Data anomaly detection method, and anomaly detection method and device for equipment monitoring indexes

Abstract

The embodiment of the invention provides a data exception detection method and device and an exception detection method and device for equipment monitoring indexes. The data exception detection method comprises the steps that to-be-detected time series data are acquired; based on the change characteristic of the to-be-tested time series data along with time, classifying the to-be-tested time series data, and determining a target evolution type of the to-be-tested time series data; according to the target evolution type, a corresponding target anomaly detection mode is determined, and different evolution types correspond to different anomaly detection modes; and performing anomaly detection on the to-be-detected time series data according to the target anomaly detection mode, and determining an anomaly detection result of the to-be-detected time series data. Data classification and anomaly detection are performed based on the change characteristics of the to-be-detected time series data along with time, different evolution types correspond to different anomaly detection modes, and the anomaly detection modes can flexibly adapt to the change characteristics of the to-be-detected time series data and adapt to various different application scenes.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of data processing technology, and in particular to a method for detecting anomalies in data, and a method and device for detecting anomalies in equipment monitoring indicators. Background Art

[0002] With the continuous development of computer and Internet technology, monitoring systems can collect a variety of monitoring indicators and perform anomaly detection in order to issue alarms for abnormal indicators and deal with anomalies in a timely manner. The so-called anomaly detection is to detect and discover abnormal indicators in the various collected indicators that do not conform to normal behavior and set rules. It has been widely used in equipment attribute detection, transaction detection, fault diagnosis and other fields.

[0003] In the existing technology, the monitoring system collects a variety of monitoring indicators. The use of anomaly indicator detection algorithms depends on the user's manual configuration. A fixed anomaly detection algorithm is used to detect anomalies in monitoring indicators. The anomaly detection algorithm used is not flexible enough and cannot meet a variety of usage scenarios. Therefore, a more efficient and flexible data anomaly detection solution is urgently needed. Summary of the invention

[0004] In view of this, an embodiment of this specification provides a data anomaly detection method. One or more embodiments of this specification also relate to an anomaly detection method for device monitoring indicators, a data anomaly detection device, an anomaly detection device for device monitoring indicators, a computing device, a computer-readable storage medium, and a computer program product to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a data anomaly detection method is provided, including: Get the timing data to be tested; Based on the change characteristics of the time series data to be tested over time, the time series data to be tested is classified to determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; According to the target anomaly detection method, anomaly detection is performed on the time series data to be tested to determine an anomaly detection result of the time series data to be tested.

[0006] According to a second aspect of an embodiment of this specification, a method for detecting anomalies of equipment monitoring indicators is provided, including: Acquire a monitoring indicator sequence of the device to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine the target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate the change type of the monitoring indicator sequence; Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; According to the target anomaly detection method, anomaly detection is performed on the monitoring indicator sequence to determine an anomaly detection result of the monitoring indicator sequence; When the abnormality detection result is that an abnormality occurs, an abnormality event of the device to be monitored is generated.

[0007] According to a third aspect of an embodiment of this specification, a data anomaly detection device is provided, including: An acquisition module, configured to acquire the timing data to be tested; A first determination module is configured to classify the time series data to be tested based on the change characteristics of the time series data to be tested over time, and determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; A second determination module is configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; The third determination module is configured to perform anomaly detection on the time series data to be tested according to the target anomaly detection method, and determine an anomaly detection result of the time series data to be tested.

[0008] According to a fourth aspect of an embodiment of this specification, there is provided an abnormality detection device for a device monitoring indicator, comprising: A fourth determination module is configured to obtain a monitoring indicator sequence of the device to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine a target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate a change type of the monitoring indicator sequence; a fifth determination module, configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; a sixth determination module, configured to perform anomaly detection on the monitoring indicator sequence according to the target anomaly detection method, and determine an anomaly detection result of the monitoring indicator sequence; The first generating module is configured to generate an abnormal event of the device to be monitored when the abnormality detection result is an abnormality.

[0009] According to a fifth aspect of an embodiment of this specification, a computing device is provided, including: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned data anomaly detection method or the anomaly detection method of equipment monitoring indicators are implemented.

[0010] According to the sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned data anomaly detection method or the device monitoring indicator anomaly detection method.

[0011] According to a seventh aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned data anomaly detection method or the device monitoring indicator anomaly detection method.

[0012] An embodiment of the present specification provides a data anomaly detection method, which obtains time series data to be tested; based on the change characteristics of the time series data to be tested over time, classifies the time series data to be tested, and determines the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; according to the target evolution type, determines the corresponding target anomaly detection method, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; according to the target anomaly detection method, performs anomaly detection on the time series data to be tested, and determines the anomaly detection result of the time series data to be tested.

[0013] An embodiment of the present specification realizes that, based on the changing characteristics of the time series data to be tested over time, the time series data to be tested is first classified, the target evolution type is determined to indicate the change type of the time series data to be tested, and the corresponding target anomaly detection method is automatically determined. Anomaly detection is performed on the time series data to be tested to obtain anomaly detection results without manually configuring the anomaly detection method, thereby reducing the configuration complexity of the anomaly detection method and improving the efficiency of data anomaly detection. Data classification and anomaly detection are performed based on the changing characteristics of the time series data to be tested over time, different evolution types correspond to different anomaly detection methods, and the anomaly detection method can flexibly adapt to the changing characteristics of the time series data to be tested and adapt to various different application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of a data anomaly detection method provided by an embodiment of this specification; Figure 2 is a schematic diagram of a data anomaly detection process provided by an embodiment of this specification; Figure 3 It is a flow chart of a method for detecting anomalies of equipment monitoring indicators provided by an embodiment of this specification; Figure 4 is a timing curve diagram of CPU usage data provided by an embodiment of this specification; Figure 5 It is a timing curve diagram of memory usage data provided by an embodiment of this specification; Figure 6 It is a structural schematic diagram of a data anomaly detection device provided by an embodiment of this specification; Figure 7 It is a structural schematic diagram of an abnormality detection device for equipment monitoring indicators provided by an embodiment of this specification; Figure 8 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0015] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0016] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0017] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0018] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0019] First, the terms involved in one or more embodiments of this specification are explained.

[0020] DF (Dickey-Fuller Test): is a statistical test used to detect whether time series data has a unit root. The presence of a unit root means that the time series is non-stationary, that is, its mean, variance or covariance is not constant, but changes over time. The DF test is a very important tool in time series analysis.

[0021] ADF test (Augmented Dickey-Fuller Test): It is a hypothesis test method used in statistics to detect the stationarity of time series data. It expands the original Dickey-Fuller Test (DF test) by adding lagged difference terms to the model to control high-order autocorrelation, so as to more accurately determine whether the time series has a unit root. That is, the ADF test is a statistical test method used to detect whether the time series data has a unit root. The existence of a unit root means that the time series is non-stationary, that is, its statistical characteristics change over time. Non-stationary time series may cause pseudo-regression in regression analysis, making the model estimation results unreliable. Therefore, before conducting time series analysis, it is usually necessary to first use means such as the ADF test to determine whether the series is stationary, and to take differential treatments such as differential treatments on the non-stationary series to make it stationary.

[0022] EWMA (Exponentially Weighted Moving Average): is a commonly used time series smoothing technique that gives higher weights to recent data points and gradually decreases weights to earlier data points. While removing noise from the data, it is more sensitive to data changes. Compared with the simple moving average (SMA), EWMA is more flexible and can respond to changes in new information more quickly. It is particularly suitable for processing data with trends or seasonality.

[0023] Z-score: Also known as the standard score, it is a statistical measurement method used to measure how many standard deviations a value has relative to the mean of the data set to which it belongs, thereby describing the distance between an original score and the mean. It is a method of standardizing scores in units of standard deviation. It can convert data of different scales to the same scale for comparison, helping to understand the position of a data point relative to the entire data set.

[0024] Isolation Forest: It is an unsupervised machine learning algorithm for anomaly detection. It is based on the assumption that normal data points are usually similar, so more random partitioning is needed to "isolate" them, while abnormal data points have less similarity and are more easily isolated, that is, anomalies are "easier to be isolated" data points. Unlike many other algorithms, Isolation Forest does not attempt to define what is a normal pattern, but discovers anomalies by identifying data points that are significantly different from other observations. It is particularly suitable for high-dimensional data and performs well when processing large data sets.

[0025] Linear Regression: It is a statistical method used to establish a linear relationship model between one or more independent variables (also called explanatory variables or features) and a dependent variable (also called response variable or target). It is one of the basic and widely used techniques in predictive analysis and is suitable for modeling continuous data.

[0026] SysOM (System Operation & Maintenance): is a one-stop operating system operation and maintenance platform that incorporates operation and maintenance practical experience. It can help users achieve complex operating system management such as host management, operating system migration, downtime analysis, system monitoring, abnormal diagnosis, log auditing, and security control on a unified platform.

[0027] It should be noted that operating system operation and maintenance platforms (such as SysOM) collect a variety of monitoring indicators, and the use of anomaly indicator detection algorithms depends on the user's manual configuration, which brings certain difficulties to users. At the same time, a large part of the indicators of the monitoring system use anomaly detection methods with fixed thresholds, which is not flexible enough and cannot meet a variety of usage scenarios. In addition, other anomaly detection solutions mostly rely on a large number of samples for manual labeling and supervised model training, which are not suitable for the use scenarios of operating system operation and maintenance platforms such as SysOM.

