An abnormality detection method, device, and equipment of data and medium

Abstract

The application discloses a kind of data's exception detection method, device, equipment and medium.The method comprises: obtaining the current time sequence of the index to be detected at current time, and judging whether there is target category matched with the current time sequence in the cluster model established in advance;If yes, when the target category is stable category, the abnormal detection result of the index to be detected is obtained according to the cluster model;When the target category is variable category, the abnormal detection result of the index to be detected is obtained according to the cluster model and the abnormal detection model trained in advance;If no, the abnormal detection result of the index to be detected is obtained according to the abnormal detection model.Through using the above technical scheme, the detection efficiency of time sequence anomaly can be improved, the abnormal discovery rate is improved, and the abnormal false alarm rate is reduced.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, device, and medium for detecting data anomalies. Background Technology

[0002] Anomaly detection in data refers to the process of identifying unreasonable, irregular, or unusual behaviors or events within data. Anomaly detection can be applied to many different fields, such as finance, power, manufacturing, and healthcare. Different anomaly detection methods exist for multimodal data in different fields, the most common including anomaly detection for time series, image, and video data. By detecting anomalies, risks, anomalies, or fraudulent situations can be identified, and necessary measures can be taken to prevent or resolve the problems.

[0003] Common methods for anomaly detection in time series data include statistical models, machine learning, and deep learning. However, statistical models for anomaly detection often have strict requirements on the data distribution of the time series data to be detected. For example, the nSigma algorithm requires the data distribution to meet a normal distribution, but in reality, various time series data have different forms, making statistical models relatively less universal. Machine learning-based anomaly detection requires a lot of manual annotation work, which consumes a lot of human resources. Moreover, for domains with few anomaly samples, obtaining a large number of anomaly samples for labeling and classification is costly. Deep learning-based anomaly detection algorithms may be difficult to understand, which may lead to users finding it difficult to determine the cause of the anomaly judgment. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for detecting data anomalies, which can improve the detection efficiency of time series anomalies, increase the anomaly detection rate, and reduce the false alarm rate.

[0005] According to one aspect of the present invention, a method for detecting anomalies in data is provided, comprising:

[0006] Obtain the current time series of the indicator to be detected at the current time, and determine whether there is a target category that matches the current time series in the pre-established clustering model;

[0007] If so, when the target category is a stable category, the anomaly detection result of the target indicator is obtained according to the clustering model; when the target category is a variable category, the anomaly detection result of the target indicator is obtained in collaboration with the clustering model and the pre-trained anomaly detection model.

[0008] If not, then obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model.

[0009] According to another aspect of the present invention, a data anomaly detection device is provided, comprising:

[0010] The target category confirmation module is used to obtain the current time series of the indicator to be detected at the current time, and to determine whether there is a target category that matches the current time series in the pre-established clustering model;

[0011] The first anomaly detection module is used to, if the target category is a stable category, obtain the anomaly detection result of the target indicator according to the clustering model; if the target category is a variable category, obtain the anomaly detection result of the target indicator in conjunction with the clustering model and the pre-trained anomaly detection model.

[0012] The second anomaly detection module is used to obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model if the anomaly is not detected.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data anomaly detection method according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data anomaly detection method according to any embodiment of the present invention.

[0018] The technical solution of this invention obtains the current time series of the indicator to be detected at the current time, determines whether there is a target category matching the current time series in the clustering model, determines whether the target category is a stable category, and determines the model for anomaly detection of the current time series based on the judgment result. The method of using the corresponding model for anomaly detection can achieve accurate and efficient anomaly detection of the current time series, effectively improve the anomaly detection rate, reduce the false alarm rate, and effectively improve the interpretability of the anomaly detection algorithm, meeting the time series anomaly detection needs in real-world scenarios and making it easier for users to understand the reasons for data anomalies.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a data anomaly detection method provided in Embodiment 1 of the present invention;

[0022] Figure 2 This is a flowchart of another data anomaly detection method provided in Embodiment 2 of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of a data anomaly detection device according to Embodiment 3 of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the data anomaly detection method of this invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] Figure 1 This is a flowchart of a data anomaly detection method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where anomalies are detected in various indicators of a computer. The method can be executed by a data anomaly detection device, which can be implemented in hardware and / or software, and is generally configured in a computer or processor with data processing capabilities. Figure 1 As shown, the method includes:

[0029] S110. Obtain the current time series of the indicator to be detected at the current time, and determine whether there is a target category that matches the current time series in the pre-established clustering model; if yes, execute S120; if no, execute S130.

