Business anomaly detection method and device

Abstract

One or more embodiments of the invention disclose a service anomaly detection method and device. The method comprises: according to a target service type of a to-be-detected target service, obtaining a trained initial anomaly detection model and a target service parameter set corresponding to the target service type, the initial anomaly detection model being obtained by training sample service data of at least one service type, the initial anomaly detection model comprises an anomaly detection module and a noise detection module. And generating a target anomaly detection model corresponding to the target service according to the initial anomaly detection model and the target service parameter set. And inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

Description

[0001] This invention patent application is a divisional application of the Chinese invention patent application with application number 202211457082.3, application date 2022.11.16, and name “Business Anomaly Detection Method and Device”. Technical Field

[0002] The present invention relates to the field of risk control technology, and in particular to a method and device for detecting business anomalies. Background Art

[0003] Time series anomaly detection is a basic and important function in intelligent operation and maintenance systems. It aims to automatically discover abnormal fluctuations in the time series of KPIs (Key Performance Indicators) through intelligent algorithms, thereby providing a decision-making basis for subsequent abnormal alarms, root cause location, and fault self-healing. Time series anomaly detection has always been a research hotspot in related fields, and various new algorithms have continued to emerge. However, the existing time series anomaly detection solutions have not been smooth in actual implementation and promotion. In addition to constraints such as anomaly detection effect and algorithm black box, the other most prominent problem is the poor model migration and adaptation ability. Due to different business scenarios, the judgment criteria for anomalies are different, resulting in the inability to quickly migrate models trained for one business to another. Each migration requires algorithm engineers to intervene to adjust parameters. In extreme cases, it is even necessary to accumulate samples and train new models again. Such investment is bound to be unsustainable. In the case of massive business scenarios, if each business requires algorithm engineers to adjust parameters, the time and cost spent will inevitably be unacceptable.

[0004] Therefore, there is an urgent need for a business anomaly detection method that can be adapted to a variety of business scenarios. Summary of the invention

[0005] On the one hand, one or more embodiments of the present specification provide a service anomaly detection method, comprising: according to the target service type of the target service to be detected, obtaining a trained initial anomaly detection model and a target service parameter set corresponding to the target service type, wherein the initial anomaly detection model is trained based on sample service data of at least one service type, and the initial anomaly detection model includes an anomaly detection module and a noise detection module. According to the initial anomaly detection model and the target service parameter set, a target anomaly detection model corresponding to the target service is generated. The service data of the target service is input into the target anomaly detection model to obtain an anomaly detection result corresponding to the target service.

[0006] On the other hand, one or more embodiments of the present specification provide a service anomaly detection device, including: an acquisition module, which acquires a trained initial anomaly detection model and a target service parameter set corresponding to the target service type according to a target service type of a target service to be detected, wherein the initial anomaly detection model is trained based on sample service data of at least one service type, and the initial anomaly detection model includes an anomaly detection module and a noise detection module. A generation module, which generates a target anomaly detection model corresponding to the target service according to the initial anomaly detection model and the target service parameter set. A detection module, which inputs the service data of the target service into the target anomaly detection model to obtain an anomaly detection result corresponding to the target service.

[0007] On the other hand, one or more embodiments of the present specification provide an electronic device, including a processor and a memory electrically connected to the processor, the memory storing a computer program, and the processor being used to call and execute the computer program from the memory to implement: according to the target business type of the target business to be detected, obtaining a trained initial anomaly detection model and a target business parameter set corresponding to the target business type, the initial anomaly detection model being trained based on sample business data of at least one business type, and the initial anomaly detection model including an anomaly detection module and a noise detection module. According to the initial anomaly detection model and the target business parameter set, a target anomaly detection model corresponding to the target business is generated. The business data of the target business is input into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

[0008] On the other hand, an embodiment of the present specification provides a storage medium for storing a computer program, which can be executed by a processor to implement the following process: according to the target business type of the target business to be detected, a trained initial anomaly detection model and a target business parameter set corresponding to the target business type are obtained, the initial anomaly detection model is trained based on sample business data of at least one business type, and the initial anomaly detection model includes an anomaly detection module and a noise detection module. According to the initial anomaly detection model and the target business parameter set, a target anomaly detection model corresponding to the target business is generated. The business data of the target business is input into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0010] Figure 1 is a schematic flow chart of a service anomaly detection method according to an embodiment of this specification; Figure 2 is a schematic structural diagram of an initial anomaly detection model according to an embodiment of this specification; Figure 3 is a schematic principle diagram of a service anomaly detection method according to an embodiment of this specification; Figure 4 is a schematic flow chart of a service anomaly detection method according to another embodiment of this specification; Figure 5 is a schematic block diagram of a service anomaly detection device according to an embodiment of this specification; Figure 6 It is a schematic block diagram of an electronic device according to an embodiment of the present specification. DETAILED DESCRIPTION

[0011] One or more embodiments of the present specification provide a service anomaly detection method and device to solve the problem that the existing anomaly detection methods have poor migration adaptability in various service scenarios.

[0012] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of one or more embodiments of this specification.

[0013] Figure 1 is a schematic flow chart of a method for detecting business anomalies according to an embodiment of this specification, such as Figure 1 As shown, the method includes: S102, according to the target business type of the target business to be detected, obtain a trained initial anomaly detection model and a target business parameter set corresponding to the target business type; the initial anomaly detection model is trained based on sample business data of at least one business type; the initial anomaly detection model includes an anomaly detection module and a noise detection module.

[0014] Among them, the anomaly detection module of the initial anomaly detection model is used to detect whether the business data of the target business has an abnormal phenomenon, and the noise detection module is used to detect whether the business data with an abnormal phenomenon is noise data or abnormal data.

[0015] Optionally, the business model library stores the trained initial anomaly detection model and business parameter sets corresponding to different business types. When obtaining the target business parameter set corresponding to the target business type, the target business type of the target business is first determined, and then the target business type is matched with each business type in the business model library to match the corresponding target business parameter set. That is to say, when executing step S102, the target business can be routed to the corresponding target business parameter set in the business model library according to the target business type of the target business, and the target business parameter set is used to generate a target anomaly detection model that matches the target business type.

[0016] S104: Generate a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set.

[0017] Optionally, the target business parameter set is input into the initial anomaly detection model to obtain a target anomaly detection model corresponding to the target business.

[0018] S106, inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

[0019] The method and timing of obtaining the business data are not limited. For example, the business data may be carried in an anomaly detection request before executing step S102, and the anomaly detection request is used to trigger the execution of step S102. For another example, after generating a target anomaly detection model corresponding to the target business, the business data of the target business is obtained from a business execution device corresponding to the target business (such as a server for managing business data of the target business).

[0020] In this embodiment, the service type is different based on different service scenarios, and the electronic device executing the service anomaly detection method can automatically identify the target service type of the target service to be detected. Before executing step S102, an anomaly detection request for the target service can be first received, and the anomaly detection request carries the service identification information of the target service (such as the service name, the unique number of the service, etc.). An optional way is that the electronic device can determine the target service type based on the service identification information carried in the anomaly detection request and the mapping relationship between the preset service identification information and the service category. Another optional way is that in addition to carrying the service identification information, the anomaly detection request also carries service type information for indicating the service type, and the electronic device can determine the target service type based on the service type information carried in the anomaly detection request. Another optional way is that the anomaly detection request also carries the service data of the target service, and the electronic device can determine the target service type by analyzing the service data. For example, if the target service data is analyzed to include the keyword "recharge", it can be determined that the target service type is a recharge service.

