finally, the server determines the anomaly confidence level based on the first and second calculation results and the anomaly standard deviation within the historical time period using the preset anomaly analysis model.

[0047] S203. If the anomaly credibility characterization is not credible, then through the anomaly analysis model, adjust at least one of the multiple indicator anomaly thresholds to obtain adjusted multiple indicator anomaly thresholds; and send the adjusted multiple indicator anomaly thresholds to the terminal.

[0048] In some embodiments of the present invention, the server judges the credibility of the anomaly. If the credibility of the anomaly is not greater than a third preset threshold, the credibility of the anomaly indicates that the anomaly is not trustworthy. Then, through the anomaly analysis model, at least one of the multiple indicator anomaly thresholds is adjusted to obtain the adjusted multiple indicator anomaly thresholds. The adjusted multiple indicator anomaly thresholds are then sent to the terminal.

[0049] For example, if the anomaly confidence level obtained by the server is not greater than the third preset threshold, then the anomaly confidence level indicates that the anomaly is unreliable, suggesting that the anomaly threshold configuration for device detection is problematic. For instance, the thresholds for CPU utilization, packet loss rate, and network latency may be configured too low, causing anomaly reporting to be triggered during normal device operation. Therefore, it is necessary to adjust at least one of the multiple indicator anomaly thresholds according to the anomaly analysis model to obtain adjusted multiple indicator anomaly thresholds.

[0050] Understandably, the server can analyze historical data sent by the terminal using a preset anomaly analysis model to determine the credibility of the anomaly. If the anomaly is deemed unreliable, it indicates a deviation in the anomaly threshold. Adjusting the anomaly threshold can improve the accuracy of terminal anomaly detection.

[0051] In some embodiments of the present invention, S202 can be implemented by S2021-S2026, as follows: S2021. Based on the device's historical online status and the device's historical user activity status, calculate the device's online rate and activity rate within the historical time period, respectively.

[0052] In some embodiments of the present invention, the server performs a quotient calculation based on the number of times the device was online in history and the historical time period to obtain the device's online rate in the historical time period; and performs a quotient calculation based on the number of times the device's users were active in history and the historical time period to obtain the device's activity rate in the historical time period.

[0053] S2022. Based on the first preset threshold and the online rate within the historical time period, determine the first calculation result through a preset anomaly analysis model.

[0054] In some embodiments of the present invention, the server uses a preset anomaly analysis model to multiply a first preset threshold by the online rate within a historical time period to obtain a first sub-operation result; and performs a difference operation between the first preset threshold and the first sub-operation result to obtain a first operation result.

[0055] S2023. Based on the second preset threshold and the activity rate within the historical time period, determine the second calculation result through a preset anomaly analysis model.

[0056] In some embodiments of the present invention, the server multiplies a second preset threshold and the activity rate within a historical time period using a preset anomaly analysis model to obtain a second sub-operation result; and performs a difference operation between the second preset threshold and the second sub-operation result to obtain a second operation result.

[0057] S2024. If the current anomaly is not the first anomaly, obtain the confidence levels of multiple historical anomalies within the historical time period; and calculate the standard deviation of the anomalies within the historical time period based on the confidence levels of multiple historical anomalies.

[0058] In some embodiments of the present invention, the server determines whether the current anomaly is the first anomaly. If the current anomaly indicates that it is not the first anomaly, the server obtains the confidence levels of multiple historical anomalies within a historical time period. Based on the confidence levels of multiple historical anomalies, the server calculates the standard deviation of the anomalies within the historical time period.

[0059] S2025. Based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period, determine the anomaly confidence level through a preset anomaly analysis model.

[0060] In some embodiments of the present invention, the server performs a sum operation on the first calculation result and the second calculation result to obtain a sum operation result; the sum operation result is then subjected to a difference operation with the anomaly standard deviation within a historical time period to obtain the anomaly confidence level of the current anomaly.

[0061] For example, the anomaly confidence level = α (1 - Device online rate within 30 days) + β (1 - 30-day activity rate of bound device users) - 30-day anomaly credibility standard deviation, where α is the first preset threshold; the 30-day online rate of the device is the online rate within the historical time period; β is the second preset threshold; the 30-day activity rate of bound device users is the activity rate within the historical time period; and the 30-day anomaly credibility standard deviation is the anomaly standard deviation within the historical time period. The value of α is 0.6, and the value of β is 0.4.

