Abnormal point identification method for detecting index data and related equipment thereof

Abstract

The invention relates to an abnormal point identification method for detecting index data and related equipment thereof, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of obtaining a time sequence queue corresponding to detection index data, and arranging the detection index data in the time sequence queue according to a size sequence of data values to obtain a data value queue corresponding to the detection index data; dividing the data value queue according to the abnormal point data proportion to obtain a first data value sub-queue; and judging whether the target candidate abnormal point data in the first data value sub-queue is a data value peak in a preset time window including the target candidate abnormal point data in the time sequence queue, and if so, determining the target candidate abnormal point data corresponding to the data value peak as abnormal point data. According to the embodiment, the abnormal point recognition efficiency and recognition accuracy of the detection index data are improved, the situation of repeated alarm is avoided, the stability of system operation is improved, and the application scene of abnormal point recognition is expanded.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for identifying abnormal points in detection index data and related equipment. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by its inclusion in this section.

[0003] Timely and accurate determination of abnormal data is an important reference to ensure the stable operation of the system. For example, the automatic detection and diagnosis system is constantly sampling various detection index data, judging whether the detected system has abnormalities based on the data value of the index data, and then performing abnormal maintenance.

[0004] The main method in the related technology is to compare the detection index data value with a certain empirical threshold to determine whether there is an abnormality. However, due to changes in system load, application environment, etc., the empirical threshold also changes accordingly, so misjudgment often occurs in the related technology. At the same time, if multiple abnormalities occur in the detection index data within the same time period, repeated alarms will also occur. Summary of the invention

[0005] The method for identifying abnormal points in detection index data and related equipment provided in the embodiments of the present invention at least solve the problems in the related art of misjudgment, low efficiency of abnormal point identification and repeated alarms due to abnormal point judgment only based on empirical thresholds.

[0006] In order to solve the above problem, one aspect of an embodiment of the present invention provides a method for identifying abnormal points in detection indicator data, including:

[0007] Obtain the time series queue corresponding to the detection indicator data, arrange the detection indicator data in the time series queue in order of data value, and obtain the data value queue corresponding to the detection indicator data;

[0008] According to the abnormal point data ratio, a first data value sub-queue is obtained from the data value queue; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data;

[0009] Determine whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the timing queue, and if so, determine that the target candidate abnormal point data corresponding to the data value peak is the abnormal point data.

[0010] In some embodiments, determining whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determining the target candidate abnormal point data corresponding to the data value peak as abnormal point data includes:

[0011] According to the order of data values ​​from large to small, the target candidate abnormal point data is taken out from the first data value sub-queue, and it is determined whether the data value corresponding to the target candidate abnormal point data is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue;

[0012] If yes, retain the target candidate outlier point data from the first data value subqueue; if no, delete the target candidate outlier point data from the first data value subqueue;

[0013] The target candidate outlier data retained in the first data value subqueue is determined as outlier data.

[0014] In some of the embodiments, after the step of dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio, the method further includes:

[0015] According to the normal point data ratio, a second data value sub-queue is obtained from the data value queue; wherein the data value of the detection index data in the second data value sub-queue is less than or equal to the data value of the detection index data in the first data value sub-queue; wherein the sum of the normal point data ratio and the abnormal point data ratio is 1;

[0016] Determine a jitter value and an average value of the detection indicator data in the second data value subqueue, and determine a first threshold value according to the jitter value and the average value;

[0017] The detection index data in the first data value subqueue is screened according to the first threshold.

[0018] In some embodiments, the step of determining a jitter value and an average value of the detection indicator data in the second data value subqueue, and determining a first threshold value according to the jitter value and the average value includes:

[0019] Determine the maximum data value and the minimum data value corresponding to the detection indicator data in the second data value subqueue, and subtract the minimum data value from the maximum data value to obtain a jitter value;

[0020] Calculate the average value corresponding to the detection indicator data in the second data value subqueue;

[0021] The jitter value is added to the average value to obtain the first threshold value.

[0022] In some embodiments, the step of dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio includes:

[0023] Obtain the abnormal point data ratio, determine the total amount of detection indicator data in the data value queue, and determine the data amount of the first data value sub-queue according to the total amount of data and the abnormal point data ratio;

[0024] According to the data amount of the first data value sub-queue, the first data value sub-queue is obtained by dividing the data value queue.

[0025] In some of the embodiments, after the step of obtaining the timing queue corresponding to the detection index data, the method further includes: obtaining a second threshold, identifying outliers on the detection index data in the timing queue according to the second threshold, and determining that the detection index data having a data value greater than the second threshold is an outlier data.

[0026] In some of the embodiments, after the step of obtaining the timing queue corresponding to the detection index data, the method further includes:

[0027] The detection index data in the time series queue are classified according to the data source to obtain time series queues corresponding to different categories of detection index data, and abnormal point identification of the detection index data is performed for different categories of time series queues.

[0028] In some embodiments, the steps of performing abnormal point identification of detection index data for different types of time series queues include:

[0029] Obtaining second thresholds corresponding to different data sources, and performing first abnormal point identification on the detection indicator data in the corresponding time series queue according to the second thresholds;

[0030] Determine the data value queues corresponding to the different categories of timing queues, and determine the first data value sub-queues corresponding to the different categories of data value queues, and perform a second abnormal point identification on the detection index data in the first data value sub-queue according to the data value peak judgment strategy within the preset time window.

[0031] In order to solve the above problem, another aspect of an embodiment of the present invention provides an abnormal point identification device for detecting indicator data, comprising:

[0032] A data processing module is used to obtain a time series queue corresponding to the detection index data, arrange the detection index data in the time series queue in order of the size of the data value, and obtain a data value queue corresponding to the detection index data;

[0033] A queue division module is used to divide the data value queue into a first data value sub-queue according to the abnormal point data ratio; wherein the detection indicator data in the first data value sub-queue is the candidate abnormal point data;

[0034] The outlier identification module is used to determine whether the target candidate outlier data in the first data value sub-queue is a data value peak within a preset time window including the target candidate outlier data in the timing queue. If so, the target candidate outlier data corresponding to the data value peak is determined to be the outlier data.