[0028] In one implementation, direct detection and classification features can be used to jointly detect time series data using statistical judgment, unsupervised and supervised learning. The detection model is generated through training with a large number of samples and can be continuously trained and updated based on the samples. However, it relies on a large number of samples for training and manual labeling. Based on this detection model, time series data can be detected to obtain abnormal results.

[0029] In another implementation, we can also focus on the orchestration and tuning of the time series anomaly detection process. The processing object is time series data, the output is the detection process and detection results, and the core algorithms are anomaly detection algorithm, time series prediction algorithm, and feature extraction algorithm for time series. The combination of online real-time monitoring and offline model training is adopted. The database for offline training also relies on manual labeling and consumes a lot of computing resources.

[0030] The embodiments of this specification provide a data anomaly detection method, an anomaly detection method and device for equipment monitoring indicators, which is a general anomaly detection solution integrating multiple models. After a plurality of different types of monitoring indicators are input, they are first classified, and the classified indicators are detected by an unsupervised multi-model combined anomaly detection algorithm. The joint detection of multiple models effectively improves the detection accuracy. At the same time, it is optimized according to the characteristics of the system indicators, and preprocessing is performed before processing the monitoring indicators, which further improves the efficiency and solves the problems of complex user algorithm configuration and the inability of the anomaly detection algorithm to cover a variety of usage scenarios.

[0031] In this specification, a data anomaly detection method is provided. This specification also involves an anomaly detection method for equipment monitoring indicators, a data anomaly detection device, an anomaly detection device for equipment monitoring indicators, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0032] See also Figure 1 , Figure 1 A flow chart of a data anomaly detection method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0033] Step 102: Obtain the timing data to be tested.

[0034] It should be noted that time series data, also known as time series, is a series of ordered data recorded in chronological order. From the perspective of sampling time, time series data can be sampling data with equal time intervals or sampling data with unequal time intervals, and the time scale of each data point can be marked. From the perspective of time granularity, the observation time of time series data can be in any time form, such as seconds, minutes, hours, days, weeks, months, years, etc.

[0035] The time series data to be tested refers to a series of time series data to be monitored that are collected from the monitored party and arranged in time. The time series data to be tested can be a data curve generated after each monitoring data is arranged in time. The horizontal axis of the data curve is time and the vertical axis is the specific monitoring data. Of course, the time series data to be tested may not be in the form of a curve, but a series of data points stored in chronological order.

[0036] In actual implementation, the monitored party can initiate an anomaly detection request to the monitoring system, and the monitoring system will continue to collect relevant monitoring data sequences from the monitored party. The "monitoring data sequence" is a series of time series data to be monitored after the previous monitoring data are arranged in time; alternatively, the monitoring system can actively and continuously collect relevant monitoring data sequences from the monitored party to continuously monitor whether the monitored party has any abnormalities.

[0037] Among them, the monitored party can be a platform, application or device that needs to be detected for anomaly, and the time series data to be tested is the data that needs to be detected by the monitored party. For example, in the monitoring scenario of a certain terminal device, the monitored party is a device that needs to be detected for anomaly, and the time series data to be tested can be a monitoring indicator sequence of the device that changes over time, such as CPU usage, memory usage and other monitoring indicator sequences; for example, in an e-commerce scenario, the monitored party is the e-commerce platform to be monitored, and the time series data to be tested is a time series composed of transaction data such as user transaction volume, transaction success rate or transaction amount on the e-commerce platform; for example, in the user monitoring scenario of an application, the time series data to be tested may refer to a time series composed of usage data such as user login volume, user registration volume, user download volume, etc. of a certain application.

[0038] Step 104: Based on the change characteristics of the time series data to be tested over time, the time series data to be tested is classified to determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested.

[0039] In actual implementation, the changing characteristics of the time series data to be tested over time refer to the changes of the time series data to be tested over time, and the target evolution type is used to indicate the change type of the time series data to be tested. For example, the changing characteristics of the time series data to be tested over time may include stable characteristics and / or trend characteristics, and the target evolution type may include a stable type and / or a trend type. For example, the stable type may include stable and unstable, and the trend type may include no trend, rising trend, falling trend, etc.

[0040] It should be noted that stationarity and trend are two important concepts in time series analysis, which describe different characteristics of data changing over time. Stationarity refers to the fact that the statistical properties of a time series (such as mean, variance, and autocorrelation coefficient) do not change over time. A stationary time series has similar behavior patterns in different time periods. Stationarity is divided into strict stationarity and wide stationarity. Strict stationarity means that the joint probability distribution of any time point in a random process does not change over time, that is, all statistical characteristics remain unchanged over time. Wide stationarity only requires that the first-order moment (mean) and the second-order moment (variance and covariance) do not change over time. Trend refers to the existence of a long-term growth or decline pattern in a time series. The trend can be linear or nonlinear, and may change its slope or direction over time.

[0041] In an optional implementation of this embodiment, the time-varying characteristics of the time series data to be tested include a stable characteristic and / or a trend characteristic; based on the time-varying characteristics of the time series data to be tested, the time series data to be tested is classified, and the target evolution type of the time series data to be tested is determined, including: Perform a stationary detection and / or a trend detection on the time series data to be tested to obtain a stationary type and / or a trend type, wherein the stationary type is used to indicate whether the time series data to be tested changes steadily over time, and the trend type is used to indicate the change trend of the time series data to be tested; The stationary type and / or trend type is used as the target evolution type of the time series data to be tested.

[0042] In actual implementation, the time series data to be tested can be subjected to stationary detection and / or trend detection, and the stationary characteristics and / or trend characteristics of the time series data to be tested can be analyzed to obtain the corresponding stationary type and / or trend type. The stationary type is used to indicate whether the time series data to be tested changes steadily over time, and the trend type is used to indicate the change trend of the time series data to be tested. Then, the obtained stationary type and / or trend type can be used as the target evolution type of the time series data to be tested.

[0043] It should be noted that if only stability detection is performed, the target evolution type may include stability and non-stability; if only trend detection is performed, the target evolution type may include no trend, rising trend, and falling trend; if stability detection and trend detection are performed, the target evolution type may include stability, non-stability with an rising trend, non-stability with a downward trend, non-stability with no trend, etc.

[0044] In specific implementation, a set stationary detection algorithm can be used to perform stationary detection, and a corresponding stationary detection result can be obtained as a stationary type, such as using a graphical method, statistical test, difference method and other stationary detection algorithms to perform stationary detection, and obtain the stationary type of the time series data to be tested; and a set trend detection algorithm can be used to perform trend detection, and a corresponding trend detection result can be obtained as a trend type, such as using a linear regression method, moving average, wavelet transform, Hodrick-Prescott filter (Hodrick-Prescott filter, referred to as HP filter), Sen slope (Sen slope estimation) estimation and other trend detection algorithms to perform trend detection, and obtain the trend type of the time series data to be tested.

[0045] In the embodiments of the present specification, stationary detection and / or trend detection can be performed on the time series data to be tested, and the corresponding stationary type and / or trend type can be obtained as the target evolution type. That is, the time series data to be tested can be classified based on the stationary characteristics and / or trend characteristics of the time series data to be tested, so that different anomaly detection methods can be used for subsequent anomaly detection for different stationary types and / or trend types, and data classification can be focused on the change characteristics of the time series data to be tested over time. This can adapt to the data change characteristics in various application scenarios and improve the efficiency and accuracy of anomaly detection.

[0046] In an optional implementation of this embodiment, performing stationary detection and / or trend detection on the time series data to be tested to obtain a stationary type and / or trend type includes: Performing an extreme value detection on the time series data to be tested, and when the result of the extreme value detection is not stable, using a set stable detection algorithm to perform a stable detection on the time series data to be tested to obtain a stable type; and / or, A set smoothing algorithm is used to smooth the time series data to be tested to obtain updated time series data; a set trend detection algorithm is used to perform trend detection on the updated time series data to obtain a trend type.

[0047] In an optional implementation method, when performing a stationary detection on the time series data to be tested, the time series data to be tested can be firstly subjected to an extreme value detection. If the result of the extreme value detection is stationary, the stationary state is directly determined as a stationary type. If the result of the extreme value detection is not stationary, a set stationary detection algorithm is further used to perform a stationary detection on the time series data to be tested to obtain a stationary type.

[0048] In actual implementation, targeted optimization can be performed based on the characteristics of system indicators. By analyzing the time series data collected in the monitoring system, it can be found that some time series data will maintain the same value under normal circumstances. For this type of data, there is no need to use additional algorithms to detect its stability. It is only necessary to check whether its maximum and minimum values ​​are consistent. The space complexity is only O(1). In addition, due to the optimization of the underlying function of finding the maximum value in the programming language extension library NumPy, NumPy's operation is very efficient. Vectorized operations can be used to process the entire time series data to be tested in one operation, rather than processing each data one by one, thereby significantly improving performance.

[0049] Specifically, the time series data to be tested can be firstly subjected to extreme value detection to determine the maximum and minimum values ​​of the time series data to be tested. If the maximum and minimum values ​​are consistent, the stationary type of the time series data to be tested is determined to be stationary. If the maximum and minimum values ​​are inconsistent, a set stationary detection algorithm is further used to perform stationary detection on the time series data to be tested. The set stationary algorithm can be any algorithm that can detect the stationarity of time series data, such as the ADF test. The ADF test is also called the unit root test. The main purpose of the ADF test is to detect whether the time series data to be tested has a unit root. Time series data with a unit root can be considered to be stationary.