[0062] S2026. If the current anomaly is the first anomaly, the credibility of the anomaly is determined by using the preset anomaly analysis model based on the first and second calculation results.

[0063] In some embodiments of the present invention, the server determines whether the current exception is the first exception. If the current exception represents the first exception, the server performs a summation operation on the first and second calculation results through a preset exception analysis model to obtain the exception confidence level of the current exception.

[0064] For example, the anomaly confidence level = α (1 - Device online rate within 30 days) + β (1 - 30-day activity rate of bound device users), where α is the first preset threshold; the online rate of the device within 30 days is the online rate within the historical time period; β is the second preset threshold; the 30-day activity rate of bound device users is the activity rate within the historical time period.

[0065] It should be noted that there is no specific order in which S2024 and S2026 are executed. The execution order depends on the actual situation. If the current exception is the first exception, S2026 will be executed. Otherwise, S2024 will be executed.

[0066] In some embodiments of the present invention, S204 or S205 is also executed after S202, as follows: S204. If the abnormal credibility is greater than the third preset threshold, then the abnormal credibility indicates abnormal credibility.

[0067] S205. If the anomaly confidence level is not greater than the third preset threshold, then the anomaly confidence level indicates that the anomaly is not trustworthy.

[0068] For example, the third preset threshold is 0.5. If the anomaly confidence level is 0.6, since 0.6 is greater than 0.5, the anomaly confidence level represents credibility; if the anomaly confidence level is 0.4, since 0.4 is less than 0.5, the anomaly confidence level represents untrustworthiness.

[0069] In some embodiments of the present invention, after S2025, S301-S302 or S401-S402 are also executed, as follows: S301. If the anomaly confidence level indicates that the anomaly is reliable, then the current anomaly is matched with the preset anomaly database to obtain the matching result. If the matching result indicates that the anomaly is successful, then the first alarm information is generated.

[0070] In some embodiments of the present invention, the preset exception library is established based on historical exceptions and contains all exceptions prior to the current exception.

[0071] In some embodiments of the present invention, if the anomaly confidence level obtained by the server indicates that the anomaly is reliable, the current anomaly is matched with a preset anomaly database to obtain a matching result. If the current anomaly is matched in the preset anomaly database, it indicates that the match is successful, and a first alarm message is generated.

[0072] S302. Based on the first alarm information, determine the anomaly repair information corresponding to the current anomaly from the preset repair library.

[0073] In some embodiments of the present invention, the preset repair library is established based on the anomaly repair information of historical anomalies, including the anomaly repair information corresponding to all anomalies before the current anomaly.

[0074] In some embodiments of the present invention, the server determines the anomaly repair information corresponding to the current anomaly from a preset repair database based on the first alarm information.

[0075] S401. If the anomaly confidence level indicates that the anomaly is reliable, then the current anomaly is matched with the preset anomaly database to obtain the matching result. If the matching result indicates that the anomaly is unreliable, then a second alarm message is generated.

[0076] In some embodiments of the present invention, if the credibility of the anomaly received by the server indicates that the anomaly is untrustworthy, the current anomaly is matched with a preset anomaly database. If the current anomaly is not matched in the preset anomaly database, it indicates that the match has failed, and a second alarm message is generated.

[0077] S402. Based on the second alarm information, obtain the anomaly repair information corresponding to the current anomaly.

[0078] In some embodiments of the present invention, the anomaly repair information is obtained after analyzing and repairing the device anomaly based on the second alarm information.

[0079] In some embodiments of the present invention, the server sends the current anomaly to the management device where the administrator is located based on the second alarm information; the management device analyzes and repairs the device anomaly to obtain the anomaly repair information corresponding to the current anomaly; and sends the anomaly repair information corresponding to the current anomaly to the server.

[0080] It should be noted that the execution order of S301 and S401 is not sequential and is determined according to the specific circumstances of the embodiment.

[0081] In some embodiments of the present invention, after S302, or after S402, S403 is also executed, as follows: S403. Send the exception repair information corresponding to the current exception to the terminal.

[0082] Understandably, the server can send anomaly repair information to the terminal so that the terminal can repair the anomaly, thereby improving the maintainability of the terminal device.

