Abnormity alarm method based on improved anomaly detection algorithm

Abstract

The invention belongs to the field of detection algorithms, and particularly relates to an anomaly alarm method based on an improved anomaly detection algorithm, which comprises the following steps: carrying out data acquisition work on an index source to obtain real-time index data, and storing historical index data of a to-be-calculated threshold and the real-time index data; according to a manually set threshold value A, weighting the historical index data in the threshold value A, carrying out anomaly detection on the historical index data based on a weighted anomaly detection algorithm, calculating to obtain a threshold value B, and outputting a data anomaly label according to the threshold value B; judging the index type of the historical index data, obtaining an alarm threshold range according to the index type, and storing the alarm threshold range; and extracting real-time index data and an alarm threshold range, and triggering alarm information when any kind of index data is within the alarm threshold range. According to the method, automatic calculation and updating of the index threshold are achieved, and the problem that the calculated threshold exceeds a reasonable interval due to the fact that the standard deviation is large when fluctuation of historical data of the index is large is avoided.

Description

Technical Field

[0001] The present invention belongs to the field of detection algorithms, and in particular relates to an abnormality alarm method based on an improved abnormality detection algorithm. Background Art

[0002] Anomaly detection is the process of identifying data points in a dataset or system that fall outside of normal ranges. During data analysis, or through machine learning algorithms, anomaly detection flags instances in the bulk of the data that do not conform to a regular pattern or statistical model. Anomalies can appear as outliers, unexpected changes, or errors, depending on the type of data being analyzed and any predefined parameters set. Anomaly detection is useful because it can quickly and effectively pinpoint potential problems or threats and maintain the integrity and reliability of the system.

[0003] At present, the confirmation of indicator thresholds is generally done manually based on experience. Here, indicators generally refer to corresponding indicators for monitoring service status and quality in information services, such as service availability, delay rate, etc. When there is a problem with service quality, the corresponding indicators will also decline, triggering threshold alarms to remind relevant personnel to perform maintenance and keep the system running at a high service quality. The general process is to first specify a standard threshold based on service requirements, and then adjust each threshold based on actual conditions during the operation of the system, and finally obtain a relatively complete indicator threshold system.

[0004] When the number of indicators is small or the indicators do not change much, it is more feasible to manually specify the thresholds. However, when the number of indicators that need to be monitored is large, for example, there are thousands of indicators that need to be monitored and updated regularly, it is difficult for humans to efficiently confirm the thresholds.

[0005] Chinese invention patent specification CN202211665482 discloses a method for confirming alarm thresholds through historical data, and its main technical features are: according to the historical sampling data of the indicator, the statistical value standard deviation is calculated as the basis for threshold calculation. This method confirms the initial alarm threshold range by sampling the historical indicator data in the standard time dimension and the specific time dimension, and then adjusts the initial alarm threshold range in combination with the data confirmed by the special scenario alarm, so as to obtain an alarm threshold range that meets the special scenario and exceeds the reasonable range, thereby reducing false alarms and achieving the purpose of accurate alarms. However, when the historical indicators fluctuate greatly, the standard deviation obtained is large. At this time, the threshold calculated based on the baseline value and the standard deviation will seriously exceed the normal situation, so it is not suitable for scenarios with large indicator fluctuations. Summary of the invention

[0006] In view of the shortcomings of the above-mentioned prior art, when there are a large number of indicators to be monitored, the workload of setting thresholds based on manual experience is large and the update speed is slow; when the standard deviation of statistical indicators is used to determine the threshold, the standard deviation is large when the historical data fluctuates greatly, and the calculated threshold exceeds the reasonable range. The problem to be solved by the present disclosure is to provide an abnormal alarm method based on an improved abnormal detection algorithm, including:

[0007] Perform data collection on the indicator source to obtain real-time indicator data, and store historical indicator data and real-time indicator data for calculating the threshold; the historical indicator data is a set of N types of indicator data collected from the same indicator source;

[0008] According to the manually set threshold A, the historical indicator data within the threshold A are weighted, and the historical indicator data outside the threshold A are kept default; the threshold A includes N thresholds, corresponding to the N types of indicator data in the historical indicator data;

[0009] Perform anomaly detection on historical indicator data based on a weighted anomaly detection algorithm, calculate the threshold B, output the data anomaly label according to the threshold B, and obtain the normal value data of the historical indicator data;

[0010] Determine the indicator type of the historical indicator data, obtain the alarm threshold range based on the data anomaly label according to the indicator type, and store the alarm threshold range;

[0011] Extract real-time indicator data and alarm threshold ranges. When any indicator data is within the alarm threshold range, an alarm message is triggered.

