Abnormal data detection method and device, storage medium and electronic equipment

Abstract

The invention discloses an abnormal data detection method and device, a storage medium and electronic equipment. Relates to the technical field of data processing and other related technical fields. The method comprises the steps of determining multiple pieces of target data corresponding to target equipment in a configuration management database; analyzing the multiple pieces of target data to obtain data distribution types corresponding to the multiple pieces of target data; and according to the data distribution type, performing anomaly detection on the multiple pieces of target data to obtain anomaly detection results corresponding to the multiple pieces of target data. Through the method and the device, the problem of relatively low accuracy of determining the abnormal data due to the fact that the abnormal data in the configuration management database is determined manually in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology and other related technical fields, and in particular to an abnormal data detection method and device, a storage medium and an electronic device. Background Art

[0002] As the scale of data centers continues to expand, the operation and maintenance management of data centers is also facing greater pressure and challenges. The efficiency and effectiveness of operation and maintenance management are directly related to the stability and availability of data center services. At present, in the operation and maintenance management of data centers, system equipment configuration information is manually verified and checked, or configuration information is queried and compared through the configuration management database. However, manual verification is time-consuming and labor-intensive, and it is impossible to distinguish the accuracy of equipment configuration information. The efficiency of information query and comparison is low, which cannot meet the needs of data center operation and maintenance management efficiency. In order to solve the problem of accuracy of system equipment configuration information in data center operation and maintenance management, it is necessary to perform accuracy verification and optimization analysis on the system equipment configuration information, and improve the quality of operation and maintenance management on the basis of ensuring the efficiency of operation and maintenance management.

[0003] With regard to the problem that abnormal data in a configuration management database is determined manually in related technologies, resulting in a relatively low accuracy rate in determining abnormal data, no effective solution has been proposed so far. Summary of the invention

[0004] The main purpose of the present application is to provide an abnormal data detection method and device, a storage medium and an electronic device to solve the problem in the related art of manually determining abnormal data in a configuration management database, resulting in a relatively low accuracy rate in determining abnormal data.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for detecting abnormal data is provided. The method comprises: determining multiple target data corresponding to a target device in a configuration management database, wherein the multiple target data comprises: multiple attribute data of the target device and multiple association relationship data between the target device and devices other than the target device in the configuration management database; analyzing the multiple target data to obtain data distribution types corresponding to the multiple target data; performing abnormality detection on the multiple target data according to the data distribution type to obtain abnormality detection results corresponding to the multiple target data, wherein the abnormality detection results are used to process the target device.

[0006] Furthermore, analyzing the multiple target data to obtain data distribution types corresponding to the multiple target data includes: encoding and mapping the multiple target data to obtain multiple encoded data; for the target encoded data, calculating the similarity between the target encoded data and the encoded data among the multiple encoded data except the target encoded data to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; analyzing the multiple similarity values ​​to obtain the data distribution type.

[0007] Further, for the target coding data, similarity calculation is performed between the target coding data and the coding data other than the target coding data in the multiple coding data to obtain multiple similarity values, including: calculating the data length of each coding data to obtain multiple data length values; calculating the Levenshtein distance between the target coding data and the coding data other than the target coding data in the multiple coding data to obtain multiple distance values; calculating based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; calculating based on a preset value and the multiple calculation results to obtain the multiple similarity values.

[0008] Furthermore, based on the data distribution type, anomaly detection is performed on the multiple target data to obtain anomaly detection results corresponding to the multiple target data, including: if the data distribution type is uniform distribution, anomaly detection is performed on the multiple target data through a chi-square test to obtain the anomaly detection result; if the data distribution type is normal distribution, anomaly detection is performed on the multiple target data through a Z-score model to obtain the anomaly detection result; if the data distribution type is multimodal distribution, anomaly detection is performed on the multiple target data through a local anomaly factor algorithm to obtain the anomaly detection result; if the data distribution type is other distributions except the uniform distribution, the normal distribution and the multimodal distribution, anomaly detection is performed on the multiple target data through an interquartile range algorithm to obtain the anomaly detection result.

[0009] Furthermore, if the data distribution type is other distributions except the uniform distribution, the normal distribution and the multimodal distribution, anomaly detection is performed on the multiple target data through the interquartile range algorithm, and the anomaly detection result is obtained, including: sorting the multiple target data to obtain multiple sorted target data; calculating the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; calculating based on the first quartile and the third quartile to obtain the anomaly detection result.

[0010] Furthermore, after performing anomaly detection on the multiple target data according to the data distribution type and obtaining anomaly detection results corresponding to the multiple target data, the method also includes: determining a first abnormal cause corresponding to the multiple attribute data and a second abnormal cause corresponding to the multiple association relationship data according to the anomaly detection results; determining an adjustment strategy for the target device according to the first abnormal cause and the second abnormal cause; and adjusting the target device according to the adjustment strategy.