[0050] In specific implementation, we can first perform preprocessing operations such as filling missing values ​​and removing noise points on the time series data to be tested, and then set the hypothesis, the null hypothesis (H0): the time series data to be tested has a unit root, that is, the series is non-stationary; the alternative hypothesis (H1): the time series data to be tested does not have a unit root, that is, the series is stationary. After that, the ADF regression equation is constructed as shown in the following formula (1): (1) in, represents the first-order difference; is the constant term (intercept); is the time trend term (optional); is the key parameter used to test the existence of a unit root; represents the coefficient of the lagged difference term; is the error term, which is usually assumed to be white noise.

[0051] After that, the lag order p can be determined. Automatic selection can use information criteria (such as Akaike Information Criterion, AIC or Bayesian Information Criterion, BIC) to automatically select a better lag order p. Alternatively, it can be manually specified to select the value of p based on professional knowledge or the results of preliminary exploratory data analysis.

[0052] The least squares method (OLS) is used to estimate the parameters of the above regression equation and obtain the estimated values ​​of each coefficient and the corresponding standard error. The key to calculating the test statistic is to calculate The t statistic is , which is the core statistic of the ADF test. Compared with the critical value, if If it is less than the critical value, the null hypothesis is rejected and the time series data to be tested is considered to be stationary; otherwise, the null hypothesis cannot be rejected, which means that the time series data to be tested may contain a unit root and is non-stationary.

[0053] It should be noted that a set of stable data means that it fluctuates within a range over a period of time. It can determine whether more than 50% of the data in the time series data to be tested are equal, but it cannot accurately reflect the stability of the time series data to be tested. Therefore, a combination of extreme value detection and ADF test is used to detect the stable characteristics of the time series data to be tested.

[0054] Of course, in actual implementation, other stationary detection algorithms may also be used, such as graphical methods, statistical tests, differential methods, etc., and the embodiments of this specification do not limit this.

[0055] In another optional implementation, when performing trend detection on the time series data to be tested, a set smoothing algorithm can be first used to smooth the time series data to obtain updated time series data; then, a set trend detection algorithm can be used to perform trend detection on the updated time series data to obtain a trend type.

[0056] The smoothing algorithm may be any algorithm that can perform smoothing on time series data, and the trend detection algorithm may be any algorithm that can perform trend detection on time series data.

[0057] In actual implementation, taking the smoothing algorithm as the EWMA algorithm as an example, before detecting the trend characteristics of the time series data to be tested, the time series data to be tested is first smoothed. EWMA is a commonly used time series smoothing technology, especially suitable for processing data with trends or seasonality. Compared with the traditional simple moving average (SMA), EWMA gives higher weight to the most recent data points, and is more sensitive to data changes while removing noise in the data.

[0058] Specifically, first set the smoothing parameter α, and select a smoothing parameter α between 0 and 1. A larger α value gives more weight to the most recent observations, making the model more sensitive to new information; a smaller α value gives more weight to past observations, which can better smooth short-term fluctuations. For the first observation x_0 in the time series data to be tested, EWMA_0=x_0 is usually set, or other predefined initial values ​​are used. This initial value is the starting point for EWMA calculation. Use the following formula (2) to iteratively calculate the EWMA value at each time point t: (2) in, is the value of time t in the time series data to be tested. is the exponentially weighted moving average at time t; is the smoothing parameter; It is the exponentially weighted moving average of the previous moment of time t.

[0059] Starting from the second value in the time series data to be tested, the EWMA (exponentially weighted moving average) value of each time point is calculated in turn according to the above formula (2). Each calculation depends on the value of the current time and the EWMA value of the previous moment. As the value changes over time, the EWMA is continuously updated to reflect the latest data change trend. The updated time series data after EWMA smoothing will be smoother, reducing the short-term fluctuations in the original time series data to be tested, but retaining the long-term trend. By changing the value of α, the degree of smoothing can be controlled. A larger α can respond to new changes more quickly, while a smaller α provides a more stable smoothing effect.

[0060] Of course, in actual implementation, other smoothing algorithms may also be used to smooth the time series data to be measured, such as simple moving average, double exponential smoothing, triple exponential smoothing, wavelet transform, etc., and the embodiments of this specification do not limit this.

[0061] In specific implementation, after smoothing the time series data to be tested, the updated time series data can be obtained, and the set trend detection algorithm is used to perform trend detection on the updated time series data. When obtaining the trend type, linear regression algorithm, moving average, wavelet transform, Hodrick-Prescott filtering (HP filtering), Sen slope estimation and other trend detection algorithms can be used.

[0062] In the embodiments of this specification, the anomaly detection process of the time series data to be tested can be divided into two processes, namely data classification and anomaly detection. Data classification can perform stationary detection and / or trend detection. During stationary detection, the stationarity of the time series data to be tested is first determined by using the maximum value detection, and optimization is performed based on the characteristics of the monitoring system indicators. Before using the set stationary detection algorithm for stationary detection, the time series data to be tested is pre-processed based on the maximum value detection, which can improve the efficiency of a part of the time series data and save computing resources. The combination of the maximum value detection and the set stationary detection algorithm can greatly improve the efficiency and accuracy of stationary detection; before trend detection, the time series data to be tested is first smoothed, thereby reducing the noise of the time series data to be tested, improving the accuracy of trend detection, simplifying data, enhancing signals, and improving model performance. Subsequently, different anomaly detection methods can be adopted for the time series data to be tested according to different stationary types and / or trend types.

[0063] In an optional implementation of this embodiment, the trend detection algorithm is set to a linear regression algorithm; the trend detection algorithm is used to perform trend detection on the update time series data to obtain the trend type, including: Fitting a linear regression model to the updated time series data and determining the slope of the linear regression model; If the scalar value of the slope is less than the first threshold, the trend type is determined to be a downward trend type; If the scalar value of the slope is greater than or equal to the first threshold and less than or equal to the second threshold, the trend type is determined to be a no-trend type; If the scalar value of the slope is greater than a second threshold, determining that the trend type is an upward trend type; The first threshold is a negative number, the second threshold is a positive number, and the scalar values ​​of the first threshold and the second threshold are the same or different.

[0064] The scalar value of slope is the numerical magnitude of the slope without its direction.

[0065] It should be noted that the linear regression algorithm is a commonly used statistical method used to establish a linear relationship between a dependent variable (response variable) and one or more independent variables (predictor variables). There is only one independent variable in the time series data to be tested, so a simple linear regression can be used to estimate the trend of the time series data to be tested, and the linear regression model can be fitted using the least squares method to output the slope of the linear regression model.

[0066] In actual implementation, the input of the least squares method is a series of observations of the independent variable x (time) and the dependent variable y (the value that changes over time in the time series data to be tested). The purpose is to find a straight line y=mx+b, where m is the slope and b is the intercept, so that this straight line is as close as possible to each numerical point in the time series data to be tested. Specifically, the formula for calculating the slope of the linear regression model using the least squares method can be used as follows (3): (3) Among them, xi is the i-th observation value of the independent variable X, that is, the i-th time point; yi is the i-th observation value of the dependent variable y, that is, the i-th value in the time series data to be tested; n refers to the number of samples.

[0067] In actual implementation, the trend type of the time series data to be tested can be determined based on the slope of the linear regression model obtained by fitting the linear regression model. If the scalar value of the slope is less than the first threshold, the trend type is determined to be a downward trend; if the scalar value of the slope is greater than or equal to the first threshold and less than or equal to the second threshold, the trend type is determined to be no trend; if the scalar value of the slope is greater than the second threshold, the trend type is determined to be an upward trend.

[0068] Among them, the first threshold and the second threshold can be pre-configured as smaller values, the first threshold is a negative number, the second threshold is a positive number, and the scalar values ​​of the first threshold and the second threshold can be the same or different. For example, the first threshold can be configured as -0.01 and the second threshold can be configured as 0.01. If the slope of the linear regression model is less than -0.01, it means that the time series data to be tested has a significant downward trend, and the trend type can be determined as a downward trend; if the slope of the linear regression model is greater than or equal to -0.01 and less than or equal to 0.01, it means that the time series data to be tested has no significant trend of change, and the trend type is determined as no trend; if the slope of the linear regression model is greater than 0.01, it means that the time series data to be tested has a significant upward trend, and the trend type can be determined as an upward trend.

[0069] In the embodiments of this specification, the characteristics of the changes of each numerical value in the time series data to be tested over time can be utilized, and a linear regression algorithm can be used for trend detection. A linear regression model can be fitted, and the downward, upward, etc. trends of the time series data to be tested can be judged by the slope of the linear regression model. The trend detection algorithm is simple and the detection efficiency is improved.

[0070] In addition, the embodiments of this specification use a variety of different methods to perform stationary detection and / or trend detection, without the need to use a supervised model, and thus without the need for model training, without relying on a large amount of training data, and without relying on manual labeling, thereby saving training resources.

[0071] Step 106: Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, different evolution types include target evolution types, and different anomaly detection methods include target anomaly detection methods.