[0021] The technical solution of one or more embodiments of the present specification is adopted, by obtaining the trained initial anomaly detection model and the target business parameter set corresponding to the target business type, and generating the target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set, and then inputting the business data of the target business into the target anomaly detection model to obtain the anomaly detection result corresponding to the target business. Since the target business parameter set corresponds to the target business, that is, it has business semantics, the target anomaly detection model generated by the initial anomaly detection model and the target business parameter set can be highly adapted to the business type to which the target business belongs, so that the business data of the target business can be detected using the target anomaly detection model that is highly adapted to the business type, so that the anomaly detection result is more accurate. And in the anomaly detection process, there is no need to migrate the model for different business types, so while ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved. For ease of understanding, the following first explains how to train the initial anomaly detection model and how to determine the business parameter sets corresponding to different business types.

[0022] In one embodiment, the training process of the initial anomaly detection model may include the following steps A1-A3: Step A1: Acquire multiple sample business data of at least one business type.

[0023] Among them, each sample business data carries the business type and label information corresponding to the sample business data; the label information may include at least one of the following information: whether the sample business data has an abnormality, whether the sample business data with an abnormality is noise data, and whether the sample business data with an abnormality is abnormal data.

[0024] Whether the sample business data is abnormal refers to whether the sample business data has an abnormal phenomenon, which can usually be seen from the waveform of the data. For example, by analyzing the waveform of the sample business data, it can be determined whether the sample abnormal data has a "waveform abnormality" phenomenon. Whether the sample business data with an abnormality is noise data refers to whether the sample business data is abnormal due to noise. If so, the sample business data is noise data, and if not, the sample business data is abnormal data. Whether the sample business data with an abnormality is abnormal data is relative to the noise data. The sample business data with an abnormality can be divided into two categories, namely noise data or abnormal data.

[0025] Step A2: modularize the initial anomaly detection model to be trained to obtain an anomaly detection module to be trained and a noise detection module to be trained.

[0026] In this step, the initial anomaly detection model to be trained is modularized, and the neural network structure of the initial anomaly detection model to be trained can be split into two parts, corresponding to the anomaly detection module and the noise detection module. Alternatively, the neural network structure of the initial anomaly detection model to be trained can be copied, that is, at the beginning of model training, the anomaly detection module and the noise detection module have the same neural network structure.

[0027] The initial anomaly detection model to be trained may be any existing classification model. Through model training, the classification model may be trained to be able to classify business data into normal data (ie, data without anomalies), noise data, or anomaly data.

[0028] Step A3: input the sample business data into the anomaly detection module to be trained and the noise detection module to be trained respectively for iterative training to obtain a trained initial anomaly detection model.

[0029] In this embodiment, since the label information carried by the sample business data may include at least one of the following: whether the sample business data is abnormal, whether the sample business data is not abnormal, whether the sample business data with an abnormality belongs to noise data, whether the sample business data with an abnormality belongs to abnormal data, etc., by continuously learning the sample business data and the label information it carries, the trained initial anomaly detection model at least has the following capabilities: identifying whether the business data is abnormal, identifying whether the business data with an abnormality belongs to noise data or abnormal data. Among them, the anomaly detection module can learn the data features of the sample business data that belongs to abnormal data by continuously learning the sample business data and the label information it carries, so that the trained anomaly detection module can have the ability to identify whether the business data is abnormal. The noise detection module can learn the data features of the sample business data that belongs to noise data by continuously learning the sample business data and the label information it carries, so that the trained noise detection module can have the ability to identify whether the business data with an abnormality belongs to noise data.

[0030] Since the selected sample business data corresponds to at least one business type when training the initial anomaly detection model, and the business type varies based on different business scenarios, the trained initial anomaly detection model can be applied to business anomaly detection in different business scenarios.

[0031] In one embodiment, the trained initial anomaly detection model can be updated regularly or irregularly. Optionally, business data of different business types are collected, and label data is added to the collected business data, and the label data includes at least one of the following information: whether the sample business data is abnormal, whether the sample business data with an abnormality is noise data, and whether the sample business data with an abnormality is abnormal data. When the collected business data reaches a certain amount, the initial anomaly detection model can be updated based on the collected business data.

[0032] In one embodiment, the anomaly detection module to be trained includes anomaly detection sub-models to be trained corresponding to a plurality of anomaly types. Among the plurality of sample business data, the label information corresponding to the sample business data belonging to the anomaly data also includes: the anomaly type corresponding to the sample business data. Based on this, when the sample business data is respectively input into the anomaly detection module to be trained and the noise detection module to be trained for iterative training, the sample business data can be respectively input into each anomaly detection sub-model to be trained for iterative training to obtain the trained anomaly detection sub-models corresponding to each anomaly type.

[0033] Among them, the anomaly detection module to be trained can be pre-divided into multiple sub-modules, and each sub-module is an anomaly detection sub-model. Each anomaly detection sub-model corresponds to an anomaly type. This embodiment does not limit the number of sub-modules included in the anomaly detection module. Usually, the number of sub-modules, that is, the number of anomaly detection sub-models, is the same as the number of anomaly types included in the anomaly detection module. For example, the anomaly types include impact anomaly, slow-changing anomaly, zero drop anomaly, etc., then the anomaly detection module at least includes the anomaly detection sub-models corresponding to the three anomaly types of impact anomaly, slow-changing anomaly, and zero drop anomaly.

[0034] In one embodiment, the noise detection module to be trained includes noise detection sub-models to be trained corresponding to a plurality of noise types. Among the plurality of sample business data, the label information corresponding to the sample business data belonging to the noise data also includes: the noise type corresponding to the sample business data. Based on this, when the sample business data is respectively input into the anomaly detection module to be trained and the noise detection module to be trained for iterative training, the sample business data can be respectively input into each noise detection sub-model to be trained for iterative training to obtain the trained noise detection sub-models corresponding to each noise type.

[0035] Among them, the noise detection module to be trained can be pre-divided into multiple sub-modules, and each sub-module is a noise detection sub-model. Each noise detection sub-model corresponds to a noise type. This embodiment does not limit the number of sub-modules included in the noise detection module. Usually, the number of noise types is the same as the number of sub-modules included in the noise detection module, that is, the number of noise detection sub-models included. For example, noise types include high-rise fallback (such as the increase exceeds the business attention threshold), big promotion (such as a rapid fall after a rise caused by a big promotion), similarity (such as the waveform is similar to the history for many days), etc., then the noise detection module includes at least the noise detection sub-models corresponding to the three noise types of high-rise fallback, big promotion and similarity.

[0036] In one embodiment, if the number of sample business data is small, the initial anomaly detection model can be constructed manually in the early stage of the initial anomaly detection model training. Specifically, an anomaly detection sub-model corresponding to each anomaly type can be constructed according to the anomaly type corresponding to the sample business data, and a noise detection sub-model corresponding to each noise type can be constructed according to the noise type corresponding to the sample business data. The manual construction of the sub-model can be understood as setting the matching rules corresponding to the sub-model, that is, as long as the business data is detected to meet the corresponding matching rules, it is determined that the detected business data is abnormal, belongs to noise data, or belongs to abnormal data.