[0011] Furthermore, determining multiple target data corresponding to the target device in the configuration management database includes: determining multiple first initial data corresponding to the target device in the configuration management database; processing missing values ​​in the multiple first initial data to obtain multiple second initial data; processing abnormal values ​​in the multiple second initial data to obtain multiple third initial data; formatting the multiple third initial data to obtain the multiple target data.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an abnormal data detection device is provided. The device comprises: a first determination unit, used to determine multiple target data corresponding to a target device in a configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and devices other than the target device in the configuration management database; an analysis unit, used to analyze the multiple target data to obtain data distribution types corresponding to the multiple target data; a detection unit, used to perform abnormality detection on the multiple target data according to the data distribution type, and obtain abnormality detection results corresponding to the multiple target data, wherein the abnormality detection results are used to process the target device.

[0013] Furthermore, the analysis unit includes: an encoding module, used to perform encoding mapping on the multiple target data to obtain multiple encoded data; a calculation module, used to perform similarity calculation on the target encoded data and the encoded data other than the target encoded data in the multiple encoded data to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; an analysis module, used to analyze the multiple similarity values ​​to obtain the data distribution type.

[0014] Furthermore, the calculation module includes: a first calculation submodule, used to calculate the data length of each encoded data to obtain multiple data length values; a second calculation submodule, used to calculate the Levenshtein distance between the target encoded data and the encoded data other than the target encoded data in the multiple encoded data to obtain multiple distance values; a third calculation submodule, used to calculate based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; a fourth calculation submodule, used to calculate based on a preset value and the multiple calculation results to obtain the multiple similarity values.

[0015] Furthermore, the detection unit includes: a first detection module, which is used to perform anomaly detection on the multiple target data through a chi-square test to obtain the anomaly detection result if the data distribution type is uniform distribution; a second detection module, which is used to perform anomaly detection on the multiple target data through a Z-score model to obtain the anomaly detection result if the data distribution type is normal distribution; a third detection module, which is used to perform anomaly detection on the multiple target data through a local anomaly factor algorithm to obtain the anomaly detection result if the data distribution type is multimodal distribution; and a fourth detection module, which is used to perform anomaly detection on the multiple target data through an interquartile range algorithm to obtain the anomaly detection result if the data distribution type is other distributions except the uniform distribution, the normal distribution and the multimodal distribution.

[0016] Furthermore, the fourth detection module includes: a sorting submodule, used to sort the multiple target data to obtain multiple sorted target data; a fifth calculation submodule, used to calculate the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; a sixth calculation submodule, used to calculate based on the first quartile and the third quartile to obtain the anomaly detection result.

[0017] Furthermore, the device also includes: a second determination unit, which is used to perform anomaly detection on the multiple target data according to the data distribution type, and after obtaining the anomaly detection results corresponding to the multiple target data, determine the first anomaly cause corresponding to the multiple attribute data and the second anomaly cause corresponding to the multiple association relationship data according to the anomaly detection results; a third determination unit, which is used to determine the adjustment strategy of the target device according to the first anomaly cause and the second anomaly cause; and an adjustment unit, which is used to adjust the target device according to the adjustment strategy.

[0018] Furthermore, the first determination unit includes: a determination module, used to determine multiple first initial data corresponding to the target device in the configuration management database; a first processing module, used to process missing values ​​in the multiple first initial data to obtain multiple second initial data; a second processing module, used to process abnormal values ​​in the multiple second initial data to obtain multiple third initial data; and a formatting module, used to format the multiple third initial data to obtain the multiple target data.

[0019] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the above-mentioned abnormal data detection methods.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, the electronic device includes one or more processors and a memory, and the memory is used to store one or more processors to implement any one of the above-mentioned abnormal data detection methods.

[0021] Through this application, the following steps are adopted: multiple target data corresponding to the target device are determined in the configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and the devices other than the target device in the configuration management database; multiple target data are analyzed to obtain data distribution types corresponding to the multiple target data; according to the data distribution type, multiple target data are detected for anomalies to obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device. Through this application, the problem of determining abnormal data in the configuration management database by manual means in the related art, resulting in a relatively low accuracy rate of determining abnormal data, is solved. In this scheme, in the configuration management database, multiple target data related to the target device are first identified, and the data covers multiple attribute information of the target device and multiple association relationship data with other non-target devices in the configuration management database (i.e., devices other than the target device in the configuration management database). Then, multiple target data are analyzed to parse the data distribution characteristics of the data. Finally, based on the data distribution characteristics, multiple target data are detected for anomalies to obtain anomaly detection results. By collecting and analyzing multiple target data, not only the comprehensiveness of problem discovery is improved, but also the potential correlation between data is deeply explored, which helps to identify abnormal data more accurately and avoid problems that may be missed by single-dimensional analysis. At the same time, anomaly detection of multiple target data based on data distribution type greatly improves the efficiency and accuracy of data analysis, reduces the subjectivity and errors of manual participation, and thus improves the overall efficiency of data center operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 is a flow chart of an abnormal data detection method provided according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of an abnormal data detection method provided according to an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of an abnormal data detection device provided according to an embodiment of the present application;

[0026] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0031] Configuration Management Database (CMDB): It is a database that stores and manages IT infrastructure configuration information. It records detailed information about various devices in the system, including device attributes and the relationships between devices. It is widely used in the operation and maintenance management process of data centers. By managing and analyzing the data in the CMDB, operation and maintenance personnel can fully understand the equipment information and operating status of the data center and can discover and handle problems in a timely manner.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0033] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of an abnormal data detection method provided in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0034] Step S101 : determining a plurality of target data corresponding to a target device in a configuration management database, wherein the plurality of target data includes: a plurality of attribute data of the target device and a plurality of association relationship data between the target device and devices other than the target device in the configuration management database.