[0035] In order to solve the above-mentioned problem, another aspect of an embodiment of the present invention provides an electronic device, comprising: a processor, and a memory for storing a program, wherein the program comprises instructions, and when the instructions are executed by the processor, the processor executes any one of the above-mentioned methods for identifying abnormal points of detection indicator data.

[0036] In order to solve the above problem, another aspect of an embodiment of the present invention provides a non-transitory machine-readable medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned methods for identifying abnormal points in detection indicator data.

[0037] The beneficial effects of the embodiments of the present invention are as follows: by obtaining the timing queue corresponding to the detection index data, arranging the detection index data in the timing queue in the order of the size of the data value, and obtaining the data value queue corresponding to the detection index data; dividing the data value queue according to the proportion of the abnormal point data to obtain the first data value subqueue; wherein the detection index data in the first data value subqueue is the candidate abnormal point data; judging whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the timing queue, and if so, determining the target candidate abnormal point data corresponding to the data value peak as the abnormal point data. The efficiency and accuracy of abnormal point identification of the detection index data are improved, repeated alarms are avoided, the stability of system operation is improved, and the application scenarios of abnormal point identification are expanded.

[0038] The details of one or more embodiments of the invention are set forth in the following drawings and description so that other features, objects, and advantages of the invention are more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0040] Figure 1 It is a flowchart of a method for identifying abnormal points in detection index data according to an embodiment of the present invention.

[0041] Figure 2a It is a flowchart of a method for identifying abnormal points in detection index data according to another embodiment of the present invention.

[0042] Figure 2b yes Figure 2a Schematic diagram of converting a time series queue into a data value queue in the method shown.

[0043] Figure 2c yes Figure 2a A schematic diagram of obtaining a first data value sub-queue by dividing a data value queue in the method shown.

[0044] Figure 2d yes Figure 2a Schematic diagram of determining anomalies based on data peak values ​​in a preset window in the method shown.

[0045] Figure 3 It is a schematic diagram of a framework of an abnormal point identification device for detecting index data according to an embodiment of the present invention.

[0046] Figure 4 Schematic diagram of the structure of the electronic device of this embodiment. DETAILED DESCRIPTION

[0047] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0048] Regarding how to identify abnormal points in detection index data, most detection and diagnosis systems judge whether there is a system abnormality based on whether the detection index data exceeds a certain empirical threshold. The disadvantage of this is that the empirical thresholds corresponding to abnormal index data of different systems or clusters are usually different, and using a single fixed empirical threshold for judgment often leads to misjudgment. At the same time, due to changes in system load or application environment, the index thresholds corresponding to the actual detection data are also different, which further leads to the occurrence of misjudgment; on the other hand, if the detection index data are all abnormal in the same time period, it is easy to have repeated alarms.

[0049] In order to solve the above problems, an embodiment of the present invention provides a method for identifying abnormal points in detection indicator data. Figure 1 As shown, the above-mentioned method for identifying abnormal points of the detection index data mainly includes:

[0050] Step S101, obtaining a time series queue corresponding to the detection index data, arranging the detection index data in the time series queue in order of the size of the data values, and obtaining a data value queue corresponding to the detection index data.

[0051] Among them, the detection index data provided by the embodiment of the present invention may include detection index data of various systems or application software, such as the CPU occupancy rate of the application, the load value of the system, the usage rate of the disk, the occupancy rate of the memory, etc., and in order to facilitate subsequent identification and processing, the data value of the detection index data obtained by the embodiment of the present invention has a unified format. If the data value format is inconsistent, the data value format of the detection index data needs to be converted into a consistent format after the timing queue is generated. The timing queue provided by the embodiment of the present invention refers to the queue obtained by arranging the acquired detection index data in the order of the timestamps corresponding to the data generation. The data in the queue is generally the value of a certain detection index at a continuous and same time interval. It should be pointed out that since the embodiment of the present invention subsequently adopts the data value peak within the preset time window to perform abnormal point judgment and identification, the time intervals corresponding to the data in the timing queue are not the same and are also applicable to the present invention. Through the above settings, the timing queue corresponding to the detection index data is first obtained, and then the data value queue of the detection index data is determined according to the size order of the data value. Subsequently, the candidate anomaly point data can be quickly and accurately determined through the data value queue to reduce the data volume range of anomaly point data identification, thereby improving the identification efficiency. The candidate anomaly point data is then combined with the timing queue to perform anomaly point identification to improve the accuracy of anomaly point identification and avoid misjudgment and repeated alarms.

[0052] Step S102 , dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio; wherein the detection indicator data in the first data value sub-queue is the candidate abnormal point data.

[0053] Among them, the proportion of abnormal point data provided by the embodiment of the present invention can be determined in combination with the proportion of abnormal point data in historical data. At the same time, since the detection index data in the first data value subqueue is the candidate abnormal point data, it can be understood that the data value of the candidate abnormal point data in the first data value subqueue is relatively high. In the actual processing process, in order to improve the accuracy of abnormal point identification, the proportion of abnormal point data can be appropriately increased based on the abnormal point data proportion determined by the historical data, and the proportion of candidate abnormal point data can be appropriately expanded accordingly, which not only reduces the amount of calculation required for abnormal point identification for all detection index data, improves the efficiency of abnormal point identification, but also can further avoid the occurrence of misjudgment and missed judgment.

[0054] Step S103, determining whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determining the target candidate abnormal point data corresponding to the data value peak as abnormal point data.

