Abnormal data analysis method and device and abnormal data analysis system

Abstract

The embodiment of the invention discloses an abnormal data analysis method and device and an abnormal data analysis system. A specific embodiment of the analysis method comprises the steps that time series data are input into a pre-created isolated forest model, the node position of each piece of data in the time series data in each binary tree is output, the isolated forest model comprises at least two binary trees, and randomly selected attributes in the at least two binary trees are different; determining a target node position of each data in the time sequence data according to the node position in each binary tree; and determining abnormal data in the time series data based on the target node position of each piece of data. The embodiment is related to a big data analysis technology, a new abnormal data detection method is provided, abnormal point detection is carried out on the time series data by utilizing the isolated forest model, a data model does not need to be defined, and marking training does not need to be carried out. And the accuracy of an analysis result can be ensured while the analysis efficiency is improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the technical field of big data analysis, and in particular to an abnormal data analysis method, device, and abnormal data analysis system. Background Art

[0002] Anomaly detection is usually the identification of items, events, or observations that do not match the expected pattern or other items in the data set. Abnormal items are generally transformed into structural defects, medical problems, text errors, and other types of problems. Anomalies are also generally called outliers, novelties, noise, deviations, or exceptions. In e-commerce platforms, statistical calculations are mainly used to identify anomalies, such as based on year-on-year changes or setting thresholds. For example, sales this month are 5% lower than the same period last year, or the number of cash flow days this month is less than 25 days.

[0003] However, the inventors found that if the year-on-year or month-on-month comparison method is used, sales abnormality will be judged if the sales of a certain category deteriorates year-on-year or month-on-month. This method often ignores an important point: change does not mean abnormality, and lacks scientific standards.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present disclosure propose an abnormal data analysis method, an abnormal data analysis device, an electronic device, an abnormal data analysis system, a computer-readable medium, and a computer program product to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide a method for analyzing abnormal data, including: inputting time series data into a pre-created isolation forest model, and outputting the node position of each data in the time series data in each binary tree, wherein the isolation forest model contains at least two binary trees, and the randomly selected attributes in at least two binary trees are different; determining the target node position of each data in the time series data according to the node position in each binary tree; and determining the abnormal data in the time series data based on the target node position of each data.

[0008] In some embodiments, the method further includes: determining a plurality of indicator parameters related to the abnormal data; analyzing the influence of the plurality of indicator parameters on the abnormal data using attribution theory, and outputting the analysis results.

[0009] In some embodiments, attribution theory is used to analyze the impact of multiple indicator parameters on abnormal data, including at least one of the following: in response to determining that the abnormal data and the multiple indicator parameters are in an additive relationship, for each indicator parameter in the multiple indicator parameters, the difference between the current value of the indicator parameter and the comparison value is determined as a contribution value affecting the abnormal data; or in response to determining that the abnormal data and the multiple indicator parameters are in a multiplicative relationship, for each indicator parameter in the multiple indicator parameters, the natural logarithm of the ratio of the current value of the indicator parameter to the comparison value is determined, and the contribution value of the indicator parameter affecting the abnormal data is determined based on the natural logarithm and the difference between the current value of the abnormal data and the comparison value; based on the contribution values ​​of the multiple indicator parameters, the target indicator parameter that has the greatest impact on the abnormal data is determined.

[0010] In some embodiments, the target node position of each data in the time series data is determined based on the node position in each binary tree, including: for each data in the time series data, the average value of the node position of the data in each binary tree in the isolation forest model is determined as the target node position of the data.

[0011] In some embodiments, based on the target node position of each data, abnormal data in the time series data is determined, including: in order of target node position from low to high, data with a low target node position and less than a position threshold are determined as abnormal data in the time series data.

[0012] In some embodiments, based on the target node position of each data, determining abnormal data in the time series data also includes: determining the abnormality index of each data in the time series data in the time series data, wherein the abnormality index is determined based on the natural logarithm of the analysis data and the number of data in the time series data; determining the abnormal data in the time series data based on the abnormality index and the target node position of each data.

[0013] In some embodiments, the isolation forest model is obtained by the following method: for each binary tree in the isolation forest model, a specified number of sample data are selected from the training data and placed in the root node of the binary tree; from multiple attribute dimensions of the sample data, an attribute dimension different from other binary trees is selected; according to the value range of the sample data in the selected attribute dimension, the partition value of the attribute dimension is determined, the sample data of the current node is divided into two child nodes, and the partition value of the attribute dimension is recorded at the current node until it is divided into a leaf node, or the height of the binary tree reaches a height threshold.

[0014] In some embodiments, an attribute dimension different from other binary trees is selected from multiple attribute dimensions of sample data, including: using the kurtosis coefficient to select at least two candidate attribute dimensions from multiple attribute dimensions of sample data; and selecting an attribute dimension different from other binary trees from at least two candidate attribute dimensions.

[0015] In a second aspect, some embodiments of the present disclosure provide an abnormal data analysis device, comprising: an input unit, configured to input time series data into a pre-created isolation forest model, and output the node position of each data in the time series data in each binary tree, wherein the isolation forest model contains at least two binary trees, and the randomly selected attributes in at least two binary trees are different; a target position determination unit, configured to determine the target node position of each data in the time series data according to the node position in each binary tree; and an abnormal data determination unit, configured to determine the abnormal data in the time series data based on the target node position of each data.