[0035] Optionally, the data acquisition module of the CMDB database (i.e., configuration management database) obtains multiple attribute data of the system device (i.e., target device) and multiple association relationship data between the system device and devices other than the system device in the configuration management database through an API interface or by directly connecting to the CMDB database.

[0036] It should be noted that multiple attribute data include but are not limited to: basic data such as the device name of the system equipment, the configuration item maintenance department, the device status, the serial number, the server type, the usage type, the usage method, the production date, etc.; hardware configuration information such as the CPU model, the number of CPU cores, the memory capacity, the number of network cards, the operating system version, etc.; software and hardware configuration information such as the operating system version, the usage type, etc.

[0037] It should be noted that the multiple association relationship data include but are not limited to: power supply information, location information, installation type, resource pool and deployment data associated with the system device and the devices other than the system device in the configuration management database.

[0038] Step S102: Analyze the multiple target data to obtain data distribution types corresponding to the multiple target data.

[0039] Optionally, multiple target data are analyzed by multiple algorithms to identify data distribution types corresponding to the multiple target data, such as uniform distribution, normal distribution, multimodal distribution, and other distributions except uniform distribution, normal distribution and multimodal distribution.

[0040] Step S103, performing anomaly detection on the multiple target data according to the data distribution type, and obtaining anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

[0041] Optionally, by comprehensively applying different statistical methods and techniques, anomaly detection is performed on multiple target data according to the characteristics of different data distribution types to obtain anomaly detection results.

[0042] In summary, in the configuration management database, multiple target data related to the target device are first identified. The data covers multiple attribute information of the target device and multiple association relationship data with other non-target devices in the configuration management database (i.e., devices other than the target device in the configuration management database). Then, the multiple target data are analyzed to parse the data distribution characteristics of the data. Finally, based on the data distribution characteristics, anomaly detection is performed on the multiple target data to obtain anomaly detection results. By collecting and analyzing multiple target data, not only the comprehensiveness of problem discovery is improved, but also the potential associations between the data are deeply explored, which helps to identify abnormal data more accurately and avoid problems that may be missed by single-dimensional analysis. At the same time, anomaly detection of multiple target data based on data distribution type greatly improves the efficiency and accuracy of data analysis, reduces the subjectivity and errors of manual participation, and thus improves the overall efficiency of data center operation and maintenance.

[0043] Optionally, in the abnormal data detection method provided in the embodiment of the present application, multiple target data are analyzed to obtain data distribution types corresponding to the multiple target data, including: encoding mapping the multiple target data to obtain multiple encoded data; for the target encoded data, calculating the similarity between the target encoded data and the encoded data other than the target encoded data in the multiple encoded data to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; analyzing the multiple similarity values ​​to obtain the data distribution type.

[0044] In an optional embodiment, multiple target data are coded and mapped, and the classification data (e.g., status labels or type descriptions) in the multiple target data are converted into numerical types to obtain multiple coded data. The differences between different coded data are measured and compared by a similarity analysis method to help identify and correct duplicates, incorrect inputs or inconsistent records in the data, especially anomalies that may occur during manual data input. On this basis, the distribution characteristics of multiple target data are determined based on multiple similarity values ​​by distribution recognition technology to obtain data distribution types, such as uniform distribution, normal distribution, multi-peak distribution, and other distributions other than uniform distribution, normal distribution, and multi-peak distribution. The specific steps are as follows: First, detect whether the data obeys uniform distribution. If the data does not obey uniform distribution, detect whether the data obeys normal distribution. If the data neither obeys uniform distribution nor normal distribution, detect whether the data obeys multi-peak distribution. If the data does not obey the above three data distributions, determine that the data distribution type of the data is other distribution.

[0045] It should be noted that the core idea of ​​label encoding is to assign a unique integer to each unique text label. The encoder assigns numbers according to the order in which the labels appear in the data, or they can be sorted and assigned according to predefined rules. For categorical data without order or priority, a non-predetermined strategy is adopted. When label encoding is applied to data mapping, the processing is determined by defining all text attributes that need to be converted, where each unique text value is mapped to an integer identifier. For categorical data with order or priority, a predetermined strategy is adopted, and data encoding mapping is performed through a given mapping relationship.

[0046] It should be noted that uniform distribution means that each category in the data has roughly the same frequency of occurrence, and the occurrence of each category during the observation period is average, and no category is particularly common or rare. Normal distribution, also known as Gaussian distribution, is an extremely important continuous probability distribution in probability statistics. It is characterized by a bell-shaped curve centered on the mean value and symmetric on both sides. Multimodal distribution means that there are two or more peaks in the data.

[0047] By encoding and mapping multiple target data, not only the efficiency of abnormal data detection is improved, but it is also crucial to improving the availability and security of data.

[0048] Optionally, in the abnormal data detection method provided in the embodiment of the present application, for the target coded data, similarity calculation is performed between the target coded data and coded data other than the target coded data in the multiple coded data to obtain multiple similarity values, including: calculating the data length of each coded data to obtain multiple data length values; calculating the Levenshtein distance between the target coded data and the coded data other than the target coded data in the multiple coded data to obtain multiple distance values; calculating based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; calculating based on the preset value and the multiple calculation results to obtain multiple similarity values.

