Abnormality detection method and device

Abstract

The embodiment of the invention discloses an anomaly detection method and device, and the method comprises the steps: obtaining the interface call amount data of a civil aviation system interface, and carrying out the visual display of the interface call amount data; determining to-be-detected data from the interface call amount data displayed and output; performing anomaly detection on the to-be-detected data based on different anomaly detection algorithms to obtain a detection result; and displaying and outputting the detection result, wherein the detection result comprises related contents of the abnormal data. According to the above scheme, the visual abnormal data detection method is provided, the abnormal data in the interface call volume data can be effectively and visually detected and displayed, different anomaly detection algorithms can be adopted to perform anomaly detection on the to-be-detected data in the implementation process, and the anomaly detection accuracy of the interface call volume data is improved.

Description

Technical Field

[0001] The present application relates to anomaly detection technology, and more specifically, to an anomaly detection method and device. Background Art

[0002] With the increasing demand for civil aviation systems, the number of interfaces based on civil aviation systems has also increased year by year. At the same time, there are more and more users, and the number of calls has also increased. The data sequence formed by a large amount of interface call data contains a lot of hidden information, such as the number of user calls to the interface, which can usually reflect the regularity of interface calls and detect abnormal points of calls, which helps to better monitor call anomalies and repair errors in a timely manner. Summary of the invention

[0003] In view of this, this application provides the following technical solutions:

[0004] An anomaly detection method, comprising:

[0005] Obtaining interface call volume data of civil aviation system interfaces and visually displaying the interface call volume data;

[0006] Determine the data to be tested from the displayed output interface call volume data;

[0007] Performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result;

[0008] The detection result is displayed and output, and the detection result includes relevant content of the abnormal data.

[0009] Optionally, obtaining the interface call volume data of the civil aviation system interface and visually displaying the interface call volume data includes:

[0010] The interface call volume data of the civil aviation system interface is obtained, and a trend chart showing the data changes over time is generated based on the interface call volume data for visual display.

[0011] Optionally, determining the data to be detected from the displayed output interface call volume data includes:

[0012] Select the trend graph that needs to be detected for anomaly to jump to the anomaly detection page, and the trend graph exists in the anomaly detection interface as data to be detected.

[0013] Optionally, performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result includes:

[0014] Determine the data type of the sequence data corresponding to the data to be detected;

[0015] Determine a target algorithm based on the data type, the target algorithm comprising at least two different anomaly detection algorithms;

[0016] Performing anomaly detection on the data to be detected based on the target algorithm;

[0017] The detection data of each anomaly detection algorithm are combined to obtain the detection result.

[0018] Optionally, the relevant content of the abnormal data includes at least the call time, the call volume and an abnormality mark.

[0019] Optionally, the displaying and outputting the detection result includes:

[0020] An abnormality mark is added at a position in the trend graph corresponding to the abnormal data.

[0021] Optionally, it also includes:

[0022] Obtain and execute a labeling instruction to label data that is not abnormal data in the to-be-detected data as abnormal data.

[0023] Optionally, it also includes:

[0024] A marking cancellation instruction is obtained and executed to remove the abnormal data identifier of the abnormal data in the data to be detected.

[0025] Optionally, after obtaining the detection result, the method further includes:

[0026] Export all abnormal data corresponding to the detection result into a data file in a first format.

[0027] An abnormality detection device, comprising:

[0028] A data display module, used to obtain the interface call volume data of the civil aviation system interface and to visually display the interface call volume data;

[0029] A data determination module is used to determine the data to be detected from the interface call volume data displayed and output;

[0030] An anomaly detection module, used to perform anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result;

[0031] The result display module is used to display and output the detection result, and the detection result includes relevant content of abnormal data.

