Anomaly detection method and device of main network equipment and electronic equipment

Abstract

The invention discloses an anomaly detection method and device for main network equipment and electronic equipment. The method comprises the following steps: acquiring historical operation data of main network equipment, and determining standard operation data of the main network equipment; inputting the historical operation data into the target model to obtain predicted operation data of the target date; calculating a historical deviation value based on the historical operation data and the standard operation data, calculating a predicted deviation value based on the predicted operation data and the standard operation data, and calculating a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; and when the comprehensive deviation value is greater than or equal to a deviation value threshold value, determining the operation state of the main network equipment as an abnormal operation state, and when the comprehensive deviation value is smaller than the deviation value threshold value, determining the operation state of the main network equipment as a normal operation state. Through the method and the device, the problem of low accuracy of the anomaly detection result of the main network equipment in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of main networks, and more specifically, to a method, device and electronic device for detecting anomalies of main network equipment. Background Art

[0002] The main grid equipment operates for a long time and is affected by natural factors, mechanical factors, grid operation and other factors. The operating status will be damaged, resulting in abnormal equipment operation status. It is necessary to detect the equipment operation status in time and issue early warnings for abnormal conditions to avoid losses caused by equipment damage.

[0003] In the related art, the abnormal detection of main network equipment relies on manual regular inspections, which has problems such as low efficiency, high cost, long inspection cycle, and inability to monitor the equipment status in real time. In addition, the detection method of the main network equipment also uses some IoT-based sensors to monitor the equipment status. However, the sensor data lacks effective data integration and analysis, which makes it difficult to form a comprehensive assessment of the equipment health status. Since the detection method of the main network equipment in the related art lacks real-time analysis capabilities and cannot promptly detect early signs of equipment failure, the accuracy of the abnormal detection results of the main network equipment is low.

[0004] Currently, no effective solution has been proposed to address the problem of low accuracy of abnormal detection results of main network devices in related technologies. Summary of the invention

[0005] The main purpose of the present application is to provide a method, device and electronic device for detecting anomalies of a main network device, so as to solve the problem of low accuracy of anomaly detection results of the main network device in the related art.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for detecting anomalies of a main network device is provided. The method includes: obtaining historical operation data of the main network device within a preset period, and determining the standard operation data of the main network device in a non-abnormal state; inputting the historical operation data into a target model to obtain predicted operation data of a target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; calculating a historical deviation value based on the historical operation data and the standard operation data, calculating a predicted deviation value based on the predicted operation data and the standard operation data, and calculating a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; when the comprehensive deviation value is greater than or equal to the deviation value threshold, determining the operation state of the main network device as an abnormal operation state, and when the comprehensive deviation value is less than the deviation value threshold, determining the operation state of the main network device as a normal operation state.

[0007] Optionally, calculating the historical deviation value based on historical operating data and standard operating data includes: determining multiple parameters contained in the operating data of the main network device, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; for each parameter, calculating the square of the difference between the historical monitoring value and the standard value of the parameter to obtain a first deviation value of the parameter, wherein the historical monitoring value is the data value of the parameter in the historical operating data, and the standard value is the data value of the parameter in the standard operating data; calculating the sum of the first deviation values ​​of all parameters, and inputting the sum into a preset time decay function to obtain an output value, and calculating the square root of the output value to obtain the historical deviation value.

[0008] Optionally, calculating the predicted deviation value based on the predicted operating data and the standard operating data includes: determining multiple parameters contained in the operating data of the main network equipment, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; for each parameter, calculating the square of the difference between the predicted monitoring value and the standard value of the parameter to obtain a second deviation value of the parameter, wherein the predicted monitoring value is the data value of the parameter in the predicted operating data, and the standard value is the data value of the parameter in the standard operating data; calculating the sum of the second deviation values ​​of all parameters, and inputting the sum into a preset time attenuation function to obtain an output value, and calculating the square root of the output value to obtain a predicted deviation value.

[0009] Optionally, calculating the comprehensive deviation value through historical deviation values, predicted deviation values, historical operation data, standard operation data and predicted operation data includes: calculating the absolute value of the difference between the historical deviation value and the predicted deviation value, and inputting the absolute value of the difference into an activation function to obtain a deviation difference value, and calculating the deviation difference evaluation value based on the deviation difference value and a dynamic threshold, wherein the dynamic threshold is determined by a threshold mapping table, the threshold mapping table contains multiple groups of mapping relationships, and each group of mapping relationships represents a mapping relationship between a moment and a threshold; calculating the Mahalanobis distance between the historical operation data and the standard operation data to obtain a first deviation value, and calculating the Mahalanobis distance between the predicted operation data and the standard operation data to obtain a second deviation value; calculating the absolute value of the difference between the first deviation value and the second deviation value to obtain a target deviation difference value; inputting the deviation difference evaluation value and the target deviation difference value into the mapping function to obtain a comprehensive deviation value.

[0010] Optionally, calculating the deviation difference evaluation value based on the deviation difference value and the dynamic threshold includes: determining the deviation difference value and the dynamic threshold at the target moment, and judging whether the deviation difference value is less than or equal to the dynamic threshold; when the deviation difference value is less than or equal to the dynamic threshold, determining the preset value as the deviation difference evaluation value; when the deviation difference value is greater than the dynamic threshold, calculating the difference between the deviation difference value and the target value, and determining the difference as the deviation difference evaluation value.