[0049] In an optional embodiment, for any two coded data to be calculated (for example, the first coded data and the second coded data) among the plurality of coded data, a similarity analysis is performed using the Levenshtein distance (i.e., the Levenshtein distance) to obtain a similarity value, and the calculation formula is as follows:

[0050]

[0051] Wherein, distance is the Levenshtein distance between the first encoded data and the second encoded data, len(str1) and len(str2) are the data length values ​​of the first encoded data and the second encoded data respectively, and 1 is a preset value. Similarity is a similarity score (i.e., similarity value), and the value range is between [0,1]. The larger the value, the more similar the first encoded data and the second encoded data are.

[0052] It should be noted that Levenshtein distance is a popular method for measuring the difference between two text strings. This difference is determined by calculating the minimum number of single-character editing operations (including inserting, deleting, or replacing characters) required to transform one string into another. Similarity analysis using Levenshtein distance can not only be applied to string comparisons of arbitrary lengths, but can also be directly associated with actual editing operations, making the results easy to interpret. Levenshtein distance shows high robustness when dealing with common text variations such as typos, abbreviation changes, etc.

[0053] By converting the Levenshtein distance between the encoded data into a similarity score, we can more intuitively understand the degree of similarity between the encoded data.

[0054] Optionally, in the abnormal data detection method provided in the embodiment of the present application, anomaly detection is performed on multiple target data according to the data distribution type, and anomaly detection results corresponding to the multiple target data are obtained, including: if the data distribution type is uniform distribution, anomaly detection is performed on the multiple target data through a chi-square test to obtain anomaly detection results; if the data distribution type is normal distribution, anomaly detection is performed on the multiple target data through a Z-score model to obtain anomaly detection results; if the data distribution type is multimodal distribution, anomaly detection is performed on the multiple target data through a local anomaly factor algorithm to obtain anomaly detection results; if the data distribution type is other distributions except uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on the multiple target data through an interquartile range algorithm to obtain anomaly detection results.

[0055] In an optional embodiment, if the data distribution type corresponding to multiple target data is uniform distribution, the anomaly detection result is usually manifested as the frequency of occurrence of certain values ​​being significantly higher or lower than the expected value. Since the characteristic of uniform distribution is that the probability of occurrence of all values ​​should be equal, any significant deviation from this pattern may be expressed as an anomaly. Therefore, a chi-square test is used to evaluate whether the actual frequency distribution of the data is significantly different from the theoretical uniform distribution. The difference between the observed frequency and the expected frequency of each value is calculated. If it occurs frequently or rarely (i.e., below the confidence interval of 0.1%), the target data is considered to be an outlier to obtain an anomaly detection result.

[0056] If the data distribution type corresponding to multiple target data is normal distribution, the anomaly detection result is usually manifested as an observation value at the tail of the distribution, far from the mean. Based on the frequency of data occurrence, when the frequency value is small, it is considered that the probability of data occurrence is small, and it is considered to be error or abnormal data. Use the Z score method to identify outliers. The Z score represents the number of standard deviations between the data point and the mean. Under normal circumstances, if the absolute value of the Z score is greater than 3, the target data is considered to be an outlier to obtain an anomaly detection result.

[0057] If the data distribution type corresponding to multiple target data is multimodal distribution, different peaks may represent data from different groups. Different groups need to be distinguished when performing anomaly detection, and a unified threshold cannot be used to define anomalies. The local anomaly factor (LOF) based on the density detection algorithm (i.e., the local anomaly factor algorithm) is used to detect abnormal points with local density deviations under multimodal distribution. By calculating the local density of each point and comparing the local density difference between the point and its neighbors, points with large differences are determined as outliers to obtain anomaly detection results.

[0058] If the data distribution type corresponding to multiple target data is other distributions, the IQR method (i.e., interquartile range algorithm) is used to perform anomaly detection on the multiple target data to obtain anomaly detection results.

[0059] Customized anomaly detection based on data distribution type can significantly improve the accuracy and efficiency of anomaly identification, reduce false positive rates, and enhance the adaptability of the system and the depth of problem diagnosis.

[0060] Optionally, in the abnormal data detection method provided in the embodiment of the present application, if the data distribution type is other than uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on multiple target data through the interquartile range algorithm, and the anomaly detection result obtained includes: sorting the multiple target data to obtain multiple sorted target data; calculating the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; calculating based on the first quartile and the third quartile to obtain the anomaly detection result.

[0061] In an optional embodiment, if the data distribution type corresponding to the multiple target data is other distribution, the multiple target data are sorted, and the first quartile (Q1, i.e., the point above the smallest 25% of the data) and the third quartile (Q3, i.e., the point below the largest 25% of the data) of the multiple target data are calculated. According to the third quartile and the first quartile, the target data greater than Q3+6×(Q3-Q1) and the target data less than Q1-6×(Q3-Q1) are considered as abnormal data, and the abnormal detection result is obtained.