[0016] In some embodiments, the analysis device further includes an attribution analysis unit configured to determine a plurality of indicator parameters related to the abnormal data; analyze the influence of the plurality of indicator parameters on the abnormal data using attribution theory, and output the analysis results.

[0017] In some embodiments, the attribution analysis unit is further configured to, in response to determining that the abnormal data and multiple indicator parameters are in an additive relationship, determine, for each of the multiple indicator parameters, the difference between the current value of the indicator parameter and the comparison value as a contribution value affecting the abnormal data; or, in response to determining that the abnormal data and multiple indicator parameters are in a multiplicative relationship, determine, for each of the multiple indicator parameters, the natural logarithm of the ratio of the current value of the indicator parameter to the comparison value, and determine the contribution value of the indicator parameter affecting the abnormal data based on the natural logarithm and the difference between the current value of the abnormal data and the comparison value; and determine the target indicator parameter that has the greatest impact on the abnormal data based on the contribution values ​​of multiple indicator parameters.

[0018] In some embodiments, the target position determination unit is further configured to determine, for each data in the time series data, an average value of the node positions of the data in each binary tree in the isolation forest model as the target node position of the data.

[0019] In some embodiments, the abnormal data determination unit is further configured to determine data with a low target node position and less than a position threshold as abnormal data in the time series data in order of the target node position from low to high.

[0020] In some embodiments, the abnormal data determination unit is further configured to determine the abnormal index of each data in the time series data, wherein the abnormal index is determined based on the natural logarithm of the analysis data and the number of data in the time series data; and determine the abnormal data in the time series data based on the abnormal index of each data and the target node position.

[0021] In some embodiments, the analysis device also includes a model creation unit, which is configured to select a specified number of sample data from the training data for each binary tree in the isolation forest model, and put them into the root node of the binary tree; select an attribute dimension that is different from other binary trees from multiple attribute dimensions of the sample data; determine the partition value of the attribute dimension based on the value range of the sample data in the selected attribute dimension, divide the sample data of the current node into two child nodes, and record the partition value of the attribute dimension at the current node until it is divided into a leaf node, or the height of the binary tree reaches a height threshold.

[0022] In some embodiments, the model creation unit is further configured to use the kurtosis coefficient to select at least two candidate attribute dimensions from multiple attribute dimensions of the sample data; and to select an attribute dimension that is different from other binary trees from the at least two candidate attribute dimensions.

[0023] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal data analysis method described in any implementation method in the above-mentioned first aspect.

[0024] In a fourth aspect, some embodiments of the present disclosure provide an abnormal data analysis system, comprising: an application server, configured to send target data generated on an application to an analysis server, and to receive analysis results returned by the analysis server, and to store and display the analysis results; an analysis server, configured to analyze the target data in response to receiving the target data sent by the application server using the abnormal data analysis method described in any implementation method of the first aspect above, and to send the analysis results to the application server.

[0025] In a fifth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the abnormal data analysis method described in any implementation manner in the above-mentioned first aspect is implemented.

[0026] In a sixth aspect, some embodiments of the present disclosure provide a computer program product, including a computer program, which, when executed by a processor, implements the abnormal data analysis method described in any implementation manner in the above-mentioned first aspect.

[0027] The above embodiments of the present disclosure have the following beneficial effects: the abnormal data analysis methods of some embodiments of the present disclosure can improve the accuracy and efficiency of the analysis results. Specifically, currently commonly used abnormal point detection algorithms are generally divided into three categories.

[0028] The first category is to deal with abnormal data based on statistical methods. This method generally constructs a probability distribution model and calculates the probability that the object conforms to the model, and regards objects with low probability as abnormal points. For example, the RobustScaler method in feature engineering uses the quantile distribution of data features when scaling data feature values, divides the data into multiple segments according to the quantiles, and only takes the middle segment for scaling. For example, only the data from the 25% quantile to the 75% quantile is scaled. This reduces the impact of abnormal data.

[0029] The second category is to detect outliers based on clustering. This is easy to understand, because most clustering algorithms are based on the distribution of data features. Usually, after clustering, we find that the data sample size of some clusters is much smaller than that of other clusters, and the values ​​of the mean distribution of data features in this cluster are also very different from those in other clusters. The sample points in these clusters are mostly outliers. For example, the BIRCH clustering algorithm principle and the DBSCAN density clustering algorithm can detect outliers while clustering.

[0030] The third category is based on a special outlier detection algorithm. These algorithms are not like clustering algorithms, where outlier detection is just a bonus. Their purpose is to specifically detect outliers. The representative of this type of algorithm is the single-class SVM algorithm.

[0031] On e-commerce platforms, however, anomaly detection is often performed by comparing year-on-year and month-on-month sales. For example, if sales of a certain category deteriorate year-on-year or month-on-month, it will be considered a sales anomaly. However, changes do not necessarily mean anomalies. This method often lacks scientific standards and is not suitable for large-scale promotion and reuse.