[0012] The weighted anomaly detection algorithm includes: weighted data = original data × weight.

[0013] The indicator types include: interval indicators, positive indicators, and negative indicators.

[0014] Determining the alarm threshold range according to the indicator type includes:

[0015] When the indicator type is an interval indicator, the maximum value of the normal value data is used as the upper threshold limit, the minimum value is used as the lower threshold limit, and the alarm threshold range is the range above the upper threshold limit and below the lower threshold limit;

[0016] When the indicator type is a positive indicator, the minimum value of the normal value data is used as the lower limit of the threshold, and the alarm threshold range is the range below the lower limit of the threshold;

[0017] When the indicator type is a negative indicator, the maximum value of the normal value data is used as the upper threshold limit, and the alarm threshold range is the range above the upper threshold limit;

[0018] If any of the historical indicator data is the same in the historical period, it is determined whether it is a normal value according to the manually set threshold A. If they are all outside the threshold A, they will not be used and an alarm message will be triggered; if they are all within the threshold A, the alarm threshold range of the indicator is determined according to the indicator type:

[0019] When the indicator type is an interval indicator, the alarm threshold range is the range outside the same historical indicator data within the historical time period;

[0020] When the indicator type is a positive indicator, the alarm threshold range is the range below the same historical indicator data within the historical time period;

[0021] When the indicator type is a negative indicator, the alarm threshold range is a range above the same historical indicator data within the historical time.

[0022] In a second aspect, the present invention further provides a system for the abnormal alarm method, characterized in that it includes:

[0023] The monitoring indicator collection module is used to automatically collect the monitoring indicators of the monitored object according to the preset collection frequency, collection object, etc., and transmit them to the data storage module for subsequent analysis.

[0024] The data storage module is used to undertake data storage work. On the one hand, it stores the indicator data from the acquisition module, and on the other hand, it stores the alarm threshold range after calculation and analysis for use by the monitoring alarm module.

[0025] The task scheduling module is used to automatically schedule task execution according to pre-set task execution information, including extracting historical data from data storage, calculating thresholds, storing thresholds in storage modules, etc.

[0026] The monitoring alarm module is used to regularly extract the alarm threshold range from the data storage server as the alarm information trigger threshold. At the same time, it regularly extracts real-time indicator data from the data storage module and compares it with the alarm threshold. If it is within the alarm threshold range, an alarm is triggered.

[0027] The threshold calculation module is used to process the indicator historical data according to the threshold calculation algorithm and the indicator historical data, and calculate the threshold corresponding to the indicator, and derive the alarm threshold range based on the indicator type, and finally store the alarm threshold range in the output storage module.

[0028] Compared with the prior art, the present invention can achieve the following technical effects:

[0029] 1. The present invention realizes the automatic calculation and update of indicator thresholds, which can be applied to the automatic calculation scenarios of large-scale monitoring of various types of indicators. By improving the weight part in the anomaly detection algorithm, artificial prior experience is introduced to make the abnormal label interval output by the algorithm closer to the normal value range, avoiding the output indicator threshold from deviating from the reasonable range when there are many abnormal values.

[0030] 2. When obtaining the indicator alarm threshold, the present invention uses the indicator historical data to perform anomaly detection, identifies the normal value interval in the indicator according to the result of the anomaly detection, and sets the indicator threshold according to the normal value interval of the indicator. This avoids the problem that the standard deviation is large when the indicator historical data fluctuates greatly, which leads to the calculated threshold exceeding the reasonable interval. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A framework diagram of an abnormality alarm system according to a preferred embodiment of the present invention;

[0032] Figure 2 A flowchart of an abnormal alarm method according to a preferred embodiment of the present invention;

[0033] Figure 3 The present invention is a flowchart of an abnormality alarm method based on an improved abnormality detection algorithm according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0034] The best mode of implementation of the present invention is described below by way of example. It should be understood that the specific embodiments herein are used to explain the present invention in detail and should not be construed as limiting the present invention. It should be noted that various changes and modifications may be made under the premise of following the principles and core scope of the present invention, and these changes should all be deemed to be within the scope of protection of the present invention. In conjunction with the accompanying drawings, the specific implementation steps of the present invention are described in detail.

[0035] The embodiments of this specification provide an abnormality detection method and device. The system architecture of the embodiments of this specification is first described below.

[0036] Figure 1 The overall system framework of the abnormality alarm method based on the improved abnormality detection algorithm of the present invention is shown in FIG. Figure 1 As shown, the system may include:

[0037] Monitoring indicator collection module:

[0038] The monitoring indicator collection module automatically collects the monitoring indicators of the monitored object according to the preset collection frequency, collection object, etc., and transmits them to the data storage module for subsequent analysis.