[0062] By performing anomaly detection on multiple target data through the interquartile range algorithm, anomaly detection results corresponding to data distribution types other than uniform distribution, normal distribution and multimodal distribution can be obtained quickly and accurately.

[0063] Optionally, in the abnormal data detection method provided in the embodiment of the present application, after performing abnormality detection on multiple target data based on the data distribution type and obtaining abnormality detection results corresponding to the multiple target data, the method also includes: determining a first abnormal cause corresponding to the multiple attribute data and a second abnormal cause corresponding to the multiple association relationship data based on the abnormality detection results; determining an adjustment strategy for the target device based on the first abnormal cause and the second abnormal cause; and adjusting the target device based on the adjustment strategy.

[0064] In an optional embodiment, multiple attribute data and multiple association relationship data of the target device are diagnosed horizontally and vertically according to the abnormality detection result to obtain a first abnormality cause and a second abnormality cause. According to the first abnormality cause and the second abnormality cause, the target device is marked with a link to determine an adjustment strategy for the target device, and the target device is adjusted according to the adjustment strategy for the target device.

[0065] It should be noted that the anomaly detection results can be visualized by classification and classification, and the causes of the anomalies can be statistically summarized to generate an evaluation report. The evaluation report includes various forms of data display, such as statistical summaries, charts, and problem information. Operation and maintenance personnel can confirm each of the contents displayed in the evaluation report, and update the data evaluation report when the anomaly detection results are fixed.

[0066] Through the abnormality detection result, the first abnormality cause and the second abnormality cause can be quickly located, and then the adjustment strategy of the target device can be accurately obtained to adjust the target device.

[0067] Optionally, in the abnormal data detection method provided in the embodiment of the present application, determining multiple target data corresponding to the target device in the configuration management database includes: determining multiple first initial data corresponding to the target device in the configuration management database; processing missing values ​​in the multiple first initial data to obtain multiple second initial data; processing abnormal values ​​in the multiple second initial data to obtain multiple third initial data; formatting the multiple third initial data to obtain multiple target data.

[0068] In an optional embodiment, multiple first initial data corresponding to the system equipment are obtained through the API interface provided by the CMDB or by directly connecting to the CMDB database. For the multiple first initial data, if there is missing data or duplicate data, the data is marked and deleted to obtain multiple second initial data; if the data exceeds the normal range or contains abnormal characters, the data is marked and uniformly proofread and processed to obtain multiple third initial data; the multiple third initial data are formatted according to the target format to obtain multiple target data.

[0069] By preprocessing multiple target data, the data quality is effectively improved, laying a data foundation for subsequent anomaly detection.

[0070] It should be noted that Figure 2 Schematic diagram of an abnormal data detection method provided according to an embodiment of the present application. Figure 2 As shown, first, the attribute data and association relationship data corresponding to the target device are determined in the configuration management database, and pre-processed to obtain the target data.

[0071] Then, multiple target data are coded and mapped to obtain multiple coded data; similarity calculation is performed on any two coded data among the multiple coded data to obtain multiple similarity values, and multiple target data are analyzed and identified based on the multiple similarity values ​​to obtain data distribution types. If the data distribution type is uniform distribution, anomaly detection is performed on multiple target data through chi-square test to obtain anomaly detection results; if the data distribution type is normal distribution, anomaly detection is performed on multiple target data through Z score model to obtain anomaly detection results; if the data distribution type is multimodal distribution, anomaly detection is performed on multiple target data through local anomaly factor algorithm to obtain anomaly detection results; if the data distribution type is other distributions except uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on multiple target data through interquartile range algorithm to obtain anomaly detection results.

[0072] Finally, based on the data distribution type, anomaly detection such as horizontal diagnosis and vertical diagnosis is performed on multiple target data to obtain anomaly detection results corresponding to the multiple target data so as to process the target equipment.

[0073] The abnormal data detection method provided by the embodiment of the present application determines multiple target data corresponding to the target device in the configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and the device other than the target device in the configuration management database; the multiple target data are analyzed to obtain the data distribution type corresponding to the multiple target data; according to the data distribution type, the multiple target data are abnormally detected to obtain the abnormal detection results corresponding to the multiple target data, wherein the abnormal detection results are used to process the target device, which solves the problem that the abnormal data in the configuration management database is determined by manual means in the related art, resulting in a relatively low accuracy rate of determining the abnormal data. In summary, in this scheme, in the configuration management database, multiple target data related to the target device are first identified, and the data covers multiple attribute information of the target device and multiple association relationship data with other non-target devices in the configuration management database (i.e., devices other than the target device in the configuration management database). Then, the multiple target data are analyzed to parse the data distribution characteristics of the data. Finally, based on the data distribution characteristics, the multiple target data are abnormally detected to obtain the abnormal detection results. By collecting and analyzing multiple target data, not only the comprehensiveness of problem discovery is improved, but also the potential correlation between data is deeply explored, which helps to identify abnormal data more accurately and avoid problems that may be missed by single-dimensional analysis. At the same time, anomaly detection of multiple target data based on data distribution type greatly improves the efficiency and accuracy of data analysis, reduces the subjectivity and errors of manual participation, and thus improves the overall efficiency of data center operation and maintenance.

