Equipment anomaly detection methods, devices, computer equipment, and storage media

Abstract

This application relates to a method, apparatus, computer device, and storage medium for detecting equipment anomalies. The method includes: acquiring historical traffic data of the device under test (DUT), and extracting traffic characteristic data of the DUT based on the historical traffic data; determining a dynamic traffic model based on the traffic characteristic data; wherein the dynamic traffic model includes multiple traffic patterns, each corresponding to a test model; dynamically adjusting the test model corresponding to the traffic data of the DUT during the test period based on the dynamic traffic model; and testing the traffic data of the DUT during the test period using multiple test models to obtain an anomaly test report for the DUT. This method can accurately detect equipment in complex operating scenarios and improve the accuracy of equipment anomaly detection.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for detecting equipment anomalies. Background Technology

[0002] With the rapid development of smart homes, smart devices have gradually integrated into modern family life. These devices include smart light bulbs, thermostats, security cameras, and smart speakers, which significantly improve users' quality of life and convenience through their interconnectivity. However, these devices are susceptible to the effects of complex environments and diverse usage scenarios during operation, making performance monitoring and anomaly detection crucial for ensuring their reliability and security. Failure to detect and handle anomalies in a timely manner can not only lead to device damage but also negatively impact user safety and experience. Therefore, developing accurate and efficient anomaly detection methods has become an important research direction in smart home device management.

[0003] In traditional technologies, anomaly detection for most smart home devices relies on conventional monitoring methods, such as static threshold detection or predefined rule-based anomaly detection. These methods typically determine whether a device is functioning correctly by setting parameter thresholds. Furthermore, these methods usually monitor and diagnose device behavior based on a predefined rule base.

[0004] However, traditional anomaly detection methods have significant limitations when facing the complex operating scenarios of smart home devices. Because static threshold detection or predefined rule-based anomaly detection methods determine whether a device is operating normally by setting fixed performance parameter thresholds, they struggle to adapt to complex operating scenarios in practice. In other words, when faced with complex load scenarios, traditional anomaly detection methods cannot accurately detect devices, thus affecting the accuracy of anomaly detection. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can accurately detect equipment in complex operating scenarios and improve the accuracy of equipment anomaly detection, in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a method for detecting equipment malfunctions, including:

[0007] Acquire historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data;

[0008] A dynamic traffic model is determined based on traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0009] Based on the dynamic flow model, the test model corresponding to the flow data of the device under test during the test period is dynamically adjusted.

[0010] The device under test is tested using multiple test models during the test period to obtain an anomaly test report.

[0011] In one embodiment, the method further includes:

[0012] Based on historical traffic data, preliminary characteristic parameters of the device under test are extracted, and based on the preliminary characteristic parameters, traffic characteristic data of the device under test are extracted.

[0013] Data analysis of traffic characteristics is performed to identify multiple traffic patterns of the device under test during the test period;

[0014] The dynamic traffic model is determined based on the multiple traffic patterns and time series models of the device under test during the test period.

[0015] In one embodiment, the traffic data of the device under test during the test period is tested according to multiple test models to obtain an anomaly test report of the device under test, including:

[0016] The traffic data of the device under test during the test period are tested according to multiple test models to obtain the first test index of the device under test under each test model.

[0017] The weighting factors corresponding to each first test index were determined using the analytic hierarchy process.

[0018] The second test index of the device under test is obtained by performing calculations on each first test index and the corresponding weight factor.

[0019] In one embodiment, the method further includes:

[0020] The second test index of the device under test is compared with multiple pre-set thresholds to determine the comparison result;

[0021] Based on the comparison results, determine the abnormal test report of the device under test.

[0022] In one embodiment, the test model corresponding to the traffic data of the device under test during the test period is dynamically adjusted according to the dynamic traffic model, including:

[0023] Based on the dynamic traffic model and the preset data change range, multiple target time periods are determined for the device under test, and the corresponding test models for the multiple target time periods are determined.

[0024] Based on the test models corresponding to multiple target time periods, the test models corresponding to the traffic data of the device under test during the test period are dynamically adjusted.

[0025] In one embodiment, the method further includes:

[0026] Obtain the response time of the device under test to changes in traffic under different traffic modes during the test period, and plot the delay change curve of the device under test;

[0027] Collect throughput data of the device under test during the test period, and plot the throughput change curve of the device under test based on the throughput data;

[0028] Obtain the memory usage data of the device under test under different traffic modes during the test period, and plot the memory usage change curve of the device under test.

[0029] The resource management capabilities of the device under test are tested based on its latency variation curve, throughput variation curve, and memory usage variation curve.

[0030] Secondly, this application also provides a device for detecting equipment malfunctions, comprising:

[0031] The extraction module is used to acquire historical traffic data of the device under test and extract traffic characteristic data of the device under test based on the historical traffic data;

[0032] The determination module is used to determine the dynamic traffic model based on traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0033] The adjustment module is used to dynamically adjust the test model corresponding to the traffic data of the device under test during the test period based on the dynamic traffic model.

[0034] The detection module is used to test the traffic data of the device under test during the test period based on multiple test models, and to obtain an abnormal test report of the device under test.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0036] Acquire historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data;

[0037] A dynamic traffic model is determined based on traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0038] Based on the dynamic flow model, the test model corresponding to the flow data of the device under test during the test period is dynamically adjusted.

[0039] The device under test is tested using multiple test models during the test period to obtain an anomaly test report.

[0040] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0041] Acquire historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data;

[0042] A dynamic traffic model is determined based on traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0043] Based on the dynamic flow model, the test model corresponding to the flow data of the device under test during the test period is dynamically adjusted.

[0044] The device under test is tested using multiple test models during the test period to obtain an anomaly test report.

[0045] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0046] Acquire historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data;

[0047] A dynamic traffic model is determined based on traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0048] Based on the dynamic flow model, the test model corresponding to the flow data of the device under test during the test period is dynamically adjusted.

[0049] The device under test is tested using multiple test models during the test period to obtain an anomaly test report.

[0050] The aforementioned equipment anomaly detection method, apparatus, computer equipment, storage medium, and computer program product acquire historical traffic data of the device under test (DUT) and extract traffic characteristic data of the DUT based on the historical traffic data; determine a dynamic traffic model based on the traffic characteristic data; wherein the dynamic traffic model includes multiple traffic patterns, each traffic pattern corresponding to a test model; dynamically adjust the test model corresponding to the traffic data of the DUT during the test period according to the dynamic traffic model; test the traffic data of the DUT during the test period according to multiple test models to obtain an anomaly test report of the DUT. This method can accurately detect equipment in complex operating scenarios and improve the accuracy of equipment anomaly detection. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a diagram illustrating the application environment of a device anomaly detection method in one embodiment.