[0039] Among them, the monitoring objects are generally the service status and quality of information services, and the monitoring indicators are the corresponding service availability, delay rate and other data. The collection frequency should not be too low to calculate the appropriate threshold in anomaly detection.

[0040] Data storage module:

[0041] The data storage module is responsible for data storage. On the one hand, it stores the indicator data from the acquisition module, and on the other hand, it stores the alarm threshold range after calculation and analysis for use by the monitoring alarm module.

[0042] Task scheduling module:

[0043] The task scheduling module automatically schedules task execution according to the pre-set task execution information, including extracting historical data from the data storage, calculating thresholds, and storing thresholds in the storage module.

[0044] Monitoring and alarm module:

[0045] The monitoring alarm module regularly extracts the alarm threshold range from the data storage server as the alarm information trigger threshold. At the same time, it regularly extracts real-time indicator data from the data storage module and compares it with the alarm threshold. If it is within the alarm threshold range, an alarm is triggered.

[0046] Threshold calculation module:

[0047] The threshold calculation module processes the indicator historical data according to the threshold calculation algorithm and the indicator historical data, calculates the threshold corresponding to the indicator, derives the alarm threshold range based on the indicator type, and finally stores the alarm threshold range in the output storage module.

[0048] The specific implementation of the abnormality alarm method of the present invention is described below in conjunction with the abnormality detection process. Figure 2 The abnormal alarm method process based on the improved abnormal detection algorithm includes:

[0049] Step S1: collect data from the indicator source to obtain real-time indicator data, and store historical indicator data and real-time indicator data for calculating the threshold; the historical indicator data is a set of N types of indicator data collected from the same indicator source;

[0050] Step S11: The task scheduling module sends a collection command to notify the collection module.

[0051] Step S12: After receiving the command, the collection module collects data from the indicator source and stores it in the database at the same time.

[0052] Specifically, the collection module automatically collects monitoring indicators of the monitored object according to the preset collection frequency, collection object, etc., and transmits them to the data storage module for subsequent analysis.

[0053] The collected monitoring indicator data are generally corresponding indicators for monitoring service status, quality, etc. in information services, including but not limited to historical indicator data and real-time indicator data such as delay rate, compliance rate, and completeness rate that require abnormality detection.

[0054] Step S2: according to the threshold value A corresponding to the N indicators set manually, weight the historical indicator data within the threshold value A, and keep the historical indicator data outside the threshold value A as default;

[0055] In a specific embodiment, the specific steps of S2 are:

[0056] Step S21: The task scheduling module notifies the threshold calculation module to perform threshold calculation according to the scheduled task.

[0057] Step S22: Obtain historical indicator source data for the threshold to be calculated;

[0058] After receiving the corresponding notification, the threshold calculation module actively initiates data extraction and obtains basic data.

[0059] The historical source data of the indicator to be calculated for the anomaly detection threshold in the storage module is obtained. Generally, at least one period of historical data is required.

[0060] The collected data may include historical indicator data such as delay rate, compliance rate, and completeness rate that require anomaly detection.

[0061] Step S23: pre-processing the source data to obtain historical indicator data;

[0062] The threshold calculation module preprocesses the source data, removes irrelevant data, such as empty data, text data, etc., and forms a data set.

[0063] Step S24: Determine whether the historical indicator data is the same value. If any of the historical indicator data is the same within the historical time, determine whether the historical indicator data is a normal value according to the manually set threshold A. If it is outside the threshold A, it will not be used, and notify the alarm module to trigger the alarm information.

[0064] If both are within threshold A, perform the following steps:

[0065] Step S25: determining the indicator type of the historical indicator data;

[0066] Among them, indicator types include positive indicators, negative indicators and interval indicators.

[0067] Among them, positive indicators refer to indicators whose higher values ​​indicate better performance, negative indicators refer to indicators whose lower values ​​indicate better performance, and interval indicators refer to indicators whose values ​​within a fixed interval are considered to be the best data.

[0068] For example, the compliance rate is a positive indicator, the delay rate is a negative indicator, and a parameter that is neither too large nor too small is an interval indicator.

[0069] Step S26: If the historical indicator data and historical time are the same value and are both within the threshold A, the alarm threshold range of the indicator is determined according to the indicator type, and the threshold calculation module stores the alarm threshold range in the monitoring alarm module:

[0070] When the indicator type is an interval indicator, the alarm threshold range is the range outside the historical indicator data;

[0071] When the indicator type is a positive indicator, the alarm threshold range is the range below the historical indicator data;

[0072] When the indicator type is a negative indicator, the alarm threshold range is taken as the range above the historical indicator data.

