Detection method, device and equipment and computer readable storage medium

Abstract

The embodiment of the invention discloses a detection method, device and equipment and a computer readable storage medium. The method comprises the following steps: acquiring index weight information of each entity; calculating distance measurement information between the index data sequences of every two entities in a specified time period based on the index weight information of each entity to obtain multiple pieces of distance measurement information; determining a reference entity from the plurality of entities based on the plurality of pieces of distance measurement information, and performing phase alignment on an index data sequence of each entity in a specified time period and an index data sequence of the reference entity in the specified time period based on the index weight information of each entity to obtain an index data sequence after phase alignment; and performing model training based on the index data sequence after phase alignment, and detecting an entity to be detected based on the trained model. Through the method, the detection cost can be reduced.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a detection method, apparatus, device and computer-readable storage medium. Background Art

[0002] With the rapid development of the IT field, the number of entities in IT infrastructure has grown exponentially. In order to ensure the stable operation of each system, it is necessary to manage the IT infrastructure, such as performing anomaly detection, which can help operation and maintenance personnel identify abnormal behaviors of entities.

[0003] In the related art, when a deep learning model is used for anomaly detection, training data is used to train the deep learning model to increase the robustness of the deep learning model in anomaly detection. However, when training the model, not only a large amount of training data is required, but also a long training time is required to achieve a good effect. In addition, different models need to be trained for anomaly detection in different scenarios. This greatly increases the cost of anomaly detection.

[0004] Therefore, how to reduce the detection cost is an urgent problem to be solved. Summary of the invention

[0005] To solve the above technical problems, the embodiments of the present application provide a detection method, apparatus, device and computer-readable storage medium, which can reduce the detection cost.

[0006] Among them, the technical solution adopted in this application is:

[0007] A detection method comprising:

[0008] Obtaining indicator weight information of each entity, where the indicator weight information of the entity is used to characterize the intensity of periodic changes in the indicator of the entity;

[0009] Based on the indicator weight information of each entity, distance measurement information between the indicator data series of every two entities within a specified time period is calculated to obtain multiple distance measurement information;

[0010] Determine a reference entity from the multiple entities based on the multiple distance measurement information, and based on the indicator weight information of each entity, phase align the indicator data sequence of each entity in the specified time period with the indicator data sequence of the reference entity in the specified time period to obtain a phase-aligned indicator data sequence;

[0011] Model training is performed based on the phase-aligned indicator data sequence, and the entity to be detected is detected based on the trained model.

[0012] A detection device, comprising:

[0013] An acquisition unit, used to acquire indicator weight information of each entity, wherein the indicator weight information of the entity is used to characterize the intensity of periodic changes of the indicator of the entity within a specified time period;

[0014] A calculation unit, configured to calculate distance measurement information between the indicator data sequences of every two entities within the specified time period based on the indicator weight information of each entity, to obtain a plurality of distance measurement information;

[0015] A processing unit, configured to determine a reference entity from a plurality of entities based on the plurality of distance measurement information, and to phase-align the indicator data sequence of each entity within the specified time period with the indicator data sequence of the reference entity within the specified time period based on the indicator weight information of each entity, so as to obtain a phase-aligned indicator data sequence;

[0016] The training unit is used to perform model training based on the phase-aligned indicator data sequence, and to detect the entity to be detected based on the trained model.

[0017] In one embodiment of the present application, based on the aforementioned scheme, the acquisition unit is also used to acquire the prediction period of the entity; the calculation unit is also used to calculate the weight corresponding to each indicator of the indicator data sequence based on the prediction period; and the weight corresponding to each indicator is used as the indicator weight information of the entity.

[0018] In one embodiment of the present application, based on the aforementioned scheme, the calculation unit is also used to calculate the data difference information in the indicator data sequence corresponding to the indicator in units of prediction period based on each data point contained in the indicator data sequence corresponding to each indicator and the data point separated from the data point by the prediction period; calculate the indicator weight of the indicator data sequence corresponding to each indicator based on the data difference information, and obtain the indicator weight information of each entity in the specified time period.

[0019] In one embodiment of the present application, based on the aforementioned scheme, the entity corresponds to multiple indicator data sequences for the specified time period, the multiple indicator data sequences are respectively for different indicators, and the indicator weight information of the entity includes weight information of multiple indicators; the calculation unit is also used to average the weight information of the indicators corresponding to the multiple entities for each indicator, to obtain the weight average value of each indicator; based on the weight average value of each indicator, the distance measurement information between the indicator data sequences of every two entities in the specified time period is calculated to obtain the multiple distance measurement information.

[0020] In one embodiment of the present application, based on the aforementioned scheme, the calculation unit is also used to calculate, for each entity, the phase offset between the entity and the reference entity based on the weighted average value of each indicator, and the processing unit is also used to phase-align the indicator data sequence of the entity within the specified time period with the indicator data sequence of the reference entity within the specified time period based on the phase offset to obtain the phase-aligned indicator data sequence.

[0021] In one embodiment of the present application, based on the aforementioned scheme, the acquisition unit is also used to obtain the predicted phase offset of the indicator in the entity; the calculation unit is also used to calculate the normalized mutual correlation information between the indicator data series of the entity and the reference entity within the specified time period based on the predicted phase offset and the weighted average value of each indicator; and the predicted phase offset when the normalized mutual correlation information between the entity and the reference entity reaches a maximum value is used as the phase offset.

[0022] In one embodiment of the present application, based on the aforementioned scheme, the computing unit is further used to, for each entity, sum up the distance measurement information between the entity and all other entities to obtain the distance and value of the entity; and select the entity with the smallest distance and value from the distances and values ​​corresponding to multiple entities as the reference entity.

[0023] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is further used to classify the indicator data sequences of the multiple entities according to the shape types of the indicator data sequences to obtain multiple entity clusters; the training unit is further used to perform model training using the phase-aligned indicator data sequences within the specified time period corresponding to each entity cluster to obtain the detection model corresponding to each entity cluster.

[0024] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is also used to select a target detection model that matches the entity to be detected from the multiple detection models based on distance measurement information of the indicator data sequences corresponding to the cluster centers of the entity to be detected and the multiple entity clusters; and detect the specified data sequence of the entity to be detected based on the target detection model.

[0025] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is further used to segment the indicator data sequence of the entity to be detected based on the length of the specified time period to obtain multiple sequence fragments of the entity to be detected; phase align the target sequence fragment with the indicator data sequence of the reference entity within the specified time period to obtain the target sequence fragment after phase alignment; wherein the target sequence fragment is any one of the multiple sequence fragments; the calculation unit is further used to calculate the distance measurement information between the target sequence fragment and the indicator data sequence of the cluster centers corresponding to the multiple entity clusters within the specified time period to obtain multiple distance measurement information to be detected; and use the detection model trained by the target entity cluster corresponding to the minimum distance measurement information to be detected among the multiple distance measurement information to be detected as the target detection model.

[0026] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is also used to detect the similarity of the shape of the indicator data sequence between the target sequence fragment and the cluster center corresponding to the target entity cluster within the specified time period; based on the similarity, the model parameters in the target detection model are migrated to the newly created model to obtain the model to be detected; and the target sequence fragment is detected based on the model to be detected.

[0027] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is also used to, if the similarity is greater than or equal to a preset similarity threshold, use all parameters of the model parameters in the target detection model as all parameters of the newly created model to obtain the model to be detected; if the similarity is less than the preset similarity threshold, then based on the type of the newly created model, use some parameters of the model parameters in the target detection model as some parameters of the newly created model to obtain the model to be detected.

[0028] In one embodiment of the present application, based on the aforementioned scheme, the processing unit is also used to, if the newly created model is composed of a plurality of fully connected layers stacked together, use the parameters of the outer structure in the target detection model as the parameters of the outer structure of the newly created model to obtain the model to be detected; if the newly created model contains a preset type network layer, use the parameters of the preset type network layer in the target detection model as the parameters of the preset type network layer in the newly created model to obtain the model to be detected.

