Sequence detection method and device, equipment, storage medium and product

Abstract

The invention discloses a sequence detection method and device, equipment, a storage medium and a product. The method comprises the following steps: dividing a time sequence to be measured into a plurality of subsequences; for any sub-sequence in the plurality of sub-sequences, respectively training and evaluating a plurality of to-be-selected models, determining a first model corresponding to each sub-sequence, and obtaining a plurality of first models; executing a selection action on each model in the plurality of first models by utilizing each subsequence; taking the model which receives the most selection times in the plurality of first models as a target model; and carrying out anomaly detection on the to-be-detected time sequence by adopting the target model. According to the embodiment of the invention, the accuracy of time sequence anomaly detection is improved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a sequence detection method, device, equipment, storage medium and product. Background Art

[0002] In the field of information technology operation and maintenance, time series anomaly detection is of great significance. Various indicators in information technology systems, such as server load, network traffic, CPU utilization, etc., can be expressed as time series data that changes over time. By performing anomaly detection on these data, potential faults, errors or abnormal situations can be discovered in a timely manner, thereby ensuring the stability and reliability of the system.

[0003] There are many time series detection methods at present, including methods based on statistical analysis and hypothesis testing; methods based on machine learning such as support vector machines and isolation forests; methods based on recursive neural networks and variational autoencoders; these methods provide a variety of technologies to detect anomalies in time series according to the characteristics of the data and application requirements.

[0004] In practical applications, the anomaly detection models of the above time series detection methods are usually single and cannot flexibly adapt to different types of time series data and anomalies. Due to the presence of various noises and interferences in actual data, it is usually necessary to manually select the model, which is a time-consuming and professional work. The manual intervention in the selection of models is subjective and uncertain, and it is difficult to accurately reflect the characteristics and patterns of the above data, resulting in inaccurate time series anomaly detection. Summary of the invention

[0005] The embodiments of the present application provide a sequence detection method, apparatus, device, storage medium and product to solve the problem of inaccurate time series anomaly detection.

[0006] In a first aspect, an embodiment of the present application provides a sequence detection method, the method comprising:

[0007] Divide the time series to be tested into multiple subsequences;

[0008] For any subsequence among the multiple subsequences, respectively train and evaluate the multiple models to be selected, determine the first model corresponding to each subsequence, and obtain multiple first models;

[0009] Using each of the subsequences, performing a selection action on each of the plurality of first models;

[0010] The model that receives the most selection times among the plurality of first models is used as the target model;

[0011] The target model is used to perform anomaly detection on the time series to be tested.

[0012] In a second aspect, an embodiment of the present application provides a sequence detection device, the device comprising:

[0013] A division module is used to divide the time series to be tested into multiple subsequences;

[0014] A training module, used for training and evaluating the multiple models to be selected for any subsequence among the multiple subsequences, determining the first model corresponding to each subsequence, and obtaining multiple first models;

[0015] A selection module, configured to perform a selection action on each model of the plurality of first models using each subsequence;

[0016] A determination module, configured to use the model that receives the most selection times among the plurality of first models as a target model;

[0017] The detection module is used to use the target model to perform anomaly detection on the time series to be tested.

[0018] In a third aspect, an embodiment of the present application provides a terminal device, the device comprising: a processor and a memory storing computer program instructions;

[0019] When the processor executes the computer program instructions, the sequence detection method of the first aspect is implemented.

[0020] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the sequence detection method of the first aspect is implemented.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the sequence detection method of the first aspect.

[0022] The sequence detection method provided in the embodiment of the present application divides the time series to be tested into multiple subsequences, and then performs model training and evaluation on the multiple subsequences respectively, obtains multiple first models corresponding to the multiple subsequences, and then performs mutual voting selection from the multiple first models, and selects the model with the largest number of votes as the target model, so as to quickly and accurately select a model suitable for the time series to be tested, and reduce the cost of manual model selection. It can improve the performance of the target model, reduce manual intervention, and thus improve the accuracy of time series anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 It is a flow chart of the sequence detection method provided in the embodiment of the present application;

[0025] Figure 2 It is a schematic diagram of the flow of model selection in the sequence detection method provided in the embodiment of the present application;

[0026] Figure 3 It is a schematic diagram of a decision tree in the sequence detection method provided in an embodiment of the present application;

[0027] Figure 4 is a flow chart of model tuning in the sequence detection method provided in the embodiment of the present application;

[0028] Figure 5 is a structural schematic diagram of a sequence detection device provided in an embodiment of the present application;

[0029] Figure 6 It is a schematic diagram of the structure of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0031] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0032] In order to solve the problems of the prior art, the embodiments of the present application provide a sequence detection method, apparatus, device, storage medium and product.