[0011] Optionally, the method also includes: determining the operating status of all main network devices of the target main network, and determining the main network devices with abnormal operating status as target patrol devices; acquiring the location information of all main network devices, obtaining a location information set, and determining a patrol path according to the location information set and the target patrol devices, wherein the patrol time of the target patrol devices in the patrol path is earlier than the patrol time of the non-target patrol devices; controlling the intelligent robot to patrol all main network devices according to the patrol path, and detecting whether each main network device has an operating risk, and issuing a prompt message when it is detected that the main network device has an operating risk, wherein the prompt message is used to prompt the operation and maintenance personnel to maintain the main network devices.

[0012] Optionally, the target model is trained in the following manner: obtain the operation data records of the main network equipment, extract sample historical operation data from the operation data records at every preset period, and determine the operation data of the sample historical operation data on adjacent dates in the operation data records as sample predicted operation data; determine the sample historical operation data within each preset period and the sample predicted operation data on adjacent dates as a group of training samples to obtain multiple groups of training samples; train the preset neural network model based on the multiple groups of training samples to obtain the target model.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a device for detecting an abnormality of a main network device is provided. The device includes: an acquisition unit, which is used to acquire the historical operation data of the main network device within a preset period, and determine the standard operation data of the main network device in a non-abnormal state; an input unit, which is used to input the historical operation data into a target model to obtain the predicted operation data of the target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; a calculation unit, which is used to calculate the historical deviation value based on the historical operation data and the standard operation data, calculate the predicted deviation value based on the predicted operation data and the standard operation data, and calculate the comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; a determination unit, which is used to determine the operation state of the main network device as an abnormal operation state when the comprehensive deviation value is greater than or equal to the deviation value threshold, and determine the operation state of the main network device as a normal operation state when the comprehensive deviation value is less than the deviation value threshold.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of the method for detecting anomalies of a main network device described in each embodiment of the present application.

[0015] Through the present application, the following steps are adopted: obtaining historical operation data within a preset period of the main network equipment, and determining the standard operation data of the main network equipment under a non-abnormal state; inputting the historical operation data into a target model to obtain predicted operation data for a target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; calculating a historical deviation value based on the historical operation data and the standard operation data, calculating a predicted deviation value based on the predicted operation data and the standard operation data, and calculating a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; when the comprehensive deviation value is greater than or equal to the deviation value threshold, determining the operation state of the main network equipment as an abnormal operation state, and when the comprehensive deviation value is less than the deviation value threshold, determining the operation state of the main network equipment as a normal operation state, thereby solving the problem of low accuracy of abnormal detection results of the main network equipment in the related art. The predicted operation data of the main network equipment is predicted through machine learning models and historical operation data. The deviation between the operation data and the standard operation data is accurately judged by calculating the historical deviation value, the predicted deviation value and the comprehensive deviation value. The comprehensive deviation value integrates the information of the historical deviation value and the predicted deviation value, providing a comprehensive perspective of the current and future operation status of the main network equipment, and enhancing the accuracy and reliability of the equipment status assessment. This enables a more accurate prediction of the status of the main network equipment. This achieves the effect of improving the accuracy of the abnormal detection results of the main network equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 is a flow chart of a method for detecting anomalies of a primary network device according to an embodiment of the present application;

[0018] Figure 2 is a schematic diagram of an abnormality detection device for a main network device provided according to an embodiment of the present application;

[0019] Figure 3 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0024] It should be noted that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0025] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a method for detecting anomalies of a primary network device according to an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0026] Step S101, obtaining historical operation data of the main network device within a preset period, and determining standard operation data of the main network device in a normal state.

[0027] In step S101, the preset period may be a period set according to expert experience, which may be one day, one week or one month, etc., and the historical operation data may be parameters such as voltage, current, power, temperature, humidity, load rate, etc. of the main network equipment. The standard operation data may be the operation data of the main network equipment under normal operating conditions (i.e., no abnormal conditions) analyzed by using statistical analysis methods (such as mean, standard deviation, percentile, etc.) or machine learning algorithms (such as cluster analysis). In addition, the standard operation data may also be combined with expert experience, refer to the technical specifications of the main network equipment manufacturer, engineering design standards or data obtained through performance testing, and determine the various parameter values ​​of the main network equipment under ideal operating conditions as standard operation data.

[0028] Step S102, inputting the historical operation data into the target model to obtain the predicted operation data of the target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data.

[0029] In step S102, the target model may be a long short-term memory network model, which is a neural network suitable for processing sequence data and can effectively capture long-term dependencies in time series. The target model is trained by multiple sets of training samples so that the target model can predict the predicted operating data of the main network equipment on the target date.

[0030] Step S103, calculate the historical deviation value based on the historical operation data and the standard operation data, calculate the predicted deviation value based on the predicted operation data and the standard operation data, and calculate the comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data.

