Business index dynamic threshold abnormality detection method and system
By using box plot algorithms and time series analysis, the anomaly detection threshold is dynamically adjusted, solving the problems of low accuracy and high cost caused by manually setting thresholds in traditional methods, and realizing automated and accurate business anomaly detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA MOBILE GRP HENAN CO LTD
- Filing Date
- 2022-05-30
- Publication Date
- 2026-08-04
AI Technical Summary
Traditional methods for identifying business anomalies rely on manually setting quality thresholds and comparing historical data, which cannot adapt to long-term data changes, resulting in high labor costs, low accuracy of early warnings, and untimely warnings.
The box plot algorithm is used to detect feature index sets. Combined with time series analysis, the box plot parameters are dynamically adjusted. By extracting individual latency and success rate indicators under various scenarios, the anomaly detection threshold is automatically adjusted.
It improved the accuracy of anomaly detection, reduced labor costs, and enabled more timely and accurate identification of business anomalies.
Smart Images
Figure CN117216693B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of IT applications, and in particular to a method and system for detecting anomalies in dynamic thresholds of business indicators. Background Technology
[0002] With the rapid development of internet businesses, traditional business anomaly identification relies on manual filtering and analysis based on experience-based thresholds for poor performance, or dynamic adjustments through historical data comparison. Different judgment standards exist for different businesses, different indicators, and even different users, making it unable to adapt to the long-term changing characteristics of data businesses. This requires long-term maintenance by data professionals, resulting in high labor costs, low accuracy of early warnings, and untimely warnings. Summary of the Invention
[0003] This application provides a method and system for detecting anomalies in dynamic thresholds of business indicators to solve the above-mentioned technical problems.
[0004] To solve the above-mentioned technical problems, this application is implemented as follows:
[0005] Firstly, a method for detecting anomalies in dynamic thresholds of business metrics is provided, including:
[0006] Extract a set of feature indicators from the business data to be tested. The set of feature indicators includes single latency indicators and single success rate indicators under various different scenarios.
[0007] The box plot algorithm is used to detect the feature index set and determine the first outlier in the feature index set;
[0008] Based on historical data, the feature index set is detected according to time series analysis to determine the second outlier in the feature index set;
[0009] The box plot algorithm is used to detect the second outlier in different scenarios, and the box plot parameters in the box plot algorithm are adjusted.
[0010] Secondly, a dynamic threshold anomaly detection system for business indicators is provided, including:
[0011] The extraction module is used to extract the feature index set of the business data to be detected. The feature index set includes single latency indexes and single success rate indexes under various different scenarios.
[0012] The first determining module is used to detect the feature index set using a box plot algorithm and determine the first outlier in the feature index set.
[0013] The second determining module is used to detect the feature index set based on historical data and time series analysis to determine the second outlier in the feature index set.
[0014] The adjustment module is used to detect the second outlier in different scenarios using the box plot algorithm and adjust the box plot parameters in the box plot algorithm.
[0015] Thirdly, a terminal device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect.
[0016] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the method described in the first aspect.
[0017] In this embodiment, a set of feature indicators for the business data to be detected is first extracted. Then, a box plot algorithm is used to detect the feature indicator set and identify the first outlier. Next, based on historical data, the feature indicator set is detected according to time series to identify the second outlier. Finally, the box plot algorithm is used to detect the second outlier under different scenarios, and the box plot parameters in the box plot algorithm are adjusted. By dynamically adjusting the box plot parameters, this embodiment can make anomaly detection more accurate and improve the accuracy rate of anomaly detection. Attached Figure Description
[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0019] Figure 1 This is a flowchart of the dynamic threshold anomaly detection method for business indicators provided in the embodiments of this application;
[0020] Figure 2 This is a schematic diagram of the box plot structure in the box plot algorithm provided in this application embodiment;
[0021] Figure 3 This is a schematic diagram of the dynamic threshold anomaly detection system for business indicators provided in the embodiments of this application;
[0022] Figure 4 This is a schematic diagram of the structure of the terminal device provided in the embodiments of this application. Detailed Implementation
[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0024] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0025] The following is in conjunction with the appendix Figure 1-4 This paper provides a detailed description of a dynamic threshold anomaly detection method and system for business indicators provided in this application through specific embodiments and application scenarios.