[0030] Optionally, the indicator to be detected can be understood as the data indicator to which the data currently being detected belongs. For example, when detecting computer data, the indicator to be detected can be information such as CPU utilization and disk capacity.

[0031] Optionally, time series data can typically store data for each time point within a single calendar day. For example, data for each minute within a calendar day can be stored chronologically to generate a time series. The current time series can be understood as a time series composed of data for each time point from 00:00 to the present. In a more specific example, using one minute as a time point, the time series of the indicator to be detected before 8:00 on the current day can store the data for each minute from 00:00 to 8:00. The time series before 8:00 can be represented as ts = (v1,...,v...). i-1 ,v i ,v i+1 ,...,v 480 ).

[0032] Optionally, the clustering model can store multiple categories for multiple indicators, with different classification methods for different indicators. For example, for the indicator of CPU utilization, the utilization rate of the same computer may be different on weekdays and weekends, or it may be different during working hours and rest hours. Therefore, it can be classified according to historical CPU utilization.

[0033] Optionally, in a clustering model, there may be multiple categories that match the current time series. The category with the highest matching degree to the current time series can be used as the target category of the current time series.

[0034] Optionally, in the clustering model, each category has a matching time series, which is the result of model training. This time series records the average value of the data collected for that category at each time point within a historical period. For example, when using 1 minute as a time point, each category can include 1440 data values, each value being the average value of the data for that category at each minute within a historical time period. The time series of a specific category can be represented as cluster_avg = [avg1, avg2, avg3, ..., avg...]. 1440 ].

[0035] Optionally, the cluster to which the target time series belongs in the clustering model can be calculated using Euclidean distance. Continuing the previous example, if the current time series is ts and the time series of a certain cluster in the clustering model is cluster_avg, then v1 and avg1, v2 and avg2, ..., v 480 with avg 480 The Euclidean distance between the time series and the time series is used to determine the category of the current time series by measuring the Euclidean distance at each time point.

[0036] Optionally, the category determination can consider the following conditions: A percentage of time points can be preset. When more than the preset percentage of time points belong to a certain category, the target time series can be determined to belong to that category. For example, if 80% of the time points belong to a certain category, the time series can be determined to belong to that category. That is, when there are 384 time points that all belong to category 1, the target time series belongs to category 1. When determining the target category for each time point, the category with the closest Euclidean distance to a certain time point can generally be used as its target category. However, for some categories, there may be a distance threshold. That is, even if the time point is closest to the category in Euclidean distance, if the Euclidean distance is greater than the threshold of the category, the time point does not belong to that category.

[0037] S120. When the target category is a stable category, obtain the anomaly detection result of the indicator to be detected according to the clustering model; when the target category is a variable category, obtain the anomaly detection result of the indicator to be detected in collaboration with the clustering model and the pre-trained anomaly detection model.

[0038] Optionally, a time range can be set for category determination. If all time points within this time range belong to the target category, the target category can be determined as a stable category. If some time points within this time range belong to the target category and some time points belong to other categories, the target category can be determined as a variable category.

[0039] Optionally, during the training of the clustering model, the upper and lower bounds of each category are calculated. If the value at a certain time point in the current time series is greater than the upper bound of the target category or less than the lower bound of the target category, the value at that time point can be determined to be an outlier.

[0040] Optionally, the anomaly detection model can also be a pre-trained model. By inputting the time series data into the anomaly detection model, the anomaly detection results can be obtained.

[0041] Optionally, when the target category is a variable category, the data is only identified as anomalous data when both the clustering model and the anomaly detection model determine that the data at a certain point in time is anomalous data.

[0042] It is understandable that using clustering models for anomaly detection can directly call pre-trained upper and lower bound values ​​for detection, resulting in high detection efficiency. However, for time series that cannot be clearly classified or cannot be classified at all, anomaly detection models can be combined to improve the robustness of anomaly detection and reduce false alarms in anomaly judgment results.

[0043] S130. Obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model.

[0044] Optionally, the anomaly detection model can be an isolation forest model.