[0032] Based on this, the abnormal data analysis method of some embodiments of the present disclosure can use the isolation forest model to analyze abnormal data. Isolation forests usually do not need to define mathematical models, nor do they need to use labeled samples for model training. Instead, a feature is randomly selected from the sample, and a value is randomly selected from the range of all values ​​of this feature to perform a binary partition on the sample. Repeat the partition until there is only one piece of data, or the limited height of the tree is reached. This method is simple and efficient, can be applied to any scenario, and helps to expand the scope of application of the method. Because abnormal data is often closer to the root, and normal data is generally farther from the root. Therefore, the accuracy of the analysis results can be guaranteed. In addition, by analyzing the time series data, the anomalies can be identified in combination with the time series trend characteristics of the data. Thereby reducing the possibility of changes being identified as anomalies and improving the accuracy of the abnormal analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0034] Figure 1 are flow charts of some embodiments of the abnormal data analysis method disclosed herein;

[0035] Figures 2A to 2C is a schematic diagram of program code for implementing the abnormal data analysis method disclosed in the present invention;

[0036] Figure 3 are flow charts of other embodiments of the abnormal data analysis method disclosed herein;

[0037] Figure 4 is a schematic diagram of the results of abnormal sales data analysis using the method disclosed in the present invention;

[0038] Figure 5 is a schematic diagram of the structure of some embodiments of the abnormal data analysis device disclosed in the present invention;

[0039] Figure 6 is a schematic diagram of the architecture of some embodiments of the abnormal data analysis system disclosed in the present invention;

[0040] Figure 7 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0041] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0042] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0043] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0044] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0045] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0046] Figure 1 The process 100 of some embodiments of the abnormal data analysis method according to the present disclosure is shown. The analysis method comprises the following steps:

[0047] Step 101, input the time series data into a pre-created isolation forest model, and output the node position of each data in the time series data in each binary tree.

[0048] In some embodiments, the execution subject of the abnormal data analysis method (such as Figure 6 The analysis server shown in ) can receive or obtain the data to be analyzed through a wired connection or a wireless connection. The data to be analyzed here can be determined according to the actual situation, such as the sales volume of a certain product, or the sales amount of a certain store, etc. It should be noted that the data to be analyzed here usually changes over time. Therefore, anomalies are identified in combination with the time series change trend of the data to be analyzed. These time series data can be obtained as a whole at one time, or in batches or periodically. For example, the e-commerce application platform can send the sales amount generated each day to the execution entity on a regular basis.

[0049] In some embodiments, the execution entity may input the time series data into a pre-created isolation forest (iForest, Isolation Forest) model. Among them, the isolation forest model usually contains at least two binary trees. And the randomly selected attributes between these binary trees in the isolation forest model are different. In this way, through the isolation forest model, the node position of each data in the time series data in each binary tree can be output. The node position here can be the position data of the node to which the data belongs in the binary tree, such as a node identifier such as a node number or a node height (or number of layers), or a node path length, etc.

[0050] It should be noted that iForest is generally a non-parametric and unsupervised method, that is, it does not require the definition of a mathematical model, nor does it require labeled training. iForest uses a very efficient strategy for finding which points are likely to be isolated. Suppose we use a random hyperplane to split the data space, and one cut can generate two subspaces. Then we continue to use a random hyperplane to split each subspace. The cycle continues until there is only one data point in each subspace. Intuitively speaking, we can find that those clusters with high density will stop cutting after being split many times, but those points with low density can easily stop in one subspace very early.

[0051] The iForest algorithm benefits from the idea of ​​random forest. Just as random forest is composed of a large number of decision trees, iForest forest is also composed of a large number of binary trees. The tree in iForest is called isolation tree, or iTree for short, which is a binary tree. iTree is different from decision tree, and its construction process is also simpler than decision tree, which is a completely random process.

[0052] Assuming that the data set has N data, when building an iTree, n samples can be uniformly sampled from the N data as training samples for the tree. Generally, sampling is done without replacement. In the sample, a feature is randomly selected, and a value is randomly selected from the range of all values ​​of this feature (between the minimum and maximum values), and the sample is binary partitioned. The samples with values ​​less than the value are divided to the left of the node, and the samples with values ​​greater than or equal to the value are divided to the right of the node. In this way, a splitting condition and the left and right data sets can be obtained. Then repeat the above process on the left and right data sets respectively until the data set has only one record or reaches the limited height of the tree.

[0053] It is understandable that since abnormal data is usually small and its eigenvalues ​​are very different from normal data, when constructing iTree, abnormal data is usually closer to the root, while normal data is farther from the root. In addition, the results of an iTree are often unreliable. The iForest algorithm can construct multiple binary trees through multiple sampling. Finally, the results of all trees can be integrated to calculate the abnormal branches of the data points.

[0054] In some embodiments, the execution subject can create an isolation forest model by the following method. Specifically, for each binary tree in the isolation forest model, a specified number of sample data can be first selected from the training data and placed in the root node of the binary tree; then, from the multiple attribute dimensions of the sample data, an attribute dimension different from other binary trees is selected; thereafter, according to the value range of the sample data in the selected attribute dimension, the partition value of the attribute dimension can be determined, and the sample data of the current node can be divided into two child nodes, and the partition value of the attribute dimension can be recorded at the current node, that is, the attribute partition record is saved at the current node, so as to facilitate data partitioning in subsequent analysis; repeat the above partitioning process until the leaf node is divided, or the height of the binary tree reaches the height threshold. In other words, for the two child nodes obtained by the division, the value range of the sample data on the child node in the attribute dimension can be determined, so as to determine the partition value of the attribute dimension again, so as to divide the sample data on the child node into two child nodes again.

[0055] As an example, the construction of an isolation forest first requires the construction of an iTree (tree). iTree is a random binary tree, where each node either has two daughters or is a leaf node with no children. Given a bunch of data sets D, where all attributes of D are continuous variables, the construction process of iTree is as follows: 1. Randomly select an attribute Attr; 2. Randomly select a value Value for the attribute; 3. Classify each record according to Attr, put the records with Attr less than Value in the left daughter, and put the records greater than or equal to Value in the right child; 4. Then recursively perform steps 2 and 3, and continue to construct the left daughter and the right daughter until the following conditions are met: the incoming data set has only one record or multiple identical records; or, the height of the tree reaches the limited height. For specific implementation program code, see Figure 2A The limited height (i.e., height threshold) here can be set according to actual conditions.

