Abnormality detection method and device, computer equipment and storage medium

Abstract

The invention relates to an anomaly detection method. The method comprises the steps of collecting to-be-processed data according to a preset time sequence format; training to-be-processed data by using the weighted moving average model to obtain a time sequence prediction model; acquiring to-be-detected data in a preset time period; inputting the to-be-detected data into the abnormal data prediction model, and determining prediction data of the to-be-detected data; setting an abnormal threshold value of the to-be-detected data according to the prediction data; and determining data exceeding the abnormal threshold in the prediction data in the preset time period as abnormal data. The accuracy and real-time performance of model prediction are improved, and the cost of anomaly detection is reduced.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of data processing, and in particular, to a method, apparatus, computer equipment, and storage medium for anomaly detection. Background Art

[0002] In the fields of economics, finance, meteorology, sales forecasting, etc., when predicting industry cycle trends, it is necessary to monitor some trend indicators in real time and predict their trends based on industry rules, and issue early warnings when the trend exceeds the preset threshold.

[0003] In the prior art, the most commonly used method is to monitor and warn key indicators based on business rules, but there are problems such as high maintenance cost and high false alarm rate of business rule monitoring and alarm. Another method is to use the Autoregressive Integrated Moving Average Model (ARIMA) based on machine learning for data prediction and early warning, but there is a problem of insufficient real-time performance, which leads to an increase in false alarm rate.

[0004] Therefore, based on the above problems, a low-cost method that can improve the real-time, accuracy and efficiency of anomaly detection is urgently needed. Summary of the invention

[0005] The embodiments of the present invention provide a method, apparatus, computer device and storage medium for anomaly detection to solve the problems of high false alarm rate and high prediction cost in current anomaly detection.

[0006] In a first aspect, an embodiment of the present invention provides a method for abnormality detection, the method comprising:

[0007] Collect the data to be processed according to the preset time series format;

[0008] Use the weighted moving average model to train the data to be processed to obtain a time series prediction model;

[0009] Obtain the data to be detected within a preset time period;

[0010] Inputting the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected;

[0011] Setting an abnormal threshold of the data to be detected according to the predicted data;

[0012] The data exceeding the abnormal threshold in the predicted data within the preset time period is determined as abnormal data.

[0013] In a second aspect, an embodiment of the present invention further provides a device for abnormality detection, the device comprising:

[0014] A module for collecting data to be processed, used for collecting data to be processed in a preset time series format;

[0015] The time series prediction model training module is used to train the processed data using the weighted moving average model to obtain the time series prediction model;

[0016] A module for acquiring data to be detected, used to acquire data to be detected within a preset time period;

[0017] A prediction module, used for inputting the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected;

[0018] An abnormality threshold setting module, used to set the abnormality threshold of the data to be detected according to the predicted data;

[0019] The abnormal data determination module is used to determine the data exceeding the abnormal threshold in the predicted data within the preset time period as abnormal data.

[0020] In a third aspect, an embodiment of the present invention further provides a computer device, the computer device comprising:

[0021] one or more processors;

[0022] a memory for storing one or more programs,

[0023] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for abnormality detection as described in any one of the first aspects.

[0024] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for anomaly detection as described in any one of the first aspects is implemented.

[0025] In this embodiment, the data to be processed are collected in a preset time series format; the weighted moving average model is used to train the data to be processed to obtain a time series prediction model; the data to be detected within a preset time period is obtained; the data to be detected is input into the abnormal data prediction model to determine the predicted data of the data to be detected; the abnormal threshold of the data to be detected is set according to the predicted data; and the data exceeding the abnormal threshold in the predicted data within the preset time period is determined as abnormal data. This improves the accuracy and real-time performance of the model prediction and reduces the cost of abnormal detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1A flowchart of a method for abnormality detection provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a diagram showing an example structure of an anomaly detection system provided in Embodiment 1 of the present invention;

[0028] Figure 3 A schematic diagram of the structure of an abnormality detection device provided in Embodiment 2 of the present invention;

[0029] Figure 4 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of an abnormality detection method provided in the first embodiment of the present invention specifically includes the following steps:

[0033] Step 101: Collect data to be processed according to a preset time series format.