[0045] The technical solution of this invention obtains the current time series of the indicator to be detected at the current time, determines whether there is a target category matching the current time series in the clustering model, determines whether the target category is a stable category, and determines the model for anomaly detection of the current time series based on the judgment result. The method of using the corresponding model for anomaly detection can achieve accurate and efficient anomaly detection of the current time series, effectively improve the anomaly detection rate, reduce the false alarm rate, and effectively improve the interpretability of the anomaly detection algorithm, meeting the time series anomaly detection needs in real-world scenarios and making it easier for users to understand the reasons for data anomalies.

[0046] Example 2

[0047] Figure 2 This is a flowchart of a data anomaly detection method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment specifically illustrates the data anomaly detection method. Figure 2 As shown, the method includes:

[0048] S210. Obtain the current time series of the indicator to be detected at the current time and the clustering information of the indicator to be detected. Based on the clustering information of the indicator to be detected, determine whether there is an optional category in the clustering model that matches the indicator to be detected. If yes, proceed to step S220. If no, proceed to step S230.

[0049] Optionally, clustering information can be keywords for the metric to be detected. For example, when the metric to be detected is CPU utilization, the time information or date information of the current time series can be obtained as clustering information.

[0050] S220. Determine the time range to be detected based on the current time, and determine the target category with the highest matching degree with the current time series in each optional category based on the data values ​​of each time point in the time range to be detected in each optional category; execute step S240.

[0051] Optionally, the time range to be detected can be a range consisting of 0:00 on the current day to the current time, or it can be a specified time range, without any specific restrictions.

[0052] S230. Determine that there is no target category in the clustering model that matches the current time series; execute step S2110.

[0053] S240. Obtain a preset reference time range and determine whether the categories that match each time point in the reference time range in the current time series are all target categories; if yes, proceed to step S250; if no, proceed to step S280.

[0054] S250. Determine the target category as a stable category.

[0055] S260. Based on the clustering model, obtain the upper and lower bound values ​​of the target time point in the current time series, and determine the anomaly range based on the upper and lower bound values.

[0056] Optionally, the anomaly range can be a range of data that is greater than the upper limit value and a range of data that is less than the lower limit value.

[0057] S270. If the data value at the target time point is within the abnormal range, then the indicator to be detected is determined to be in an abnormal state at the target time point.

[0058] S280. Determine the target category as a variable category.

[0059] S290. Based on the clustering model, obtain the upper and lower bound values ​​of the target time point in the current time series, and determine the anomaly range based on the upper and lower bound values.

[0060] S2100. If the data value at the target time point is within the abnormal range, and the detection result of the target time point output by the abnormality detection model is also abnormal, then the indicator to be detected at the target time point is determined to be in an abnormal state.

[0061] S2110. Obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model.

[0062] The technical solution of this invention obtains the current time series of the indicator to be detected at the current time, determines whether there is a target category matching the current time series in the clustering model, determines whether the target category is a stable category, and determines the model for anomaly detection of the current time series based on the judgment result. The method of using the corresponding model for anomaly detection can achieve accurate and efficient anomaly detection of the current time series, effectively improve the anomaly detection rate, reduce the false alarm rate, and effectively improve the interpretability of the anomaly detection algorithm, meeting the time series anomaly detection needs in real-world scenarios and making it easier for users to understand the reasons for data anomalies.

[0063] Furthermore, before obtaining the current time series of the indicator to be detected at the current time, it may also include:

[0064] Acquire detection data of the first target indicator at each time point within the first data collection time range, and preprocess the detection data;

[0065] The preprocessed detection data is divided into days, and the detection data of each day is converted into the mean and variance of multiple first time windows in turn, generating dimensionality-reduced data corresponding to each day within the first data collection time range.

[0066] The dimensionality-reduced data are combined to generate training data for the clustering model;

[0067] Clustering is performed based on the training data of the clustering model to obtain multiple cluster categories that match the first target indicator. The mean, upper bound, and lower bound of each cluster category at each time point are then obtained to generate the clustering model.

[0068] Optionally, the first target metric can refer to the current data metric used in training the clustering model, and the first data collection time can be a preset data collection time, for example, the first data collection time can be three months, and the detection data at each time point within the first data collection time can be used to train the clustering model.