[0031] In step S103, since the operation data of the main network equipment includes multiple parameters, each parameter corresponds to a historical monitoring value, a standard value and a predicted monitoring value. By calculating the square of the difference between the historical monitoring value and the standard value of each parameter, then calculating the sum of the squares of the differences of all parameters, and inputting the sum into a preset time decay function, solving the square root of the output value of the preset time decay function to obtain the historical deviation value, by calculating the square of the difference between the predicted monitoring value and the standard value of each parameter, then calculating the sum of the squares of the differences of all parameters, and inputting the sum into a preset time decay function, solving the square root of the output value of the preset time decay function to obtain the predicted deviation value. Finally, the comprehensive deviation value is calculated based on the Mahalanobis distance between the predicted operation data and the standard operation data, and the Mahalanobis distance between the historical operation data and the standard operation data.

[0032] Step S104, when the comprehensive deviation value is greater than or equal to the deviation value threshold, the operating state of the main network device is determined to be an abnormal operating state; when the comprehensive deviation value is less than the deviation value threshold, the operating state of the main network device is determined to be a normal operating state.

[0033] In step S104, the deviation value and the threshold may be values ​​set according to expert experience. The comprehensive deviation value is compared with the deviation value threshold. If the comprehensive deviation value is less than the deviation value threshold, the main network device corresponding to the comprehensive deviation value is in a normal operating state; if the comprehensive deviation value is greater than or equal to the deviation value threshold, the main network device corresponding to the comprehensive deviation value is in an abnormal operating state.

[0034] It should be noted that if the main network device is in an abnormal operating state, further diagnosis and maintenance are required. Exemplarily, the real-time data of the main network device is re-predicted multiple times, the predicted deviation value and the comprehensive deviation value are recalculated based on the obtained predicted value, and the comprehensive deviation is compared with the deviation value threshold. If the comprehensive deviation value is less than the deviation value threshold, it is determined that the main network device is in a normal operating state; if the comprehensive deviation value is greater than or equal to the deviation value threshold, it returns to re-prediction until the comprehensive deviation value is less than the deviation value threshold and stops predicting. If after several repeated executions, the comprehensive deviation value is still greater than or equal to the deviation value threshold, it is considered that the main network device is in an abnormal operating state.

[0035] In some examples, the deviation threshold is determined based on the percentage deviation from the ideal value (i.e., standard operating data), and the deviation threshold may be a dynamic threshold, for example, the parameters of the main network device are allowed to fluctuate within the range of ±5% of the ideal value. The value range of the deviation threshold is: greater than or equal to 0.95I and less than or equal to 1.05I, where I represents the ideal value. The threshold is set to 95% to 105% of the ideal parameter value, which means that the actual value of the device parameter is allowed to fluctuate within a range of ±5%, in order to accommodate normal changes and measurement errors during the operation of the main network device. It is used to balance the sensitivity and stability of the device status monitoring of the main network device, avoid frequent false alarms due to excessive sensitivity, and ensure that early warnings of the device status are not missed due to the judgment threshold being set too wide.

[0036] For example, the current of a transformer under ideal operating conditions is 100A, and through historical data analysis, its normal operating range is 95A to 105A. In the future, due to changes in the external environment, the optimal operating current of the transformer may fluctuate to 98A to 102A. At this time, the dynamic deviation threshold will be adjusted to 98A to 102A instead of the fixed 95A to 105A. In this way, even if the actual current value is 101A, it will not be mistakenly marked as abnormal because the dynamic deviation threshold has taken into account the current operating conditions.

[0037] The method for detecting anomalies of a main network device provided in an embodiment of the present application obtains historical operation data of the main network device within a preset period, and determines standard operation data of the main network device in a non-abnormal state; inputs the historical operation data into a target model to obtain predicted operation data of a target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; calculates a historical deviation value based on the historical operation data and the standard operation data, calculates a predicted deviation value based on the predicted operation data and the standard operation data, and calculates a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; when the comprehensive deviation value is greater than or equal to a deviation value threshold, determines the operation state of the main network device as an abnormal operation state, and when the comprehensive deviation value is less than the deviation value threshold, determines the operation state of the main network device as a normal operation state, thereby solving the problem of low accuracy of abnormal detection results of the main network device in the related art. The predicted operation data of the main network equipment is predicted through machine learning models and historical operation data. The deviation between the operation data and the standard operation data is accurately judged by calculating the historical deviation value, the predicted deviation value and the comprehensive deviation value. The comprehensive deviation value integrates the information of the historical deviation value and the predicted deviation value, providing a comprehensive perspective of the current and future operation status of the main network equipment, and enhancing the accuracy and reliability of the equipment status assessment. This enables a more accurate prediction of the status of the main network equipment. This achieves the effect of improving the accuracy of the abnormal detection results of the main network equipment.

[0038] In order to improve the accuracy of predicting abnormal states of equipment, historical deviation values ​​are introduced when evaluating whether the equipment has an abnormality, so as to improve the comprehensiveness of data used to predict abnormal states of equipment. Optionally, in the abnormality detection method for main network equipment provided in an embodiment of the present application, calculating historical deviation values ​​based on historical operating data and standard operating data includes: determining multiple parameters contained in the operating data of the main network equipment, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; for each parameter, calculating the square of the difference between the historical monitoring value and the standard value of the parameter to obtain a first deviation value of the parameter, wherein the historical monitoring value is the data value of the parameter in the historical operating data, and the standard value is the data value of the parameter in the standard operating data; calculating the sum of the first deviation values ​​of all parameters, and inputting the sum into a preset time decay function to obtain an output value, and calculating the square root of the output value to obtain the historical deviation value.