[0034] In the embodiment of the present invention, before the anomaly detection model is trained, it is first necessary to collect business system data that can reflect the performance and behavior of the system. Among them, the data can be obtained through various monitoring tools, log files, API interfaces and other methods. In the application scenario of this embodiment, the business data includes but is not limited to the system's CPU usage, memory consumption, disk I / O, network traffic and other indicators. All data must carry a timestamp, which is usually automatically generated by the data source. The accuracy of the timestamp can be seconds, milliseconds or even microseconds as needed, which is not limited by the embodiment of the present invention.

[0035] Specifically, the time series format ensures that the data is arranged in chronological order, each data point has an exact timestamp corresponding to it, and time series data is often used to analyze and predict the performance of the system at different time points to maintain the time order.

[0036] In practical applications, the collected data mainly collects feature data with timestamps and in a certain time sequence, such as extracting information such as hours and days of the week from timestamps for model training. The above collection features are set by relevant technicians according to actual needs, and the embodiments of the present invention are not limited thereto.

[0037] Step 102: Use a weighted moving average model to train the data to be processed to obtain a time series prediction model.

[0038] In an embodiment of the present invention, the step of using a weighted moving average model (SMA) to predict time series involves combining each point in the data set with past data points to predict future data points. During the training process, the number of observations used to calculate the moving average is first determined based on the data to be processed, a weight is assigned to each observation, and the period window and offset of the data are set. The training data is trained using the weighted moving average algorithm based on the above parameters to obtain a time series prediction model.

[0039] Preferably, in another embodiment of the present invention, step 102 may further include:

[0040] Sub-step A1, determining the number of recent data points r, the recent data weight α, the number of data cycles c and the number of points o that deviate from the same cycle to the previous one of the data to be processed.

[0041] Specifically, the important parameters in the weighted moving average model are determined, including the number of recent data points r, that is, the number of observations used to calculate the moving average; the weight of the recent data α, usually the closer the distance to the observation, the higher the weight; the number of data cycles c and the number of deviations before and after the same cycle o, that is, the observation time period window c and the starting point o of the period window.

[0042] Sub-step A2: Based on the training formula of the weighted moving average model SMA t The number of data points r, the weight of the most recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle are trained to obtain a time series prediction model;

[0043] The SMA t for

[0044]

[0045] In the embodiment of the present invention, the above formula is used to perform model training on the data to be processed to determine the optimal weight distribution and parameter settings.

[0046] Specifically, the part on the left of the plus sign is the year-on-year forecast formula, (1-α) is the year-on-year weight, Represents the weighted sum extracted from historical period data, where the weight decreases as time goes by. It represents the data at the same time point (year-on-year) in the past period. The value range is the time points of the previous c periods. 2o and c(c+1) are normalization constants, which control the weighted range and weight distribution respectively. The core logic of the calculation is to combine the historical data of the same time point in the past c periods (for example, the past c days) to perform weighted average and predict the current time point. The part to the right of the plus sign is the month-on-month forecast, and α is the weight of the month-on-month. Represents the data of the most recent r time points. Here, the weighting is based on the time distance. The closer the moment, the greater the weight. r(r+1) is a normalization constant used to adjust the weighted sum. The core logic of the calculation is to combine the data of the most recent r moments for weighted averaging to obtain the predicted value at the current moment.

[0047] Overall understanding of the formula:

[0048] Year-on-year part: prediction is based on data from the same historical time node, using the weighted average of the same time points in multiple periods in the past, emphasizing the changes in the weight of historical data. The farther the time, the lower the weight.

[0049] Month-on-month part: The prediction is based on the most recent observation value before the current moment. The weight is adjusted with the distance in time. The closer the observation data is to the current time, the higher the weight.

[0050] Therefore, the above formula is used to perform weighted time series forecasting based on the historical period data and the latest data of the current event segment.

[0051] Step 103: Obtain the data to be detected within a preset time period.

[0052] In the embodiment of the present invention, the real-time data within a preset time period is collected as the data to be detected according to the same method as in step 101.

[0053] In order to compare year-on-year and quarter-on-quarter with the forecast data, the preset time period usually overlaps with the time period of the forecast data.