[0053] Figure 2 This is a flowchart illustrating a device anomaly detection method in one embodiment;

[0054] Figure 3 This is a flowchart illustrating the process of obtaining an anomaly test report for the device under test in one embodiment.

[0055] Figure 4 This is a structural block diagram of a device anomaly detection device in one embodiment;

[0056] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] The device anomaly detection method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Terminal 102 sends a device anomaly detection request to server 104. Server 104 receives the request, obtains historical traffic data of the device under test, and extracts traffic characteristic data of the device under test based on the historical traffic data. It then determines a dynamic traffic model based on the traffic characteristic data; the dynamic traffic model includes multiple traffic patterns, each corresponding to a test model; based on the dynamic traffic model, it dynamically adjusts the test model corresponding to the traffic data of the device under test during the test period; and tests the traffic data of the device under test during the test period using multiple test models to obtain an anomaly test report for the device under test. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0059] Traditional anomaly detection methods, which employ static threshold detection or predefined rules, typically set fixed thresholds to determine whether a device is operating normally. However, these thresholds may not adapt to the actual performance changes of the device under different environments or usage scenarios. For example, the performance of a device in a high-temperature environment may differ significantly from that in a low-temperature environment. Static thresholds cannot be flexibly adjusted, leading to false alarms or missed alarms. Traditional anomaly detection methods often neglect in-depth analysis of historical device data, thus failing to utilize big data and machine learning technologies to identify potential problems in device performance. Furthermore, traditional anomaly detection methods often struggle to adapt to complex operating scenarios, thus failing to effectively detect the root cause of device failures. This application proposes a device anomaly detection method that can monitor the performance of smart home devices in real time and construct a dynamic traffic model. The method performs tests on the device under test under different modes, analyzes the dynamic behavioral characteristics of the device under test under different modes, evaluates the traffic test index of the device under test, and quickly identifies and marks abnormal states, thereby achieving more intelligent management.

[0060] In one exemplary embodiment, such as Figure 2 As shown, a method for detecting equipment malfunctions is provided, which can be applied to... Figure 1 Taking the server in the example, the explanation includes the following steps 202 to 206. Wherein:

[0061] Step 202: Obtain historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data.

[0062] The device under test (DUT) refers to the device that requires anomaly detection. Optionally, the device can be a smart home device or other types of intelligent or automated devices, such as smart wearables and smartphones. Historical traffic data refers to traffic-related records of the DUT over a period of time. Historical traffic data can include network traffic data (such as data transmission volume and packet size), device status data, and device response data. Traffic characteristic data is a key indicator describing network traffic characteristics. It can be used to build dynamic traffic models to accurately simulate the traffic behavior of the DUT. Traffic characteristic data can include average traffic intensity, peak traffic duration, protocol distribution, and traffic volatility.

[0063] For example, historical traffic data of the device under test (DUT) over a past period is acquired. This historical traffic data may include upload and download traffic, request-response frequency, network latency, and device resource usage (such as memory consumption) under different operating modes and load conditions. Artificial intelligence (AI) algorithms are then used to perform in-depth analysis of this historical traffic data. Optionally, the AI ​​algorithm can extract key traffic characteristic data from the large amount of historical traffic data, such as average traffic intensity, peak traffic time, protocol distribution, and traffic volatility. This traffic characteristic data can provide the foundation for further anomaly detection and can also be used to evaluate the performance of the DUT under different load conditions.

[0064] Step 204: Determine the dynamic traffic model based on the traffic characteristic data; wherein, the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0065] Dynamic traffic models are mathematical models used to simulate and predict changes in network traffic. They can reflect the traffic patterns of the device under test (DUT) under different time periods and load conditions, and can be used to test and evaluate the performance of the DUT under different load conditions.

[0066] Optionally, based on traffic characteristic data, an in-depth analysis of the device under test (DUT) can be conducted to extract key traffic patterns and regularities, thereby constructing a dynamic traffic model. This dynamic traffic model can dynamically adjust according to different behavioral characteristics of the DUT to adapt to its performance under different operating conditions. The dynamic traffic model can include multiple sub-modes, each corresponding to a specific traffic pattern. Traffic patterns can include linear growth patterns, periodic fluctuation patterns, burst traffic patterns, etc. Each traffic pattern represents the typical traffic behavior of the DUT under specific environmental or load conditions, and changes in each traffic pattern will affect the DUT's response speed, throughput, stability, and other performance indicators.

[0067] Step 206: Based on the dynamic traffic model, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period.

[0068] The test period is a pre-defined specific time interval during the anomaly detection process, during which the traffic data of the device under test is tested and analyzed. This period can be predefined or automatically adjusted according to the behavior and traffic changes of the device under test.

[0069] Optionally, based on the dynamic traffic model, the test model is dynamically adjusted during the anomaly detection process of the traffic data of the device under test (DUT) during the test period. This ensures that the test model matches the actual operating state of the DUT. In other words, the corresponding test model is determined according to the different traffic characteristics of the DUT. The test model can be flexibly selected or switched based on the traffic data of the DUT during the test period, ensuring that the load and response of the DUT remain consistent with the traffic pattern during anomaly detection. For example, when the DUT exhibits abnormally high traffic fluctuations within a certain period, the test model can be switched to a more stringent test model. In this way, the test model can more accurately reflect the performance of the DUT under various real-world environments, thereby improving the reliability and effectiveness of anomaly detection.

[0070] Step 208: Test the traffic data of the device under test during the test period according to multiple test models to obtain an abnormal test report of the device under test.

[0071] For example, based on multiple test models, a comprehensive test is performed on the traffic data of the device under test (DUT) during the test period to evaluate its performance under different traffic patterns. During anomaly detection, corresponding traffic patterns are matched based on the characteristics of the traffic data during the test period. Optionally, the traffic data of the DUT during the test period can be matched with multiple traffic patterns. Then, based on the multiple traffic patterns matched by the DUT during the test period, a corresponding test model is determined, and an anomaly test report for the DUT is generated based on the test results of different test models. The test results of different test models can be considered as test indices.