[0056] It is understandable that the maximum height is set for each iTree because there are relatively few abnormal data records and their path length is relatively low. We only need to distinguish normal records from abnormal records. Therefore, we only need to care about the part below the average height. This can make the analysis of the isolation forest model more efficient. As an example, the maximum height can be determined based on the number of samples in each tree (sub-sampling size), such as log 2 ψ. The number of samples for each tree can be the same or different. In addition, the negative impact of sampling on the performance of the isolation forest model algorithm is usually small. And after experiments, it can be found that when the sampling size exceeds 256, the effect of the isolation forest model is often not improved much. Therefore, while setting the limit height, the sampling size can also be limited. The specific implementation program code can be found in Figure 2B shown.

[0057] After obtaining t iTrees, the iForest training is generally finished. Then we can use the generated iForest to analyze the test data. It should be noted that in order to ensure the accuracy of the prediction results of the isolation forest model, after obtaining each iTree, the test data can be used to test the iTree. Alternatively, the test data can also be used to test the entire isolation forest model.

[0058] Here, the testing process usually involves running the test data on each constructed iTree to see which leaf node the test data is in. It is understandable that the assumption that iTree can effectively detect anomalies is that anomalies are generally very rare and will be quickly divided into leaf nodes in iTree. In this case, the accuracy of the iTree analysis results can be determined based on the anomaly index of the test data. Among them, the anomaly index is usually determined based on the natural logarithm of the current analysis data (i.e., the data input into the iTree) and the amount of data in the time series data (i.e., the data set).

[0059] As an example, for a data set containing n data, the minimum height of the constructed tree is generally log(n) and the maximum height can be n-1. Then the abnormal index of each data is:

[0060]

[0061] c(n)=2H(n-1)-(2(n-1) / n);

[0062]

[0063] Among them, S(x,n) represents the anomaly index of data x in the iTree composed of n data sets, and the value range is [0,1]. Here, the judgment of abnormal situations is generally divided into the following situations: the closer to 1, the higher the possibility of an outlier (abnormal data); the closer to 0, the higher the possibility of a normal value. If S(x,n) of most data is close to 0.5, it can be said that there are no obvious outliers in the entire data set.

[0064] Step 102, determining the target node position of each data in the time series data according to the node position in each binary tree.

[0065] In some embodiments, based on the node position of each data in each binary tree obtained in step 101, the execution entity can determine the target node position of each data in the above time series data. That is to say, combined with the analysis results (node ​​positions) of each binary tree, the final node position of the data can be obtained. As an example, for each data in the time series data, the execution entity can determine the average value of the node position of the data in each binary tree in the isolation forest model, that is, the height average value (PathLength), as the target node position of the data. For the specific implementation program, please refer to Figure 2C shown.

[0066] Optionally, in order to prevent the influence of individual data, extreme values ​​can be removed. That is, the maximum and minimum values ​​in these node positions can be removed. After that, the average value of the remaining node positions is used as the target node position of the data. For another example, for each data in the time series data, the execution body can also determine the weighted average value of these node positions as the target node position of the data. The weight of each binary tree can be set according to its randomly selected attributes.

[0067] Step 103: determine abnormal data in the time series data based on the target node position of each data.

[0068] In some embodiments, based on the target node position of each data, the execution subject can determine the abnormal data in the time series data. Among them, the abnormal data is usually data that is different from most of the data in the time series data. As an example, the execution subject can determine the data with a low target node position and less than a position threshold (such as 3) as abnormal data in the time series data in the order of the target node position from low to high. For example, the execution subject can use the first few with the lowest target node position as candidate node positions. Then it can be determined whether these candidate node positions are less than the position threshold. Thereby, the data corresponding to the candidate node position less than the position threshold, that is, the data close to the root node, is determined as abnormal data.

[0069] In some application scenarios, in order to further improve the accuracy of the analysis results, the execution subject can also determine the abnormal data in combination with the above-mentioned abnormal index. Here, the execution subject can determine the abnormal index of each data in the time series data in the time series data. For details, please refer to the relevant description in step 101, which will not be repeated here. Then, according to the abnormal index and target node position of each data, the abnormal data in the time series data is determined. As an example, the execution subject can determine the data with an abnormal index greater than the index threshold (such as 0.8) and a lower target node position (or less than the position threshold) as abnormal data. Various thresholds in this embodiment can be set according to actual conditions. In other words, the number of abnormal data can be roughly determined by the abnormal index. And then combined with the analysis results of the isolation forest model (i.e., the target node position of each data), the abnormal data can be determined more accurately.

[0070] It can be seen from the above description that the abnormal data analysis method in some embodiments of the present disclosure can use the isolation forest model to analyze abnormal data. Isolation forests usually do not need to define mathematical models, nor do they need to use labeled samples for model training. Instead, a feature is randomly selected from the sample, and a value is randomly selected from the range of all values ​​of this feature to perform a binary partition on the sample. Repeat the partition until there is only one piece of data, or the limited height of the tree is reached. This method is simple and efficient, can be applied to any scenario, and helps to expand the scope of application of the method. Because abnormal data is often closer to the root, and normal data is generally farther from the root. Therefore, the accuracy of the analysis results can be guaranteed. In addition, by analyzing the time series data, the anomaly can be identified in combination with the time series trend characteristics of the data. Thereby reducing the possibility of changes being identified as anomalies and improving the accuracy of the abnormal analysis results.