[0054] Specifically, year-on-year growth considers the data at the same time point in the historical cycle data and performs weighted averaging to predict the current time point. Month-on-month growth considers the most recent data point and performs weighted averaging to obtain the predicted value at the current moment.

[0055] Step 104: input the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected.

[0056] In the embodiment of the present invention, the data to be detected is calculated using the optimal weight distribution and parameter settings set in the prediction model to obtain the predicted value of the data to be detected in the future.

[0057] Step 105: Setting an abnormal threshold of the data to be detected according to the predicted data.

[0058] In the embodiment of the present invention, an abnormal threshold value of the data within the time period is set according to the specific value of the current predicted data.

[0059] Step 106: Determine the data exceeding the abnormal threshold in the predicted data within the preset time period as abnormal data.

[0060] In the embodiment of the present invention, the value of the predicted data exceeding the abnormal threshold is determined as abnormal data.

[0061] In practical applications, if the data has obvious seasonal characteristics, a seasonal adjustment factor can be introduced. For data with trends, a trend term can be introduced to improve the accuracy of the prediction. It is possible to consider combining the SMA model with other models (such as ARIMA, exponential smoothing, etc.) to form an integrated model to improve the prediction performance. The above can be set and adjusted by relevant technical personnel according to actual needs, and the embodiments of the present invention are not limited to this.

[0062] Among other things, models can be designed to update in real time to incorporate the latest data points.

[0063] Preferably, in another embodiment of the present invention, if the abnormal threshold includes an abnormal upper threshold and an abnormal lower threshold, step 106 may further include:

[0064] Sub-step B1: Determine the predicted data within the preset time period that is greater than the abnormal upper threshold or less than the abnormal lower threshold as abnormal data.

[0065] Specifically, the normal fluctuation range of the moving average is determined by using a formula, and the upper and lower limits of the threshold for abnormal detection are set. By comparing the current predicted data value with the upper and lower thresholds, it is detected whether there is an abnormality. Values ​​greater than the upper limit of the abnormal threshold or less than the lower limit of the threshold are determined as abnormal data.

[0066] Preferably, in another embodiment of the present invention, it also includes:

[0067] Step 107: Calculate the abnormal data using a symmetric mean absolute percentage error statistical method to obtain abnormal statistical data.

[0068] Preferably, in another embodiment of the present invention, step 107 may further include:

[0069] SMAPE=n1t=1∑n(|At|+|Ft|) / 2|Ft-At|×100; Ft is the predicted value of the data to be detected; At is the actual value of the data to be detected.

[0070] Specifically, the formula is called SMAPE (Symmetric Mean Absolute Percentage Error), where |Ft-At| is the absolute difference between the predicted value and the actual value, and |At|+|Ft|) / 2 is the average of the actual value and the predicted value, which is used to standardize the results. The closer the SMAPE value is to 0, the more accurate the prediction result is.

[0071] In practical applications, the preset detection threshold is determined based on a multi-level threshold system constructed based on business needs and statistical analysis. First, the first-level threshold is set by judging the tolerable error range of the business according to business needs, and the second-level threshold is determined by calculating the standard deviation of past data based on statistical methods. The value below the second-level threshold is normal, the value between the second-level threshold and the first-level threshold requires alert, and the value above the first-level threshold requires immediate intervention.

[0072] It can be understood that the preset detection threshold is set by relevant technical personnel in actual applications based on business needs and statistical analysis, and the embodiments of the present invention do not limit its specific methods and specific values.

[0073] Preferably, in another embodiment of the present invention, if the abnormal statistical data exceeds a preset detection threshold, then after the step of collecting the data to be processed in a preset time series format, the step further includes:

[0074] Step 108: Perform noise reduction and missing value filling on the data to be processed.

