Time sequence data detection method and device, equipment and medium

Abstract

The embodiment of the invention discloses a time sequence data detection method and device, equipment and a medium. According to the scheme, the method comprises the steps of obtaining target time sequence data containing to-be-detected time sequence data; the target time sequence data further comprises target historical time sequence data in a preset time period before the to-be-detected time sequence data; based on the target time sequence data, judging whether the to-be-detected time sequence data meets a first prediction condition and a second prediction condition or not; the first prediction condition is that the to-be-detected time series data does not exceed prediction upper and lower limits obtained based on historical time series data; the second prediction condition is that the difference value between the period size of the to-be-detected time series data and the period size of adjacent historical to-be-detected time series data is smaller than or equal to a first preset threshold value; and if the to-be-detected time series data meets the first prediction condition and the second prediction condition, determining that the to-be-detected time series data is not abnormal.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and medium for detecting time series data. Background Art

[0002] With the development of computer technology, Internet platforms provide users with a variety of convenient services, such as shopping, financial management, insurance, etc. As a product of computer technology, data has penetrated into various industries and application fields and has become an important production factor. In the era of data technology, data includes time series data that changes over time. The changes in time series data can reflect some valuable information. For example, in scenarios such as transaction monitoring, fault diagnosis, disease detection, intrusion detection, and identity recognition, risk assessment can be performed based on the changes in time series data to improve the stability of services.

[0003] Therefore, how to detect time series data more accurately is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present specification provide a method, device, equipment and medium for detecting time series data to improve the accuracy of time series data detection.

[0005] To solve the above technical problems, the embodiments of this specification are implemented as follows:

[0006] An embodiment of the present specification provides a method for detecting time series data, including:

[0007] Acquire target time series data including the time series data to be detected; the target time series data also includes target historical time series data within a preset time period before the time series data to be detected;

[0008] Based on the target time series data, determine whether the time series data to be detected meets the first prediction condition and the second prediction condition; the first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data; the second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to the first preset threshold;

[0009] If the time series data to be detected meets the first prediction condition and the second prediction condition, it is determined that the time series data to be detected has no abnormality.

[0010] An embodiment of the present specification provides a time series data detection device, including:

[0011] The data acquisition module is used to acquire target time series data including the time series data to be detected. The target time series data also includes target historical time series data within a preset time period before the time series data to be detected.

[0012] A judgment module is used to judge whether the time series data to be detected meets the first prediction condition and the second prediction condition based on the target time series data. The first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data. The second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to the first preset threshold.

[0013] The result determination module is used to determine that the time series data to be detected has no abnormality if the time series data to be detected meets the first prediction condition and the second prediction condition.

[0014] An embodiment of the present specification provides a time series data detection device, including:

[0015] at least one processor; and,

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the above-mentioned method for detecting time series data.

[0018] An embodiment of the present specification provides a computer-readable medium on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement the above-mentioned method for detecting time series data.

[0019] At least one embodiment of this specification can achieve the following beneficial effects:

[0020] In the embodiments of this specification, it is determined whether the time series data to be detected is abnormal by judging whether it exceeds the predicted upper and lower limits obtained based on the historical time series data and whether the period value of the time series data to be detected is close to the period value of the adjacent historical detection time series data. Then, detection can be performed from multiple angles such as upper and lower limits and period value, which can improve the accuracy of time series data detection. On the other hand, the time series data to be detected can be detected based on the predicted upper and lower limits determined by the historical time series data. For the time series data to be detected that meets the first prediction condition and the second prediction condition, there is no need to perform the relevant steps for determining the upper and lower limits, which can also improve the efficiency of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0022] Figure 1 A schematic diagram of an application scenario of a method for detecting time series data provided in an embodiment of this specification;

[0023] Figure 2 A flowchart of a method for detecting time series data provided in an embodiment of this specification;

[0024] Figure 3 A schematic diagram of the structure of a time series data detection device provided in an embodiment of this specification;

[0025] Figure 4 A schematic diagram of the structure of a time series data detection device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of one or more embodiments of this specification clearer, the technical solutions of one or more embodiments of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of one or more embodiments of this specification.

[0027] In order to more clearly illustrate the method provided in this specification, the terms involved in one or more embodiments of this specification are first explained.