[0069] Optionally, the preprocessing of the detection data may include grouping, deduplication, data quality verification, and missing value imputation. Grouping can group the detection data by natural day; deduplication refers to deleting duplicate data within each group; data quality verification can verify the missing rate of each group. If the missing rate of a group is greater than a preset missing rate threshold, the data in that group cannot be used as training data; missing value imputation refers to filling missing data in groups that have missing values ​​but whose missing rate is less than the missing rate threshold. Imputation methods may include forward imputation, backward imputation, and mean imputation, etc.

[0070] Optionally, the first time window can refer to the time window for data dimensionality reduction used to generate training data for the clustering model. For example, an 8-hour time window can be set.

[0071] In an optional example, the preprocessed time series for a given day can be [ts1, ts2, ts3, ..., ts 1440 The training data generated after dimensionality reduction can be [avg1, std1, avg2, std2, avg3, std3], where avg... i std represents the mean of all values ​​in the i-th time window. i This represents the variance of all values ​​in the i-th time window. Specifically, avg1 can be understood as the variance from ts1 to ts. 480 The average value, std1 can be understood as the value from ts1 to ts 480 The variance of , and inferences from this.

[0072] Continuing the previous example, after performing the above processing on all qualified data within the first data collection time frame, the final training data can be obtained:

[0073]

[0074] Among them, avg n,i std represents the mean of all values ​​in the i-th time window on day n. n,i This represents the variance of the i-th time window on day n; each row represents the training data obtained after dimensionality reduction of the original data for a certain day.

[0075] Optionally, clustering can be performed using the training data mentioned above. The clustering algorithm can be DBSCAN (Density-Based Spatial Clustering of Applications with Noise), and the MinPts parameter of DBSCAN can be set to... Here, len(train_data) can represent the length of the training data, or it can refer to the value of n in the training data mentioned above.

[0076] Furthermore, assuming that after clustering, a total of m categories are obtained, where the i-th category contains n objects (i.e., n days), then the original time series data of the i-th category can be:

[0077]

[0078] Among them, ts n,j This represents the original value of the j-th point on day n.

[0079] Optionally, the mean value (cluster_avg) for each time point of this category can be calculated using the following formula:

[0080]

[0081] Among them, avg i This represents the mean of all values ​​corresponding to the i-th point on each day in this class.

[0082] Optionally, the upper bound value `cluster_upper` and the lower bound value `cluster_lower` corresponding to each time point of this category can be calculated using the following formula:

[0083] cluster_upper = [avg i +3*std i for j in[1,1440]];

[0084] cluster_lower = [avg i -3*std i for j in[1,1440]];

[0085] Among them, std i This represents the variance of all values ​​corresponding to the i-th point on each day in this class.

[0086] Obtaining the mean, upper bound, and lower bound of each time point within each cluster category can include:

[0087] Combine the time series of each day in the target cluster category in chronological order to generate the original time series that matches the target cluster category;

[0088] Based on the data at each time point in the original time series, the mean and variance of each time point under the target cluster category are calculated;

[0089] Based on the mean and variance of each time point under the target cluster category, the upper and lower bounds of each time point under the target cluster category are calculated.

[0090] Furthermore, before obtaining the current time series of the indicator to be detected at the current time, it may also include:

[0091] The detection data of the second target indicator at each time point within the second data collection time range are obtained and preprocessed to obtain the time series of the second target indicator for each day within the second data collection time range.

[0092] Based on the time series of the second target indicator, obtain the variance difference and the variance of the first difference of each time point within the second time window within the second data collection time range.

[0093] The time series, variance difference, and variance of the first difference of the second target indicator are combined to generate training data for the anomaly detection model.

[0094] The model is trained based on the training data of the anomaly detection model, and the trained anomaly detection model is obtained.

[0095] Optionally, the second target metric can refer to the current data metric used in training the anomaly classification model, and the second data collection time can be a preset data collection time, for example, the second data collection time can be one month, and the detection data at each time point within the second data collection time can be used to train the anomaly detection model.