[0037] Among them, the anomaly type corresponding to the sample business data refers to the anomaly type of the sample business data where the anomaly occurs; the noise type corresponding to the sample business data refers to the noise type corresponding to the noise data if the sample business data where the anomaly occurs is noise data. Taking the anomaly detection sub-model corresponding to any anomaly type as an example, the user sets the anomaly matching rule corresponding to the anomaly detection sub-model according to the sample business data corresponding to the anomaly type. For example, one of the anomaly matching rules is set as follows: if the business data drops to zero for 1 minute, it can be determined that the business data drops to zero abnormality.

[0038] In this embodiment, even if the sample business data does not reach a certain scale, the initial anomaly detection model can be constructed manually, and the sample business data on which the initial anomaly detection model is based is closely related to the business scenario, anomaly type, noise type, etc. Therefore, it can ensure that the initial anomaly detection model can still obtain good cold start accuracy in the initial stage of construction, and can greatly reduce the investment in manpower, resources, etc. caused by model migration between different business scenarios.

[0039] Figure 2 is a schematic structural diagram of an initial anomaly detection model according to an embodiment of this specification. Figure 2 As shown, the initial anomaly detection model includes an anomaly detection module and a noise detection module. Among them, the anomaly detection module further includes anomaly detection sub-models corresponding to various anomaly types such as anomaly type A, anomaly type B, anomaly type C (more specifically, such as impact anomaly, slow-changing anomaly, drop-to-zero anomaly, etc.), and the noise detection module further includes noise detection sub-models corresponding to various noise types such as noise type D, noise type E, noise type F (more specifically, such as high-rise fallback, big promotion, similarity, etc.). The ellipsis "..." in the anomaly detection module and the noise detection module indicates that there is no limit on the number of sub-models in each module, and corresponding sub-models can be added to the anomaly detection module and / or the noise detection module according to the anomaly type and / or noise type in the actual business.

[0040] It can be seen from the above embodiments that, since the anomaly detection module and the noise detection module in the initial anomaly detection model are refined into more specific sub-modules, each sub-module corresponds to a sub-model of a type (anomaly type or noise type), each sub-model only needs to detect whether the anomaly data matches the type corresponding to the sub-model when detecting abnormal data, without having to worry about other types. For example, when detecting abnormal data, the anomaly detection sub-model corresponding to the impact anomaly only needs to detect whether the data features of the abnormal data match the features of the impact anomaly. Therefore, by refining the anomaly detection module and the noise detection module into more specific sub-modules, the difficulty of data detection of a single sub-module (i.e., a single sub-model) is greatly reduced, and when multiple sub-modules are detected in parallel, the efficiency of business data anomaly detection can also be improved.

[0041] In one embodiment, each service type corresponds to its own service parameter set, which includes a first service parameter corresponding to the anomaly detection module and / or a second service parameter corresponding to the noise detection module. Then, the trained initial anomaly detection model is stored in the service model library, and each service type and the corresponding service parameter set are stored in the service model library.

[0042] Wherein, in the case where the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types, the first business parameter includes at least one of the following: a first switch parameter for whether each anomaly detection sub-model is enabled, an anomaly alarm condition, and an anomaly duration. In the case where the noise detection module includes noise detection sub-models corresponding to a plurality of noise types, the second business parameter includes at least one of the following: a second switch parameter for whether each noise detection sub-model is enabled, and a noise alarm condition. That is to say, in the business model library, each business type corresponds to a business parameter set, and each business parameter set includes: a first business parameter corresponding to each anomaly detection sub-model in the anomaly detection module, and / or a second business parameter corresponding to each noise detection sub-model in the noise detection module.

[0043] Business parameters (first business parameters or second business parameters) are parameters used to control the switch, alarm conditions, and recognition sensitivity of the corresponding sub-model. Among them, the switch refers to whether the corresponding sub-model is enabled, the alarm condition refers to the conditions under which the corresponding sub-model issues an alarm, and the recognition sensitivity means that the corresponding sub-model can detect an anomaly after the anomaly is detected for a certain period of time. Business parameters can be set before or after training the initial anomaly detection model. Some business parameters can also be selectively set first according to the specific parameter type of the business parameters.

[0044] Optionally, for the business parameters corresponding to each sub-model (anomaly detection sub-model or noise detection sub-model), any existing method (such as Bayesian optimization, grid search, etc.) can be used for parameter optimization, that is, to find the optimal business parameter set. Specifically, for a certain business type (i.e., business scenario), construct sample business data corresponding to the business type, and the sample business data carries label information, which may include the anomaly type or noise type of the sample business data. First, set a parameter optimization target, and then based on the parameter optimization target and the sample business data, select a business parameter set that can achieve the parameter optimization target from a variety of possible business parameter sets as the business parameter set corresponding to the sub-model. Taking the anomaly detection sub-model corresponding to the impact anomaly in the anomaly detection module (abbreviated as the impact anomaly sub-model) as an example, the parameter optimization target is: the recognition sensitivity of the sub-model is 1 minute (that is, the anomaly is detected when the duration of the anomaly reaches 1 minute), then by collecting sample business data corresponding to the business type and traversing multiple business parameter sets, that is, using each business parameter set and sample business data corresponding to the business type, determine which business parameter set to use, which can make the recognition sensitivity of the impact anomaly sub-model 1 minute, then this business parameter set is the business parameter set corresponding to the impact anomaly sub-model. For other anomaly detection sub-models and each noise detection sub-module in the noise detection module, the same method is used to determine the corresponding business parameter set, which will not be repeated here.

[0045] The switch parameter in the business parameter is used to control whether the corresponding sub-model is enabled. Optionally, a switch parameter of 0 indicates that the corresponding sub-model is not enabled, and a switch parameter of 1 indicates that the corresponding sub-model is enabled. Figure 2Taking the model structure shown as an example, assuming that the service type is a recharge service, based on experience, it can be determined that the probability of a drop-to-zero anomaly in a recharge service is very low. In the service parameter set corresponding to the recharge service, the switch parameter of the anomaly detection submodel corresponding to the impact anomaly and the slow-changing anomaly is set to 1, and the switch parameter of the anomaly detection submodel corresponding to the drop-to-zero anomaly is set to 0. In this way, when the recharge service is subsequently detected, the initial anomaly detection model recognizes that the service type is a recharge service, and the service data will be routed to the service parameter set corresponding to the recharge service. The service parameter set corresponding to the recharge service and the initial anomaly detection model are used to generate a target anomaly detection model corresponding to the recharge service, and then the target anomaly detection model is used to detect the service data of the recharge service. At this time, since the switch parameter of the anomaly detection submodel corresponding to the drop-to-zero anomaly is 0, the anomaly detection submodel corresponding to the drop-to-zero anomaly is closed during the anomaly detection process, that is, the service data of the recharge service will not be detected abnormally. The advantage of this approach is that, for business data of different business types, the sub-model that matches the business type is enabled for anomaly detection in a targeted manner, while the sub-model that has a low match with the business type is turned off. This not only helps to improve the efficiency of anomaly detection, but also ensures the accuracy of anomaly detection.

