Data processing method and device, medium, electronic equipment and computer program product

Abstract

The invention discloses a data processing method and device, a medium, electronic equipment and a computer program product, and relates to the field of data processing technologies, text generation technologies, large model technologies and large language model technologies. The method comprises the following steps: acquiring to-be-detected time sequence data; feature information of the time sequence data is determined, and the feature information comprises period information of the time sequence data; based on the time series data and the feature information, determining a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm; and performing anomaly detection on the time series data based on the processing algorithm and the processing parameters. Therefore, automatic identification and detection of the periodic features of the time series data can be realized, and the time series data and the feature information are combined to automatically determine the processing algorithm and the processing parameters, so that the workload of manual intervention and parameter adjustment is reduced, and the efficiency of anomaly detection is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a data processing method, device, medium, electronic device and computer program product. Background Art

[0002] With the development of computer technology, information can be stored in the form of time series data. Anomaly detection of time series data is a very important task. For example, in business monitoring scenarios, it is possible to determine whether there are anomalies in business processing by analyzing time series data. In related technologies, time series data usually has a variety of forms, such as different periodic characteristics. It is necessary to rely on manual verification of the characteristics of time series data to ensure the accuracy of data analysis, which is time-consuming and inefficient. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a data processing method, the method comprising: Obtain the time series data to be detected; Determining characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; Based on the time series data and the feature information, determining a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm; Anomaly detection is performed on the time series data based on the processing algorithm and the processing parameters.

[0005] In a second aspect, the present disclosure provides a data processing device, the device comprising: An acquisition module is used to acquire the time series data to be detected; A first determining module, configured to determine characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; A second determination module, used to determine a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm based on the time series data and the feature information; A detection module is used to perform anomaly detection on the time series data based on the processing algorithm and the processing parameters.

[0006] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the steps of the method described in the first aspect when the computer program is executed by a processing device.

[0007] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the first aspect.

[0008] In a fifth aspect, the present disclosure provides a computer program product, including a computer program, which implements the steps of the method described in the first aspect when executed by a processor.

[0009] Therefore, through the above technical solution, the time series data can be analyzed to obtain its characteristic information, realize the automatic identification and detection of the periodic characteristics of the time series data, and the processing algorithm and processing parameters can be automatically determined in combination with the time series data and the characteristic information, reducing the workload of manual intervention and parameter adjustment, thereby effectively improving the efficiency of anomaly detection of time series data. Moreover, in the above scheme, the periodic information of the time series data can be automatically detected without manual calibration and configuration, avoiding the difference in detection results due to different user configuration parameters, and improving the accuracy of the detection results of anomaly detection of time series data. In addition, by automatically determining the processing algorithm and processing parameters, there is no need for the user to configure, reducing the technical requirements for the user, and broadening the scope of application of the method disclosed in the present invention.

[0010] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 It is a flowchart of a data processing method provided according to an embodiment of the present disclosure.

[0012] Figure 2 It is a block diagram of a data processing device provided according to an embodiment of the present disclosure.

[0013] Figure 3 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0014] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0015] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0016] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0017] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0018] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0019] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0020] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0021] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0022] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0023] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0024] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0025] In order to achieve effective analysis of time series data, time series anomaly detection algorithms such as Holtwinter and Prophet can be used in related technologies. After research, the applicant found that the Holtwinter algorithm is a time series prediction method based on exponential smoothing, which can capture the trend and seasonal characteristics in the data. The algorithm predicts future values ​​by weighted averaging historical data, and detects anomalies by calculating the difference between the predicted value and the actual value. However, the effect of the algorithm is highly dependent on the accuracy of its parameter settings, such as smoothing parameters, trend parameters, and seasonal parameters. Different parameter settings will lead to significant differences in prediction results. The Prophet algorithm is suitable for the analysis of time series data with obvious seasonal and trend characteristics, and its detection effect is also highly dependent on parameter settings, such as trend change points, seasonal cycles, and holiday effects. Therefore, when performing anomaly detection through the above algorithm, users are usually required to select the algorithm and adjust the parameter settings to ensure the detection effect.