[0033] The following first introduces the sequence detection method provided in the embodiments of the present application.

[0034] Figure 1 FIG. 1 is a flow chart of a sequence detection method provided by an embodiment of the present application. Figure 1 As shown, the method includes:

[0035] Step 101, dividing the time series to be tested into multiple subsequences;

[0036] In this embodiment, the time series to be measured may be various indicators in an IT system represented by time series data that changes over time, such as server load, network traffic, central processing unit utilization, and the like.

[0037] Step 102: for any subsequence among the multiple subsequences, respectively train and evaluate multiple models to be selected, determine a first model corresponding to each subsequence, and obtain multiple first models;

[0038] In this embodiment, the above-mentioned models to be selected may include a periodic median model, a kernel density estimation model, and an isolation forest model. For each subsequence, the same subsequence may be used to train multiple models to be selected, thereby obtaining multiple second models corresponding to each subsequence, and then the performance of the multiple second models is evaluated, and a model with the best performance is selected from the multiple second models as the first model of the subsequence.

[0039] The following is an explanation of the selected model:

[0040] Cycle Median Model: The cycle median model divides the time series data into cycles and calculates the median within the cycle, using the robustness of the median to resist the influence of outliers. The difference between the observed value and the cycle median is calculated, and a threshold is set to determine whether there is an anomaly. This method is suitable for periodic data and can effectively detect and identify anomalies for data containing periodic anomalies.

[0041] Kernel density estimation model: The kernel density estimation model estimates the probability density of the data and smoothes the density using the kernel function. The abnormality of the observed value is determined by setting a threshold or comparing it with the overall distribution. This method is suitable for non-periodic data and does not make assumptions about the distribution of the data, so it has certain universality and flexibility.

[0042] Isolation Forest Model: The Isolation Forest Model constructs a random binary tree to determine the degree of abnormality of observations in the feature space. It uses the isolation principle, and outliers are often more easily isolated. This method is suitable for multidimensional data and has good scalability and computational efficiency for large data sets.

[0043] Step 103, using each subsequence, performing a selection action on each model in the plurality of first models;

[0044] Step 104, taking the model that receives the most selection times among the multiple first models as the target model;

[0045] In this embodiment, once the best model is selected for each subsequence, a majority voting step can be performed, in which the first model of each subsequence is considered as an option, and then the first models of all subsequences are voted. Finally, the model with the most votes is selected as the best model for the entire time series, i.e., the target model.

[0046] Step 105: Use the target model to perform anomaly detection on the time series to be tested.

[0047] The sequence detection method provided in the embodiment of the present application divides the time series to be tested into multiple subsequences, and then performs model training and evaluation on the multiple subsequences respectively, obtains multiple first models corresponding to the multiple subsequences, and then performs mutual voting selection from the multiple first models, and selects the model with the largest number of votes as the target model, so as to quickly and accurately select a model suitable for the time series to be tested, and reduce the cost of manual model selection. It can improve the performance of the target model, reduce manual intervention, and thus improve the accuracy of time series anomaly detection.

[0048] In one embodiment of the present application, dividing the time series to be measured into a plurality of subsequences includes:

[0049] Obtaining a reference value of a data value corresponding to each first time point in the time series to be measured;

[0050] For any first time point in each time point, determining the difference between the data value and the reference value as the deviation of the first time point;

[0051] According to the order of each time point, the deviations are accumulated in sequence until, when the accumulated deviation is greater than a preset threshold, a second time point corresponding to the accumulated deviation is determined as a change point, and the step of accumulating the deviations in sequence according to the order of each time point is performed again with the second time point as the starting point until all the change points of the time series to be measured are obtained;

[0052] Performing a genetic algorithm search according to all the change points and the data values ​​of all the change points to obtain a plurality of target segmentation points of the time series to be measured;

[0053] The time series to be measured is divided into a plurality of subsequences according to the plurality of target segmentation points.