[0046] The alarm conditions (including abnormal alarm conditions or noise alarm conditions) in the business parameters are used to control the circumstances under which the corresponding sub-model will alarm. Optionally, the alarm conditions are characterized by alarm thresholds. For example, the probability threshold of abnormality can be used as the alarm threshold in the abnormality detection module, and the probability threshold of noise data (or abnormal data) can be used as the alarm threshold in the noise detection module.

[0047] It can be seen that the business parameters corresponding to each sub-model have certain business semantics, which can control whether the sub-model is enabled, the alarm conditions, and the recognition sensitivity, etc. Therefore, when performing anomaly detection on the target business, the target anomaly detection model that matches the business type (or business scenario) can be directly used for anomaly detection, so that the target anomaly detection model based on the anomaly detection is highly adapted to the business type, and there is no need to migrate the model for the business type of the target business, thereby ensuring the high accuracy of the anomaly detection results while improving the anomaly detection efficiency.

[0048] Table 1 below exemplarily lists the service parameter sets corresponding to two different service types (service A and service B). As can be seen from Table 1, the service parameter sets corresponding to service A and service B respectively include service parameter sets corresponding to each sub-model.

[0049] Table 1

[0050] In this embodiment, by setting a corresponding business parameter set for each business type, including a first business parameter corresponding to the anomaly detection module and / or a second business parameter corresponding to the noise detection module, each anomaly detection submodel and / or noise detection submodel can perform anomaly detection on business data of different business types in a targeted manner, which is not only suitable for anomaly detection in various business scenarios, but also can ensure the accuracy of anomaly detection results for business data of different business types.

[0051] In one embodiment, the initial anomaly detection model includes an anomaly detection module and a noise detection module. Figure 3 is a schematic diagram of a method for detecting anomalies in a business according to an embodiment of the present specification, combined with Figure 3 When the business data of the target business is input into the target anomaly detection model to obtain the anomaly detection result corresponding to the target business, the following steps B1-B3 can be performed: Step B1: input the business data into an anomaly detection module, perform anomaly detection on the business data through the anomaly detection module, and obtain a first detection result for identifying whether an anomaly occurs in the business data.

[0052] Among them, the first detection result may include: an abnormality occurs in the business data; or, no abnormality occurs in the business data. The "abnormality occurs" mentioned here means that an abnormal phenomenon occurs in the business data, rather than determining that the business data is abnormal data. For example, if the abnormality detection module detects that the change trend graph corresponding to the business data has an abnormal fluctuation, then it can be considered that the first detection result is that the business data is abnormal, but at this time it cannot be determined that the business data is definitely abnormal data. If the first detection result is that there is no abnormality in the business data, then it can be determined that the business data is normal and no subsequent actions need to be performed.

[0053] Step B2: If the first detection result is that the business data is abnormal, the business data is input into the noise detection module, and the noise detection module performs noise detection on the business data to obtain a second detection result for identifying whether the business data is noise data.

[0054] Step B3: if the second detection result is that the business data is noise data, then determine that the business data is not abnormal data; if the second detection result is that the business data is not noise data, then determine that the business data is abnormal data.

[0055] In this embodiment, for the case where the first detection result is that the business data is abnormal, the business data is further subjected to noise detection through the noise detection module, that is, whether the abnormality is caused by noise. If the abnormality is caused by noise, it means that the business data is only noise data, not abnormal data. If the abnormality is not caused by noise, it means that the business data is abnormal data. For example, the target business is an online shopping business, and a big promotion activity may cause a sharp drop in the selling price of goods. Then the business data of the online shopping business during the big promotion is input into the abnormal detection module, and the first detection result obtained is that the business data is abnormal (that is, an abnormal phenomenon of a sharp drop in price has occurred). Then, the business data of the online shopping business during the big promotion is input into the noise detection module. The noise detection module can detect that the business data is only noise data (that is, a sharp drop in price caused by the big promotion period), not abnormal data, so the second detection result is that the business data is noise data.

[0056] It can be seen that this embodiment detects business data through the target anomaly detection model, and can realize anomaly detection and noise detection of business data in a modular manner. Compared with the previous method of only performing anomaly detection on business data in a single manner, it can improve the accuracy of business anomaly detection results and avoid mistaking noise data (such as business data anomalies caused by special environments, human operations, etc.) for abnormal data.

[0057] In one embodiment, the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types. The anomaly type is used to characterize the abnormal causes and abnormal manifestations of the abnormal data, such as impact anomaly, slow-changing anomaly, drop-to-zero anomaly, etc. Based on this, when the business data is input into the anomaly detection module, the business data can be input into each anomaly detection sub-module respectively, and the business data is subjected to anomaly detection by each anomaly detection sub-module to obtain the anomaly detection sub-results corresponding to each anomaly detection sub-module. If at least one anomaly detection sub-result is that the business data is abnormal, then the first detection result is determined to be that the business data is abnormal.

[0058] In one embodiment, the noise detection module includes noise detection sub-models corresponding to a plurality of noise types. Based on this, when the business data is input into the noise detection module and the noise detection module is used to perform noise detection on the business data, the business data can be input into each noise detection sub-model respectively, and the business data can be noise detected by each noise detection sub-model to obtain the noise detection sub-results corresponding to each noise detection sub-module respectively. If at least one noise detection sub-result is that the business data belongs to noise data, then the second detection result is determined to be that the business data belongs to noise data.

[0059] In one embodiment, when the trained initial anomaly detection model and the target business parameter set corresponding to the target business type are obtained, the target business type can be matched with the business model library to determine whether the business model library contains the business parameter set corresponding to the target business type. If it is contained, the business parameter set corresponding to the target business type is determined to be the target business parameter set. If it is not contained, the default business parameter set is determined to be the target business parameter set. The default business parameter set can be preset.

[0060] In this embodiment, if the initial anomaly detection model does not include the first anomaly detection sub-model corresponding to the first business type, the first anomaly detection sub-model corresponding to the first business type can be added to the initial anomaly detection model. Specifically, firstly, the first sample business data corresponding to the first business type is obtained, and then, the first anomaly detection sub-model to be trained is added to the initial anomaly detection model; then, the first sample business data is input into the first anomaly detection sub-module for iterative training to obtain the trained first anomaly detection sub-model, and the initial anomaly detection model is updated based on the trained first anomaly detection sub-model.

[0061] In this embodiment, sub-models not included in the initial anomaly detection model can be added at any time, so that the sub-models of each anomaly type and / or the sub-models corresponding to each noise type in the initial anomaly detection model can be quickly expanded, and during the expansion process, there is no need to retrain the initial anomaly detection model, but only to add the corresponding sub-models to the initial anomaly detection model, and perform model training separately for the sub-models to be added, without affecting the use of existing sub-models. In addition, this embodiment pre-sets a default business parameter set, so that even if the business model library does not contain a business parameter set corresponding to the target business type, the default business parameter set can be used to generate a target anomaly detection model corresponding to the target business type, and the default business parameter set can be set by technical personnel based on experience, so that the overall anomaly detection result during cold start can still ensure a certain degree of detection accuracy.

[0062] In one embodiment, for the first anomaly detection sub-model not included in the initial anomaly detection model, it can also be added by manually constructing a sub-model. Optionally, the user collects the first sample business data of the anomaly type corresponding to the first anomaly detection sub-model, and sets the anomaly matching rule corresponding to the first anomaly detection sub-model according to the anomaly type corresponding to the first sample business data, so that the first anomaly detection sub-model performs detection based on the corresponding anomaly matching rule. For the noise detection sub-model not included in the initial anomaly detection model, it can also be added by manually constructing a sub-model. The method of adding the noise detection sub-model is the same as the method of adding the anomaly detection sub-model, which will not be repeated here. It can be seen that the method of manually adding a new sub-model will not affect the operation and use of the existing sub-models of the initial anomaly detection model.