[0028] Seasonal and Trend Decomposition: STL is a versatile and robust method for decomposing time series. STL is the abbreviation of "Seasonal and Trend decomposition using Loess". This method is mainly used to decompose time series data into three main components: seasonal component, trend component and residual (or noise) component. Seasonal component: represents a recurring pattern in the data, such as a specific change that occurs every year or every quarter. Trend component: reflects the overall direction of data changing slowly over time, such as long-term growth or decline. Residual component: refers to the random fluctuation part after removing seasonality and trend, which is usually used to represent outliers or unforeseen changes. STL smoothes time series data through local weighted regression (Loess or Lowess). Loess is a non-parametric regression method that selects data points in a neighborhood around each point to be estimated and assigns weights to these points for regression analysis. The weight is usually determined based on the distance of the point from the center point, and the closer the point, the higher the weight. This process allows the algorithm to capture local characteristics in the data, thereby effectively separating seasonal, trend and residual components.

[0029] Anomaly Detection: In data mining, anomaly detection is the identification of items, events, or observations that do not conform to the expected pattern or other items in the data set. Anomalies can also be called outliers, novelties, noise, deviations, and exceptions, etc.

[0030] Time series forecasting: is a statistical or machine learning method that attempts to model historical time series data to predict future points in time.

[0031] Time series data: It is a series of ordered data recorded in chronological order, which can also be called a time series. From the perspective of sampling time, time series data can be sampling data with equal time intervals or sampling data with unequal time intervals, and the time scale of each data point can be marked. From the perspective of time granularity, the observation time of time series data can be in any time form, such as hours, days, weeks, months, years, etc.

[0032] Statistics window: Slide in units of data items. When the data item reaches the set number, the statistics window will be triggered for calculation and analysis.

[0033] Time window: Slide in time. Regardless of the amount of data, the time window will be triggered once every fixed period of time for calculation and analysis.

[0034] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0035] In order to solve the defects in the prior art, this solution provides the following embodiments:

[0036] Figure 1 Schematic diagram of an application scenario of a method for detecting time series data provided in an embodiment of this specification. Figure 1 As shown, the solution may include a terminal 1 and a server 2. Terminal 1 includes but is not limited to mobile communication devices, personal computers, tablet computers, smart watches, barcode scanners, POS terminals, cash registers, central control devices, central consoles and other terminal devices, and may also be a server with time series data detection requirements, such as a local area network server within an enterprise, an e-commerce platform server, etc. Server 2 may be an independent physical server, or a server cluster or distributed file system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0037] Terminal 1 can generate or send time series data to server 2, and server 2 can detect the acquired time series data. In actual applications, terminal 1 can also send a detection request to server 2, and server 2 can perform detection based on the detection request sent by terminal 1. Server 2 can also automatically execute the detection process, such as performing regular detection or irregular sampling of time series data.

[0038] Next, a method for detecting time series data provided in an embodiment of the specification will be described in detail with reference to the accompanying drawings.

[0039] Figure 2 A flow chart of a method for detecting time series data provided by an embodiment of the present specification. From a program perspective, the execution subject of the flow can be a program installed on an application server or a detection terminal.

[0040] like Figure 2 As shown, the process may include the following steps.

[0041] Step 202: Obtain target time series data including the time series data to be detected.

[0042] The target time series data also includes target historical time series data within a preset time period before the time series data to be detected.

[0043] Time series data can be a data pair containing a data value and a corresponding timestamp. In practical applications, data collected once can be used as time series data to be detected; data collected multiple times can also be used as time series data to be detected. For example, if data is collected once every minute, the data per minute can be used as time series data to be detected, or data collected multiple times such as 3 minutes and 5 minutes can be used as time series data to be detected. The length of the specific time window and the length or amount of time series data to be detected can be set according to actual needs, and no specific limitation is made here.

[0044] The target time series data is data including the time series data to be detected and the target historical time series data. The historical time series data is data within a period of time before the time series data to be detected. In practical applications, the target time series data can be determined by a time window or a statistical window. The time window can be a time window of time levels such as days, hours, minutes, seconds, milliseconds, etc., or a time window of time levels such as years, seasons, and months. For example, the time series data to be detected can be the real-time data currently collected, and the target time series data can be the data of the previous 5 days including the current time. The statistical window can slide in units of the number of data items. For example, the time series data to be detected is one or several data items collected recently, and the target time series data can be a preset number of data items including one or several data items currently collected, such as 100, 200, 500, etc. The specific data time length and data volume are not specifically limited here, as long as they can meet actual needs.

[0045] In practical applications, the time series data to be detected may not be real-time data, but may be time series data that needs to be detected, for example, time series data stored in a database of a server or device. The specific content of the time series data to be detected can be set according to actual needs and is not specifically limited here.