[0026] In actual application scenarios, different time series data usually have different sequence characteristics, such as periodic characteristics. Therefore, when performing anomaly detection on time series data based on the above algorithm, users are required to manually tune parameters, which is a time-consuming process. The results of anomaly detection also depend on the accuracy of the user's parameter tuning, which places high technical requirements on the user. Based on this, the present disclosure provides the following embodiments to improve the efficiency and accuracy of data processing.

[0027] Figure 1 As shown, it is a flow chart of a data processing method provided according to an embodiment of the present disclosure. Figure 1 As shown, the method may include: In step 11, the time series data to be detected is obtained.

[0028] Among them, time series data refers to a series of values ​​of the same indicator arranged in the order of their occurrence, such as time series data in the performance monitoring scenario of the device, such as time series data of CPU usage, and indicators such as GMV (Gross Merchandise Volume) and DAU (Daily Active User) in the sales scenario. Analysis of time series data can be used to predict the future based on existing historical data. Depending on the observation time, the time granularity in time series data can be years, quarters, months, or any other time form, which can be set based on the actual application scenario.

[0029] In step 12, characteristic information of the time series data is determined, wherein the characteristic information includes period information of the time series data.

[0030] Wherein, the periodic information is used to represent the periodic characteristics of the time series data, such as annual cycle, monthly cycle, weekly cycle, daily cycle, hourly cycle, etc. The same time series data may contain one or more periodic characteristics, and the period contained in the periodic information may be one or more. If the time series data reflects similar characteristics in each week and similar characteristics in each month, the periodic information of the time series data is a monthly cycle and a weekly cycle. In this embodiment, the time series can be periodically identified and detected to determine the periodic information of the time series data.

[0031] In step 13, based on the time series data and the feature information, a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm are determined.

[0032] For example, multiple algorithms for anomaly detection can be pre-set. In this step, analysis can be performed based on time series data and feature information to automatically determine the processing algorithm and its processing parameters by selecting from the multiple algorithms, thereby realizing prediction of the processing algorithm and processing parameters without the need for the user to manually select the algorithm and tune the parameters.

[0033] In step 14, anomaly detection is performed on the time series data based on the processing algorithm and processing parameters.

[0034] For example, if the processing algorithm determined by step 13 is Prophet, then the time series data can be detected for anomalies based on the processing logic of the Prophet algorithm in the art in combination with the determined processing parameters to obtain the detection result of the time series data. The specific processing logic of the processing algorithm can be implemented based on the general logic in the art, and the present disclosure is not limited to this.

[0035] Therefore, through the above technical solution, the time series data can be analyzed to obtain its characteristic information, realize the automatic identification and detection of the periodic characteristics of the time series data, and the processing algorithm and processing parameters can be automatically determined in combination with the time series data and the characteristic information, reducing the workload of manual intervention and parameter adjustment, thereby effectively improving the efficiency of anomaly detection of time series data. Moreover, in the above scheme, the periodic information of the time series data can be automatically detected without manual calibration and configuration, avoiding the difference in detection results due to different user configuration parameters, and improving the accuracy of the detection results of anomaly detection of time series data. In addition, by automatically determining the processing algorithm and processing parameters, there is no need for the user to configure, reducing the technical requirements for the user, and broadening the scope of application of the method disclosed in the present invention.

[0036] In some embodiments, determining the characteristic information of the time series data may include: A stationarity test is performed on the time series data.

[0037] Among them, the ADF (Augmented Dickey Fuller) test algorithm can be used to test the stability of time series data. The ADF test is used to test whether there is a unit root in the time series data. If the unit root exists, it means that the time series data is not stable. If the unit root does not exist, it means that the time series data is stable. Among them, the implementation of the ADF detection algorithm can be based on the general algorithm in this field, which will not be repeated here.