[0073] Step S3: Perform anomaly detection on the historical indicator data based on a weighted anomaly detection algorithm, calculate a threshold value B, output a data anomaly label according to the threshold value B, and obtain normal value data of the historical indicator data;

[0074] In a specific embodiment, if the historical indicator data has different values ​​in the historical time, the threshold calculation module executes step S3, which includes:

[0075] Step S31: The default weight of historical data is 1. The data within threshold A is weighted according to the manually set threshold A, weighted data = original data × weight, and the data outside threshold A remains default.

[0076] Step S32: Perform anomaly detection on the historical indicator data according to the anomaly detection algorithm and output data anomaly labels;

[0077] Specifically, the anomaly detection algorithm may be a commonly used anomaly detection algorithm such as a clustering-based method or a statistics-based method.

[0078] In one embodiment of the present invention, the anomaly detection algorithm used is the isolation forest algorithm, which is as follows:

[0079] A certain number of samples are randomly selected from the entire historical data set to form a subsampling set in preparation for building the tree.

[0080] It should be noted that the size of the sub-sampling set is usually much smaller than the size of the original historical data set, which can limit the size of the tree and reduce the computational complexity.

[0081] For each sub-sampling set, a tree is constructed, namely:

[0082] For the historical indicator data in the sub-sampling set, at each node, the algorithm randomly selects a split value and divides the sample into the left subtree or the right subtree according to this split value. This operation is repeated in the subtree until the tree reaches a specified height, the number of samples in the node reaches a certain number, or the values ​​of all samples are the same.

[0083] For example: For the historical indicator data in the sub-sampling set, at each node, the algorithm randomly selects a split value, and the historical indicator data less than the split value is divided into the left subtree, and the historical indicator data greater than the split value is divided into the right subtree. In the left subtree and the right subtree, the split is continued, and the historical indicator data less than the split value is divided into the left subtree of the subtree, and the historical indicator data greater than the split value is divided into the right subtree of the subtree. Repeat the operation until the tree reaches a specified height, the number of samples in the node reaches a certain number, or the values ​​of all samples are the same.

[0084] It should be noted that the reason why the height of the tree is limited is that points with shorter path lengths are more likely to be outliers, while normal points with long path lengths are not the focus of anomaly detection.

[0085] Since the cutting process of each tree training is completely random, it is necessary to build several more trees and then calculate the average value of each tree's cutting results to make the results converge. After building a specific number of isolated trees according to the above steps, the collection is called an isolation forest.

[0086] The path length of the indicator data in each isolated tree is calculated, and the average path length is calculated to obtain the anomaly score of each data point.

[0087] Among them, the anomaly score s is calculated by the following formula:

[0088]

[0089] Where h(x) is the height of an indicator data in a tree, that is, how many edges are needed from the root node of the tree to reach the leaf node.

[0090] E(h(x)) is the average height of the indicator data x in all trees. The lower the height, the higher the anomaly score.

[0091] c(n) is the average value of the path length when the number of samples in the subsample set is n, and is used to standardize the path length h(x) of the indicator data x.

[0092] If E(h(x))→0, then s→1, which means that the average height of the x data point in all trees is close to 0. Since the data that is isolated earlier, that is, the data closer to the root node, is more likely to be abnormal, it can be considered an outlier.

[0093] Similarly, when E(h(x))→n-1, then s→0, which means that the average height of the x data point in all trees approaches n-1. The data point approaches the bottom of the tree, that is, the maximum depth, so it is not easy to be isolated and can be considered a normal point.

[0094] According to the calculated anomaly score, set the anomaly score threshold B to determine which data points are abnormal.

[0095] For abnormal data, output the data abnormality label.

[0096] Step S4: determining the indicator type of the historical indicator data, obtaining an alarm threshold range based on the indicator type and the data anomaly label, and storing the alarm threshold range;

[0097] In a specific embodiment, the specific steps of S4 include:

[0098] Step S41: determining the indicator type of the historical indicator data;

[0099] Among them, indicator types include positive indicators, negative indicators and interval indicators.

[0100] Among them, positive indicators refer to indicators whose higher values ​​indicate better performance, negative indicators refer to indicators whose lower values ​​indicate better performance, and interval indicators refer to indicators whose values ​​within a fixed interval are considered to be the best data.

[0101] Step S42: Calculate the threshold value based on the indicator type and whether the historical data of the indicator is the same within the historical time period, and output the alarm threshold range.