[0046] In the embodiments of this specification, the time series data to be detected may include at least one of business data, system or device indicator data. Business data may be various data generated based on business processing or data generated in actual production and life, such as user activity, user visits, product transaction volume, product turnover, product payment amount, platform transaction amount, platform advance payment and other business data, and may also include traffic flow, power consumption, agricultural output and other business data. System or device indicator data may be data generated by the hardware or software of the system or device itself, such as CPU utilization, GPU utilization, memory occupancy, query rate per second QPS (Queries Per Second), etc. For the above-mentioned various time series data, the above-mentioned time series data to be detected may include one or more of the above-mentioned various time series data, which is not specifically limited here.

[0047] Step 204: Based on the target time series data, determine whether the time series data to be detected meets the first prediction condition and the second prediction condition.

[0048] Among them, the first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data; the second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to the first preset threshold.

[0049] The predicted upper and lower limits are the upper and lower limits of future data relative to the historical time series data obtained by performing upper and lower limit prediction based on the historical time series data. In the embodiments of this specification, the upper and lower limits of one or more future data points can be predicted based on the historical time series data. If the data value of the time series data to be detected does not exceed the predicted upper and lower limits obtained by predicting the historical time series data, it can be indicated that the time series data to be detected meets the first prediction condition.

[0050] The historical time series data may be time series data that has been detected before the time series data to be detected. In the process of detecting the historical time series data, the upper and lower limits of future data may be predicted based on the historical time series data to obtain predicted upper and lower limits. If the predicted upper and lower limits include upper and lower limits corresponding to multiple predicted data in the future, the historical time series data may not be the historical time series data adjacent to the time series data to be detected. For example, the upper and lower limits of the next 10 points are predicted based on the historical time series data, and the time series data to be detected may be the first point after the historical time series data, or any one or more points from the 2nd to the 10th points after the historical time series data. If the time series data to be detected is the first or first batch of time series data to be detected, the historical time series data may also be the historical time series data collected before the time series data to be detected, or the upper and lower limits of future data may be predicted based on the historical time series data to obtain predicted upper and lower limits.

[0051] In practical applications, time series data may have periodic characteristics. The cycle size can represent the length of the cycle in which the time series data is located, such as 1 day, 2 hours, 3 days, etc. The cycle size can be expressed in terms of time length or in terms of data volume. For example, the cycle of time series data A is 1 day; for another example, the cycle of time series data B is 20 data items. There is no specific limitation on the representation of the cycle size here. The cycle size of the time series data to be detected in the embodiments of this specification can be obtained based on the target time series data.

[0052] The adjacent historical time series data to be detected may be the adjacent time series data located before the time series data to be detected, and may be the time series data that has been detected before the time series data to be detected. The cycle size of the adjacent historical time series data to be detected may be the cycle determined by performing cycle identification on the adjacent historical time series data to be detected. Among them, the cycle size of the adjacent historical time series data to be detected may be determined by performing cycle identification using the adjacent historical time series data to be detected and the historical time series data of a preset number or preset length before the adjacent historical time series data to be detected. If there is no historical data before the time series data to be detected, a historical cycle size may also be set randomly or by default for the purpose of judgment.

[0053] The upper and lower limits predicted in this specification can be predicted upper and lower limits determined based on the period of historical time series data. If the period size of the time series data to be detected is close to the period size of the adjacent historical time series data to be detected, that is, the difference between the two period sizes is less than or equal to the preset threshold, it can be said that the predicted upper and lower limits obtained based on the historical time series data can be used to detect the time series data to be detected, thereby improving the accuracy of the detection.

[0054] Step 206: If the time series data to be detected meets the first prediction condition and the second prediction condition, it is determined that the time series data to be detected has no abnormality.

[0055] In practical applications, the judgment of the first prediction condition and the second prediction condition can be performed synchronously or asynchronously. For example, it is possible to judge whether the time series data to be detected meets the first prediction condition while judging whether the time series data to be detected meets the second prediction condition. Alternatively, it is possible to first judge whether the time series data to be detected meets the first prediction condition, and then judge whether the time series data to be detected meets the second prediction condition. Alternatively, it is possible to first judge whether the time series data to be detected meets the second prediction condition, and then judge whether the time series data to be detected meets the first prediction condition.

[0056] If the time series data to be detected meets the above-mentioned first prediction condition and the second prediction condition, it can be said that the data value of the time series data to be detected is within a reasonable range, and it can be determined that the time series data to be detected is normal.

[0057] It should be understood that the order of some steps in the methods described in one or more embodiments of this specification can be interchanged according to actual needs, or some steps can be omitted or deleted.

[0058] Figure 2The method in the embodiment determines whether the time series data to be detected exceeds the predicted upper and lower limits based on the historical time series data and whether the period value of the time series data to be detected is close to the period value of the adjacent historical detection time series data to determine whether the data to be detected is abnormal. Then, detection can be performed from multiple angles such as upper and lower limits and period value, which can improve the accuracy of time series data detection.