[0055] The embodiment of the present invention creatively proposes a solution for identifying anomalies in an ordered queue window peak, by dividing the data value queue, determining the first data value sub-queue corresponding to the candidate anomaly data, and then sequentially judging whether each target candidate anomaly data in the first data value sub-queue is a data value peak of a preset time window including the target candidate anomaly data in the timing queue. This achieves the technical effect of improving the efficiency and accuracy of anomaly identification of detection index data, avoiding repeated alarms, and improving the stability of system operation. At the same time, the above-mentioned preset time window can be adjusted according to the alarm frequency during actual operation, which not only avoids repeated alarms, but also expands the application scenarios of anomaly identification.

[0056] In some of the embodiments, the above-mentioned step of determining whether the target candidate outlier data in the first data value subqueue is a data value peak within a preset time window including the target candidate outlier data in the timing queue, and if so, determining that the target candidate outlier data corresponding to the data value peak is the outlier data, includes: taking out the target candidate outlier data from the first data value subqueue in order from large to small data values, and determining whether the data value corresponding to the target candidate outlier data is a data value peak within a preset time window including the target candidate outlier data in the timing queue; if so, retaining the target candidate outlier data from the first data value subqueue; if not, deleting the target candidate outlier data from the first data value subqueue; and determining that the target candidate outlier data retained in the first data value subqueue is the outlier data.

[0057] Among them, the preset time window provided by the embodiment of the present invention is set according to the alarm rules of each system. It is understandable that the narrower the preset time window, the more frequently the alarm is triggered. Through the above settings, for the target candidate abnormal point data in the first data value subqueue, the data value of the target candidate abnormal point data is judged in sequence according to the size order of the data value in the timing queue. Whether it is a data value peak within the preset time window including the target candidate abnormal point data, if it is a data value peak, the target candidate abnormal point data is adjusted and marked as abnormal point data, triggering an alarm notification. According to this, only when the data value of the target candidate abnormal point data is a data value peak within the preset time window, the target candidate abnormal point data is adjusted to abnormal point data, that is, the situation of repeated alarms is avoided. At the same time, the data value peak within the preset time window is used as the judgment basis, which avoids the fluctuation of the indicator threshold caused by changes in the system load or application environment, thereby causing the misjudgment of abnormal points.

[0058] In some of the embodiments, after the step of dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio, the method further includes: dividing the data value queue into a second data value sub-queue according to the normal point data ratio; wherein the data value of the detection index data in the second data value sub-queue is less than or equal to the data value of the detection index data in the first data value sub-queue, and the sum of the normal point data ratio and the abnormal point data ratio is 1; determining the jitter value and the average value of the detection index data in the second data value sub-queue, and determining the first threshold value according to the jitter value and the average value; and screening the detection index data in the first data value sub-queue according to the first threshold value.

[0059] Through the above settings, the detection index data included in the first data value subqueue is the candidate abnormal point data, and the detection index data included in the second data subqueue is the normal point data. The first threshold is determined according to the jitter value and the average value determined by multiple normal point data in the second data value subqueue, and then the detection index data in the first data value subqueue is screened by the first threshold, that is, the candidate abnormal point data is screened, and the detection index data in the first data value subqueue whose data value is less than or equal to the first threshold is deleted from the first data value subqueue, further narrowing the range of the candidate abnormal point data, reducing the amount of calculation required for subsequent abnormal point identification, and improving the efficiency of abnormal point identification. At the same time, because the first threshold is determined according to the normal point data in the second data value subqueue, the first threshold can respond to changes in the system load and application environment, expanding the application scenarios of abnormal point identification.

[0060] In some of the embodiments, the above-mentioned steps of determining the jitter value and average value of the detection index data in the second data value subqueue, and determining the first threshold value based on the jitter value and the average value, include: determining the maximum data value and the minimum data value corresponding to the detection index data in the second data value subqueue, subtracting the minimum data value from the maximum data value to obtain the jitter value; calculating the average value corresponding to the detection index data in the second data value subqueue; and adding the jitter value to the average value to obtain the first threshold value.

[0061] The above steps provide an example of determining a first threshold value in an embodiment of the present invention. Since the detection index data in the second data value subqueue is normal point data, the first threshold value determined by the scheme shown in the above example can effectively respond to changes in the system load and application environment, avoid misjudgment caused by the use of a single fixed threshold value in related technologies, and can also effectively narrow the range of candidate abnormal point data in the first data subqueue while ensuring the accuracy of abnormal point identification, which helps to further improve the efficiency of abnormal point identification.

[0062] In some embodiments, the step of dividing the data value queue according to the abnormal point data ratio to obtain the first data value subqueue includes: obtaining the abnormal point data ratio, determining the total amount of detection index data in the data value queue, and determining the amount of data of the first data value subqueue according to the total amount of data and the abnormal point data ratio; dividing the data value queue according to the amount of data of the first data value subqueue to obtain the first data value subqueue. After the first data value subqueue is divided, the remaining detection index data in the data value queue can be divided into the second data value subqueue.

[0063] Among them, the sum of the abnormal point data ratio and the normal point data ratio provided by the embodiment of the present invention is 100%. According to a specific implementation of the embodiment of the present invention, the data volume of the second data value subqueue can be determined based on the normal point data ratio and the total data volume, and then the detection index data with a smaller data value corresponding to the data volume of the second data value subqueue is selected from the data value queue to obtain the second data value subqueue, and the remaining detection index data in the data value queue constitutes the first data value subqueue. According to another specific implementation of the embodiment of the present invention, the data volume of the first data value subqueue can also be determined based on the abnormal point data ratio and the total data volume, and then the detection index data with a larger data value corresponding to the data volume of the first data value subqueue is selected from the data value queue to obtain the first data value subqueue, and the remaining detection index data in the data value queue constitutes the second data value subqueue.

[0064] In some of the embodiments, after the step of obtaining the timing queue corresponding to the detection index data, the method further includes: obtaining a second threshold, identifying outliers on the detection index data in the timing queue according to the second threshold, and determining that the detection index data having a data value greater than the second threshold is an outlier data.

