Operation data anomaly detection method, electronic device and computer program product

Abstract

The embodiment of the invention is suitable for the technical field of computers, and provides a running data anomaly detection method, electronic equipment and a computer program product, and the method comprises the steps: collecting running data of target equipment based on a collection period; if the first operation data corresponding to the current acquisition period and a first data set do not meet a preset gradient condition, adding the first operation data to a second data set, and performing anomaly detection on the target equipment based on the first data set to generate anomaly information corresponding to the target equipment; the first data set is a data set composed of second operation data corresponding to N collection periods before the current collection period; a first data curve generated based on the first data set meets the gradient condition; n is a positive integer greater than 1. According to the method, the electronic equipment can perform anomaly detection according to the multiple pieces of operation data meeting the gradient condition, so that the anomaly detection accuracy is improved.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of computer technology, and in particular, relate to a method for detecting anomalies in operating data, an electronic device, and a computer program product. Background Art

[0002] With the widespread application of digital management, more and more companies are beginning to equip equipment management systems to help operation and maintenance personnel better understand the operating status and performance changes of equipment. The equipment management system can continuously monitor the operating data of terminal equipment, such as CPU utilization and memory utilization, to help operation and maintenance personnel promptly discover abnormal conditions during the operation of terminal equipment, so that they can handle abnormal conditions in a timely manner, thereby ensuring that the terminal equipment can operate stably and meet business needs. For example, when the equipment management system detects that a certain terminal device may have excessive memory utilization, in order to avoid the terminal device from crashing due to overload, the equipment management system can automatically trigger an alarm mechanism to notify the operation and maintenance personnel to handle it in a timely manner.

[0003] In the prior art, after collecting the operation data of the terminal device, the device management system can periodically input the collected operation data into the neural network model according to the detection cycle preset by the R&D personnel, so as to perform anomaly detection on all the operation data in the current detection cycle through the neural network model. However, the operation data of the terminal device has strong randomness. Therefore, the accuracy of the prior art in detecting anomalies of the operation data according to the detection cycle is low. Summary of the invention

[0004] In view of this, embodiments of the present application provide a method for detecting anomalies in operating data, an electronic device, and a computer program product to improve the accuracy of detecting anomalies in operating data.

[0005] A first aspect of an embodiment of the present application provides a method for detecting anomalies in operation data, comprising:

[0006] Collect the operation data of the target equipment based on the collection cycle;

[0007] If the first operating data corresponding to the current acquisition cycle does not satisfy a preset gradient condition with the first data set, the first operating data is added to the second data set, and the target device is detected for abnormality based on the first data set to generate abnormal information corresponding to the target device; the first data set is a data set composed of the second operating data corresponding to N acquisition cycles before the current acquisition cycle; the first data curve generated based on the first data set satisfies the gradient condition; N is a positive integer greater than 1.

[0008] In a possible implementation manner of the first aspect, if the first operating data corresponding to the current acquisition period does not satisfy a preset gradient condition with the first data set, adding the first operating data to the second data set, and performing anomaly detection on the target device based on the first data set to generate anomaly information corresponding to the target device, including:

[0009] Inputting the first operating data and a first data curve corresponding to the first data set into a preset gradient algorithm to determine a gradient value between the first operating data and the first data curve;

[0010] If the gradient value is greater than the gradient threshold, the first operating data is added to the second data set, and anomaly detection is performed on the target device based on the first data set to generate the anomaly information.

[0011] In a possible implementation manner of the first aspect, performing anomaly detection on the target device based on the first data set to generate anomaly information corresponding to the target device includes:

[0012] Performing nonlinear fitting on all second running data in the first data set to generate the first data curve;

[0013] If a discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, the any second operating data is determined as abnormal data.

[0014] In a possible implementation manner of the first aspect, the discrete indicator includes a distance value between the second operating data and the first data curve;

[0015] If the discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, determining the any second operating data as abnormal data includes:

[0016] Inputting all the second operating data in the first data set and the first data curve into a mean square error function to determine a discrete threshold value corresponding to the first data curve;

[0017] If the distance value of any second operating data is greater than or equal to the discrete threshold, the any second operating data is determined as the abnormal data.

[0018] In a possible implementation manner of the first aspect, the abnormal information includes first prompt information and second prompt information;

[0019] After determining any second operating data as abnormal data, the method further comprises:

[0020] For any abnormal data, query the log information corresponding to the abnormal data based on the collection time of the abnormal data;

[0021] If there is log information corresponding to any of the abnormal data, generating the first prompt information based on the log information, the collection time and the any of the abnormal data;

[0022] If there is no log information corresponding to any of the abnormal data, the second prompt information is generated based on the collection time and the any of the abnormal data.