[0054] In this embodiment, the time series to be tested is composed of time points and data values ​​corresponding to the time points. The reference value is the mean of the data values ​​at the corresponding time points. The time series to be tested T can be expressed as T = t1, t2, ...t i ,...,t n .

[0055] Specifically, the first formula may be used to calculate the reference value of the data value corresponding to each time point in the time series to be measured;

[0056] The first formula is:

[0057] m i =m i-1 +(t i -m i-1 ) / i

[0058] Among them, m i is the reference value of the data value corresponding to the i-th time point, m i-1 is the reference value of the data value corresponding to the i-1th time point, t i is the data value corresponding to the i-th time point, where i is the time point.

[0059] In addition, it should be noted that when i is 1, m1 is t1.

[0060] After determining the reference value at each time point, the deviation at each time point is calculated and accumulated. When the cumulative sum of the deviations exceeds the set threshold, the corresponding second time point is determined to be a change point, and the deviation accumulation starts again from the second time point until all change points are identified.

[0061] Among them, the deviation e i This can be calculated as follows:

[0062] e i =t i -m i ;

[0063] t i is the data value, m i is the reference value.

[0064] After all the change points are identified, k is used to represent all the change points. Since the change points must also meet the condition that there are data values ​​before and after them, the last point in the time series to be tested will not be determined as a change point. The time series to be tested can be divided into k+1 segments, and the position of each change point is (x1, x2, ... x k ), the corresponding data values ​​are (y1,y2,...y k+1 ), establish the following function, and minimize this function as the goal:

[0065]

[0066] Among them, x1,x2,...x k are the change points, y1,y2,...y k+1 is the data value corresponding to the change point, t i is the i-th time point.

[0067] For the objective function established in the above steps, a genetic algorithm search is performed on a total of 2k+1 parameters, namely, the change points and data values ​​(x1, x2, ... xk, y1, y2, ... yk+1). The population initialization positions are randomly distributed on the k change point positions and their corresponding original sequence values.

[0068] The searched optimal parameters (x1, x2, ... xk) are output as the target segmentation points.

[0069] In this embodiment, the time series to be tested is segmented by the above-mentioned change point optimal approximation method, which provides more refined data support for subsequent model selection and model tuning and can improve the accuracy of the model.

[0070] In an embodiment of the present application, for any subsequence among the multiple subsequences, the multiple models to be selected are trained and evaluated respectively, and the first model corresponding to each subsequence is determined to obtain multiple first models, including:

[0071] For any subsequence among the multiple subsequences, extract features from the subsequence to obtain data features of the subsequence;

[0072] Using the subsequences to perform model training on multiple models to be selected, respectively, to obtain multiple second models corresponding one to one to the multiple models to be selected;

[0073] The data features are input into a preset decision tree for evaluation, a first model whose performance meets preset conditions is determined among the multiple second models, and multiple first models corresponding to the multiple subsequences are obtained.

[0074] In this example, see Figure 2 , Figure 2 Schematic diagram of the process flow selected for the model. Figure 2 Subsequence 1, subsequence 2 and subsequence n in are any subsequences in the plurality of subsequences. Subsequence model 1, subsequence model 2...subsequence model n are the first model.

[0075] Since the subsequence contains a lot of information, the subsequent calculation complexity will be too high. Therefore, in order to reduce the data dimension and reduce the calculation complexity of subsequent model selection and parameter optimization, it is necessary to extract features from each subsequence. The extracted data features include: statistical features, frequency domain features and time domain features.

[0076] Specifically, statistical features include mean, variance, maximum, minimum, and standard deviation. These statistical features can provide information such as the central tendency, degree of dispersion, and distribution shape of the data.

[0077] Frequency domain features include: Fourier transform spectrum, power spectrum density. These frequency domain features can provide information such as frequency components, periodicity and spectrum energy of the data.

[0078] Time domain features include: autocorrelation coefficient, mutual correlation coefficient, and difference value. These time domain features can provide information such as data autocorrelation, trend, and periodicity.

[0079] When using subsequences to train multiple models to be selected, the first 80% of the data in each subsequence can be used as training data to train multiple models to be selected, and multiple second models corresponding to the multiple models to be selected can be obtained. In addition, the last 20% of the data is used as verification data to evaluate the performance of the trained second model.