[0072] It should be noted that different evolution types correspond to different anomaly detection methods. Therefore, the corresponding target anomaly detection method can be determined based on the target evolution type of the time series data to be tested, so as to facilitate the subsequent anomaly detection of the time series data to be tested based on the target anomaly detection method corresponding to the time series data to be tested.

[0073] In an optional implementation of this embodiment, determining a corresponding target anomaly detection method according to the target evolution type includes: If the target evolution type is a stable type, or the target evolution type is an unsteady and trendless type, the target anomaly detection method is determined to be jitter detection and threshold detection; If the target evolution type is unstable and has an upward trend, the target anomaly detection method is determined to be trend detection and threshold detection; If the target evolution type is unstable and has a downward trend, the target anomaly detection method is determined to be trend detection.

[0074] In actual implementation, multiple detection methods that can detect anomalies in time series data can be pre-configured, such as jitter detection, threshold detection, trend detection, etc. In the anomaly detection scenario, jitter detection, threshold detection, and trend detection are three different types of detection methods, each of which focuses on different characteristics of time series data and is used to identify different anomaly patterns. Jitter detection aims to capture short-term fluctuations or high-frequency noise in time series data. Such fluctuations may be caused by measurement errors, external interference, or other transient factors. If these fluctuations exceed the normal range, they may be considered abnormal; threshold detection is a direct anomaly detection method that distinguishes between normal and abnormal situations by setting upper and lower thresholds. When the value exceeds the preset threshold range, it is marked as abnormal. Trend detection is used to identify whether there is a long-term upward or downward trend in time series data. Even if a single data point looks normal, if the overall trend shows an unusual trend, it may indicate a potential problem or anomaly.

[0075] Furthermore, the corresponding relationship between different evolution types and anomaly detection methods may be preconfigured, and one evolution type may be combined with at least one anomaly detection method to perform anomaly detection.

[0076] In actual implementation, after determining the stationary type and / or trend type of the time series data to be tested, different anomaly detection methods are used for different types of time series data to be tested. As an optional implementation method, for data that appears to be stationary, jitter detection and threshold detection are performed; for data that is not stationary and has an upward trend, trend detection and threshold detection are performed; for data that is not stationary and has a downward trend, trend detection is performed; for data that is not stationary and has no trend, jitter detection and threshold detection are used.

[0077] Specifically, if the target evolution type is a stable type, it means that the time series data to be tested has no obvious change. If the target evolution type is an unsteady and trendless type, it means that the time series data to be tested is unsteady and has no obvious change trend. Therefore, in the above two cases, the target anomaly detection method can be determined as jitter detection and threshold detection, and further determine whether the time series data to be tested has large jitters in the stable change process, or exceeds the set threshold, etc., to achieve anomaly detection of the time series data to be tested; if the target evolution type is an unsteady and rising trend type, it means that the time series data to be tested has an obvious rising change with the change of time, and it is necessary to determine whether the rising change is an abnormal situation, such as the rising amplitude, whether it exceeds the dangerous threshold, etc., so the target anomaly detection method can be determined as trend detection and threshold detection; if the target evolution type is an unsteady and falling trend type, it means that the time series data to be tested has an obvious falling change with the change of time, and it is necessary to determine whether the falling change is an abnormal situation, such as whether the falling amplitude is too large, etc., so the target anomaly detection method can be determined as trend detection.

[0078] Of course, in actual implementation, other corresponding relationships between evolution types and detection methods may also be configured. The above is only a possible example, and the embodiments of this specification do not limit this.

[0079] In the embodiments of this specification, different target anomaly detection methods can be used for different target evolution types. The target anomaly detection method can include at least one detection method, that is, the time series data to be tested can be combined with at least one detection method to perform anomaly detection. Specifically, the time series data to be tested can be classified based on the change characteristics of the time series data to be tested over time, focusing on the change characteristics of the time series data to be tested over time to perform data classification, and then adaptively using the corresponding target anomaly detection method to perform anomaly detection, which can adapt to the data change characteristics in a variety of application scenarios and improve the efficiency and accuracy of anomaly detection.

[0080] Step 108: Perform anomaly detection on the time series data to be tested according to the target anomaly detection method, and determine the anomaly detection result of the time series data to be tested.

[0081] It should be noted that after determining the target anomaly detection method, anomaly detection can be performed on the time series data to be tested based on the various anomaly detection methods indicated by the target anomaly detection method to determine the anomaly detection result of the time series data to be tested. The anomaly detection result can be whether the time series data to be tested has an anomaly, or the probability of an anomaly occurring.

[0082] In actual implementation, it is possible to directly determine whether the time series data to be tested has an abnormality or the probability of an abnormality based on each abnormality detection method indicated by the target abnormality detection method. If any abnormality detection method determines that an abnormality has occurred or the probability of an abnormality has occurred is greater than a set value, then the abnormality detection result of the time series data to be tested is determined to be an abnormality. Alternatively, it is also possible to obtain a corresponding abnormality evaluation value based on each abnormality detection method indicated by the target abnormality detection method, and then combine each abnormality evaluation value to determine whether the time series data to be tested has an abnormality.

[0083] In an optional implementation of this embodiment, according to the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and an anomaly detection result of the time series data to be tested is determined, including: According to at least one anomaly detection method included in the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods are determined; Determine the comprehensive anomaly evaluation value of the time series data to be tested according to the anomaly evaluation values ​​under various anomaly detection methods; When the comprehensive abnormality evaluation value is lower than the set evaluation value threshold, it is determined that the time series data to be tested is abnormal.

[0084] Among them, the anomaly evaluation value refers to a parameter value that reflects the degree of anomaly of the time series data to be tested, such as an anomaly evaluation value can be an anomaly score or an anomaly level, such as an anomaly evaluation value can be 85 points, 90 points, or an anomaly evaluation value can be the first level, the second level. The comprehensive anomaly evaluation value refers to a comprehensive value obtained by integrating the anomaly evaluation values ​​under various anomaly detection methods, reflecting the degree of anomaly of the time series data to be tested after the integration of various anomaly detection methods.

[0085] In actual implementation, the target anomaly detection method may include at least one anomaly detection method. Based on the determined target anomaly detection method, each anomaly detection is performed on the time series data to be tested, and the anomaly evaluation value of the time series data to be tested under various anomaly detection methods is obtained. Then, the average value or weighted average value of the anomaly evaluation values ​​under various anomaly detection methods can be determined as the comprehensive anomaly evaluation value of the time series data to be tested. If the comprehensive anomaly evaluation value is lower than the set evaluation value threshold, it means that the time series data to be tested has an anomaly; if the comprehensive anomaly evaluation value is not lower than the set evaluation value threshold, it means that the time series data to be tested has no anomaly.

[0086] Among them, setting the evaluation value threshold is a pre-configured evaluation value used to determine whether the time series data to be tested is abnormal. For example, taking the abnormal evaluation value as the abnormal score as an example, the setting of the evaluation value threshold can be 60 points, 75 points, etc. Taking the abnormal evaluation value as the abnormal level as an example, the setting of the evaluation value threshold can be the third level, the second level, etc.

[0087] In the embodiments of the present specification, the target anomaly detection method may include at least one anomaly detection method, and anomaly evaluation values ​​are performed on the time series data to be tested based on various anomaly detection methods respectively, and then the anomaly evaluation values ​​under various anomaly detection methods are combined to determine the comprehensive anomaly evaluation value of the time series data to be tested, and determine whether the time series data to be tested is abnormal. At least one anomaly detection method can be combined to perform anomaly detection on the time series data to be tested, which greatly improves the accuracy of anomaly detection.

[0088] In an optional implementation of this embodiment, according to at least one anomaly detection method included in the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods are determined, including: If the target abnormality detection method includes jitter detection, a first jitter algorithm is used to perform jitter detection on the timing data to be tested to obtain a first jitter evaluation value; Using a second jitter algorithm to perform jitter detection on the timing data to be measured to obtain a second jitter evaluation value, wherein the second jitter algorithm is different from the first jitter algorithm; A target jitter evaluation value of the timing data to be tested under jitter detection is determined according to the first jitter evaluation value and the second jitter evaluation value.

[0089] In actual implementation, if the determined target abnormality detection method includes jitter detection, the first jitter algorithm and the second jitter algorithm can be used respectively to perform jitter detection on the timing data to be tested to obtain a first jitter evaluation value and a second jitter evaluation value; then, the first jitter evaluation value and the second jitter evaluation value are averaged or weighted averaged to determine the target jitter evaluation value of the timing data to be tested under jitter detection.

[0090] In specific implementation, the first jitter algorithm and the second jitter algorithm are two different jitter algorithms, and the first jitter algorithm and the second jitter algorithm can adopt an unsupervised algorithm model. Two jitter algorithms with different advantages and disadvantages can be used for jitter detection to achieve complementary jitter detection results.

[0091] As an example, the first jitter algorithm uses Z-score, and the second jitter algorithm uses isolation forest algorithm. Z-score is a method used in statistics to measure the degree of deviation of a value relative to the mean. It represents the distance between the value and the mean of the data set in units of standard deviation. The principle of Z-score outlier detection method is based on the standard normal distribution. It evaluates the degree of abnormality of the data point by calculating the distance between each data point and the mean of the data set and converting it into multiples of the standard deviation. In the standard normal distribution, about 68% of the data points are within one standard deviation of the mean, 95% of the data points are within two standard deviations, and 99.7% of the data points are within three standard deviations. Therefore, if the Z-score scalar value of a data point is large, that is, it is many standard deviations away from the mean, then it is likely to be an outlier.