[0038] If it is determined that the time series data is stationary, then the autocorrelation coefficient of the time series data at the candidate lag period is determined.

[0039] Among them, the autocorrelation calculation is used to analyze the periodicity of time series data. By calculating the correlation between the current sequence and itself at different lag times, it is possible to find out whether the data has repeated periodic behavior within a certain time interval. The lag period is used to represent the time difference between the current sequence and a lagged version of itself in the autocorrelation calculation. The lag period can be used to represent the displacement between the two sequences. As an example, multiple lag periods can be pre-set based on possible periodic characteristics. The lag period is year, quarter, month, week, day, hour, etc., and the preset multiple lag periods can be used as candidate lag periods.

[0040] Determining the autocorrelation coefficient of the time series data at the candidate lag period may be to calculate the similarity between each point in the time series data and the previous lag points. If the time granularity of the time series data is day, that is, the time series data is the data of the detection indicator on each day, if the candidate lag period is determined to be week (7 days), then the similarity between each point i in the time series data and the data of point i-7 may be calculated.

[0041] As another example, the candidate lag period is determined by: The time granularity of the time series data and the time length of the time series data are determined.

[0042] The time granularity of the time series data is used to represent the time interval between the time points corresponding to adjacent data in the time series data. For example, if the time series data is the daily data of the indicator, the time granularity is day; if the time series data is the weekly data of the indicator, the time granularity is week.

[0043] The time length of time series data is used to indicate the number of time points contained in the time series data. It can be the time range covered by the time series data. For example, if the time series data is the daily data of the indicator within two months, its time granularity is day and the time length is 2 months.

[0044] The candidate lag period is determined from a plurality of preset lag periods according to the time granularity and the time length.

[0045] Time series data with different time granularities and time lengths have different periodicities, and the possible periods in the time series data can be determined based on the time granularity and time length.

[0046] The time granularity of the time series data determines the minimum period that can be detected. If the time granularity of the time series data is a certain unit, then the period less than or equal to the unit cannot be identified in the time series data, for example: If the time granularity of the time series data is weekly, it cannot identify weekly cycles, daily cycles, and hourly cycles; If the time granularity of time series data is daily, it cannot identify daily cycles or hourly cycles.

[0047] From the above, it can be known that the lag period that is larger than the time granularity of the time series data among the preset multiple lag periods can be used as the first lag period.

[0048] The time granularity of the time series data determines the maximum period that can be detected. The time length of the time series data contains at least two periods to be identified, that is, the length of the time series data is at least twice the period to be identified, so as to identify recurring features. For example: If the period to be identified is an annual period, the time length of the time series data must be at least 2 years; If the period to be identified is a quarterly period, the time length of the time series data must be at least 2 quarters; If the cycle to be identified is a monthly cycle, the time length of the time series data must be at least 2 months; If the period to be identified is a daily period, the time length of the time series data must be at least 2 days; If the period to be identified is an hourly period, the time length of the time series data must be at least 2 hours.

[0049] From the above, we can see that if the time length of the time series data is greater than or equal to twice the lag period, the lag period will be taken as the second lag period.

[0050] Furthermore, the union of the first lag period and the second lag period can be used as a candidate lag period, and then the correlation coefficient can be calculated based on the candidate lag period, avoiding the waste of computing resources caused by correlation calculation for unnecessary lag periods, and comprehensively determining the various periodic characteristics in the time series data, providing effective data support for the accuracy of determining periodic information.

[0051] Further, after determining the period information of the time series data based on the autocorrelation coefficient, the period information of the time series data is determined.

[0052] Therefore, through the above technical scheme, the various periodic characteristics that may exist in the time series data can be extracted by performing autocorrelation calculations on the time series data based on a variety of possible lag periods, thereby ensuring the comprehensiveness of the periodic information extraction and providing a more comprehensive and accurate data reference for subsequent algorithm selection and parameter determination.