[0026] like Figure 1 The diagram shown is a flowchart of a dynamic threshold anomaly detection method for business indicators provided in an embodiment of this application. Figure 1 As shown, the dynamic threshold anomaly detection of this business indicator may include the contents shown in S101 to S104.
[0027] In S101, a set of feature metrics is extracted from the business data to be tested. This set of feature metrics includes various single-item latency metrics and single-item success rate metrics for different scenarios.
[0028] The feature index set refers to the protocol fields collected by DPI (Deep Packet Inspection) of Internet protocols. The feature index set includes, but is not limited to, SSL (Secure Sockets Layer) / TLS (Transport Layer Security) handshake latency, uplink RTT (Round-Trip Time) latency, downlink RTT latency, TCP (Transmission Control Protocol) first and second handshake success rates, and TCP second and third handshake success rates.
[0029] After extracting the feature index set of the business data to be detected, data cleaning can be performed. If the missing value is a numerical attribute, the average value of that attribute across all other objects is used to fill the missing attribute value. If the data is abnormal or zero, the data is removed. Specific data anomaly detection is shown below.
[0030] In S102, the box plot algorithm is used to detect the feature index set and determine the first outlier in the feature index set.
[0031] The box plot algorithm identifies outliers in the data by drawing box plots, and is referred to as the first anomaly detection method in this application. It is described in detail in the following embodiments, and will not be repeated here.
[0032] In S103, based on historical data, the second outlier in the feature index set is determined according to the time series detection feature index set.
[0033] Time series detection involves comparing current data with data from the same time the previous day, or comparing the current daily average with the previous day's daily average, to identify outliers. This is referred to as the second anomaly detection method in this application. Specific details are described in the following embodiments, and will not be repeated here.
[0034] In S104, the box plot algorithm is used to detect the second outlier in different scenarios, and the box plot parameters in the box plot algorithm are adjusted.
[0035] In other words, the anomaly detection results of the second anomaly detection method under different scenarios are compared and analyzed with those of the first anomaly detection method, and then the box plot parameters in the box plot algorithm are adjusted to make the anomaly data detection more accurate.
[0036] In this embodiment, a set of feature indicators for the business data to be detected is first extracted. Then, a box plot algorithm is used to detect the feature indicator set and identify the first outlier. Next, based on historical data, the feature indicator set is detected according to time series to identify the second outlier. Finally, the box plot algorithm is used to detect the second outlier under different scenarios, and the box plot parameters in the box plot algorithm are adjusted. By dynamically adjusting the box plot parameters, this embodiment can make anomaly detection more accurate and improve the accuracy rate of anomaly detection.
[0037] In one possible implementation of this application, using a box plot algorithm to detect a set of feature indicators and determine the first outlier in the set of feature indicators may include: using a box plot algorithm to determine the first quartile and the third quartile of a single-latency category indicator in the set of feature indicators; determining the interquartile range of the single-latency category indicator based on the first quartile and the third quartile; and identifying data in the single-latency category indicator that are greater than a lower threshold and / or less than an upper threshold as the first outlier in the set of feature indicators.
[0038] In this embodiment, the box plot algorithm identifies outliers in the data by drawing box plots. IQR is calculated by subtracting the first quartile Q1 from the third quartile Q3, where the value greater than Q3+k is the outlier. IQR and / or less than Q1-k The IQR data was identified as outliers. Specifically, such as... Figure 2 As shown, the box plot algorithm is used to draw boxes to find the first quartile, i.e., the value Q1 at the 25th percentile; and the third quartile, i.e., the value Q3 at the 75th percentile; and the interquartile range (IQR) = Q3 - Q1; then, for single-latency indicators, such as single-latency KPIs (Key Performance Indicators), the values are greater than Q3 + k. The IQR data is identified as outliers, where k is adjustable. Then, anomaly detection is performed on individual success rate indicators, such as single KPI success rate indicators. The first quartile (Q1) and the third quartile (Q3) are identified, along with the interquartile range (IQR) = Q3 - Q1. Success rate values less than Q1 - k are then considered. IQR data is identified as outliers, with success rates greater than Q3+k. The IQR data was also identified as outliers, where k is adjustable. This application, by setting dynamic parameters, can be applied to anomaly detection for more types of business data, making the anomaly detection results more accurate. Here, Q2 is the second quartile, that is, the value at the 50th percentile, which is the median.