[0092] In specific implementation, taking the first jitter evaluation value as the jitter score as an example, the following formula (4) can be used to calculate the standard score of each data point in the timing data to be tested as the jitter score: (4) Among them, Z is the standard score Z-score of data point X in the time series data to be tested, and X is a data point in the time series data to be tested. is the average value (mean) of the time series data to be tested, is the standard deviation of the time series data to be tested. Z-score converts the data into a standard normal distribution, and can determine whether a data point is an outlier based on the 3-sigma principle.

[0093] In actual implementation, since the value range of Z-score is theoretically from negative infinity to positive infinity, it needs to be standardized to adapt to a specific scoring range (such as 0 to 100). Specifically, one of the following methods can be used: direct mapping, directly mapping the Z-score to the range of 0 to 100. Assuming that the distribution of Z-score roughly conforms to the standard normal distribution, the cumulative distribution function (CDF) can be used to complete this conversion. For a given Z-score Z_t, its corresponding percentile can be found through the standard normal distribution table, and then this percentile is linearly converted to a score from 0 to 100; setting the threshold range, according to needs and empirical knowledge, set a series of Z-score thresholds and their corresponding score segments.

[0094] It is worth noting that the first jitter evaluation value in the time series data to be tested can be calculated. If you only focus on the jitter situation at a specific time point in the time series data to be tested, you can directly use the score calculated by the Z-score of the point as the first jitter evaluation value; or, you can take the weighted average of the Z-scores of each data point in the time series data to be tested. When you need to evaluate the overall jitter level over a period of time, you can calculate the weighted average of the Z-scores of multiple consecutive time points. The weight can be set according to the importance of the time point or the distance from the current moment. In this way, you can obtain a comprehensive score reflecting the overall jitter level as the first jitter evaluation value; or, you can also calculate the Z-score scores of multiple consecutive windows and take the average or median of these scores to smooth the impact of individual abnormal points and more accurately reflect the jitter trend.

[0095] It should be noted that the Z-score algorithm is sensitive to extreme values. If there are extreme outliers in the time series data to be tested, it may greatly affect the calculation of the mean and standard deviation, thereby affecting the Z-score of other data points. At the same time, the Z-score method assumes that each data point in the time series data to be tested obeys a normal distribution. If each data point does not obey a normal distribution, using the Z-score to detect outliers may be misleading. Therefore, the isolation forest algorithm can also be combined for jitter detection, that is, the second jitter algorithm can use the isolation forest algorithm.

[0096] The Isolation Forest Algorithm is a fast anomaly detection method with linear time complexity and high accuracy. It is suitable for anomaly detection of continuous data. It defines anomalies as "outliers that are easily isolated", which can be understood as points that are sparsely distributed and far away from dense groups. Specifically, the algorithm uses a binary search tree structure called an isolation tree (iTree) to isolate samples. Due to the small number of outliers and their alienation from most samples, outliers will be isolated earlier, that is, outliers will be closer to the root node of the iTree, while normal values ​​will be farther away from the root node. The Isolation Forest Algorithm does not require the definition of a mathematical model or labeled training. It is a very efficient algorithm. In addition, the Isolation Forest Algorithm has good robustness to high-dimensional data.

[0097] Each time, a feature and a split value are randomly selected, and the time series data to be tested is split on the feature. This process is repeated until all data points in the time series data to be tested are completely isolated. The degree of abnormality of the data point is evaluated based on the path length of the data point in the isolation tree (that is, the number of edges from the root to the leaf node). The shorter the average path length, the easier it is for the data point to be isolated, and therefore it is more likely to be an abnormal point.

[0098] Since the abnormal evaluation value output by the isolation forest algorithm may not be within the set range, it needs to be standardized to adapt to a specific evaluation value system (such as 0 to 100 points) to obtain a second jitter evaluation value. For example, one of the following methods can be used: linear conversion, percentile-based, etc.

[0099] In the embodiments of this specification, the first jitter algorithm and the second jitter algorithm can be combined to determine the target jitter evaluation value of the time series data to be tested, measure the jitter condition of the time series data to be tested, and thus determine whether the time series data to be tested is abnormal. The combination of the two jitter algorithms greatly improves the accuracy of abnormality detection.

[0100] In an optional implementation of this embodiment, according to at least one anomaly detection method included in the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods are determined, including: If the target anomaly detection method includes threshold detection, determine the distance between the time series data to be tested and the set anomaly threshold; According to the distance between the time series data to be tested and the set abnormal threshold, the target threshold evaluation value of the time series data to be tested under threshold detection is determined.

[0101] It should be noted that if the target anomaly detection method includes threshold detection, the distance between the time series data to be tested and the set anomaly threshold can be determined, and the target threshold evaluation value of the time series data to be tested under the threshold detection can be calculated. The set anomaly threshold is a pre-set dangerous value, and the closer it is to the set anomaly threshold, the greater the probability that the data point is abnormal.

[0102] In actual implementation, an evaluation value mechanism can be defined to reflect the degree to which each data point in the time series data to be tested deviates from the normal range, or the degree to which it approaches the set abnormal threshold, so as to obtain the target threshold evaluation value of the time series data to be tested under threshold detection. Specifically, reasonable upper and lower abnormal thresholds L and U can be set according to the scenario of the time series data to be tested. For each data point x_t corresponding to each time point t, calculate its deviation relative to the upper and lower abnormal thresholds L and U, such as one of the following methods: deviation, calculate the difference between the data point and the nearest threshold, or calculate the proportional deviation of the data point relative to the threshold range formed by the upper and lower abnormal thresholds L and U. Then, in order to convert the deviation into an intuitive evaluation value (such as 0 to 100 points) and obtain the target threshold evaluation value, it needs to be standardized. One of the following methods can be used: linear mapping. Assuming that the value range of the deviation is [0, 1], it can be directly linearly mapped to the evaluation value range to obtain the target threshold evaluation value. For example, if the deviation is 0.7 and the evaluation value range is 0-100 points, the target threshold evaluation value can be determined to be 70 points; based on percentiles, if the distribution of the deviation does not conform to the uniform distribution, the corresponding percentile can be calculated and this percentile can be linearly converted into the evaluation value range.

[0103] In the embodiments of the present specification, threshold detection can be used to obtain the target threshold evaluation value of the time series data to be tested under threshold detection to measure the degree to which the time series data to be tested deviates from the normal range or approaches the abnormal range, thereby determining whether the time series data to be tested is abnormal. The threshold detection algorithm is simple and accurate, which improves the efficiency and accuracy of abnormality detection.

[0104] In an optional implementation of this embodiment, according to at least one anomaly detection method included in the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods are determined, including: If the target anomaly detection method includes trend detection, trend detection is performed on the time series data to be tested according to the set trend detection algorithm to obtain the target trend evaluation value under trend detection.

[0105] It should be noted that if the target anomaly detection method includes trend detection, trend detection can be performed on the time series data to be tested according to the set trend detection algorithm to obtain the target trend evaluation value under trend detection. The process of obtaining the trend evaluation value based on trend detection involves identifying the long-term upward or downward trend in the time series data to be tested and converting it into an intuitive evaluation value. The target trend evaluation value reflects the significance and strength of the trend in the time series data to be tested.

[0106] In actual implementation, according to the characteristics of the time series data to be tested and the application scenario, a suitable trend detection method is selected to detect the trend. Common methods may include linear regression algorithm, Mann-Kendall trend test, Sen slope estimation, Hodrick-Prescott filtering, etc. This trend detection method may be consistent with the method used for trend detection in the data classification process described above, or it may be inconsistent.

[0107] Then, according to the selected trend detection method, the indicator reflecting the significance and strength of the trend can be calculated. For example, for the linear regression algorithm, the indicator can be the regression coefficient. For linear regression, the size and sign of the regression coefficient can indicate the direction and strength of the trend; for the Mann-Kendall trend test algorithm, the indicator can be a statistic, and the statistic and its corresponding p-value can evaluate the existence and significance of the trend; for the Sen slope estimation, the indicator can be the Sen slope, which can quantify the specific rate of change of the trend; for the Hodrick-Prescott filter, the indicator can be the trend component after HP filtering, and the trend part extracted from the original time series data to be tested can be directly used as a trend indicator.

[0108] In order to convert the trend indicator into an intuitive evaluation value (such as 0 to 100), it needs to be standardized. The standardization process is similar to the specific implementation process of converting the deviation into an intuitive evaluation value in the above-mentioned process of calculating the target threshold evaluation value, and will not be repeated in the embodiments of this specification.

[0109] In the embodiments of the present specification, a trend detection algorithm can be set to obtain the target trend evaluation value of the time series data to be tested under trend detection, so as to measure the long-term upward or downward trend of the time series data to be tested, thereby determining whether the time series data to be tested is abnormal, and further combining the trend to perform anomaly detection, thereby improving the efficiency and accuracy of anomaly detection.