[0065] In order to respond to the different needs of users, through the above settings, a second threshold that is larger than the empirical threshold can be set to identify the first abnormal point of the acquired timing queue according to the second threshold, that is, to issue timely alarms for more extreme abnormal situations to ensure system stability and avoid system downtime or greater losses to application services.

[0066] In some of the embodiments, after the step of obtaining the timing queue corresponding to the detection index data, the method further includes: classifying the detection index data in the timing queue according to the data source, obtaining timing queues corresponding to different categories of detection index data, and performing abnormal point identification of the detection index data for different categories of timing queues.

[0067] Since the abnormal indicator thresholds of different systems or clusters are usually different, and the fluctuations of system load and application environment also affect the abnormal indicator thresholds. Through the above settings, the detection indicator data is classified according to the data source, and then the abnormal points are identified for different categories of detection indicator data, which further improves the accuracy of abnormal point identification.

[0068] In some of the embodiments, the steps of performing abnormal point identification of detection index data for different categories of timing queues include: obtaining a second threshold corresponding to different data sources, and performing a first abnormal point identification on the detection index data in the corresponding timing queue according to the second threshold; determining the data value queues corresponding to the different categories of timing queues, and determining the first data value sub-queues corresponding to the different categories of data value queues, and performing a second abnormal point identification on the detection index data in the first data value sub-queue according to the data value peak judgment strategy within a preset time window.

[0069] Among them, the "data value peak judgment strategy within the preset time window" provided in the embodiment of the present invention refers to judging whether the data value corresponding to the target candidate abnormal point data in the first data value subqueue is a data value peak within the preset time window including the target candidate abnormal point data in the timing queue, and if so, the target candidate abnormal point data is determined to be abnormal point data. Through the above example, the embodiment of the present invention performs a first abnormal point identification on the detection index data in the timing queue with a second threshold, and then classifies the detection index data, and determines different categories of data value queues and first data value subqueues, and then combines the data value peak judgment strategy of the preset time window to perform a second abnormal point identification on the detection index data, which can cope with the diverse needs of users for abnormal point identification, expand the applicable scenarios of the abnormal point identification method, and effectively improve the accuracy of abnormal point identification.

[0070] The above-mentioned method for identifying abnormal points of detection index data provided by the embodiment of the present invention obtains the time series queue corresponding to the detection index data, arranges the detection index data in the time series queue in the order of the size of the data value, and obtains the data value queue corresponding to the detection index data; divides the data value queue according to the proportion of abnormal point data to obtain the first data value sub-queue; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data; determines whether the target candidate abnormal point data in the first data value sub-queue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determines that the target candidate abnormal point data corresponding to the data value peak is the abnormal point data. The efficiency and accuracy of abnormal point identification of the detection index data are improved, the situation of repeated alarms is avoided, the stability of system operation is improved, and the application scenarios of abnormal point identification are expanded.

[0071] The embodiment of the present invention also provides a method for detecting abnormal points of indicator data. Figure 2a As shown, the above-mentioned method for identifying abnormal points of the detection index data mainly includes:

[0072] Step S201, obtaining a time series queue corresponding to the detection index data, identifying abnormal points of the detection index data in the time series queue according to a second threshold, and determining that the detection index data having a data value greater than the second threshold is abnormal point data.

[0073] The timing queue provided in the embodiment of the present invention refers to a queue obtained by arranging the acquired detection index data in the order of the timestamps corresponding to the data. maxIt is a threshold larger than the empirical threshold. The second threshold is used to perform the first abnormal point identification on the detection indicator data in the acquired time series queue, so as to realize timely alarm for more extreme abnormal situations, meet the diverse needs of users, ensure system stability, and avoid system downtime or cause great losses to application services.

[0074] Step S202, arranging the detection index data in the time series queue in order of the size of the data values ​​to obtain a data value queue corresponding to the detection index data.

[0075] Figure 2b yes Figure 2a A schematic diagram of converting a timing queue into a data value queue in the method shown is as follows Figure 2b As shown, according to the data values ​​corresponding to each detection indicator data in the timing queue, the data value queue is obtained by arranging them in order of the data value size. Through the above settings, after obtaining the timing queue corresponding to the detection indicator data and preliminarily identifying the detection indicator data in the timing queue with the second threshold, the data value queue of the detection indicator data is determined according to the order of the data value size. Subsequently, the candidate abnormal point data can be quickly and accurately determined through the data value queue to reduce the data volume range of abnormal point data identification, thereby improving the identification efficiency, and then the abnormal point identification of the candidate abnormal point data is performed in combination with the timing queue to improve the accuracy of abnormal point identification and avoid misjudgment and repeated alarms.

[0076] Step S203, obtain the proportion of abnormal point data, determine the total amount of detection index data in the data value queue, and determine the data amount of the first data value sub-queue according to the total amount of data and the proportion of abnormal point data; according to the data amount of the first data value sub-queue, divide the data value queue to obtain the first data value sub-queue, and divide the remaining detection index data in the data value queue into the second data value sub-queue.

[0077] Among them, the proportion of abnormal point data provided by the embodiment of the present invention can be determined in combination with the proportion of abnormal point data in historical data. At the same time, since the detection index data in the first data value subqueue is the candidate abnormal point data, it can be understood that the data value of the candidate abnormal point data in the first data value subqueue is relatively high. In the actual processing process, in order to improve the accuracy of abnormal point identification, the proportion of abnormal point data can be appropriately increased based on the abnormal point data proportion determined by the historical data, and the proportion of candidate abnormal point data can be appropriately expanded accordingly, which not only reduces the amount of calculation required for abnormal point identification for all detection index data, improves the efficiency of abnormal point identification, but also can further avoid the occurrence of misjudgment and missed judgment. Figure 2c yes Figure 2a Schematic diagram of obtaining a first data value sub-queue by dividing the data value queue in the method shown. Figure 2cAs shown, each detection indicator data in the first data value subqueue is greater than or equal to the data value corresponding to the detection indicator data in the second data value subqueue.