[0080] After the model training is completed, the second model of the subsequence is evaluated by a decision tree using the data features extracted from the subsequence, and the model with the best evaluation result is selected as the first model.

[0081] Specifically, see Figure 3 , Figure 3 It is a decision tree diagram, and the data in the figure represents the data features. When the power density in the data features is large and the autocorrelation coefficient is large, if the data features include cycles, the periodic median model is selected; when the power density in the data features is low and the autocorrelation coefficient is small, if the data features do not include cycles, the kurtosis and coefficient of variation are further determined; when the kurtosis is large and the coefficient of variation is small, if the density in the data features is stable, the periodic median model is selected; when the kurtosis in the data features is small and the coefficient of variation is large, if the density in the data features is not stable, the regression coefficient is further determined; when the regression coefficient is large, the kernel density estimation model is selected; when the regression coefficient is small, the isolation forest model is selected.

[0082] In this embodiment, through automated feature learning and model selection, full use is made of the information in the time series data, and a model suitable for specific data is selected quickly and accurately, thereby reducing the cost of manual model selection and enhancing the generalization ability of anomaly detection.

[0083] In an embodiment of the present application, for any subsequence among the multiple subsequences, the multiple models to be selected are trained and evaluated respectively, and the first model corresponding to each subsequence is determined to obtain multiple first models, including:

[0084] Using the subsequences to perform model training on multiple models to be selected, respectively, to obtain multiple second models corresponding one to one to the multiple models to be selected;

[0085] According to the subsequences, respectively, the plurality of second models are subjected to performance evaluation to obtain evaluation results corresponding to the plurality of second models one by one;

[0086] The second model with the best performance in the evaluation results is determined as the first model.

[0087] In this embodiment, after the decision tree evaluation is performed using the data features in the above embodiment, if the discrimination of the model obtained by the evaluation is not high and it is difficult to accurately identify the first model, in addition to selecting the first model using the data features in the above embodiment, each subsequence can be used to train multiple models to be selected. For each model to be selected, a trained model, i.e., multiple second models, is obtained.

[0088] By performing performance evaluation on multiple second models, a performance evaluation result of each second model is obtained, and then the model with the best performance in the performance evaluation results is used as the first model.

[0089] Specifically, in one embodiment, the performing performance evaluation on the multiple second models according to the subsequence to obtain evaluation results corresponding to the multiple second models one by one includes:

[0090] In the case where the subsequence includes an abnormal label, using a preset machine learning algorithm to perform performance evaluation on the multiple second models to obtain evaluation results corresponding to the multiple second models one by one;

[0091] In the case where the subsequence does not include an abnormal label, using the multiple second models to respectively detect the time series to be tested, and obtaining detection results corresponding to the multiple second models one by one; and

[0092] The abnormality ratio in the detection result is compared with the preset abnormality ratio to obtain the evaluation result of the second model.

[0093] In this embodiment, the above-mentioned abnormal label refers to a label that may be contained in the subsequence and indicates whether the data value at the corresponding time point is an abnormal value. The label can be set by the staff or inherent in the subsequence when the subsequence is generated, and this embodiment does not limit this.

[0094] When the subsequence contains abnormal labels, a machine learning algorithm can be used to directly evaluate the performance of multiple second models to obtain evaluation results. The machine learning algorithm can be linear regression, random forest, support vector machine, etc., which is not limited in this embodiment.

[0095] The specific evaluation process may include: first, ensuring that the subsequence contains abnormal labels, which are known and accurate, and are used to evaluate the model's ability to identify anomalies.

[0096] The subsequence data is divided into a training set, a validation set (or a cross-validation set), and a test set. Usually, the training set is used for model training, the validation set is used to adjust model parameters, and the test set is used to finally evaluate model performance. Use the training set data to train multiple machine learning algorithms to be selected to obtain multiple second models. Select appropriate evaluation indicators, such as accuracy, recall, F1 score, precision, area under the ROC curve (AUC), etc. Use the data and anomaly labels in the test set (or validation set if cross-validation is used) to predict each second model.

[0097] Compare the model’s predictions with the true labels and calculate the evaluation metrics chosen above.

[0098] Record the evaluation results of each second model on the test set, including the specific values ​​of each evaluation indicator. Analyze the performance of different models on the evaluation indicators and identify which models perform better in identifying anomalies.