[0023] In a possible implementation manner of the first aspect, after collecting the operating data of the target device based on the collection cycle, the method includes:

[0024] If the gradient condition is satisfied between the first operating data corresponding to the current acquisition period and the first data set, the first operating data is added to the first data set, and the first data curve is updated based on the added first data set.

[0025] In a possible implementation manner of the first aspect, after performing anomaly detection on the target device based on the first data set and generating anomaly information corresponding to the target device, the method includes:

[0026] Nonlinear fitting is performed on the second operating data other than the abnormal data in the first data set to generate a second data curve, and the second data curve is displayed.

[0027] In a possible implementation manner of the first aspect, the method includes:

[0028] In response to a display instruction initiated by a user, determining a plurality of target time points based on a target display period in the display instruction;

[0029] Based on the target data set corresponding to the target moment, determining the data to be fitted corresponding to the target moment; the target data set is any data set whose acquisition time period includes the target moment;

[0030] Based on the to-be-fitted data corresponding to each target moment in the target display period, a third data curve is generated, and the third data curve is displayed.

[0031] A second aspect of an embodiment of the present application provides an abnormality detection device for operation data, including:

[0032] A collection module is used to collect the operation data of the target device based on a collection cycle;

[0033] A detection module, used for adding the first operating data corresponding to the current acquisition cycle to the second data set, and performing abnormality detection on the target device based on the first data set to generate abnormality information corresponding to the target device if the first operating data corresponding to the current acquisition cycle does not satisfy a preset gradient condition with the first data set; the first data set is a data set composed of the second operating data corresponding to N acquisition cycles before the current acquisition cycle; a first data curve generated based on the first data set satisfies the gradient condition; N is a positive integer greater than 1.

[0034] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting anomalies in operating data as described in the first aspect above is implemented.

[0035] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for detecting anomalies in operating data as described in the first aspect above is implemented.

[0036] A fifth aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the method for detecting anomalies in operating data described in the first aspect.

[0037] Compared with the prior art, the embodiments of the present application have the following advantages:

[0038] In an embodiment of the present application, the electronic device can collect the operation data of the target device according to the collection cycle; after each operation data is collected, the electronic device can determine whether the first operation data corresponding to the current collection cycle and the first data set meet the preset gradient condition; wherein the first data set is a data set composed of the second operation data corresponding to the N collection cycles before the current collection cycle; the first data curve generated according to the first data set can meet the gradient condition; N can be a positive integer greater than 1; if the electronic device determines that the first operation data corresponding to the current collection cycle and the first data set do not meet the gradient condition, the electronic device can add the first operation data to the second data set, and perform anomaly detection on the target device according to the first data set, and generate anomaly information corresponding to the target device. Through the method provided by this embodiment, since the electronic device can divide the operation data that can form a smooth data curve into a data set according to the gradient condition, and perform anomaly detection on the target device through the operation data in the same data set, then it can also realize data classification when the operation data is not periodic, so as to distinguish the different operation states of the target device during the operation process, and perform anomaly detection based on the operation data of the same operation state, which can improve the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 is a schematic diagram of a method for detecting anomalies in operating data provided by an embodiment of the present application;

[0041] Figure 2 is a schematic diagram of a data set provided in an embodiment of the present application;

[0042] Figure 3 is a flowchart for constructing a data set provided in an embodiment of the present application;

[0043] Figure 4 It is an operation trend diagram provided by an embodiment of the present application;

[0044] Figure 5 is a schematic diagram of a third data curve provided in an embodiment of the present application;

[0045] Figure 6 is a schematic diagram of another method for detecting abnormality of operating data provided in an embodiment of the present application;

[0046] Figure 7 is a schematic diagram of a data curve provided in an embodiment of the present application;

[0047] Figure 8 is a schematic diagram of an abnormality detection device for operation data provided by an embodiment of the present application;

[0048] Fig. 9 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In the following description, specific details such as specific system structures, technologies, etc. are proposed for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from hindering the description of the present application.

[0050] The technical solution of the present application is described below through specific embodiments.

[0051] Reference Figure 1 , shows a schematic diagram of a method for detecting anomalies in operation data provided by an embodiment of the present application. The method can be applied to a variety of electronic devices such as computers, tablet computers, mobile terminals, and large servers. The above-mentioned method for detecting anomalies in operation data may specifically include the following steps:

[0052] S101. Collect operating data of a target device based on a collection cycle.

[0053] In this embodiment, when the operation and maintenance personnel need to perform abnormality detection on a target device, the operation and maintenance personnel can set a collection period of operation data on the electronic device. The electronic device can collect the operation data of the target device according to the collection period and record the collection time of each operation data. The target device and the electronic device can be the same device or different devices.