[0039] In one specific embodiment of this application, the lower threshold and upper threshold Calculate using the formula shown below:
[0040]
[0041]
[0042]
[0043] in, The lower threshold; The upper threshold; It is the first quartile; It is the third quartile; is the interquartile range; k is the box plot parameter.
[0044] In one possible implementation of this application, determining a second outlier in a set of feature indicators based on historical data and a time series detection feature indicator set may include: acquiring historical data of the feature indicator set; detecting a first amplitude between the historical data and the current data of a single latency-type indicator, and a second amplitude between the historical data and the current data of a single success rate-type indicator; determining a second outlier in the feature indicator set if, at a preset time, the first amplitude is greater than an amplitude threshold and the first amplitude is greater than zero; and / or determining a second outlier in the feature indicator set if, at a preset time, the second amplitude is greater than an amplitude threshold and the second amplitude is less than zero.
[0045] Historical data refers to data from the same point in time the day before, or the average data from the previous day. The detection method involves comparing the current data with the data from the same point in time the day before, or comparing the current daily average data with the daily average data from the previous day. If the difference exceeds a certain amplitude, the data at that point is considered abnormal.
[0046] Specifically, when testing single-item latency indicators, such as single-item KPI latency indicators, if the amplitude at a certain moment exceeds the amplitude threshold... If the amplitude at a certain moment is greater than zero, it is considered that a sudden increase has occurred at that moment. Or, for single success rate indicators, such as single KPI success rate indicators, if the amplitude at a certain moment is greater than the amplitude threshold and the amplitude at that moment is less than zero, it is considered that a sudden decrease has occurred at that moment. The KPI indicator value at the time of the sudden increase or decrease is judged as an abnormal result.
[0047] The amplitude can be calculated using the formula shown below:
[0048]
[0049] in, For amplitude, Values can be selected at the daily or hourly granularity level.
[0050] In one possible implementation of this application, the box plot algorithm is used to detect second outliers in different scenarios. Adjusting the box plot parameters in the box plot algorithm may include: comparing the second outliers of individual indicators in different scenarios of the feature indicator set using the box plot algorithm, obtaining the mean within a preset period, where the individual indicators include individual latency indicators and individual success rate indicators; calculating the Euclidean distance between the second outlier and the mean; if the Euclidean distance is greater than the second outlier, calculating the anomaly detection results of individual indicators in different scenarios based on the time series; and determining the box plot parameters in the box plot algorithm to obtain a parameter sequence when the anomaly detection result is equal to the upper or lower threshold of the interquartile range of the individual indicator.
[0051] In this embodiment, the anomaly detection results of individual indicators in different scenarios using the second anomaly detection method are compared with those in the algorithm of the first anomaly detection method. The mean value within the current time period is then obtained from hourly and daily statistics. By comparing the distance between the two detection results and the mean value, if the Euclidean distance between the anomaly detection results of individual indicators in different scenarios of the second anomaly detection method and the mean value is greater than the Euclidean distance between the results of the first anomaly detection method and the mean value, then the anomaly detection results of individual indicators in different scenarios of the second anomaly detection method need to be dynamically calculated based on the time series, using hourly, daily, or other time granularities. These anomaly detection results can be calculated based on different coverage scenarios, different network elements, city / prefecture dimensions, and business dimensions, ensuring that within this time granularity, the result equals the upper threshold Q3+k of the interquartile range of the individual indicator. IQR or lower threshold Q1-k IQR allows us to calculate the value of k and add it to the set sequence, marking the characteristic changes of the k value.
[0052] This application improves the accuracy of subsequent detection of other business data by modifying the box plot parameter k in the first anomaly detection method.