[0096] Optionally, the preprocessing of the detection data may include grouping, deduplication, data quality verification, and missing value imputation. Grouping can group the detection data by natural day; deduplication refers to deleting duplicate data within each group; data quality verification can verify the missing rate of each group. If the missing rate of a group is greater than a preset missing rate threshold, the data in that group cannot be used as training data; missing value imputation refers to filling missing data in groups that have missing values ​​but whose missing rate is less than the missing rate threshold. Imputation methods may include forward imputation, backward imputation, and mean imputation, etc.

[0097] Optionally, the second time window can refer to the data augmentation time window used to generate training data for the anomaly detection model. For example, a time window can be set every 5 minutes.

[0098] Continuing the previous example, the variance difference of time point i within the second time window within the second data collection time range can be std_change. i =σ(P1)-σ(P2), where P1=(v m ,...,v i-1 ,v i ,v i+1 ,...,v n ), P2 = (v m ,...,v i-1 ,vi+1 ,...,v n ), v i Let represent the value of the i-th point. Within the second data collection timeframe, time point i is within the second time window, i.e., within 5 minutes. The variance of the first-order difference can be... Among them, diff i This represents the first-order difference at the i-th point. This represents the mean of the first differences of all points within this time window.

[0099] Optionally, if the preprocessed data is:

[0100] [v 1,1 ,v 1,2 ,...,v 1,1440 ,...,v i,1 ,v i,2 ,...,v i,1440 ];

[0101] The training data for the anomaly detection model can then be:

[0102]

[0103] Among them, v i,k This represents the value at the k-th time point on the i-th day.

[0104] Example 3

[0105] Figure 3 This is a schematic diagram of a data anomaly detection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a target category confirmation module 310, a first anomaly detection module 320, and a second anomaly detection module 330.

[0106] The target category confirmation module 310 is used to obtain the current time series of the indicator to be detected at the current time, and to determine whether there is a target category that matches the current time series in the pre-established clustering model.

[0107] The first anomaly detection module 320 is used to, if the target category is a stable category, obtain the anomaly detection result of the target index according to the clustering model; and if the target category is a variable category, obtain the anomaly detection result of the target index in collaboration with the clustering model and the pre-trained anomaly detection model.

[0108] The second anomaly detection module 330 is used to obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model if no.

[0109] The technical solution of this invention obtains the current time series of the indicator to be detected at the current time, determines whether there is a target category matching the current time series in the clustering model, determines whether the target category is a stable category, and determines the model for anomaly detection of the current time series based on the judgment result. The method of using the corresponding model for anomaly detection can achieve accurate and efficient anomaly detection of the current time series, effectively improve the anomaly detection rate, reduce the false alarm rate, and effectively improve the interpretability of the anomaly detection algorithm, meeting the time series anomaly detection needs in real-world scenarios and making it easier for users to understand the reasons for data anomalies.

[0110] Based on the above embodiments, the target category confirmation module 310 can be specifically used for:

[0111] Obtain the current time series of the indicator to be detected and the clustering information of the indicator to be detected at the current time, and determine whether there is an optional category in the clustering model that matches the indicator to be detected based on the clustering information of the indicator to be detected.

[0112] If it exists, then the time range to be detected is determined based on the current time, and the target category with the highest matching degree with the current time series is determined in each optional category based on the current time series and the data values ​​of each time point in the time range to be detected in each optional category.

[0113] If not, it is determined that there is no target category in the clustering model that matches the current time series.

[0114] Based on the above embodiments, the first anomaly detection module 320 may include a stable category anomaly detection unit and a variable category anomaly detection unit.

[0115] Based on the above embodiments, the stable category anomaly detection unit can be specifically used for:

[0116] Obtain a preset reference time range and determine whether the categories that match each time point in the current time series within the reference time range are all the target category; if so, determine that the target category is a stable category.

[0117] Based on the clustering model, the upper and lower bounds of the target time point in the current time series are obtained, and the anomaly range is determined based on the upper and lower bounds.

[0118] If the data value at the target time point is within the abnormal range, then the indicator to be detected is determined to be in an abnormal state at the target time point.

[0119] Based on the above embodiments, the variable category anomaly detection unit can be specifically used for:

[0120] Obtain a preset reference time range and determine whether the categories that match each time point within the reference time range in the current time series are all the target category; if not, determine that the target category is a variable category.

[0121] Based on the clustering model, the upper and lower bounds of the target time point in the current time series are obtained, and the anomaly range is determined based on the upper and lower bounds.