[0054] In some implementation scenarios, the electronic device can collect the operating data corresponding to multiple target devices at the same time according to the collection cycle, so as to perform anomaly detection on multiple target devices at the same time. When the electronic device needs to perform anomaly detection on other devices other than the electronic device itself, the electronic device can communicate with each target device. R&D personnel can configure a client program for data anomaly detection on each target device. The client program installed on the target device can periodically collect the operating data of the target device and send the collected operating data to the electronic device. At this time, the electronic device can be configured with a system program for data anomaly detection, and the electronic device can continuously receive the operating data collected by the user-end program on each target device through the system program.

[0055] In this embodiment, the operation data collected by the electronic device may include but is not limited to the CPU utilization of the target device and the memory utilization of the target device. For example, when the collection period set by the operation and maintenance personnel is 30 seconds, the electronic device may collect the CPU utilization and memory utilization of the target device every 30 seconds, and record the collection time corresponding to each CPU utilization and memory utilization.

[0056] S102: If the first operating data corresponding to the current acquisition cycle does not satisfy a preset gradient condition with the first data set, the first operating data is added to the second data set, and an abnormality detection is performed on the target device based on the first data set to generate abnormality information corresponding to the target device.

[0057] In this embodiment, after the electronic device obtains the first operating data corresponding to the current acquisition cycle, it can determine whether the first operating data and the first data set meet a preset gradient condition. Among them, the first data set may include the second operating data obtained by N electronic devices in the acquisition cycle before the current acquisition cycle. Among them, N can be a positive integer greater than 1. For the first operating data obtained in the current acquisition cycle, if the electronic device determines that the first operating data and the first data set meet the gradient condition, the electronic device can add the first operating data to the first data set, and update the first data curve corresponding to the first data set according to the added first data set. Among them, the data set can be used to represent a set composed of multiple operating data.

[0058] If the electronic device determines that the first operation data and the first data set do not meet the gradient condition, the electronic device can add the first operation data to the second data set. The second data set is a data set composed of the first operation data and the operation data of N acquisition cycles after the current acquisition cycle. Then, the electronic device can perform abnormality detection on the target device according to all the second operation data contained in the first data set, and generate abnormal information corresponding to the target device. The gradient condition can be used to determine whether the first operation data and the first data curve corresponding to the first data set have continuity, that is, the gradient condition can be used to determine whether the first operation data can form a smooth curve with the first data curve corresponding to the first data set. For the operation data that meets the gradient condition, that is, the operation data and the first data curve corresponding to the first data set have strong continuity and can form a smooth curve, therefore, the electronic device can write the first operation data into the first data set. For the operation data that does not meet the gradient condition, that is, the continuity between the operation data and the first data curve corresponding to the first data set is poor, and it is difficult to form a smooth curve, therefore, the electronic device can write the first operation data into the second data set to generate a new data curve.

[0059] For example, Figure 2 is a schematic diagram of a data set provided in an embodiment of the present application. Figure 2 As shown, the operation data collected by the electronic device includes data set 1 and data set 2, wherein the operation data in the data set 1 can be fitted into a smooth curve, such as curve 1, that is, there is a certain continuity between the operation data in the data set. The operation data collected by the electronic device at time T1 has obviously deviated from the various operation data in data set 1, and the operation data collected after time T1 also has an essential difference in the data trend between data set 1, therefore, the operation data collected at time T1 and thereafter can be used as data set 2. Furthermore, since the operation data of the target device is mainly affected by the number of programs currently running on the target device or the amount of tasks currently executed by the target device. It can be seen that the operation data of the above two data sets correspond to two different operation states of the target device. Therefore, in order to achieve more accurate anomaly detection, the operation data collected before time T1 and the operation data collected at time T1 and thereafter can be divided into different data sets, and anomaly detection is performed based on the operation data in the same data set.

[0060] In this embodiment, since the operation data of the target device does not have a periodic feature, but has a great relationship with the number of programs currently running or the amount of tasks executed by the target device, further, since the gradient condition can be used to determine the continuity between the second operation data and the first data curve corresponding to the first data set. The second operation data in the first data set all meet the gradient condition, that is, there is a strong continuity between the second operation data in the first data set. Therefore, it can be seen that the second operation data in the first data set can be understood as the operation data of the target device in the time period when the same amount of tasks are executed. Therefore, by performing anomaly detection based on multiple operation data that meet the gradient condition, it is possible to avoid the anomaly detection being affected by the number of programs currently running or the amount of tasks executed by the target device, thereby improving the accuracy of anomaly detection.