[0053] In one possible implementation of this application, the dynamic threshold anomaly detection method for business indicators may further include: selecting a preset number of initial mass points from a parameter sequence; calculating the Euclidean distances from multiple preset mass points to the preset number of initial mass points based on a machine learning algorithm; calculating the average of the Euclidean distances from the multiple preset mass points to each initial mass point, updating the initial mass points, and obtaining updated initial mass points; repeatedly calculating the Euclidean distances between the updated initial mass points and the multiple preset mass points until a preset convergence condition is met, obtaining a preset number of target mass points; and using the average of the preset number of target mass points as the box plot parameters in the box plot algorithm.
[0054] In this application, within the same time period, for different scenarios, a preset number of initial mass points are selected from the k-value feature sequence calculated according to the above embodiments. In this application, three can be selected, namely A1, A2, and A3. Then, based on a machine learning algorithm, such as the k-means machine learning algorithm, the distances from other points to mass points A1, A2, and A3 are calculated using Euclidean distance. The average of these three classes is used as the new round of mass points until the convergence condition is met, resulting in target mass points B1, B2, and B3. The average of the three mass points is then extracted as the box plot parameters in the final box plot algorithm.
[0055] During anomaly detection, the box plot parameters change throughout the detection process to adapt to the detection of various types of business data. The changes in the box plot parameters are described in the various processes provided in the above embodiments. This makes the detection results increasingly accurate, improving the detection accuracy rate.
[0056] like Figure 3 The diagram shown is a schematic of a dynamic threshold anomaly detection system for business indicators provided in an embodiment of this application. Figure 3 As shown, the dynamic threshold anomaly detection system for business indicators may include: an extraction module 301, a first determination module 302, a second determination module 303, and an adjustment module 304.
[0057] The extraction module 301 is used to extract the feature index set of the business data to be detected. The feature index set includes single latency indexes and single success rate indexes under various different scenarios. The first determination module 302 is used to detect the feature index set using the box plot algorithm and determine the first outlier in the feature index set. The second determination module 303 is used to detect the feature index set based on historical data and time series and determine the second outlier in the feature index set. The adjustment module 304 is used to detect the second outlier under different scenarios using the box plot algorithm and adjust the box plot parameters in the box plot algorithm.
[0058] In this embodiment, the extraction module 301 first extracts the feature index set of the business data to be detected. Then, the first determination module 302 uses a box plot algorithm to detect the feature index set and determine the first outlier in the feature index set. The second determination module 303 then uses historical data and time series analysis to detect the feature index set and determine the second outlier in the feature index set. Finally, the adjustment module 304 uses a box plot algorithm to detect the second outlier in different scenarios and adjusts the box plot parameters in the box plot algorithm. This embodiment, by dynamically adjusting the box plot parameters, can make anomaly detection more accurate and improve the accuracy rate of anomaly detection.
[0059] In one possible implementation of this application, the first determining module 302 can be used to: determine the first quartile and the third quartile of the single-latency category index in the feature index set using a box plot algorithm; determine the interquartile range of the single-latency category index based on the first quartile and the third quartile; and determine the data in the single-latency category index that are greater than the lower threshold and / or less than the upper threshold as the first outlier in the feature index set.
[0060] In one possible implementation of this application, the first determining module 302 may be used to: lower a threshold and upper threshold Calculate using the formula shown below:
[0061]
[0062]
[0063]
[0064] in, The lower threshold; The upper threshold; It is the first quartile; It is the third quartile; is the interquartile range; k is the box plot parameter.
[0065] In one possible implementation of this application, the second determining module 303 may be used to: acquire historical data of a feature index set; detect a first amplitude between the historical data and the current data of a single latency-type indicator, and a second amplitude between the historical data and the current data of a single success rate-type indicator, based on the time series; at a preset time, if the first amplitude is greater than an amplitude threshold and the first amplitude is greater than zero, determine it as a second outlier in the feature index set; and / or at a preset time, if the second amplitude is greater than an amplitude threshold and the second amplitude is less than zero, determine it as a second outlier in the feature index set.