[0075] In an embodiment of the present invention, if the abnormal statistical data exceeds the preset detection threshold, that is, the statistical abnormal detection data exceeds the tolerable range determined by business needs, that is, above the first-level threshold, then manual intervention is required, including more refined preprocessing of the data to be processed. Among them, noise reduction processing mainly reduces the noise in the data through filtering and other methods to improve the quality of the data for the collected time series data. Missing value filling is mainly for missing data points, and interpolation methods can be used to estimate and fill the missing values, such as using the average of the previous and next data points. It can be understood that the specific algorithm of the above-mentioned preprocessing method is set by relevant technical personnel according to actual applications, and the embodiment of the present invention does not limit this.

[0076] like Figure 2As shown in the figure, it is an example diagram of the structure of the anomaly detection system. First, the advertising server processes the real-time data stream in real time and efficiently through the distributed stream processing platform Kafka, and uses Prometheus, an open source monitoring and alarm tool suitable for collecting and storing time series data, to collect monitoring data. Then, the monitoring platform uses the Druid database that can quickly query a large amount of event data and perform high-performance real-time analysis to achieve access connection with the anomaly detection system. The monitoring platform monitors the performance and status of the system in real time. When the detection system needs to detect the anomaly type and standard, it will send an anomaly detection request to the metadata management module. The anomaly detection model (metadata model) trained by the distributed computing system Spark calculates the anomaly detection results, performs anomaly evaluation, and after determining its severity, feeds it back to the monitoring platform for display, and triggers an alarm when necessary.

[0077] Specifically, all events that occur in the entire system are stored in the event log, providing data support for subsequent analysis and auditing.

[0078] It can be seen that the components in the figure interact with each other through different processes and interfaces, forming a complete anomaly detection system. The anomaly detection results are displayed on the monitoring platform. The interaction of the entire system components achieves real-time and automation, which can timely detect and respond to potential system anomalies and ensure the stability and reliability of the system.

[0079] In this embodiment, the data to be processed is collected in a preset time series format; the weighted moving average model is used to train the data to be processed to obtain a time series prediction model; the data to be detected within a preset time period is obtained; the data to be detected is input into the abnormal data prediction model to determine the predicted data of the data to be detected; the abnormal threshold of the data to be detected is set according to the predicted data; and the data in the predicted data within the preset time period that exceeds the abnormal threshold is determined as abnormal data. This improves the accuracy and real-time performance of the model prediction, reduces the complexity of the model, and reduces the cost of abnormal detection.

[0080] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0081] Embodiment 2

[0082] Figure 3A structural block diagram of an abnormality detection device provided in Embodiment 2 of the present invention may specifically include the following modules:

[0083] The data collection module 201 is used to collect the data to be processed according to a preset time series format;

[0084] A time series prediction model training module 202 is used to train the data to be processed using a weighted moving average model to obtain a time series prediction model;

[0085] The to-be-detected data acquisition module 203 is used to acquire the to-be-detected data within a preset time period;

[0086] Prediction module 204, used for inputting the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected;

[0087] An abnormality threshold setting module 205, used to set the abnormality threshold of the data to be detected according to the predicted data;

[0088] The abnormal data determination module 206 is used to determine the data exceeding the abnormal threshold in the predicted data within the preset time period as abnormal data.

[0089] Preferably, in another embodiment of the present invention, it also includes:

[0090] An abnormal statistical data calculation module is used to calculate the abnormal data using a symmetric mean absolute percentage error statistical method to obtain abnormal statistical data;

[0091] If the abnormal statistical data exceeds the preset detection threshold, the to-be-processed data collection module is further used to:

[0092] The data to be processed is subjected to noise reduction processing and missing value filling.

[0093] Preferably, in another embodiment of the present invention, the time series prediction model training module 202 is further used for:

[0094] Determine the number of recent data points r, the weight of recent data α, the number of data cycles c and the number of points o that deviate from the same cycle to the previous one;

[0095] According to the training formula of the weighted moving average model SMA t The number of data points r, the weight of the most recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle are trained to obtain a time series prediction model;

[0096] The SMA t for

[0097]

[0098] Preferably, in another embodiment of the present invention, if the abnormal threshold includes an abnormal upper threshold and an abnormal lower threshold, the abnormal data determination module 206 is further used to:

[0099] The predicted data within the preset time period that is greater than the abnormal upper limit threshold or less than the abnormal lower limit threshold is determined as abnormal data.