[0083] An optional flowchart of an anomaly detection method provided in this embodiment of the invention. Figure 3 ,like Figure 3 As shown, the server configures and distributes indicator detection thresholds (equivalent to multiple indicator abnormality thresholds) and detection cycles (equivalent to anomaly detection cycles) to the terminal. The terminal detects each indicator according to the configured detection cycle; it determines whether the indicator is abnormal. If not, it continues to detect each indicator; if so, it reports abnormal data and log information (equivalent to historical relevant information of the device). The server comprehensively analyzes the anomaly credibility based on the business data (equivalent to log information) and determines whether the anomaly credibility is reliable. If not, it adjusts the detection indicator thresholds and sends them to the terminal, and the terminal continues to perform the next detection; if so, it continues to determine whether the anomaly is a known anomaly. If so, it pushes an alarm and sends a patch (equivalent to anomaly repair information) to resolve the anomaly; if not, it pushes an alarm, completes the anomaly resolution, and improves the anomaly patch library (equivalent to a preset repair library).

[0084] An optional flowchart of an anomaly detection method provided in this embodiment of the invention. Figure 4 ,like Figure 4 As shown, the anomaly detection method can be implemented through the following steps: S1. The server sends multiple abnormal thresholds and abnormal detection cycles to the terminal.

[0085] S2. The terminal performs periodic anomaly detection on multiple indicator data based on multiple indicator anomaly thresholds.

[0086] S3. If the terminal detects that at least one of the multiple indicator data is abnormal, it will obtain the abnormal data and the device's historical relevant data.

[0087] S4. The terminal sends the abnormal data and the device's historical data to the server.

[0088] S5. The server calculates the anomaly confidence level based on the device's historical data.

[0089] S6. The server judges the credibility of the anomaly. If the credibility of the anomaly is unreliable, the anomaly thresholds of multiple indicators are adjusted to obtain the adjusted anomaly thresholds of multiple indicators. If the credibility of the anomaly is reliable, the anomaly repair information corresponding to the anomaly is obtained.

[0090] S7. The server sends the adjusted abnormal thresholds or abnormal repair information for multiple indicators to the terminal.

[0091] S8. The terminal performs the next anomaly detection based on the adjusted abnormal thresholds of multiple indicators, or repairs the anomaly based on the anomaly repair information.

[0092] Understandably, by performing periodic anomaly detection based on a specific anomaly detection cycle, and analyzing only the periodically collected data from multiple metrics, the terminal reduces the amount of data it processes, thus improving the speed of anomaly detection. Simultaneously, by using the server-adjusted anomaly thresholds for multiple metrics for anomaly detection, the terminal can improve the accuracy of anomaly detection.

[0093] Based on the anomaly detection method described in the above embodiments, this invention also provides a terminal, such as... Figure 5 As shown, Figure 5 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention. Figure 1 The terminal 5 includes: a detection unit 501, a first acquisition unit 502, a first transmission unit 503, and a first receiving unit 504; wherein, The detection unit 501 is used to periodically detect multiple indicator data according to the abnormal detection cycle and multiple indicator abnormal thresholds issued by the server. The first acquisition unit 502 is used to acquire abnormal data and historical related data of the device if at least one of the multiple indicator data is abnormal; the abnormality indicates that the indicator data is greater than the abnormal value of the indicator. The first sending unit 503 is used to send the abnormal data and the historical related data of the device to the server; The first receiving unit 504 is used to receive the adjusted multiple indicator abnormality thresholds sent by the server and perform the next abnormality detection; the adjusted multiple indicator abnormality thresholds are obtained by the server through the historical relevant data of the device to represent the untrustworthy anomaly credibility.

[0094] In some embodiments of the present invention, before performing periodic detection on multiple indicator data according to the anomaly detection period and multiple indicator anomaly thresholds issued by the server, the first receiving unit 504 is further configured to receive the anomaly detection period and the multiple indicator anomaly thresholds issued by the server through a soft probe.

[0095] In some embodiments of the present invention, after uploading the abnormal data and the historical related data of the device to the server, the first receiving unit 504 is further configured to receive abnormal repair information sent by the server; the abnormal repair information is obtained based on the abnormality when the abnormality confidence level is characterized as trustworthy after the server calculates the abnormality confidence level through the historical related data of the device; the abnormality is repaired according to the abnormality repair information.