[0066] In one possible implementation of this application, the adjustment module 304 can be used to: compare the second outliers of individual indicators in different scenarios of the feature indicator set using a box plot algorithm, and obtain the mean within a preset period. The individual indicators include individual latency indicators and individual success rate indicators; calculate the Euclidean distance between the second outlier and the mean; if the Euclidean distance is greater than the second outlier, calculate the anomaly detection results of individual indicators in different scenarios based on the time series; and determine the box plot parameters in the box plot algorithm and obtain the parameter sequence when the anomaly detection result is equal to the upper or lower threshold of the interquartile range of the individual indicator.
[0067] In one possible implementation of this application, the adjustment module 304 can be used to: select a preset number of initial mass points from the parameter sequence; calculate the Euclidean distances from multiple preset mass points to the preset number of initial mass points based on a machine learning algorithm; calculate the average value of the Euclidean distances from the multiple preset mass points to each initial mass point, update the initial mass points, and obtain the updated initial mass points; repeatedly calculate the Euclidean distances between the updated initial mass points and the multiple preset mass points until a preset convergence condition is met, and obtain the preset number of target mass points; and use the average value of the preset number of target mass points as the box plot parameters in the box plot algorithm.
[0068] The functionality of the dynamic threshold anomaly detection system for business indicators described in this application has been implemented. Figure 1-2 The method embodiments shown are described in detail. Therefore, for any parts not covered in detail in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.
[0069] Optionally, such as Figure 4 As shown, this application embodiment also provides a terminal device 400, including a processor 401, a memory 402, and a computer program stored in the memory 402 and executable on the processor. When the computer program is executed by the processor 401, it implements the various processes of the dynamic threshold anomaly detection method embodiment for business indicators and can achieve the same technical effect. To avoid repetition, it will not be described again here.
[0070] Optionally, embodiments of this application also provide a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described embodiments of the dynamic threshold anomaly detection method for business indicators, and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.
[0071] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0072] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.
[0073] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.
Claims
1. A method for detecting anomalies in dynamic thresholds of business indicators, characterized in that, include: Extract a set of feature indicators from the business data to be tested. The set of feature indicators includes single latency indicators and single success rate indicators under various different scenarios. The box plot algorithm is used to detect the feature index set and determine the first outlier in the feature index set; Based on historical data, the feature index set is detected according to time series analysis to determine the second outlier in the feature index set; The box plot algorithm is used to detect the second outlier in different scenarios, and the box plot parameters in the box plot algorithm are adjusted accordingly. The step of using the box plot algorithm to detect the second outlier in different scenarios and adjusting the box plot parameters in the box plot algorithm includes: The box plot algorithm is used to compare the second outliers of individual indicators in different scenarios of the feature indicator set to obtain the mean within a preset period. The individual indicators include individual latency indicators and individual success rate indicators. Calculate the Euclidean distance between the second outlier and the mean; If the Euclidean distance is greater than the second outlier, then the anomaly detection results of the individual indicators under different scenarios are calculated based on the time series. If the anomaly detection result is equal to the upper or lower threshold of the interquartile range of the single indicator, the box plot parameters in the box plot algorithm are determined to obtain the parameter sequence. The step of comparing the second outliers of individual indicators in different scenarios of the feature indicator set using the box plot algorithm to obtain the mean within a preset period includes: The anomaly detection results of single indicators in different scenarios using the second anomaly detection method are compared with those in the first anomaly detection algorithm, and the average value within the current time period is obtained from the hourly and daily granular statistics. If the Euclidean distance is greater than the second outlier, it includes: If the Euclidean distance between the anomaly detection results and the mean of a single indicator in different scenarios of the second anomaly detection is greater than the Euclidean distance between the result and the mean of the first anomaly detection.
2. The method according to claim 1, characterized in that, The step of using a box plot algorithm to detect the feature index set and determine the first outlier in the feature index set includes: The first and third quartiles of single-delay category indicators in the feature indicator set are determined using the box plot algorithm. The interquartile range of the single-delay index is determined based on the first quartile and the third quartile. Data in the single-latency category that are greater than the lower threshold and / or less than the upper threshold are identified as the first outlier in the feature index set.