[0099] According to the evaluation results, the second model with the best performance is selected as the first model corresponding to the subsequence. The best performance may be based on the highest value of a single evaluation indicator, or it may be the best weighted sum of multiple evaluation indicators.

[0100] In the case where the subsequence does not include abnormal labels, multiple second models can be used to detect the time series to be tested respectively to obtain the abnormal proportion in the time series to be tested. The abnormal proportion is then compared with the preset proportion to obtain the evaluation result of the second model. Among them, if the abnormal proportion is higher than the preset proportion or lower than the proportion threshold of the preset proportion, it can be considered that the evaluation result of the second model is poor, otherwise, it is good.

[0101] In this embodiment, different evaluation methods are used for the second model to determine the best model for the subsequence, thereby improving the accuracy of selecting the best model for the subsequence.

[0102] In an embodiment of the present application, after taking the model with the largest number of selections among the plurality of first models as the target model, the method further includes:

[0103] According to the multiple subsequences, the target model is optimized to obtain target parameters of the target model;

[0104] The using the target model to perform anomaly detection on the time series to be tested includes:

[0105] The target model and the target parameters are used to perform anomaly detection on the time series to be tested.

[0106] In this embodiment, after determining the target model, it is necessary to further optimize the parameters of the target model, and then use the optimized target parameters and the target model together to perform anomaly detection on the time series to be tested.

[0107] Specifically, in one embodiment, the performing model tuning on the target model according to the multiple subsequences to obtain target parameters of the target model includes:

[0108] For any subsequence among the multiple subsequences, determining a first parameter of each subsequence, where the first parameter is an optimal parameter of the subsequence;

[0109] Clustering the plurality of the first parameters to obtain a plurality of parameter sets;

[0110] Among the multiple parameter sets, the set center of the set with the largest number is determined as the target parameter of the target model.

[0111] In this embodiment, see Figure 4 , Figure 4 Specifically, for the first model selected for the subsequence, the grid search method can be used to perform model tuning for each subsequence to obtain the optimal parameters of each subsequence, and then the optimal parameters of each subsequence are clustered, and the cluster center of the largest number of clusters is used as the optimal parameter of the entire sequence, that is, the target parameter.

[0112] In one embodiment, for any subsequence among the multiple subsequences, determining the first parameter of each subsequence includes:

[0113] Acquire multiple second parameters of the target model and a value range of each second parameter;

[0114] Randomly combining the multiple second parameters and the value ranges to obtain multiple parameter combinations;

[0115] Using the subsequence and the plurality of parameter combinations, evaluating the target model;

[0116] The parameter combination whose performance meets the preset conditions obtained through evaluation is determined as the first parameter.

[0117] In this embodiment, each type of model (isolation forest, periodic median, kernel density estimation) has its own specific second parameters, which are customized according to the design principles of the model. For example, the second parameters of the isolation forest model include: n_estimators (the number of isolated trees) usually takes values ​​of 50, 100, 200, etc.; max_samples (the number of samples for each tree) usually takes values ​​of 256, 512, etc.; max_features (the number of features for each tree) takes values ​​in the range of 0 to 1; then the parameter space of the model can be defined as (n_estimators, max_samples, max_features) = [(50, 256, 0), (50, 256, 0.1), (50, 256, 0.2), .... ].

[0118] After determining the second parameter and its value range, the second parameter and its value range are randomly combined. As an example, the parameter combination of the isolation forest may be n_estimators and 50, or n_estimators and 100, or n_estimators and 200.

[0119] After all random parameter combinations are obtained, the target model is evaluated according to each parameter combination and subsequence. The evaluation process is as described in the above embodiment and will not be described in detail here.

[0120] After the evaluation is completed, the parameter corresponding to the model with the best performance obtained through evaluation is determined as the first parameter.

[0121] In this embodiment, the performance of the model is further improved through adaptive model tuning, human intervention is reduced, and the cost of model parameter tuning is greatly reduced, making it more adaptable to actual needs and suitable for large-scale promotion.

[0122] In one embodiment, in order to better understand the above embodiment, a case is described below:

[0123] Background description: In the core transaction system of a city commercial bank, a real-time anomaly detection system needs to be implemented to monitor transaction volume indicators in real time, so as to promptly detect abnormal situations such as transaction reduction or interruption.

[0124] Environment configuration: high-performance server (4 cores and 8 threads, 16GB memory, 500GB SSD hard disk), Linux operating system, software environment including financial transaction processing software, database, Spark framework, and Flink framework.