[0061] In one possible implementation, see Figure 3 , shows a flowchart of constructing a data set provided by an embodiment of the present application. Figure 3As shown, after the electronic device collects the operation data, it can also first determine whether the first operation data of the current collection cycle is the initial operation data of the target device. If the electronic device determines that the first operation data of the current collection cycle is the initial operation data, the electronic device can add the first operation data to the first data set and record the collection time of the first operation data as the start time of the collection time period of the first data set. If the electronic device determines that the first operation data of the current collection cycle is not the initial operation data, the electronic device can determine whether the number of the second operation data contained in the first data set is equal to 1, that is, determine whether the first operation data of the current collection cycle is the second operation data in the first data set. If the number of the second operation data contained in the current data set is equal to 1, that is, it is determined that the first operation data of the current collection cycle is the second operation data in the first data set, the electronic device can write the first operation data of the current collection cycle into the first data set and return to perform the data collection operation.

[0062] If the number of second operating data included in the current data set is greater than 1, and the first operating data of the current acquisition cycle is not the second operating data in the first data set, the electronic device can determine whether the gradient condition is satisfied between the first operating data and the first data set. For a certain first operating data, if the electronic device determines that the gradient condition is satisfied between the first operating data and the first data set, the electronic device can write the first operating data into the first data set. If the electronic device determines that the gradient condition is not satisfied between the first operating data and the first data set, the electronic device can write the first operating data into the second data set. The electronic device can use the acquisition time of the second operating data of the previous acquisition cycle as the end time of the acquisition time period of the first data set, and store the first data set, the data curve corresponding to the first data set, and the acquisition time period of the first data set. Then, the electronic device can perform anomaly detection on each second operating data in the first data set through an anomaly detection algorithm, and generate an anomaly detection result.

[0063] In one possible implementation, when the electronic device determines whether the gradient condition is satisfied between the first operating data and the first data set, it may first perform nonlinear fitting on all the second operating data in the first data set to generate a first data curve corresponding to the first data set. For the specific method of the electronic device performing nonlinear fitting on the first data set, please refer to the relevant content in this application, which will not be repeated here. The first operating data and the first data curve corresponding to the first data set are input into a preset gradient algorithm to determine the gradient value between the first operating data and the first data curve. The gradient algorithm may be specifically as follows.

[0064] Δx(t)=x(t)-x(t-1)

[0065]

[0066] Δy(t)=y(t)-y(t-1)

[0067]

[0068] Wherein, t may represent the acquisition time. y(t) may represent the operation data corresponding to a certain acquisition time. grad(u) may represent the gradient value. x(t) may represent the first data curve that changes with the acquisition time. x may represent the first offset of the operation data that changes with time. y may represent the second offset of the first data curve that changes with time.

[0069] The electronic device can determine whether the gradient value between the first operating data and the first data curve is less than or equal to the gradient threshold value to determine whether the gradient condition is satisfied between the first operating data and the first data curve. The gradient threshold value can be a first default value pre-set by the R&D personnel, or can be set by the operation and maintenance personnel according to the equipment analysis requirements.

[0070] If the electronic device determines that the gradient value between the first operating data and the first data curve is less than or equal to the gradient threshold, that is, the electronic device determines that the gradient condition is satisfied between the first operating data and the first data curve, then the electronic device may add the first operating data to the first data set. If the electronic device determines that the gradient value between the first operating data and the first data curve is greater than the gradient threshold, that is, the electronic device determines that the gradient condition is not satisfied between the first operating data and the first data curve, then the electronic device may determine the first operating data as mutation data, and write the first operating data into the second data set, so that the first operating data is nonlinearly fitted with the subsequently collected operating data.

[0071] Through the method provided in this embodiment, for the operating data of the target device, since the electronic device can first determine the data set to which the operating data belongs based on the gradient value between the operating data and the data set, and then perform nonlinear fitting on all the operating data in the data set to generate a data curve of the target device within a certain time period. That is, the electronic device first processes the specific operating data (points), and then stores it as a whole in the form of a data set (segment). The point-segment processing method can not only comprehensively analyze each operating data, but also save the storage space of the electronic device. It can be seen that the method provided in this embodiment enables the electronic device to monitor the operating status of the target device for a long time and improve the sustainability of operating status monitoring.

[0072] In one possible implementation, when the operation and maintenance personnel need to obtain the operating trend of the target device within a certain period of time, the operation and maintenance personnel can initiate a display instruction to the electronic device. If the target display period in the display instruction is a real-time period, the electronic device can display the first data curve corresponding to the latest first data set in real time. Exemplarily, when the target display period is a real-time period, the electronic device can generate an operating trend graph based on the data curves of the data sets corresponding to all operating data collected in the last 20 minutes, and display the operating trend graph. Among them, for the specific method of the electronic device generating the first data curve, please refer to the relevant content in the embodiments of the present application, which will not be repeated here. See. Figure 4 , shows an operation trend diagram provided by an embodiment of the present application. Figure 4 As shown, the operation trend graph may include a data curve corresponding to at least one data set and abnormal data in each data set. When the electronic device determines that the first operation data of the current collection period meets the gradient condition with the first data set, the electronic device may also generate predicted data corresponding to the collection time of the first operation data according to the collection time of the first operation data and the data curve of the first data set, and display the predicted data and the deviation value between the first operation data and the predicted data in the operation trend graph.