[0032] Through the above technical scheme, it can be known that the embodiment of the present application discloses an anomaly detection method and device, the method includes: obtaining the interface call volume data of the civil aviation system interface and visually displaying the interface call volume data; determining the data to be detected from the displayed output interface call volume data; performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain the detection result; displaying and outputting the detection result, the detection result includes the relevant content of the abnormal data. The above scheme provides a visual abnormal data detection method, which can effectively and intuitively detect and display the abnormal data in the interface call volume data, and different anomaly detection algorithms can be used in the implementation process to perform anomaly detection on the data to be detected, thereby improving the accuracy of anomaly detection of the interface call volume data. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0034] Figure 1 A flowchart of an anomaly detection method disclosed in an embodiment of the present application;

[0035] Figure 2 A flowchart of performing anomaly detection on the data to be detected disclosed in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of the process of detecting anomalies in a data sequence disclosed in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of a process for storing abnormal results of a data sequence disclosed in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of the structure of an abnormality detection device disclosed in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of the principle architecture of the anomaly detection system disclosed in the embodiment of the present application;

[0040] Figure 7 A schematic diagram of the structure of a server disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] Figure 1 This is a flow chart of an abnormality detection method disclosed in an embodiment of the present application. Figure 1 As shown, the anomaly detection method may include:

[0043] Step 101: Obtain interface call volume data of a civil aviation system interface and visualize the interface call volume data.

[0044] Among them, the interface call volume data can be sequence data, which can be obtained from the civil aviation system interface through relevant statistical recording work. In the detection of sequence data that characterizes the interface call volume data, anomaly detection is usually the most direct detection method. Anomaly detection, generally speaking, is to identify data points that are different from normal data, data that are inconsistent with the rules of normal data and have a large difference from the expected data behavior and different direction. Anomaly detection targets a small number of data that are different from the public, and can also be understood as a very small number of events in high-probability events, such as network intrusions, civil aviation system interface call anomalies, etc.

[0045] According to the number of sequences (the number of sequences refers to the number of elements in the sequence), anomaly detection can be divided into single variable and multivariate (single variable and multivariate refer to the number of variables describing the data) detection. According to the complexity of the data, the detected data is usually a multivariate problem. Anomaly detection tasks are mainly divided into three categories: supervised, unsupervised, and semi-supervised; supervised means that both positive and negative examples in the training set have labels, unsupervised means that the training set has no labels, and semi-supervised means that there are only normal data in the training set without abnormal data. Based on the sequence data formed by the interface call volume data, anomaly detection is performed on the data, anomaly points are obtained and analyzed, and the causes of the anomalies are found, which can better maintain the civil aviation system interface.

[0046] The interface call volume data of the civil aviation system interface is obtained and the interface call volume data is visualized. In the implementation, the interface call volume data based on the civil aviation system interface that changes over time can be obtained, and the arff (attribute relation file format, attribute relationship file format) file generated by these data information is displayed in the visualization page. Due to the complexity of the real environment and other reasons, the user's call volume may have abnormal call situations. Visual data display provides a convenient method for finding abnormal data.

[0047] Step 102: Determine the data to be detected from the displayed output interface call volume data.

[0048] Through the displayed interface call volume data, you can design a data selection function, and the visualization page can intuitively display the data trend. According to the call volume data of different interfaces in different time periods, data selection can select the data call volume trend data of a certain interface within a specific time period, and perform anomaly detection on the data based on the selected data.

[0049] Step 103: Perform anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain detection results.

[0050] In the embodiment of the present application, a plurality of anomaly detection algorithms can be preset in the processing system. When performing anomaly detection on the data to be detected, multiple anomaly detection algorithms can be selected to perform anomaly detection on the data to be detected respectively, so as to comprehensively improve the detection rate of anomaly detection. The anomaly detection algorithm can include but is not limited to: EDM, autoregressive algorithm, CUSUM control chart, DBSCAN, Shewhart personal control chart, LOF (local outlier factor), MAD, median moving window method, quartile outlier point, short-term month-on-month, Z score, etc.

[0051] After the detection of the data to be detected by different anomaly detection algorithms is completed, a plurality of inspection data (inspection results) corresponding to each selected anomaly detection algorithm will be obtained, and these inspection data can be summarized into the final inspection result.

[0052] Step 104: Display and output the detection result, which includes relevant content of abnormal data.

[0053] After the detection results are obtained, they can be displayed and output in a visual manner so that users can more intuitively determine the relevant content of the abnormal data.

[0054] The anomaly detection method described in this embodiment provides a visual abnormal data detection method, which can effectively and intuitively detect and display abnormal data in interface call volume data. In the implementation process, different anomaly detection algorithms can be used to perform anomaly detection on the data to be detected, thereby improving the accuracy of anomaly detection of interface call volume data.