[0053] In some embodiments, determining the period information of the time series data based on the autocorrelation coefficient includes: If there is an autocorrelation coefficient greater than the correlation threshold, the lag period corresponding to the autocorrelation coefficient is determined as the period information of the time series data.

[0054] Among them, the correlation threshold can be set based on the actual application scenario, such as the upper limit of the 95% confidence interval can be used as the correlation threshold. If the autocorrelation coefficient is greater than the correlation threshold, it means that the data has a similar change trend at the lag time point of the lag period. At this time, the time series data can be considered to have periodicity, and the duration of the lag period is the period. If the autocorrelation coefficient of the lag period is month and week exceeds the correlation threshold, it can be considered that the time series data has periodicity, and the periods it contains are weekly and monthly cycles.

[0055] Therefore, based on the autocorrelation coefficient, the cycles in the time series data can be quickly and comprehensively identified, and comprehensive and effective identification of cycle information can be achieved without the need for users to perform fine identification. At the same time, it can also avoid the omission of multi-cycle sequences in manual identification and improve the accuracy and efficiency of cycle information identification.

[0056] In some embodiments, determining the characteristic information of the time series data may further include: If it is determined that the time series data is not stationary, differential processing is performed on the time series data to obtain differential series data.

[0057] As mentioned above, if the ADF test determines that the time series data has a unit root, it means that the time series data is not stationary. At this time, the time series data can be differentiated to eliminate the trend. As an example, a new time series data, namely the differential series data, can be obtained by first-order difference processing, such as calculating the difference between adjacent data points in the time series data.

[0058] The differential series data is used as new time series data, and the step of performing a stationarity test on the time series data is returned to.

[0059] Furthermore, the difference sequence data can be used as new time series data to perform an ADF test to determine whether the data is stable. If the data is determined to be stable, periodic information can be extracted based on the data. If the data is determined to be unsteady, differential processing can be performed again to obtain difference sequence data, and a stability test can be performed here until stable time series data is obtained.

[0060] Therefore, through the above technical solution, multiple differential processing and stationarity tests are performed to ensure that the time series data reaches a stable state, thereby improving the accuracy of subsequent period information extraction.

[0061] In some embodiments, the feature information further includes a signal-to-noise ratio of the time series data; Accordingly, the determining the characteristic information of the time series data may include: The time series data is converted into a frequency domain to obtain a power spectrum density of the time series data in the frequency domain.

[0062] Among them, the fast Fourier transform (FFT) can be used to convert the time series data in the time domain into the frequency domain. Furthermore, the result of the fast Fourier transform can be squared to realize the calculation of the power spectral density (PSD). Among them, the calculation formula of the power spectral density is the existing technology and will not be repeated here.

[0063] Based on the power spectral density, a signal power spectrum and a noise power spectrum are determined.

[0064] Among them, after converting the time series data to the frequency domain, the frequency of the signal part is usually low, and the signal of the noise part is usually high. Then, the ratio threshold can be pre-set based on the actual application scenario, and the low-frequency part of the frequency before the ratio threshold in the power spectrum density can be considered as the signal power spectrum, and the remaining part is the noise power spectrum. If the ratio threshold is set to 2 / 3, in this embodiment, the low-frequency part of the first 2 / 3 of the spectrum is the signal power spectrum, and the high-frequency part of the last 1 / 3 is the noise power spectrum.

[0065] A signal-to-noise ratio of the time series data is determined based on the signal power spectrum and the noise power spectrum.

[0066] As an example, the sum of the powers corresponding to the signal power spectrum can be calculated, recorded as P_signal, and the sum of the powers corresponding to the noise power spectrum can be calculated, recorded as P_noise. Then the signal-to-noise ratio (SNR) can be expressed as: SNR = P_signal / P_noise.