[0096] Based on the anomaly detection method described in the above embodiments, this invention also provides a server, such as... Figure 6 As shown, Figure 6 A schematic diagram of the structure of a server provided in an embodiment of the present invention. Figure 1 The server 6 includes a second receiving unit 601, a second acquiring unit 602, and a second sending unit 603; wherein, The second receiving unit 601 is used for receiving abnormal data of the device and historical related data of the device sent by the terminal; The second acquisition unit 602 is used to analyze the historical relevant data of the device through a preset anomaly analysis model to obtain the anomaly confidence level; the preset anomaly analysis model is used to calculate the anomaly confidence level of the device anomaly. The second sending unit 603 is used to adjust at least one of the multiple indicator abnormality thresholds through the abnormality analysis model if the abnormality credibility characterization is abnormally unreliable, thereby obtaining adjusted multiple indicator abnormality thresholds; and to send the adjusted multiple indicator abnormality thresholds to the terminal.

[0097] In some embodiments of the present invention, the server 6 further includes a computing unit 604 and a determining unit 605; the historical related data of the device includes: the historical online status of the device and the historical user activity status of the device; The calculation unit 604 is used to calculate the online rate and the activity rate of the device in a historical time period based on the historical online status of the device and the historical user activity status of the device. The determining unit 605 is used to determine a first calculation result based on a first preset threshold and the online rate within the historical time period, using the preset anomaly analysis model; and to determine a second calculation result based on a second preset threshold and the activity rate within the historical time period, using the preset anomaly analysis model. The calculation unit 604 is further configured to, if the current anomaly characterization is not the first anomaly, obtain the confidence levels of multiple historical anomalies within a historical time period; and calculate the anomaly standard deviation within the historical time period based on the multiple historical anomaly confidence levels. The determining unit 605 is further configured to determine the credibility of the anomaly based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period, using the preset anomaly analysis model; if the current anomaly represents the first anomaly, then the credibility of the anomaly is determined based on the first calculation result, the second calculation result, and the preset anomaly analysis model.

[0098] In some embodiments of the present invention, after analyzing the historical relevant data of the device through a preset anomaly analysis model to obtain the anomaly credibility, if the anomaly credibility is greater than a third preset threshold, then the anomaly credibility represents anomaly credibility; or, if the anomaly credibility is not greater than the third preset threshold, then the anomaly credibility represents anomaly untrustworthiness.

[0099] In some embodiments of the present invention, the server 6 further includes a generation unit 606. After determining the anomaly credibility based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period using the preset anomaly analysis model, the generation unit 606 is used to match the current anomaly with a preset anomaly database if the anomaly credibility indicates that the anomaly is credible, and obtain a matching result; if the matching result indicates that the anomaly is credible, then generate a first alarm message. The determining unit 605 is further configured to determine, based on the first alarm information, the abnormal repair information corresponding to the current abnormality from a preset repair library; The generation unit 606 is further configured to generate a second alarm message if the matching result representation fails. The second acquisition unit 602 is further configured to acquire anomaly repair information corresponding to the current anomaly based on the second alarm information; the anomaly repair information is obtained after analyzing and repairing the device anomaly based on the second alarm information; The second sending unit 603 is also used to send the anomaly repair information corresponding to the current anomaly to the terminal.

[0100] Based on the anomaly detection method described in the above embodiments, this invention also provides a terminal, such as... Figure 7 As shown, Figure 7 A schematic diagram of the structure of a terminal provided in an embodiment of the present invention. Figure 2 The terminal 7 includes a first processor 701 and a first memory 702; the first memory 702 stores one or more programs executable by the processor, and when one or more programs are executed, the first processor 701 executes an anomaly detection method on the terminal side.

[0101] Based on the anomaly detection method described in the above embodiments, this invention also provides a server, such as... Figure 8 As shown, Figure 8 A schematic diagram of the structure of a server provided in an embodiment of the present invention. Figure 2 The server 8 includes: a second processor 801 and a second memory 802; the second memory 802 stores one or more programs executable by the second processor, and when one or more programs are executed, the server-side anomaly detection method is executed by the second processor 801.