[0055] In the above embodiment, the interface call volume data is visualized. In one implementation, the interface call volume data of the civil aviation system interface can be obtained, and a trend chart showing the data change over time is generated based on the interface call volume data for visualization. The trend chart displays both data and data trends, and its horizontal axis can be time and its vertical axis can be data call volume (interface call volume data).

[0056] Then, the data to be detected is determined from the displayed interface call volume data, which can be selected by selecting a data trend chart (referring to a trend chart displayed on the page, clicking to select it, jumping to another anomaly detection interface, and bringing the selected data to the anomaly detection page), providing a basis for subsequent anomaly detection. Therefore, the determination of the data to be detected from the displayed interface call volume data can include: selecting a trend chart that needs to be detected for anomaly detection to jump to the anomaly detection page, and the trend chart exists in the anomaly detection interface as the data to be detected.

[0057] Based on the above, the display output of the detection result may include: adding an abnormal mark at the position corresponding to the abnormal data in the trend graph. For example, a vertical line may be added at the position point corresponding to the abnormal data to identify the data corresponding to the position as abnormal data. The relevant content of the abnormal data includes at least the call time, the call volume and the abnormal or not mark.

[0058] For marked abnormal data, a display function of abnormal data points can be designed. For abnormal data detected by anomaly detection algorithms and manually marked abnormal data, the abnormal data will be displayed on the visualization page, including the time point when the data was generated, the number of user calls at that time point, and the marking column of the abnormal point (in the data trend chart data, the abnormal point marking column is marked as 1, and the non-abnormal point is marked as 0). Users can clearly see the detailed information of the abnormality, as well as the location of the abnormal point and the time when it occurred. This provides a good foundation for better analysis of the causes of data anomalies in the future.

[0059] In the above embodiments, the specific implementation of abnormality detection on the data to be detected can be found in Figure 2 . Figure 2 The flowchart of the abnormality detection of the detected data disclosed in the embodiment of the present application is combined with Figure 2 As shown, performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result may include:

[0060] Step 201: Determine the data type of the sequence data corresponding to the data to be detected.

[0061] In the implementation, different anomaly detection algorithms can be used for different types of sequence data as needed. The types of sequence data may include steep increase, steep drop, disorder, linear trend, relative stability, upward jump, downward jump, periodic fluctuation, etc.

[0062] Step 202: Determine a target algorithm based on the data type, where the target algorithm includes at least two different anomaly detection algorithms.

[0063] In this embodiment, data anomaly detection can be selectively performed based on the determined data type. The number of anomaly detection algorithms included in the target algorithm is not fixed. Anomaly detection algorithms can include distribution-based algorithms, such as 3-sigma, Z score, MAD, median moving window method, quartile anomaly point, short-term year-on-year, etc.; distance-based algorithms, such as KNN; density-based algorithms, such as LOF; clustering-based algorithms, such as DBSCAN; tree-based algorithms, such as IFOREST; prediction-based algorithms, such as Moving Average.

[0064] The 3-Sigma method, also known as the 3 times standard deviation method, is a quality control method based on statistics. When the data sequence is under the assumption of normal distribution, the degree of variation of the statistical data sequence is used to determine whether the data is abnormal. In this method, a band interval is formed with the mean value as the center and a distance of 3 standard deviations extending to both sides. If the sample data point falls within this band interval, the data is considered normal; if it falls outside the band interval, the data is considered abnormal.

[0065] KNN is one of the more commonly used anomaly detection algorithms. It mainly calculates the distance between each data point and the nearest k neighboring points of each data point, and determines whether it is an outlier based on the size of the distance. The advantage of this type of algorithm is that it is simple to implement and suitable for a single data sequence.

[0066] The LOF algorithm is similar to KNN. The difference between the two is that the LOF algorithm uses the local density deviation of its neighbors. It further converts the distance between adjacent points into a "neighborhood" to obtain the number of points in the neighborhood (i.e., density), and considers samples with a density much lower than that of their neighbors as outliers. The advantages of this algorithm are that it can handle data sequences with different regional densities very well, is insensitive to parameter selection, and has a high accuracy rate.

