Index data anomaly detection method and device, storage medium and electronic equipment

Abstract

The application discloses an abnormality detection method and device of index data, a storage medium and an electronic device, and relates to the technical field of data processing. The method comprises the following steps: obtaining time sequence data of target index data to be detected within a preset detection duration, performing visual processing on the time sequence data, generating a target visualization graph, determining an abnormal reference visualization graph according to historical time sequence data of the target index data, determining the similarity between the target visualization graph and the abnormal reference visualization graph, judging whether the similarity reaches a preset first similarity threshold, and determining that the target index data is abnormal if the similarity reaches the preset first similarity threshold. The application directly determines the abnormal reference visualization graph based on the historical time sequence data of the target index data to be detected, and uses the abnormal reference visualization graph as a judgment reference for whether the target index data is abnormal. The state of the target index data can be judged by comparing the similarity between the target visualization graph and the abnormal reference visualization graph, and the convenience of abnormality detection of index data is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method, apparatus, storage medium, and electronic device for detecting anomalies in indicator data. Background Technology

[0002] With the development of computer technology, many systems with different functions and services have emerged. To ensure the normal operation of these systems, it is necessary to monitor and detect certain indicator data. In related technologies, monitoring indicator data typically involves setting anomaly thresholds.

[0003] However, the above-mentioned method of monitoring indicator data through anomaly thresholds requires relevant personnel to set the status judgment strategy function and anomaly threshold for each type of indicator data, making the work required for anomaly detection of indicator data complex and cumbersome. Summary of the Invention

[0004] This application provides a method, apparatus, storage medium, and electronic device for detecting anomalies in indicator data, which can improve the convenience of detecting anomalies in indicator data.

[0005] In a first aspect, embodiments of this application provide a method for detecting anomalies in indicator data, including:

[0006] Acquire time-series data of the target indicator to be detected within a preset detection duration;

[0007] The time-series data is then visualized to generate a target visualization graph.

[0008] Obtain an anomaly reference visualization, which is the visualization corresponding to when the target indicator data is abnormal;

[0009] Determine the similarity between the target visualization and the anomaly reference visualization;

[0010] Determine whether the similarity reaches a preset first similarity threshold;

[0011] If the similarity reaches a preset first similarity threshold, the target indicator data is determined to be abnormal.

[0012] In some embodiments, obtaining an anomaly reference visualization, wherein the anomaly reference visualization is a visualization corresponding to when the target indicator data is abnormal, includes:

[0013] Obtain historical time-series data of the target indicator data;

[0014] The historical time-series data is visualized to obtain a historical visualization chart;

[0015] The historical visualization chart corresponding to the occurrence of anomalies in the target indicator data during the preset detection period is selected as the anomaly reference visualization chart.

[0016] In some embodiments, selecting the historical visualization corresponding to when the target indicator data for the preset detection duration becomes abnormal as the anomaly reference visualization includes:

[0017] The historical visualization is provided to the user through a user interface.

[0018] The anomaly reference visualization is determined based on the user's interactive operations on the user interface.

[0019] In some embodiments, determining the anomaly reference visualization based on user interactions with the user interface includes:

[0020] Obtain the first candidate anomaly visualization selected by the user from the historical visualizations through a selection operation;

[0021] From the historical visualization map, a second abnormal candidate visualization map is determined whose similarity to the first abnormal candidate visualization map meets a preset second similarity threshold;

[0022] Recommend the second anomaly candidate visualization to the user;

[0023] The anomaly reference visualization is determined from the first anomaly candidate visualization and the second anomaly candidate visualization based on the user's selection.