[0071] In some optional implementations, when processing high-dimensional data, the algorithm can be improved, and not all attributes are used after sampling, that is, some attributes are used to construct an isolation forest model. As an example, a certain number of attributes can be randomly selected from these attributes. For another example, in order to ensure the accuracy of the analysis results, the kurtosis coefficient (Kurtosis) can be used to select at least two candidate attribute dimensions from multiple attribute dimensions of the sample data. Then, from these candidate attribute dimensions, an attribute dimension is selected for each binary tree. Among them, the attribute dimensions of each binary tree are different. Here, Kurtosis is also called the peak coefficient, which generally characterizes the characteristic number of the peak height of the probability density distribution curve at the mean value. In this way, while ensuring the analysis effect of the isolation forest model, the number of binary trees in the model can be reduced, which is conducive to improving the analysis efficiency of the model and reducing the storage space occupied by the model.

[0072] Continue to refer Figure 3, which shows a process 300 of other embodiments of the abnormal data analysis method according to the present disclosure. The analysis method may include the following steps:

[0073] Step 301, input the time series data into a pre-created isolation forest model, and output the node position of each data in the time series data in each binary tree.

[0074] Step 302, determining the target node position of each data in the time series data according to the node position in each binary tree.

[0075] Step 303: determine abnormal data in the time series data based on the target node position of each data.

[0076] In some embodiments, the detailed description of the above steps can be found in Figure 1 In the embodiment, the related descriptions in step 101 to step 103 are not repeated here.

[0077] Step 304, determining multiple indicator parameters related to the abnormal data, using attribution theory, analyzing the impact of the multiple indicator parameters on the abnormal data, and outputting the analysis results.

[0078] In some embodiments, the execution subject of the abnormal data analysis method, when determining the abnormal data in the time series data, can first determine multiple indicator parameters related to the abnormal data. The multiple here is usually at least two. Among them, the relevant indicator parameters can be directly related indicator parameters or indirectly related indicator parameters. For example, for the total sales volume of goods (GMV, Gross Merchandise Volume), it is usually directly related to indicator parameters such as traffic, conversion rate and unit price. The daily sales volume of a product usually directly affects the daily total sales volume of the product, so the daily sales volume can be converted into the daily total sales volume, which is indirectly related to the above-mentioned indicator parameters.

[0079] Next, the execution subject can use the attribution theory (LMDI, Logarithmic Mean Index Method) to analyze the impact of multiple indicator parameters on abnormal data, and can output the analysis results. The output method here is not limited, such as including but not limited to at least one of the following: sending, storing, displaying, etc. In other words, for a certain abnormal data, the data change can be broken down into a specific indicator parameter factor through attribution theory analysis, so as to further locate the main cause.

[0080] As an example, if the indicator is assumed to be: Y=X+Z. At this time, when comparing the indicators Y1 and Y0 of two different periods, the change of the indicator is expressed as: Y1-Y0. Since the change of the indicator is caused by the change of two factors X and Z, the change of the indicator can be further divided into the change of two factors X and Z: Y1-Y0=(X1+Z1)-(X0+Z0)=(X1-X0)+(Z1-Z0). Therefore, the absolute value of the contribution of factor X to the indicator is: X1-X0; the relative value of the contribution is: (X1-X0) / (Y1-Y0). The absolute value of the contribution of factor Z to the indicator is: Z1-Z0; the relative value of the contribution is: (Z1-Z0) / (Y1-Y0). It can be seen from this that if the abnormal data and multiple indicator parameters are in an additive relationship, then for each indicator parameter among the multiple indicator parameters, the difference between the current value of the indicator parameter and the comparison value can be determined as the contribution value affecting the abnormal data.

[0081] For another example, when the indicator Y is in a multiplication relationship with factors X and Z: Y = X*Z. The contribution calculation method of the additive relationship cannot be used directly, so it is necessary to take the logarithm of the indicator and transform it into an additive relationship: ln(Y) = ln(X*Z) = ln(X) + ln(Z).

[0082] Under the additive relationship, the indicator change can be expressed as: ln(Y1)-ln(Y0)=[ln(X1)+ln(Z1)]-[(ln(X0)+ln(Z0)].

[0083] At this point, the absolute value of the contribution of factor ln(X) to index ln(Y) can be obtained as: ln(X1)-ln(X0)=ln(X1 / X0);

[0084] The relative contribution value is:

[0085] [ln(X1)-ln(X0)] / (lnY1-lnY0)=ln(X1 / X0) / (lnY1-lnY0).

[0086] The absolute value of the contribution of ln(Z) to the index ln(Y) is: ln(Z1)-ln(Z0)=ln(Z1 / Z0);

[0087] The relative contribution value is:

[0088] [ln(Z1)-ln(Z0)] / (lnY1-lnY0)=ln(Z1 / Z0) / (lnY1-lnY0).

