Equipment anomaly detection method and device, computer equipment and storage medium

Abstract

The invention relates to an equipment anomaly detection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring historical traffic data of to-be-tested equipment, and extracting traffic feature data of the to-be-tested equipment based on the historical traffic data; determining a dynamic flow model according to the flow characteristic data; wherein the dynamic flow model comprises a plurality of flow modes, and each flow mode corresponds to one test model; according to the dynamic flow model, dynamically adjusting a test model corresponding to the flow data of the to-be-tested equipment in the test time period; and testing the traffic data of the to-be-tested device in the test time period according to the plurality of test models to obtain an abnormal test report of the to-be-tested device. By adopting the method, the equipment in a complex operation scene can be accurately detected, and the equipment anomaly detection accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a device anomaly detection method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of smart homes, smart devices have gradually been integrated into modern family life. These devices include smart bulbs, thermostats, security cameras, and smart speakers. With their ability to interconnect, they have greatly improved the quality of life and convenience of users. However, these devices are easily affected by complex environments and diverse usage scenarios during operation, and performance monitoring and anomaly detection have become key links in ensuring their reliability and security. If abnormal problems cannot be discovered and handled in a timely manner, it may not only cause damage to the equipment, but also have a negative impact on the safety and experience of users. Therefore, the development of accurate and efficient anomaly detection methods has become an important research direction in smart home device management.

[0003] In traditional technologies, most anomaly detection of smart home devices relies on traditional monitoring methods, such as static threshold detection or anomaly detection methods based on predefined rules. These anomaly detection methods usually determine whether the device is operating normally by setting parameter thresholds. In addition, such methods usually monitor and diagnose device behavior based on a predefined rule base.

[0004] However, traditional anomaly detection methods have obvious limitations when facing complex operating scenarios of smart home devices. Since static threshold detection or predefined rule anomaly detection methods determine whether the device is operating normally by setting fixed performance parameter thresholds, in actual operation, traditional anomaly detection methods are difficult to adapt to complex operating scenarios. In other words, when facing complex load scenarios, traditional anomaly detection methods cannot accurately detect devices, which in turn affects the accuracy of device anomaly detection. Summary of the invention

[0005] Based on this, it is necessary to provide a device anomaly detection method, device, computer equipment, computer-readable storage medium and computer program product that can accurately detect devices in complex operating scenarios and improve the accuracy of device anomaly detection in response to the above technical problems.

[0006] In a first aspect, the present application provides a device anomaly detection method, comprising:

[0007] Obtaining historical flow data of the device under test, and extracting flow characteristic data of the device under test based on the historical flow data;

[0008] Determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each traffic pattern corresponds to a test model;

[0009] According to the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period;

[0010] The flow data of the device under test within the test period is tested according to multiple test models to obtain an abnormal test report of the device under test.

[0011] In one embodiment, the method further comprises:

[0012] Extracting preliminary characteristic parameters of the device under test based on historical traffic data, and extracting traffic characteristic data of the device under test based on the preliminary characteristic parameters;

[0013] Perform data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period;

[0014] A dynamic traffic model is determined according to multiple traffic patterns and time series models of the device under test within a test period.

[0015] In one embodiment, the flow data of the device under test is tested during the test period according to multiple test models to obtain an abnormal test report of the device under test, including:

[0016] Testing the flow data of the device under test in the test period according to the multiple test models to obtain the first test index of the device under test corresponding to each test model;

[0017] Determine the weight factors corresponding to each first test index by using the hierarchical analysis method;

[0018] Each first test index and the weight factor corresponding to each first test index are processed by operation to obtain a second test index of the device under test.

[0019] In one embodiment, the method further comprises:

[0020] Comparing the second test index of the device under test with a plurality of preset thresholds to determine a comparison result;

[0021] Based on the comparison results, determine the abnormal test report of the device under test.

[0022] In one embodiment, dynamically adjusting the test model corresponding to the flow data of the device under test during the test period according to the dynamic flow model includes:

[0023] According to the dynamic traffic model and the preset data change range, multiple target time periods of the device under test are determined, and the test models corresponding to the multiple target time periods are determined;

[0024] According to the test models corresponding to the multiple target time periods, the test model corresponding to the flow data of the device under test within the test period is dynamically adjusted.

[0025] In one embodiment, the method further comprises:

[0026] Obtain the response time of the device under test to traffic changes in each traffic mode during the test period, and draw a delay change curve of the device under test;

[0027] Collecting throughput data of the device under test during the test period, and drawing a throughput change curve of the device under test based on the throughput data;

[0028] Obtain the memory usage data corresponding to each traffic mode of the device under test during the test period, and draw a memory usage change curve of the device under test;

[0029] The resource management capability of the device under test is tested based on the delay change curve, throughput change curve and memory usage change curve of the device under test.

[0030] In a second aspect, the present application also provides a device for detecting anomalies of a device, comprising:

[0031] An extraction module is used to obtain historical flow data of the device under test, and extract flow characteristic data of the device under test based on the historical flow data;

[0032] A determination module, used to determine a dynamic traffic model according to traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each traffic pattern corresponding to a test model;

[0033] An adjustment module, used to dynamically adjust the test model corresponding to the flow data of the device under test during the test period according to the dynamic flow model;

[0034] The detection module is used to test the flow data of the device under test within the test period according to multiple test models to obtain an abnormal test report of the device under test.

[0035] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] Obtaining historical flow data of the device under test, and extracting flow characteristic data of the device under test based on the historical flow data;

[0037] Determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each traffic pattern corresponds to a test model;

[0038] According to the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period;

[0039] The flow data of the device under test within the test period is tested according to multiple test models to obtain an abnormal test report of the device under test.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0041] Obtaining historical flow data of the device under test, and extracting flow characteristic data of the device under test based on the historical flow data;

[0042] Determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each traffic pattern corresponds to a test model;

[0043] According to the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period;

[0044] The flow data of the device under test within the test period is tested according to multiple test models to obtain an abnormal test report of the device under test.

[0045] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0046] Obtaining historical flow data of the device under test, and extracting flow characteristic data of the device under test based on the historical flow data;

[0047] Determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each traffic pattern corresponds to a test model;

[0048] According to the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period;

[0049] The flow data of the device under test within the test period is tested according to multiple test models to obtain an abnormal test report of the device under test.