[0067] The cluster-based detection algorithm DBSCAN divides data points into relatively dense "clusters", and those points that cannot be classified into a certain cluster are regarded as outliers. This type of algorithm is highly sensitive to the selection of the number of clusters. Improper selection of the number may cause more normal values ​​to be classified as outliers or outliers in small clusters to be classified as normal. Therefore, specific parameters need to be set for each data set to ensure the clustering effect, and the universality between data sets is poor. The main purpose of clustering is usually to find clustered data, while outliers and noise are ignored or discarded as worthless data. It is rarely used in special outlier detection. The advantage of this type of algorithm is that it can better detect outliers that are not easy to detect.

[0068] Statistical methods make assumptions about the normality of the data. They assume that normal data objects are generated by a statistical model, and data that do not follow the model are outliers. The effectiveness of statistical methods is highly dependent on whether the statistical model assumptions made for the given data are valid.

[0069] Histogram-based methods are divided into static width histograms and dynamic width histograms. Static width histogram, a standard histogram construction method, uses k equal-width bins within the value range. The frequency (relative number) of samples falling into each bucket is used as an estimate of the density (bin height). Dynamic width histogram: First, all values ​​are sorted, and then a fixed number of Nk consecutive values ​​are packed into a bin, where N is the total number of instances and k is the number of bins; the bin area in the histogram represents the number of instances. Because the width of the bin is determined by the first and last values ​​in the bin, the area of ​​all bins is the same, so the height of each bin is calculable. This means that bins with a large span have a low height, that is, a low density, with only one exception, when the number of bins exceeding k is equal, in which case it is allowed to exceed Nk values ​​in the same bin.

[0070] Due to the diversity of data sequences and the uncertainty of user calls, data sequences may be extremely complex. Using a single anomaly detection algorithm cannot meet the needs of data anomaly detection, and its detection accuracy will not be very high. It cannot detect abnormal data very well, and the combination of multiple anomaly detection algorithms can better target the diversity and complexity of data. Using different anomaly detection methods to perform anomaly detection on the same data, unifying the anomaly points detected by different algorithms, greatly improves the accuracy of data anomaly detection.

[0071] Step 203: Perform anomaly detection on the data to be detected based on the target algorithm.

[0072] After the target algorithm is determined, each anomaly detection algorithm in the target algorithm can be used to perform anomaly detection on the data to be detected, to obtain detection data corresponding to each anomaly detection algorithm, and to detect which data recorded in the detection data are abnormal data.

[0073] Step 204: Combine the detection data of each anomaly detection algorithm to obtain a detection result.

[0074] After obtaining at least two detection data, the detection data can be combined to obtain a final detection result. It should be noted that the detection result includes the detection results of multiple anomaly detection algorithms, and the anomaly recognition coverage is relatively wide, thus being able to improve the overall anomaly detection accuracy.

[0075] In other implementations, the anomaly detection algorithm may further include: obtaining and executing a labeling instruction to label data in the to-be-detected data that is not originally abnormal data as abnormal data.

[0076] It is understandable that the anomaly points of the data may not be detected 100% when using anomaly detection algorithms on data sequences. For such cases, the data sequences are manually marked for anomalies. Manual marking can be based on user experience, and the data can be marked for anomalies within a certain period of time or at certain points. The marking can be done by fixed-point marking of a certain point in the data sequence or by batch marking of data within a certain period of time. The anomaly detection algorithm combined with the anomaly detection method of manual marking greatly improves the detection accuracy of abnormal data.

[0077] Furthermore, the anomaly detection method may further include: obtaining and executing a marking cancellation instruction to remove the abnormal data identifier that is originally abnormal data in the data to be detected.

[0078] When marking data anomalies, there may be misoperations, or when the accuracy of the anomaly algorithm in detecting data anomalies is not very high, there may be wrongly marked anomalies. On this basis, a button for removing marks is developed, and the mark removal function of the visualization page is used to remove the wrong data, ensure the accuracy of the anomaly data, and improve the accuracy of data anomaly detection.

[0079] Based on the above, Figure 3 The flow chart of data sequence anomaly detection is shown, which can be combined with Figure 3 Understand the relevant contents of the aforementioned embodiments.