[0067] Among them, the signal-to-noise ratio characteristics of different time series data are different. When performing anomaly detection on time series data, it is necessary to set parameters based on the characteristics of the data. Therefore, through the above technical solution, the signal-to-noise ratio characteristics can be determined based on the time series data, and then the signal-to-noise ratio can be combined when determining the processing algorithm and processing parameters in the subsequent determination, thereby improving the diversity and comprehensiveness of the reference data when determining the processing algorithm and processing parameters, thereby improving the accuracy of determining the processing algorithm and processing parameters, and improving the accuracy of anomaly detection.

[0068] In some embodiments, the feature information further includes statistical information and / or sequence information of the time series data; The statistical information includes at least one of the following: mean, median, standard deviation, kurtosis, skewness, maximum value, minimum value, and quantile of the time series data. The selection of quantile can be pre-set based on the actual application scenario, such as 1 / 4 quantile, 3 / 4 quantile, etc. The above statistical information can be determined based on each data in the time series data based on a common statistical technique, which will not be repeated here.

[0069] The sequence information includes at least one of the following: time granularity, time length, and data missing rate of the time series data.

[0070] The determination method of time granularity and time length has been described above. In particular, due to data corruption, data generation, storage and data transmission process, the anomalies may cause data missing in the time series, and the data missing rate is used to represent the proportion of missing data in the time series data. In particular, the number of theoretical data points of the time series data can be determined based on the time length and time granularity. For example, if the time length is 30 days and the time granularity is daily granularity, the number of theoretical data points is 30. Based on the time series data, the actual number of data points is obtained. If it is 27, the number of theoretical data points minus the actual number of data points can be used as the number of missing data (that is, 3). The data missing rate can be the ratio of the number of missing data to the number of theoretical data points, that is, 0.1 (3 / 30).

[0071] Therefore, through the above technical solution, the features in the time series data can be further extracted, the information diversity and comprehensiveness in the feature information can be increased, and effective data support can be provided for the subsequent determination of processing algorithms and processing parameters.

[0072] In some embodiments, the processing algorithm includes a baseline algorithm and / or a detection algorithm.

[0073] The main task of the baseline algorithm is to determine the baseline of the time series data, that is, the basic trend or pattern that the time series data should follow under normal circumstances. The baseline algorithm extracts the internal structure and regularity of the time series data through in-depth analysis and modeling, thereby forming a baseline. This baseline can be regarded as the "normal" state of the time series data, which provides a reference standard for subsequent anomaly detection.

[0074] The detection algorithm is used to further determine the normal range of time series data based on the baseline algorithm, that is, within a certain range above and below the baseline. By calculating and setting this normal range, the detection algorithm can clearly define the normal interval and abnormal interval of time series data. When the time series data exceeds this normal range, that is, exceeds a certain range above and below the baseline, the detection algorithm will mark it as abnormal.

[0075] Accordingly, the determining, based on the time series data and the feature information, a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm includes: The time series data and the feature information are input into an algorithm prediction model so that the algorithm prediction model determines the processing algorithm and processing parameters of the processing algorithm from a plurality of candidate algorithms.

[0076] The algorithm prediction model can be implemented based on a large language model (LLM), a natural language model based on deep learning, etc. In this step, prompt text can be constructed through time series data and sequence algorithms and the prompt text can be input into the algorithm prediction model, so that the algorithm prediction model can select and configure according to the time series data and feature information to determine the baseline algorithm and detection algorithm suitable for the time series data and their respective required processing parameters.

[0077] As an example, an optional baseline algorithm and a detection algorithm may be pre-set in the algorithm prediction model to obtain a plurality of candidate algorithms, so that the algorithm prediction model may select from the corresponding algorithms. For example, the preset baseline algorithm may include baseline algorithms commonly used in the art, such as multiple algorithms in ARIMA, SARIMA, Prophet, and Holt-Winters. The detection algorithm may include detection algorithms commonly used in the art, such as 3-Sigma, ARCH, etc. Among them, the above-mentioned baseline algorithm and detection algorithm are exemplary descriptions, which can be set based on actual application scenarios, and the algorithm that can realize the corresponding baseline determination and normal range determination is sufficient, and the present disclosure does not limit this.