[0039] In some examples, the historical deviation value can be calculated by the following formula:

[0040]

[0041] Among them, x represents the historical deviation value of the main network device, n represents the maximum number of parameters of the main network device, ω i(t) is a preset time decay function, such as an exponential decay function, a Gaussian decay function, etc., H i Represents the historical monitoring value of the i-th parameter of the main network device, I i Represents the standard value of the i-th parameter of the main network device.

[0042] This embodiment calculates historical deviation values ​​as the influencing factors of historical operating data on predicting abnormal states of equipment, and then calculates comprehensive deviation values ​​based on the historical deviation values, so as to evaluate whether there is any abnormality in the main network equipment through the comprehensive deviation values, thereby improving the comprehensiveness of data used to predict abnormal states of equipment, and further improving the accuracy of predicting abnormal states of main network equipment.

[0043] The degree of influence of the predicted operating data on the predicted device abnormal state is evaluated by calculating the predicted deviation value. Optionally, in the abnormality detection method for the main network device provided in the embodiment of the present application, the predicted deviation value is calculated based on the predicted operating data and the standard operating data, including: determining multiple parameters contained in the operating data of the main network device, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; for each parameter, calculating the square of the difference between the predicted monitoring value and the standard value of the parameter to obtain a second deviation value of the parameter, wherein the predicted monitoring value is the data value of the parameter in the predicted operating data, and the standard value is the data value of the parameter in the standard operating data; calculating the sum of the second deviation values ​​of all parameters, and inputting the sum into a preset time decay function to obtain an output value, and calculating the square root of the output value to obtain the predicted deviation value.

[0044] In some examples, the prediction deviation value can be calculated by the following formula:

[0045]

[0046] Among them, y represents the predicted deviation value of the main network device, n represents the maximum number of parameters of the main network device, ω i (t) is the preset time decay function, M i Represents the predicted monitoring value of the i-th parameter of the main network device, I i Represents the standard value of the i-th parameter of the main network device.

[0047] This embodiment calculates the predicted deviation value as the influencing factor of the predicted operating data on the predicted equipment abnormal state, and then calculates the comprehensive deviation value based on the predicted deviation value, so as to evaluate whether the main network equipment has an abnormality through the comprehensive deviation value, thereby improving the comprehensiveness of the data used to predict the abnormal state of the equipment, and further improving the accuracy of predicting the abnormal state of the main network equipment.

[0048] After calculating the historical deviation value and the predicted deviation value, a comprehensive deviation value is calculated using the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data. Optionally, in the abnormality detection method for the main network device provided in the embodiment of the present application, calculating the comprehensive deviation value using the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data includes: calculating the absolute value of the difference between the historical deviation value and the predicted deviation value, and inputting the absolute value of the difference into the activation function to obtain the deviation difference value, and calculating the deviation difference evaluation value based on the deviation difference value and the dynamic threshold, wherein the dynamic threshold is determined by a threshold mapping table, the threshold mapping table includes multiple groups of mapping relationships, each group of mapping relationships represents a mapping relationship between a moment and a threshold; calculating the Mahalanobis distance between the historical operation data and the standard operation data to obtain a first deviation value, and calculating the Mahalanobis distance between the predicted operation data and the standard operation data to obtain a second deviation value; calculating the absolute value of the difference between the first deviation value and the second deviation value to obtain a target deviation difference value; inputting the deviation difference evaluation value and the target deviation difference value into the mapping function to obtain a comprehensive deviation value.

[0049] In some examples, the comprehensive deviation value can be calculated by the following formula:

[0050] X(t) = g(D(t), L);

[0051] Among them, X(t) represents the comprehensive deviation value of the main network equipment, g() represents the mapping function, D(t) represents the evaluation result of the deviation difference of the nonlinear effect at the tth moment, that is, the deviation difference evaluation value, and L represents the difference between the historical deviation value and the predicted deviation value calculated based on the Mahalanobis distance, that is, the target deviation difference value.

[0052] The target deviation difference value can be calculated by the following formula:

[0053] L = |x′-y′|;

[0054]

[0055] Wherein, x' represents the first deviation value, y' represents the second deviation value, A vector of historical operating data representing multiple parameters, represents the standard running data vector of multiple parameters, T represents the transpose operation, Representation vector The inverse matrix of A vector of forecast runs representing multiple parameters, Representation vector The inverse matrix of .

[0056] The calculation method of the comprehensive deviation value takes into account the historical deviation value, the predicted deviation value, the nonlinear effect deviation difference and the Mahalanobis distance deviation, forming an indicator that comprehensively reflects the equipment status. The Mahalanobis distance can comprehensively consider the correlation between multiple monitoring parameters and provide a multi-dimensional equipment status evaluation method. Compared with the deviation value of a single parameter, the deviation evaluation based on the Mahalanobis distance can more comprehensively reflect the comprehensive operating status of the equipment and help identify complex failure modes. Improve the prediction accuracy.

[0057] Optionally, in the abnormality detection method for the main network device provided in the embodiment of the present application, calculating the deviation difference evaluation value based on the deviation difference value and the dynamic threshold includes: determining the deviation difference value and the dynamic threshold at the target moment, and judging whether the deviation difference value is less than or equal to the dynamic threshold; when the deviation difference value is less than or equal to the dynamic threshold, determining the preset value as the deviation difference evaluation value; when the deviation difference value is greater than the dynamic threshold, calculating the difference between the deviation difference value and the target value, and determining the difference as the deviation difference evaluation value.