[0050] The above-mentioned device anomaly detection method, apparatus, computer equipment, storage medium and computer program product obtain the historical flow data of the device under test, and extract the flow characteristic data of the device under test based on the historical flow data; determine the dynamic flow model according to the flow characteristic data; wherein the dynamic flow model includes multiple flow modes, each flow mode corresponds to a test model; according to the dynamic flow model, dynamically adjust the test model corresponding to the flow data of the device under test during the test period; test the flow data of the device under test during the test period according to multiple test models, and obtain an abnormal test report of the device under test. This method can accurately detect devices in complex operating scenarios and improve the accuracy of device anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] FIG1 is a diagram of an application environment of a device anomaly detection method in one embodiment;

[0053] FIG2 is a schematic diagram of a process flow of a device abnormality detection method in one embodiment;

[0054] FIG3 is a schematic diagram of a process for obtaining an abnormal test report of a device under test in one embodiment;

[0055] FIG4 is a structural block diagram of a device abnormality detection device in one embodiment;

[0056] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] The device anomaly detection method provided in the embodiment of the present application can be applied in the application environment shown in FIG. 1. The terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 sends a device anomaly detection request to the server 104, and the server 104 receives the device anomaly detection request, obtains the historical flow data of the device to be tested, and extracts the flow characteristic data of the device to be tested based on the historical flow data; determines the dynamic flow model according to the flow characteristic data; wherein the dynamic flow model includes multiple flow modes, each flow mode corresponds to a test model; according to the dynamic flow model, dynamically adjusts the test model corresponding to the flow data of the device to be tested during the test period; according to the multiple test models, the flow data of the device to be tested during the test period is tested to obtain an abnormal test report of the device to be tested. The terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0059] Traditional anomaly detection methods that use static threshold detection or predefined rules usually set fixed thresholds to determine whether the device is operating normally, but these thresholds may not be adapted to the actual performance changes of the device in different environments or usage scenarios; for example, the working performance of a device in a high temperature environment may be very different from that in a low temperature environment, and the static threshold cannot be flexibly adjusted, resulting in false alarms or missed alarms. Traditional anomaly detection methods often ignore the in-depth analysis of historical data of the device, and thus fail to use big data and machine learning technologies to identify potential problems with device performance; moreover, traditional anomaly detection methods are often difficult to adapt to complex operating scenarios, and thus fail to effectively detect the root cause of device failures. This application proposes a device anomaly detection method that can monitor the performance of smart home devices in real time and build a dynamic traffic model. The device to be tested is tested in different modes, and then the dynamic characteristics of the behavior of the device to be tested in different modes are analyzed, the traffic test index of the device to be tested is evaluated, and abnormal states are quickly identified and marked, thereby achieving more intelligent management.

[0060] In an exemplary embodiment, as shown in FIG2 , a device anomaly detection method is provided, which is described by taking the method applied to the server in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0061] Step 202: Acquire historical flow data of the device under test, and extract flow characteristic data of the device under test based on the historical flow data.

[0062] The device under test refers to the device that needs to be detected for anomalies. Optionally, the device can be a smart home device and other types of intelligent or automated devices, such as smart wearable devices, smart phones, etc. Historical traffic data refers to the recorded data related to the traffic of the device under test over a period of time. Historical traffic data may include network traffic data (including data transmission volume, data packet size, etc.), device status data, device response data, etc. Traffic characteristic data is a key indicator to describe the characteristics of network traffic. It can be used to build a dynamic traffic model to accurately simulate the traffic behavior of the device under test. Traffic characteristic data may include data such as average traffic intensity, peak traffic time, protocol distribution, and traffic volatility.

[0063] Exemplarily, historical traffic data of the device under test in the past period of time is obtained. The historical traffic data may include the upload and download traffic of the device under test under different operating modes and load conditions, the frequency of request responses, network latency, and the resource usage of the device (such as memory usage). An artificial intelligence (AI) algorithm is used to conduct an in-depth analysis of the historical traffic data. Optionally, the AI ​​algorithm can extract key traffic feature data from a large amount of historical traffic data, such as average traffic intensity, peak traffic time, protocol distribution, traffic volatility, and other data. These traffic feature data can provide basic data for further anomaly detection, and at the same time, the performance of the device under test under different load conditions can be evaluated based on the traffic feature data.

[0064] Step 204, determining a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, and each traffic pattern corresponds to a test model.

[0065] The dynamic traffic model is a mathematical model used to simulate and predict changes in network traffic. It can reflect the traffic patterns of the device under test in different time periods and load conditions, and can be used to test and evaluate the performance of the device under different load conditions.

[0066] Optionally, based on the traffic characteristic data, an in-depth analysis is performed on the device under test, and key traffic patterns and rules are extracted from the traffic characteristic data to construct a dynamic traffic model. The dynamic traffic model can be dynamically adjusted according to the different behavioral characteristics of the device under test to adapt to the performance of the device under test under different operating conditions. The dynamic traffic model may include multiple sub-modes, each of which corresponds to a specific traffic pattern. The traffic patterns may include linear growth patterns, periodic fluctuation patterns, burst traffic patterns, etc. Each traffic pattern represents the typical traffic behavior of the device under test under specific environmental or load conditions, and changes in each traffic pattern will also affect the performance indicators of the device under test, such as response speed, throughput, and stability.

[0067] Step 206: dynamically adjust the test model corresponding to the flow data of the device under test during the test period according to the dynamic flow model.

[0068] The test period is a specific time interval pre-set during the anomaly detection process, during which the flow data of the device under test is tested and analyzed; this period can be pre-defined or automatically adjusted according to the behavior of the device under test and flow changes.

[0069] Optionally, according to the dynamic traffic model, in the process of abnormal detection of the traffic data of the device under test during the test period, the test model is dynamically adjusted to ensure that the test model matches the actual operating status of the device under test, that is, according to the different traffic characteristics of the device under test, the corresponding test model is determined, and the test model can be flexibly selected or switched according to the traffic data of the device under test during the test period to ensure that the load and response of the device under test are consistent with the traffic pattern during the device anomaly detection process. For example, when the device under test exhibits abnormally high traffic fluctuations within a certain period of time, the test model can be switched to a more stringent test model. In this way, the test model can more accurately reflect the performance of the device under test in various actual environments, thereby improving the reliability and effectiveness of device anomaly detection.

[0070] Step 208: Test the flow data of the device under test within the test period according to multiple test models to obtain an abnormal test report of the device under test.