[0063] In one embodiment, each service type corresponds to its own service parameter set, which includes a first service parameter corresponding to the anomaly detection module and / or a second service parameter corresponding to the noise detection module. The first service parameter includes at least one of the following: a first switch parameter for whether each anomaly detection submodel is enabled, an anomaly alarm condition, and an anomaly duration. The second service parameter includes at least one of the following: a second switch parameter for whether each noise detection submodel is enabled, and a noise alarm condition.

[0064] Among them, in the anomaly detection module, the first business parameter corresponding to each anomaly detection submodel can be the same or different, and the first business parameter corresponding to each anomaly detection submodel can be determined based on the anomaly type corresponding to the anomaly detection submodel. For example, for business data of a certain business type, since the probability of its impact anomaly is very low, it can be determined that in the initial anomaly detection model corresponding to the business type, the first switch parameter corresponding to the impact anomaly submodel is 0 (i.e., the submodel is closed). For another example, the anomaly alarm condition corresponding to the anomaly detection submodel A is: the probability value of the business data being abnormal reaches 70%; the anomaly alarm condition corresponding to the anomaly detection submodel B is: the probability value of the business data being abnormal reaches 90%. That is, when the probability value of the anomaly detection submodel A detects that the business data is abnormal reaches 70%, it will alarm, that is, it is determined that the business data is abnormal, and when the probability value of the anomaly detection submodel B detects that the business data is abnormal, it will alarm, that is, it is determined that the business data is abnormal. By setting the same or different business parameters for each anomaly detection submodel, the anomaly detection logic of each anomaly detection submodel is matched with the corresponding anomaly type, thereby improving the accuracy of business data anomaly detection.

[0065] In the noise detection model, the second business parameter corresponding to each noise detection submodel may be the same or different, and the second business parameter corresponding to each noise detection submodel may be determined based on the noise type corresponding to the noise detection submodel. For example, the noise alarm condition in the second business parameter is characterized by the degree of abnormal deviation. For abnormal business data, when the noise detection submodel detects that the degree of abnormal deviation of the business data reaches a preset deviation threshold, the business data is determined to be abnormal data; when the noise detection submodel detects that the degree of abnormal deviation of the business data reaches a preset threshold, the business data is determined to be abnormal data. For another example, the noise alarm condition in the second business parameter is characterized by the data rise and fall rate. For abnormal business data, when the noise detection submodel detects that the data rise and fall rate of the business data is higher than the preset rate threshold, the business data is determined to be abnormal data. For another example, the noise alarm condition in the second business parameter is characterized by the data fluctuation range of the same period in history. For abnormal business data, when the noise detection submodel detects that the data fluctuation range of the business data is highly similar to the data fluctuation range of the same period in history (for example, the similarity reaches 90%), the business data is determined to be abnormal data.

[0066] It can be seen that by determining the business parameters in a targeted manner, the anomaly detection module and the noise detection module can be closely associated in the business dimension. Specifically, the business data is detected for anomalies based on the first business parameter corresponding to each anomaly detection sub-model in the anomaly detection module. If the anomaly detection result is an anomaly, the business data is input into the noise detection module, and each noise detection sub-model in the noise detection module further performs noise detection on the abnormal business data based on the corresponding second business parameter. When noise detection is performed based on the second business parameter, since the second business parameter is determined based on the corresponding noise type, the second business parameter can reveal the business semantics to a certain extent. For example, the noise alarm condition in the second business parameter can reveal the abnormal deviation degree of the business data, the data rise and fall rate, the data fluctuation range of the same period in history, etc., so that the target anomaly detection model is highly adapted to the anomaly detection and business type (i.e., business scenario) of the business data, eliminating the process of model migration for the business type. While ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved.

[0067] Figure 4 FIG. 1 is a schematic flow chart of a method for detecting a service anomaly according to an embodiment of the present specification. Figure 4 As shown, the method includes: S401, receiving an anomaly detection request for a target service, where the anomaly detection request carries service data and service type of the target service.

[0068] S402: Based on the abnormal request, the business type of the target business is matched with the business model library to determine a target business parameter set corresponding to the business type of the target business.

[0069] The business model library stores the trained initial anomaly detection model and the business parameter sets corresponding to each business type.

[0070] The initial anomaly detection model includes an anomaly detection module and a noise detection module, wherein the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types, and the noise detection module includes noise detection sub-models corresponding to a plurality of noise types. The anomaly detection module is used to detect whether an abnormal phenomenon occurs in the business data of the target business, and each anomaly detection sub-model is used to detect whether an abnormal phenomenon matching the corresponding abnormal type occurs in the business data of the target business. The noise detection module is used to detect whether the business data with abnormal phenomenon is noise data or abnormal data, and each noise detection sub-model is used to detect whether the business data of the target business is noise data matching the corresponding noise type.

[0071] Each service parameter set includes a first service parameter corresponding to the anomaly detection module and a second service parameter corresponding to the noise detection module. The first service parameter includes at least one of the following: a first switch parameter for whether each anomaly detection submodel is enabled, an anomaly alarm condition, and an anomaly duration. The second service parameter includes at least one of the following: a second switch parameter for whether each noise detection submodel is enabled, and a noise alarm condition.

[0072] S403, obtaining a trained initial anomaly detection model and a target business parameter set corresponding to the target business type from the business model library, and generating a target anomaly detection model corresponding to the target business based on the initial anomaly detection model and the target business parameter set.

[0073] Optionally, the target business parameter set is input into the initial anomaly detection model to obtain a target anomaly detection model corresponding to the target business.

[0074] S404: Input the business data of the target business into the anomaly detection module of the target anomaly detection model, perform anomaly detection on the business data through the anomaly detection module, and obtain a first detection result for identifying whether an anomaly occurs in the business data.

[0075] In this step, the business data of the target business is input into the anomaly detection module, that is, into each anomaly detection sub-model included in the anomaly detection module. Since each anomaly detection sub-model corresponds to its own switch parameter, the business data of the target business can be input into only the anomaly detection sub-model with a switch parameter of 1 (indicating that the sub-model is turned on), without having to input the anomaly detection sub-model with a switch parameter of 0 (indicating that the sub-model is not turned on).

[0076] Assuming that the business data of the target business is input into multiple anomaly detection sub-models, then the business data is subjected to anomaly detection through multiple anomaly detection sub-models, and the corresponding detection results can be obtained. If the detection result of at least one anomaly detection sub-model is that the business data is abnormal, it can be determined that the first detection result of the anomaly detection module is that the business data is abnormal.

[0077] For any of the anomaly detection sub-models, if the corresponding business parameters include an abnormal alarm condition, the anomaly detection sub-model can detect business data based on the corresponding abnormal alarm condition. For example, the abnormal alarm condition is: an alarm is triggered when the probability value of an abnormality in business data reaches 80%. Then, when the anomaly detection sub-model detects that the probability value of an abnormality in business data reaches 80%, it can be determined that the detection result is that an abnormality has occurred in the business data; when the anomaly detection sub-model detects that the probability value of an abnormality in business data does not reach 80%, it can be determined that the detection result is that no abnormality has occurred in the business data.