[0059] On the other hand, in the example of this specification, the current time series data to be detected can be detected based on the predicted upper and lower limits and period values ​​obtained from the historical detection time series data. There is no need to perform too much complex analysis on the current time series data to be detected, and the efficiency of time series data detection can be improved, and the real-time performance of detection can be improved.

[0060] based on Figure 2 The method, the examples of this specification also provide some specific implementation plans of the method, which are described below.

[0061] In practical applications, the upper and lower limits obtained by predicting the upper and lower limits based on the historical time series data can be the upper and lower limits of multiple future data points or the upper and lower limits of data within a future time period. The predicted upper and lower limits can include the upper and lower limit values ​​and the corresponding time information. Optionally, the above judgment on whether the time series data to be detected meets the first prediction condition can specifically include:

[0062] Determine whether the value of the time series data to be detected is within the data interval represented by the predicted upper and lower limits, and determine whether the timestamp of the time series data to be detected is within the time period corresponding to the predicted upper and lower limits;

[0063] If the value of the time series data to be detected is within the data interval represented by the prediction upper and lower limits and the timestamp of the time series data to be detected is within the time period corresponding to the prediction upper and lower limits, it is determined that the time series data to be detected meets the first prediction condition.

[0064] The data interval represented by the prediction upper and lower limits can be a data interval consisting of a prediction upper limit and a prediction lower limit. If the value of the time series data to be detected is greater than or equal to the prediction lower limit and less than or equal to the prediction upper limit, it can be determined that the value of the time series data to be detected is within the data interval represented by the prediction upper and lower limits.

[0065] The time period corresponding to the predicted upper and lower limits can represent the time period in which the predicted upper and lower limits are applicable. The time period may include multiple time points in units of preset duration, such as 12:00:00, 12:00:01, 12:00:02, etc. The time period may also be a time period represented by a start time and an end time, such as 12:00:00 to 12:00:05. The specific representation form is not limited here. The timestamp of the time series data to be detected can be the time when the time series data to be detected is collected, or it can be the time when the server obtains the time series data to be detected. It is sufficient to ensure that the timestamp of the time series data to be detected and the time period corresponding to the predicted upper and lower limits are of the same dimension or the same timing standard.

[0066] In actual applications, if the value of the time series data to be detected exceeds the data interval represented by the prediction upper and lower limits, and / or the timestamp of the time series data to be detected exceeds the time period corresponding to the prediction upper and lower limits, it can be determined that the time series data to be detected does not meet the first prediction condition.

[0067] In order to improve the accuracy of detection in the embodiments of this specification, for the time series data to be detected that does not meet the first prediction condition or the second prediction condition, the upper and lower limits can be re-determined, and then the newly determined upper and lower limits can be used to perform abnormal judgment. Optionally, the method in the embodiments of this specification can also include:

[0068] If the time series data to be detected does not meet the first prediction condition or the second prediction condition, determining the current upper and lower limits based on the target time series data;

[0069] Determine whether the time series data to be detected exceeds the current upper and lower limits;

[0070] If the time series data to be detected does not exceed the current upper and lower limits, it is determined that the time series data to be detected has no abnormality;

[0071] If the time series data to be detected includes data exceeding the current upper and lower limits, the time series data exceeding the current upper and lower limits in the time series data to be detected is determined as abnormal data.

[0072] Among them, if the time series data to be detected exceeds the predicted upper and lower limits based on the historical time series data or the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is greater than a preset threshold, the upper and lower limits can be re-determined for the time series data to be detected, and the newly determined upper and lower limits can be used to determine whether there are abnormal data in the time series data to be detected.

[0073] In the process of detecting time series data in the embodiments of this specification, for time series data that meets the first prediction condition and the second prediction condition, it is not necessary to perform the relevant steps for determining the upper and lower limits, thereby improving the efficiency of detection, and the effect is more significant in the process of detecting time series data with a larger order of magnitude. On the other hand, for time series data that does not meet the first prediction condition or the second prediction condition, the upper and lower limits can be re-determined by performing the relevant steps for determining the upper and lower limits, which can improve the accuracy of detection.

[0074] In practical applications, after determining that the time series data to be detected does not meet the first prediction condition, it is not necessary to determine whether the time series data to be detected meets the second prediction condition, or if the step of determining whether the time series data to be detected meets the second prediction condition has already been executed, the execution of this step can be terminated. Similarly, after determining that the time series data to be detected does not meet the second prediction condition, it is not necessary to determine whether the time series data to be detected meets the first prediction condition, or if the step of determining whether the time series data to be detected meets the first prediction condition has already been executed, the execution of this step can be terminated.