[0073] Through the method provided in this embodiment, the electronic device can intelligently predict the future operating status of the target device based on the data curve to generate prediction data, and display the deviation value between the first operating data and the prediction data. Therefore, the method provided in this embodiment can help R&D personnel to promptly discover the operating deviation of the target device, so as to take preventive measures in advance, which helps to improve the operating stability of the target device.

[0074] If the target display period in the display instruction is not a real-time period, the electronic device can query the preset data granularity mapping relationship according to the length of the target display period to determine the data granularity corresponding to the target display period. Exemplarily, if the target display period is from 0 o'clock to 12 o'clock, that is, the length of the target display period is 12 hours, the data granularity of the target display period can be one data every 10 minutes; if the length of the target display period is 24 hours, the data granularity can be one data every 30 minutes. Then, the electronic device can determine multiple target moments in the target display period according to the data granularity. Exemplarily, when the target display period is from 0 o'clock to 12 o'clock, the target moments of the target display period can include but are not limited to multiple moments such as 0:00, 0:10, and 0:20.

[0075] Then, the electronic device can determine the data to be fitted corresponding to the target moment according to the target data sets corresponding to each target moment. Among them, the target data set corresponding to a certain target moment can be any data set whose acquisition time period includes the target moment. Specifically, after determining the target data set corresponding to the target moment, the electronic device can input the target moment into the data curve corresponding to the target data set to determine the data to be fitted corresponding to the target moment. Exemplarily, when the target display time period is from 0 o'clock to 12 o'clock, if the electronic device queries that there is a data set A with an acquisition time period of 22:40 to 0:30, the electronic device can determine the data set A as the target data set for the four target moments of 0:00, 0:10, 0:20 and 0:30. Then, the electronic device can determine the data to be fitted for the four target moments of 0:00, 0:10, 0:20 and 0:30 respectively based on the data curve corresponding to the data set A.

[0076] After determining the data to be fitted corresponding to each target moment in the target display period, the electronic device can generate a third data curve according to the data to be fitted corresponding to each target moment in the target display period, and display the third data curve. For the specific method of the electronic device generating the third data curve, please refer to the relevant content of generating the first data curve in the embodiment of the present application, and replace the "second operating data" in the relevant content with "data to be fitted", and replace the "first data curve" with "third data curve" to understand this solution.

[0077] See also Figure 5 , shows a schematic diagram of a third data curve provided in an embodiment of the present application. Figure 5 As shown, point A may be the data to be fitted corresponding to the target time of 8:00, and curve 2 may be a third data curve generated after the electronic device performs nonlinear fitting on a plurality of data to be fitted.

[0078] In this embodiment, since each data to be fitted in the third data curve is determined according to the data curve of the data set to which it belongs, the method provided in this embodiment can make the data to be fitted corresponding to each target moment in the third data curve more consistent with the average level of the target data set to which the target moment belongs, avoiding the fitted data curve from being affected by accidental factors when the display granularity is large, thereby improving the smoothness of the fitted data curve. In addition, since the operating data of the target device is collected periodically, for a certain target moment, the electronic device may not be able to directly obtain the operating data of the target device at the target moment. Therefore, the method provided in this embodiment can ensure that the electronic device can obtain the data to be fitted at each target moment, thereby improving the availability of the solution.

[0079] Figure 6FIG. 1 shows a specific implementation flow chart of a method S102 for detecting abnormality in operation data provided by the second embodiment of the present application. Figure 6 , compared to Figure 1 In the embodiment, in a method for detecting abnormality of operation data provided in this embodiment, S102 includes: S601 to S602, which are described in detail as follows:

[0080] S601 , performing nonlinear fitting on all second operation data in the first data set to generate a first data curve.

[0081] In this embodiment, when the electronic device performs abnormality detection on all the second operating data in the first data set, it may first perform nonlinear fitting on all the second operating data in the first data set to generate a first data curve.

[0082] In one possible implementation, the electronic device can input the function template preset by the R&D personnel and all the second operating data in the first data set into a nonlinear fitting algorithm to generate a first operating function corresponding to the form of the function template, and generate a first data curve according to the first operating function. Among them, the nonlinear fitting algorithm can be any algorithm known to those skilled in the art, such as LM iterative algorithm, least squares method, maximum likelihood estimation method, spline method, etc., which can be used for fitting curves. The embodiments of the present application are not intended to specifically limit the nonlinear fitting algorithm. For example, when the function template is y=a*t b +c, the first operating function generated by the electronic device according to all the second operating data in the first data set can be y=3*t 2 +5. Wherein, a, b, and c can all be parameters determined by the electronic device through nonlinear fitting.