[0058] In some examples, the deviation difference evaluation value may be calculated using the following formula:

[0059]

[0060] Where z(t) represents the deviation difference considering the nonlinear effect at the tth moment. T(t) represents the dynamic threshold at the tth moment. The deviation difference of the nonlinear effect can be calculated by the following formula:

[0061] z = f(|xy|);

[0062]

[0063] Among them, z represents the deviation difference of nonlinear effect, f(|xy|) represents a nonlinear function, such as Sigmoid (activation) function, which is used to deal with the nonlinear relationship of deviation; α represents the adjustment parameter that controls the steepness of the nonlinear function.

[0064] When evaluating the deviation difference of the nonlinear effect in this embodiment, the threshold is considered as a dynamic threshold rather than a static threshold, that is, a different deviation value threshold can be set at each moment. The dynamic threshold is adjusted based on the operating status of the device, which can be closer to the actual operating conditions and avoid excessive or insufficient alarms that may be caused by static thresholds. The setting of the dynamic threshold is to better adapt to changes in the operating conditions of the device and improve the accuracy of device status detection.

[0065] Deviation difference assessment of nonlinear effects can more accurately capture subtle differences in equipment state changes, especially when equipment performance is affected by complex nonlinear factors. This assessment method can increase sensitivity to these nonlinear changes and thus detect potential problems earlier.

[0066] After determining the operating status of the main network device, a patrol plan can be formulated according to the operating status of different main network devices. Optionally, in the main network device abnormality detection method provided in the embodiment of the present application, the method also includes: determining the operating status of all main network devices of the target main network, and determining the main network device with an abnormal operating status as the target patrol device; obtaining the location information of all main network devices to obtain a location information set, and determining a patrol path according to the location information set and the target patrol device, wherein the patrol time of the target patrol device in the patrol path is earlier than the patrol time of the non-target patrol device; controlling the intelligent robot to patrol all main network devices according to the patrol path, and detecting whether each main network device has an operating risk, and issuing a prompt message when it is detected that the main network device has an operating risk, wherein the prompt message is used to prompt the operation and maintenance personnel to maintain the main network device.

[0067] In some examples, a higher patrol priority can be set for a main network device in an abnormal operating state, and a lower patrol priority can be set for a main network device in a normal operating state. That is, the formulated patrol plan prioritizes patrolling target patrol devices, and then patrols non-target patrol devices. Among them, the patrol path can be determined based on the geographical distribution of the main network devices and the priority of the device status, and a specific patrol schedule can be formulated based on the patrol path to ensure that the intelligent robot can complete the patrol of high-priority devices in the shortest time.

[0068] The intelligent robot performs patrol tasks according to the planned patrol path and schedule, collects on-site data, including but not limited to images, sounds, temperature readings, etc., for comparison with historical operation data and standard operation data. During the patrol process, the intelligent robot analyzes the collected data in real time, updates the equipment status, and adjusts the patrol plan according to the new equipment status. If a serious abnormality is found, the robot immediately notifies the maintenance personnel through prompt information for emergency response.

[0069] For example, obtain the location coordinates of all main network devices, convert them into points on the map, and map these points onto an electronic map to facilitate subsequent path planning. Select a suitable path planning algorithm, such as the Dijkstra algorithm, to find the shortest path from the starting point to the end point, and optimize the path planning in combination with the patrol priority. For target patrol devices with higher priority, arrange patrols at an earlier time period to ensure that problems are discovered and responded to in the first place.

[0070] This embodiment formulates an inspection strategy based on the inspection priority of the main network equipment, dispatches inspection resources more reasonably, avoids unnecessary inspections of equipment in good condition, ensures that high-risk equipment receives priority attention, and optimizes operation and maintenance costs.

[0071] In order to obtain the predicted operation data of the main network device, it is necessary to train the target model. Optionally, in the anomaly detection method of the main network device provided in the embodiment of the present application, the target model is trained in the following manner: obtaining the operation data record of the main network device, extracting sample historical operation data from the operation data record at every preset period, and determining the operation data of the sample historical operation data on the adjacent date in the operation data record as the sample predicted operation data; determining the sample historical operation data within each preset period and the sample predicted operation data on the adjacent date as a group of training samples to obtain multiple groups of training samples; training a preset neural network model based on the multiple groups of training samples to obtain a target model.

[0072] In some examples, data of the same period (such as each week) in the past year are collected from the operation data records, and each set of data contains sample historical operation data and sample predicted operation data. The data is cleaned to remove outliers, such as extreme voltage fluctuations or temperature readings, to ensure the quality of model training. Seven consecutive days of historical operation data can be selected as input, which represents the sequence length of the model input. The operation data of the next day corresponding to each set of sample historical operation data is used as sample predicted operation data. The collected data is divided into a training set, a validation set, and a test set, and the proportions can be 70%, 15%, and 15%. A neural network model containing multiple long short-term memory network layers is constructed. The long short-term memory network layer can remember the information in the sequence. Among them, the input layer of the preset neural network model: receives 7 days of historical operation data, each data contains multiple parameter values. Hidden layer: contains one or more long short-term memory network layers to capture the time dependency in the historical data. Output layer: outputs the predicted operation data for the next day.