[0072] In the aforementioned device anomaly detection method, historical traffic data of the device under test (DUT) is acquired, and traffic characteristic data of the DUT is extracted based on the historical traffic data to provide basic data for further anomaly detection. A dynamic traffic model is determined based on the traffic characteristic data. This dynamic traffic model includes multiple traffic patterns, each corresponding to a test model. Based on the dynamic traffic model, the test model corresponding to the DUT's traffic data during the test period is dynamically adjusted. This allows for flexible selection or switching of test models for different environments and usage scenarios to adapt to changes in the DUT's performance, ensuring effective monitoring of the DUT's operation under various conditions. The DUT's traffic data during the test period is tested using multiple test models to obtain an anomaly test report. The method determines the corresponding test model based on the multiple traffic patterns matched by the DUT during the test period, enabling the test model to more accurately reflect the DUT's performance in various real-world environments, thereby improving the reliability and effectiveness of device anomaly detection. This application, through real-time data processing and analysis, quickly identifies abnormal situations and accurately detects devices in complex operating scenarios, improving the accuracy of device anomaly detection.

[0073] In an exemplary embodiment, the method further includes: extracting preliminary characteristic parameters of the device under test based on historical traffic data, and extracting traffic characteristic data of the device under test based on the preliminary characteristic parameters; performing data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period; and determining a dynamic traffic model based on the multiple traffic patterns and time series model of the device under test during the test period.

[0074] The data analysis employed cluster analysis. Historical traffic data was collected using network traffic monitoring tools, and statistical analysis methods were used to extract preliminary characteristic parameters of the historical traffic. These preliminary characteristic parameters included average traffic intensity, peak traffic time, protocol distribution, and traffic volatility. Based on these preliminary characteristic parameters, AI algorithms were used to extract traffic feature data, which included complex time-series dependencies, protocol usage patterns, and dynamic traffic trends. This traffic feature data was used as input for cluster analysis, which identified different traffic patterns of the device under test during the test period. The traffic feature data was classified into different pattern types, including linear growth patterns, burst traffic patterns, and periodic fluctuation patterns. Combined with a time series model, a dynamic traffic model was constructed.

[0075] The linear growth mode is a load test mode that simulates network traffic growing linearly. It assumes that traffic increases uniformly over time and is used to evaluate the performance of the device under test (DUT) under continuously increasing loads and to test the DUT's response and performance under gradual load changes. The periodic fluctuation mode is a load test mode that simulates periodic changes in network traffic. It describes traffic changes using a sine function or other periodic functions, evaluating the DUT's performance under periodic loads and testing the DUT's stability and performance under common periodic load fluctuations (such as daily peak loads). The burst traffic mode is a load test mode that simulates a sudden surge in traffic followed by a rapid decline. By setting the intensity and duration of the burst traffic, it tests the DUT's ability to withstand high loads for a short period and evaluates the DUT's response speed and stability under sudden high load conditions.

[0076] For example, network traffic monitoring tools, including Wireshark and NetFlow, can be used to record historical network traffic data. These tools can capture and record information about network packets, including timestamps, source IP addresses (Internet Protocol), destination IP addresses, port numbers, and protocol types, providing a raw data foundation for subsequent data analysis and model building. Key characteristic parameters of the historical traffic data are extracted using statistical analysis methods to obtain preliminary characteristic parameters. These preliminary characteristic parameters include average traffic intensity, peak traffic time, protocol distribution, and traffic volatility. Average traffic intensity is used to calculate the average traffic over a period of time to understand the basic load level of the network. Peak traffic time is used to determine the time when traffic reaches its peak, identifying peak traffic periods. Protocol distribution is used to analyze the traffic proportions of various protocols in the network, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and HTTP (Hypertext Transfer Protocol), to understand the distribution of network applications. Traffic volatility is used to calculate the magnitude of traffic changes over time to assess the stability and volatility of the network.

[0077] Statistical tools, including Pandas (a Python data analysis library) and R (a programming language), were used to process and analyze the collected data, extracting key feature parameters. This provided a quantitative description of network traffic behavior, offering initial feature input for model building. Based on these initial features, AI algorithms further explored complex traffic feature parameters. Complex time-series dependencies refer to the patterns of change in traffic data over time. They reflect the long-term and short-term trends of traffic over time, as well as periodic fluctuations. Identification methods: Long-Short-Term Memory (LSTM) models can capture long-term trends and short-term fluctuations in traffic. LSTMs can remember historical information from past time steps, thus predicting future traffic changes. This time-series dependency helps distinguish different traffic patterns, such as linear growth patterns, burst traffic patterns (short-term surges), or periodic fluctuations (regular peaks and troughs). Protocol usage patterns refer to the usage and distribution of different protocols (such as TCP, UDP, HTTP, HTTPS, etc.) in the network. By analyzing the changes in the usage frequency of each protocol over different time periods, abnormal or typical traffic patterns can be identified. The dynamic trend of traffic flow refers to the overall characteristics of traffic flow over time, which can be characterized by stability, increase, fluctuation, or sudden drop.

[0078] Furthermore, by using the Support Vector Regression (SVR) algorithm, trends in historical traffic data are analyzed to predict future traffic changes. In a stable state, traffic data fluctuates little, while upward or downward trends reflect increased load or abnormal interruptions in the device under test (DUT). Fluctuating trends may indicate that the DUT is being interfered with by external environments or other systems. These trend analyses help distinguish whether the DUT is in a normal or abnormal state.

[0079] Clustering analysis is an unsupervised learning algorithm that categorizes data points into different classes based on traffic characteristic parameters, forming traffic patterns. Specifically, complex temporal dependencies, protocol usage patterns, and dynamic traffic trends extracted by AI algorithms serve as input features for clustering analysis. Complex temporal dependencies distinguish between long-term and short-term trends and periodic fluctuations; protocol usage patterns differentiate traffic behavior across different protocols in the network; and dynamic traffic trends reflect traffic stability, volatility, or anomalies. K-means clustering is used to classify the traffic characteristic parameters. K-means divides traffic data into different pattern categories by minimizing the distance between data points and their cluster centers. The clustering results can identify linear growth patterns, burst traffic patterns, and periodic fluctuation patterns. In linear growth patterns, traffic increases linearly over time, indicating a gradual increase in device load. In burst traffic patterns, traffic surges within a short period, potentially indicating network attacks or other abnormal behavior. In periodic fluctuation patterns, traffic fluctuates within fixed time intervals, typically related to peak daily usage or regular device operation.

[0080] A dynamic traffic model is constructed by combining time series models and multiple traffic patterns. Optionally, time series analysis techniques are used to model each traffic pattern, generating a dynamic model capable of predicting future traffic trends. This dynamic traffic model simulates network traffic changes under different time and load conditions, providing accurate traffic input for performance testing of the device under test.