[0083] S602: If a discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, determine any second operating data as abnormal data.

[0084] In this embodiment, after generating the first data curve corresponding to the first data set, the electronic device can respectively calculate the discrete index between each second operating data in the first data set and the first data curve, and determine whether the discrete index corresponding to each second operating data is greater than a preset discrete threshold value, so as to perform an abnormality detection operation on each second operating data in the first data set. Among them, the discrete threshold value can be a second default value pre-set by the R&D personnel, or it can be set by the operation and maintenance personnel according to the specific operation and maintenance tasks. For any second operating data in the first data set, if the discrete index between the second operating data and the first data curve is less than or equal to the discrete threshold value, the electronic device can determine that the current second operating data is normal data. If the discrete index between the second operating data and the first data curve is greater than the discrete threshold value, the electronic device can determine that the current second operating data is abnormal data.

[0085] In a possible implementation, the discrete index between a second operating data and a first data curve may be a distance value between the second operating data and the first data curve. After generating a first data curve corresponding to a first data set, the electronic device may input the first data curve and all the second operating data in the first data set into a mean square error function preset by a developer to determine a discrete threshold corresponding to the first data curve. Exemplarily, the discrete threshold may be three times the mean square error value between the first data curve and all the second operating data in the first data set.

[0086] After determining the discrete threshold, the electronic device can input the second operating data and the first data curve into the distance function preset by the R&D personnel for any second operating data to generate the distance value between the second operating data and the first data curve. If the distance value between the second operating data and the first data curve is greater than or equal to the discrete threshold corresponding to the first data curve, the electronic device can determine that the second operating data is abnormal data. If the distance value between the second operating data and the first data curve is less than the discrete threshold corresponding to the first data curve, the electronic device can determine that the second operating data is normal data.

[0087] According to the method provided by this embodiment, since the mean square error can be used to represent the average degree of dispersion between each data in the data set and the curve, the method provided by this embodiment determines the discrete threshold value according to the mean square error function, and can more accurately select abnormal data that deviates far from the first data set, thereby improving the accuracy of abnormality detection of the electronic device.

[0088] In one possible implementation, for any first data set, after the electronic device performs anomaly detection on all second operating data in the first data set, if the first data set does not contain abnormal data, the electronic device can display a first data curve corresponding to the first data set, so that the staff can know the operating trend of the target device through the first data curve.

[0089] If the first data set contains abnormal data, the electronic device can re-perform nonlinear fitting on the second operating data other than the abnormal data in the first data set. Figure 7 , shows a schematic diagram of a data curve provided by an embodiment of the present application. Figure 7 As shown in (a), before the electronic device detects abnormalities in the second operating data in the data set 1, the electronic device can directly perform nonlinear fitting based on all the second operating data in the data set 1 to generate the first data curve. Since the electronic device does not detect abnormal data at this time, it can be seen that Figure 7 The data curve in (a) is less consistent with the data in dataset 1. Figure 7 As shown in (b), after determining the abnormal data A, the electronic device can re-perform nonlinear fitting on all operating data in the data set 1 except the abnormal data A to generate a second data curve that is smoother and more in line with the normal data of the data set 1. Among them, the specific method for the electronic device to perform nonlinear fitting on the data set can be found in the relevant content of the embodiment of the present application, which will not be repeated here. The electronic device can display the re-fitted second data curve, and mark the abnormal data in the first data set in the figure where the second data curve is located, so that the operation and maintenance personnel can intuitively know the deviation of the abnormal data, thereby improving the efficiency of the operation and maintenance personnel in analyzing the abnormal data.

[0090] In a possible implementation, after the electronic device determines the abnormal data in a first data set, for any abnormal data, the electronic device can also query the log database of the target device according to the collection time of the abnormal data to determine the log information corresponding to the abnormal data. If the log information corresponding to the abnormal data exists in the log database, the electronic device can store the abnormal data, the log information corresponding to the abnormal data, and the collection time corresponding to the abnormal data. The electronic device can also generate a first prompt information according to the log information corresponding to the abnormal data, the collection time of the abnormal data, and the abnormal data, and send the first prompt information to the equipment of the operation and maintenance personnel. Among them, the first prompt information can be used to inform the operation and maintenance personnel that the event in the log information may cause the target device to be abnormal. If the log information corresponding to the abnormal data does not exist in the log database, the electronic device stores the abnormal data and the collection time corresponding to the abnormal data. The electronic device can also generate a second prompt information corresponding to the abnormal data, and send the second prompt information to the equipment of the operation and maintenance personnel. Among them, the second prompt information can be used to prompt the operation and maintenance personnel to pay attention to the abnormal data.