[0078] According to a specific implementation of an embodiment of the present invention, taking the normal point data ratio of 50% as an example, this ratio indicates that at least 50% of the data values ​​in the currently acquired time series queue are normal point data. This is because the 50% of the abnormal point data ratio will be subsequently screened and identified, and the actual abnormal point data ratio is lower than 50%. The sampling period corresponding to the time series queue is T = 1day, the corresponding number of samples, that is, the total amount of data is S, and the sampling time interval is 1min (referring to the time stamps corresponding to the two adjacent detection index data in the time series queue differ by 1min), then the total amount of data in the time series queue is S = 1440.

[0079] Step S204, determining the jitter value and average value of the detection index data in the second data value subqueue, and determining a first threshold value according to the jitter value and the average value; and screening the detection index data in the first data value subqueue according to the first threshold value.

[0080] Through the above settings, the detection index data included in the first data value subqueue is the candidate abnormal point data, and the detection index data included in the second data subqueue is the normal point data. The first threshold is determined according to the jitter value and the average value determined by multiple normal point data in the second data value subqueue, and then the detection index data in the first data value subqueue is screened by the first threshold, that is, the candidate abnormal point data is screened, and the detection index data in the first data value subqueue whose data value is less than or equal to the first threshold is deleted from the first data value subqueue, further narrowing the range of the candidate abnormal point data, reducing the amount of calculation required for subsequent abnormal point identification, and improving the efficiency of abnormal point identification. At the same time, because the first threshold is determined according to the normal point data in the second data value subqueue, the first threshold can respond to changes in the system load and application environment, expanding the application scenarios of abnormal point identification.

[0081] The above steps provide an example of determining a first threshold value in an embodiment of the present invention. Since the detection index data in the second data value subqueue is normal point data, the first threshold value determined by the scheme shown in the above example can effectively respond to changes in the system load and application environment, avoid misjudgment caused by the use of a single fixed threshold value in related technologies, and can also effectively narrow the range of candidate abnormal point data in the first data subqueue while ensuring the accuracy of abnormal point identification, which helps to further improve the efficiency of abnormal point identification.

[0082] Step S205, in the order of data value from large to small, take out the target candidate outlier data from the first data value subqueue, and determine whether the data value corresponding to the target candidate outlier data in the timing queue is a data value peak within a preset time window including the target candidate outlier data; if so, retain the target candidate outlier data from the first data value subqueue; if not, delete the target candidate outlier data from the first data value subqueue; determine that the target candidate outlier data retained in the first data value subqueue is outlier data.

[0083] The preset time window provided in the embodiment of the present invention is set according to the alarm rules of each system. It is understandable that the narrower the preset time window is, the more frequently the alarm is triggered. Figure 2d yes Figure 2a The schematic diagram of judging abnormal points according to the peak value of data in a preset window in the method shown is as follows: Figure 2d As shown, when it is determined that the target candidate abnormal point data is a data value peak within the preset time window including the current target candidate abnormal point data, the target candidate abnormal point data is determined to be abnormal point data. Through the above settings, for the target candidate abnormal point data in the first data value subqueue, according to the order of the size of the data value, it is judged in turn whether the data value of the target candidate abnormal point data in the timing queue is a data value peak within the preset time window including the target candidate abnormal point data. If it is a data value peak, the target candidate abnormal point data is adjusted and marked as abnormal point data, triggering an alarm notification. According to this, only when the data value of the target candidate abnormal point data is a data value peak within the preset time window, the target candidate abnormal point data is adjusted to abnormal point data, that is, the situation of repeated alarms is avoided. At the same time, the data value peak within the preset time window is used as the judgment basis, which avoids the fluctuation of the indicator threshold caused by changes in the system load or application environment, thereby causing the misjudgment of abnormal points.

[0084] In some of the embodiments, after the step of obtaining the timing queue corresponding to the detection index data, the method further includes: classifying the detection index data in the timing queue according to the data source, obtaining timing queues corresponding to different categories of detection index data, and performing abnormal point identification of the detection index data for different categories of timing queues.

[0085] Since the abnormal indicator thresholds of different systems or clusters are usually different, and the fluctuations of system load and application environment also affect the abnormal indicator thresholds. Through the above settings, the detection indicator data is classified according to the data source, and then the abnormal points are identified for different categories of detection indicator data, which further improves the accuracy of abnormal point identification.

[0086] In some of the embodiments, the steps of performing abnormal point identification of detection index data for different categories of timing queues include: obtaining a second threshold corresponding to different data sources, and performing a first abnormal point identification on the detection index data in the corresponding timing queue according to the second threshold; determining the data value queues corresponding to the different categories of timing queues, and determining the first data value sub-queues corresponding to the different categories of data value queues, and performing a second abnormal point identification on the detection index data in the first data value sub-queue according to the data value peak judgment strategy within a preset time window.

[0087] Among them, the "data value peak judgment strategy within the preset time window" provided in the embodiment of the present invention refers to judging whether the data value corresponding to the target candidate abnormal point data in the first data value subqueue is a data value peak within the preset time window including the target candidate abnormal point data in the timing queue, and if so, the target candidate abnormal point data is determined to be abnormal point data. Through the above example, the embodiment of the present invention performs a first abnormal point identification on the detection index data in the timing queue with a second threshold, and then classifies the detection index data, and determines different categories of data value queues and first data value subqueues, and then combines the data value peak judgment strategy of the preset time window to perform a second abnormal point identification on the detection index data, which can cope with the diverse needs of users for abnormal point identification, expand the applicable scenarios of the abnormal point identification method, and effectively improve the accuracy of abnormal point identification.