[0125] Implementation steps:

[0126] Data collection: Obtain minute-by-minute transaction volume data from financial transaction processing software and store the data in a database.

[0127] Data processing: Select the transaction volume data of one month from the database and use this proposed method in Spark to perform the following processing:

[0128] Preprocessing: cleaning, resampling and filling missing values ​​of data.

[0129] Segmentation: Divide the preprocessed sequence into several subsequences based on the change point optimal approximation method.

[0130] Feature extraction: Extract statistical features, frequency domain features and time domain features for each subsequence.

[0131] Model selection: Based on the characteristics of each subsequence, this proposed method is used in Spark to train and evaluate the model for each subsequence to obtain the best model for each subsequence. Then, a majority voting step is performed on the best model of each subsequence, and the model with the most votes is selected as the best model for the entire sequence.

[0132] Model tuning: Based on the selected best model, the proposed method is used in Spark to tune the model of each subsequence to obtain the optimal parameters of each subsequence. Then, the optimal parameters of each subsequence are clustered, and the cluster center of the largest number of clusters is used as the optimal parameter of the entire sequence.

[0133] Real-time anomaly detection: Use the trained best model and optimal parameters to detect anomalies in the real-time per-minute transaction volume in Flink, automatically identify abnormal transactions and issue alarms.

[0134] like Figure 5 As shown, the embodiment of the present application further provides a sequence detection device 500, the device comprising:

[0135] A division module 501 is used to divide the time series to be measured into multiple subsequences;

[0136] A training module 502 is used to train and evaluate the multiple models to be selected for any subsequence of the multiple subsequences, determine the first model corresponding to each subsequence, and obtain multiple first models;

[0137] A selection module 503, configured to perform a selection action on each model of the plurality of first models using each subsequence;

[0138] A determination module 504 is configured to use the model that receives the most selection times among the plurality of first models as a target model;

[0139] The detection module 505 is used to perform anomaly detection on the time series to be tested using the target model.

[0140] Optionally, the division module 501 further includes:

[0141] An acquisition submodule, used to acquire a reference value of a data value corresponding to each first time point in the time series to be measured;

[0142] A first determining submodule, configured to determine, for any first time point in each time point, a difference between the data value and the reference value as a deviation at the first time point;

[0143] An accumulation submodule, configured to accumulate the deviations in sequence according to the order of each time point, until, when the accumulated deviation is greater than a preset threshold, a second time point corresponding to the accumulated deviation is determined as a change point, and the step of accumulating the deviations in sequence according to the order of each time point is performed again with the second time point as the starting point, until all the change points of the time series to be measured are obtained;

[0144] A second determination submodule is used to perform a genetic algorithm search based on all the change points and the data values ​​of all the change points to obtain a plurality of target segmentation points of the time series to be measured;

[0145] The division submodule is used to divide the time series to be measured into multiple subsequences according to the multiple target segmentation points.

[0146] Optionally, the training module 502 includes:

[0147] An extraction submodule, configured to extract features of any subsequence among the plurality of subsequences to obtain data features of the subsequence;

[0148] A training submodule, used to perform model training on a plurality of models to be selected respectively using the subsequence, to obtain a plurality of second models corresponding one to one to the plurality of models to be selected;

[0149] The third determination submodule is used to input the data features into a preset decision tree for evaluation, and determine the first model whose performance meets the preset conditions among the multiple second models.

[0150] Optionally, the training module 502 includes:

[0151] A fourth determination submodule is used to perform model training on a plurality of models to be selected respectively using any subsequence among the plurality of subsequences to obtain a plurality of second models corresponding one-to-one to the plurality of models to be selected;

[0152] a fifth determination submodule, configured to perform performance evaluation on each of the plurality of second models according to the subsequences, and obtain evaluation results corresponding one to one to the plurality of second models;

[0153] The sixth determination submodule is used to determine the second model with the best performance in the evaluation results as the first model.

[0154] Optionally, the fifth determining submodule includes:

[0155] An evaluation unit, configured to, when the subsequence includes an abnormal label, use a preset machine learning algorithm to perform performance evaluation on the plurality of second models, and obtain evaluation results corresponding one-to-one to the plurality of second models;

[0156] a detection unit, configured to detect the time series to be tested respectively using the multiple second models when the subsequence does not include an abnormal label, and obtain detection results corresponding to the multiple second models one by one; and

[0157] A comparing unit is used to compare the abnormality ratio in the detection result with a preset abnormality ratio to obtain an evaluation result of each of the second models.