[0029] A detection device includes a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the above detection method is implemented.

[0030] A computer-readable storage medium stores computer-readable instructions, which, when executed by a processor of a computer, enable the computer to execute the above detection method.

[0031] A computer program product includes computer-readable instructions, and when the computer-readable instructions are executed by a processor, the above detection method is implemented.

[0032] In the above technical solution:

[0033] On the one hand, by calculating the distance metric between indicator data sequences based on the indicator weight information of each entity, the similarities and differences between different entities can be measured more accurately, which helps to more accurately determine the benchmark entity. In addition, the indicator data sequence of each entity in the same time period is aligned through the phase of the indicator data sequence of the benchmark entity in the specified time period. The phase-aligned data sequence can better capture the temporal relationship between the data, which is conducive to ensuring the training efficiency and accuracy of the model.

[0034] On the other hand, during the model training phase, only data within a specified time period is used for training, without the need for a complete indicator data series. This helps reduce the amount of data and duration of model training, thereby reducing the cost of model training and testing.

[0035] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0037] Figure 1 This is a schematic diagram of a multi-dimensional KPI in an exemplary anomaly detection scenario.

[0038] Figure 2 It is a schematic diagram of an implementation environment involved in this application;

[0039] Figure 3 is a flowchart of offline training according to an exemplary embodiment;

[0040] Figure 4 is a flow chart of a detection method according to an exemplary embodiment;

[0041] Figure 5is a flow chart of a detection method according to another exemplary embodiment;

[0042] Figure 6 is a flow chart of a detection method according to another exemplary embodiment;

[0043] Figure 7 is a flow chart of a detection method according to another exemplary embodiment;

[0044] Figure 8 is a diagram showing an abnormality detection effect according to an exemplary embodiment;

[0045] Fig. 9 This is a schematic diagram of the F1score performance of various models at different model training times;

[0046] Fig.10 is a block diagram of a detection device according to an exemplary embodiment;

[0047] Fig.11 It is a schematic diagram of the hardware structure of a detection device according to an exemplary embodiment. DETAILED DESCRIPTION

[0048] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments that are the same as the present application. Instead, they are only examples of devices and methods that are the same as some aspects of the present application as detailed in the attached claims.

[0049] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0050] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, while some operations / steps can be integrated or partially integrated, so the actual execution order may change according to actual conditions.

[0051] It should be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0052] It should be noted that in the specific implementation of this application, user-related data is involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0053] It should be noted that the formulas involved in the embodiments of the present application can be flexibly adjusted, for example, by increasing or decreasing corresponding parameters.

[0054] Before introducing the technical solutions of the embodiments of the present application, the technical terms involved in the embodiments of the present application are first introduced here.

[0055] A multidimensional key performance indicator (KPI) is an indicator used to measure and evaluate performance in business or system operations. These indicators often involve data from multiple dimensions or aspects. KPIs are usually associated with specific goals or business goals and are used to measure the success of a business or system in achieving these goals. In a multidimensional KPI, "multidimensional" emphasizes that the indicator involves performance data from multiple aspects and dimensions. These dimensions can be different business indicators, technical indicators, or other aspects of data. For example, the system-level indicators of a server may at least include: CPU load, memory usage, network throughput, and disk input / output (I / O); user-level indicators may at least include: average response delay, page access times, and access error rate; other indicators of a base station may at least include: wireless connection rate, wireless drop rate, switching success rate, interference level, and uplink and downlink traffic. It is understandable that a multidimensional KPI may contain multiple indicators.

[0056] Multivariate Time Series (MTS) refers to a data series involving multiple variables (indicators) changing over time in statistics and time series analysis. Compared with univariate time series, MTS contains observations of multiple indicators at the same time point. In a multivariate time series, the observation at each time point is a vector, not a single value. These vectors usually represent the values ​​of different indicators at that time point.

[0057] like Figure 1The figure shows a schematic diagram of multi-dimensional KPI in an exemplary anomaly detection scenario. Figure 1 In the multidimensional KPI, an entity can represent a physical or virtual entity such as a device, server or base station. Different entities have different multidimensional time series in the multidimensional KPI, that is, each indicator of an entity in the multidimensional KPI has a corresponding time series, also called an indicator data series. Each indicator data series contains the indicator values ​​of the entity at each time point under the indicator.

[0058] The indicator data series in the multidimensional KPI correspond to different entities and different indicator values, providing detailed information about the entity's performance and indicator changes. These time series constitute the time dimension of the entity, which can be regarded as the indicator data values ​​sampled by the computer for the entity in different time dimensions. In other words, the computer can collect the values ​​of each indicator data series of the entity in different time dimensions.

[0059] In this anomaly detection scenario, the importance of multidimensional KPI lies in providing comprehensive entity performance and anomaly detection capabilities. By analyzing the indicator data series in the multidimensional KPI, the system can monitor the entity's status and performance changes in real time, and take timely corresponding measures when abnormal situations are found. For example, for a server entity, the multidimensional KPI can include indicators such as CPU usage, memory occupancy, and network traffic. By analyzing these indicator data series, the system can detect abnormal behaviors of the server, such as high load, memory leaks, etc., and take timely measures to avoid system crashes or service interruptions.

[0060] In different anomaly detection scenarios, due to the diversity and complexity of data sources, indicator data sequences may be affected by various interferences and noises, including noisy data and abnormal data.

[0061] Noise data: Noise data refers to data disturbances introduced due to random fluctuations in the data collection process, sensor errors, communication interference, etc. These data are random to a certain extent and may cause slight changes in the indicator data sequence, but they do not represent actual abnormal conditions. The presence of noise data may interfere with the anomaly detection algorithm and affect the accuracy and reliability of detection.

[0062] Abnormal data: Abnormal data refers to data that does not conform to normal behavior, which may be caused by equipment failure, operational errors, network attacks, etc. These data appear as abnormal peaks, abnormal trends, or sudden abnormal events in the indicator data sequence. The existence of abnormal data is the goal of anomaly detection, but in actual scenarios, the types and quantities of abnormal data may be large, so it is necessary to distinguish between real abnormal data and false positive abnormal data to ensure the accuracy of detection.

[0063] exist Figure 1 There are also periodic indicator data series and non-periodic indicator data series, and different periodic situations can be obtained according to different indicators.

[0064] Transfer learning is a machine learning method that improves the performance of a target task or field by transferring knowledge learned from one task or field to another task or field. In traditional machine learning, it is usually assumed that training data and test data are independently and identically sampled from the same distribution. However, in practical applications, in many cases, training data and test data do not meet this assumption, resulting in poor performance of traditional machine learning methods. In transfer learning, if the knowledge in the source field can help the learning of the target field, then the data or model in the source field can be used to assist the learning process in the target field, thereby speeding up learning, improving learning performance, or reducing the demand for data in the target field.

[0065] Clustering is an unsupervised learning method used to divide samples in a data set into multiple groups or clusters with similar characteristics. The goal of clustering is to make the similarity of samples within the same cluster as high as possible, while the similarity of samples between different clusters is as low as possible. Clustering algorithms perform clustering by calculating the similarity or distance between samples, and do not require pre-labeled training data, so they are called unsupervised learning. Clustering algorithms divide data samples into multiple clusters based on similarity, and each cluster represents a class or a group of similar samples. Common clustering algorithms include K-means clustering, which is one of the most commonly used clustering algorithms. It can divide samples into K clusters, each cluster represented by its centroid (the average value of samples in the cluster, also called the cluster center).

[0066] In the related art, when a deep learning model is used for anomaly detection, training data is used to train the deep learning model. Training the model requires not only a large amount of training data, but also a long training time to achieve good results. In addition, different models need to be trained for different scenarios to perform anomaly detection. This greatly increases the cost of anomaly detection.