[0122] If the data value at the target time point is within the abnormal range, and the detection result of the target time point output by the anomaly detection model is also abnormal, then the indicator to be detected at the target time point is determined to be in an abnormal state.

[0123] Based on the above embodiments, a clustering model training module may also be included, specifically including:

[0124] The first target indicator detection data acquisition unit is used to acquire the detection data of the first target indicator at each time point within the first data collection time range, and to preprocess the detection data.

[0125] The dimensionality reduction data generation unit is used to divide the preprocessed detection data by day, and sequentially convert the detection data of each day into the mean and variance of multiple first time windows to generate dimensionality reduction data corresponding to each day within the first data collection time range.

[0126] The training data generation unit is used to combine the dimensionality-reduced data to generate training data for the clustering model.

[0127] The reference value acquisition unit is used to perform clustering based on the training data of the clustering model, obtain multiple cluster categories that match the first target index, and obtain the mean, upper bound, and lower bound values ​​at each time point under each cluster category to generate a clustering model.

[0128] Based on the above embodiments, the reference value acquisition unit can be specifically used for:

[0129] Combine the time series of each day in the target cluster category in chronological order to generate the original time series that matches the target cluster category;

[0130] Based on the data at each time point in the original time series, the mean and variance of each time point under the target cluster category are calculated;

[0131] Based on the mean and variance of each time point under the target cluster category, the upper and lower bounds of each time point under the target cluster category are calculated.

[0132] Based on the above embodiments, an anomaly detection model training module may also be included, specifically for:

[0133] The detection data of the second target indicator at each time point within the second data collection time range are obtained and preprocessed to obtain the time series of the second target indicator for each day within the second data collection time range.

[0134] Based on the time series of the second target indicator, obtain the variance difference and the variance of the first difference of each time point within the second time window within the second data collection time range.

[0135] The time series, variance difference, and variance of the first difference of the second target indicator are combined to generate training data for the anomaly detection model.

[0136] The model is trained based on the training data of the anomaly detection model, and the trained anomaly detection model is obtained.

[0137] The data anomaly detection device provided in the embodiments of the present invention can execute the data anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0138] Example 4

[0139] Figure 4 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0140] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0141] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0142] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the data anomaly detection method as described in the embodiments of the present invention. That is:

[0143] Obtain the current time series of the indicator to be detected at the current time, and determine whether there is a target category that matches the current time series in the pre-established clustering model;

[0144] If so, when the target category is a stable category, the anomaly detection result of the target indicator is obtained according to the clustering model; when the target category is a variable category, the anomaly detection result of the target indicator is obtained in collaboration with the clustering model and the pre-trained anomaly detection model.

[0145] If not, then obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model.

[0146] In some embodiments, the data anomaly detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data anomaly detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data anomaly detection method by any other suitable means (e.g., by means of firmware).

[0147] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0148] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0149] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0150] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0151] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0152] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0153] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0154] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting data anomalies, characterized in that, It is applied to scenarios involving anomaly detection of various indicators in a computer, including: Obtain the current time series of the indicator to be detected at the current time, and determine whether there is a target category that matches the current time series in the pre-established clustering model; wherein, the indicator to be detected includes CPU utilization or disk capacity; the current time series at the current time is the time series composed of data at each time node from 0:00 on the current day to the current time. When the indicator to be detected is CPU utilization, the multiple classification categories in the clustering model are obtained based on the historical CPU utilization on weekdays and weekends, and the CPU utilization during working hours and rest hours. If so, when the target category is a stable category, the upper and lower bounds of the target time point in the current time series are obtained according to the clustering model, and the anomaly range is determined according to the upper and lower bounds. If the data value of the target time point is within the anomaly range, the indicator to be detected is determined to be in an abnormal state at the target time point. When the target category is a variable category, the anomaly detection result of the indicator to be detected is obtained collaboratively according to the clustering model and the pre-trained anomaly detection model. If not, then obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model.

2. The method according to claim 1, characterized in that, Obtain the current time series of the indicator to be detected at the current time, and determine whether there is a target category that matches the current time series in the pre-established clustering model, including: Obtain the current time series of the indicator to be detected and the clustering information of the indicator to be detected at the current time, and determine whether there is an optional category in the clustering model that matches the indicator to be detected based on the clustering information of the indicator to be detected. If it exists, then the time range to be detected is determined based on the current time, and the target category with the highest matching degree with the current time series is determined in each optional category based on the current time series and the data values ​​of each time point in the time range to be detected in each optional category. If not, it is determined that there is no target category in the clustering model that matches the current time series.