[0081] In this embodiment, by statistically analyzing historical traffic data and extracting preliminary feature parameters, a clear description of the traffic patterns of the device under test (DUT) can be provided. Based on AI algorithms, further traffic feature data is extracted from the preliminary feature parameters, and these traffic feature data are categorized into different traffic patterns through cluster analysis. This enables rapid differentiation and understanding of the DUT's performance in varying traffic scenarios, thereby improving the accuracy of anomaly detection. Based on multiple traffic patterns and time-series models of the DUT during the testing period, a dynamic traffic model is constructed. This dynamic traffic model can adapt to the traffic characteristics of different DUTs and environments, further improving the accuracy and flexibility of anomaly detection.

[0082] In the previous exemplary embodiment, the traffic data of the device under test is analyzed by an AI algorithm to extract complex time-series dependencies, protocol usage patterns, and dynamic traffic change trends from the traffic data; based on the complex time-series dependencies, protocol usage patterns, and dynamic traffic change trends, abnormal traffic and the status of the device under test are identified.

[0083] For example, AI algorithms include Long Short-Term Memory (LSTM) networks, wavelet transform, convolutional neural networks (CNN), sliding window techniques, support vector regression (SVR), and K-means clustering algorithms. The key role of AI-driven approaches lies in automatically analyzing complex relationships and identifying patterns, including: complex temporal dependencies—through AI's time-series analysis, identifying the patterns of change in traffic data over time, including long-term trends and short-term fluctuations, which can help predict future traffic behavior; abnormal behavior patterns—AI algorithms can automatically detect abnormal patterns in historical traffic data, discovering potential abnormal traffic behavior, such as sudden traffic surges or unauthorized traffic activity; protocol usage patterns—AI not only analyzes the distribution of protocols but also identifies changes in protocol usage over different time periods or under different loads, discovering abnormal behavior at the protocol level; dynamic traffic trends—AI identifies overall trend changes through dynamic analysis of traffic data, such as the fluctuation patterns of traffic over different time periods, and trends of growth or decline; and complex temporal dependency extraction—capturing long-term trends, periodic fluctuations, and short-term anomalies in traffic data. Complex temporal dependencies primarily reflect the dynamic relationships of traffic changes over time.

[0084] Long Short-Term Memory (LSTM) networks are well-suited for handling long-term dependencies. They can remember historical information over extended periods and predict future traffic changes. LSTMs can analyze traffic data to identify long-term trends of increase or decrease; for example, they can identify that a gradual increase in traffic over a certain period may indicate that the device under test is gradually entering a high-load state. They can also capture periodic fluctuations in traffic (such as daily traffic peaks and troughs) and identify the periodic frequency through wavelet transform. Furthermore, LSTMs can be used to predict the traffic value at the next moment and analyze the deviation between the predicted and actual values ​​to identify short-term abnormal fluctuations.

[0085] Protocol usage pattern extraction identifies the types of protocols used by the device under test (DUT) over different time periods and their changes, analyzing whether the usage patterns of different protocols are normal. Deep learning models (such as Convolutional Neural Networks (CNNs)) are used to classify protocols in network packets. Protocol header information in traffic data (such as IP headers and TCP headers) can be used as input features. Specific protocol patterns are extracted using CNNs to monitor the usage frequency of different protocol types in each time period, such as the traffic share of protocols like HTTP, HTTPS, and FTP at different times. A sliding window is used to analyze changes in protocol distribution; by statistically analyzing the frequency of each protocol within the sliding window, abnormal changes are detected. For example, a DUT that typically uses HTTP but suddenly experiences a large amount of HTTPS traffic may indicate abnormal data encryption or illegal communication.

[0086] Traffic dynamics trend extraction and analysis are performed on the traffic changes of the device under test (DUT) to determine whether the traffic is stable, increasing, or fluctuating. A regression model (Support Vector Regression (SVR)) is used to predict future traffic trends. Analysis of historical traffic data trends helps determine if the DUT is gradually entering a high-load or abnormally volatile state. AI algorithms are used to classify traffic dynamics trends into: stable state, upward trend, fluctuating trend, and sudden drop trend. A stable state indicates minimal traffic fluctuation and normal operation. An upward trend indicates gradually increasing traffic, potentially indicating increased load on the DUT. A fluctuating trend indicates frequent traffic fluctuations, potentially indicating unstable operation or external interference. A sudden drop in traffic may indicate a DUT malfunction or disconnection. K-means clustering analysis is applied to identify patterns in the extracted traffic features, dividing the traffic data into different groups or pattern types. Identifying different patterns in network traffic, including normal traffic, peak traffic, and abnormal traffic, helps understand the diversity and regularity of network behavior.

[0087] In this embodiment, through deep learning and analysis of traffic data using AI algorithms such as LSTM, CNN, and SVR, the system can automatically identify traffic patterns of devices under different operating states, capturing long-term trends, periodic fluctuations, and short-term fluctuations in device traffic. This intelligent traffic pattern analysis enables the timely detection of abnormal device behavior (such as sudden traffic surges or illegal traffic activities), thereby improving the accuracy of abnormal traffic detection. Simultaneously, by integrating historical data, potential abnormal patterns can be identified, improving the accuracy and efficiency of anomaly detection, thereby enhancing the safety and stability of device use and improving user experience.

[0088] In an exemplary embodiment, the test model corresponding to the traffic data of the device under test during the test period is dynamically adjusted according to the dynamic traffic model, including: determining multiple target time periods of the device under test according to the dynamic traffic model and the preset data change range, and determining the test model corresponding to the multiple target time periods; and dynamically adjusting the test model corresponding to the traffic data of the device under test during the test period according to the test model corresponding to the multiple target time periods.

[0089] Optionally, each traffic pattern corresponds to a preset data variation range. That is, the traffic pattern corresponding to the traffic data of the device under test (DUT) during the test period can be determined based on the preset data variation range. Based on the dynamic traffic model and the preset data variation range, the traffic patterns corresponding to the DUT during the test period are determined. The time periods corresponding to each traffic pattern are set as target time periods. For example, multiple time periods corresponding to the linear growth pattern of the DUT during the test period are called linear target time periods; multiple time periods corresponding to the periodic fluctuation pattern of the DUT during the test period are called fluctuation target time periods; and multiple time periods corresponding to the burst traffic pattern of the DUT during the test period are called burst target time periods. Since each traffic pattern corresponds to a test model (i.e., the linear growth pattern corresponds to the linear growth test model), the test model corresponding to each target time period is determined based on the traffic patterns corresponding to the DUT during the test period (i.e., each target time period). Then, based on the test models corresponding to multiple target time periods, the test model corresponding to the traffic data of the DUT during the test period is dynamically adjusted.