[0080] In other implementations, after obtaining the detection result, the anomaly detection method may further include: exporting all the abnormal data corresponding to the detection result into a data file in a first format.

[0081] By combining the anomaly detection algorithm and the set of labeled data anomaly points obtained by manual labeling, the data set containing the data anomaly column can be exported into an arff file and saved in the specified directory. At the same time, different types of data sequences can be manually exported to different directories. The exported data set provides an analytical basis for the causes of abnormal data.

[0082] Figure 4 This is a flow chart of the abnormal result storage of the data sequence disclosed in the embodiment of the present application, which can be combined with Figure 4 Understand the relevant contents of the aforementioned embodiments.

[0083] This embodiment mainly detects anomalies in the data sequence generated by the call volume of the civil aviation interface, and marks the detected data sequence anomalies through a visual method to intuitively display the anomaly location and abnormal time period. Combining multiple anomaly detection methods, it supports manual annotation to determine abnormal data and displays a list of anomalies in the data sequence. By using a visual anomaly detection interface, different data sequence detection methods are selected to detect the data sequence, and the location of the abnormal data is marked. The anomaly points and the time when the anomaly points are generated are intuitively displayed to facilitate the subsequent analysis of the causes of the anomalies, providing a good foundation for the subsequent analysis of the causes of abnormal behavior.

[0084] This application proposes a method for detecting anomalies in interface call volume based on the civil aviation system. By obtaining a trend graph of the interface call volume changing over time and displaying the trend graph, a certain trend graph is selected, and an anomaly detection algorithm is selected for the trend graph. The trend graph is detected by different algorithms, and manual anomaly point marking can be performed at the same time. Finally, a time trend graph with anomaly point markings is obtained, and the final data with anomaly markings can be downloaded. This is to provide data support for subsequent anomaly detection analysis. The specific processing flow can be divided into the following steps:

[0085] Step 1: Display the trend graph of the interface call volume over time. The time trend graph may be regular or irregular. After selecting a trend graph, the trend graph will be displayed on the visualization page. The horizontal and vertical axes of the displayed data include time and call volume, anomaly detection algorithm selection, data manual marking function, marked data removal function, detailed display of abnormal point marked data, and marked data export function;

[0086] Step 2: Anomaly detection of data sequence, display the data on the anomaly detection page (in the marked data export module. After clicking the trend chart, select the trend chart and jump to the interface), select different algorithms to perform anomaly detection on the data sequence through the integrated anomaly detection algorithm, and mark the detected abnormal data with vertical lines. For locations that cannot be detected by the algorithm and are manually considered to be abnormal points, you can also manually mark the abnormal points and export the marked data into an arff file;

[0087] Step 3: Visual display, after marking the data, will show the detailed information of the marked abnormal data, the specific data of each column and the identifier of the marked column (this is the preview module of the abnormal data file, which can be previewed before exporting; it can include but is not limited to the three columns of call time, call volume, and whether it is an abnormal point; the identifier of the abnormal point is 1, and the non-abnormal point is marked as 0). The location of the abnormal data point is also clearly displayed in the trend graph.

[0088] In summary, the anomaly detection method proposed in this application is a visual abnormal data detection method that can effectively and intuitively detect the abnormal points of the data sequence; in its implementation, different types of data sequences generated by user calls and data complexity are considered, and a variety of anomaly detection algorithms are combined to effectively adapt different algorithms to different types of data. At the same time, combined with the manual labeling method, the anomaly detection accuracy of the data sequence is greatly improved; in addition, the labeled abnormal data displays detailed information of its data, and the location of the data anomaly points can be intuitively analyzed.

[0089] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0090] The method is described in detail in the embodiments disclosed in the above-mentioned application. The method of the application can be implemented by various forms of devices. Therefore, the application also discloses a device, and a specific embodiment is given below for detailed description.

[0091] Figure 5 Schematic diagram of the structure of an abnormality detection device disclosed in an embodiment of the present application. Figure 5 As shown, the abnormality detection device 50 may include:

[0092] The data display module 501 is used to obtain the interface call volume data of the civil aviation system interface and to visualize the interface call volume data.

[0093] The data determination module 502 is used to determine the data to be detected from the interface call volume data displayed and output.

[0094] The anomaly detection module 503 is used to perform anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result.