[0089] After taking the logarithm, in order to convert the result into the contribution of X and Z to indicator Y, the LMDI method uses the relative value of contribution calculated after taking the logarithm, and splits the change of Y indicator according to the relative value of contribution of factors:

[0090] Changes in indicator Y: Y1-Y0

[0091] The contribution of factor X to indicator Y is:

[0092] (Y1-Y0)*ln(X1 / X0) / (lnY1-lnY0)=

[0093] [(Y1-Y0) / (lnY1-lnY0)]*ln(X1 / X0);

[0094] The contribution of factor Z to indicator Y is:

[0095] (Y1-Y0)*ln(Z1 / Z0) / (lnY1-lnY0)=

[0096] [(Y1-Y0) / (lnY1-lnY0)]*ln(Z1 / Z0).

[0097] It can be seen that if the abnormal data and multiple indicator parameters are in a multiplication relationship, then for each of the multiple indicator parameters, the natural logarithm of the ratio of the current value of the indicator parameter to the comparison value can be determined first; then, based on the natural logarithm and the difference between the current value of the abnormal data and the comparison value, the contribution value of the indicator parameter to the abnormal data can be determined. Here, based on the contribution values ​​of multiple indicator parameters, the target indicator parameter that has the greatest impact on the abnormal data can be determined.

[0098] The abnormal data analysis method of some embodiments of the present disclosure further enriches and improves the abnormal data analysis process. Through attribution theory, the index parameters that affect the abnormal data changes can be further analyzed, so that the main influencing factors can be accurately located. This helps managers take effective improvement measures, so that problems can be quickly solved, which is conducive to eliminating or reducing the occurrence of abnormal data.

[0099] In some application scenarios, for e-commerce companies, sales quality is the key to the survival of the enterprise. Therefore, it is particularly important to diagnose whether sales are abnormal (especially abnormally low). Here, anomaly detection algorithms need to be applied to accurately identify anomalies. From the perspective of operators, sales problems are generally viewed from a time series perspective, that is, to look at sales trends over a period of time (such as 30 days) and then observe abnormal sales days.

[0100] As an example, when performing sales anomaly detection, experiments are conducted with the overall category and one-dimensional brand sales time series. The time series selects a 21-day period (such as 2022-03-22—2022-04-11), and the brands include Brand A, Brand B, Brand C, etc. The following table only shows one of them, and the other data styles are the same:

[0101]

[0102]

[0103] After obtaining the above data, the abnormal data analysis method of the disclosed embodiment can be used to detect anomalies in the overall and segmented time series sales data (sale qtty). During the experiment, the abnormal ratio parameter is 0.2, which means that the number of abnormal points in 30 days is 6 (30*0.2). During the detection process, the points with abnormally high sales and abnormally low sales will be marked separately, and the detection results can be shown as follows: Figure 4 As shown in the figure, the horizontal axis is the date and the vertical axis is the sales index data.

[0104] From the detection chart, we can find that the overall diagnosis result for April 11 is that sales are abnormally low, which is a day we need to focus on. At the same time, brands A and D also have this abnormal problem. These are the abnormal detection data pools we screened out in the first step. In the next step of positioning, this data pool will be used as the positioning object.

[0105] In the anomaly detection results of the previous step, we identified the overall sales anomaly and the segmented dimensions with the same anomaly trend. Further, we need to determine which factor has the greatest impact on the corresponding segmented dimensions: traffic, conversion rate, or unit price. Among them, GMV = traffic * conversion rate * unit price.

[0106] Specifically, when calling the LMDI method for attribution, based on the abnormal brands located in the previous step, detailed data can be given in the following format:

[0107]

[0108] As can be seen from the table above, we need to input the current and comparison period values ​​of GMV, traffic, conversion rate, and average order value. The difference between the current and comparison period values ​​is the change value of the indicator. According to the formula, the overall change of GMV is decomposed into the contribution values ​​of the three indicators of traffic, conversion rate, and average order value. The sum of the contribution values ​​is equal to the overall change of GMV, and the contribution values ​​of each indicator are comparable, so the indicator with the greatest contribution can be found.

[0109] In the above application scenarios, pursuing higher sales is an important part of e-commerce companies' profitability, and it is crucial to locate and attribute problems in this link. Scientific abnormal location attribution can help the business accurately identify the reasons for the deterioration of sales. Therefore, establishing a positioning attribution theory with unified standards can quickly identify abnormal sales problems, reduce the energy of business personnel in self-diagnosis, and thus improve operational efficiency. After locating the cause of the sales abnormality, in order to refine the operation needs, corresponding improvement actions need to be given, and the specific execution system is linked to improve indicators, thereby forming a virtuous closed loop. The abnormal data analysis method of the disclosed embodiment can solve the following two technical problems:

[0110] Vertical positioning: As a department manager, you need to be keenly aware of business development at all times. When sales are abnormal, you need to capture the information in a timely manner, and you need to understand which subordinate brand or category caused the sales abnormality. Therefore, we need to accurately identify the department's sales abnormality days, and further refine the department's sales abnormality to dimensions such as brand.

[0111] Horizontal decomposition: For the scope located in the previous step, further decomposition into detailed indicators can achieve refined operations if there is a clear mathematical relationship (such as the multiplication formula: GMV = traffic * conversion rate * unit price).

[0112] Further references Figure 5 , as a response to the above Figure 1 , 3 In order to realize the analysis method shown in the figure, the present disclosure provides some embodiments of an abnormal data analysis device. These analysis device embodiments are similar to Figure 1 , 3 The abnormal data analysis device can be specifically applied to various electronic devices.