[0024] In some embodiments, determining the anomaly reference visualization based on user interactions with the user interface includes:

[0025] Obtain multiple candidate anomaly visualizations selected by the user from the historical visualizations through a selection operation;

[0026] Obtain the currently selected anomaly candidate visualization image from the multiple anomaly candidate visualization images as the target anomaly candidate visualization image;

[0027] Determine the similarity values ​​between the other anomaly candidate visualizations besides the target anomaly candidate visualization and the target anomaly candidate visualization;

[0028] The similarity value is displayed in the other anomaly candidate visualizations so that the user can determine the anomaly reference visualization from the multiple anomaly candidate visualizations based on the similarity value.

[0029] In some embodiments, determining the similarity between the target visualization and the anomaly reference visualization includes:

[0030] Obtain the first image features of the target visualization;

[0031] Obtain the second image features of the anomaly reference visualization;

[0032] The similarity is obtained by calculating the image similarity based on the first image feature and the second image feature.

[0033] In some embodiments, after determining that the target indicator data is abnormal if the similarity reaches a preset first similarity threshold, the process includes:

[0034] Generate an alarm notification when the target indicator data is abnormal;

[0035] Send the alarm notification to the designated external electronic device.

[0036] Secondly, embodiments of this application also provide an anomaly detection device for indicator data, comprising:

[0037] The acquisition unit is used to acquire the time-series data of the target indicator data to be detected within a preset detection time.

[0038] A visualization processing unit is used to visualize the time-series data and generate a target visualization graph.

[0039] The first determining unit is used to obtain an anomaly reference visualization, which is a visualization corresponding to when the target indicator data is abnormal.

[0040] The second determining unit is used to determine the similarity between the target visualization and the anomaly reference visualization;

[0041] A judgment unit is used to determine whether the similarity reaches a preset first similarity threshold;

[0042] An anomaly detection unit is used to determine that the target indicator data is abnormal if the similarity reaches a preset first similarity threshold.

[0043] Thirdly, embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when run on a computer, causes the computer to execute an anomaly detection method for indicator data as provided in any embodiment of this application.

[0044] Fourthly, embodiments of this application also provide an electronic device, including a processor and a memory, wherein the memory has a computer program, and the processor executes an anomaly detection method for indicator data as provided in any embodiment of this application by calling the computer program.

[0045] The technical solution provided in this application involves acquiring time-series data of a target indicator within a preset detection period, visualizing the time-series data to generate a target visualization map, and obtaining an anomaly reference visualization map. The anomaly reference visualization map is the visualization map corresponding to when the target indicator data becomes abnormal. The similarity between the target visualization map and the anomaly reference visualization map is determined, and it is judged whether the similarity reaches a preset first similarity threshold. If the similarity reaches the preset first similarity threshold, the target indicator data is determined to be abnormal. Compared with related technologies, this application does not require setting a state judgment strategy function and anomaly threshold for each indicator data. It directly determines the anomaly reference visualization map based on the historical time-series data of the target indicator data as a reference for judging whether the target indicator data is abnormal. By comparing the similarity between the target visualization map and the anomaly reference visualization map, the state of the target indicator data can be determined, improving the convenience of anomaly detection for indicator data. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating an anomaly detection method for indicator data provided in an embodiment of this application.

[0048] Figure 2 This is a schematic diagram of a device for detecting anomalies in index data provided in an embodiment of this application.

[0049] Figure 3 This is another structural schematic diagram of the anomaly detection device for indicator data provided in the embodiments of this application.

[0050] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the protection scope of this application.

[0052] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0053] This application provides a method for detecting anomalies in indicator data. The execution entity of this method can be the indicator data anomaly detection device provided in this application, or an electronic device integrating the indicator data anomaly detection device. The indicator data anomaly detection device can be implemented in hardware or software. The electronic device can be a smartphone, tablet computer, PDA, laptop computer, or desktop computer, etc.

[0054] Please see Figure 1 , Figure 1 This is a schematic flowchart of a first method for detecting anomalies in indicator data provided in an embodiment of this application. The method for detecting anomalies in indicator data provided in an embodiment of this application may include the following steps:

[0055] S110. Obtain the time-series data of the target indicator data to be detected within the preset detection time.