[0078] If the first detection result of the anomaly detection module is that an anomaly occurs in the business data, continue to execute step S405; if the first detection result of the anomaly detection module is that no anomaly occurs in the business data, execute step S407.

[0079] Optionally, if the first detection result of the anomaly detection module is that an anomaly occurs in the business data, the first detection result may also include the anomaly type of the business data anomaly, that is, which anomaly detection sub-model(s) detects that an anomaly occurs in the business data.

[0080] S405: Input the target business data into the noise detection module of the target anomaly detection model, perform noise detection on the business data through the noise detection module, and obtain a second detection result for identifying whether the business data is noise data.

[0081] In this step, the business data of the target business is input into the noise detection module, that is, into each noise detection sub-model included in the noise detection module. Since each noise detection sub-model corresponds to its own switch parameter, the business data of the target business can be input only into the noise detection sub-model with a switch parameter of 1 (indicating that the sub-model is turned on), without having to input the noise detection sub-model with a switch parameter of 0 (indicating that the sub-model is not turned on).

[0082] Assuming that the business data of the target business is input into multiple noise detection sub-models, then the business data is subjected to noise detection through multiple noise detection sub-models to obtain corresponding detection results. If the detection result of at least one noise detection sub-model is that the business data belongs to noise data, then the second detection result of the noise detection module can be determined to be that the business data belongs to noise data.

[0083] For any of the noise detection sub-models, if the corresponding business parameters include abnormal alarm conditions, the noise detection sub-model can detect business data based on the corresponding noise alarm conditions. For example, the noise alarm condition is: an alarm is triggered when the probability value of business data belonging to noise data reaches 80%. Then, when the noise detection sub-model detects that the probability value of business data belonging to noise data reaches 80%, it can be determined that the detection result is that the business data belongs to noise data; when the noise detection sub-model detects that the probability value of business data belonging to noise data does not reach 80%, it can be determined that the detection result is that the business data does not belong to noise data.

[0084] If the second detection result of the noise detection module is that the business data does not belong to noise data, continue to execute step S406; if the second detection result of the noise detection module is that the business data belongs to noise data, execute step S407.

[0085] Optionally, if the second detection result of the noise detection module is that the business data belongs to noise data, the second detection result may also include the noise type of the business data belonging to noise data, that is, which noise detection sub-model(s) detect that the business data belongs to noise data.

[0086] S406: Determine that the business data is abnormal data.

[0087] S407: Determine that the business data is not abnormal data.

[0088] In this embodiment, by obtaining the trained initial anomaly detection model and the target business parameter set corresponding to the target business type, and generating the target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set, and then inputting the business data of the target business into the target anomaly detection model, the anomaly detection result corresponding to the target business is obtained. Since the target business parameter set corresponds to the target business, that is, it has business semantics, the target anomaly detection model generated by the initial anomaly detection model and the target business parameter set can be highly adapted to the business type to which the target business belongs, so that the business data of the target business can be detected using the target anomaly detection model that is highly adapted to the business type, so that the anomaly detection result is more accurate. In addition, during the anomaly detection process, there is no need to migrate the model for different business types, so while ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved. In addition, since the target anomaly detection model includes anomaly detection sub-models corresponding to multiple anomaly types and noise detection sub-models corresponding to multiple noise types, the business data can be detected separately through each sub-model (including the anomaly detection sub-model and / or the noise detection sub-model) during the anomaly detection process, thereby making the anomaly detection results of the business data more accurate. For example, it can accurately detect what type of anomaly has occurred in the business data, whether the business data with the anomaly is anomaly data, and if the business data with the anomaly is noise data, what type of noise data it is, and so on.

[0089] In summary, specific embodiments of the present subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recorded in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing can be advantageous.

[0090] The above is a service anomaly detection method provided by one or more embodiments of this specification. Based on the same idea, one or more embodiments of this specification also provide a service anomaly detection device.

[0091] Figure 5 1 is a schematic block diagram of a service anomaly detection device provided according to one or more embodiments of this specification. Figure 5 As shown, the service anomaly detection device includes: An acquisition module 51 acquires a trained initial anomaly detection model and a target business parameter set corresponding to the target business type according to the target business type to be detected; the initial anomaly detection model is trained based on sample business data of at least one business type; the initial anomaly detection model includes an anomaly detection module and a noise detection module; A generating module 52 generates a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set; The detection module 53 inputs the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

[0092] In one embodiment, the detection module 53 includes: a first detection unit, inputting the business data into the anomaly detection module, performing anomaly detection on the business data through the anomaly detection module, and obtaining a first detection result for identifying whether an anomaly occurs in the business data; a second detection unit, if the first detection result is that the business data is abnormal, inputting the business data into the noise detection module, performing noise detection on the business data through the noise detection module, and obtaining a second detection result for identifying whether the business data is noise data; The first determination unit determines that the business data is not abnormal data if the second detection result is that the business data belongs to the noise data; and determines that the business data is abnormal data if the second detection result is that the business data does not belong to the noise data.

[0093] In one embodiment, the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types; The first detection unit inputs the business data into each of the anomaly detection sub-modules respectively, performs anomaly detection on the business data through each of the anomaly detection sub-modules, and obtains anomaly detection sub-results corresponding to each of the anomaly detection sub-modules; if at least one of the anomaly detection sub-results is that an anomaly occurs in the business data, it is determined that the first detection result is that an anomaly occurs in the business data.

[0094] In one embodiment, the noise detection module includes noise detection sub-models corresponding to a plurality of noise types; The second detection unit inputs the business data into each of the noise detection sub-models respectively, performs noise detection on the business data through each of the noise detection sub-models, and obtains noise detection sub-results corresponding to each of the noise detection sub-modules respectively; if at least one of the noise detection sub-results is that the business data belongs to the noise data, then it is determined that the second detection result is that the business data belongs to the noise data.

[0095] In one embodiment, the device further comprises: The second acquisition module acquires a plurality of sample business data of at least one business type before acquiring the initial anomaly detection model and the target business parameters corresponding to the target business type according to the target business type to be detected; each sample business data carries the business type and label information corresponding to the sample business data, and the label information includes at least one of the following information: whether the sample business data is abnormal, whether the sample business data with an abnormality is noise data, and whether the sample business data with an abnormality is abnormal data; A processing module performs modular processing on the initial anomaly detection model to be trained to obtain an anomaly detection module to be trained and a noise detection module to be trained; In the first training module, the sample business data is respectively input into the anomaly detection module to be trained and the noise detection module to be trained for iterative training to obtain the trained initial anomaly detection model.

[0096] In one embodiment, the anomaly detection module to be trained includes anomaly detection sub-models to be trained corresponding to a plurality of anomaly types respectively; among the plurality of sample business data, the label information corresponding to the sample business data belonging to the anomaly data further includes: the anomaly type corresponding to the sample business data; The first training module includes: The first training unit inputs the sample business data into each of the anomaly detection sub-models to be trained for iterative training, so as to obtain the trained anomaly detection sub-models corresponding to each of the anomaly types.