[0067] Based on this, the embodiments of the present application respectively propose a detection method, a detection device, a detection equipment, a computer-readable storage medium, and a computer program product. In these embodiments, only data within a specified time period is used for training, without requiring a complete indicator data sequence. This helps to reduce the amount of data and duration of model training, thereby reducing the cost of model training and detection.

[0068] See also Figure 2 , Figure 2 It is a schematic diagram of an implementation environment involved in this application.

[0069] Figure 2 The implementation environment shown specifically includes an offline training module 210 , a transfer learning module 220 and an online detection module 230 .

[0070] The offline training module 210 is used to train the model in an offline state. First, the offline training module 120 will first extract the baseline of the acquired complete historical indicator data series of multiple entities and smooth the data. Then, the complete historical indicator data series of each entity is split into historical indicator data series of multiple time periods. In this way, data sets of multiple time periods can be obtained, and each data set represents an indicator data series within a time period.

[0071] You can select a time period as a specified time period from multiple time periods. The specified time period is a key time period for training models. You can train machine learning models or deep learning models based on the indicator data series of each entity in the time period. Selecting an appropriate specified time period can affect the effect of model training and the accuracy of anomaly detection.

[0072] Before training the model, the offline training module 210 can classify the indicator data sequences of multiple entities according to the shape type of the indicator data sequences. Indicator data sequences with similar shape types can be summarized into an entity cluster. For example, the indicator data sequences of each entity with shape C are added to entity cluster C. For each entity cluster, the offline training module 210 can train an anomaly detection model separately. The purpose of doing this is to better adapt to indicator data sequences of different shape types and improve the accuracy and robustness of anomaly detection. The process of training the model can use a machine learning algorithm or a deep learning algorithm so that the model can learn and understand the laws of anomaly detection.

[0073] It should be noted that after the offline training module 210 performs model training based on the indicator data sequences of multiple entities in a specified time period, an initial detection model is obtained. This initial model is obtained by training based on existing data and is used to perform preliminary anomaly detection tasks. The offline training module 210 can also continue the next training, that is, enter the next time period (the time period can be any unused time period among the multiple time periods split out). During this time period, the indicator data sequence corresponding to each entity cluster will have some changes, because the data may change in different time periods, including normal fluctuations and abnormal situations.

[0074] For the indicator data sequence in the next time period, the existing detection model can be incrementally trained. Incremental training is to use new data to further optimize the model based on the existing model. This can avoid retraining the model from scratch, saving time and computing resources. Through incremental training, the detection model can gradually adapt to new data changes and enhance its ability to detect new data. The detection model is continuously incrementally trained in different time periods, so that the detection model can capture the data characteristics in different time periods and better adapt to various data changes and abnormal situations.

[0075] Specifically, during the execution of the offline training module 220, that is, during the offline training phase, the following steps may be included: Figure 3 The parts shown include obtaining the indicator data series of historical multi-dimensional KPI, baseline extraction, calculation of indicator weight information, slicing segmentation, phase alignment and clustering.

[0076] Before the transfer learning module 220 performs transfer learning, the indicator data sequence of the entity to be detected can be split into multiple segments. Each segment of data represents an indicator data sequence within a period of time, so that the entire indicator data sequence can be divided into multiple time periods. From multiple time periods, arbitrarily select a segment as the target data sequence. The target data sequence is a portion of the data of the entity to be detected and can be used for anomaly detection. Furthermore, the target data sequence is phase-aligned with the indicator data sequence of the aforementioned reference entity within a specified time period. Phase alignment is to ensure that the target data sequence and the data sequence of the reference entity have the same time dimension, which is convenient for subsequent model training and transfer learning.

[0077] Next, an entity cluster with a shape type closest to the target data sequence can be selected from multiple entity clusters. Entity clusters with similar shape types have similar indicator data sequence characteristics, so the entity cluster that best matches the target data sequence can be selected as the source of the target detection model. The detection model obtained by training corresponding to the selected entity cluster can be used as the target detection model. This target detection model is trained on other entity clusters, but because the shape types are similar, it can be used as the starting point of the target model. Next, the transfer learning module 220 can use transfer learning technology to generate a new model, transfer and fine-tune parameters based on the target detection model, and obtain the model to be detected. The transfer learning technology utilizes the knowledge of the target detection model trained on other entity clusters, accelerates the training process of the model to be detected, and improves the effect and performance of the model.

[0078] The online detection module 230 is used to apply the trained model, i.e., the model to be detected, to perform detection in a real-time or online environment. After offline training and transfer learning, the model to be detected will be deployed in an online environment, and can process the data acquired in the anomaly detection scenario in real time. The online detection module 230 can use the model to be detected to perform anomaly detection on a fragment of the indicator data sequence of the entity to be detected, and detect the probability that the entity to be detected may be abnormal. The model to be detected can output an anomaly score indicating the degree of abnormality at each time point, and then can determine whether each point is abnormal based on the threshold of the anomaly score.

[0079] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0080] It should be noted that the detection method in this application can use a higher performance server configuration to perform corresponding model training and anomaly detection. The detection method can be applied in scenarios such as wireless base stations, servers, and user terminal devices to detect whether different entities have abnormalities.

[0081] See also Figure 4 , Figure 4 is a flow chart of a detection method according to an exemplary embodiment. The method can be applied to Figure 2 The implementation environment shown in the figure is specifically executed by a computer. Of course, the method can also be applied to other implementation environments, and the execution subject of the method is not limited here.

[0082] The following will use a computer as an exemplary execution subject to describe the detection method in detail. Figure 4 As shown, in an exemplary embodiment, the method comprises at least the following steps:

[0083] S410, obtaining indicator weight information of each entity, where the indicator weight information of the entity is used to characterize the intensity of periodic changes of the indicator of the entity within a specified time period.

[0084] In an embodiment of the present application, in order to reduce the impact of noise data and abnormal data on multidimensional KPI, the data can be smoothed. First, the mean and standard deviation of the indicator data sequence of each entity are calculated. Then, the extreme values ​​in the data sequence, that is, the abnormal values ​​that differ greatly from the mean, are detected. A threshold can be set, for example, marking the deviation from the mean by more than 5% as an extreme value. Delete these extreme value data to reduce the impact of abnormal data on the data sequence. After deleting the extreme values, some positions where data is missing will be left. In order to fill these missing data, a linear interpolation method can be used. Linear interpolation is a commonly used data interpolation technique that estimates the value of missing data points through the linear relationship between known data points. This can make the data sequence more continuous and smooth. Next, the sliding average method can be used to further smooth the data. Sliding average is a moving average technique that replaces the original data points by calculating the average value of the data points in the window in the data sequence. This window can be set to a fixed size, such as averaging over a period of time. Sliding average can eliminate high-frequency fluctuations in the data and make the data sequence more stable and gentle. In this way, the noise and outliers in the data series can be reduced, making the baseline of the multidimensional KPI more stable and reliable.

[0085] The computer can calculate the periodicity of each indicator, that is, calculate the indicator weight information of each entity. The indicator weight information can include the weight corresponding to each indicator in the entity.

[0086] The computer can obtain the prediction period of the entity, which can include the periodic prediction value of each indicator, and then calculate the weight corresponding to each indicator of the indicator data series of the entity based on the prediction period, and use the weight corresponding to each indicator as the indicator weight information of the entity.

[0087] Specifically, the weight corresponding to each indicator can be calculated by the following formula:

[0088]

[0089]

[0090] Among them, τ is the prediction period, which is a possible value of a period. Its specific value can be selected by technical personnel in this field, for example, it can be one hour, one day, one week or one month. d(τ) is the sum of the differences between the values ​​of every two time points with an interval of τ in the data sequence of an indicator. CMND(τ) is the Cumulative Mean Normalized Difference (CMND) algorithm. CMND(τ) is the weight information of the indicator in the multidimensional KPI, indicating the strength of the data periodicity of the indicator of the entity. After performing this operation on each indicator, the indicator weight information of the entity can be obtained.