[0056] The anomaly detection method for indicator data provided in this application is mainly used for monitoring various indicator data during the operation and maintenance of various systems. For example, indicator data may include interface error rate, CPU utilization, memory usage, network bandwidth, request response time, and error logs, etc.

[0057] Time-series data refers to a series of data arranged in chronological order, used to describe the system's operational status at different points in time. The metric data examples above are all time-series data, for example:

[0058] Interface error rate: Records the number of errors that occurred on the interface over a period of time, such as the interface error rate per minute, the interface error rate per hour, etc.

[0059] CPU utilization: Records the system's CPU usage over a period of time, such as utilization per minute, highest / lowest utilization, etc.

[0060] Memory usage: Records system memory usage, such as memory usage per minute, memory swaps per second, and the number of memory cache operations per second;

[0061] Network bandwidth: Records the upload and download speeds of the network over a period of time, such as hourly upload / download volume, average upload / download speed, etc.

[0062] Request response time: Records the response time of various system services, such as the number of requests processed per second, average response time, and maximum response time;

[0063] Error Log: Records system error information, such as the number of errors per hour, error type, and error source.

[0064] The above are just some examples. In real-world scenarios, time series data also includes many other metrics, and the time series data of different systems will vary.

[0065] In this embodiment, time-series data generated within a preset detection period is selected as reference data for abnormal states of the detection indicator data. This preset detection period can be set by those skilled in the art as needed.

[0066] For example, you can set the preset detection time to 10 minutes, 60 minutes, etc.

[0067] In this embodiment, the electronic device can acquire the time-series data of the target indicator data to be detected within a preset detection time period, and use this time-series data within the preset detection time period as reference data for whether the indicator data is abnormal.

[0068] For example, suppose the target metric to be detected is CPU utilization, which is collected once per minute. The preset detection duration is set to 10 minutes. That is, the electronic device can obtain the time-series data of CPU utilization within 10 minutes as reference data to detect whether the CPU utilization is abnormal.

[0069] S120. Visualize the time series data to generate a target visualization diagram.

[0070] Among them, the visualization chart is used to represent the changes of the target indicator data over time.

[0071] In this embodiment, real-time data can be visualized using data visualization tools such as Grafana and ECharts. These tools can be used to plot time-series data as line charts or other intuitive chart types along a time axis.

[0072] S130. Obtain an anomaly reference visualization chart, wherein the anomaly reference visualization chart is the visualization chart corresponding to when the target indicator data is abnormal.

[0073] Among them, the anomaly reference visualization chart is a visualization chart corresponding to the time series data when the target indicator data is abnormal.

[0074] In this embodiment, target indicator data can be collected periodically and stored as time-series data to facilitate subsequent anomaly detection of the target indicator data.

[0075] In some embodiments, step S130, "obtaining an anomaly reference visualization, wherein the anomaly reference visualization is a visualization corresponding to when the target indicator data is abnormal," may include the following steps S1310 to S1330:

[0076] S1310. Obtain historical time-series data of the target indicator data;

[0077] S1320. Visualize the historical time series data to obtain a historical visualization chart;

[0078] In this embodiment, historical time-series data is also visualized using data visualization tools to obtain a historical visualization chart.

[0079] S1330. Select the historical visualization chart corresponding to the time when the target indicator data of the preset detection period is abnormal as the abnormal reference visualization chart.

[0080] It is understood that the historical time series data in this embodiment corresponds to a historical visualization map. It is possible to determine a portion of the historical abnormal visualization maps corresponding to when the target indicator data in the historical visualization map is abnormal, and select the historical abnormal visualization map with a preset detection duration as the abnormal reference visualization map when the target indicator data is abnormal.

[0081] It is understood that the target visualization and the anomaly reference visualization in this application embodiment correspond to the same time interval, that is, both are preset detection durations.