[0074] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0075] The embodiment of the present application also provides an abnormal data detection device. It should be noted that the abnormal data detection device of the embodiment of the present application can be used to execute the abnormal data detection method provided by the embodiment of the present application. The abnormal data detection device provided by the embodiment of the present application is introduced below.

[0076] Figure 3 is a schematic diagram of an abnormal data detection device according to an embodiment of the present application. Figure 3 As shown, the device includes: a first determination unit 301, an analysis unit 302, and a detection unit 303.

[0077] A first determining unit 301 is used to determine a plurality of target data corresponding to a target device in a configuration management database, wherein the plurality of target data includes: a plurality of attribute data of the target device and a plurality of association relationship data between the target device and devices other than the target device in the configuration management database;

[0078] An analysis unit 302 is used to analyze the multiple target data to obtain data distribution types corresponding to the multiple target data;

[0079] The detection unit 303 is used to perform anomaly detection on multiple target data according to the data distribution type, and obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

[0080] The abnormal data detection device provided by the embodiment of the present application, the first determination unit 301 determines multiple target data corresponding to the target device in the configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and the devices other than the target device in the configuration management database; the analysis unit 302 analyzes the multiple target data to obtain the data distribution type corresponding to the multiple target data; the detection unit 303 performs abnormal detection on the multiple target data according to the data distribution type to obtain the abnormal detection results corresponding to the multiple target data, wherein the abnormal detection results are used to process the target device, which solves the problem that the abnormal data in the configuration management database is determined manually in the related art, resulting in a relatively low accuracy rate of determining the abnormal data. In this scheme, in the configuration management database, firstly, multiple target data related to the target device are identified, and the data covers multiple attribute information of the target device and multiple association relationship data with other non-target devices in the configuration management database (i.e., devices other than the target device in the configuration management database). Then, the multiple target data are analyzed to parse the data distribution characteristics of the data. Finally, based on the data distribution characteristics, the multiple target data are abnormally detected to obtain the abnormal detection results. By collecting and analyzing multiple target data, not only the comprehensiveness of problem discovery is improved, but also the potential correlation between data is deeply explored, which helps to identify abnormal data more accurately and avoid problems that may be missed by single-dimensional analysis. At the same time, anomaly detection of multiple target data based on data distribution type greatly improves the efficiency and accuracy of data analysis, reduces the subjectivity and errors of manual participation, and thus improves the overall efficiency of data center operation and maintenance.

[0081] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the analysis unit includes: an encoding module, which is used to encode and map multiple target data to obtain multiple encoded data; a calculation module, which is used to calculate the similarity between the target encoded data and the encoded data other than the target encoded data in the multiple encoded data, to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; and an analysis module, which is used to analyze the multiple similarity values ​​to obtain a data distribution type.

[0082] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the calculation module includes: a first calculation submodule, used to calculate the data length of each encoded data to obtain multiple data length values; a second calculation submodule, used to calculate the Levenshtein distance between the target encoded data and the encoded data other than the target encoded data in the multiple encoded data, to obtain multiple distance values; a third calculation submodule, used to calculate based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; a fourth calculation submodule, used to calculate based on a preset value and the multiple calculation results to obtain multiple similarity values.

[0083] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the detection unit includes: a first detection module, which is used to perform anomaly detection on multiple target data through a chi-square test to obtain anomaly detection results if the data distribution type is uniform distribution; a second detection module, which is used to perform anomaly detection on multiple target data through a Z-score model to obtain anomaly detection results if the data distribution type is normal distribution; a third detection module, which is used to perform anomaly detection on multiple target data through a local anomaly factor algorithm to obtain anomaly detection results if the data distribution type is multimodal distribution; and a fourth detection module, which is used to perform anomaly detection on multiple target data through an interquartile range algorithm to obtain anomaly detection results if the data distribution type is other distributions except uniform distribution, normal distribution and multimodal distribution.

[0084] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the fourth detection module includes: a sorting submodule, used to sort multiple target data to obtain multiple sorted target data; a fifth calculation submodule, used to calculate the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; a sixth calculation submodule, used to calculate based on the first quartile and the third quartile to obtain an abnormal detection result.

[0085] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the device also includes: a second determination unit, used to perform abnormality detection on multiple target data according to the data distribution type, and after obtaining the abnormality detection results corresponding to the multiple target data, determine the first abnormal cause corresponding to the multiple attribute data and the second abnormal cause corresponding to the multiple association relationship data according to the abnormal detection results; a third determination unit, used to determine an adjustment strategy for the target device according to the first abnormal cause and the second abnormal cause; and an adjustment unit, used to adjust the target device according to the adjustment strategy.

[0086] Optionally, in the abnormal data detection device provided in the embodiment of the present application, the first determination unit includes: a determination module, used to determine multiple first initial data corresponding to the target device in the configuration management database; a first processing module, used to process missing values ​​in the multiple first initial data to obtain multiple second initial data; a second processing module, used to process abnormal values ​​in the multiple second initial data to obtain multiple third initial data; and a formatting module, used to format the multiple third initial data to obtain multiple target data.

[0087] The abnormal data detection device includes a processor and a memory. The above-mentioned first determination unit 301, analysis unit 302, detection unit 303, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize accurate detection of abnormal data.

[0088] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the abnormal data can be accurately detected by adjusting the kernel parameters.