[0158] Optionally, the sequence detection device 500 further includes:

[0159] A tuning module, used for performing model tuning on the target model according to the multiple subsequences to obtain target parameters of the target model;

[0160] The using the target model to perform anomaly detection on the time series to be tested includes:

[0161] The detection module is used to use the target model and the target parameters to perform anomaly detection on the time series to be tested.

[0162] Optionally, a tuning module includes:

[0163] a seventh determination submodule, configured to determine, for any subsequence among the plurality of subsequences, a first parameter of each subsequence, wherein the first parameter is an optimal parameter of the subsequence;

[0164] A clustering submodule, used for clustering the plurality of the first parameters to obtain a plurality of parameter sets;

[0165] An eighth determination submodule is used to determine, among the multiple parameter sets, the set center of the set with the largest number as the target parameter of the target model.

[0166] Optionally, the seventh determining submodule includes:

[0167] an acquiring unit, configured to acquire a plurality of second parameters of the target model and a value range of each second parameter, wherein the second parameters include the first parameter;

[0168] A combining unit, used for randomly combining the plurality of second parameters and the value ranges to obtain a plurality of parameter combinations;

[0169] An evaluation unit, configured to evaluate the target model using the subsequence and the plurality of parameter combinations;

[0170] The determining unit is used to determine the parameter combination whose performance meets the preset condition obtained by evaluation as the first parameter.

[0171] It should be noted that the sequence detection device 500 is a device corresponding to the above-mentioned sequence detection method, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device and can achieve the same technical effect.

[0172] Figure 6 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application is shown.

[0173] The terminal device may include a processor 601 and a memory 602 storing computer program instructions.

[0174] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0175] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0176] In certain embodiments, the memory 602 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, in general, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0177] The processor 601 implements any one of the sequence detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 602 .

[0178] In one example, the terminal device may further include a communication interface 606 and a bus 610. Figure 6 As shown, the processor 601, the memory 602, and the communication interface 606 are connected via a bus 610 and communicate with each other.

[0179] The communication interface 606 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0180] Bus 610 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 610 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0181] In addition, in combination with the sequence detection method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the sequence detection methods in the above embodiment is implemented.

[0182] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0183] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0184] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0185] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable sequence detection device to produce a machine so that these instructions executed by the processor of the computer or other programmable sequence detection device enable the realization of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0186] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A sequence detection method, characterized in that: The method comprises: Divide the time series to be tested into multiple subsequences; For any subsequence among the multiple subsequences, respectively train and evaluate the multiple models to be selected, determine the first model corresponding to each subsequence, and obtain multiple first models; Using each of the subsequences, performing a selection action on each of the plurality of first models; The model that receives the most selection times among the plurality of first models is used as the target model; The target model is used to perform anomaly detection on the time series to be tested.

2. The sequence detection method according to claim 1, characterized in that: The step of dividing the time series to be measured into a plurality of subsequences comprises: Obtaining a reference value of a data value corresponding to each first time point in the time series to be measured; For any first time point, determining the difference between the data value and the reference value as the deviation of the first time point; According to the order of each time point, the deviations are accumulated in sequence until, when the accumulated deviation is greater than a preset threshold, a second time point corresponding to the accumulated deviation is determined as a change point, and the step of accumulating the deviations in sequence according to the order of each time point is performed again with the second time point as the starting point until all the change points of the time series to be measured are obtained; Performing a genetic algorithm search according to all the change points and the data values ​​of all the change points to obtain a plurality of target segmentation points of the time series to be measured; The time series to be measured is divided into a plurality of subsequences according to the plurality of target segmentation points.

3. The sequence detection method according to claim 2, characterized in that: The obtaining a reference value of a data value corresponding to each first time point in the time series to be measured includes: The first formula is used to calculate the reference value of the data value corresponding to each time point in the time series to be measured; The first formula is: Among them, m i is the reference value of the data value corresponding to the i-th time point, m i-1 is the reference value of the data value corresponding to the i-1th time point, t i is the data value corresponding to the i-th time point, where i is the time point.