[0082] In some embodiments, step S1330, "selecting the historical visualization map corresponding to when the target indicator data of the preset detection duration becomes abnormal as the abnormal reference visualization map", may include the following steps S13310 to S13320:

[0083] S13310. Provide the historical visualization to the user through the user interaction interface;

[0084] In this embodiment, a user interface is provided to display the historical visualization, and users can operate and edit the historical visualization data through the user interface.

[0085] S13320. Determine the anomaly reference visualization based on the user's interactive operations on the user interface.

[0086] For example, a historical visualization can be a line chart. Users can drag the mouse on the line chart to select a representative time interval of abnormal target indicator data, and then select the visualization corresponding to that time interval as the anomaly reference visualization. When the user interacts, the area of ​​the visualization corresponding to the selected time interval can be displayed differently to facilitate observation, for example, by highlighting the selected area in blue.

[0087] In some embodiments, step S13320, "determining the anomaly reference visualization based on the user's interactive operation on the user interface," may include the following steps S133210 to S133240:

[0088] S133210. Obtain the first abnormal candidate visualization image selected by the user from the historical visualization image through a selection operation;

[0089] For example, when a user selects a historical visualization, the visualization corresponding to a certain time period can be selected as the first candidate visualization for an anomaly.

[0090] S133220. Determine a second abnormal candidate visualization image from the historical visualization image whose similarity to the first abnormal candidate visualization image meets a preset second similarity threshold.

[0091] The preset second similarity threshold can be selected by those skilled in the art as needed.

[0092] It is understandable that the second anomaly candidate visualization is also a partial image selected from the historical visualizations. When determining the second anomaly candidate visualization, the electronic device can acquire the image features of the first anomaly candidate visualization as the target anomaly image features, and search for image features in the historical visualizations that are the same as or similar to these target anomaly image features as target cropped image features. Based on these target cropped image features, a visualization with a time interval of a preset detection duration is cropped from the historical visualizations as the second anomaly candidate visualization. It is understood that the cropped second anomaly candidate visualization includes these target cropped image features.

[0093] S133230, Recommend the second anomaly candidate visualization to the user;

[0094] For example, the second anomaly candidate visualization recommended to the user can display the similarity value between the second anomaly candidate visualization and the first anomaly candidate visualization, making it convenient for the user to refer to.

[0095] S133240. Determine the anomaly reference visualization from the first anomaly candidate visualization and the second anomaly candidate visualization based on the user's selection operation.

[0096] It is understood that in this embodiment, other visualizations that meet a preset second similarity threshold with the first anomaly candidate visualization selected by the user can be recommended to the user as second anomaly candidate visualizations for viewing and selection, which facilitates the user's selection of anomaly reference visualizations. There can be one or more second anomaly candidate visualizations.

[0097] In some embodiments, step S13320, "determining the anomaly reference visualization based on the user's interactive operation on the user interface," may include the following steps S13350 to S13380:

[0098] S13350: Obtain multiple candidate abnormal visualizations selected by the user from the historical visualizations through a selection operation;

[0099] S13360: Obtain the currently selected anomaly candidate visualization image from the plurality of anomaly candidate visualization images as the target anomaly candidate visualization image;

[0100] S13370. Determine the similarity values ​​between the other anomaly candidate visualization maps besides the target anomaly candidate visualization map and the target anomaly candidate visualization map;

[0101] S13380. The similarity value is displayed in the other anomaly candidate visualizations so that the user can determine the anomaly reference visualization from the multiple anomaly candidate visualizations based on the similarity value.

[0102] Understandably, in this embodiment, the user can select multiple candidate abnormal visualizations from the historical visualizations. When the user selects one of the candidate abnormal visualizations, the electronic device automatically calculates the similarity value between the selected candidate abnormal visualization and the other candidate abnormal visualizations, and displays the similarity value on the corresponding other candidate abnormal visualizations. The user can use the displayed similarity value as a reference to determine the final selected abnormal reference visualization, which facilitates the user's selection of the abnormal reference visualization.