[0091] S420, calculating the distance measurement information between the indicator data sequences of every two entities within a specified time period based on the indicator weight information of each entity, and obtaining a plurality of distance measurement information.

[0092] Specifically, the computer can calculate the average value of the weights of the indicators corresponding to multiple entities for each indicator to obtain the average periodic weight information of each indicator, and then calculate the average periodic weight information to obtain the average weight of each indicator.

[0093] For example, there are three entities, the weight information of indicator 1 in entity 1 is 5, the weight in entity 2 is 6, and the weight in entity 3 is 7. Then the average periodic weight information of indicator 1 can be calculated as (5+6+7) / 3=6.

[0094] In this way, we can get a one-dimensional indicator weight information vector P, which contains the average periodic weight information of each indicator. M , where M is the number of indicators in the multidimensional KPI. Based on the indicator weight information vector P, the weight average of each indicator can be obtained, which can be represented by the weight average vector PW.

[0095] PW=P -α

[0096] Wherein, α is a hyperparameter set by those skilled in the art, and the larger α is, the greater the weight difference between periodic indicators and non-periodic indicators. The weight average vector PW also includes the weight averages of M indicators, for example, the weight average of indicator 1 is 0.1, the weight average of indicator 2 is 0.15, the weight average of indicator 3 is 0.08, ..., the weight average of indicator M is 0.06. And the weight average vector PW is applicable to all entities. In the embodiment of the present application, the stronger the periodicity of the indicator, the higher the weight average can be.

[0097] It should be noted that the weighted average vector PW can be calculated based on the complete indicator data sequence of each entity.

[0098] The computer can split the complete indicator data sequence of each entity to obtain indicator data sequences of multiple time periods, and select a time period as a designated time period, so that the indicator data sequence within the designated time period can be subsequently processed. Therefore, the embodiment of the present application takes the processing method of the indicator data sequence within the designated time period as an example for explanation, and the processing method is the same as the processing method of the indicator data sequence within other time periods.

[0099] Furthermore, based on the weighted average value of each indicator, the computer can calculate the distance measurement information between the indicator data series of each two entities within a specified time period. The distance measurement information can be Euclidean distance, and the following description takes the distance measurement information as Euclidean distance as an example.

[0100] For entity A and entity B, the Euclidean distance between their indicator data series can be calculated using the following formula:

[0101] Euc w (A,B)=(AB) 2 ×PW

[0102] Among them, A and B are two matrices formed by multi-dimensional KPI and indicator data sequences of entity A and entity B respectively. In this way, the Euclidean distance between the indicator data sequences of any two entities among multiple entities can be obtained.

[0103] S430, determining a reference entity from multiple entities based on multiple distance measurement information, and based on the indicator weight information of each entity, phase-aligning the indicator data sequence of each entity within a specified time period with the indicator data sequence of the reference entity within a specified time period to obtain a phase-aligned indicator data sequence.

[0104] The computer can sum the Euclidean distances between each entity and the indicator data sequences of other entities to obtain the sums of multiple Euclidean distances, and select a minimum sum of Euclidean distances, and use the entity corresponding to the minimum sum of Euclidean distances as the reference entity.

[0105] The reference entity can be determined using the following formula.

[0106]

[0107] Among them, PVT is the indicator data sequence of the benchmark entity within a specified time period, and D is the entity indicator data sequence set composed of the indicator data sequences of all entities.

[0108] After determining the reference entity, the indicator data series of each entity in a specified time period can be phase-aligned with the indicator data series of the reference entity in a specified time period. The weighted normalized cross-correlation method can be used to estimate the phase offset of the indicator data series of each entity relative to the reference entity.

[0109] Specifically, s∈[-n+1, ​​n-1] can be used to represent the possible phase offset of an indicator data sequence of an entity in a specified time period relative to an indicator data sequence of a reference entity in a specified time period, where n is the number of time points of the indicator data sequence in the specified time period. The computer can perform a wraparound operation on an indicator data sequence A of entity A in a specified time period and an indicator data sequence B of entity B in a specified time period.

[0110]

[0111] The normalized cross-correlation between the two can be calculated using the following formula:

[0112]

[0113]

[0114] in, It represents the value of the i-th time point in the indicator data sequence of the j-th indicator in sequence A when the possible phase offset is s. Indicates the value of the i-th time point in the indicator data sequence of the j-th indicator in sequence B when the possible phase offset is s. M indicates the number of indicators. CC w (A, B, s, j) represents the mutual information between A and B, NCC w (A, B, s) represents the normalized mutual information between A and B.

[0115] A can be set as the index data sequence of the benchmark entity and B as the index data sequence of each different entity, so as to calculate the normalized mutual information between each entity and the index data sequence of the benchmark entity, that is, NCC w (PVT, MTS seg , s).

[0116] The computer can make NCC w The maximum value s of (A, B, s) is used as the phase offset of the indicator data sequence of the entity in the specified time period relative to the indicator data sequence of the reference entity in the specified time period. This phase offset can also be called the optimal phase offset.

[0117] This phase shift can be expressed as s * The specific calculation formula is as follows:

[0118]

[0119] Among them, PVT is the indicator data series of the benchmark entity in a specified time period, MTS seg It is a series of indicator data of an entity within a specified time period.

[0120] The computer can add the phase of the indicator data sequence of each entity in the specified time period to the phase offset, thereby adjusting the phase of the indicator data sequence of each entity in the specified time period to obtain the phase-aligned indicator data sequence of each entity in the specified time period.

[0121] It is understandable that the phase offsets of the indicator data sequences of different entities within the specified time period and the indicator data sequence of the reference entity within the specified time period may be different.

[0122] S440, performing model training based on the phase-aligned indicator data sequence, and detecting the entity to be detected based on the trained model.

[0123] Specifically, the computer can cluster the indicator data sequence of each entity, and classify the indicator data sequences of the same shape type into an entity cluster. In this way, multiple entity clusters can be obtained, and the computer can train a detection model for each entity cluster to obtain multiple detection models.

[0124] In an embodiment of the present application, a computer may use a specific model to train a detection model for anomaly detection.

[0125] Optionally, the first type of model can be used to train a detection model for anomaly detection: a model based on a variational autoencoder structure. This type of model usually implies the mapping relationship between the variable z and the observed variable x, and often trains the model by optimizing the maximum evidence lower bound. The corresponding loss function is as follows:

[0126]

[0127] Among them, the loss function is mainly composed of a reconstruction term and a regular term. The reconstruction term represents the reconstruction probability of the observation variable x on the reconstruction distribution output by the decoder, and the regular term is composed of the KL divergence.

[0128] Optionally, the second type of model can be used to train a detection model for anomaly detection: models with autoencoder structures and prediction structures. These models directly reconstruct or predict the observed variable x and minimize the difference between the observed variable and the reconstructed value or predicted value to optimize the model. The form of the loss function is as follows:

[0129] L2=MSE(tar get-output)

[0130] Those skilled in the art can select any one of the above two types of models as the basis for training the detection model.

[0131] Next, the computer can use the trained model to detect the entity to be detected.

[0132] When the computer obtains the indicator data sequence of the entity to be detected, the indicator data sequence of the entity to be detected can be segmented based on the length of the specified time period to obtain multiple sequence segments of the entity to be detected, and one of the segments is selected as the target sequence segment. Then, the phase offset between the target sequence segment and the indicator data sequence of the reference entity in the specified time period needs to be calculated, so as to perform phase alignment and obtain the target sequence segment after phase alignment.