[0071] Exemplarily, according to multiple test models, a comprehensive test is performed on the flow data of the device under test during the test period to evaluate the performance of the device under test under different flow modes. In the process of abnormal detection of the device under test, the corresponding flow mode is matched according to the characteristics of the flow data during the test period. Optionally, the flow data of the device under test during the test period can match multiple flow modes. Then, the corresponding test model is determined according to the multiple flow modes matched by the device under test during the test period, and an abnormal test report of the device under test is generated according to the test results of different test models. Among them, the test results of different test models can be test indexes.

[0072] In the above-mentioned device anomaly detection method, the historical flow data of the device under test is obtained, and the flow characteristic data of the device under test is extracted based on the historical flow data to provide basic data for further anomaly detection; the dynamic flow model is determined according to the flow characteristic data; wherein the dynamic flow model includes multiple flow modes, and each flow mode corresponds to a test model; according to the dynamic flow model, the test model corresponding to the flow data of the device under test during the test period is dynamically adjusted, and the test model can be flexibly selected or switched for different environments and usage scenarios to adapt to the changes in the performance of the device under test, ensuring that the operation of the device under test can be effectively monitored under various conditions; the flow data of the device under test during the test period is tested according to multiple test models to obtain an abnormal test report of the device under test, and the corresponding test model can be determined according to the multiple flow modes matched by the device under test during the test period, so that the test model can more accurately reflect the performance of the device under test in various actual environments, thereby improving the reliability and effectiveness of device anomaly detection. This application quickly identifies abnormal situations through real-time data processing and analysis, and can accurately detect devices in complex operating scenarios and improve the accuracy of device anomaly detection.

[0073] In an exemplary embodiment, the method also includes: extracting preliminary characteristic parameters of the device under test based on historical traffic data, and extracting traffic characteristic data of the device under test based on the preliminary characteristic parameters; performing data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test within the test period; and determining a dynamic traffic model based on the multiple traffic patterns of the device under test within the test period and a time series model.

[0074] Among them, cluster analysis is used for data analysis. Historical traffic data is collected through network traffic monitoring tools, and statistical analysis methods are performed on the historical traffic data to extract preliminary characteristic parameters of historical traffic. Among them, preliminary characteristic parameters include average traffic intensity, peak traffic time, protocol distribution and traffic volatility. Based on the preliminary characteristic parameters, traffic characteristic data is extracted through AI algorithms. The traffic characteristic data includes complex timing dependencies, protocol usage patterns and dynamic traffic change trends. The traffic characteristic data is used as the input feature of cluster analysis. Cluster analysis is used to identify different traffic patterns of the device under test during the test period, and the traffic characteristic data is divided into different pattern types, including linear growth patterns, burst traffic patterns and periodic fluctuation patterns. Combined with the time series model, a dynamic traffic model is constructed.

[0075] Among them, the linear growth mode is a load test mode that simulates the linear growth of network traffic. It assumes that the traffic increases evenly over time. It is used to evaluate the performance of the device under a continuously increasing load and test the response and performance of the device under gradual load changes. The periodic fluctuation mode is a load test mode that simulates the periodic changes of network traffic. It describes the traffic changes through sinusoidal functions or other periodic functions, evaluates the performance of the device under periodic loads, and tests the stability and performance of the device under common periodic load fluctuations (such as daily peak loads). The burst traffic mode is a load test mode that simulates a sudden surge in traffic and then a rapid drop. It tests the ability of the device under test to withstand high loads in a short period of time by setting the intensity and time of the burst traffic, and evaluates the response speed and stability of the device under sudden high load conditions.

[0076] Exemplarily, network traffic monitoring tools including Wireshark (network traffic analysis protocol) and NetFlow (network traffic analysis protocol) are used to record historical traffic data in the network. These tools can capture and record information of network data packets, including timestamps, source IP (Internet Protocol), destination IP, port number, and protocol type, providing the original data basis for subsequent data analysis and model building. The key characteristic parameters of historical traffic data are extracted by statistical analysis methods to obtain preliminary characteristic parameters. The preliminary characteristic parameters include average traffic intensity, peak traffic time, protocol distribution, and traffic volatility. Among them, the average traffic intensity is used to calculate the average value of traffic over a period of time to understand the basic load level of the network. The peak traffic time is used to determine the time point when the traffic reaches the peak value, which is used to identify the peak traffic period. Protocol distribution is used to analyze the traffic ratio of various protocols in the network, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and HTTP (HyperText TransferProtocol), to understand the distribution of network applications. The traffic volatility is used to calculate the amplitude of traffic changes over time to evaluate the stability and volatility of the network.

[0077] Statistical tools including Python (programming language) Pandas (Python data analysis library) and R (programming language) are used to process and analyze the collected data and extract these key characteristic parameters. A quantitative description of network traffic behavior is obtained to provide preliminary feature input for model construction. Based on the preliminary features, the AI ​​algorithm further explores complex traffic characteristic parameters. Complex time series dependency refers to the changing pattern of traffic data in the time series. It reflects the long-term and short-term trend changes of traffic over time, as well as the periodic fluctuation characteristics. Identification method: The long-term trend and short-term fluctuation of traffic can be captured through the time series analysis (LSTM, Long Short-Term Memory) model. LSTM can remember the historical information of past time steps and then predict future traffic changes. This time series dependency can help distinguish different traffic patterns, such as linear growth patterns, burst traffic patterns (short-term surges) or periodic fluctuations (regular peaks and troughs). Protocol usage patterns refer to the usage and distribution of different protocols (such as TCP, UDP, HTTP, HTTPS, etc.) in the network. By analyzing the changes in the frequency of use of each protocol in different time periods, abnormal or typical traffic patterns can be identified. The dynamic change trend of traffic refers to the overall change characteristics of traffic over time, which manifests as trends such as stability, increase, fluctuation or sudden drop.

[0078] In addition, the Support Vector Regression (SVR) regression algorithm is used to analyze the trends in historical traffic data and predict future traffic changes. In a stable state, traffic data fluctuates slightly, while an upward or downward trend reflects an increase in the load of the device under test or an abnormal interruption. Fluctuating trends may indicate that the device under test is interfered by the external environment or other systems. These trend analyses help distinguish whether the device under test is in a normal working state or an abnormal state.