[0090] Optionally, the flow pattern corresponding to the flow data of the device under test during the test period can be identified through cluster analysis of the dynamic flow model and time series model; the corresponding test model can be matched according to the flow pattern; the test models include linear growth test model, burst flow test model and periodic fluctuation test model.

[0091] For example, a dynamic traffic model is used to perform cluster analysis on the traffic data of the device under test to identify traffic characteristic parameters (time-series dependence, protocol usage patterns, and dynamic traffic change trends). Based on this, a time series model (LSTM) is used to predict traffic change trends and determine the traffic change patterns during the test period. This process automatically captures the time-series characteristics and pattern changes of traffic data through AI algorithms, providing accurate traffic identification for subsequent testing.

[0092] After identifying the traffic patterns of the device under test (DUT), the corresponding test model is automatically matched based on the actual traffic behavior. Each traffic pattern represents different load conditions, reflecting the DUT's performance under different environments. The test models are categorized into linear growth test models, burst traffic test models, and periodic fluctuation test models based on the DUT's current traffic status. The linear growth test model simulates a gradually increasing traffic load when a stable linear growth trend in traffic data is identified, evaluating the DUT's processing capacity and stability under progressively heavier loads. The burst traffic test model is triggered if traffic data exhibits sudden and rapid changes within a short period, simulating traffic peaks or abnormal situations to test the DUT's response speed and handling capabilities under high load impacts. The periodic fluctuation test model simulates the periodic changes in traffic when traffic data exhibits periodic fluctuations, testing the DUT's stability and performance under load fluctuations.

[0093] By matching the traffic behavior of the device under test with traffic patterns, the dynamic traffic model can comprehensively test the device under test under different load conditions. At the same time, the server can automatically generate test conditions according to each traffic pattern, that is, dynamically adjust the test model corresponding to the traffic data of the device under test during the test period.

[0094] In this embodiment, after analyzing the traffic data using a dynamic traffic model, the test period can be divided into different target time periods based on traffic patterns, with each target time period corresponding to a different test model. This dynamic adjustment of the test model based on target time periods and traffic patterns allows the device anomaly detection process to adapt to changes in traffic characteristics in real time, avoiding the forced adaptation of a single model to all situations and improving the flexibility and adaptability of device anomaly detection.

[0095] In one exemplary embodiment, such as Figure 3 As shown, the device under test is tested using multiple test models based on its traffic data during the test period, resulting in an abnormal test report for the device under test, including steps 302 to 306. Among them:

[0096] Step 302: Test the traffic data of the device under test during the test period according to multiple test models to obtain the first test index of the device under test under each test model.

[0097] Both the first and second test indices are traffic test indices, which are metrics used to quantify the performance of the device under test (DUT). The first test index includes burst traffic test index, linear growth test index, and periodic fluctuation test index. The traffic test index is calculated based on the DUT's performance data under different traffic patterns, including parameters such as latency, throughput, and packet loss rate. The traffic test index is used to evaluate whether the DUT meets expected performance standards and provides a basis for DUT optimization.

[0098] For devices under test (DUTs) with traffic data in a linear growth mode, a linear growth test model is used to perform linear growth mode testing. The linear growth mode test includes setting an initial traffic value and a growth rate; constructing a linear growth equation for the traffic data over time using a linear equation to simulate the dynamic behavior of the DUT under gradually increasing load, thereby obtaining the linear growth test index of the DUT. This linear growth test index is used to evaluate the processing capacity and stability of the DUT under gradually increasing load.

[0099] Optionally, the starting traffic value is the initial network traffic at the start of the linear growth mode test, typically set as the baseline traffic when the device under test is operating normally. The growth rate is the rate at which traffic increases over time, usually expressed as the amount of traffic increase per unit time, such as Mbps / minute. The growth rate can be set according to the actual usage scenario to simulate different load growth conditions.

[0100] To simulate the linear growth of traffic data, a linear equation is used to describe the change in traffic data over time. The form of this equation is: ,in, This represents the flow rate at time t. Let represent the initial flow rate, r be the growth rate, and t be time. This equation indicates that the flow rate increases linearly with time, increasing at a constant rate over time. The formula for calculating the linear growth test index of the device under test is as follows:

[0101]

[0102] in, This represents the linear growth test index of the device under test. This represents the average response time, which indicates how quickly the device under test responds to a gradually increasing load. This represents the response time threshold, used to measure the acceptable standard for response time. The average throughput represents the data processing capability of the device under test as the load increases. This represents the maximum throughput, specifically the maximum throughput that the device under test can achieve during the test. This represents the average packet loss rate, indicating the packet loss situation of the device under test during the test. This represents the packet loss rate threshold, used to measure the acceptable standard for packet loss rate. This represents the average CPU utilization, i.e., the CPU resource usage of the device under test during the test period. This represents the average memory usage, i.e., the memory resource usage of the device under test during the test period. This represents the maximum resource usage value, i.e., the maximum usage standard of CPU and memory, used to measure the resource utilization efficiency of the device under test. Historical performance data of smart home devices under different workload conditions are collected using network monitoring tools to obtain response time thresholds and packet loss rate thresholds.

[0103] For devices under test (DUTs) exhibiting periodic fluctuation patterns in traffic data, a periodic fluctuation test model is employed for periodic fluctuation pattern testing. This testing includes: analyzing the periodic characteristics of historical traffic data from the DUT to determine the period and frequency; using a sine function to describe the periodic fluctuations; simulating the dynamic behavior of the DUT under periodic fluctuation load conditions; and obtaining the DUT's periodic fluctuation test index, which is used to evaluate the DUT's performance and stability under periodic loads.