[0088] The above-mentioned method for identifying abnormal points of detection index data provided by the embodiment of the present invention is to obtain the time series queue corresponding to the detection index data, arrange the detection index data in the time series queue in the order of the size of the data value, and obtain the data value queue corresponding to the detection index data; divide the data value queue according to the proportion of abnormal point data to obtain the first data value sub-queue; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data; determine whether the target candidate abnormal point data in the first data value sub-queue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determine that the target candidate abnormal point data corresponding to the data value peak is the abnormal point data. The efficiency and accuracy of abnormal point identification of the detection index data are improved, the situation of repeated alarms is avoided, the stability of system operation is improved, and the application scenarios of abnormal point identification are expanded.

[0089] Based on the above-mentioned method for identifying abnormal points in detection index data provided by the embodiment of the present invention, the embodiment of the present invention also provides a device for identifying abnormal points in detection index data, which is applied to identify abnormal points in detection index data in an automatic detection and diagnosis system. Figure 3 As shown, the abnormal point identification device 300 for detecting index data includes:

[0090] The data processing module 301 is used to obtain a time series queue corresponding to the detection index data, and arrange the detection index data in the time series queue in order of the size of the data value to obtain a data value queue corresponding to the detection index data.

[0091] Among them, the timing queue provided in the embodiment of the present invention refers to the queue obtained by arranging the acquired detection index data in the order of the timestamps generated by the data. Through the above settings, the data processing module first obtains the timing queue corresponding to the detection index data, and then determines the data value queue of the detection index data according to the order of the size of the data value. Subsequently, the candidate abnormal point data can be quickly and accurately determined through the data value queue to reduce the data volume range of abnormal point data identification, thereby improving the identification efficiency, and then the abnormal point identification of the candidate abnormal point data is performed in combination with the timing queue to improve the accuracy of abnormal point identification and avoid misjudgment and repeated alarms.

[0092] The queue division module 302 is used to divide the data value queue into a first data value sub-queue according to the abnormal point data ratio; wherein the detection indicator data in the first data value sub-queue is the candidate abnormal point data.

[0093] Among them, the proportion of abnormal point data provided by the embodiment of the present invention can be determined in combination with the proportion of abnormal point data in historical data. At the same time, since the detection index data in the first data value subqueue is the candidate abnormal point data, it can be understood that the data value of the candidate abnormal point data in the first data value subqueue is relatively high. In the actual processing process, in order to improve the accuracy of abnormal point identification, the proportion of abnormal point data can be appropriately increased based on the abnormal point data proportion determined by the historical data, and the proportion of candidate abnormal point data can be appropriately expanded accordingly, which not only reduces the amount of calculation required for abnormal point identification for all detection index data, improves the efficiency of abnormal point identification, but also can further avoid the occurrence of misjudgment and missed judgment.

[0094] The outlier identification module 303 is used to determine whether the target candidate outlier data in the first data value sub-queue is a data value peak within a preset time window including the target candidate outlier data in the timing queue, and if so, determine that the target candidate outlier data corresponding to the data value peak is the outlier data.

[0095] The embodiment of the present invention creatively proposes a solution for identifying anomalies in an ordered queue window peak, by dividing the data value queue, determining the first data value sub-queue corresponding to the target candidate anomaly data, and then sequentially judging whether each target candidate anomaly data in the first data value sub-queue is a data value peak of a preset time window including the detection index data in the timing queue. This achieves the technical effect of improving the efficiency and accuracy of anomaly identification of detection index data, avoiding repeated alarms, and improving the stability of system operation. At the same time, the above-mentioned preset time window can be adjusted according to the alarm frequency during actual operation, which not only avoids repeated alarms, but also expands the application scenarios of anomaly identification.

[0096] In some of the embodiments, the above-mentioned outlier identification module 303 is also used to: take out target candidate outlier data from the first data value subqueue in order from large to small data values, and determine whether the data value corresponding to the target candidate outlier data in the timing queue is a data value peak within a preset time window including the target candidate outlier data; if so, retain the target candidate outlier data from the first data value subqueue; if not, delete the target candidate outlier data from the first data value subqueue; and determine that the target candidate outlier data retained in the first data value subqueue is the outlier data.

[0097] Among them, the preset time window provided by the embodiment of the present invention is set according to the alarm rules of each system. It is understandable that the narrower the preset time window, the more frequently the alarm is triggered. Through the above settings, for the target candidate abnormal point data in the first data value subqueue, the data value of the target candidate abnormal point data is judged in sequence according to the size order of the data value in the timing queue. Whether it is a data value peak within the preset time window including the target candidate abnormal point data, if it is a data value peak, the target candidate abnormal point data is adjusted and marked as abnormal point data, triggering an alarm notification. According to this, only when the data value of the target candidate abnormal point data is a data value peak within the preset time window, the target candidate abnormal point data is adjusted to abnormal point data, that is, the situation of repeated alarms is avoided. At the same time, the data value peak within the preset time window is used as the judgment basis, which avoids the fluctuation of the indicator threshold caused by changes in the system load or application environment, thereby causing the misjudgment of abnormal points.

[0098] In some of the embodiments, the abnormal point identification device 300 for the detection index data further includes a screening module. After the step of dividing the first data value sub-queue from the data value queue according to the abnormal point data ratio, the screening module is used to: divide the second data value sub-queue from the data value queue according to the normal point data ratio; wherein the data value of the detection index data in the second data value sub-queue is less than or equal to the data value of the detection index data in the first data value sub-queue, and the sum of the normal point data ratio and the abnormal point data ratio is 1; determine the jitter value and the average value of the detection index data in the second data value sub-queue, and determine the first threshold value according to the jitter value and the average value; and screen the detection index data in the first data value sub-queue according to the first threshold value.