[0095] The result display module 504 is used to display and output the detection result, and the detection result includes relevant content of abnormal data.

[0096] The anomaly detection device described in this embodiment provides a visual abnormal data detection method, which can effectively and intuitively detect and display abnormal data in interface call volume data. In the implementation process, different anomaly detection algorithms can be used to perform anomaly detection on the data to be detected, thereby improving the accuracy of anomaly detection of interface call volume data.

[0097] In one implementation, the data display module may be specifically used to obtain interface call volume data of a civil aviation system interface, and generate a trend chart showing data changes over time based on the interface call volume data for visual display.

[0098] In one implementation, the data determination module can be specifically used to: select a trend graph that needs to be detected for anomaly to jump to an anomaly detection page, and the trend graph exists in the anomaly detection interface as data to be detected.

[0099] In one implementation, the anomaly detection module can be specifically used to: determine the data type of the sequence data corresponding to the data to be detected; determine the target algorithm based on the data type, and the target algorithm includes at least two different anomaly detection algorithms; perform anomaly detection on the data to be detected based on the target algorithm; and merge the detection data of each anomaly detection algorithm to obtain a detection result.

[0100] In one implementation, the relevant content of the abnormal data includes at least the call time, the call volume and an abnormality mark.

[0101] In one implementation, the result display module may be specifically configured to: add an abnormality mark at a position corresponding to the abnormal data in the trend graph.

[0102] In one implementation, the anomaly detection device may further include: a first execution module, configured to obtain and execute a labeling instruction to label data in the to-be-detected data that is not originally abnormal data as abnormal data.

[0103] In one implementation, the anomaly detection device may further include: a second execution module, configured to obtain and execute a marking cancellation instruction to remove an abnormal data identifier that is originally abnormal data in the data to be detected.

[0104] In one implementation, the anomaly detection device may further include: a data export module, configured to export all abnormal data corresponding to the detection result into a data file in a first format after the detection result is obtained.

[0105] Figure 6 This is a schematic diagram of the principle architecture of the anomaly detection system disclosed in the embodiment of this application. Figure 6 As shown, the anomaly detection system may include a data display module, a data selection module, an algorithm selection module, a manual marking module, a marking removal module, a marked data export module and an abnormal data display module. Among them:

[0106] Data display module: obtains call volume data based on the civil aviation system interface, provides data display function, displays the call volume data, and generates a trend chart of data changes over time.

[0107] Data selection module: Through the displayed call volume data information, the data selection function is invented. The visualization page intuitively displays the data trend and selects each data trend chart to provide a basis for subsequent anomaly detection.

[0108] Algorithm selection module: According to the selected data trend chart, by integrating different types of anomaly detection algorithms, different algorithms are selected through the visualization page to obtain a trend chart with marks of abnormal points in the data trend chart.

[0109] Manual marking module: It also supports manual marking. According to the manual marking button, points that are considered abnormal can be manually marked to provide data support for subsequent abnormality analysis.

[0110] Mark removal module: For anomalies that are accidentally marked incorrectly, the marks can be removed to ensure that data anomalies are truly effective.

[0111] Marked data export module: Marked abnormal data (the data exported here is the data with abnormal marks after the above marking) can be exported into an arff file (a file ending with the suffix .arff, other types of files cannot be exported), and a column of data is added to export the abnormal mark column (after marking, a mark column will be added to the original data, each abnormal data will be marked as 1, and non-abnormal points will be marked as 0. On this basis, a file with the suffix .arff is exported) to provide basic data for subsequent data anomaly detection.

[0112] Abnormal data display module: For the marked data and abnormal data detected by the algorithm, the present invention displays the data on the visualization page, marks the abnormal points of the data with vertical lines, intuitively displays the abnormal data in the data trend chart (displays the entire trend chart and displays the abnormal point identification at the same time), and displays the detailed information of the data, displays each column of abnormally marked data, and adds a marked column. This allows users to understand the abnormal points more clearly and intuitively, and thus analyze the causes of the abnormal points.