[0078] For another example, in order to further improve the flexibility of processing algorithm selection, multiple optional candidate algorithms can be input in the prompt text, such as the exemplary prompt text prompt as follows: Given the following information about a time series dataset, pleasesuggest an appropriate baseline algorithm with its parameters and a detectionalgorithm with its parameters for anomaly detection. The output should be in a structured JSON format. 1. The time series has a yearly cycle, a monthly cycle, and a dailycycle. 2. The signal-to-noise ratio of the time series is 0.8. 3. The basic statistical measures of the time series are as follows: mean = 100, standard deviation = 15, skewness = 0.5, kurtosis = 3. 4. The basic information about the time series is as follows: length= 10000, granularity = 1 hour. The options for the baseline algorithm are: SARIMA, Prophet, Holt‐Winters. The options for the detection algorithm are: 3-Sigma, ARCH. Based on this information, please provide a JSON output that includes the most suitable baseline algorithm and detection algorithm for anomalydetection in this time series data, along with the parameters for each algorithm. In this example, the above prompt text can be input into the algorithm prediction model so that the algorithm prediction model can analyze the provided cycle information (a yearly cycle, a monthly cycle, and a daily cycle), signal-to-noise ratio (signal-to-noise ratio of the time series is 0.8), statistical information (mean = 100, standard deviation = 15, skewness = 0.5, kurtosis = 3), sequence information (length = 10000, granularity = 1 hour) and time series data to select one from the baseline algorithms SARIMA, Prophet and Holt-Winters and determine its processing parameters, and select one from the detection algorithms 3-Sigma and ARCH and determine its processing parameters.

[0079] As an example, the output of the algorithm prediction model is as follows: json { "baseline_algorithm": { "name": "SARIMA", "parameters": { "order": [1, 0, 1], "seasonal_order": [1, 1, 1, 24], "seasonal_order_yearly": [1, 1, 1, 8760] } }, "detection_algorithm": { "name": "3-Sigma", "parameters": { "threshold": 3 } } } Based on this output, we can determine that the selected baseline algorithm is SARIMA, and its corresponding processing parameters are ""order": [1, 0, 1], "seasonal_order": [1, 1, 1, 24], "seasonal_order_yearly":[1, 1, 1, 8760]", and the selected detection algorithm is 3-Sigma, and its corresponding processing parameter is ""threshold": 3".

[0080] Therefore, through the above technical solution, the processing algorithm and processing parameters can be determined based on the time series data and its characteristic information and the algorithm prediction model, reducing the manual workload required for algorithm selection and parameter configuration, and improving the efficiency of time series data anomaly detection. At the same time, it can also avoid the deviation that may be caused by manual parameter configuration and improve the accuracy of time series data anomaly detection.

[0081] Based on the same inventive concept, the present disclosure also provides a data processing device, such as Figure 2 As shown, the device 10 comprises: An acquisition module 100 is used to acquire time series data to be detected; A first determination module 200, configured to determine characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; A second determination module 300, for determining a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm based on the time series data and the feature information; The detection module 400 is used to perform anomaly detection on the time series data based on the processing algorithm and the processing parameters.

[0082] Optionally, the first determining module includes: A first processing submodule, used for performing a stationarity test on the time series data; A first determination submodule, for determining an autocorrelation coefficient of the time series data at a candidate lag period if it is determined that the time series data is stationary; The second determining submodule is used to determine the period information of the time series data based on the autocorrelation coefficient.

[0083] Optionally, the second determining submodule is further used for: If there is an autocorrelation coefficient greater than the correlation threshold, the lag period corresponding to the autocorrelation coefficient is determined as the period information of the time series data.

[0084] Optionally, the first determining module further includes: The second processing submodule is used to perform differential processing on the time series data to obtain differential series data if it is determined that the time series data is not stationary; and use the differential series data as new time series data, and trigger the first processing submodule to perform a stationarity test on the time series data.