[0133] The computer needs to calculate the distance measurement information between the target sequence fragment and the index data sequence of the cluster center of each of the multiple entity clusters to obtain multiple distance measurement information to be detected. Among them, the cluster center of each entity cluster can be selected from the multiple entities contained in each entity cluster, or can be obtained by averaging each entity. Among the multiple distance measurement information to be detected, the minimum distance measurement information to be detected can be determined, and the corresponding entity cluster can be determined as the target entity cluster, and the detection model trained by the target entity cluster can be used as the target detection model.

[0134] Before using the target detection model to detect the target sequence fragment, it is necessary to detect the similarity of the target sequence fragment and the indicator data sequence shape of the cluster center corresponding to the target cluster within a specified time period.

[0135] Specifically, the robust aggregate value of the anomaly score of the target sequence fragment of the entity to be detected on the target detection model can be used as the distance metric between the target sequence fragment and the cluster center of the target entity cluster, and the similarity is obtained based on the distance metric. In an embodiment of the present application, the anomaly score can represent the degree of abnormality of the data, and more intuitively reflect the error size of the target sequence fragment from the reconstruction or prediction of the target detection model, that is, the error size from the normal mode learned by the target detection model. Different deep models have different modeling methods for multidimensional KPIs, so using the deep features of the target detection model itself can more accurately reflect the degree of shape difference between the target sequence fragment and the target entity cluster. At the same time, in order to avoid the interference of noise and anomalies in the training data on the distance metric, the computer can remove the contribution of the maximum anomaly score of 5% to the distance calculation.

[0136] After calculating the similarity of the shape of the indicator data sequence between the target sequence fragment and the cluster center corresponding to the target cluster within a specified time period, the model parameters in the target detection model can be migrated to the newly created model according to the similarity to obtain the model to be detected.

[0137] If the similarity is greater than or equal to the preset similarity threshold, all parameters of the model parameters in the target detection model are used as all parameters of the newly created model to obtain the model to be detected.

[0138] If the similarity is less than a preset similarity threshold, based on the type of the newly created model, some parameters of the model parameters in the target detection model are used as some parameters of the newly created model to obtain the model to be detected.

[0139] Among them, if the newly created model is composed of multiple layers of fully connected layers, the parameters of the outer structure in the target detection model are used as the parameters of the outer structure of the newly created model to obtain the model to be detected. In this case, the computer uses the first type of model mentioned above to train the detection model for anomaly detection. This type of model is composed of multiple layers of fully connected layers, and the parameters of the outer structure can be selected to migrate, because the outer network mainly captures some common features in feature extraction, while the inner network mainly focuses on specific tasks.

[0140] If the newly created model contains a preset type network layer, the parameters of the preset type network layer in the target detection model are used as the parameters of the preset type network layer in the newly created model to obtain the model to be detected. Among them, the preset type network layer can be some special structures, such as recurrent neural networks, convolutional neural networks, graph neural networks and attention mechanism layers. In this case, the computer uses the aforementioned second type of model to train a detection model for anomaly detection. The second type of model also contains fully connected layers. These preset type network layers capture common and important features, while fully connected layers often focus on some specific tasks and are not suitable for migration.

[0141] It should be noted that after performing the above parameter transfer, the computer can also fine-tune various parameters in the model, which is not limited here.

[0142] Through the above operations, a model to be detected for detecting a target sequence segment of an entity to be detected can be obtained, and then the model to be detected can be used to perform anomaly detection on the target sequence segment.

[0143] Specifically, if the model to be detected is trained based on the variational autoencoder architecture model (i.e., the first type of model), the reconstruction probability can be used to represent the anomaly score:

[0144]

[0145] If the model to be detected is trained based on the autoencoder architecture and the prediction-based model (i.e., the second type of model), the reconstruction error or prediction error can be used to represent the anomaly score:

[0146] AnomalyScore2=MSE(tar get-output)

[0147] In this way, the target sequence fragment of the entity to be detected can be detected by the model to be detected.

[0148] It should be noted that the computer can also use the model to be detected to detect other indicator data sequence fragments of the entity to be detected. The detection method is the same as the detection method of the target sequence fragment, which will not be repeated here.

[0149] Through this method, the computer splits the indicator data sequence of each entity, phase-aligns the indicator sequence within a certain period of time, and then clusters it to obtain multiple entity clusters, and trains different detection models based on these entity clusters. The advantage of this is that it reduces the amount of data required for training the model and reduces the cost of training. In the process of transfer learning, the computer can determine the target entity cluster closest to the entity to be detected based on the indicator data sequence of the entity to be detected, and use the detection model corresponding to the target entity cluster for transfer learning. This can improve the pertinence and accuracy of the model to be detected, thereby ensuring the accuracy of anomaly detection. Therefore, this method reduces the detection cost while ensuring the detection accuracy.

[0150] In one embodiment of the present application, another detection method is provided, which can be executed by a computer. Figure 5 As shown, the detection method may include S410, S510 to S520 and S430 to S440. That is, S510 to S520 are Figure 4 The specific implementation method of S420 is shown.

[0151] In an embodiment of the present application, an entity corresponds to multiple indicator data sequences in a specified time period, the multiple indicator data sequences are respectively for different indicators, and the indicator weight information of the entity includes weight information of the multiple indicators.

[0152] S510 to S520 are described below:

[0153] S510, for each indicator, average weight information of indicators corresponding to multiple entities is calculated to obtain the weight average value of each indicator.

[0154] Before executing S510, the computer may also execute S501 to S502, which are described below:

[0155] S501, for each entity, splitting the complete indicator data sequence of the entity to obtain indicator data sequences of multiple time periods.

[0156] Among them, the time period corresponding to the complete indicator data series is equal to the sum of multiple time periods.

[0157] S502: Select an indicator data sequence of a time period from indicator data sequences of multiple time periods as an indicator data sequence of a designated time period.

[0158] The specified time period may be any one of a plurality of time periods, and may be specifically selected by those skilled in the art.

[0159] S520, calculating the distance measurement information between the indicator data series of every two entities within a specified time period based on the weighted average value of each indicator, and obtaining a plurality of distance measurement information.

[0160] The distance measurement information can be Euclidean distance, and the weighted average of each indicator can be PW j To express.

[0161] Through this method, the computer makes full use of the weight information of the indicator and the periodicity of the indicator data sequence. By splitting the data and calculating the distance measurement information, the anomaly detection problem of multi-dimensional KPI data can be modeled more accurately. It can improve the accuracy and efficiency of anomaly detection and reduce the computing cost, making anomaly detection more effective and reliable.

[0162] In one embodiment of the present application, another detection method is provided, which can be executed by a computer. Figure 6 As shown, the detection method can be S410 to S420, S610 and S440. That is, S610 is Figure 4 The specific implementation method of S430 is shown.

[0163] The S610 is described below:

[0164] S610, determine a reference entity from multiple entities based on multiple distance measurement information, and for each entity, calculate the phase offset between the entity and the reference entity based on the weighted average value of each indicator, and based on the phase offset, phase-align the indicator data sequence of the entity within a specified time period with the indicator data sequence of the reference entity within a specified time period to obtain a phase-aligned indicator data sequence.

[0165] In the step of “determining a reference entity from multiple entities based on multiple distance measurement information” in S610 may specifically include S611 to S612.

[0166] S611 to S612 are described below:

[0167] S611, for each entity, summing up the distance measurement information between the entity and all other entities to obtain the distance sum value of the entity.

[0168] That is, the distance measurement information of the entity and entity 1, the distance measurement information of entity 2, and other distance measurement information of each entity except the entity are summed up. In this way, each entity has a corresponding distance sum value.

[0169] S612, selecting an entity with the smallest distance and value from the distances and values ​​corresponding to the multiple entities as a reference entity.

[0170] The distance measurement information between the benchmark entity and other entities is the smallest, so the phase of its indicator data sequence can be used as a benchmark.