[0103] S140. Determine the similarity between the target visualization and the anomaly reference visualization.

[0104] In this embodiment, the similarity between the target visualization and the abnormal reference visualization is compared to determine whether the target indicator has become abnormal.

[0105] In some embodiments, step S140, "determining the similarity between the target visualization and the abnormal reference visualization," may include the following steps S1410 to S1430:

[0106] S1410. Obtain the first image feature of the target visualization image;

[0107] S1420. Obtain the second image feature of the anomaly reference visualization map;

[0108] S1430. Calculate the image similarity based on the first image features and the second image features to obtain the similarity.

[0109] In this embodiment, the similarity between the first image feature and the second image feature can be calculated using an image similarity algorithm.

[0110] S150. Determine whether the similarity reaches a preset first similarity threshold;

[0111] The preset first similarity threshold can be set by those skilled in the art. When setting this preset first similarity threshold, a similarity value between the first and second candidate anomaly visualizations described above can be provided when the user selects an anomaly reference visualization, helping the user to set the preset first similarity threshold more intuitively. For example, the similarity value between the second and first candidate anomaly visualizations can be attached to the user interface, and this similarity value can be displayed on the user interface to inform the user of the similarity between the second and first candidate anomaly visualizations.

[0112] S160. If the similarity reaches a preset first similarity threshold, it is determined that the target indicator data is abnormal.

[0113] In this embodiment, when the similarity between the target visualization and the abnormal reference visualization reaches a preset first similarity threshold, it indicates that the target indicator data is abnormal and the target indicator data is in an abnormal state.

[0114] In some embodiments, multiple similarity threshold intervals can be set to satisfy different degrees of similarity between target indicator data in different similarity threshold intervals, reflecting the degree of anomaly in the target indicator data based on different similarity levels. For example, three similarity threshold intervals can be set from high to low similarity: a first similarity threshold interval, a second similarity threshold interval, and a third similarity threshold interval. The first similarity threshold interval corresponds to a high anomaly level for the target indicator data, the second similarity threshold interval corresponds to a medium anomaly level for the target indicator data, and the third similarity threshold interval corresponds to a low anomaly level for the target indicator data. The specific range of values ​​for the similarity threshold intervals can be set by those skilled in the art based on actual circumstances.

[0115] In practice, this application is not limited by the execution order of the described steps. Without causing conflicts, some steps may be performed in other orders or simultaneously.

[0116] As can be seen from the above, the anomaly detection method for indicator data provided in this application obtains the time-series data of the target indicator data to be detected within a preset detection period, performs visualization processing on the time-series data to generate a target visualization map, determines an anomaly reference visualization map based on the historical time-series data of the target indicator data, determines the similarity between the target visualization map and the anomaly reference visualization map, and judges whether the similarity reaches a preset first similarity threshold. If the similarity reaches the preset first similarity threshold, it is determined that the target indicator data is abnormal. This application directly determines the anomaly reference visualization map based on the historical time-series data of the target indicator data to be detected as a reference for judging whether the target indicator data is abnormal. By comparing the similarity between the target visualization map and the anomaly reference visualization map, the state of the target indicator data can be determined, which improves the convenience of anomaly detection for indicator data.

[0117] The anomaly detection method for indicator data provided in this application embodiment may include, but is not limited to, the following aspects:

[0118] Data Center: Data centers need to monitor the status and problems of multiple servers and network devices in real time. For certain key indicators, such as network latency and CPU utilization, this method can be used for real-time monitoring and alerting.

[0119] Cloud services: Cloud service providers need to monitor the operating status and resource utilization of their cloud hosts and cloud storage in real time, and this method can be used to implement intelligent alarm functions.

[0120] Cloud-native: monitoring of Kubernetes infrastructure, container runtime status, and core application metrics.