[0089] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0090] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a method for detecting abnormal data is implemented.

[0091] An embodiment of the present invention provides a processor, which is used to run a program, wherein the abnormal data detection method is executed when the program is running.

[0092] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: determining multiple target data corresponding to a target device in a configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and devices other than the target device in the configuration management database; analyzing the multiple target data to obtain data distribution types corresponding to the multiple target data; performing anomaly detection on the multiple target data based on the data distribution type to obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

[0093] Optionally, analyzing multiple target data to obtain data distribution types corresponding to the multiple target data includes: encoding and mapping the multiple target data to obtain multiple encoded data; for the target encoded data, calculating the similarity between the target encoded data and encoded data other than the target encoded data in the multiple encoded data to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; analyzing the multiple similarity values ​​to obtain the data distribution type.

[0094] Optionally, for the target coding data, similarity calculation is performed between the target coding data and coding data other than the target coding data in the multiple coding data to obtain multiple similarity values, including: calculating the data length of each coding data to obtain multiple data length values; calculating the Levenshtein distance between the target coding data and the coding data other than the target coding data in the multiple coding data to obtain multiple distance values; calculating based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; calculating based on a preset value and the multiple calculation results to obtain multiple similarity values.

[0095] Optionally, based on the data distribution type, anomaly detection is performed on multiple target data to obtain anomaly detection results corresponding to the multiple target data, including: if the data distribution type is uniform distribution, anomaly detection is performed on the multiple target data through a chi-square test to obtain anomaly detection results; if the data distribution type is normal distribution, anomaly detection is performed on the multiple target data through a Z-score model to obtain anomaly detection results; if the data distribution type is multimodal distribution, anomaly detection is performed on the multiple target data through a local anomaly factor algorithm to obtain anomaly detection results; if the data distribution type is other distributions except uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on the multiple target data through an interquartile range algorithm to obtain anomaly detection results.

[0096] Optionally, if the data distribution type is other than uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on multiple target data using the interquartile range algorithm, and the anomaly detection result includes: sorting the multiple target data to obtain multiple sorted target data; calculating the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; calculating based on the first quartile and the third quartile to obtain the anomaly detection result.

[0097] Optionally, after performing anomaly detection on multiple target data based on the data distribution type and obtaining anomaly detection results corresponding to the multiple target data, the method also includes: determining a first abnormal cause corresponding to the multiple attribute data and a second abnormal cause corresponding to the multiple association relationship data based on the anomaly detection results; determining an adjustment strategy for the target device based on the first abnormal cause and the second abnormal cause; and adjusting the target device based on the adjustment strategy.

[0098] Optionally, determining multiple target data corresponding to the target device in the configuration management database includes: determining multiple first initial data corresponding to the target device in the configuration management database; processing missing values ​​in the multiple first initial data to obtain multiple second initial data; processing abnormal values ​​in the multiple second initial data to obtain multiple third initial data; formatting the multiple third initial data to obtain multiple target data.

[0099] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0100] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: determining multiple target data corresponding to a target device in a configuration management database, wherein the multiple target data include: multiple attribute data of the target device and multiple association relationship data between the target device and devices other than the target device in the configuration management database; analyzing the multiple target data to obtain data distribution types corresponding to the multiple target data; performing anomaly detection on the multiple target data based on the data distribution type to obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

[0101] Optionally, analyzing multiple target data to obtain data distribution types corresponding to the multiple target data includes: encoding and mapping the multiple target data to obtain multiple encoded data; for the target encoded data, calculating the similarity between the target encoded data and encoded data other than the target encoded data in the multiple encoded data to obtain multiple similarity values, wherein the target encoded data is any one of the multiple encoded data; analyzing the multiple similarity values ​​to obtain the data distribution type.

[0102] Optionally, for the target coding data, similarity calculation is performed between the target coding data and coding data other than the target coding data in the multiple coding data to obtain multiple similarity values, including: calculating the data length of each coding data to obtain multiple data length values; calculating the Levenshtein distance between the target coding data and the coding data other than the target coding data in the multiple coding data to obtain multiple distance values; calculating based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; calculating based on a preset value and the multiple calculation results to obtain multiple similarity values.

[0103] Optionally, based on the data distribution type, anomaly detection is performed on multiple target data to obtain anomaly detection results corresponding to the multiple target data, including: if the data distribution type is uniform distribution, anomaly detection is performed on the multiple target data through a chi-square test to obtain anomaly detection results; if the data distribution type is normal distribution, anomaly detection is performed on the multiple target data through a Z-score model to obtain anomaly detection results; if the data distribution type is multimodal distribution, anomaly detection is performed on the multiple target data through a local anomaly factor algorithm to obtain anomaly detection results; if the data distribution type is other distributions except uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on the multiple target data through an interquartile range algorithm to obtain anomaly detection results.

[0104] Optionally, if the data distribution type is other than uniform distribution, normal distribution and multimodal distribution, anomaly detection is performed on multiple target data using the interquartile range algorithm, and the anomaly detection result includes: sorting the multiple target data to obtain multiple sorted target data; calculating the multiple sorted target data to obtain the first quartile and the third quartile corresponding to the target data; calculating based on the first quartile and the third quartile to obtain the anomaly detection result.