[0099] Through the above settings, the detection index data included in the first data value subqueue is the candidate abnormal point data, and the detection index data included in the second data subqueue is the normal point data. The first threshold is determined according to the jitter value and the average value determined by multiple normal point data in the second data value subqueue, and then the detection index data in the first data value subqueue is screened by the first threshold, that is, the candidate abnormal point data is screened, and the detection index data in the first data value subqueue whose data value is less than or equal to the first threshold is deleted from the first data value subqueue, further narrowing the range of the candidate abnormal point data, reducing the amount of calculation required for subsequent abnormal point identification, and improving the efficiency of abnormal point identification. At the same time, because the first threshold is determined according to the normal point data in the second data value subqueue, the first threshold can respond to changes in the system load and application environment, expanding the application scenarios of abnormal point identification.

[0100] In some of the embodiments, the above-mentioned screening module is also used to: determine the maximum data value and the minimum data value corresponding to the detection index data in the second data value subqueue, and subtract the minimum data value from the maximum data value to obtain the jitter value; calculate the average value corresponding to the detection index data in the second data value subqueue; add the jitter value to the average value to obtain the first threshold value.

[0101] The above steps provide an example of determining a first threshold value in an embodiment of the present invention. Since the detection index data in the second data value subqueue is normal point data, the first threshold value determined by the scheme shown in the above example can effectively respond to changes in the system load and application environment, avoid misjudgment caused by the use of a single fixed threshold value in related technologies, and can also effectively narrow the range of candidate abnormal point data in the first data subqueue while ensuring the accuracy of abnormal point identification, which helps to further improve the efficiency of abnormal point identification.

[0102] In some embodiments, the queue division module 302 is further used to: obtain the abnormal point data ratio, determine the total amount of detection index data in the data value queue, determine the amount of data of the first data value subqueue according to the total amount of data and the abnormal point data ratio; and divide the data value queue to obtain the first data value subqueue according to the amount of data of the first data value subqueue. After the first data value subqueue is obtained, the remaining detection index data in the data value queue can be divided into the second data value subqueue.

[0103] Among them, the sum of the abnormal point data ratio and the normal point data ratio provided by the embodiment of the present invention is 100%. According to a specific implementation of the embodiment of the present invention, the data volume of the second data value subqueue can be determined based on the normal point data ratio and the total data volume, and then the detection index data with a smaller data value corresponding to the data volume of the second data value subqueue is selected from the data value queue to obtain the second data value subqueue, and the remaining detection index data in the data value queue constitutes the first data value subqueue. According to another specific implementation of the embodiment of the present invention, the data volume of the first data value subqueue can also be determined based on the abnormal point data ratio and the total data volume, and then the detection index data with a larger data value corresponding to the data volume of the first data value subqueue is selected from the data value queue to obtain the first data value subqueue, and the remaining detection index data in the data value queue constitutes the second data value subqueue.

[0104] In some of the embodiments, the above-mentioned detection index data anomaly point identification device 300 also includes a second threshold identification module. After the step of obtaining the timing queue corresponding to the detection index data, the second threshold identification module is used to identify anomalies of the detection index data in the timing queue according to the obtained second threshold, and determine that the detection index data with a data value greater than the second threshold is anomaly point data.

[0105] In order to respond to the different needs of users, through the above settings, a second threshold that is larger than the empirical threshold can be set to identify the first abnormal point of the acquired timing queue according to the second threshold, that is, to issue timely alarms for more extreme abnormal situations to ensure system stability and avoid system downtime or greater losses to application services.

[0106] In some of the embodiments, the above-mentioned device 300 for identifying anomalies in detection index data further includes a classification and identification module. After the step of obtaining the timing queue corresponding to the detection index data, the above-mentioned classification and identification module is used to: classify the detection index data in the timing queue according to the data source, obtain timing queues corresponding to different categories of detection index data, and perform abnormal point identification of the detection index data for different categories of timing queues.

[0107] Since the abnormal indicator thresholds of different systems or clusters are usually different, and the fluctuations of system load and application environment also affect the abnormal indicator thresholds. Through the above settings, the detection indicator data is classified according to the data source, and then the abnormal points are identified for different categories of detection indicator data, which further improves the accuracy of abnormal point identification.

[0108] In some of the embodiments, the classification and identification module is also used to: obtain a second threshold corresponding to different data sources, and perform a first anomaly point identification on the detection index data in the corresponding timing queue according to the second threshold; determine the data value queues corresponding to the timing queues of different categories, and determine the first data value sub-queues corresponding to the data value queues of different categories, and perform a second anomaly point identification on the detection index data in the first data value sub-queue according to the data value peak judgment strategy within a preset time window.

[0109] Among them, the "data value peak judgment strategy within the preset time window" provided in the embodiment of the present invention refers to judging whether the data value corresponding to the target candidate abnormal point data in the first data value subqueue is a data value peak within the preset time window including the target candidate abnormal point data in the timing queue, and if so, the target candidate abnormal point data is determined to be abnormal point data. Through the above example, the embodiment of the present invention performs a first abnormal point identification on the detection index data in the timing queue with a second threshold, and then classifies the detection index data, and determines different categories of data value queues and first data value subqueues, and then combines the data value peak judgment strategy of the preset time window to perform a second abnormal point identification on the detection index data, which can cope with the diverse needs of users for abnormal point identification, expand the applicable scenarios of the abnormal point identification method, and effectively improve the accuracy of abnormal point identification.

[0110] The above-mentioned abnormal point identification device for detection index data provided by the embodiment of the present invention has a data processing module for obtaining a time series queue corresponding to the detection index data, arranging the detection index data in the time series queue in order of the size of the data value, and obtaining a data value queue corresponding to the detection index data; the queue division module is used to divide the data value queue into a first data value sub-queue according to the abnormal point data ratio; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data; the abnormal point identification module is used to determine whether the target candidate abnormal point data in the first data value sub-queue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determining the target candidate abnormal point data corresponding to the data value peak as the abnormal point data, thereby improving the abnormal point identification efficiency and identification accuracy of the detection index data, avoiding the situation of repeated alarms, improving the stability of system operation, and expanding the application scenarios of abnormal point identification.