[0121] After step S160, "If the similarity reaches a preset first similarity threshold, determine that the target indicator data is abnormal," the following steps may also be included:

[0122] S170. Generate an alarm notification that the target indicator data is abnormal;

[0123] For example, the alarm notification can be in the form of an alarm floating window. When the target data is abnormal, the alarm floating window will pop up to the display interface of the electronic device, displaying information about the abnormality of the target indicator data.

[0124] For example, the alarm notification can be in the form of a notification message. When the target data is abnormal, the notification message is displayed in the notification bar of the electronic device, which shows that the target indicator data is abnormal.

[0125] S180. Send the alarm notification to the designated external electronic device.

[0126] In this embodiment, the alarm notification can be sent to the current electronic device to notify the target indicator data of an abnormal state. At the same time, the alarm notification can also be sent to an external electronic device, such as a mobile phone or computer used by relevant maintenance personnel, so that maintenance personnel can quickly know that the indicator data has become abnormal and handle it in a timely manner.

[0127] In one embodiment, an anomaly detection device for indicator data is also provided. Please refer to [link / reference]. Figure 2 , Figure 2 This is a schematic diagram of a structural anomaly detection device 200 for indicator data provided in an embodiment of this application. The anomaly detection device 200 is applied to an electronic device and includes an acquisition unit 201, a visualization processing unit 202, a first determination unit 203, a second determination unit 204, a judgment unit 205, and an anomaly determination unit 207, as follows:

[0128] The acquisition unit 201 is used to acquire the time-series data of the target indicator data to be detected within a preset detection time.

[0129] The visualization processing unit 202 is used to perform visualization processing on the time series data to generate a target visualization diagram;

[0130] The first determining unit 203 is used to obtain an anomaly reference visualization chart, wherein the anomaly reference visualization chart is the visualization chart corresponding to when the target indicator data is abnormal;

[0131] The second determining unit 204 is used to determine the similarity between the target visualization and the anomaly reference visualization;

[0132] The judgment unit 205 is used to determine whether the similarity reaches a preset first similarity threshold;

[0133] The anomaly determination unit 207 is used to determine that the target indicator data is abnormal if the similarity reaches a preset first similarity threshold.

[0134] In some embodiments, the first determining unit 203 may be used for:

[0135] Obtain historical time-series data of the target indicator data;

[0136] The historical time-series data is visualized to obtain a historical visualization chart;

[0137] The historical visualization chart corresponding to the occurrence of anomalies in the target indicator data during the preset detection period is selected as the anomaly reference visualization chart.

[0138] In some embodiments, the first determining unit 203 may be used for:

[0139] The historical visualization is provided to the user through a user interface.

[0140] The anomaly reference visualization is determined based on the user's interactive operations on the user interface.

[0141] In some embodiments, the first determining unit 203 may be used for:

[0142] Obtain the first candidate anomaly visualization selected by the user from the historical visualizations through a selection operation;

[0143] From the historical visualization map, a second abnormal candidate visualization map is determined whose similarity to the first abnormal candidate visualization map meets a preset second similarity threshold;

[0144] Recommend the second anomaly candidate visualization to the user;

[0145] The anomaly reference visualization is determined from the first anomaly candidate visualization and the second anomaly candidate visualization based on the user's selection.

[0146] In some embodiments, the first determining unit 203 may be used for:

[0147] Obtain multiple candidate anomaly visualizations selected by the user from the historical visualizations through a selection operation;

[0148] Obtain the currently selected anomaly candidate visualization image from the multiple anomaly candidate visualization images as the target anomaly candidate visualization image;

[0149] Determine the similarity values ​​between the other anomaly candidate visualizations besides the target anomaly candidate visualization and the target anomaly candidate visualization;

[0150] The similarity value is displayed in the other anomaly candidate visualizations so that the user can determine the anomaly reference visualization from the multiple anomaly candidate visualizations based on the similarity value.