[0104] For example, historical traffic data can be analyzed to identify the periodic characteristics of the device under test (DUT) during its past operation. By analyzing the historical traffic data of the DUT, periodic characteristics such as the periodic variation pattern and frequency of traffic flow can be extracted. The period refers to the length of the repetition cycle of fluctuations in the data. For example, the fluctuation period of traffic data repeating every 30 minutes is 30 minutes. The frequency is the reciprocal of the period and is used to describe the speed of fluctuation. A sine function is used to describe periodic fluctuations to simulate and describe the periodic changes in traffic flow over time; the function form is... , Here, A is the flow rate at time t, A is the amplitude, representing the intensity of the periodic fluctuation, and f is the frequency, representing the periodicity of the fluctuation (the reciprocal of the period). C is the phase, representing the initial point of the fluctuation, and C is the offset, representing the baseline level of the fluctuation. The formula for calculating the periodic fluctuation test index of the device under test is as follows:

[0105]

[0106] in, This represents the periodic fluctuation test index of the smart home device under test, used to measure the resource utilization efficiency of the device. 'k' is a scalar coefficient used to amplify or reduce the impact of periodic fluctuations on the test index. In practical applications, this 'k' coefficient may be set based on the characteristics of the device under test, the network environment, or testing requirements.

[0107] For devices under test (DUT) experiencing burst traffic patterns, a burst traffic test model is used to perform burst traffic pattern testing. The burst traffic pattern test includes setting the intensity, start time, and end time of the burst traffic; using a piecewise function to describe the changes in burst traffic; simulating the dynamic behavior of the DUT under burst traffic conditions; and obtaining the burst traffic test index of the DUT to evaluate its performance and stability under burst traffic conditions.

[0108] For example, burst flow pattern testing is used to evaluate the performance and stability of the device under test (DUT) under burst flow conditions. Burst flow intensity specifies the flow value or rate of the burst, typically higher than normal flow levels. This represents the intensity of the burst flow, which usually needs to exceed the normal processing capacity of the DUT for effective testing. Start time defines the point in time when the burst flow begins, marking the start of the burst flow pattern. End time defines the point in time when the burst flow ends, marking the termination of the burst flow pattern. Piecewise functions are used to describe the changes in burst flow. These functions accurately simulate the dynamic changes in burst flow, defining the change in flow over time during the duration of the burst flow. The piecewise function is as follows:

[0109]

[0110] Where B represents the intensity of the burst traffic, Indicates the start time of the sudden traffic surge. This represents the end time of the burst traffic, where t represents the time variable. In this piecewise function, the burst traffic starts from... It begins to reach intensity B, and in The flow rate then returned to normal levels. The formula for calculating the burst flow test index of the device under test is as follows:

[0111]

[0112] in, This indicates the burst flow test index of the device under test. This represents the actual throughput at time t, reflecting the throughput performance of the device under test at different time points. The maximum throughput during the burst traffic is the highest throughput that the device under test can achieve during the burst traffic, and T is the total duration of the burst traffic, that is, the length of time the device under test experiences the burst traffic.

[0113] Step 304: Determine the weight factors corresponding to each first test index using the analytic hierarchy process.

[0114] Step 306: Calculate and process each first test index and its corresponding weight factor to obtain the second test index of the device under test.

[0115] By assigning corresponding weights to the linear growth test index, periodic fluctuation test index, and burst flow test index of the device under test using the analytic hierarchy process, the weight factors of the linear growth test index, periodic fluctuation test index, and burst flow test index, respectively, are obtained.

[0116] The linear growth test index, periodic fluctuation test index, and burst flow test index of the device under test are combined with the weighting factors of the linear growth test index, periodic fluctuation test index, and burst flow test index, respectively, to obtain the second test index of the device under test.

[0117] By establishing a hierarchical model, the linear growth test index, periodic fluctuation test index, and burst flow test index of the device under test are used as the main evaluation indicators. Expert scoring or other decision-making methods are used to assess the relative importance of these indicators, thereby determining their weighting factors.

[0118] The formula for calculating the second test index of the device under test is as follows:

[0119]

[0120] in, This represents the second test index of the device under test. This represents the weighting factor of the linear growth test index, indicating the importance of the linear growth pattern test index in the overall evaluation. This indicates the weighting factor of the cyclical volatility test index, representing the importance of the cyclical volatility pattern test index in the overall assessment. This represents the weighting factor of the burst traffic test index, indicating the importance of the burst traffic pattern test index in the overall evaluation.

[0121] In an exemplary embodiment, the method further includes: comparing a second test index of the device under test with a plurality of pre-set thresholds to determine the comparison result; and determining an abnormal test report of the device under test based on the comparison result.

[0122] The pre-set thresholds include a first threshold, a second threshold, and a third threshold.

[0123] The second test index of the device under test (DUT) is compared with multiple pre-set thresholds and marked accordingly, generating an anomaly test report for the DUT. When the second test index of the DUT is less than the first threshold but greater than the second threshold, the DUT is marked as a slightly abnormal device; when the second test index of the DUT is less than the second threshold but greater than the third threshold, the DUT is marked as a moderately abnormal device; when the second test index of the DUT is less than the third threshold, the DUT is marked as a highly abnormal device. The DUT anomaly test report includes a record of the current second test index of the DUT and the time of occurrence.

[0124] This classification helps to clarify the health status of the device under test and guides subsequent maintenance or adjustment measures. The final anomaly test report will include the second test index of the device under test and the time of its occurrence. Recording this information not only provides a basis for historical tracking of the device under test's performance but also provides important reference for subsequent fault analysis and preventative maintenance. Through such a systematic process, the performance of smart home devices can be managed and optimized more effectively.

[0125] In this embodiment, multiple test models are used to test the traffic data of the device under test (DUT). This allows for a comprehensive evaluation of the DUT's performance under different load modes (such as linear growth, periodic fluctuations, and burst traffic), enabling anomaly detection to adapt to the complex usage scenarios of the DUT and improving the flexibility of the anomaly detection method. By processing the first test index and weighting factors, a second test index is obtained, providing a unified and comprehensive performance evaluation value for the DUT. Compared to using a single model or test, this approach better balances device performance under various traffic modes, thereby improving the accuracy of the anomaly detection method.

[0126] In an exemplary embodiment, the method further includes: acquiring the response time of the device under test (DUT) to traffic changes under various traffic modes during the test period, and plotting the latency change curve of the DUT; collecting throughput data of the DUT during the test period, and plotting the throughput change curve of the DUT based on the throughput data; acquiring memory usage data of the DUT under various traffic modes during the test period, and plotting the memory usage change curve of the DUT; and testing the resource management capability of the DUT based on the latency change curve, throughput change curve, and memory usage change curve of the DUT.

[0127] During testing under different traffic patterns, analyze the response time of the device under test (DUT) to traffic changes, plot latency variation curves, and identify the impact of traffic pattern changes on latency. Analyze the throughput of the DUT over time to identify its throughput capacity and fluctuations when handling peak traffic. Analyze the packet loss rate of the DUT under different load conditions to identify patterns in packet loss and stability under peak load. Evaluate the CPU and memory utilization of the DUT under various traffic patterns to analyze resource utilization efficiency and load balancing.