[0073] Use the training set data to train the preset neural network model, and adjust the model parameters through the back propagation algorithm. The validation set is used to adjust the model's hyperparameters, such as learning rate, batch size, etc., to prevent overfitting. The test set is used to evaluate the final performance of the model. Select an appropriate loss function (such as mean square error) to evaluate the gap between the predicted value and the true value, and use an optimizer to minimize the loss function. Finally, the target model is trained.

[0074] In addition, the accuracy of the target model can be evaluated regularly using new historical data. If the model performs poorly or deviates, the model needs to be retrained. As the equipment runs, new historical operation data is continuously collected, which can be used to update the target model so that the target model can adapt to the operating characteristics of the equipment that change over time.

[0075] This embodiment constructs a target model that can predict the future operating status of the main network equipment to obtain the predicted operating data of the target date, thereby improving the accuracy of predicting the operating data of the main network equipment.

[0076] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0077] The embodiment of the present application also provides an abnormality detection device for a main network device. It should be noted that the abnormality detection device for a main network device in the embodiment of the present application can be used to execute the abnormality detection method for a main network device provided in the embodiment of the present application. The abnormality detection device for a main network device provided in the embodiment of the present application is introduced below.

[0078] Figure 2 Schematic diagram of an abnormality detection device for a main network device provided according to an embodiment of the present application. Figure 2 As shown, the device comprises:

[0079] The acquisition unit 201 is used to acquire the historical operation data of the main network device within a preset period and determine the standard operation data of the main network device in a normal state;

[0080] An input unit 202 is used to input historical operation data into a target model to obtain predicted operation data of a target date, wherein the target model is trained by multiple sets of training samples, each set of training samples includes sample historical operation data and sample predicted operation data;

[0081] A calculation unit 203, used to calculate a historical deviation value based on the historical operation data and the standard operation data, calculate a predicted deviation value based on the predicted operation data and the standard operation data, and calculate a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data;

[0082] The determination unit 204 is used to determine the operating state of the main network device as an abnormal operating state when the comprehensive deviation value is greater than or equal to the deviation value threshold, and to determine the operating state of the main network device as a normal operating state when the comprehensive deviation value is less than the deviation value threshold.

[0083] The abnormality detection device for main network equipment provided in the embodiment of the present application obtains the historical operation data of the main network equipment within a preset period through the acquisition unit 201, and determines the standard operation data of the main network equipment in a non-abnormal state; the input unit 202 inputs the historical operation data into the target model to obtain the predicted operation data of the target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; the calculation unit 203 calculates the historical deviation value based on the historical operation data and the standard operation data, calculates the predicted deviation value based on the predicted operation data and the standard operation data, and calculates the comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data; The determination unit 204 determines the operation state of the main network device as an abnormal operation state when the comprehensive deviation value is greater than or equal to the deviation value threshold, and determines the operation state of the main network device as a normal operation state when the comprehensive deviation value is less than the deviation value threshold, thereby solving the problem of low accuracy of the abnormal detection results of the main network device in the related art. The predicted operation data of the main network device is predicted by the machine learning model and the historical operation data. The deviation between the operation data and the standard operation data is accurately judged by calculating the historical deviation value, the predicted deviation value and the comprehensive deviation value. The comprehensive deviation value integrates the information of the historical deviation value and the predicted deviation value, provides a comprehensive perspective of the current and future operation states of the main network device, and enhances the accuracy and reliability of the device status assessment. Thus, the state of the main network device can be predicted more accurately. Thus, the accuracy of the abnormal detection results of the main network device is improved.

[0084] Optionally, in the abnormality detection device of the main network equipment provided in the embodiment of the present application, the calculation unit 203 includes: a first determination module, used to determine multiple parameters contained in the operation data of the main network equipment, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; a first calculation module, used to calculate the square of the difference between the historical monitoring value and the standard value of the parameter for each parameter, to obtain a first deviation value of the parameter, wherein the historical monitoring value is the data value of the parameter in the historical operation data, and the standard value is the data value of the parameter in the standard operation data; a second calculation module, used to calculate the sum of the first deviation values ​​of all parameters, and input the sum into a preset time attenuation function to obtain an output value, and calculate the square root of the output value to obtain a historical deviation value.

[0085] Optionally, in the abnormality detection device of the main network equipment provided in the embodiment of the present application, the calculation unit 203 also includes: a second determination module, used to determine multiple parameters contained in the operation data of the main network equipment, wherein the type of parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; a third calculation module, used to calculate the square of the difference between the predicted monitoring value and the standard value of the parameter for each parameter, to obtain a second deviation value of the parameter, wherein the predicted monitoring value is the data value of the parameter in the predicted operation data, and the standard value is the data value of the parameter in the standard operation data; a fourth calculation module, used to calculate the sum of the second deviation values ​​of all parameters, and input the sum into a preset time attenuation function to obtain an output value, and calculate the square root of the output value to obtain a predicted deviation value.