[0100] Preferably, in another embodiment of the present invention, the calculation formula of the symmetric mean absolute percentage error statistical method includes:

[0101] SMAPE=n1t=1∑n(|At|+|Ft|) / 2|Ft-At|×100; Ft is the predicted value of the data to be detected; At is the actual value of the data to be detected.

[0102] The anomaly detection device provided in the embodiment of the present invention can execute the anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0103] Embodiment 3

[0104] Figure 4 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. Figure 4 A block diagram of an exemplary computer device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 4 The computer device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0105] like Figure 4 As shown, the computer device 12 is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0106] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0107] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0108] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0109] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0110] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the computer device 12, and / or may communicate with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the computer device 12 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the computer device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 12, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0111] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the anomaly detection method provided by the embodiment of the present invention.

[0112] Embodiment 4

[0113] Embodiment 4 of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned anomaly detection method are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0114] Among them, computer-readable storage media may include, for example, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or device.

[0115] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for anomaly detection, characterized in that: The method comprises: Collect the data to be processed according to the preset time series format; Use the weighted moving average model to train the data to be processed to obtain a time series prediction model; Obtain the data to be detected within a preset time period; Inputting the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected; Setting an abnormal threshold of the data to be detected according to the predicted data; The data exceeding the abnormal threshold in the predicted data within the preset time period is determined as abnormal data.

2. The method according to claim 1, characterized in that Also includes: The abnormal data are calculated using a symmetric mean absolute percentage error statistical method to obtain abnormal statistical data; If the abnormal statistical data exceeds the preset detection threshold, after the step of collecting the data to be processed according to the preset time series format, the step further includes: The data to be processed is subjected to noise reduction processing and missing value filling.

3. The method according to claim 1, characterized in that The step of using a weighted moving average model to train the data to be processed to obtain a time series prediction model includes: Determine the number of recent data points r, the weight of the recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle before and after the data to be processed; According to the training formula of the weighted moving average model SMA t The number of data points r, the weight of the most recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle are trained to obtain a time series prediction model; The SMA t for 4. The method according to claim 1, characterized in that If the abnormal threshold includes an abnormal upper threshold and an abnormal lower threshold, the step of determining the data exceeding the abnormal threshold in the predicted data within the preset time period as abnormal data includes: The predicted data within the preset time period that is greater than the abnormal upper threshold or less than the abnormal lower threshold is determined as abnormal data.

5. According to the method of claim 2, the calculation formula of the symmetric mean absolute percentage error statistical method includes: SMAPE=n1t=1∑n(|At|+|Ft|) / 2|Ft-At|×100; Ft is the predicted value of the data to be detected; At is the actual value of the data to be detected.

6. An abnormality detection device, characterized in that: The device comprises: A module for collecting data to be processed, used for collecting data to be processed in a preset time series format; The time series prediction model training module is used to train the processed data using the weighted moving average model to obtain the time series prediction model; A module for acquiring data to be detected, used to acquire data to be detected within a preset time period; A prediction module, used for inputting the data to be detected into the abnormal data prediction model to determine the predicted data of the data to be detected; An abnormality threshold setting module, used to set the abnormality threshold of the data to be detected according to the predicted data; The abnormal data determination module is used to determine the data exceeding the abnormal threshold in the predicted data within the preset time period as abnormal data.

7. The device according to claim 6, characterized in that Also includes: An abnormal statistical data calculation module is used to calculate the abnormal data using a symmetric mean absolute percentage error statistical method to obtain abnormal statistical data; If the abnormal statistical data exceeds the preset detection threshold, the to-be-processed data collection module is further used to: The data to be processed is subjected to noise reduction processing and missing value filling.

8. The device according to claim 7, characterized in that The time series prediction model training module is also used for: Determine the number of recent data points r, the weight of the recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle before and after the data to be processed; According to the training formula of the weighted moving average model SMA t The number of data points r, the weight of the most recent data α, the number of data cycles c, and the number of points o that deviate from the same cycle are trained to obtain a time series prediction model; The SMA t for 9. A computer device, characterized in that: The computer device comprises: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method for abnormality detection as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for abnormality detection according to any one of claims 1 to 5 is implemented.

Images