[0171] Among them, "calculating the phase offset between the entity and the reference entity based on the weighted average value of each indicator" in S610 may specifically include S613 to S615.

[0172] S613 to S615 are described below:

[0173] S613, obtaining the predicted phase offset of the indicator in the entity.

[0174] The predicted phase offset can be represented by s, s∈[-n+1, ​​n-1].

[0175] S614, calculating the normalized mutual correlation information between the indicator data series of the entity and the reference entity within a specified time period based on the predicted phase offset and the weighted average value of each indicator.

[0176] The computer can first perform a wraparound operation on each entity and the reference entity, and then calculate the normalized mutual information between the indicator data series of each entity and the reference entity, that is, NCC w (PVT, MTS seg , s).

[0177] S615: Taking the predicted phase offset when the normalized mutual correlation information between the entity and the reference entity reaches a maximum value as the phase offset.

[0178] The phase shift can be used * To express.

[0179] Through this method, the computer selects a benchmark entity from multiple entities, and aligns the phases of the indicator data sequences of other entities to the phases of the indicator data sequences of the benchmark entity, so that the indicator data sequences of each entity are more unified, which is conducive to reducing the amount of calculation for subsequent model training, thereby reducing training costs.

[0180] In one embodiment of the present application, another detection method is provided, which can be executed by a computer. Figure 7 As shown, the detection method may include S410 to S430 and S710 to S740. That is, S710 to S740 are Figure 4 The specific implementation method of S440 is shown.

[0181] S710 to S740 are described below:

[0182] S710, classifying indicator data sequences of multiple entities according to shape types of the indicator data sequences to obtain multiple entity clusters.

[0183] In this way, indicator data sequences with similar shape types can be classified into the same category, thereby achieving clustering of entities.

[0184] S720, using the phase-aligned indicator data sequence within the specified time period corresponding to each entity cluster to perform model training, to obtain a detection model corresponding to each entity cluster.

[0185] A detection model can be trained separately for each entity cluster, making each detection model more targeted, thereby ensuring the accuracy of detection.

[0186] S730, selecting a target detection model that matches the entity to be detected from multiple detection models based on distance measurement information between the entity to be detected and the indicator data sequences corresponding to the cluster centers of the multiple entity clusters.

[0187] Specifically, S730 may include S731 to S734.

[0188] S731 to S734 are described below:

[0189] S731 , segmenting the indicator data sequence of the entity to be detected based on the length of the specified time period to obtain multiple sequence segments of the entity to be detected.

[0190] That is, the length of each sequence segment is the same as the length of the specified time period, so that the detected entity can be matched to the entity cluster more accurately.

[0191] S732, phase-aligning the target sequence segment with the indicator data sequence of the reference entity within a specified time period to obtain a phase-aligned target sequence segment.

[0192] The target sequence segment is any sequence segment among the multiple sequence segments.

[0193] Currently, it is necessary to detect a certain sequence segment among multiple sequence segments, so the target sequence segment can be selected and phase-aligned.

[0194] S733, calculating distance measurement information between the target sequence segment and the index data sequences of the cluster centers corresponding to the multiple entity clusters in the specified time period, and obtaining multiple distance measurement information to be detected.

[0195] The distance measurement information may be Euclidean distance.

[0196] S734, using a detection model trained with a target entity cluster corresponding to a minimum distance measurement information to be detected among a plurality of distance measurement information to be detected as a target detection model.

[0197] In this way, the target detection model that best matches the target sequence segment can be selected to detect the target sequence segment.

[0198] S740: Detect a specified data sequence of an entity to be detected based on the target detection model.

[0199] Specifically, the computer can detect the similarity of the target sequence fragment and the shape of the indicator data sequence corresponding to the cluster center of the target entity cluster within a specified time period, and then migrate the model parameters in the target detection model to the newly created model based on the similarity to obtain the model to be detected. Among them, the newly created model is newly created based on the target detection model, and the newly created model and the target detection model belong to the same type of model. Finally, the target sequence fragment is detected based on the model to be detected.

[0200] Optionally, if the similarity is greater than or equal to a preset similarity threshold, all parameters of the model parameters in the target detection model are used as all parameters of the newly created model to obtain the model to be detected.

[0201] Optionally, if the similarity is less than a preset similarity threshold, based on the type of the newly created model, some parameters of the model parameters in the target detection model are used as some parameters of the newly created model to obtain the model to be detected.

[0202] Optionally, when the similarity is less than a preset similarity threshold, if the newly created model is composed of multiple fully connected layers, the parameters of the outer structure in the target detection model are used as the parameters of the outer structure of the newly created model to obtain the model to be detected.

[0203] Optionally, when the similarity is less than a preset similarity threshold, if the newly created model includes a preset type network layer, the parameters of the preset type network layer in the target detection model are used as the parameters of the preset type network layer in the newly created model to obtain the model to be detected.

[0204] Through this method, after finding the target detection model that best matches the target sequence fragment, the computer can use transfer learning to learn the model parameters from the target detection model, and then perform fine-tuning to obtain the most suitable model to be detected for detecting the target sequence fragment. There is no need to re-train the model, thereby reducing the model training cost and detection cost.

[0205] The operating environment required for the detection method in the present application includes a CPU, a graphics processing unit (GPU) and a random access memory (RAM). For example, the following operating environment can be configured: a high-performance server configuration using a 16C32T Intel(R) Xeon(R) Gold5218CPU@2.30GHz, an NVIDIA(R) Tesla(R) V100S, and 192GB RAM.

[0206] In order to illustrate the role of the detection method in this application in reducing detection costs and ensuring detection accuracy, the following is an explanation using relevant data from an experiment.

[0207] In this experiment, two data sets are used to verify the detection effect of the model framework to be detected. Of the two data sets, data set 1 comes from the machine indicators and business indicator data of the cloud service of a network content provider, and data set 2 comes from the wireless base station performance indicator data provided by a network operator. The details of the two data sets are shown in Table 1 below. Half of the entity data of the entire data set is divided into offline data (i.e., the data set used to train the detection model), and the other half of the entities are online data (i.e., the data sets of different entities to be detected).

[0208] Dataset 1 Dataset 2 Entity Class Cloud Server Wireless Base Station Number of entities 400 400 Number of indicators 19 25 Basic model training data length 7 days 14 days Transfer learning training data length 1 day 1 day Test data length 2 days 7 days Abnormal proportion 5.52％ 5.18％

[0209] Table 1

[0210] Among them, the basic model is the detection model.

[0211] The anomaly detection problem can be viewed as a binary classification problem, where the positive class represents anomalies and the negative class represents normal points. In anomaly detection, the anomaly score output by the model can be viewed as the probability or confidence that the sample belongs to the positive class, and the anomaly score is converted into a prediction result of anomalies or normal points according to the set threshold.

[0212] In such cases, F1 score is a commonly used model evaluation metric, especially for unbalanced data sets, because in anomaly detection, there are usually far fewer anomalies than normal points. F1 score comprehensively considers the model's precision (the proportion of samples predicted as anomalies that are actually anomalies) and recall (the proportion of samples that are actually anomalies that are correctly predicted as anomalies), and can more comprehensively evaluate the performance of the model. By optimizing F1 score, the accuracy and robustness of the anomaly detection model can be improved, making it better suited to anomaly detection tasks in practical applications.

[0213] The overall technical effect of the present application can be verified from three perspectives: F1score, training cost, and reduced model training data length. Here, 7 multidimensional KPI anomaly detection models and 3 frameworks or models with similar purposes to the present application were selected for experimental comparison. The 7 multidimensional KPI anomaly detection models are all from international conferences or journals.

[0214] The structure and characteristics of the seven multi-dimensional KPI anomaly detection models can be seen in Table 2.

[0215]

[0216] Table 2

[0217] From Table 2, we can see that these models have proposed advanced solutions for different problems and scenarios. The anomaly detection model framework proposed in this application can be combined with these 7 models respectively, and compared with training these 7 models separately to verify the effect of the framework.