[0102] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0103] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0104] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0106] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. An anomaly detection method, characterized in that, Applied to terminals, including: Based on the anomaly detection cycle and multiple anomaly thresholds issued by the server, periodic anomaly detection is performed on multiple indicator data. If at least one of the multiple indicator data is detected to be abnormal, the abnormal data and the device's historical related data are obtained; wherein, the device's historical related data includes: the device's historical online status and the device's historical user activity status; the abnormality indicates that the indicator data is greater than the indicator abnormality threshold; The abnormal data and the historical relevant data of the device are sent to the server; The server receives adjusted anomaly thresholds for multiple metrics sent by the server, and performs the next anomaly detection based on these adjusted thresholds. These adjusted thresholds are calculated by the server using historical data of the device to determine anomaly credibility, and at least one anomaly threshold is adjusted when the anomaly credibility indicates unreliability. The anomaly credibility is determined as follows: the server calculates the device's online rate and activity rate within a historical time period based on the device's historical online status and the device's historical user activity status; and then, based on a first preset threshold and the online rate within the historical time period, performs a further anomaly detection using a preset threshold. An anomaly analysis model determines a first calculation result; based on a second preset threshold and the activity rate within the historical time period, a second calculation result is determined using the preset anomaly analysis model; if the current anomaly represents a non-first anomaly, multiple historical anomaly confidence levels within the historical time period are obtained, and the anomaly standard deviation within the historical time period is calculated based on the multiple historical anomaly confidence levels; based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period, the anomaly confidence level is determined using the preset anomaly analysis model; if the current anomaly represents a first anomaly, the anomaly confidence level is determined based on the first calculation result and the second calculation result using the preset anomaly analysis model.

2. The method according to claim 1, characterized in that, Before periodically detecting multiple indicator data based on the anomaly detection cycle and multiple indicator anomaly thresholds issued by the server, the method further includes: The system uses a soft probe to receive the anomaly detection period and the multiple indicator anomaly thresholds sent by the server.

3. The method according to claim 1, characterized in that, After uploading the abnormal data and the device's historical related data to the server, the method further includes: Receive anomaly repair information sent by the server; the anomaly repair information is obtained by the server after calculating the anomaly confidence level through the historical relevant data of the device, and based on the anomaly when the anomaly confidence level represents confidence; Based on the aforementioned anomaly repair information, the anomaly is repaired.

4. An anomaly detection method, characterized in that, Applied to servers, including: The receiving terminal sends abnormal data of the device and historical data related to the device; wherein, the historical data related to the device includes: the historical online status of the device and the historical user activity status of the device; Based on the historical online status of the device and the historical user activity status of the device, calculate the online rate and the activity rate of the device within the historical time period, respectively. Based on a first preset threshold and the online rate within the historical time period, a first calculation result is determined using a preset anomaly analysis model; wherein, the preset anomaly analysis model is used to calculate the anomaly confidence level of the device anomaly; Based on the second preset threshold and the activity rate within the historical time period, the second calculation result is determined through the preset anomaly analysis model; If the current anomaly is not the first anomaly, then the credibility of multiple historical anomalies within a historical time period is obtained; and the standard deviation of the anomaly within the historical time period is calculated based on the multiple historical anomaly credibility; and the anomaly credibility is determined by the preset anomaly analysis model based on the first calculation result, the second calculation result, and the standard deviation of the anomaly within the historical time period. If the current anomaly is the first anomaly, then the credibility of the anomaly is determined by the preset anomaly analysis model based on the first calculation result and the second calculation result; the anomaly credibility greater than a third preset threshold indicates that the anomaly is credible; the anomaly credibility not greater than the third preset threshold indicates that the anomaly is unreliable. If the anomaly credibility characterization indicates anomaly unreliability, then through the anomaly analysis model, at least one of the multiple indicator anomaly thresholds is adjusted to obtain adjusted multiple indicator anomaly thresholds; and the adjusted multiple indicator anomaly thresholds are sent to the terminal.

5. The method according to claim 4, characterized in that, After determining the credibility of the anomaly, the method further includes: If the anomaly credibility indicates that the anomaly is credible, then the current anomaly is matched with a preset anomaly database to obtain a matching result; If the matching result is successful, a first alarm message is generated, and based on the first alarm message, the anomaly repair information corresponding to the current anomaly is determined from the preset repair library. If the matching result fails, a second alarm message is generated. Based on the second alarm message, the anomaly repair information corresponding to the current anomaly is obtained. The anomaly repair information is obtained after analyzing and repairing the device anomaly based on the second alarm message. Send the anomaly repair information corresponding to the current anomaly to the terminal.