[0113] The present application provides an outlier detection solution based on visualized user call volume data of the civil aviation system. The solution operates on sequence data through a visualization page, performs anomaly detection on the data sequence by selecting different anomaly detection algorithms, and displays the detected outlier data in a visualization list. The solution also supports manual annotation of abnormal data and removal of anomalies, as well as data export of anomaly annotations, providing a good foundation for subsequent analysis of the causes of data anomalies and data classification.

[0114] The specific implementation of the aforementioned abnormality detection device and the modules it contains can be found in the corresponding parts of the method embodiment, which will not be repeated here.

[0115] Any of the anomaly detection devices described in the above embodiments includes a processor and a memory. The data display module, data determination module, anomaly detection module, result display module, etc. in the above embodiments are all stored in the memory as program modules, and the processor executes the above program modules stored in the memory to implement corresponding functions.

[0116] The processor includes a kernel, which retrieves the corresponding program module from the memory. One or more kernels can be set, and the processing of the access data can be realized by adjusting the kernel parameters.

[0117] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0118] In an exemplary embodiment, a computer-readable storage medium is also provided, which can be directly loaded into the internal memory of a computer and contains software code. After the computer program is loaded and executed, it can implement the steps shown in any embodiment of the above-mentioned abnormality detection method.

[0119] In an exemplary embodiment, a computer program product is also provided, which can be directly loaded into the internal memory of a computer, wherein the computer program contains software codes, and after being loaded and executed by a computer, the computer program can implement the steps shown in any embodiment of the above-mentioned abnormality detection method.

[0120] Furthermore, an embodiment of the present application provides a server. Figure 7 This is a schematic diagram of the structure of a server disclosed in an embodiment of the present application. Figure 7 As shown, the server includes at least one processor 701, and at least one memory 702 and a bus 703 connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call the program instructions in the memory to execute the above-mentioned anomaly detection method.

[0121] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0122] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0123] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0124] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An anomaly detection method, characterized in that: include: Obtaining interface call volume data of civil aviation system interfaces and visually displaying the interface call volume data; Determine the data to be tested from the displayed output interface call volume data; Performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result; The detection result is displayed and output, and the detection result includes relevant content of the abnormal data.

2. The anomaly detection method according to claim 1, characterized in that: The obtaining of the interface call volume data of the civil aviation system interface and visually displaying the interface call volume data includes: The interface call volume data of the civil aviation system interface is obtained, and a trend chart showing the data changes over time is generated based on the interface call volume data for visual display.

3. The anomaly detection method according to claim 2, characterized in that: The step of determining the data to be detected from the displayed output interface call volume data includes: Select the trend graph that needs to be detected for anomaly to jump to the anomaly detection page, and the trend graph exists in the anomaly detection interface as data to be detected.

4. The anomaly detection method according to claim 1, characterized in that: The performing anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result includes: Determine the data type of the sequence data corresponding to the data to be detected; Determine a target algorithm based on the data type, the target algorithm comprising at least two different anomaly detection algorithms; Performing anomaly detection on the data to be detected based on the target algorithm; The detection data of each anomaly detection algorithm are combined to obtain the detection result.

5. The anomaly detection method according to claim 1, characterized in that: The relevant content of the abnormal data includes at least the call time, the call volume and an abnormality mark.

6. The abnormality detection method according to claim 3, characterized in that: The display and output of the detection result includes: An abnormality mark is added at a position in the trend graph corresponding to the abnormal data.

7. The anomaly detection method according to claim 1, characterized in that: Also includes: Obtain and execute a labeling instruction to label data that is not abnormal data in the to-be-detected data as abnormal data.

8. The abnormality detection method according to claim 7, characterized in that: Also includes: A marking cancellation instruction is obtained and executed to remove the abnormal data identifier of the abnormal data in the data to be detected.

9. The abnormality detection method according to claim 1, characterized in that: After obtaining the test result, the method further includes: Export all abnormal data corresponding to the detection result into a data file in a first format.

10. An abnormality detection device, characterized in that: include: A data display module, used to obtain the interface call volume data of the civil aviation system interface and to visually display the interface call volume data; A data determination module is used to determine the data to be detected from the interface call volume data displayed and output; An anomaly detection module, used to perform anomaly detection on the data to be detected based on different anomaly detection algorithms to obtain a detection result; The result display module is used to display and output the detection result, and the detection result includes relevant content of abnormal data.

Images