[0079] Cluster analysis is an unsupervised learning algorithm that can classify data points into different categories based on traffic feature parameters to form traffic patterns. Specifically, complex time series dependencies, protocol usage patterns, and traffic dynamic change trends extracted by AI algorithms are used as input features for cluster analysis. Complex time series dependencies are used to distinguish long-term and short-term trends from periodic fluctuations, protocol usage patterns distinguish traffic behaviors of different protocols in the network, and traffic dynamic change trends reflect the stability, volatility, or abnormality of traffic. Use K-means (clustering algorithm) to classify traffic feature parameters. K-means divides traffic data into different pattern categories by minimizing the distance between data points and their cluster centers. Through clustering results, linear growth patterns, burst traffic patterns, and periodic fluctuation patterns can be identified. In the linear growth pattern, traffic increases linearly over time, indicating that the device load is gradually increasing. In the burst traffic pattern, a surge in traffic occurs in a short period of time, which may indicate a network attack or other abnormal behavior. In the periodic fluctuation pattern, traffic fluctuates within a fixed time interval, which is usually related to daily usage peaks or regular device operations.

[0080] Combine the time series model with multiple traffic patterns to build a dynamic traffic model. Optionally, use time series analysis technology to model each traffic pattern and generate a dynamic model that can predict future traffic trends. The dynamic traffic model simulates network traffic changes under different time and load conditions to provide accurate traffic input for the performance test of the device under test.

[0081] In this embodiment, by statistically analyzing the historical traffic data and extracting preliminary characteristic parameters, a clear description of the traffic pattern of the device under test can be provided. Traffic characteristic data is further extracted from the preliminary characteristic parameters based on the AI ​​algorithm, and these traffic characteristic data are classified into different traffic patterns through cluster analysis, so as to quickly distinguish and understand the performance of the device under test in a variety of traffic scenarios, thereby improving the accuracy of abnormal detection of the device under test. According to the multiple traffic patterns and time series models of the device under test during the test period, a dynamic traffic model is constructed, so that the dynamic traffic model can adapt to the traffic characteristics of different devices under test and environments, thereby improving the accuracy and flexibility of abnormal detection.

[0082] In the previous exemplary embodiment, the traffic data of the device under test is analyzed by an AI algorithm, and complex timing dependencies, protocol usage patterns and dynamic traffic change trends are extracted from the traffic data; based on the complex timing dependencies, protocol usage patterns and dynamic traffic change trends, abnormal traffic and the status of the device under test are identified.

[0083] Exemplary AI algorithms include long short-term memory network (LSTM), wavelet transform, convolutional neural network (CNN), sliding window technology, support vector regression (SVR), and K-means clustering algorithm. The key role of AI-driven is reflected in the automatic analysis of complex relationships and identification of patterns, including: complex time series dependencies, through AI time series analysis, identify the temporal changes in traffic data, including long-term trends and short-term fluctuations, which can help predict future traffic behavior; abnormal behavior patterns, AI algorithms can automatically detect abnormal patterns in historical traffic data and discover potential abnormal traffic behaviors, such as sudden traffic surges or unauthorized traffic activities; protocol usage patterns, AI not only analyzes the distribution of protocols, but also identifies changes in protocol usage under different time periods or loads, and discovers abnormal behaviors at the protocol level; dynamic traffic change trends, AI identifies changes in overall trends through dynamic analysis of traffic data, such as traffic fluctuation patterns, growth or decrease trends in different time periods; complex time series dependency extraction, captures long-term trends, periodic fluctuations and short-term anomalies in traffic data, and complex time series dependencies mainly reflect the dynamic relationship of traffic changes over time.

[0084] Through the long short-term memory network (LSTM), LSTM is suitable for processing long-term dependencies. It can remember long-term historical information and predict future traffic changes; analyze whether there is a long-term upward or downward trend in the traffic data. For example, identifying that the gradual increase in traffic in certain time periods may represent that the device under test is gradually entering a high-load state; capture the periodic fluctuations of traffic (such as daily traffic peaks and troughs), and identify the periodic frequency through wavelet transform; use LSTM to predict the traffic value at the next moment, and analyze the deviation between the predicted value and the actual value to identify short-term abnormal fluctuations.

[0085] Protocol usage pattern extraction, identifying the types of protocols used by the device under test and their changes in different time periods, and analyzing whether the usage patterns of different protocols are normal. The protocols in the network packets are classified through deep learning models (such as convolutional neural networks (CNN)). The protocol header information (such as IP header, TCP header, etc.) in the traffic data can be used as input features. CNN is used to extract specific protocol patterns and monitor the usage frequency of different protocol types in each time period, such as the traffic share of HTTP, HTTPS, FTP and other protocols in different time periods; a sliding window is used to analyze changes in protocol distribution. The frequency of occurrence of each protocol in the sliding window is counted to detect whether abnormal changes have occurred. For example, a device under test usually uses the HTTP protocol, but suddenly there is a large amount of HTTPS traffic, which may indicate abnormal data encryption or illegal communication.

[0086] Extract the dynamic change trend of traffic, analyze the change trend of the traffic of the device under test, and determine whether the traffic is stable, increasing, or fluctuating; use the regression model (support vector regression (SVR)) to predict the future traffic change trend; by analyzing the change trend of historical traffic data, determine whether the device under test is gradually entering a high load or abnormal fluctuation state; classify the traffic through the AI ​​algorithm, and divide the dynamic change trend of traffic into: stable state, rising trend, fluctuating trend and sudden drop trend. In the stable state, the traffic of the device under test fluctuates slightly and is in normal working state. In the rising trend, the traffic gradually increases, which may indicate that the load of the device under test is increased. In the fluctuating trend, the traffic fluctuates frequently, which may indicate that the working state of the device under test is unstable or is subject to external interference. In the sudden drop trend, the traffic suddenly drops, which may indicate that the device under test is faulty or disconnected. Apply cluster analysis K-means to perform pattern recognition on the extracted traffic feature parameters and divide the traffic data into different groups or pattern types. Identify different patterns in network traffic, including normal traffic, peak traffic, and abnormal traffic, to help understand the diversity and regularity of network behavior.

[0087] In this embodiment, through deep learning and analysis of traffic data by AI algorithms such as LSTM, CNN, and SVR, the system can automatically identify the traffic patterns of the device under different working conditions and capture the long-term trends, periodic fluctuations, and short-term fluctuations of the device traffic. This intelligent traffic pattern analysis enables abnormal device behavior (such as sudden traffic surges or illegal traffic activities) to be discovered in a timely manner, thereby improving the accuracy of abnormal traffic detection. At the same time, by integrating historical data, potential abnormal patterns can be identified, improving the accuracy and efficiency of anomaly detection, thereby improving the safety and stability of device use, and improving the user experience.