[0097] In one embodiment, the noise detection module to be trained includes noise detection sub-models to be trained corresponding to a plurality of noise types respectively; among the plurality of sample business data, the label information corresponding to the sample business data belonging to the noise data further includes: the noise type corresponding to the sample business data; The first training module includes: The second training unit inputs the sample business data into each of the noise detection sub-models to be trained for iterative training, so as to obtain the trained noise detection sub-models corresponding to each of the noise types.

[0098] In one embodiment, the apparatus further comprises: A determination module is used to determine a service parameter set corresponding to each of the service types; the service parameter set includes a first service parameter corresponding to the anomaly detection module and / or a second service parameter corresponding to the noise detection module; The storage module stores the trained initial anomaly detection model in a business model library, and stores each business type and the corresponding business parameter set in the business model library.

[0099] In one embodiment, when the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types, the first service parameter includes at least one of the following: a first switch parameter of whether each anomaly detection sub-model is enabled, an anomaly alarm condition, and an anomaly duration; In the case where the noise detection module includes noise detection sub-models corresponding to a plurality of noise types, the second service parameter includes at least one of the following: a second switch parameter for whether each of the noise detection sub-models is enabled, and a noise alarm condition.

[0100] In one embodiment, the acquisition module 51 includes: The second determination unit matches the target business type with the business model library to determine whether the business model library contains a business parameter set corresponding to the target business type; if so, the business parameter set corresponding to the target business type is determined to be the target business parameter set; if not, a default business parameter set is determined to be the target business parameter set.

[0101] In one embodiment, the apparatus further comprises: A third acquisition module, if the initial anomaly detection model does not include a first anomaly detection sub-model corresponding to the first business type, acquires first sample business data corresponding to the first business type; An adding module is used to add a first anomaly detection sub-model to be trained to the initial anomaly detection model; The second training module inputs the first sample business data into the first anomaly detection submodule for iterative training to obtain a trained first anomaly detection submodel, and updates the initial anomaly detection model based on the trained first anomaly detection submodel.

[0102] The device using one or more embodiments of the present specification obtains the trained initial anomaly detection model and the target business parameter set corresponding to the target business type, and generates a target anomaly detection model corresponding to the target business based on the initial anomaly detection model and the target business parameter set, and then inputs the business data of the target business into the target anomaly detection model to obtain the anomaly detection result corresponding to the target business. Since the target business parameter set corresponds to the target business, that is, it has business semantics, the target anomaly detection model generated by the initial anomaly detection model and the target business parameter set can be highly adapted to the business type to which the target business belongs, so that the business data of the target business can be detected using the target anomaly detection model that is highly adapted to the business type, making the anomaly detection result more accurate. In addition, during the anomaly detection process, there is no need to migrate models for different business types, so while ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved.

[0103] Those skilled in the art should understand that the above-mentioned business anomaly detection device can be used to implement the business anomaly detection method described above, and the detailed description thereof should be similar to the description of the method part above, and will not be further described here to avoid tediousness.

[0104] Based on the same idea, one or more embodiments of this specification also provide an electronic device, such as Figure 6 As shown. The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 601 and memory 602, and the memory 602 may store one or more storage applications or data. Among them, the memory 602 can be a short-term storage or a persistent storage. The application stored in the memory 602 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 601 can be configured to communicate with the memory 602 to execute a series of computer executable instructions in the memory 602 on the electronic device. The electronic device may also include one or more power supplies 603, one or more wired or wireless network interfaces 604, one or more input and output interfaces 605, and one or more keyboards 606.

[0105] Specifically in this embodiment, the electronic device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions for the electronic device, and the one or more programs are configured to be executed by one or more processors, including the following computer executable instructions: According to the target service type of the target service to be detected, a trained initial anomaly detection model and a target service parameter set corresponding to the target service type are obtained; the initial anomaly detection model is trained based on sample service data of at least one service type; the initial anomaly detection model includes an anomaly detection module and a noise detection module; Generate a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set; The business data of the target business is input into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

[0106] The technical solution of one or more embodiments of the present specification is adopted, by obtaining the trained initial anomaly detection model and the target business parameter set corresponding to the target business type, and generating the target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set, and then inputting the business data of the target business into the target anomaly detection model to obtain the anomaly detection result corresponding to the target business. Since the target business parameter set corresponds to the target business, that is, it has business semantics, the target anomaly detection model generated by the initial anomaly detection model and the target business parameter set can be highly adapted to the business type to which the target business belongs, so that the business data of the target business can be detected using the target anomaly detection model that is highly adapted to the business type, so that the anomaly detection result is more accurate. And in the anomaly detection process, there is no need to migrate the model for different business types, so while ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved.

[0107] One or more embodiments of the present specification further propose a storage medium, which stores one or more computer programs, wherein the one or more computer programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to perform each process of the above-mentioned service anomaly detection method embodiment, and are specifically used to perform: According to the target service type of the target service to be detected, a trained initial anomaly detection model and a target service parameter set corresponding to the target service type are obtained; the initial anomaly detection model is trained based on sample service data of at least one service type; the initial anomaly detection model includes an anomaly detection module and a noise detection module; Generate a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set; The business data of the target business is input into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business.

[0108] The technical solution of one or more embodiments of the present specification is adopted, by obtaining the trained initial anomaly detection model and the target business parameter set corresponding to the target business type, and generating the target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set, and then inputting the business data of the target business into the target anomaly detection model to obtain the anomaly detection result corresponding to the target business. Since the target business parameter set corresponds to the target business, that is, it has business semantics, the target anomaly detection model generated by the initial anomaly detection model and the target business parameter set can be highly adapted to the business type to which the target business belongs, so that the business data of the target business can be detected using the target anomaly detection model that is highly adapted to the business type, so that the anomaly detection result is more accurate. And in the anomaly detection process, there is no need to migrate the model for different business types, so while ensuring the high accuracy of the anomaly detection results, the efficiency of anomaly detection can also be improved.

[0109] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0110] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0111] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system, or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] One or more embodiments of this specification are described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0113] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0115] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0116] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0117] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0118] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0119] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0120] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0121] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of one or more embodiments of this specification.

Claims

1. A business anomaly detection method, comprising: According to the target service type of the target service to be detected, obtaining a trained initial anomaly detection model, and obtaining a target service parameter set corresponding to the target service type; the initial anomaly detection model is trained based on sample service data of at least one service type; The initial anomaly detection model includes an anomaly detection module and a noise detection module; Generate a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set; Inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business; The inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business includes: performing anomaly detection on the business data, and if a first detection result obtained by the anomaly detection is that an anomaly occurs in the business data, performing noise detection on the business data; If the second detection result obtained by the noise detection is that the business data is noise data, it is determined that the business data is not abnormal data.

2. According to the method of claim 1, the step of inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business comprises: Inputting the business data into the anomaly detection module, performing anomaly detection on the business data through the anomaly detection module, and obtaining a first detection result for identifying whether an anomaly occurs in the business data; If the first detection result is that the business data is abnormal, the business data is input into the noise detection module, and the noise detection module performs noise detection on the business data to obtain a second detection result for identifying whether the business data is noise data; If the second detection result is that the business data belongs to the noise data, determining that the business data is not abnormal data; If the second detection result is that the business data does not belong to the noise data, it is determined that the business data is abnormal data.