[0110] As an example, for the steady type of time series data to be tested, the comprehensive abnormality evaluation value is the average of the target jitter evaluation value and the target threshold evaluation value; for the unstable time series data to be tested with an upward or downward trend, the comprehensive abnormality evaluation value is the average of the target trend evaluation value and the target threshold evaluation value; for the unstable time series data to be tested with a downward trend, the comprehensive abnormality evaluation value is the target trend evaluation value; for the unstable data without obvious trend, the comprehensive abnormality evaluation value is the average of the target jitter evaluation value and the target threshold evaluation value.

[0111] In an optional implementation of this embodiment, according to the target anomaly detection method, after performing anomaly detection on the time series data to be tested and determining the anomaly detection result of the time series data to be tested, the method further includes: When the anomaly detection result is an abnormality, an abnormal event is generated; Determine abnormal attribute information of abnormal events; Determine the number of occurrences of abnormal events with the same abnormal attribute information within a set time period. If the number of occurrences exceeds a threshold, issue a reminder, where the reminder is used to indicate whether abnormal events are continuously generated.

[0112] In actual implementation, if the monitoring system determines that the anomaly detection result of the time series data to be tested is an abnormality, an abnormal event can be generated based on the attribute information of the time series data to be tested, and the abnormal event can be pushed to the monitored party or other monitoring terminals, wherein the attribute information may include the collection time, source, scene, data type and other information of the time series data to be tested, so that the monitored party or other monitoring terminals can analyze the abnormal cause of the abnormal event and take corresponding measures in time.

[0113] In addition, the monitoring system can also determine the abnormal attribute information of the abnormal event, which is used to uniquely identify an abnormal event, such as the source of the abnormal event, event identifier, abnormal type, etc. The monitoring system can determine the number of occurrences of abnormal events with the same abnormal attribute information within a set time period. If the number of occurrences exceeds the number threshold, it means that the same abnormality has occurred multiple times in a short period of time. At this time, a reminder can be issued to remind the user whether to continue to generate abnormal events. The user can configure, such as ignoring or continuously reminding. If the user feedback is configured to ignore, the abnormal event will no longer be pushed after the number of occurrences exceeds the number threshold; if the user feedback is configured to continuously remind, the abnormal event will continue to be generated and pushed.

[0114] It should be noted that after the monitoring system determines that an abnormality occurs in the time series data to be tested, an abnormal event can be generated in a timely manner to facilitate the monitored party or other monitoring terminals to analyze the abnormal cause of the abnormal event and take corresponding measures in a timely manner; and, it can also be configured whether abnormal events with the same abnormal attribute information need continuous attention, thereby deciding whether to continue to generate and push corresponding abnormal events, which can flexibly adapt to the needs of various application scenarios.

[0115] The embodiments of this specification provide a data anomaly detection method, which first classifies the time series data to be tested based on the time-varying characteristics of the time series data to be tested, determines the target evolution type, and then automatically determines the corresponding target anomaly detection method based on the target evolution type, performs anomaly detection on the time series data to be tested, and obtains anomaly detection results. There is no need to manually configure the anomaly detection method, which reduces the configuration complexity of the anomaly detection method and improves the efficiency of data anomaly detection. Data classification and anomaly detection are performed based on the time-varying characteristics of the time series data to be tested. Different evolution types correspond to different anomaly detection methods. The anomaly detection method can flexibly adapt to the changing characteristics of the time series data to be tested and to various application scenarios, solving the problem of complex user algorithm configuration and the inability of the anomaly detection algorithm to cover a variety of usage scenarios. In addition, in the process of data classification and anomaly detection, a variety of unsupervised models are combined to effectively improve the detection accuracy.

[0116] Figure 2 is a schematic diagram of a data anomaly detection process provided by an embodiment of this specification, such as Figure 2 As shown, the complete data anomaly detection process is divided into two stages. The first stage is data classification. First, the collected time series data to be tested is classified to determine the target evolution type of the time series data to be tested. Specifically, the maximum value detection and ADF detection (setting the stable detection algorithm) can be performed to obtain the stable type of the time series data to be tested. EWMA smoothing (setting the smoothing algorithm) and linear regression detection (setting the trend detection algorithm) can be performed to obtain the trend type of the time series data to be tested, and the stable type and / or trend type are used as the target evolution type. The second stage is anomaly detection. Based on the target evolution type, different target detection methods are used for anomaly detection. Specifically, for the stable type of time series data to be tested, jitter detection (the first jitter algorithm "Z-score", the second jitter algorithm "isolation forest") and threshold detection are performed; for the unsteady and rising trend type of the time series data to be tested, trend detection and threshold detection are performed; for the unsteady and falling trend type of the time series data to be tested, trend detection is performed; for the unsteady and trendless type of the time series data to be tested, jitter detection and threshold detection are used.

[0117] The embodiments of this specification provide a general, unsupervised multi-model combined anomaly detection algorithm. After a variety of different evolution types of time series data to be tested are input, they are first classified, and then combined with multiple models to perform anomaly detection. It does not require a large amount of data training, manual labeling, or a large amount of resources. Multiple models are combined for anomaly detection, which effectively improves the detection efficiency and accuracy and reduces the false alarm rate.

[0118] See also Figure 3 , Figure 3A flow chart of a method for detecting anomalies of equipment monitoring indicators provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0119] Step 302: Obtain a monitoring indicator sequence of the equipment to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine the target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate the change type of the monitoring indicator sequence.

[0120] It should be noted that in the monitoring scenario of device parameters, a monitoring indicator sequence of the device to be monitored that changes over time can be collected. The monitoring indicator sequence can be any hardware or software parameter of the device, such as CPU usage, memory usage, etc.

[0121] Step 304: Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, different evolution types include target evolution types, and different anomaly detection methods include target anomaly detection methods.

[0122] Step 306: Perform anomaly detection on the monitoring indicator sequence according to the target anomaly detection method, and determine the anomaly detection result of the monitoring indicator sequence.

[0123] Step 308: When the abnormality detection result is that an abnormality occurs, an abnormality event of the device to be monitored is generated.

[0124] In actual implementation, the specific implementation process of the above steps 302-306 can refer to the above steps 104-108, and the embodiments of this specification will not be repeated here.

[0125] As an example, take the monitoring indicator as CPU usage and the abnormality assessment value as the abnormality score, and the monitoring indicator sequence is the CPU usage data that changes over time. The monitoring system continuously collects CPU usage data from the device to be monitored. Figure 4 is a timing curve diagram of CPU usage data provided by an embodiment of this specification, such as Figure 4 As shown, for the long-term CPU usage data, there is no obvious trend, with occasional small fluctuations. Generally speaking, it is "unstable and trendless". That is, after the above-mentioned stability detection and trend detection, it can be determined that the target evolution type of the CPU usage data is "unstable and trendless". Then, jitter detection and threshold detection are used for anomaly detection to obtain the target jitter score of 100 and the target threshold score of 100. At this time, it can be determined that the comprehensive anomaly score is 100, which is not lower than the set score threshold (assuming it is 90.00), and it is determined that no anomaly occurs at this time.

[0126] Assume that faults are injected into the monitored device at around 11:42. At this time, there is no obvious trend. The CPU usage data increases suddenly at 11:43. Since the long-term CPU usage data has no obvious trend and the data is unstable, that is, the target evolution type is still "unstable, no trend", jitter detection and threshold detection are used for anomaly detection. The target jitter score is 47.14 and the target threshold score is 85.78. At this time, it can be determined that the comprehensive anomaly score is 66.46. At this time, the target jitter score is low, the target threshold score is low, and the comprehensive anomaly score is low (lower than the set score threshold), reflecting that the CPU usage is abnormal, and an abnormal event is pushed.

[0127] At 11:45, the fault injection is still going on and the CPU usage is still at a high level. That is, after a period of time after the fault occurs, the target jitter score gradually increases. The current target jitter score is 77.40. Due to the increase in CPU usage, the target threshold score decreases. The current target threshold score is 60.00 and the comprehensive anomaly score is 68.70. The comprehensive anomaly score is still low (lower than the set score threshold), reflecting that the CPU usage is abnormal and continues to push abnormal events.

[0128] At 11:52, the fault injection has ended, and the time series data of CPU usage is normal. For the long-term CPU usage data, it is still unstable and has no obvious trend, that is, the target evolution type is still "unstable, no trend". Using jitter detection and threshold detection, the target jitter score of 100 and the target threshold score of 100 are obtained. At this time, it can be determined that the comprehensive anomaly score is 100, which is not lower than the set score threshold. It is determined that no anomaly occurs at this time, the comprehensive anomaly score returns to normal, and the push of abnormal events stops.

[0129] As another example, take the monitoring indicator as memory usage and the anomaly assessment value as anomaly score, and the monitoring indicator sequence is the memory usage data that changes over time. The monitoring system continuously collects memory usage data from the device to be monitored. Figure 5 is a timing curve diagram of memory usage data provided by an embodiment of this specification, such as Figure 5 As shown, for the long-term memory usage data, there is no obvious trend, with occasional small fluctuations. Generally speaking, it is "unstable and trendless". That is, after the above-mentioned stability detection and trend detection, it can be determined that the target evolution type of the memory usage data is "unstable and trendless". Then, jitter detection and threshold detection are used for anomaly detection to obtain the target jitter score of 100 and the target threshold score of 100. At this time, it can be determined that the comprehensive anomaly score is 100, which is not lower than the set score threshold (assuming it is 90.00), and it is determined that no anomaly occurs at this time.