[0151] In some embodiments, the second determining unit 204 may be used for:

[0152] Obtain the first image features of the target visualization;

[0153] Obtain the second image features of the anomaly reference visualization;

[0154] The similarity is obtained by calculating the image similarity based on the first image feature and the second image feature.

[0155] In some embodiments, please refer to Figure 3 , Figure 3 This is another schematic diagram of the anomaly detection device 200 for indicator data provided in the embodiments of this application. The anomaly detection device 200 for indicator data may further include an alarm notification unit 207, a time-series data acquisition unit 208, and a time-series data storage unit 209.

[0156] The alarm notification unit can be used to alert the user that the target indicator data is abnormal.

[0157] In some embodiments, the alarm notification unit may be used for:

[0158] Generate an alarm notification when the target indicator data is abnormal;

[0159] Send the alarm notification to the designated external electronic device.

[0160] In some embodiments, the time-series data acquisition unit 208 can be used for:

[0161] Collect data on the target indicators.

[0162] In some embodiments, the time-series data storage unit 209 can be used for:

[0163] The collected target indicator data will be stored as time-series data.

[0164] It should be noted that the anomaly detection device for indicator data provided in this application embodiment and the anomaly detection method for indicator data in the above embodiment belong to the same concept. Any of the methods provided in the anomaly detection method embodiment for indicator data can be implemented through this anomaly detection device for indicator data. For details of its implementation process, please refer to the anomaly detection method embodiment for indicator data, which will not be repeated here.

[0165] Furthermore, to better implement the anomaly detection method for indicator data in the embodiments of this application, this application also provides an electronic device based on the anomaly detection method for indicator data. Please refer to... Figure 4 , Figure 4 A schematic diagram of one structure of the electronic device 300 provided in this application is shown, such as... Figure 4 As shown, the electronic device 300 provided in this application includes a processor 301 and a memory 302. The processor 301 executes the computer program stored in the memory 302 to implement the steps of the anomaly detection method for indicator data as described in the above embodiments of this application, such as:

[0166] Acquire time-series data of the target indicator to be detected within a preset detection duration;

[0167] The time-series data is then visualized to generate a target visualization graph.

[0168] Obtain an anomaly reference visualization, which is the visualization corresponding to when the target indicator data is abnormal;

[0169] Determine the similarity between the target visualization and the anomaly reference visualization;

[0170] Determine whether the similarity reaches a preset first similarity threshold;

[0171] If the similarity reaches a preset first similarity threshold, the target indicator data is determined to be abnormal.

[0172] For example, a computer program can be divided into one or more modules / units, one or more of which are stored in memory 302 and executed by processor 301 to complete the embodiments of this application. One or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a computer device.

[0173] Electronic device 300 may include, but is not limited to, processor 301 and memory 302. Those skilled in the art will understand that the illustrations are merely examples of electronic device 300 and do not constitute a limitation on electronic device 300. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, electronic device 300 may also include input / output devices, network access devices, buses, etc., with processor 301, memory 302, input / output devices, and network access devices connected via a bus.

[0174] Processor 301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of electronic device 300, connecting various parts of the electronic device 300 through various interfaces and lines.

[0175] The memory 302 can be used to store computer programs and / or modules. The processor 301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302 and by calling the data stored in the memory 302. The memory 302 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 300 (such as audio data, video data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0176] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described anomaly detection device, electronic device 300 and its corresponding units can be referred to the description of the anomaly detection method for indicator data in the above embodiments of this application, and will not be repeated here.

[0177] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0178] Therefore, embodiments of this application provide a computer-readable storage medium storing multiple instructions that can be loaded by a processor to execute steps in the anomaly detection method for indicator data in the above embodiments of this application, such as:

[0179] Acquire time-series data of the target indicator to be detected within a preset detection duration;

[0180] The time-series data is then visualized to generate a target visualization graph.