6. A terminal, characterized in that, The terminal includes a detection unit, a first acquisition unit, a first transmission unit, and a first receiving unit; wherein, The detection unit is used to periodically detect multiple indicator data according to the abnormal detection cycle issued by the server and multiple indicator abnormal thresholds. The first acquisition unit is configured to acquire abnormal data and historical related data of the device if at least one of the plurality of indicator data is detected to be abnormal; wherein, the historical related data of the device includes: the historical online status of the device and the historical user activity status of the device; the abnormality indicates that the indicator data is greater than the indicator abnormality value threshold. The first sending unit is used to send the abnormal data and the historical related data of the device to the server; The first receiving unit is used to receive adjusted multiple indicator anomaly thresholds sent by the server for the next anomaly detection. The adjusted multiple indicator anomaly thresholds are obtained by the server calculating the anomaly credibility when the device is unreliable based on historical relevant data. The anomaly credibility is determined as follows: the server calculates the device's online rate and activity rate within a historical time period based on the device's historical online status and the device's historical user activity status; a first calculation result is determined using a preset anomaly analysis model based on a first preset threshold and the online rate within the historical time period; a second calculation result is determined using the preset anomaly analysis model based on a second preset threshold and the activity rate within the historical time period; if the current anomaly is not the first anomaly, multiple historical anomaly credibility values ​​within the historical time period are obtained, and the anomaly standard deviation within the historical time period is calculated based on the multiple historical anomaly credibility values; the anomaly credibility is determined using the preset anomaly analysis model based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period; if the current anomaly is the first anomaly, the anomaly credibility is determined using the preset anomaly analysis model based on the first calculation result and the second calculation result.

7. A server, characterized in that, The server includes a second receiving unit, a second sending unit, a calculation unit, and a determining unit; wherein, The second receiving unit is used to receive abnormal data of the device and historical related data of the device sent by the terminal; wherein, the historical related data of the device includes: the historical online status of the device and the historical user activity status of the device; The calculation unit is used to calculate the online rate and the activity rate of the device within a historical time period based on the historical online status of the device and the historical user activity status of the device, respectively. The determining unit is used to determine a first calculation result based on a first preset threshold and the online rate within the historical time period, using a preset anomaly analysis model; wherein, the preset anomaly analysis model is used to calculate the anomaly credibility of the device anomaly; and to determine a second calculation result based on a second preset threshold and the activity rate within the historical time period, using the preset anomaly analysis model. The calculation unit is used to obtain the confidence levels of multiple historical anomalies within a historical time period if the current anomaly characterizes a non-first anomaly; and to calculate the anomaly standard deviation within the historical time period based on the multiple historical anomaly confidence levels. The determining unit is configured to determine the anomaly credibility based on the first calculation result, the second calculation result, and the anomaly standard deviation within the historical time period, using the preset anomaly analysis model; if the current anomaly represents the first anomaly, then the anomaly credibility is determined based on the first calculation result, the second calculation result, and the preset anomaly analysis model; the anomaly credibility greater than a third preset threshold indicates that the anomaly is credible; the anomaly credibility not greater than the third preset threshold indicates that the anomaly is unreliable. The second sending unit is configured to, if the anomaly credibility characterization is unreliable, adjust at least one of the multiple indicator anomaly thresholds through the anomaly analysis model to obtain adjusted multiple indicator anomaly thresholds; and send the adjusted multiple indicator anomaly thresholds to the terminal.

8. A terminal, characterized in that, include: The first memory is used to store executable instructions; A first processor, when executing executable instructions stored in the first memory, implements the anomaly detection method according to any one of claims 1 to 3.

9. A server, characterized in that, include: The second memory is used to store executable instructions; The second processor, when executing executable instructions stored in the second memory, implements the anomaly detection method of claim 4 or 5.

10. A computer-readable storage medium, characterized in that, The storage medium stores executable instructions, which, when executed, cause a first processor to execute the anomaly detection method as described in any one of claims 1 to 3; or cause a second processor to execute the anomaly detection method as described in claim 4 or 5.

Images