[0088] In an exemplary embodiment, the test model corresponding to the flow data of the device under test within the test period is dynamically adjusted according to the dynamic traffic model, including: determining multiple target time periods of the device under test according to the dynamic traffic model and a preset data change range, and determining the test models corresponding to the multiple target time periods; dynamically adjusting the test model corresponding to the flow data of the device under test within the test period according to the test models corresponding to the multiple target time periods.

[0089] Optionally, each traffic pattern corresponds to a preset data variation range, that is, the traffic pattern corresponding to the traffic data of the device under test in the test period can be determined according to the preset data variation range. According to the dynamic traffic model and the preset data variation range, the traffic patterns corresponding to the device under test in the test period are determined, and the time period corresponding to the device under test under each traffic pattern is set as a target period, that is, the time period corresponding to each traffic pattern is determined as the corresponding target period, such as, the multiple time periods corresponding to the linear growth mode of the device under test in the test period are called linear target periods, the multiple time periods corresponding to the periodic fluctuation mode of the device under test in the test period are called fluctuation target periods, and the multiple time periods corresponding to the burst traffic mode of the device under test in the test period are called burst target periods. Since each traffic pattern corresponds to a test model, that is, the linear growth mode corresponds to the linear growth test model, therefore, according to each traffic pattern corresponding to the device under test in the test period (that is, each target period), the test model corresponding to each target period is determined. Then, according to the test models corresponding to the multiple target periods, the test model corresponding to the traffic data of the device under test in the test period is dynamically adjusted.

[0090] Optionally, the traffic pattern corresponding to the traffic data of the device under test during the test period is identified through cluster analysis of the dynamic traffic model and the time series model; the corresponding test model is matched according to the traffic pattern; the test models include a linear growth test model, a burst traffic test model and a periodic fluctuation test model.

[0091] For example, the dynamic traffic model is used to cluster the traffic data of the device under test to identify traffic characteristic parameters (timing dependency, protocol usage pattern, and dynamic traffic change trend). On this basis, the time series model (LSTM) is combined to predict the traffic change trend and determine the traffic change pattern during the test period. This process automatically captures the timing characteristics and pattern changes of traffic data through AI algorithms, providing accurate traffic identification for subsequent tests.

[0092] After identifying the traffic pattern of the device under test, the corresponding test model is automatically matched according to the actual traffic behavior. Each traffic pattern represents a different load condition, reflecting the performance of the device under test in different environments. The test model is divided into a linear growth test model, a burst traffic test model, and a periodic fluctuation test model according to the current traffic status of the device under test. The linear growth test model, when it is identified that the traffic data presents a stable linear growth trend, tests the performance of the device under test by simulating a gradually increasing traffic load, and evaluates its processing capacity and stability under gradually increasing loads. The burst traffic test model, if the traffic data shows a sudden behavior that changes sharply in a short period of time, triggers the burst traffic test model to simulate traffic peaks or abnormal conditions, and detects the response speed and coping ability of the device under test under high load shocks. The periodic fluctuation test model, when the traffic data shows periodic fluctuations, simulates the periodic changes of traffic through the periodic fluctuation mode, and tests the stability and performance of the device under load fluctuations.

[0093] By matching the traffic behavior of the device under test with the traffic pattern, the dynamic traffic model can comprehensively test the device under test under different load conditions; at the same time, the server can automatically generate test conditions based on each traffic pattern, that is, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period.

[0094] In this embodiment, after the flow data is analyzed by the dynamic flow model, it can be divided into different target periods within the test period according to the flow pattern, and each target period will correspond to a different test model. This dynamic adjustment of the test model based on the target period and flow pattern enables the device anomaly detection process to adapt to changes in flow characteristics in real time, avoiding the forced adaptation of a single model to all situations, and improving the flexibility and adaptability of device anomaly detection.

[0095] In an exemplary embodiment, as shown in FIG3 , the flow data of the device under test in the test period is tested according to multiple test models to obtain an abnormal test report of the device under test, including steps 302 to 306. Among them:

[0096] Step 302 , testing the flow data of the device under test within a test period according to multiple test models, and obtaining first test indexes of the device under test corresponding to each test model.

[0097] The first test index and the second test index are both flow test indexes. The flow test index is an indicator that quantifies the performance of the device under test. The first test index includes a burst flow test index, a linear growth test index, and a periodic fluctuation test index. Among them, the flow test index is calculated based on the performance data of the device under test under different flow modes. The performance data under different flow modes include parameters such as delay, throughput, and packet loss rate. The flow test index is used to evaluate whether the device under test meets the expected performance standards and provide a basis for optimizing the device under test.

[0098] The linear growth test model is used to perform linear growth mode test on the device under test whose traffic data is in linear growth mode. The linear growth mode test includes setting the starting traffic value and growth rate; using linear equations to construct a linear growth equation for traffic data over time, simulating the dynamic characteristics of the behavior of the device under gradually increasing load, and then obtaining the linear growth test index of the device under test. The linear growth test index is used to evaluate the processing capacity and stability of the device under test when the load gradually increases.

[0099] Optionally, the starting traffic value is the initial network traffic at the beginning of the linear growth mode test, which is usually set to the baseline traffic when the device under test is operating normally. The growth rate is the rate at which the traffic increases over time, usually expressed as the traffic growth per unit time, such as Mbps / minute. The growth rate can be set according to the actual usage scenario to simulate different load growth situations.

[0100] To simulate the linear growth of flow data, a linear equation is used to describe the change of flow data over time. The form of this equation is ,in, represents the flow rate at time t, represents the starting flow value, r is the growth rate, and t is the time. This equation indicates that the flow data increases linearly with time, and as time goes by, the flow data will increase at a constant rate. The calculation formula for the linear growth test index of the device under test is as follows:

[0101]

[0102] in, Indicates the linear growth test index of the device under test, Represents the average response time, that is, the response speed of the device under test to the gradually increasing load. Represents the response time threshold, which is used to measure the acceptance criteria of the response time. Indicates the average throughput, which indicates the data processing capability of the device under test when the load increases. Indicates the maximum throughput, which means the maximum throughput that the device under test can achieve during the test. Indicates the average packet loss rate, which indicates the packet loss of the device under test during the test. Indicates the packet loss rate threshold, which is used to measure the acceptance standard of the packet loss rate. Indicates the average CPU usage, that is, the CPU resource usage of the device under test during the test. Indicates the average memory usage, that is, the memory resource usage of the device under test during the test. Indicates the maximum resource usage value, that is, the maximum usage standard of CPU and memory, which is used to measure the resource utilization efficiency of the device under test. The historical performance data of smart home devices under different workload conditions is collected through network monitoring tools to obtain the response time threshold and packet loss rate threshold.