3. The method according to claim 2, characterized in that, The lower threshold and the upper threshold Calculate using the formula shown below: in, The lower threshold; The upper threshold; It is the first quartile; It is the third quartile; is the interquartile range; k is the box plot parameter.
4. The method according to claim 1, characterized in that, The step of determining the second outlier in the feature indicator set based on historical data and time series analysis includes: Obtain historical data of the feature index set; The data is analyzed based on time series detection, specifically the first amplitude between the historical data and the current data of the single latency indicator, and the second amplitude between the historical data and the current data of the single success rate indicator. At a preset time, if the first amplitude is greater than an amplitude threshold and the first amplitude is greater than zero, it is determined to be a second outlier in the feature index set; and / or At a preset time, if the second amplitude is greater than the amplitude threshold and the second amplitude is less than zero, it is determined to be the second outlier in the feature index set.
5. The method according to claim 1, characterized in that, The method further includes: A preset number of initialization particles are selected from the parameter sequence; Based on machine learning algorithms, calculate the Euclidean distances from multiple preset mass points to the preset number of initial mass points; Calculate the average Euclidean distance from multiple preset mass points to each initial mass point, update the initial mass point, and obtain the updated initial mass point; The Euclidean distance between the updated initial mass point and multiple preset mass points is repeatedly calculated until the preset convergence condition is met, and a preset number of target mass points are obtained. The average value of the preset number of target particles is used as the box plot parameter in the box plot algorithm.
6. A dynamic threshold anomaly detection system for business indicators, characterized in that, include: The extraction module is used to extract the feature index set of the business data to be detected. The feature index set includes single latency indexes and single success rate indexes under various different scenarios. The first determining module is used to detect the feature index set using a box plot algorithm and determine the first outlier in the feature index set. The second determining module is used to detect the feature index set based on historical data and time series analysis to determine the second outlier in the feature index set. The adjustment module is used to detect the second outlier in different scenarios using the box plot algorithm and adjust the box plot parameters in the box plot algorithm. The adjustment module is used for: The box plot algorithm is used to compare the second outliers of individual indicators in different scenarios of the feature indicator set to obtain the mean within a preset period. The individual indicators include individual latency indicators and individual success rate indicators. Calculate the Euclidean distance between the second outlier and the mean; If the Euclidean distance is greater than the second outlier, then the anomaly detection results of the individual indicators under different scenarios are calculated based on the time series. If the anomaly detection result is equal to the interquartile range upper or lower threshold of the single indicator, the box plot parameters in the box plot algorithm are determined to obtain the parameter sequence. The step of comparing the second outliers of individual indicators in different scenarios of the feature indicator set using the box plot algorithm to obtain the mean within a preset period includes: The anomaly detection results of single indicators in different scenarios using the second anomaly detection method are compared with those in the first anomaly detection algorithm, and the average value within the current time period is obtained from the hourly and daily granular statistics. If the Euclidean distance is greater than the second outlier, it includes: If the Euclidean distance between the anomaly detection results and the mean of a single indicator in different scenarios of the second anomaly detection is greater than the Euclidean distance between the result and the mean of the first anomaly detection.
7. The system according to claim 6, characterized in that, The first determining module is used for: The first and third quartiles of single-delay category indicators in the feature indicator set are determined using the box plot algorithm. The interquartile range of the single-delay index is determined based on the first quartile and the third quartile. Data in the single-latency category that are greater than the lower threshold and / or less than the upper threshold are identified as the first outlier in the feature index set.
8. The system according to claim 6, characterized in that, The second determining module is used for: Obtain historical data of the feature index set; The data is analyzed based on time series detection, specifically the first amplitude between the historical data and the current data of the single latency indicator, and the second amplitude between the historical data and the current data of the single success rate indicator. At a preset time, if the first amplitude is greater than the amplitude threshold and the first amplitude is greater than zero, a second outlier value is determined in the feature index set; and / or At a preset time, if the second amplitude is greater than the amplitude threshold and the second amplitude is less than zero, a second outlier in the feature index set is determined.