[0128] Optionally, analyze the response time of the device under test (DUT) to traffic changes. Under different traffic patterns (e.g., linear growth, periodic fluctuations, burst traffic), record the time delay from the start of traffic change to the DUT beginning to process the traffic. Record the change in the DUT's response time over time and plot the latency variation curve. This latency variation curve shows the DUT's response speed to different traffic pattern changes. By analyzing the trend in the latency variation curve, understand how the DUT's response time changes when facing traffic pattern changes. For example, does the response time significantly increase when traffic increases rapidly? Evaluate the DUT's throughput and throughput fluctuations when handling peak traffic. During traffic testing, periodically record the DUT's throughput (the amount of data processed per unit time) and plot a throughput variation curve to show how the throughput changes over time. Observe the stability of the DUT's processing capacity and throughput during peak traffic periods through the throughput variation curve. Analyze the peaks, troughs, and fluctuation amplitudes of the throughput variation curve to determine the DUT's performance under peak load and the stability of its throughput. Identify patterns in packet loss and their stability under high load, recording packet loss data under different traffic patterns and load conditions. Packet loss rate is the ratio of lost packets to the total number of packets. Record packet loss rates under different load conditions. By analyzing trends in packet loss rates, identify patterns in packet loss under different traffic patterns and assess stability under peak load. Evaluate the resource utilization efficiency and load balancing of the device under test (DUT) under different traffic patterns. During traffic testing, periodically monitor the CPU and memory usage of the DUT and plot memory usage change curves, i.e., plot CPU and memory usage change curves. These curves record and plot changes in CPU and memory usage over time, displaying resource utilization efficiency, evaluating resource usage under different traffic patterns, and checking for resource bottlenecks or load imbalances. These data allow for assessment of the DUT's resource management capabilities under high load conditions.

[0129] In this embodiment, by acquiring key metrics such as latency, throughput, and memory usage under different traffic patterns, the performance of the device under test can be comprehensively evaluated. Different traffic patterns impose different loads and pressures on the device. A comprehensive evaluation of these metrics provides insight into the device's performance under various workloads. This helps identify potential bottlenecks or deficiencies under different conditions. By monitoring trends in latency, throughput, and memory usage, potential abnormal behavior or performance degradation risks can be detected promptly. For example, a sudden increase in latency may indicate network congestion or hardware bottlenecks, a decrease in throughput may indicate insufficient computing power, and excessively high memory usage may indicate uneven resource allocation or memory leaks. This ability to detect potential problems early helps reduce the risk of device failure and performance degradation.

[0130] In another embodiment, a device anomaly detection method is provided, the method comprising:

[0131] Based on historical traffic data, preliminary characteristic parameters of the device under test are extracted, and based on the preliminary characteristic parameters, traffic characteristic data of the device under test are extracted.

[0132] Data analysis is performed on traffic characteristic data to identify multiple traffic patterns of the device under test (DUT) during the test period. Based on these multiple traffic patterns and the time series model, a dynamic traffic model is determined. The dynamic traffic model includes multiple traffic patterns, each corresponding to a separate test model.

[0133] The dynamic traffic model and time series model are used to identify the traffic patterns of the device under test during the test period; the corresponding test model is matched according to the traffic pattern; the test models include linear growth test model, burst traffic test model and periodic fluctuation test model.

[0134] The device under test (DUT) is tested using multiple test models to measure traffic data during the test period, resulting in a first test index for each DUT under each test model. The weighting factor for each first test index is determined using the analytic hierarchy process (AHP). The second test index for the DUT is obtained by processing the first test index and its corresponding weighting factor.

[0135] The second test index of the device under test is compared with multiple pre-set thresholds to determine the comparison result; based on the comparison result, an abnormal test report of the device under test is determined.

[0136] The test involves acquiring the response time of the device under test (DUT) to traffic changes under various traffic modes during the test period and plotting the latency variation curve of the DUT; collecting the throughput data of the DUT during the test period and plotting the throughput variation curve of the DUT based on the throughput data; acquiring the memory usage data of the DUT under various traffic modes during the test period and plotting the memory usage variation curve of the DUT; and testing the resource management capabilities of the DUT based on the latency variation curve, throughput variation curve, and memory usage variation curve of the DUT.

[0137] In this embodiment, multiple test models are used to test the traffic data of the device under test (DUT). This allows for a comprehensive evaluation of the DUT's performance under different load modes (such as linear growth, periodic fluctuations, and burst traffic), enabling anomaly detection to adapt to the complex usage scenarios of the DUT and improving the flexibility and accuracy of the anomaly detection method. Furthermore, testing the DUT's traffic data using multiple test models allows for automatic adjustment of the anomaly detection threshold for different environments and usage scenarios, adapting to changes in device performance and ensuring effective monitoring of the device's normal operation under various conditions.

[0138] Furthermore, this application utilizes real-time data processing and analysis to quickly identify anomalies, promptly notify users, or automatically take measures to reduce the risks associated with equipment malfunctions, ensuring user safety and equipment stability. It also reduces the frequency of manual user intervention and enhances user experience through intelligent monitoring, allowing users to focus more on other aspects of life. By integrating historical and real-time data, this application identifies potential anomaly patterns in devices, thereby improving the accuracy and efficiency of anomaly detection. This provides support for long-term evaluation and optimization of device performance, helps users understand the device's usage status, and enables them to develop more reasonable usage and maintenance strategies. Moreover, by introducing advanced AI technology, smart home devices can not only perform basic functions but also possess self-monitoring and fault warning capabilities, enhancing the overall intelligence level of the smart home ecosystem.

[0139] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0140] Based on the same inventive concept, this application also provides an equipment anomaly detection device for implementing the equipment anomaly detection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more equipment anomaly detection device embodiments provided below can be found in the limitations of the equipment anomaly detection method described above, and will not be repeated here.

[0141] In one exemplary embodiment, such as Figure 4 As shown, a device for detecting equipment malfunctions is provided, comprising: an extraction module 402, a determination module 404, an adjustment module 406, and a detection module 408, wherein:

[0142] The extraction module 402 is used to acquire historical traffic data of the device under test and extract traffic feature data of the device under test based on the historical traffic data;

[0143] The determination module 404 is used to determine a dynamic traffic model based on the traffic characteristic data; wherein the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model.