[0103] The periodic fluctuation test model is used to perform periodic fluctuation mode test on the equipment under test whose traffic data is in periodic fluctuation mode. The periodic fluctuation mode test includes determining the period and frequency by analyzing the periodic characteristics in the historical traffic data of the equipment under test; using a sine function to describe the periodic fluctuation, simulating the dynamic characteristics of the behavior of the equipment under periodic fluctuation load conditions, and obtaining the periodic fluctuation test index of the equipment under test, which is used to evaluate the performance and stability of the equipment under periodic load.

[0104] For example, historical traffic data is analyzed to identify the periodic characteristics of the equipment under test in previous operations. By analyzing the historical traffic data of the equipment under test, periodic characteristics such as the periodic change pattern and frequency of the traffic are extracted. The period refers to the length of the repetitive cycle of fluctuations in the data. For example, the fluctuation period of traffic data that repeats every 30 minutes is 30 minutes. The frequency is the reciprocal of the period and is used to describe the speed of the fluctuation. The sine function is used to describe the periodic fluctuation to simulate and describe the periodic changes of traffic over time. The function form is , is the flow value at time t, A is the amplitude, which is used to indicate the intensity of periodic fluctuations, and f is the frequency, which indicates the periodicity of the fluctuation (the inverse of the period). is the phase, indicating the initial point of the fluctuation, and C is the offset, indicating the baseline level of the fluctuation. The calculation formula for the periodic fluctuation test index of the device under test is as follows:

[0105]

[0106] in, It represents the periodic fluctuation test index of the smart home device to be tested, which is used to measure the resource utilization efficiency of the device to be tested. k represents a scalar coefficient, which is used to amplify or reduce the impact of periodic fluctuations on the test index. In actual applications, this k coefficient may be set based on the characteristics of the device to be tested, the network environment or the test requirements.

[0107] The burst traffic test model is used to perform burst traffic mode test on the device under test whose traffic data is in burst traffic mode. The burst traffic mode test includes setting the intensity, start time and end time of the burst traffic; using piecewise functions to describe the changes in burst traffic, simulating the dynamic characteristics of the behavior of the device under burst traffic conditions, and obtaining the burst traffic test index of the device under test, which is used to evaluate the performance and stability of the device under burst traffic.

[0108] Exemplarily, the burst traffic pattern test is used to evaluate the performance and stability of the device under test in the face of burst traffic conditions. The burst traffic intensity specifies the traffic value or rate of the traffic burst, which is usually higher than the normal traffic level. This represents the intensity of the burst traffic, which usually needs to be greater than the normal processing capacity of the device under test for effective testing. The start time defines the time point when the burst traffic starts, which marks the beginning of the burst traffic pattern. The end time defines the time point when the burst traffic ends, which marks the end of the burst traffic pattern. The piecewise function is used to describe the changes in burst traffic. The piecewise function is used to accurately simulate the dynamic changes of burst traffic. The function defines the changes in traffic over time during the duration of the burst traffic. The piecewise function is as follows:

[0109]

[0110] Where B represents the intensity of burst traffic. Indicates the start time of burst traffic. represents the end time of burst traffic, and t represents the time variable. In this piecewise function, burst traffic starts from Begins to reach intensity B and After that, it returns to the normal traffic level. The calculation formula for the burst traffic test index of the device under test is as follows:

[0111]

[0112] in, Indicates the burst traffic test index of the device under test. It represents the actual throughput at time t, reflecting the throughput performance of the device under test at different time points. It represents the maximum throughput during the burst traffic, that is, the highest throughput that the device under test can achieve during the burst traffic, and T is the total duration of the burst traffic, that is, the length of time the device under test experiences the burst traffic.

[0113] Step 304: Determine the weight factors corresponding to the first test indexes respectively by using the hierarchical analysis method.

[0114] Step 306: Perform calculations on each first test index and the weighting factors corresponding to each first test index to obtain a second test index of the device under test.

[0115] The linear growth test index, periodic fluctuation test index and burst flow test index of the equipment under test are assigned corresponding weights through the hierarchical analysis method, and the linear growth test index weight factor, periodic fluctuation test index weight factor and burst flow test index weight factor corresponding to the linear growth test index, periodic fluctuation test index and burst flow test index are obtained respectively.

[0116] The linear growth test index, periodic fluctuation test index and burst flow test index of the device under test are respectively processed with the linear growth test index weight factor, periodic fluctuation test index weight factor and burst flow test index weight factor to obtain a second test index of the device under test.

[0117] By establishing a hierarchical model, the linear growth test index, periodic fluctuation test index and burst flow test index of the device under test are used as the main evaluation indicators. Expert scoring or other decision-making methods are used to evaluate the relative importance of these indicators to determine their weight factors.

[0118] The calculation formula of the second test index of the device under test is as follows:

[0119]

[0120] in, Indicates the second test index of the device under test, It represents the linear growth test index weight factor, which indicates the importance of the linear growth model test index in the overall evaluation. It represents the weight factor of the periodic fluctuation test index, which indicates the importance of the periodic fluctuation pattern test index in the overall evaluation. Represents the weight factor of the burst traffic test index, indicating the importance of the burst traffic pattern test index in the overall evaluation.

[0121] In an exemplary embodiment, the method further includes: comparing the second test index of the device under test with a plurality of preset thresholds to determine a comparison result; and determining an abnormal test report of the device under test based on the comparison result.

[0122] The pre-set multiple thresholds include a first threshold, a second threshold and a third threshold.

[0123] The second test index of the device under test is compared with multiple preset thresholds, and marked to generate an abnormal test report of the device under test. When the second test index of the device under test is less than the first threshold and greater than the second threshold, the device under test is marked as a slightly abnormal device; when the second test index of the device under test is less than the second threshold and greater than the third threshold, the device under test is marked as a moderately abnormal device; when the second test index of the device under test is less than the third threshold, the device under test is marked as a highly abnormal device; the device abnormal test report of the device under test includes recording the second test index of the current device under test and the time of occurrence.

[0124] This classification helps to clarify the health status of the device under test and guide subsequent maintenance or adjustment measures. The final abnormal test report will include the second test index of the device under test and the time of its occurrence. The recording of this information not only provides a basis for historical tracking of the performance of the device under test, but also provides an important reference for subsequent fault analysis and preventive maintenance. Through such a systematic process, the performance of smart home devices can be managed and optimized more effectively.