[0091] Through the method provided in this embodiment, since the electronic device can generate different prompt information according to whether the abnormal data has corresponding log information, the method provided in this embodiment can help the operation and maintenance personnel distinguish different abnormal data, thereby improving the convenience of the operation and maintenance personnel in analyzing the abnormal data, and further improving the analysis efficiency of the abnormal data by the operation and maintenance personnel.

[0092] It should be noted that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0093] Reference Figure 8 , shows a schematic diagram of an abnormality detection device for operation data provided in an embodiment of the present application, which may specifically include a collection module 801 and a detection module 802, wherein:

[0094] The collection module 801 is used to collect the operation data of the target device based on the collection cycle;

[0095] The detection module 802 is used to add the first operating data corresponding to the current acquisition cycle to the second data set if the preset gradient condition is not satisfied between the first operating data and the first data set, and perform abnormality detection on the target device based on the first data set to generate abnormality information corresponding to the target device; the first data set is a data set composed of the second operating data corresponding to N acquisition cycles before the current acquisition cycle; the first data curve generated based on the first data set satisfies the gradient condition; N is a positive integer greater than 1.

[0096] The detection module can also be used to input the first operating data and the first data curve corresponding to the first data set into a preset gradient algorithm to determine the gradient value between the first operating data and the first data curve; if the gradient value is greater than the gradient threshold, the first operating data is added to the second data set, and the target device is detected for anomalies based on the first data set to generate the anomaly information.

[0097] The detection module can also be used to perform nonlinear fitting on all second operating data in the first data set to generate the first data curve; if the discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, the any second operating data is determined as abnormal data.

[0098] The detection module can also be used to input all the second operating data in the first data set and the first data curve into a mean square error function to determine a discrete threshold corresponding to the first data curve; if the distance value of any second operating data is greater than or equal to the discrete threshold, then any second operating data is determined as the abnormal data.

[0099] The detection module can also be used to query the log information corresponding to any abnormal data based on the collection time of any abnormal data; if there is log information corresponding to any abnormal data, generate the first prompt information based on the log information, the collection time and any abnormal data; if there is no log information corresponding to any abnormal data, generate the second prompt information based on the collection time and any abnormal data.

[0100] The detection module may also be configured to add the first operating data corresponding to the current acquisition period to the first data set if the gradient condition is satisfied between the first operating data and the first data set, and to update the first data curve based on the added first data set.

[0101] The abnormality detection device for operation data may further include a display module, wherein the display module is used to perform nonlinear fitting on the second operation data other than the abnormal data in the first data set, generate a second data curve, and display the second data curve.

[0102] The display module can also be used to respond to a display instruction initiated by a user, determine multiple target moments based on the target display period in the display instruction; determine the data to be fitted corresponding to the target moment based on the target data set corresponding to the target moment; the target data set is any data set whose acquisition time period includes the target moment; generate a third data curve based on the data to be fitted corresponding to each target moment in the target display period, and display the third data curve.

[0103] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0104] Reference Fig. 9 , shows a schematic diagram of an electronic device provided by an embodiment of the present application. Fig. 9 As shown, the electronic device 900 in the embodiment of the present application includes: a processor 910, a memory 920, and a computer program 921 stored in the memory 920 and executable on the processor 910. When the processor 910 executes the computer program 921, the steps in each embodiment of the above-mentioned method for detecting abnormality of running data are implemented, such as Figure 1 Alternatively, when the processor 910 executes the computer program 921, the functions of each module / unit in the above-mentioned device embodiments are realized, for example Figure 8 Functions of modules 801 to 802 are shown.

[0105] Exemplarily, the computer program 921 may be divided into one or more modules / units, which are stored in the memory 920 and executed by the processor 910 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which may be used to describe the execution process of the computer program 921 in the electronic device 900. For example, the computer program 921 may be divided into an acquisition module and a detection module, and the specific functions of each module are as follows:

[0106] A collection module is used to collect the operation data of the target device based on a collection cycle;

[0107] A detection module, used for adding the first operating data corresponding to the current acquisition cycle to the second data set, and performing abnormality detection on the target device based on the first data set to generate abnormality information corresponding to the target device if the first operating data corresponding to the current acquisition cycle does not satisfy a preset gradient condition with the first data set; the first data set is a data set composed of the second operating data corresponding to N acquisition cycles before the current acquisition cycle; a first data curve generated based on the first data set satisfies the gradient condition; N is a positive integer greater than 1.