[0181] Obtain an anomaly reference visualization, which is the visualization corresponding to when the target indicator data is abnormal;

[0182] Determine the similarity between the target visualization and the anomaly reference visualization;

[0183] Determine whether the similarity reaches a preset first similarity threshold;

[0184] If the similarity reaches a preset first similarity threshold, the target indicator data is determined to be abnormal.

[0185] For specific instructions, please refer to the description of the anomaly detection method for indicator data in the above embodiments of this application, which will not be repeated here.

[0186] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0187] Since the instructions stored in the computer-readable storage medium can execute the steps in the anomaly detection method for indicator data in the above embodiments of this application, the beneficial effects that the anomaly detection method for indicator data in the above embodiments of this application can achieve can be realized, as detailed in the preceding description, and will not be repeated here.

[0188] Furthermore, the terms "first," "second," and "third," etc., used in this application are used to distinguish different objects, not to describe a specific order. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but some embodiments may also include steps or modules not listed, or some embodiments may include other steps or modules inherent to these processes, methods, products, or devices.

[0189] The above provides a detailed description of an anomaly detection method, apparatus, electronic device, and storage medium for indicator data provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting anomalies in indicator data, characterized in that, include: Acquire time-series data of the target indicator to be detected within a preset detection duration; The time-series data is then visualized to generate a target visualization graph. Obtain an anomaly reference visualization, which is the visualization corresponding to when the target indicator data is abnormal; Determine the similarity between the target visualization and the anomaly reference visualization; Determine whether the similarity reaches a preset first similarity threshold; If the similarity reaches a preset first similarity threshold, the target indicator data is determined to be abnormal; The step of obtaining the anomaly reference visualization includes: obtaining historical time-series data of the target indicator data; visualizing the historical time-series data to obtain a historical visualization; providing the historical visualization to a user through a user interface; obtaining a first anomaly candidate visualization selected by the user from the historical visualization; determining a second anomaly candidate visualization from the historical visualization that has a similarity to the first anomaly candidate visualization that meets a preset second similarity threshold; recommending the second anomaly candidate visualization to the user; and determining the anomaly reference visualization from the first and second anomaly candidate visualizations based on the user's selection.

2. The method for detecting anomalies in indicator data as described in claim 1, characterized in that, The step of determining the anomaly reference visualization based on the user's interactive operations on the user interface includes: Obtain multiple candidate anomaly visualizations selected by the user from the historical visualizations through a selection operation; Obtain the currently selected anomaly candidate visualization image from the multiple anomaly candidate visualization images as the target anomaly candidate visualization image; Determine the similarity values ​​between the other anomaly candidate visualizations besides the target anomaly candidate visualization and the target anomaly candidate visualization; The similarity value is displayed in the other anomaly candidate visualizations so that the user can determine the anomaly reference visualization from the multiple anomaly candidate visualizations based on the similarity value.

3. The method for detecting anomalies in indicator data as described in claim 1, characterized in that, Determining the similarity between the target visualization and the anomaly reference visualization includes: Obtain the first image features of the target visualization; Obtain the second image features of the anomaly reference visualization; The similarity is obtained by calculating the image similarity based on the first image feature and the second image feature.

4. The method for detecting anomalies in indicator data as described in claim 1, characterized in that, After determining that the target indicator data is abnormal if the similarity reaches a preset first similarity threshold, the method further includes: Generate an alarm notification when the target indicator data is abnormal; Send the alarm notification to the designated external electronic device.

5. An anomaly detection device for indicator data, characterized in that, Includes an anomaly detection method for performing the indicator data as described in any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run on a computer, it causes the computer to perform the anomaly detection method for indicator data as described in any one of claims 1 to 4.

7. An electronic device comprising a processor and a memory, the memory storing a computer program, characterized in that, The processor invokes the computer program to execute the anomaly detection method for indicator data as described in any one of claims 1 to 4.

Images