[0130] Assume that the fault injection into the monitored device starts at around 10:51. At this time, there is no obvious trend. The memory usage data increases suddenly at 10:52. Since the long-term memory usage data has no obvious trend and the data is not stable, that is, the target evolution type is still "unstable, no trend", the jitter detection and threshold detection methods are used for anomaly detection. The target jitter score is 85.73 and the target threshold score is 75.11. At this time, the comprehensive anomaly score can be determined to be 80.42. At this time, the target jitter score is low, the target threshold score is low, and the comprehensive anomaly score is low (lower than the set score threshold). That is to say, when the fault is just injected, it can be detected that the memory usage data has a violent jitter, the target jitter score is low, and the usage data has increased to the threshold limit. The target threshold score is reduced, and the comprehensive anomaly score reflects that an anomaly has occurred and an abnormal event is pushed.

[0131] After a period of fault injection, the target jitter score of the memory usage data returned to normal, such as 92.23, but the target threshold score remained at a low level, such as 75.15, and the comprehensive anomaly score was 83.69 (lower than the set score threshold). The anomaly was still displayed and the anomaly event was pushed.

[0132] Since there are multiple identical abnormal events in a short period of time, the user can be reminded whether they need to continue to pay attention. If not, they can be set in the feedback. For example, the attention reminder is "This alarm appears multiple times in a short period of time. If you do not need to pay attention, please give feedback! The node memory usage rate is high, which may be accompanied by memory background recycling."

[0133] At 10:57, the fault injection has ended, and the time series data of memory usage is normal. For the long-term memory usage data, it is still unstable and has no obvious trend, that is, the target evolution type is still "unstable, no trend". Using jitter detection and threshold detection, the target jitter score of 100 and the target threshold score of 100 are obtained. At this time, it can be determined that the comprehensive anomaly score is 100, which is not lower than the set score threshold. It is determined that no anomaly occurs at this time, the comprehensive anomaly score returns to normal, and the push of abnormal events stops.

[0134] The embodiment of this specification provides a method for detecting anomalies of equipment monitoring indicators. In the monitoring scenario of the monitoring indicators of the equipment to be monitored, the monitoring indicator sequence of the equipment to be monitored that changes over time can be continuously collected. First, based on the changing characteristics of the monitoring indicator sequence over time, the monitoring indicator sequence is classified to determine the target evolution type, and then the corresponding target abnormal detection method is automatically determined based on the target evolution type, and the monitoring indicator sequence is detected for abnormalities to obtain abnormal detection results. There is no need to manually configure the abnormal detection method, which reduces the configuration complexity of the abnormal detection method and improves the efficiency of abnormal detection of monitoring indicators. Data classification and abnormal detection are performed based on the changing characteristics of the monitoring indicator sequence over time. Different evolution types correspond to different abnormal detection methods. The abnormal detection method can flexibly adapt to the changing characteristics of various monitoring indicator sequences and various application scenarios, solving the problem of complex user algorithm configuration and the inability of abnormal detection algorithms to cover a variety of usage scenarios. In addition, in the process of data classification and abnormal detection, a variety of unsupervised models are combined to effectively improve the detection accuracy.

[0135] Corresponding to the above method embodiment, this specification also provides a data anomaly detection device embodiment, Figure 6 FIG. 2 shows a schematic diagram of a data anomaly detection device provided by an embodiment of the present specification. Figure 6 As shown, the device comprises: An acquisition module 602 is configured to acquire timing data to be tested; The first determination module 604 is configured to classify the time series data to be tested based on the change characteristics of the time series data to be tested over time, and determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; A second determination module 606 is configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, different evolution types include target evolution types, and different anomaly detection methods include target anomaly detection methods; The third determination module 608 is configured to perform anomaly detection on the time series data to be tested according to the target anomaly detection method, and determine the anomaly detection result of the time series data to be tested.

[0136] Optionally, the variation characteristics of the time series data to be measured over time include a stable characteristic and / or a trend characteristic; the first determination module 604 is further configured to: Perform a stationary detection and / or a trend detection on the time series data to be tested to obtain a stationary type and / or a trend type, wherein the stationary type is used to indicate whether the time series data to be tested changes steadily over time, and the trend type is used to indicate the change trend of the time series data to be tested; The stationary type and / or trend type is used as the target evolution type of the time series data to be tested.

[0137] Optionally, the first determining module 604 is configured to: Performing an extreme value detection on the time series data to be tested, and when the result of the extreme value detection is not stable, using a set stable detection algorithm to perform a stable detection on the time series data to be tested to obtain a stable type; and / or, A set smoothing algorithm is used to smooth the time series data to be tested to obtain updated time series data; a set trend detection algorithm is used to perform trend detection on the updated time series data to obtain a trend type.

[0138] Optionally, the trend detection algorithm is set to a linear regression algorithm; the first determination module 604 is further configured to: Fitting a linear regression model to the updated time series data and determining the slope of the linear regression model; If the scalar value of the slope is less than the first threshold, the trend type is determined to be a downward trend type; If the scalar value of the slope is greater than or equal to the first threshold and less than or equal to the second threshold, the trend type is determined to be a no-trend type; If the scalar value of the slope is greater than a second threshold, determining that the trend type is an upward trend type; The first threshold is a negative number, the second threshold is a positive number, and the scalar values ​​of the first threshold and the second threshold are the same or different.

[0139] Optionally, the second determining module 606 is further configured to: If the target evolution type is a stable type, or the target evolution type is an unsteady and trendless type, the target anomaly detection method is determined to be jitter detection and threshold detection; If the target evolution type is unstable and has an upward trend, the target anomaly detection method is determined to be trend detection and threshold detection; If the target evolution type is unstable and has a downward trend, the target anomaly detection method is determined to be trend detection.

[0140] Optionally, the third determining module 608 is further configured to: According to at least one anomaly detection method included in the target anomaly detection method, anomaly detection is performed on the time series data to be tested, and anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods are determined; Determine the comprehensive anomaly evaluation value of the time series data to be tested according to the anomaly evaluation values ​​under various anomaly detection methods; When the comprehensive abnormality evaluation value is lower than the set evaluation value threshold, it is determined that the time series data to be tested is abnormal.

[0141] Optionally, the third determining module 608 is further configured to: If the target abnormality detection method includes jitter detection, a first jitter algorithm is used to perform jitter detection on the timing data to be tested to obtain a first jitter evaluation value; Using a second jitter algorithm to perform jitter detection on the timing data to be measured to obtain a second jitter evaluation value, wherein the second jitter algorithm is different from the first jitter algorithm; A target jitter evaluation value of the timing data to be tested under jitter detection is determined according to the first jitter evaluation value and the second jitter evaluation value.

[0142] Optionally, the third determining module 608 is further configured to: If the target anomaly detection method includes threshold detection, determine the distance between the time series data to be tested and the set anomaly threshold; According to the distance between the time series data to be tested and the set abnormal threshold, the target threshold evaluation value of the time series data to be tested under threshold detection is determined.

[0143] Optionally, the third determining module 608 is further configured to: If the target anomaly detection method includes trend detection, trend detection is performed on the time series data to be tested according to the set trend detection algorithm to obtain the target trend evaluation value under trend detection.

[0144] Optionally, the device further includes a second generating module configured to: When the anomaly detection result is an abnormality, an abnormal event is generated; Determine abnormal attribute information of abnormal events; Determine the number of occurrences of abnormal events with the same abnormal attribute information within a set time period. If the number of occurrences exceeds a threshold, issue a reminder, where the reminder is used to indicate whether abnormal events are continuously generated.

[0145] The above is a schematic scheme of a data anomaly detection device of this embodiment. It should be noted that the technical scheme of the data anomaly detection device and the technical scheme of the above-mentioned data anomaly detection method belong to the same concept, and the details not described in detail in the technical scheme of the data anomaly detection device can be referred to the description of the technical scheme of the above-mentioned data anomaly detection method.

[0146] Corresponding to the above method embodiment, this specification also provides an abnormality detection device embodiment of equipment monitoring indicators, Figure 7 FIG. 1 is a schematic diagram showing a structure of an abnormality detection device for equipment monitoring indicators provided by an embodiment of the present specification. Figure 7 As shown, the device comprises: The fourth determination module 702 is configured to obtain a monitoring indicator sequence of the device to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine a target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate a change type of the monitoring indicator sequence; A fifth determination module 704 is configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, different evolution types include target evolution types, and different anomaly detection methods include target anomaly detection methods; The sixth determination module 706 is configured to perform anomaly detection on the monitoring indicator sequence according to the target anomaly detection method, and determine an anomaly detection result of the monitoring indicator sequence; The first generating module 708 is configured to generate an abnormal event of the device to be monitored when the abnormality detection result is an abnormality.

[0147] The above is a schematic scheme of an abnormality detection device for equipment monitoring indicators of this embodiment. It should be noted that the technical scheme of the abnormality detection device for equipment monitoring indicators and the technical scheme of the abnormality detection method for data anomaly detection and equipment monitoring indicators mentioned above belong to the same concept. For details not described in detail in the technical scheme of the abnormality detection device for equipment monitoring indicators, please refer to the description of the technical scheme of the abnormality detection method for data anomaly detection and equipment monitoring indicators mentioned above.