[0144] The adjustment module 406 is used to dynamically adjust the test model corresponding to the traffic data of the device under test during the test period according to the dynamic traffic model;

[0145] The detection module 408 is used to test the traffic data of the device under test during the test period according to multiple test models, and to obtain an abnormal test report of the device under test.

[0146] In an exemplary embodiment, the extraction module 402 is further configured to extract preliminary feature parameters of the device under test based on the historical traffic data, and extract traffic feature data of the device under test according to the preliminary feature parameters.

[0147] In an exemplary embodiment, the determining module 404 is further configured to perform data analysis on the traffic characteristic data, identify multiple traffic patterns of the device under test during the test period, and determine a dynamic traffic model based on the multiple traffic patterns and time series model of the device under test during the test period.

[0148] In an exemplary embodiment, the detection module 408 is further configured to test the traffic data of the device under test during the test period according to multiple test models, and obtain the first test index of the device under test under each test model; determine the weight factor corresponding to each first test index by the analytic hierarchy process; and perform calculation processing on each first test index and the weight factor corresponding to each first test index to obtain the second test index of the device under test.

[0149] In an exemplary embodiment, the adjustment module 406 is further configured to compare the second test index of the device under test with a plurality of preset thresholds to determine the comparison result; and to determine an abnormal test report of the device under test based on the comparison result.

[0150] In an exemplary embodiment, the detection module 408 is further configured to determine multiple target time periods of the device under test based on the dynamic traffic model and a preset data change range, and determine test models corresponding to the multiple target time periods; and dynamically adjust the test models corresponding to the traffic data of the device under test during the test period based on the test models corresponding to the multiple target time periods.

[0151] In one exemplary embodiment, the device anomaly detection apparatus further includes:

[0152] The resource management detection module is used to acquire the response time of the device under test (DUT) to traffic changes under various traffic modes during the test period, and to plot the latency change curve of the DUT; to collect the throughput data of the DUT during the test period, and to plot the throughput change curve of the DUT based on the throughput data; to acquire the memory usage data of the DUT under various traffic modes during the test period, and to plot the memory usage change curve of the DUT; and to detect the resource management capability of the DUT based on the latency change curve, throughput change curve, and memory usage change curve of the DUT.

[0153] Each module in the aforementioned equipment anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0154] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores historical traffic data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a device anomaly detection method.

[0155] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0156] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0157] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0158] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0160] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0161] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting equipment malfunctions, characterized in that, The method includes: Acquire historical traffic data of the device under test, and extract traffic characteristic data of the device under test based on the historical traffic data; A dynamic traffic model is determined based on the traffic characteristic data; wherein, the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model; Based on the dynamic traffic model, the test model corresponding to the traffic data of the device under test during the test period is dynamically adjusted. The traffic data of the device under test during the test period is tested according to multiple test models to obtain an abnormal test report of the device under test. The method further includes: Based on the historical traffic data, preliminary feature parameters of the device under test are extracted, and traffic feature data of the device under test are extracted based on the preliminary feature parameters. Data analysis is performed on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period; Based on the multiple traffic patterns and time series models of the device under test during the test period, a dynamic traffic model is determined; The step of testing the traffic data of the device under test during the test period according to multiple test models to obtain an abnormal test report of the device under test includes: The traffic data of the device under test during the test period is tested according to multiple test models to obtain the first test index of the device under test under each test model. The weighting factors corresponding to each of the first test indices are determined by the analytic hierarchy process. The second test index of the device under test is obtained by performing calculations on each of the first test indices and the weighting factors corresponding to each of the first test indices. The method further includes: The second test index of the device under test is compared with multiple pre-set thresholds to determine the comparison result; Based on the comparison results, an abnormal test report for the device under test is determined.

2. The method according to claim 1, characterized in that, The step of performing data analysis on the traffic characteristic data to identify multiple traffic patterns of the device under test during the test period includes: using cluster analysis on the traffic characteristic data to identify the multiple traffic patterns.

3. The method according to claim 1, characterized in that, The preliminary characteristic parameters include average flow intensity, peak flow time, protocol distribution, and flow volatility.

4. The method according to claim 3, characterized in that, The traffic characteristic data includes complex time-series dependencies, protocol usage patterns, and dynamic trends in traffic changes.

5. The method according to claim 1, characterized in that, The step of dynamically adjusting the test model corresponding to the traffic data of the device under test during the test period according to the dynamic traffic model includes: Based on the dynamic traffic model and the preset data change range, multiple target time periods are determined for the device under test, and test models corresponding to the multiple target time periods are determined. Based on the test models corresponding to multiple target time periods, the test models corresponding to the traffic data of the device under test during the test period are dynamically adjusted.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the response time of the device under test to changes in traffic flow under different traffic flow modes during the test period, and plot the delay change curve of the device under test; Collect throughput data of the device under test during the test period, and plot the throughput change curve of the device under test based on the throughput data; Obtain the memory usage data of the device under test under various traffic modes during the test period, and plot the memory usage change curve of the device under test; The resource management capability of the device under test is tested based on the latency change curve, throughput change curve, and memory usage change curve of the device under test.

7. A device for detecting equipment malfunctions, characterized in that, The device includes: The extraction module is used to acquire historical traffic data of the device under test and extract traffic feature data of the device under test based on the historical traffic data; The determination module is used to determine a dynamic traffic model based on the traffic characteristic data; wherein the dynamic traffic model includes multiple traffic patterns, and each traffic pattern corresponds to a test model; The adjustment module is used to dynamically adjust the test model corresponding to the traffic data of the device under test during the test period according to the dynamic traffic model; The detection module is used to test the traffic data of the device under test during the test period according to multiple test models, and to obtain an abnormal test report of the device under test. The extraction module is also used to extract preliminary feature parameters of the device under test based on the historical traffic data, and to extract traffic feature data of the device under test based on the preliminary feature parameters; The determining module is further configured to perform data analysis on the traffic characteristic data, identify multiple traffic patterns of the device under test during the test period, and determine a dynamic traffic model based on the multiple traffic patterns and time series model of the device under test during the test period. The detection module is also used to test the traffic data of the device under test during the test period according to multiple test models, and obtain the first test index of the device under test under each test model; determine the weight factor corresponding to each first test index by the analytic hierarchy process; and perform calculation processing on each first test index and the weight factor corresponding to each first test index to obtain the second test index of the device under test. The adjustment module is also used to compare the second test index of the device under test with a number of pre-set thresholds to determine the comparison result; and to determine the abnormal test report of the device under test based on the comparison result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images