[0113] like Figure 5 As shown, some embodiments of the abnormal data analysis device 500 may include: an input unit 501, configured to input the time series data into a pre-created isolation forest model, and output the node position of each data in the time series data in each binary tree, wherein the isolation forest model contains at least two binary trees, and the randomly selected attributes in at least two binary trees are different; a target position determination unit 502, configured to determine the target node position of each data in the time series data according to the node position in each binary tree; an abnormal data determination unit 503, configured to determine the abnormal data in the time series data based on the target node position of each data.

[0114] In some embodiments, the analysis device 500 may also include an attribution analysis unit (not shown in the figure), which is configured to determine multiple indicator parameters related to the abnormal data; use attribution theory to analyze the impact of multiple indicator parameters on the abnormal data, and output the analysis results.

[0115] In some embodiments, the attribution analysis unit can be further configured to, in response to determining that the abnormal data and multiple indicator parameters are in an additive relationship, determine, for each of the multiple indicator parameters, the difference between the current value of the indicator parameter and the comparison value as a contribution value affecting the abnormal data; or, in response to determining that the abnormal data and multiple indicator parameters are in a multiplicative relationship, determine, for each of the multiple indicator parameters, the natural logarithm of the ratio of the current value of the indicator parameter to the comparison value, and determine the contribution value of the indicator parameter affecting the abnormal data based on the natural logarithm and the difference between the current value of the abnormal data and the comparison value; and determine the target indicator parameter that has the greatest impact on the abnormal data based on the contribution values ​​of multiple indicator parameters.

[0116] In some embodiments, the target position determination unit 502 may be further configured to determine, for each data in the time series data, an average value of the node positions of the data in each binary tree in the isolation forest model as the target node position of the data.

[0117] In some embodiments, the abnormal data determination unit 503 may be further configured to determine data with a low target node position and less than a position threshold as abnormal data in the time series data in order of the target node position from low to high.

[0118] In some embodiments, the abnormal data determination unit 503 can be further configured to determine the abnormal index of each data in the time series data in the time series data, wherein the abnormal index is determined based on the natural logarithm of the analysis data and the number of data in the time series data; and determine the abnormal data in the time series data based on the abnormal index of each data and the target node position.

[0119] In some embodiments, the analysis device 500 may also include a model creation unit (not shown in the figure), which is configured to select a specified number of sample data from the training data for each binary tree in the isolation forest model, and put them into the root node of the binary tree; select an attribute dimension different from other binary trees from multiple attribute dimensions of the sample data; determine the partition value of the attribute dimension based on the value range of the sample data in the selected attribute dimension, divide the sample data of the current node into two child nodes, and record the partition value of the attribute dimension at the current node until it is divided into a leaf node, or the height of the binary tree reaches a height threshold.

[0120] In some embodiments, the model creation unit can be further configured to use the kurtosis coefficient to select at least two candidate attribute dimensions from multiple attribute dimensions of the sample data; and select an attribute dimension that is different from other binary trees from the at least two candidate attribute dimensions.

[0121] It is understandable that the units described in the abnormal data analysis device 500 are similar to those described in the reference Figure 1 , 3 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the analysis device 500 and the units contained therein, and will not be described in detail here.

[0122] Some embodiments of the present disclosure also provide an abnormal data analysis system. The abnormal data analysis system may include an application server and an analysis server. Figure 6 As shown, the application server (i.e., the application side) can be a background server that provides support for the application. Users can perform various operations on the application, such as browsing, placing orders, etc. In this way, various data will be generated on the application. The application server can send the target data generated on it to the analysis server (i.e., the algorithm side) for abnormal data detection and analysis. The target data here is also not limited and can be any data that needs abnormal detection.

[0123] Here, when the analysis server receives the target data sent by the application server, it can use the above Figure 1 or Figure 3 In the embodiment, the abnormal data analysis method described in any implementation mode analyzes the target data. And the analysis results can be sent to the application server. At this time, when the application server receives the analysis results returned by the analysis server, it can store and display the analysis results. For example, it can be stored in a database for management personnel to query. At the same time, the application server can display the query data and analysis results through the application terminal.

[0124] The application server and the analysis server can be connected through Figure 6 The general interface design framework shown in the figure realizes the communication connection. Figure 6It can be seen that the linkage between the application side and the algorithm side is: the application side is responsible for the input and output of data; the algorithm side is responsible for the development of the core computing logic. The core computing logic part contains the core algorithm calculation code file, and the other part is the web server code file encapsulated by FLASK. Among them, FLASK is usually a lightweight Web application framework written in Python (a computer programming language). Then, the core algorithm calculation code file can be called by the server code file to realize real-time calculation under the incoming data. Finally, the server is deployed in an online jdos physical container to generate an online instance. The application side performs real-time calculation of data by accessing the instance IP (Internet Protocol, international interconnection protocol).

[0125] From the above description, it can be seen that the abnormal data analysis method of the disclosed embodiment is mainly divided into three major sections: abnormal detection and positioning, display attribution based on LMDI theory, and general interface design and development that integrates abnormal detection and positioning and attribution. Among them, the first step is abnormal detection, corresponding to the e-commerce platform, through which the abnormal sales days of the category as a whole and the subdivided dimensions are screened out; the second step is to use the LMDI theory to decompose the changes in GMV into a specific multiplication factor item based on the golden formula GMV = traffic * conversion rate * unit price, so as to locate the main cause; the third step is based on the mature diagnostic methodology of the first two steps, and encapsulates it into the web server through Flask to form a unified real-time call interface, so as to better enable other similar business needs.