[0108] The electronic device 900 may be a computing device such as a desktop computer or a cloud server. The electronic device 900 may include, but is not limited to, a processor 910 and a memory 920. Those skilled in the art will appreciate that Fig. 9 It is only an example of the electronic device 900 and does not constitute a limitation of the electronic device 900. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 900 may also include input and output devices, network access devices, buses, etc.

[0109] The processor 910 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0110] The memory 920 may be an internal storage unit of the electronic device 900, such as a hard disk or memory of the electronic device 900. The memory 920 may also be an external storage device of the electronic device 900, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 900. Further, the memory 920 may also include both an internal storage unit of the electronic device 900 and an external storage device. The memory 920 is used to store the computer program 921 and other programs and data required by the electronic device 900. The memory 920 may also be used to temporarily store data that has been output or is to be output.

[0111] An embodiment of the present application also discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for detecting abnormalities in operating data as described in the above embodiments is implemented.

[0112] The embodiments of the present application further disclose a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for detecting anomalies in operating data as described in the aforementioned embodiments is implemented.

[0113] The embodiment of the present application further discloses a computer program product. When the computer program product is executed on a computer, the computer is enabled to execute the method for detecting abnormalities in operating data described in the above-mentioned embodiments.

[0114] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application is described in detail with reference to the above-mentioned embodiments, a person skilled in the art should understand that the technical solutions described in the above-mentioned embodiments can still be modified, or some of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for detecting anomalies in operation data, characterized in that: include: Collect the operation data of the target equipment based on the collection cycle; If the first operating data corresponding to the current acquisition period does not satisfy a preset gradient condition with the first data set, the first operating data is added to the second data set, and anomaly detection is performed on the target device based on the first data set to generate anomaly information corresponding to the target device; The first data set is a data set consisting of second operation data corresponding to N collection periods before the current collection period; The first data curve generated based on the first data set satisfies the gradient condition; N is a positive integer greater than 1.

2. The method according to claim 1, characterized in that If the first operating data corresponding to the current acquisition cycle does not satisfy a preset gradient condition with the first data set, the first operating data is added to the second data set, and anomaly detection is performed on the target device based on the first data set to generate anomaly information corresponding to the target device, including: Inputting the first operating data and a first data curve corresponding to the first data set into a preset gradient algorithm to determine a gradient value between the first operating data and the first data curve; If the gradient value is greater than the gradient threshold, the first operating data is added to the second data set, and anomaly detection is performed on the target device based on the first data set to generate the anomaly information.

3. The method according to claim 1, characterized in that: The performing anomaly detection on the target device based on the first data set to generate anomaly information corresponding to the target device includes: Performing nonlinear fitting on all second running data in the first data set to generate the first data curve; If a discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, the any second operating data is determined as abnormal data.

4. The method according to claim 3, characterized in that: The discrete index includes a distance value between the second operating data and the first data curve; If the discrete index between any second operating data and the first data curve is greater than a preset discrete threshold, determining the any second operating data as abnormal data includes: Inputting all the second operating data in the first data set and the first data curve into a mean square error function to determine a discrete threshold value corresponding to the first data curve; If the distance value of any second operating data is greater than or equal to the discrete threshold, the any second operating data is determined as the abnormal data.

5. The method according to claim 3, characterized in that: The abnormal information includes first prompt information and second prompt information; After determining any second operating data as abnormal data, the method further comprises: For any abnormal data, query the log information corresponding to the abnormal data based on the collection time of the abnormal data; If there is log information corresponding to any of the abnormal data, generating the first prompt information based on the log information, the collection time and the any of the abnormal data; If there is no log information corresponding to any of the abnormal data, the second prompt information is generated based on the collection time and the any of the abnormal data.

6. The method according to any one of claims 1 to 5, characterized in that: After collecting the operation data of the target device based on the collection cycle, the method further includes: If the gradient condition is satisfied between the first operating data corresponding to the current acquisition period and the first data set, the first operating data is added to the first data set, and the first data curve is updated based on the added first data set.

7. The method according to any one of claims 1 to 5, characterized in that: After performing anomaly detection on the target device based on the first data set and generating anomaly information corresponding to the target device, the method includes: Nonlinear fitting is performed on the second operating data other than the abnormal data in the first data set to generate a second data curve, and the second data curve is displayed.

8. The method according to any one of claims 1 to 5, characterized in that: include: In response to a display instruction initiated by a user, determining a plurality of target time points based on a target display period in the display instruction; Based on the target data set corresponding to the target time, determining the data to be fitted corresponding to the target time; The target data set is any data set whose collection time period includes the target time; A third data curve is generated based on the data to be fitted corresponding to each target moment in the target display period, and the third data curve is displayed.

9. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method for detecting anomalies in operating data as described in any one of claims 1 to 8.

10. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, enables the method for detecting abnormality of operation data according to any one of claims 1 to 8 to be executed.

Images