[0148] Figure 8 The structure block diagram of a computing device 800 provided according to an embodiment of the present specification is shown. The components of the computing device 800 include but are not limited to a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and the database 850 is used to store data.

[0149] The computing device 800 also includes an access device 840 that enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 840 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0150] In one embodiment of the present specification, the above components of the computing device 800 and Figure 8 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 8 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0151] The computing device 800 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 800 may also be a mobile or stationary server.

[0152] Among them, the processor 820 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned data anomaly detection method or the anomaly detection method of the equipment monitoring indicator.

[0153] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the data anomaly detection method or the anomaly detection method of the device monitoring indicator are of the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the data anomaly detection method or the anomaly detection method of the device monitoring indicator.

[0154] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned data anomaly detection method or the device monitoring indicator anomaly detection method.

[0155] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the data anomaly detection method or the device monitoring indicator anomaly detection method are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the data anomaly detection method or the device monitoring indicator anomaly detection method.

[0156] An embodiment of the present specification also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned data anomaly detection method or the device monitoring indicator anomaly detection method.

[0157] The above is a schematic scheme of a computer program product of this embodiment. It should be noted that the technical scheme of the computer program product and the technical scheme of the data anomaly detection method or the device monitoring indicator anomaly detection method described above belong to the same concept, and the details not described in detail in the technical scheme of the computer program product can be referred to the description of the technical scheme of the data anomaly detection method or the device monitoring indicator anomaly detection method described above.

[0158] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0159] Computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. Computer readable media may include: any entity or device capable of carrying computer program codes, recording media, USB flash drives, mobile hard disks, magnetic disks, optical disks, computer memories, read-only memories (ROM), random access memories (RAM), electric carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the contents of computer readable media may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer readable media do not include electric carrier signals and telecommunication signals.

[0160] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0161] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0162] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data anomaly detection method, comprising: Obtain the timing data to be tested; Based on the change characteristics of the time series data to be tested over time, the time series data to be tested is classified to determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; According to the target anomaly detection method, anomaly detection is performed on the time series data to be tested to determine an anomaly detection result of the time series data to be tested.

2. According to the data anomaly detection method of claim 1, the time-varying characteristics of the time series data to be tested include a stable characteristic and / or a trend characteristic; and the step of classifying the time series data to be tested based on the time-varying characteristics of the time series data to be tested and determining the target evolution type of the time series data to be tested comprises: Performing a stationary detection and / or a trend detection on the time series data to be tested to obtain a stationary type and / or a trend type, wherein the stationary type is used to indicate whether the time series data to be tested changes steadily over time, and the trend type is used to indicate a change trend of the time series data to be tested; The stationary type and / or the trend type is used as the target evolution type of the time series data to be tested.

3. According to the data anomaly detection method of claim 2, the step of performing stationary detection and / or trend detection on the time series data to be tested to obtain the stationary type and / or the trend type comprises: Performing an extreme value detection on the time series data to be tested, and when the result of the extreme value detection is not stable, performing a stable detection on the time series data to be tested by using a set stable detection algorithm to obtain the stable type; and / or, A set smoothing algorithm is used to smooth the time series data to be tested to obtain updated time series data; a set trend detection algorithm is used to perform trend detection on the updated time series data to obtain the trend type.

4. The data anomaly detection method according to claim 3, wherein the setting trend detection algorithm is a linear regression algorithm; The adopting a set trend detection algorithm to perform trend detection on the update time series data to obtain the trend type includes: Fitting a linear regression model of the updated time series data to determine the slope of the linear regression model; If the scalar value of the slope is less than a first threshold, determining that the trend type is a downward trend type; If the scalar value of the slope is greater than or equal to a first threshold and less than or equal to a second threshold, determining that the trend type is a no-trend type; If the scalar value of the slope is greater than a second threshold, determining that the trend type is an upward trend type; The first threshold is a negative number, the second threshold is a positive number, and the scalar values ​​of the first threshold and the second threshold are the same or different.

5. The data anomaly detection method according to claim 1, wherein determining the corresponding target anomaly detection method according to the target evolution type comprises: If the target evolution type is a stable type, or the target evolution type is an unstable and trendless type, determining that the target abnormality detection method is jitter detection and threshold detection; If the target evolution type is unstable and has an upward trend, the target anomaly detection method is determined to be trend detection and threshold detection; If the target evolution type is unstable and has a downward trend, the target anomaly detection method is determined to be trend detection.

6. The data anomaly detection method according to claim 1, wherein the step of performing anomaly detection on the time series data to be tested and determining an anomaly detection result of the time series data to be tested according to the target anomaly detection method comprises: According to at least one abnormality detection method included in the target abnormality detection method, abnormality detection is performed on the time series data to be tested, and abnormality evaluation values ​​of the time series data to be tested under various abnormality detection methods are determined; Determine the comprehensive abnormality evaluation value of the time series data to be tested according to the abnormality evaluation values ​​under the various abnormality detection modes; When the comprehensive abnormality evaluation value is lower than the set evaluation value threshold, it is determined that the time series data to be tested is abnormal.

7. The data anomaly detection method according to claim 6, wherein the step of performing anomaly detection on the time series data to be tested according to at least one anomaly detection method included in the target anomaly detection method, and determining anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods comprises: If the target abnormality detection method includes jitter detection, a first jitter algorithm is used to perform jitter detection on the time series data to be tested to obtain a first jitter evaluation value; Using a second jitter algorithm to perform jitter detection on the timing data to be tested to obtain a second jitter evaluation value, wherein the second jitter algorithm is different from the first jitter algorithm; A target jitter evaluation value of the timing data to be tested under jitter detection is determined according to the first jitter evaluation value and the second jitter evaluation value.

8. The data anomaly detection method according to claim 6, wherein the step of performing anomaly detection on the time series data to be tested according to at least one anomaly detection method included in the target anomaly detection method, and determining anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods comprises: If the target anomaly detection method includes threshold detection, determining the distance between the time series data to be tested and a set anomaly threshold; According to the distance between the time series data to be tested and the set abnormal threshold, a target threshold evaluation value of the time series data to be tested under threshold detection is determined.

9. The data anomaly detection method according to claim 6, wherein the step of performing anomaly detection on the time series data to be tested according to at least one anomaly detection method included in the target anomaly detection method, and determining anomaly evaluation values ​​of the time series data to be tested under various anomaly detection methods comprises: If the target anomaly detection method includes trend detection, trend detection is performed on the time series data to be tested according to a set trend detection algorithm to obtain a target trend evaluation value under trend detection.

10. The data anomaly detection method according to any one of claims 1 to 9, wherein after performing anomaly detection on the time series data to be tested according to the target anomaly detection mode and determining an anomaly detection result of the time series data to be tested, the method further comprises: When the abnormality detection result is an abnormality, generating an abnormality event; Determining abnormal attribute information of the abnormal event; Determine the number of occurrences of abnormal events with the same abnormal attribute information within a set time period, and if the number of occurrences exceeds a threshold, issue a reminder, wherein the reminder is used to indicate whether abnormal events are continuously generated.

11. A method for detecting anomalies of equipment monitoring indicators, comprising: Acquire a monitoring indicator sequence of the device to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine the target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate the change type of the monitoring indicator sequence; Determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; According to the target anomaly detection method, anomaly detection is performed on the monitoring indicator sequence to determine an anomaly detection result of the monitoring indicator sequence; When the abnormality detection result is that an abnormality occurs, an abnormality event of the device to be monitored is generated.

12. A data anomaly detection device, comprising: An acquisition module, configured to acquire the timing data to be tested; A first determination module is configured to classify the time series data to be tested based on the change characteristics of the time series data to be tested over time, and determine the target evolution type of the time series data to be tested, wherein the target evolution type is used to indicate the change type of the time series data to be tested; A second determination module is configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; The third determination module is configured to perform anomaly detection on the time series data to be tested according to the target anomaly detection method, and determine an anomaly detection result of the time series data to be tested.

13. An abnormality detection device for equipment monitoring indicators, comprising: A fourth determination module is configured to obtain a monitoring indicator sequence of the device to be monitored that changes over time, classify the monitoring indicator sequence based on the change characteristics of the monitoring indicator sequence over time, and determine a target evolution type of the monitoring indicator sequence, wherein the target evolution type is used to indicate a change type of the monitoring indicator sequence; a fifth determination module, configured to determine a corresponding target anomaly detection method according to the target evolution type, wherein different evolution types correspond to different anomaly detection methods, the different evolution types include the target evolution type, and the different anomaly detection methods include the target anomaly detection method; a sixth determination module, configured to perform anomaly detection on the monitoring indicator sequence according to the target anomaly detection method, and determine an anomaly detection result of the monitoring indicator sequence; The first generating module is configured to generate an abnormal event of the device to be monitored when the abnormality detection result is an abnormality.

14. A computing device comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the steps of the data anomaly detection method according to any one of claims 1 to 10 or the anomaly detection method for equipment monitoring indicators according to claim 11 are implemented.

15. A computer-readable storage medium storing a computer program / instruction, which, when executed by a processor, implements the steps of the data anomaly detection method according to any one of claims 1 to 10 or the device monitoring indicator anomaly detection method according to claim 11.

16. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the data anomaly detection method according to any one of claims 1 to 10 or the device monitoring indicator anomaly detection method according to claim 11.

Images