[0102] If the historical data of the indicator is different within the historical period, determine the alarm threshold range according to the indicator type:

[0103] When the indicator type is an interval indicator, the maximum value of the normal value data is used as the upper threshold limit, the minimum value is used as the lower threshold limit, and the alarm threshold range is the range above the upper threshold limit and below the lower threshold limit;

[0104] When the indicator type is a positive indicator, the minimum value of the normal value data is used as the lower limit of the threshold, and the alarm threshold range is the range below the lower limit of the threshold;

[0105] When the indicator type is a negative indicator, the maximum value of the normal value data is used as the upper threshold limit, and the alarm threshold range is the range above the upper threshold limit;

[0106] Step S5: extract real-time indicator data and alarm threshold range, and trigger alarm information when any indicator data is within the alarm threshold range.

[0107] In a specific embodiment, the monitoring alarm module periodically extracts real-time indicator data and alarm threshold ranges from the storage module, and triggers alarm information based on a comparison result between the two.

[0108] When any indicator result is within the alarm threshold range, an alarm message is triggered.

[0109] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An abnormality alarm method based on an improved abnormality detection algorithm, characterized in that: include: Perform data collection on the indicator source to obtain real-time indicator data, and store historical indicator data and real-time indicator data for calculating the threshold; the historical indicator data is a set of N types of indicator data collected from the same indicator source; According to the manually set threshold A, the historical indicator data within the threshold A are weighted, and the historical indicator data outside the threshold A are kept default; the threshold A includes N thresholds, corresponding to the N types of indicator data in the historical indicator data; Perform anomaly detection on the historical indicator data based on a weighted anomaly detection algorithm, calculate a threshold value B, output a data anomaly label according to the threshold value B, and obtain normal value data in the historical indicator data; the threshold value B includes N threshold values ​​corresponding to N types of indicator data in the historical indicator data; Determine the indicator type of the historical indicator data, obtain the alarm threshold range based on the data anomaly label according to the indicator type, and store the alarm threshold range; Extract real-time indicator data and alarm threshold ranges. When any indicator data is within the alarm threshold range, an alarm message is triggered.

2. The method according to claim 1, characterized in that: The step of weighting the historical indicator data within the threshold A specifically includes: The weighted data is the result of original data*weight.

3. The method according to claim 1, characterized in that The indicator types include: interval indicators, positive indicators, and negative indicators.

4. The method according to claim 1, characterized in that: The step of determining the alarm threshold range according to the indicator type specifically includes: When the indicator type is an interval indicator, the maximum value of the normal value data is used as the upper threshold limit, the minimum value is used as the lower threshold limit, and the alarm threshold range is the range above the upper threshold limit and below the lower threshold limit; When the indicator type is a positive indicator, the minimum value of the normal value data is used as the lower limit of the threshold, and the alarm threshold range is the range below the lower limit of the threshold; When the indicator type is a negative indicator, the maximum value of the normal value data is used as the upper threshold limit, and the alarm threshold range is the range above the upper threshold limit.

5. The method according to claim 1, characterized in that If any of the historical indicator data is the same in the historical period, it is determined whether it is a normal value according to the manually set threshold A. If they are all outside the threshold A, they will not be used and an alarm message will be triggered; if they are all within the threshold A, the alarm threshold range of the indicator is determined according to the indicator type: When the indicator type is an interval indicator, the alarm threshold range is the range outside the same historical indicator data within the historical time period; When the indicator type is a positive indicator, the alarm threshold range is the range below the same historical indicator data within the historical time period; When the indicator type is a negative indicator, the alarm threshold range is a range above the same historical indicator data within the historical time.

6. A system for the abnormal alarm method according to claim 1, characterized in that: include: The monitoring indicator collection module is used to automatically collect the monitoring indicators of the monitored object according to the preset collection frequency, collection object, etc., and transmit them to the data storage module for subsequent analysis. The data storage module is used to undertake data storage work. On the one hand, it stores the indicator data from the acquisition module, and on the other hand, it stores the alarm threshold range after calculation and analysis for use by the monitoring alarm module. The task scheduling module is used to automatically schedule task execution according to pre-set task execution information, including extracting historical data from data storage, calculating thresholds, storing thresholds in storage modules, etc. The monitoring alarm module is used to regularly extract the alarm threshold range from the data storage server as the alarm information trigger threshold. At the same time, it regularly extracts real-time indicator data from the data storage module and compares it with the alarm threshold. If it is within the alarm threshold range, an alarm is triggered. The threshold calculation module is used to process the indicator historical data according to the threshold calculation algorithm and the indicator historical data, and calculate the threshold corresponding to the indicator, and derive the alarm threshold range based on the indicator type, and finally store the alarm threshold range in the output storage module.

Images