[0125] In this embodiment, the flow data of the device under test is tested through multiple test models, and the performance of the device under test under different load modes (such as linear growth, periodic fluctuations, and burst traffic) can be comprehensively evaluated, so that the device anomaly detection can adapt to the complex usage scenarios of the device under test and improve the flexibility of the device anomaly detection method. By calculating and processing the first test index and the weight factor to obtain the second test index, a unified and comprehensive performance evaluation value can be provided for the device under test. Compared with using a single model or test, this method can better balance the performance of the device under multiple traffic modes, thereby improving the accuracy of the device anomaly detection method.

[0126] In an exemplary embodiment, the method also includes: obtaining the response time of the device under test to traffic changes under each traffic mode during a test period, and drawing a delay change curve of the device under test; collecting throughput data of the device under test during the test period, and drawing a throughput change curve of the device under test based on the throughput data; obtaining memory usage data corresponding to each traffic mode of the device under test during the test period, and drawing a memory usage change curve of the device under test; and testing the resource management capability of the device under test based on the delay change curve, throughput change curve and memory usage change curve of the device under test.

[0127] During the test of different traffic patterns, analyze the response time of the device under test to traffic changes, draw a delay change curve, and identify the impact of traffic pattern changes on delay. Analyze the changes in the throughput of the device under test over time, and identify the throughput capacity and fluctuations of the device under test when handling traffic peaks. Analyze the packet loss rate of the device under test under different load conditions, identify the pattern of packet loss and stability during peak loads. Evaluate the CPU and memory usage of the device under test in each traffic mode, and analyze the efficiency of resource utilization and load balancing.

[0128] Optionally, analyze the response time of the device under test to traffic changes. When applying different traffic patterns (such as linear growth, periodic fluctuations, and burst traffic), record the time delay from the start of traffic change to the start of traffic processing by the device under test. Record the change of the response time of the device under test over time and draw a delay change curve for the device under test. This delay change curve shows the response speed of the device under test to different traffic pattern changes. By analyzing the trend in the delay change curve, understand the change of the response time of the device under test when facing traffic pattern changes. For example, whether the response time is significantly extended when the traffic increases rapidly. Evaluate the throughput capacity and throughput fluctuation of the device under test when processing traffic peaks. During the traffic test, regularly record the throughput of the device under test (the amount of data processed per unit time), draw a throughput change curve, and show the change of throughput over time. Observe the processing capacity and throughput stability of the device under test during traffic peaks through the throughput change curve. Analyze the peak, valley, and fluctuation amplitude of the throughput change curve to determine the performance of the device under test under load peaks and the stability of its throughput capacity. Identify the pattern of packet loss and stability under high load, and record the packet loss under different traffic modes and load conditions. The packet loss rate is the ratio of the number of lost packets to the total number of packets. Record the packet loss rate under different load conditions. Through the changing trend of the packet loss rate, identify the pattern of packet loss under different traffic modes and the stability under peak load. Evaluate the resource utilization efficiency and load balancing of the device under test under different traffic modes. During the traffic test, regularly monitor the CPU and memory usage of the device under test, and draw a memory usage change curve, that is, draw a CPU and memory usage change curve. The CPU and memory usage change curve records and draws the changes in CPU and memory usage over time, which can show the efficiency of resource utilization, evaluate resource usage under different traffic modes, and check whether there is a resource bottleneck or load imbalance. The above data can be used to judge the resource management ability of the device under high load conditions.

[0129] In this embodiment, by obtaining key indicators such as latency, throughput, and memory usage of the device under different traffic modes, the performance of the device under test can be comprehensively evaluated. Different traffic modes will generate different loads and pressures on the device. Through the comprehensive evaluation of these indicators, we can gain an in-depth understanding of the performance of the device under various workloads. This helps to discover potential bottlenecks or deficiencies of the device under different conditions. By monitoring the changing trends of latency, throughput, and memory usage, potential risks of abnormal behavior or performance degradation can be discovered in a timely manner. For example, a sudden increase in latency may indicate that the device is facing network congestion or hardware bottlenecks, a decrease in throughput may indicate insufficient computing power of the device, and excessive memory usage may indicate uneven resource allocation or memory leaks. This ability to detect potential problems in advance helps reduce the risk of device failure and performance degradation.

[0130] In another embodiment, a device abnormality detection method is provided, the method comprising:

[0131] Based on the historical traffic data, preliminary characteristic parameters of the device under test are extracted, and based on the preliminary characteristic parameters, traffic characteristic data of the device under test is extracted.

[0132] Perform data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period; determine the dynamic traffic model based on the multiple traffic patterns and time series model of the device under test during the test period. The dynamic traffic model includes multiple traffic patterns, each of which corresponds to a test model.

[0133] The traffic pattern corresponding to the traffic data of the device under test during the test period is identified through a dynamic traffic model and a time series model; the corresponding test model is matched according to the traffic pattern; wherein the test model includes a linear growth test model, a burst traffic test model and a periodic fluctuation test model.

[0134] The flow data of the device under test within the test period is tested according to multiple test models to obtain the first test index of the device under test under each test model; the weight factors corresponding to each first test index are determined by the hierarchical analysis method; the first test indexes and the weight factors corresponding to each first test index are processed by operation to obtain the second test index of the device under test.

[0135] The second test index of the device under test is compared with a plurality of preset thresholds to determine a comparison result; and an abnormal test report of the device under test is determined according to the comparison result.

[0136] Obtain the response time of the device under test to traffic changes in each traffic mode during the test period, and draw a delay change curve for the device under test; collect the throughput data of the device under test during the test period, and draw a throughput change curve for the device under test based on the throughput data; obtain the corresponding memory usage data of the device under test in each traffic mode during the test period, and draw a memory usage change curve for the device under test; test the resource management capability of the device under test based on the delay change curve, throughput change curve and memory usage change curve of the device under test.

[0137] In this embodiment, by testing the flow data of the device under test through multiple test models, the performance of the device under test under different load modes (such as linear growth, periodic fluctuations, and burst traffic) can be comprehensively evaluated, so that the device anomaly detection can adapt to the complex usage scenarios of the device under test, and improve the flexibility and accuracy of the device anomaly detection method. At the same time, by testing the flow data of the device under test through multiple test models, the anomaly detection threshold can be automatically adjusted for different environments and usage scenarios to adapt to changes in device performance, ensuring that the normal operation of the device can be effectively monitored under various conditions.