[0111] An embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory in communication with the at least one processor. The memory stores a computer program executable by the at least one processor, and when the at least one processor executes the computer program, the electronic device executes the method for identifying abnormal points in the detection index data of the embodiment of the present invention.

[0112] An embodiment of the present invention further provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the method for identifying abnormal points in detection index data of an embodiment of the present invention.

[0113] An embodiment of the present invention further provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the method for identifying abnormal points in detection indicator data of an embodiment of the present invention.

[0114] refer to Figure 4 , a block diagram of an electronic device that can be used as a server or client of an embodiment of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 4 As shown, the electronic device includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In RAM 403, various programs and data required for the operation of the electronic device can also be stored. The computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0116] Multiple components in the electronic device are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 can be any type of device that can input information to the electronic device, and the input unit 406 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 407 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include but is not limited to a disk, an optical disk. The communication unit 409 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0117] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be stored in a ROM.

[0118] 402 and / or the communication unit 409 are loaded and / or installed on the electronic device. In some embodiments, the computing unit 401 can be configured to execute the above method in any other appropriate manner (for example, by means of firmware).

[0119] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0120] In the context of an embodiment of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0121] It should be noted that the term "including" and its variations used in the embodiments of the present invention are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0122] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the detection indicator data obtained by the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0123] The various steps described in the method implementation methods provided in the embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present invention is not limited in this respect.

[0124] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0125] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A method for identifying abnormal points in detection indicator data, comprising: Acquire a time series queue corresponding to the detection index data, arrange the detection index data in the time series queue in order of data value, and obtain a data value queue corresponding to the detection index data; According to the abnormal point data ratio, a first data value sub-queue is obtained from the data value queue; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data; Determine whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the timing queue; if so, determine that the target candidate abnormal point data corresponding to the data value peak is the abnormal point data.

2. The method according to claim 1, wherein: The step of determining whether the target candidate abnormal point data in the first data value subqueue is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue, and if so, determining that the target candidate abnormal point data corresponding to the data value peak is abnormal point data comprises: According to the order of data values ​​from large to small, the target candidate abnormal point data is taken out from the first data value subqueue, and it is determined whether the data value corresponding to the target candidate abnormal point data is a data value peak within a preset time window including the target candidate abnormal point data in the time series queue; If yes, retain the target candidate outlier point data from the first data value subqueue; if no, delete the target candidate outlier point data from the first data value subqueue; The target candidate outlier data retained in the first data value subqueue is determined to be outlier data.

3. The method according to claim 1, wherein: After the step of dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio, the method further includes: According to the normal point data ratio, a second data value sub-queue is obtained from the data value queue; wherein the data value of the detection index data in the second data value sub-queue is less than or equal to the data value of the detection index data in the first data value sub-queue; wherein the sum of the normal point data ratio and the abnormal point data ratio is 1; Determine a jitter value and an average value of the detection indicator data in the second data value subqueue, and determine a first threshold value according to the jitter value and the average value; The detection indicator data in the first data value subqueue is screened according to the first threshold.

4. The method according to claim 3, wherein: The step of determining a jitter value and an average value of the detection indicator data in the second data value subqueue, and determining a first threshold value according to the jitter value and the average value, comprises: Determine a maximum data value and a minimum data value corresponding to the detection indicator data in the second data value subqueue, and subtract the minimum data value from the maximum data value to obtain the jitter value; Calculate the average value corresponding to the detection indicator data in the second data value subqueue; The jitter value is added to the average value to obtain the first threshold.

5. The method according to claim 1, wherein: The step of dividing the data value queue into a first data value sub-queue according to the abnormal point data ratio comprises: Acquire the abnormal point data ratio, determine the total amount of detection index data in the data value queue, and determine the data amount of the first data value sub-queue according to the total amount of data and the abnormal point data ratio; The first data value sub-queue is obtained by dividing the data value queue according to the data amount of the first data value sub-queue.

6. The method according to claim 1, wherein: After the step of obtaining the timing queue corresponding to the detection index data, the method further includes: A second threshold is obtained, and abnormal point identification is performed on the detection indicator data in the timing queue according to the second threshold, and the detection indicator data having a data value greater than the second threshold is determined as abnormal point data.

7. The method according to claim 1, wherein: After the step of obtaining the timing queue corresponding to the detection index data, the method further includes: The detection index data in the time series queue is classified according to the data source to obtain time series queues corresponding to different categories of detection index data, and abnormal point identification of the detection index data is performed for different categories of time series queues.

8. The method according to claim 7, wherein: The steps of performing abnormal point identification of detection index data for different categories of time series queues respectively include: Obtaining second thresholds corresponding to different data sources, and performing first abnormal point identification on the detection indicator data in the corresponding time series queue according to the second thresholds; Determine the data value queues corresponding to the different categories of timing queues, and determine the first data value sub-queues corresponding to the different categories of data value queues, and perform a second abnormal point identification on the detection index data in the first data value sub-queue according to the data value peak judgment strategy within the preset time window.

9. A device for identifying abnormal points of detection index data, comprising: A data processing module is used to obtain a time series queue corresponding to the detection index data, and arrange the detection index data in the time series queue in order of the size of the data value to obtain a data value queue corresponding to the detection index data; A queue division module, configured to divide the data value queue into a first data value sub-queue according to the abnormal point data ratio; wherein the detection index data in the first data value sub-queue is the candidate abnormal point data; The outlier point identification module is used to determine whether the target candidate outlier point data in the first data value sub-queue is a data value peak within a preset time window including the target candidate outlier point data in the timing queue, and if so, determine that the target candidate outlier point data corresponding to the data value peak is the outlier point data.

10. An electronic device comprising: A processor, and a memory storing a program, wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 8.

11. A non-transitory machine-readable medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-8.

Images