[0126] Reference below Figure 7 , which shows a structural schematic diagram of an electronic device 700 suitable for implementing some embodiments of the present disclosure. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0127] like Figure 7 As shown, the electronic device 700 may include a processing device 701 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the terminal device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0128] Typically, the following devices may be connected to the I / O interface 705: input devices 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 707 including, for example, a speaker, a vibrator, etc.; storage devices 708 including, for example, a disk, a hard disk, etc.; and communication devices 709. The communication devices 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 7 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0129] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0130] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0131] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0132] The computer-readable medium may be included in the electronic device; or it may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: inputs the time series data into a pre-created isolation forest model, and outputs the node position of each data in the time series data in each binary tree, wherein the isolation forest model contains at least two binary trees, and the randomly selected attributes in at least two binary trees are different; determines the target node position of each data in the time series data according to the node position in each binary tree; and determines the abnormal data in the time series data based on the target node position of each data.

[0133] In addition, computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0134] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0135] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a training data input unit, a target position determination unit, and an abnormal data determination unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the input unit may also be described as a "unit for inputting time series data into a pre-created isolation forest model".

[0136] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0137] Some embodiments of the present disclosure further provide a computer program product, including a computer program, which implements any of the above-mentioned abnormal data analysis methods when executed by a processor.

[0138] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for analyzing abnormal data, comprising: Input the time series data into a pre-created isolation forest model, and output the node position of each data in the time series data in each binary tree, wherein the isolation forest model includes at least two binary trees, and the randomly selected attributes in the at least two binary trees are different; Determine the target node position of each data in the time series data according to the node position in each binary tree; Based on the target node position of each data, abnormal data in the time series data is determined.

2. The abnormal data analysis method according to claim 1, wherein: The method further comprises: Determining a plurality of indicator parameters related to the abnormal data; Attribution theory is used to analyze the impact of the multiple indicator parameters on the abnormal data, and the analysis results are output.

3. The abnormal data analysis method according to claim 2, wherein: The analyzing the influence of the multiple indicator parameters on the abnormal data by using attribution theory includes at least one of the following: In response to determining that the abnormal data and the plurality of indicator parameters are in an additive relationship, for each indicator parameter in the plurality of indicator parameters, determining a difference between a current value of the indicator parameter and a comparison value as a contribution value affecting the abnormal data; or In response to determining that the abnormal data and the multiple indicator parameters are in a multiplication relationship, for each indicator parameter of the multiple indicator parameters, determining a natural logarithm of a ratio of a current value of the indicator parameter to a comparison value, and determining a contribution value of the indicator parameter to the abnormal data according to the natural logarithm and a difference between the current value of the abnormal data and the comparison value; According to the contribution values ​​of the multiple indicator parameters, a target indicator parameter that has the greatest impact on the abnormal data is determined.

4. The abnormal data analysis method according to claim 1, wherein: The step of determining the target node position of each data in the time series data according to the node position in each binary tree includes: For each data in the time series data, the average value of the node positions of the data in each binary tree in the isolation forest model is determined as the target node position of the data.

5. The abnormal data analysis method according to claim 1, wherein: The determining of abnormal data in the time series data based on the target node position of each data includes: According to the order of the target node positions from low to high, the data with a low target node position and less than the position threshold is determined as abnormal data in the time series data.

6. The abnormal data analysis method according to claim 1, wherein: The determining of abnormal data in the time series data based on the target node position of each data further includes: Determine an abnormality index of each data in the time series data, wherein the abnormality index is determined according to the natural logarithm of the analysis data and the number of data in the time series data; Abnormal data in the time series data are determined according to the abnormal index of each data and the target node position.

7. The abnormal data analysis method according to any one of claims 1 to 6, wherein: The isolation forest model is obtained by the following method: For each binary tree in the isolation forest model, a specified number of sample data are selected from the training data and placed into the root node of the binary tree; Selecting an attribute dimension different from other binary trees from the multiple attribute dimensions of the sample data; According to the value range of the sample data in the selected attribute dimension, the partition value of the attribute dimension is determined, the sample data of the current node is divided into two child nodes, and the partition value of the attribute dimension is recorded at the current node until it is divided into a leaf node or the height of the binary tree reaches a height threshold.

8. The abnormal data analysis method according to claim 7, wherein: The selecting, from the multiple attribute dimensions of the sample data, an attribute dimension different from other binary trees comprises: Selecting at least two candidate attribute dimensions from the multiple attribute dimensions of the sample data using the kurtosis coefficient; and From the at least two candidate attribute dimensions, an attribute dimension different from other binary trees is selected.

9. An abnormal data analysis device, comprising: An input unit is configured to input time series data into a pre-created isolation forest model, and output a node position of each data in the time series data in each binary tree, wherein the isolation forest model includes at least two binary trees, and the randomly selected attributes in the at least two binary trees are different; a target position determination unit, configured to determine a target node position of each data in the time series data according to the node position in each binary tree; The abnormal data determination unit is configured to determine the abnormal data in the time series data based on the target node position of each data.

10. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal data analysis method as described in any one of claims 1-8.

11. An abnormal data analysis system, comprising: The application server is configured to send the target data generated on the application to the analysis server, receive the analysis result returned by the analysis server, and store and display the analysis result; The analysis server is configured to analyze the target data using the abnormal data analysis method according to any one of claims 1 to 8 in response to receiving the target data sent by the application server, and send the analysis result to the application server.

12. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the abnormal data analysis method as described in any one of claims 1 to 8 is implemented.

13. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the abnormal data analysis method according to any one of claims 1 to 8.

Images