[0105] Optionally, after performing anomaly detection on multiple target data based on the data distribution type and obtaining anomaly detection results corresponding to the multiple target data, the method also includes: determining a first abnormal cause corresponding to the multiple attribute data and a second abnormal cause corresponding to the multiple association relationship data based on the anomaly detection results; determining an adjustment strategy for the target device based on the first abnormal cause and the second abnormal cause; and adjusting the target device based on the adjustment strategy.

[0106] Optionally, determining multiple target data corresponding to the target device in the configuration management database includes: determining multiple first initial data corresponding to the target device in the configuration management database; processing missing values ​​in the multiple first initial data to obtain multiple second initial data; processing abnormal values ​​in the multiple second initial data to obtain multiple third initial data; formatting the multiple third initial data to obtain multiple target data.

[0107] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0108] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0111] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0112] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0113] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0114] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0116] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for detecting abnormal data, characterized in that: include: Determining a plurality of target data corresponding to the target device in the configuration management database, wherein the plurality of target data includes: a plurality of attribute data of the target device and a plurality of association relationship data between the target device and devices other than the target device in the configuration management database; Analyze the multiple target data to obtain data distribution types corresponding to the multiple target data; According to the data distribution type, anomaly detection is performed on the multiple target data to obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

2. The method according to claim 1, characterized in that Analyzing the multiple target data to obtain data distribution types corresponding to the multiple target data includes: Performing encoding mapping on the multiple target data to obtain multiple encoded data; For target coded data, similarity calculation is performed between the target coded data and coded data other than the target coded data among the plurality of coded data to obtain a plurality of similarity values, wherein the target coded data is any one of the plurality of coded data; The multiple similarity values ​​are analyzed to obtain the data distribution type.

3. The method according to claim 2, characterized in that For the target coded data, similarity calculation is performed between the target coded data and coded data other than the target coded data among the plurality of coded data, and the plurality of similarity values ​​obtained include: Calculate the data length of each encoded data to obtain multiple data length values; Calculating the Levenshtein distance between the target coded data and the coded data other than the target coded data among the plurality of coded data to obtain a plurality of distance values; Performing calculations based on the multiple distance values ​​and the multiple data length values ​​to obtain multiple calculation results; Calculation is performed according to a preset value and the plurality of calculation results to obtain the plurality of similarity values.

4. The method according to claim 1, characterized in that: According to the data distribution type, anomaly detection is performed on the multiple target data, and anomaly detection results corresponding to the multiple target data are obtained, including: If the data distribution type is uniform distribution, performing anomaly detection on the multiple target data through a chi-square test to obtain the anomaly detection result; If the data distribution type is normal distribution, anomaly detection is performed on the multiple target data using a Z-score model to obtain the anomaly detection result; If the data distribution type is multimodal distribution, anomaly detection is performed on the multiple target data using a local anomaly factor algorithm to obtain the anomaly detection result; If the data distribution type is other than the uniform distribution, the normal distribution and the multimodal distribution, anomaly detection is performed on the multiple target data using an interquartile range algorithm to obtain the anomaly detection result.

5. The method according to claim 4, characterized in that If the data distribution type is other than the uniform distribution, the normal distribution and the multimodal distribution, anomaly detection is performed on the multiple target data using an interquartile range algorithm, and the anomaly detection result obtained includes: Sorting the plurality of target data to obtain a plurality of sorted target data; Calculating the plurality of sorted target data to obtain a first quartile and a third quartile corresponding to the target data; The anomaly detection result is obtained by performing calculation according to the first quartile and the third quartile.

6. The method according to claim 1, characterized in that After performing anomaly detection on the plurality of target data according to the data distribution type to obtain anomaly detection results corresponding to the plurality of target data, the method further includes: Determine, according to the abnormality detection result, a first abnormality cause corresponding to the plurality of attribute data and a second abnormality cause corresponding to the plurality of association relationship data; Determining an adjustment strategy for the target device according to the first abnormal cause and the second abnormal cause; The target device is adjusted according to the adjustment strategy.

7. The method according to claim 1, characterized in that Determining the multiple target data corresponding to the target device in the configuration management database includes: Determining, in the configuration management database, a plurality of first initial data corresponding to the target device; Processing missing values ​​in the plurality of first initial data to obtain a plurality of second initial data; Processing the abnormal values ​​in the plurality of second initial data to obtain a plurality of third initial data; The plurality of third initial data are formatted to obtain the plurality of target data.

8. An abnormal data detection device, characterized in that: include: A first determining unit is used to determine a plurality of target data corresponding to a target device in a configuration management database, wherein the plurality of target data includes: a plurality of attribute data of the target device and a plurality of association relationship data between the target device and devices other than the target device in the configuration management database; An analyzing unit, configured to analyze the plurality of target data to obtain data distribution types corresponding to the plurality of target data; A detection unit is used to perform anomaly detection on the multiple target data according to the data distribution type, and obtain anomaly detection results corresponding to the multiple target data, wherein the anomaly detection results are used to process the target device.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the storage medium is controlled to execute the abnormal data detection method according to any one of claims 1 to 7 on a device.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal data detection method described in any one of claims 1 to 7.

Images