[0218] The above three frameworks or models with similar purposes to the solution of the present application are the OmniCluster model, the Cluster-Training Coupled (CTF) model and the JumpStarter model.

[0219] Among them, OmniCluster is a general clustering method for multi-dimensional KPIs. Its goal is to reduce the training cost of anomaly detection models through clustering.

[0220] CTF: CTF proposes a framework that combines clustering and training coupling, which is applied to the anomaly detection model based on RNN+VAE structure. The framework aims to reduce the cost of large-scale anomaly detection.

[0221] JumpStarter: JumpStarter uses compressed sensing technology and anomaly-resistant sampling strategies to reduce the model's demand for training data length. By performing compressed sensing on the training data, the amount of raw data required for model training can be reduced.

[0222] like Figure 8 The figure shows an abnormality detection effect. Figure 8 In the figure, the F1score (F ′ 1) The performance of training time (s), as well as the performance of F1score and training time of CTF and JumpStarter models.

[0223] from Figure 8 It can be seen that the F1score of this solution combined with the 7 models is greater than the F1score of OmniCluster combined with the 7 models, and the F1score of the 7 models trained separately. Therefore, this application solution ensures the accuracy of the model in anomaly detection.

[0224] Also, see Fig. 9 , Fig. 9 This is a schematic diagram of the F1score performance of various models at different model training times. Fig. 9 In the figure, the dotted line represents the F1score performance of this solution under different model training durations after combining it with the above 7 models, and the solid line represents the F1score performance of the above 7 models under different model training durations after training them separately. It can be seen that the detection results of this application solution when the training data length is relatively small are significantly better than those of the single training model, and the model results basically converge when the training data is less than three days. Therefore, this application solution can significantly reduce the length requirement of the data volume of the training model, reduce the training cost, and thus reduce the cost of the entire detection process.

[0225] Fig.10 FIG. 1 is a block diagram of a detection device according to an embodiment of the present application. Fig.10 As shown, the detection device can be applied to a computer, and the device includes:

[0226] An acquisition unit 1010 is used to acquire the indicator weight information of each entity, where the indicator weight information of the entity is used to characterize the intensity of periodic changes of the indicator of the entity within a specified time period;

[0227] A calculation unit 1020 is used to calculate distance measurement information between indicator data sequences of every two entities within a specified time period based on the indicator weight information of each entity, so as to obtain multiple distance measurement information;

[0228] The processing unit 1030 is used to determine a reference entity from the multiple entities based on the multiple distance measurement information, and based on the indicator weight information of each entity, phase align the indicator data sequence of each entity in a specified time period with the indicator data sequence of the reference entity in a specified time period to obtain a phase-aligned indicator data sequence;

[0229] The training unit 1040 is used to perform model training based on the phase-aligned indicator data sequence, and detect the entity to be detected based on the trained model.

[0230] In one embodiment of the present application, based on the aforementioned scheme, the acquisition unit 1010 is also used to obtain the prediction period of the entity; the calculation unit 1020 is also used to calculate the weight corresponding to each indicator of the indicator data series based on the prediction period; and the weight corresponding to each indicator is used as the indicator weight information of the entity.

[0231] In one embodiment of the present application, based on the aforementioned scheme, the calculation unit 1020 is also used to calculate the data difference information in the indicator data sequence corresponding to the indicator in units of prediction period based on each data point contained in the indicator data sequence corresponding to each indicator and the data point with a prediction period interval from the data point; calculate the indicator weight of the indicator data sequence corresponding to each indicator based on the data difference information, and obtain the indicator weight information of each entity within the specified time period.

[0232] In one embodiment of the present application, based on the aforementioned scheme, an entity corresponds to multiple indicator data sequences for a specified time period, and the multiple indicator data sequences are respectively for different indicators, and the indicator weight information of the entity includes weight information of multiple indicators; the calculation unit 1020 is also used to average the weight information of the indicators corresponding to the multiple entities for each indicator, and obtain the weight average value of each indicator; based on the weight average value of each indicator, the distance measurement information between the indicator data sequences of every two entities in the specified time period is calculated to obtain multiple distance measurement information.

[0233] In one embodiment of the present application, based on the aforementioned scheme, the calculation unit 1020 is also used to calculate, for each entity, the phase offset between the entity and the reference entity based on the weighted average value of each indicator, and the processing unit 1030 is also used to phase-align the indicator data sequence of the entity within a specified time period with the indicator data sequence of the reference entity within a specified time period based on the phase offset to obtain the phase-aligned indicator data sequence.

[0234] In one embodiment of the present application, based on the aforementioned scheme, the acquisition unit 1010 is also used to obtain the predicted phase offset of the indicator in the entity; the calculation unit 1020 is also used to calculate the normalized mutual correlation information between the indicator data series of the entity and the reference entity within a specified time period based on the predicted phase offset and the weighted average value of each indicator; the predicted phase offset when the normalized mutual correlation information between the entity and the reference entity reaches a maximum value is used as the phase offset.

[0235] In one embodiment of the present application, based on the aforementioned scheme, the computing unit 1020 is further used to sum up the distance measurement information between each entity and all other entities to obtain the distance and value of the entity; and select the entity with the smallest distance and value from the distances and values ​​corresponding to multiple entities as the reference entity.

[0236] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is further used to classify the indicator data sequences of multiple entities according to the shape types of the indicator data sequences to obtain multiple entity clusters; the training unit 1040 is further used to perform model training using the phase-aligned indicator data sequences within a specified time period corresponding to each entity cluster to obtain a detection model corresponding to each entity cluster.

[0237] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is also used to select a target detection model that matches the entity to be detected from multiple detection models based on the distance measurement information of the indicator data sequences of the entity to be detected and the cluster centers corresponding to the multiple entity clusters; and detect the specified data sequence of the entity to be detected based on the target detection model.

[0238] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is further used to segment the indicator data sequence of the entity to be detected based on the length of the specified time period to obtain multiple sequence fragments of the entity to be detected; phase align the target sequence fragment with the indicator data sequence of the reference entity within the specified time period to obtain the target sequence fragment after phase alignment; wherein the target sequence fragment is any one of the multiple sequence fragments; the calculation unit 1020 is further used to calculate the distance measurement information between the target sequence fragment and the indicator data sequence of the cluster center corresponding to the multiple entity clusters within the specified time period to obtain multiple distance measurement information to be detected; and use the detection model trained by the target entity cluster corresponding to the minimum distance measurement information to be detected among the multiple distance measurement information to be detected as the target detection model.

[0239] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is also used to detect the similarity of the shape of the indicator data sequence between the target sequence fragment and the cluster center corresponding to the target entity cluster within a specified time period; based on the similarity, the model parameters in the target detection model are migrated to the newly created model to obtain the model to be detected; and the target sequence fragment is detected based on the model to be detected.

[0240] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is also used to, if the similarity is greater than or equal to a preset similarity threshold, use all parameters of the model parameters in the target detection model as all parameters of the newly created model to obtain the model to be detected; if the similarity is less than the preset similarity threshold, use some parameters of the model parameters in the target detection model as some parameters of the newly created model based on the type of the newly created model to obtain the model to be detected.

[0241] In one embodiment of the present application, based on the aforementioned scheme, the processing unit 1030 is also used to, if the newly created model is composed of a plurality of fully connected layers stacked together, use the parameters of the outer structure in the target detection model as the parameters of the outer structure of the newly created model to obtain the model to be detected; if the newly created model includes a preset type network layer, use the parameters of the preset type network layer in the target detection model as the parameters of the preset type network layer in the newly created model to obtain the model to be detected.

[0242] It should be noted that the apparatus provided in the aforementioned embodiment and the method provided in the aforementioned embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment.