[0085] Optionally, the candidate lag period is determined by: Determining the time granularity of the time series data and the time length of the time series data; The candidate lag period is determined from a plurality of preset lag periods according to the time granularity and the time length.

[0086] Optionally, the characteristic information further includes a signal-to-noise ratio of the time series data; The first determining module comprises: A third processing submodule is used to perform frequency domain conversion on the time series data to obtain the power spectrum density of the time series data in the frequency domain; A third determination submodule, configured to determine a signal power spectrum and a noise power spectrum based on the power spectrum density; The fourth determination submodule is used to determine the signal-to-noise ratio of the time series data based on the signal power spectrum and the noise power spectrum.

[0087] Optionally, the feature information further includes statistical information and / or sequence information of the time series data; The statistical information includes at least one of the following: mean, median, standard deviation, kurtosis, skewness, maximum value, minimum value, and quantile of the time series data; The sequence information includes at least one of the following: time granularity, time length, and data missing rate of the time series data.

[0088] Optionally, the processing algorithm comprises a baseline algorithm and / or a detection algorithm; The second determining module is further used for: The time series data and the feature information are input into an algorithm prediction model so that the algorithm prediction model determines the processing algorithm and processing parameters of the processing algorithm from a plurality of candidate algorithms.

[0089] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device (such as a terminal device or a server) 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0090] like Figure 3 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0091] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0092] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0093] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0094] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0095] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0096] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the time series data to be detected; determines the characteristic information of the time series data, wherein the characteristic information includes the periodic information of the time series data; determines the processing algorithm and processing parameters of the processing algorithm for performing anomaly detection on the time series data based on the time series data and the characteristic information; and performs anomaly detection on the time series data based on the processing algorithm and the processing parameters.

[0097] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0098] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0099] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, an acquisition module may also be described as a "module for acquiring time series data to be detected."

[0100] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0101] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] According to one or more embodiments of the present disclosure, Example 1 provides a data processing method, the method comprising: Obtain the time series data to be detected; Determining characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; Based on the time series data and the feature information, determining a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm; Anomaly detection is performed on the time series data based on the processing algorithm and the processing parameters.

[0103] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein determining the feature information of the time series data includes: Performing a stationarity test on the time series data; If it is determined that the time series data is stationary, then determining the autocorrelation coefficient of the time series data at the candidate lag period; Based on the autocorrelation coefficient, period information of the time series data is determined.

[0104] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, wherein determining the period information of the time series data based on the autocorrelation coefficient includes: If there is an autocorrelation coefficient greater than the correlation threshold, the lag period corresponding to the autocorrelation coefficient is determined as the period information of the time series data.

[0105] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 2, wherein the determining the feature information of the time series data further includes: If it is determined that the time series data is not stationary, performing differential processing on the time series data to obtain differential series data; The differential series data is used as new time series data, and the step of performing a stationarity test on the time series data is returned to.

[0106] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 2, wherein the candidate hysteresis period is determined in the following manner: Determining the time granularity of the time series data and the time length of the time series data; The candidate lag period is determined from a plurality of preset lag periods according to the time granularity and the time length.

[0107] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 1, wherein the feature information further includes a signal-to-noise ratio of the time series data; The determining of the characteristic information of the time series data includes: Convert the time series data into a frequency domain to obtain a power spectrum density of the time series data in the frequency domain; Based on the power spectral density, determining a signal power spectrum and a noise power spectrum; A signal-to-noise ratio of the time series data is determined based on the signal power spectrum and the noise power spectrum.

[0108] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 1, wherein the feature information further includes statistical information and / or sequence information of the time series data; The statistical information includes at least one of the following: mean, median, standard deviation, kurtosis, skewness, maximum value, minimum value, and quantile of the time series data; The sequence information includes at least one of the following: time granularity, time length, and data missing rate of the time series data.