[0086] Optionally, in the anomaly detection device of the main network equipment provided in the embodiment of the present application, the calculation unit 203 also includes: a fifth calculation module, which is used to calculate the absolute value of the difference between the historical deviation value and the predicted deviation value, and input the absolute value of the difference into the activation function to obtain the deviation difference value, and calculate the deviation difference evaluation value based on the deviation difference value and the dynamic threshold, wherein the dynamic threshold is determined by a threshold mapping table, and the threshold mapping table contains multiple groups of mapping relationships, each group of mapping relationships represents a mapping relationship between a moment and a threshold; a sixth calculation module, which is used to calculate the Mahalanobis distance between the historical operation data and the standard operation data to obtain a first deviation value, and calculate the Mahalanobis distance between the predicted operation data and the standard operation data to obtain a second deviation value; a seventh calculation module, which is used to calculate the absolute value of the difference between the first deviation value and the second deviation value to obtain a target deviation difference value; an input module, which is used to input the deviation difference evaluation value and the target deviation difference value into the mapping function to obtain a comprehensive deviation value.

[0087] Optionally, in the anomaly detection device of the main network equipment provided in the embodiment of the present application, the fifth calculation module includes: a first determination submodule, used to determine the deviation difference value and the dynamic threshold at the target moment, and judge whether the deviation difference value is less than or equal to the dynamic threshold; a second determination submodule, used to determine the preset value as the deviation difference evaluation value when the deviation difference value is less than or equal to the dynamic threshold; and a calculation submodule, used to calculate the difference between the deviation difference value and the target value when the deviation difference value is greater than the dynamic threshold, and determine the difference as the deviation difference evaluation value.

[0088] Optionally, in the abnormality detection device for the main network equipment provided in the embodiment of the present application, the device also includes: an equipment determination unit, used to determine the operating status of all main network equipment of the target main network, and determine the main network equipment with an abnormal operating status as a target patrol equipment; a path determination unit, used to obtain the location information of all main network equipment, obtain a location information set, and determine the patrol path according to the location information set and the target patrol equipment, wherein the patrol time of the target patrol equipment in the patrol path is earlier than the patrol time of the non-target patrol equipment; a control unit, used to control the intelligent robot to patrol all main network equipment according to the patrol path, and detect whether each main network equipment has an operating risk, and when it is detected that the main network equipment has an operating risk, issue a prompt message, wherein the prompt message is used to prompt the operation and maintenance personnel to maintain the main network equipment.

[0089] Optionally, in the abnormality detection device of the main network equipment provided in the embodiment of the present application, the device also includes: an extraction unit, used to obtain the operation data record of the main network equipment, extract sample historical operation data from the operation data record at every preset period, and determine the operation data of the sample historical operation data on adjacent dates in the operation data record as sample predicted operation data; a sample determination unit, used to determine the sample historical operation data within each preset period and the sample predicted operation data on adjacent dates as a group of training samples to obtain multiple groups of training samples; a training unit, used to train a preset neural network model based on the multiple groups of training samples to obtain a target model.

[0090] The anomaly detection device of the main network equipment includes a processor and a memory. The above-mentioned acquisition unit 201, input unit 202, calculation unit 203 and determination unit 204 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0091] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the accuracy of the abnormality detection results of the main network device can be improved by adjusting the kernel parameters.

[0092] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0093] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a method for detecting anomalies of a main network device is implemented.

[0094] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes an abnormality detection method for a main network device when the program is running.

[0095] Figure 3 is a schematic diagram of an electronic device provided according to an embodiment of the present application. Figure 3 As shown, the electronic device 301 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining the historical operation data of the main network device within a preset period, and determining the standard operation data of the main network device in a non-abnormal state; inputting the historical operation data into the target model to obtain the predicted operation data of the target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operation data and sample predicted operation data; calculating the historical deviation value based on the historical operation data and the standard operation data, calculating the predicted deviation value based on the predicted operation data and the standard operation data, and calculating the comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data, and the predicted operation data; when the comprehensive deviation value is greater than or equal to the deviation value threshold, the operation state of the main network device is determined to be an abnormal operation state, and when the comprehensive deviation value is less than the deviation value threshold, the operation state of the main network device is determined to be a normal operation state. The device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0096] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: obtaining historical operating data of a main network device within a preset period, and determining standard operating data of the main network device under a non-abnormal state; inputting the historical operating data into a target model to obtain predicted operating data for a target date, wherein the target model is trained by multiple groups of training samples, and each group of training samples includes sample historical operating data and sample predicted operating data; calculating a historical deviation value based on the historical operating data and the standard operating data, calculating a predicted deviation value based on the predicted operating data and the standard operating data, and calculating a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operating data, the standard operating data, and the predicted operating data; when the comprehensive deviation value is greater than or equal to a deviation value threshold, determining the operating state of the main network device as an abnormal operating state, and when the comprehensive deviation value is less than the deviation value threshold, determining the operating state of the main network device as a normal operating state.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0106] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for detecting anomalies of a main network device, characterized in that: include: Obtain historical operation data of the main network equipment within a preset period, and determine standard operation data of the main network equipment in a normal state; Inputting the historical operation data into a target model to obtain predicted operation data for a target date, wherein the target model is trained by multiple sets of training samples, each set of training samples including sample historical operation data and sample predicted operation data; Calculate a historical deviation value based on the historical operation data and the standard operation data, calculate a predicted deviation value based on the predicted operation data and the standard operation data, and calculate a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data, and the predicted operation data; When the comprehensive deviation value is greater than or equal to the deviation value threshold, the operating state of the main network device is determined to be an abnormal operating state. When the comprehensive deviation value is less than the deviation value threshold, the operating state of the main network device is determined to be a normal operating state.