3. The method according to claim 2, characterized in that, When the target category is a stable category, the anomaly detection results of the target indicator are obtained according to the clustering model, including: Obtain a preset reference time range and determine whether the categories that match each time point in the current time series within the reference time range are all the target category; if so, determine that the target category is a stable category.

4. The method according to claim 3, characterized in that, When the target category is a variable category, the anomaly detection results of the target metric are obtained collaboratively based on the clustering model and the pre-trained anomaly detection model, including: Obtain a preset reference time range and determine whether the categories that match each time point within the reference time range in the current time series are all the target category; if not, determine that the target category is a variable category. Based on the clustering model, the upper and lower bounds of the target time point in the current time series are obtained, and the anomaly range is determined based on the upper and lower bounds. If the data value at the target time point is within the abnormal range, and the detection result of the target time point output by the anomaly detection model is also abnormal, then the indicator to be detected at the target time point is determined to be in an abnormal state.

5. The method according to any one of claims 1-4, characterized in that, Before obtaining the current time series of the indicator to be detected at the current time, the following steps are also included: Acquire detection data of the first target indicator at each time point within the first data collection time range, and preprocess the detection data; The preprocessed detection data is divided into days, and the detection data of each day is converted into the mean and variance of multiple first time windows in turn, generating dimensionality-reduced data corresponding to each day within the first data collection time range; The dimensionality-reduced data are combined to generate training data for the clustering model; Clustering is performed based on the training data of the clustering model to obtain multiple cluster categories that match the first target index. The mean, upper bound, and lower bound of each cluster category at each time point are then obtained to generate the clustering model.

6. The method according to claim 5, characterized in that, Obtain the mean, upper bound, and lower bound for each time point within each cluster category, including: Combine the time series of each day in the target cluster category in chronological order to generate the original time series that matches the target cluster category; Based on the data at each time point in the original time series, the mean and variance of each time point under the target cluster category are calculated; Based on the mean and variance of each time point under the target cluster category, the upper and lower bounds of each time point under the target cluster category are calculated.

7. The method according to any one of claims 1-4, characterized in that, Before obtaining the current time series of the indicator to be detected at the current time, the following steps are also included: The detection data of the second target indicator at each time point within the second data collection time range are obtained and preprocessed to obtain the time series of the second target indicator for each day within the second data collection time range. Based on the time series of the second target indicator, obtain the variance difference and the variance of the first difference of each time point within the second time window within the second data collection time range. The time series, variance difference, and variance of the first difference of the second target indicator are combined to generate training data for the anomaly detection model. The model is trained based on the training data of the anomaly detection model, and the trained anomaly detection model is obtained.

8. A data anomaly detection device, characterized in that, It is applied to scenarios involving anomaly detection of various indicators in a computer, including: The target category confirmation module is used to obtain the current time series of the indicator to be detected at the current time, and to determine whether there is a target category that matches the current time series in the pre-established clustering model; wherein, the indicator to be detected includes CPU utilization or disk capacity; the current time series at the current time is the time series composed of data at each time node from 0:00 on the current day to the current time. When the indicator to be detected is CPU utilization, the multiple classification categories in the clustering model are obtained based on the historical CPU utilization on weekdays and weekends, and the CPU utilization during working hours and rest hours. The first anomaly detection module is used to, if the target category is a stable category, obtain the upper and lower bound values ​​of the target time point in the current time series according to the clustering model, and determine the anomaly range according to the upper and lower bound values. If the data value of the target time point is within the anomaly range, then the indicator to be detected is determined to be in an abnormal state at the target time point. When the target category is a variable category, the module obtains the anomaly detection result of the indicator to be detected in collaboration with the clustering model and the pre-trained anomaly detection model. The second anomaly detection module is used to obtain the anomaly detection result of the indicator to be detected according to the anomaly detection model if the anomaly is not detected.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data anomaly detection method according to any one of claims 1-7 of the present invention.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the data anomaly detection method according to any one of claims 1-7.

Images