[0109] According to one or more embodiments of the present disclosure, Example 8 provides the method described in any one of Examples 1-7, wherein the processing algorithm includes a baseline algorithm and / or a detection algorithm; The determining, based on the time series data and the feature information, a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm includes: The time series data and the feature information are input into an algorithm prediction model so that the algorithm prediction model determines the processing algorithm and processing parameters of the processing algorithm from a plurality of candidate algorithms.

[0110] According to one or more embodiments of the present disclosure, Example 9 provides a data processing device, the device comprising: An acquisition module is used to acquire the time series data to be detected; A first determining module, configured to determine characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; A second determination module, used to determine a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm based on the time series data and the feature information; A detection module is used to perform anomaly detection on the time series data based on the processing algorithm and the processing parameters.

[0111] According to one or more embodiments of the present disclosure, Example 10 provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processing device, the steps of the method described in any one of Examples 1-8 are implemented.

[0112] According to one or more embodiments of the present disclosure, Example 11 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods described in Examples 1-8.

[0113] According to one or more embodiments of the present disclosure, Example 12 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-8 when executed by a processor.

[0114] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0115] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0116] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A data processing method, characterized in that: The method comprises: Obtain the time series data to be detected; Determining characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; Based on the time series data and the feature information, determining a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm; Anomaly detection is performed on the time series data based on the processing algorithm and the processing parameters.

2. The method according to claim 1, characterized in that The determining of the characteristic information of the time series data includes: Performing a stationarity test on the time series data; If it is determined that the time series data is stationary, then determining the autocorrelation coefficient of the time series data at the candidate lag period; Based on the autocorrelation coefficient, period information of the time series data is determined.

3. The method according to claim 2, characterized in that The determining, based on the autocorrelation coefficient, the period information of the time series data comprises: If there is an autocorrelation coefficient greater than the correlation threshold, the lag period corresponding to the autocorrelation coefficient is determined as the period information of the time series data.

4. The method according to claim 2, characterized in that: The determining of the characteristic information of the time series data further includes: If it is determined that the time series data is not stationary, performing differential processing on the time series data to obtain differential series data; The differential series data is used as new time series data, and the step of performing a stationarity test on the time series data is returned to.

5. The method according to claim 2, characterized in that: The candidate lag period is determined by: Determining the time granularity of the time series data and the time length of the time series data; The candidate lag period is determined from a plurality of preset lag periods according to the time granularity and the time length.

6. The method according to claim 1, characterized in that The characteristic information also includes the signal-to-noise ratio of the time series data; The determining of the characteristic information of the time series data includes: Convert the time series data into a frequency domain to obtain a power spectrum density of the time series data in the frequency domain; Based on the power spectral density, determining a signal power spectrum and a noise power spectrum; A signal-to-noise ratio of the time series data is determined based on the signal power spectrum and the noise power spectrum.

7. The method according to claim 1, characterized in that The characteristic information also includes statistical information and / or sequence information of the time series data; The statistical information includes at least one of the following: mean, median, standard deviation, kurtosis, skewness, maximum value, minimum value, and quantile of the time series data; The sequence information includes at least one of the following: time granularity, time length, and data missing rate of the time series data.

8. The method according to any one of claims 1 to 7, characterized in that The processing algorithm comprises a baseline algorithm and / or a detection algorithm; The determining, based on the time series data and the feature information, a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm includes: The time series data and the feature information are input into an algorithm prediction model so that the algorithm prediction model determines the processing algorithm and processing parameters of the processing algorithm from a plurality of candidate algorithms.

9. A data processing device, characterized in that: The device comprises: An acquisition module is used to acquire the time series data to be detected; A first determining module, configured to determine characteristic information of the time series data, wherein the characteristic information includes period information of the time series data; A second determination module, used to determine a processing algorithm for performing anomaly detection on the time series data and processing parameters of the processing algorithm based on the time series data and the feature information; A detection module is used to perform anomaly detection on the time series data based on the processing algorithm and the processing parameters.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 8 are implemented.

11. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images