[0243] An embodiment of the present application also provides a detection device, including: one or more processors; a memory for storing one or more programs, when the one or more programs are executed by the one or more processors, the electronic device implements the above detection method.

[0244] Fig.11 It is a structural diagram of a computer system suitable for implementing the detection device of the embodiment of the present application.

[0245] It should be noted that Fig.11 The computer system 1100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0246] like Fig.11As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1102 or the program loaded from the storage part 1108 to the random access memory (RAM) 1103, such as executing the method in the above embodiment. In the RAM 1103, various programs and data required for system operation are also stored. The CPU 1101, the ROM 1102 and the RAM 1103 are connected to each other through the bus 1104. The input / output (I / O) interface 1105 is also connected to the bus 1104.

[0247] The following components are connected to the I / O interface 1105: an input section 1106 including a keyboard, a mouse, etc.; an output section 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed so that a computer program read therefrom is installed into the storage section 1108 as needed.

[0248] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1109, and / or installed from a removable medium 1111. When the computer program is executed by a central processing unit (CPU) 1101, various functions defined in the system of the present application are executed.

[0249] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable media may be, for example, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0250] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0251] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0252] Another aspect of the present application further provides a computer readable medium having a computer program stored thereon, which implements the above detection method when executed by a processor. The computer readable medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0253] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable medium. A processor of a computer device reads the computer instruction from the computer-readable medium, and the processor executes the computer instruction, so that the computer device executes the detection method provided in each of the above embodiments.

[0254] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A detection method, characterized in that: include: Obtaining indicator weight information of each entity, where the indicator weight information of the entity is used to characterize the intensity of periodic changes in the indicator of the entity; Based on the indicator weight information of each entity, distance measurement information between the indicator data series of every two entities within a specified time period is calculated to obtain multiple distance measurement information; Determine a reference entity from the multiple entities based on the multiple distance measurement information, and based on the indicator weight information of each entity, phase align the indicator data sequence of each entity in the specified time period with the indicator data sequence of the reference entity in the specified time period to obtain a phase-aligned indicator data sequence; Model training is performed based on the phase-aligned indicator data sequence, and the entity to be detected is detected based on the trained model.

2. The method according to claim 1, characterized in that: The obtaining of indicator weight information of each entity includes: obtaining a forecast period for the entity; Calculate the weight corresponding to each indicator targeted by the indicator data sequence based on the forecast period; The weight corresponding to each indicator is used as the indicator weight information of the entity.

3. The method according to claim 1, characterized in that Before calculating the distance measurement information between the indicator data sequences of every two entities within the specified time period based on the indicator weight information of each entity to obtain a plurality of distance measurement information, the method further includes: For each entity, the complete indicator data sequence of the entity is split to obtain indicator data sequences of multiple time periods; wherein the time period corresponding to the complete indicator data sequence is equal to the sum of the multiple time periods; An indicator data sequence of a time period is selected from the indicator data sequences of the multiple time periods as the indicator data sequence of the specified time period.

4. The method according to claim 3, characterized in that The entity corresponds to a plurality of indicator data sequences in the specified time period, the plurality of indicator data sequences are respectively for different indicators, and the indicator weight information of the entity includes weight information of the plurality of indicators; The distance measurement information between the indicator data sequences of every two entities within the specified time period is calculated based on the indicator weight information of each entity to obtain multiple distance measurement information, including: For each indicator, average weight information of the indicators corresponding to the multiple entities is calculated to obtain a weight average value of each indicator; The distance measurement information between the indicator data series of every two entities within the specified time period is calculated based on the weighted average value of each indicator to obtain the multiple distance measurement information.

5. The method according to claim 4, characterized in that The step of performing phase alignment on the indicator data sequence of each entity in the specified time period and the indicator data sequence of the reference entity in the specified time period based on the indicator weight information of each entity to obtain the phase-aligned indicator data sequence includes: For each entity, the phase offset between the entity and the reference entity is calculated based on the weighted average value of each indicator, and based on the phase offset, the indicator data sequence of the entity within the specified time period is phase-aligned with the indicator data sequence of the reference entity within the specified time period to obtain the phase-aligned indicator data sequence.

6. The method according to claim 5, characterized in that The step of calculating, for each entity, a phase offset between the entity and the reference entity based on a weighted average value of each indicator comprises: obtaining a predicted phase offset of an indicator in the entity; Calculating normalized cross-correlation information between the indicator data series of the entity and the reference entity within the specified time period based on the predicted phase shift and the weighted average of each indicator; The predicted phase offset when the normalized mutual correlation information between the entity and the reference entity reaches a maximum value is used as the phase offset.

7. The method according to claim 1, characterized in that The determining a reference entity from a plurality of entities based on the plurality of distance measurement information comprises: For each entity, summing up the distance measurement information between the entity and all other entities to obtain the distance sum value of the entity; An entity with the smallest distance and value is selected from the distances and values ​​corresponding to the multiple entities as the reference entity.

8. The method according to claim 1, characterized in that The performing model training based on the phase-aligned indicator data sequence includes: Classifying the indicator data sequences of the multiple entities according to the shape types of the indicator data sequences to obtain multiple entity clusters; Model training is performed using the phase-aligned indicator data sequence within the specified time period corresponding to each entity cluster to obtain a detection model corresponding to each entity cluster.

9. The method according to claim 8, characterized in that The detecting of the entity to be detected based on the trained model includes: Based on the distance measurement information between the entity to be detected and the indicator data sequences corresponding to the cluster centers of the multiple entity clusters, selecting a target detection model that matches the entity to be detected from the multiple detection models; The designated data sequence of the entity to be detected is detected based on the target detection model.

10. The method according to claim 9, characterized in that The selecting a target detection model matching the entity to be detected from the multiple detection models based on the distance measurement information of the indicator data sequence of the cluster centers respectively corresponding to the entity to be detected and the multiple entity clusters includes: Segmenting the indicator data sequence of the entity to be detected based on the length of the specified time period to obtain multiple sequence segments of the entity to be detected; Performing phase alignment on the target sequence segment and the indicator data sequence of the reference entity within the specified time period to obtain a phase-aligned target sequence segment; wherein the target sequence segment is any one of the multiple sequence segments; Calculating distance measurement information between the target sequence segment and the index data sequence of the cluster centers corresponding to the multiple entity clusters respectively within the specified time period to obtain multiple distance measurement information to be detected; The detection model trained by the target entity cluster corresponding to the minimum distance measurement information to be detected among the multiple distance measurement information to be detected is used as the target detection model.

11. The method according to claim 10, characterized in that The detecting the indicator data sequence of the entity to be detected based on the target detection model includes: Detecting the similarity of the target sequence segment and the indicator data sequence shape of the cluster center corresponding to the target entity cluster within the specified time period; Migrating the model parameters in the target detection model to the newly created model based on the similarity to obtain a model to be detected; The target sequence fragment is detected based on the model to be detected.

12. A detection device, characterized in that: include: An acquisition unit, used to acquire indicator weight information of each entity, wherein the indicator weight information of the entity is used to characterize the intensity of periodic changes of the indicator of the entity within a specified time period; A calculation unit, configured to calculate distance measurement information between the indicator data sequences of every two entities within the specified time period based on the indicator weight information of each entity, to obtain a plurality of distance measurement information; A processing unit, configured to determine a reference entity from a plurality of entities based on the plurality of distance measurement information, and to phase-align the indicator data sequence of each entity within the specified time period with the indicator data sequence of the reference entity within the specified time period based on the indicator weight information of each entity, so as to obtain a phase-aligned indicator data sequence; The training unit is used to perform model training based on the phase-aligned indicator data sequence, and to detect the entity to be detected based on the trained model.

13. A detection device, characterized in that: include: a memory storing computer-readable instructions; A processor reads the computer-readable instructions stored in the memory to execute the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and when the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the method according to any one of claims 1 to 11.

Images