3. According to the method of claim 2, the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types; The step of inputting the business data into the anomaly detection module, performing anomaly detection on the business data by the anomaly detection module, and obtaining a first detection result for identifying whether an anomaly occurs in the business data includes: Input the business data into each of the anomaly detection submodules respectively, perform anomaly detection on the business data through each of the anomaly detection submodules, and obtain anomaly detection subresults corresponding to each of the anomaly detection submodules respectively; If at least one of the abnormality detection sub-results is that an abnormality occurs in the business data, it is determined that the first detection result is that an abnormality occurs in the business data.

4. The method according to claim 2, wherein the noise detection module comprises noise detection sub-models corresponding to a plurality of noise types; The step of inputting the service data into the noise detection module, performing noise detection on the service data by the noise detection module, and obtaining a second detection result for identifying whether the service data is noise data includes: Inputting the service data into each of the noise detection sub-models respectively, performing noise detection on the service data through each of the noise detection sub-models, and obtaining noise detection sub-results corresponding to each of the noise detection sub-modules respectively; If at least one of the noise detection sub-results indicates that the business data belongs to the noise data, then the second detection result is determined to indicate that the business data belongs to the noise data.

5. The method according to claim 1, before acquiring the initial anomaly detection model and the target business parameters corresponding to the target business type according to the target business to be detected, further comprises: Acquire a plurality of sample business data of at least one business type; Each of the sample service data carries the service type and label information corresponding to the sample service data, and the label information includes at least one of the following information: whether the sample service data is abnormal, whether the sample service data with an abnormality is noise data, and whether the sample service data with an abnormality is abnormal data; Modularize the initial anomaly detection model to be trained to obtain an anomaly detection module to be trained and a noise detection module to be trained; The sample business data is respectively input into the anomaly detection module to be trained and the noise detection module to be trained for iterative training to obtain the trained initial anomaly detection model.

6. According to the method of claim 5, the anomaly detection module to be trained comprises anomaly detection sub-models to be trained corresponding to a plurality of anomaly types respectively; Among the plurality of sample business data, the label information corresponding to the sample business data belonging to the abnormal data further includes: the abnormal type corresponding to the sample business data; The step of inputting the sample business data into the anomaly detection module to be trained and the noise detection module to be trained respectively for iterative training to obtain the trained initial anomaly detection model comprises: The sample business data is respectively input into each of the anomaly detection sub-models to be trained for iterative training, so as to obtain the trained anomaly detection sub-models corresponding to each of the anomaly types.

7. The method according to claim 5, wherein the noise detection module to be trained comprises noise detection sub-models to be trained corresponding to a plurality of noise types respectively; Among the plurality of sample service data, the label information corresponding to the sample service data belonging to the noise data further includes: the noise type corresponding to the sample service data; The step of inputting the sample business data into the anomaly detection module to be trained and the noise detection module to be trained respectively for iterative training to obtain the trained initial anomaly detection model comprises: The sample business data is respectively input into each of the noise detection sub-models to be trained for iterative training, so as to obtain the trained noise detection sub-models corresponding to each of the noise types.

8. The method according to claim 5, further comprising: Determine a service parameter set corresponding to each of the service types; the service parameter set includes a first service parameter corresponding to the anomaly detection module and / or a second service parameter corresponding to the noise detection module; The trained initial anomaly detection model is stored in a business model library, and each business type and the corresponding business parameter set are stored in the business model library.

9. According to the method of claim 8, when the anomaly detection module includes anomaly detection sub-models corresponding to a plurality of anomaly types, the first service parameter includes at least one of the following: a first switch parameter of whether each anomaly detection sub-model is enabled, an anomaly alarm condition, and an anomaly duration; In the case where the noise detection module includes noise detection sub-models corresponding to a plurality of noise types, the second service parameter includes at least one of the following: a second switch parameter for whether each of the noise detection sub-models is enabled, and a noise alarm condition.

10. The method according to claim 8, wherein the step of obtaining a trained initial anomaly detection model and a target service parameter set corresponding to the target service type according to the target service to be detected comprises: Matching the target business type with the business model library to determine whether the business model library contains a business parameter set corresponding to the target business type; If yes, determining the service parameter set corresponding to the target service type as the target service parameter set; If not, the default service parameter set is determined to be the target service parameter set.

11. The method according to claim 3, further comprising: If the initial anomaly detection model does not include a first anomaly detection sub-model corresponding to the first business type, obtaining first sample business data corresponding to the first business type; Adding a first anomaly detection sub-model to be trained to the initial anomaly detection model; The first sample business data is input into the first anomaly detection submodule for iterative training to obtain a trained first anomaly detection submodel, and the initial anomaly detection model is updated based on the trained first anomaly detection submodel.

12. A service anomaly detection device, comprising: An acquisition module, which acquires a trained initial anomaly detection model according to a target business type of a target business to be detected, and acquires a target business parameter set corresponding to the target business type; the initial anomaly detection model is trained based on sample business data of at least one business type; The initial anomaly detection model includes an anomaly detection module and a noise detection module; A generation module, which generates a target anomaly detection model corresponding to the target business according to the initial anomaly detection model and the target business parameter set; A detection module, inputting the business data of the target business into the target anomaly detection model to obtain an anomaly detection result corresponding to the target business; The detection module performs anomaly detection on the business data, and if a first detection result obtained by the anomaly detection is that the business data is abnormal, performs noise detection on the business data; If the second detection result obtained by the noise detection is that the business data is noise data, it is determined that the business data is not abnormal data.

13. The device according to claim 12, wherein the detection module comprises: a first detection unit, inputting the business data into the anomaly detection module, performing anomaly detection on the business data through the anomaly detection module, and obtaining a first detection result for identifying whether an anomaly occurs in the business data; a second detection unit, if the first detection result is that the business data is abnormal, inputting the business data into the noise detection module, performing noise detection on the business data through the noise detection module, and obtaining a second detection result for identifying whether the business data is noise data; a first determining unit, which determines that the business data is not abnormal data if the second detection result is that the business data belongs to the noise data; If the second detection result is that the business data does not belong to the noise data, it is determined that the business data is abnormal data.

14. The device according to claim 13, wherein the anomaly detection module comprises anomaly detection sub-models corresponding to a plurality of anomaly types; The first detection unit inputs the business data into each of the anomaly detection sub-modules respectively, performs anomaly detection on the business data through each of the anomaly detection sub-modules, and obtains anomaly detection sub-results corresponding to each of the anomaly detection sub-modules; if at least one of the anomaly detection sub-results is that an anomaly occurs in the business data, it is determined that the first detection result is that an anomaly occurs in the business data.

15. The device according to claim 13, wherein the noise detection module comprises noise detection sub-models corresponding to a plurality of noise types respectively; The second detection unit inputs the business data into each of the noise detection sub-models respectively, performs noise detection on the business data through each of the noise detection sub-models, and obtains noise detection sub-results corresponding to each of the noise detection sub-modules respectively; if at least one of the noise detection sub-results is that the business data belongs to the noise data, then it is determined that the second detection result is that the business data belongs to the noise data.

16. An electronic device, comprising a processor and a memory electrically connected to the processor, the memory storing a computer program, and the processor being configured to call and execute the computer program from the memory to implement the service anomaly detection method according to any one of claims 1 to 11.

17. A storage medium for storing a computer program, wherein the computer program can be executed by a processor to implement the service anomaly detection method according to any one of claims 1 to 11.

Images