4. The sequence detection method according to claim 2, characterized in that: The step of performing a genetic algorithm search based on all the change points and the data values ​​of all the change points to obtain a plurality of target segmentation points of the time series to be tested includes: Establishing an objective function according to the plurality of change points and the data values ​​corresponding to the change points; Performing a genetic algorithm search on the objective function to obtain the multiple target segmentation points; The objective function is: Among them, x1,x2,...x k are the change points, y1,y2,...y k+1 is the data value corresponding to the change point, t i is the i-th time point.

5. The sequence detection method according to claim 1, characterized in that: The method of training and evaluating the multiple models to be selected for any subsequence among the multiple subsequences, determining the first model corresponding to each subsequence, and obtaining the multiple first models includes: For any subsequence among the multiple subsequences, extract features from the subsequence to obtain data features of the subsequence; Using the subsequences to perform model training on multiple models to be selected, respectively, to obtain multiple second models corresponding one to one to the multiple models to be selected; The data features are input into a preset decision tree for evaluation to determine a first model among the multiple second models whose performance meets preset conditions.

6. The sequence detection method according to claim 1, characterized in that: The step of training and evaluating a plurality of models to be selected for any subsequence among the plurality of subsequences to determine a first model corresponding to each subsequence includes: For any subsequence among the multiple subsequences, perform model training on multiple models to be selected respectively using the subsequence to obtain multiple second models corresponding to the multiple models to be selected one by one; According to the subsequences, respectively, the plurality of second models are subjected to performance evaluation to obtain evaluation results corresponding to the plurality of second models one by one; The second model with the best performance in the evaluation results is determined as the first model.

7. The sequence detection method according to claim 6, characterized in that: The performing performance evaluation on the plurality of second models respectively according to the subsequence to obtain evaluation results corresponding to the plurality of second models one by one includes: In the case where the subsequence includes an abnormal label, using a preset machine learning algorithm to perform performance evaluation on the multiple second models to obtain evaluation results corresponding to the multiple second models one by one; In the case where the subsequence does not include an abnormal label, using the multiple second models to respectively detect the time series to be tested, and obtaining detection results corresponding to the multiple second models one by one; and The abnormality ratio in the detection result is compared with the preset abnormality ratio to obtain the evaluation result of each of the second models.

8. The sequence detection method according to claim 1, characterized in that: After taking the model with the largest number of selections among the plurality of first models as the target model, the method further comprises: According to the multiple subsequences, the target model is optimized to obtain target parameters of the target model; The using the target model to perform anomaly detection on the time series to be tested includes: The target model and the target parameters are used to perform anomaly detection on the time series to be tested.

9. The sequence detection method according to claim 8, characterized in that: The step of performing model tuning on the target model according to the multiple subsequences to obtain target parameters of the target model includes: For any subsequence among the multiple subsequences, determining a first parameter of each subsequence, where the first parameter is an optimal parameter of the subsequence; Clustering the plurality of the first parameters to obtain a plurality of parameter sets; Among the multiple parameter sets, the set center of the set with the largest number is determined as the target parameter of the target model.

10. The sequence detection method according to claim 9, characterized in that: The step of determining, for any subsequence among the plurality of subsequences, a first parameter of each subsequence comprises: Acquire multiple second parameters of the target model and a value range of each second parameter, where the second parameters include the first parameter; Randomly combining the multiple second parameters and the value ranges to obtain multiple parameter combinations; Using the subsequence and the plurality of parameter combinations, evaluating the target model; The parameter combination whose performance meets the preset conditions obtained through evaluation is determined as the first parameter.

11. A sequence detection device, characterized in that: The device includes: A division module is used to divide the time series to be tested into multiple subsequences; A training module, used for training and evaluating the multiple models to be selected for any subsequence among the multiple subsequences, determining the first model corresponding to each subsequence, and obtaining multiple first models; A selection module, configured to perform a selection action on each model of the plurality of first models using each subsequence; A determination module, configured to use the model that receives the most selection times among the plurality of first models as a target model; The detection module is used to use the target model to perform anomaly detection on the time series to be tested.

12. A terminal device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the sequence detection method according to any one of claims 1 to 10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the sequence detection method according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that The computer product comprises a computer program, and when the computer program is executed by a processor, the sequence detection method according to any one of claims 1 to 10 is implemented.

Images