[0138] In addition, this application uses real-time data processing and analysis to quickly identify abnormal situations, promptly notify users or automatically take measures to reduce the risks of equipment failures, ensure user safety and equipment stability, reduce the frequency of manual user intervention, and improve user experience through intelligent monitoring, allowing users to focus more on other life matters. This application integrates historical data and real-time data to identify potential abnormal patterns of equipment, thereby improving the accuracy and efficiency of equipment anomaly detection, providing support for long-term evaluation and optimization of equipment performance, helping users understand the use of equipment, and then formulating more reasonable use and maintenance strategies. Moreover, by introducing advanced AI technology, smart home devices can not only complete basic functions, but also have the ability to self-monitor and warn of faults, thereby improving the intelligence level of the entire smart home ecosystem.

[0139] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0140] Based on the same inventive concept, the embodiment of the present application also provides a device anomaly detection device for implementing the device anomaly detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more device anomaly detection device embodiments provided below can refer to the limitations of the device anomaly detection method above, and will not be repeated here.

[0141] In an exemplary embodiment, as shown in FIG4 , a device abnormality detection apparatus is provided, comprising: an extraction module 402 , a determination module 404 , an adjustment module 406 and a detection module 408 , wherein:

[0142] An extraction module 402 is used to obtain historical flow data of the device under test, and extract flow characteristic data of the device under test based on the historical flow data;

[0143] A determination module 404 is used to determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each of which corresponds to a test model;

[0144] An adjustment module 406, configured to dynamically adjust the test model corresponding to the flow data of the device under test within a test period according to the dynamic flow model;

[0145] The detection module 408 is used to test the flow data of the device under test within a test period according to the multiple test models to obtain an abnormal test report of the device under test.

[0146] In an exemplary embodiment, the extraction module 402 is further configured to extract preliminary characteristic parameters of the device under test based on the historical flow data, and extract flow characteristic data of the device under test according to the preliminary characteristic parameters.

[0147] In an exemplary embodiment, the determination module 404 is also used to perform data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period; and determine the dynamic traffic model based on the multiple traffic patterns and time series model of the device under test during the test period.

[0148] In an exemplary embodiment, the detection module 408 is also used to test the flow data of the device under test within the test period according to the multiple test models to obtain the first test index of the device under test under each test model; determine the weight factors corresponding to each of the first test indexes through the hierarchical analysis method; perform calculations on each of the first test indexes and the weight factors corresponding to each of the first test indexes to obtain the second test index of the device under test.

[0149] In an exemplary embodiment, the adjustment module 406 is further configured to compare the second test index of the device under test with a plurality of preset thresholds to determine a comparison result; and determine an abnormal test report of the device under test based on the comparison result.

[0150] In an exemplary embodiment, the detection module 408 is also used to determine multiple target time periods of the device under test and determine the test models corresponding to the multiple target time periods based on the dynamic traffic model and the preset data change range; based on the test models corresponding to the multiple target time periods, dynamically adjust the test model corresponding to the traffic data of the device under test within the test period.

[0151] In an exemplary embodiment, the device abnormality detection apparatus further includes:

[0152] A resource management detection module is used to obtain the response time of the device under test to traffic changes under each traffic mode within a test period, and draw a delay change curve of the device under test; collect throughput data of the device under test within the test period, and draw a throughput change curve of the device under test based on the throughput data; obtain memory usage data corresponding to each traffic mode of the device under test within the test period, and draw a memory usage change curve of the device under test; and detect the resource management capability of the device under test based on the delay change curve, throughput change curve and memory usage change curve of the device under test.

[0153] Each module in the above-mentioned device abnormality detection device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0154] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store historical traffic data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a device abnormality detection method is implemented.

[0155] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0157] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0158] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0161] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A device anomaly detection method, characterized in that: The method comprises: Acquire historical flow data of the device under test, and extract flow characteristic data of the device under test based on the historical flow data; Determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each of which corresponds to a test model; According to the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period; The flow data of the device under test within a test period is tested according to the multiple test models to obtain an abnormal test report of the device under test.

2. The method according to claim 1, characterized in that The method further comprises: Based on the historical flow data, extracting preliminary characteristic parameters of the device under test, and extracting flow characteristic data of the device under test according to the preliminary characteristic parameters; Performing data analysis on the flow characteristic data to identify multiple flow patterns of the device under test within a test period; A dynamic traffic model is determined according to a plurality of traffic patterns and time series models of the device under test within a test period.

3. The method according to claim 1, characterized in that: The step of testing the flow data of the device under test within a test period according to the plurality of test models to obtain an abnormal test report of the device under test includes: Testing the flow data of the device under test in a test period according to the plurality of test models to obtain first test indexes of the device under test corresponding to the respective test models; Determine the weight factors corresponding to each of the first test indexes by using the hierarchical analysis method; Each of the first test indexes and the weight factors respectively corresponding to the first test indexes are processed to obtain a second test index of the device under test.

4. The method according to claim 3, characterized in that The method further comprises: Comparing the second test index of the device under test with a plurality of preset thresholds to determine a comparison result; An abnormal test report of the device under test is determined according to the comparison result.

5. The method according to claim 1, characterized in that: The dynamically adjusting the test model corresponding to the flow data of the device under test within the test period according to the dynamic flow model includes: Determine multiple target time periods of the device under test according to the dynamic traffic model and the preset data change range, and determine the test models corresponding to the multiple target time periods; According to the test models corresponding to the multiple target time periods, the test model corresponding to the flow data of the device under test within the test period is dynamically adjusted.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining the response time of the device under test to flow changes in each flow mode during the test period, and drawing a delay change curve of the device under test; Collecting throughput data of the device under test during a test period, and drawing a throughput change curve of the device under test according to the throughput data; Obtaining memory usage data corresponding to each flow mode of the device under test during a test period, and drawing a memory usage change curve of the device under test; The resource management capability of the device under test is detected according to the delay variation curve, the throughput variation curve and the memory usage variation curve of the device under test.

7. A device for detecting abnormality of equipment, characterized in that: The device comprises: An extraction module, used to obtain historical flow data of the device under test, and extract flow characteristic data of the device under test based on the historical flow data; A determination module, used to determine a dynamic traffic model according to the traffic characteristic data; wherein the dynamic traffic model includes a plurality of traffic patterns, each of which corresponds to a test model; An adjustment module, used for dynamically adjusting the test model corresponding to the flow data of the device under test within a test period according to the dynamic flow model; The detection module is used to test the flow data of the device under test within a test period according to the multiple test models to obtain an abnormal test report of the device under test.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images