2. The method according to claim 1, characterized in that: Calculating the historical deviation value based on the historical operation data and the standard operation data includes: Determine a plurality of parameters included in the operation data of the main network device, wherein the type of the parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; For each parameter, calculating the square of the difference between the historical monitoring value and the standard value of the parameter to obtain a first deviation value of the parameter, wherein the historical monitoring value is the data value of the parameter in the historical operation data, and the standard value is the data value of the parameter in the standard operation data; The sum of the first deviation values ​​of all parameters is calculated, and the sum is input into a preset time decay function to obtain an output value, and the square root of the output value is calculated to obtain the historical deviation value.

3. The method according to claim 1, characterized in that Calculating the prediction deviation value based on the prediction operation data and the standard operation data includes: Determine a plurality of parameters included in the operation data of the main network device, wherein the type of the parameter includes at least one of the following: voltage, current, power, temperature, humidity and load rate; For each parameter, calculating the square of the difference between the predicted monitoring value and the standard value of the parameter to obtain a second deviation value of the parameter, wherein the predicted monitoring value is the data value of the parameter in the predicted operation data, and the standard value is the data value of the parameter in the standard operation data; The sum of the second deviation values ​​of all parameters is calculated, and the sum is input into a preset time decay function to obtain an output value, and the square root of the output value is calculated to obtain the predicted deviation value.

4. The method according to claim 1, characterized in that: Calculating the comprehensive deviation value by using the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data and the predicted operation data comprises: Calculate the absolute value of the difference between the historical deviation value and the predicted deviation value, input the absolute value of the difference into an activation function to obtain a deviation difference value, and calculate a deviation difference evaluation value based on the deviation difference value and a dynamic threshold, wherein the dynamic threshold is determined by a threshold mapping table, and the threshold mapping table includes multiple groups of mapping relationships, each group of mapping relationships represents a mapping relationship between a moment and a threshold; Calculating the Mahalanobis distance between the historical operation data and the standard operation data to obtain a first deviation value, and calculating the Mahalanobis distance between the predicted operation data and the standard operation data to obtain a second deviation value; Calculating an absolute value of a difference between the first deviation value and the second deviation value to obtain a target deviation difference value; The deviation difference evaluation value and the target deviation difference value are input into a mapping function to obtain the comprehensive deviation value.

5. The method according to claim 4, characterized in that Calculating the deviation difference evaluation value based on the deviation difference value and the dynamic threshold comprises: Determine a deviation difference value and a dynamic threshold value at a target time, and determine whether the deviation difference value is less than or equal to the dynamic threshold value; In a case where the deviation difference value is less than or equal to the dynamic threshold, determining a preset value as the deviation difference evaluation value; When the deviation difference value is greater than the dynamic threshold, a difference between the deviation difference value and a target value is calculated, and the difference is determined as the deviation difference evaluation value.

6. The method according to claim 1, characterized in that The method further comprises: Determine the operating status of all main network devices of the target main network, and determine the main network device whose operating status is the abnormal operating status as the target patrol device; Acquire the location information of all main network devices to obtain a location information set, and determine a patrol path according to the location information set and the target patrol device, wherein the patrol time of the target patrol device in the patrol path is ahead of the patrol time of the non-target patrol device; The intelligent robot is controlled to patrol all main network devices according to the patrol path, and detect whether each main network device has an operation risk. When it is detected that the main network device has an operation risk, a prompt message is issued, wherein the prompt message is used to prompt the operation and maintenance personnel to maintain the main network device.

7. The method according to claim 1, characterized in that The target model is trained in the following way: Obtaining the operation data record of the main network device, extracting sample historical operation data from the operation data record at intervals of the preset period, and determining the operation data of the date adjacent to the sample historical operation data in the operation data record as the sample predicted operation data; The sample historical operation data within each preset period and the sample predicted operation data of adjacent dates are determined as a group of training samples to obtain multiple groups of training samples; A preset neural network model is trained based on the multiple groups of training samples to obtain the target model.

8. An abnormality detection device for a main network device, characterized in that: include: An acquisition unit, used to acquire historical operation data of the main network device within a preset period, and determine standard operation data of the main network device in a normal state; An input unit, used for inputting the historical operation data into a target model to obtain predicted operation data of a target date, wherein the target model is obtained by training multiple groups of training samples, each group of training samples includes sample historical operation data and sample predicted operation data; a calculation unit, configured to calculate a historical deviation value based on the historical operation data and the standard operation data, calculate a predicted deviation value based on the predicted operation data and the standard operation data, and calculate a comprehensive deviation value through the historical deviation value, the predicted deviation value, the historical operation data, the standard operation data, and the predicted operation data; A determination unit is used to determine the operating state of the main network device as an abnormal operating state when the comprehensive deviation value is greater than or equal to the deviation value threshold, and to determine the operating state of the main network device as a normal operating state when the comprehensive deviation value is less than the deviation value threshold.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for detecting anomalies of a primary network device according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the main network device anomaly detection method as described in any one of claims 1 to 7.

Images