[0075] In the embodiments of this specification, time series data determined as abnormal data can also be marked or stored, and the numerical value of the abnormal data and the corresponding timestamp can be recorded or stored for subsequent abnormal analysis. For example, after abnormal data appears or the amount of abnormal data reaches a preset number, a prompt message can be sent to the operation and maintenance personnel. For another example, the abnormal data can be sent to a risk decision model, which can determine the corresponding processing plan based on the abnormal data. In practical applications, the abnormal data can be used or processed according to actual needs, which will not be repeated here.

[0076] In the embodiment of this specification, the cycle size of the time series data to be detected can be obtained by period identification of the target time series data. Optionally, after obtaining the target time series data including the time series data to be detected, the embodiment of this specification can also include: period identification of the target time series data to determine the cycle of the time series data to be detected.

[0077] The period of the time series data to be detected can be represented by the data period in which the time series data to be detected is located in the data sequence containing the time series data to be detected. Specifically, it can be a period size or a period value expressed in the form of period length.

[0078] The cycle size of the time series data to be detected can be the cycle size represented by the cycle of the time series data to be detected determined according to the target time series data, such as 10 minutes, 2 hours, 3 days, etc. The specific cycle size is determined according to the actual distribution of the time series data, and is not specifically limited here.

[0079] As an implementation method, the period of the time series data may be determined based on a Fast Fourier Transform (FFT). Optionally, the above-mentioned period identification of the target time series data to determine the period of the time series data to be detected may specifically include:

[0080] Extracting period item data from the target time series data;

[0081] Performing fast Fourier transform processing on the periodic term data to obtain a first transformation result;

[0082] Determine the period corresponding to each peak value in the first transformation result as a candidate period;

[0083] If the candidate period includes one period, determining the candidate period as the period of the time series data to be detected;

[0084] If the candidate period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods is determined as the period of the time series data to be detected.

[0085] The periodic item data may represent a pattern in which the target time series data recurs in a certain time period, or may be the seasonal item data in the target time series data. As an implementation method, the target time series data may be stripped of outliers to obtain stripped data; then the stripped data may be smoothed to obtain the trend item; and the stripped data may be subtracted from the trend item to obtain the periodic item data.

[0086] For example, a box plot can be used to remove outliers from the target time series data y_data to obtain the removed data box_data, and then the removed data box_data is smoothed using the local weighted scatter plot smoothing method (Lowess) to obtain the trend item trend_data, and the difference between the removed data box_data and the trend item trend_data is calculated to obtain the period item data box_data-trend_data. Then, the obtained period item data box_data-trend_data is subjected to a fast Fourier transform (FFT), and the periods corresponding to the multiple peaks of the FFT can be used as candidate periods. If there are multiple candidate periods, the period with the largest FFT peak can be selected as the period of the time series data to be detected, and the period size of the time series data to be detected can be determined.

[0087] In practical applications, in addition to using box plots, you can also use methods such as standard scores (Z-Score), interquartile range (IQR), density-based spatial clustering of applications with noise (DBSCAN), etc. to remove outliers. You can also use models such as autoregressive integrated moving average model (ARIMA), state space model, etc. You can also use at least one of the models for identifying discrete points obtained by training models such as support vector machines (SVM) and neural networks to remove discrete points in the target time series data.

[0088] In addition to using the locally weighted scatter plot smoothing method (LOWESS), the smoothing process can also use at least one of the locally weighted regression method (LOESS), moving average (MA), exponential smoothing (ES), Gaussian filtering, Kalman filtering, etc. The specific method of removing discrete points and smoothing is not specifically limited here, as long as it can meet the needs.

[0089] In order to improve the accuracy of cycle identification, the embodiment of this specification can also determine the cycle of the time series data to be detected from the candidate cycles through some verification conditions. As an implementation method, the method in the embodiment of this specification can also include:

[0090] A cycle satisfying the first verification condition and / or the second verification condition is selected from the candidate cycles to obtain a candidate cycle.

[0091] The first verification condition is a period located on a peak of an autocorrelation result; and the autocorrelation result is a result obtained by performing an autocorrelation calculation on the periodic item data.

[0092] The second verification condition is a period in which the energy ratio is less than or equal to a second preset threshold; for any candidate period among the candidate periods, the energy ratio is the ratio of the energy of the second transformation result obtained by performing a fast Fourier transform on the verification residual data to the energy of the first transformation result; the verification residual data is the difference between the periodic result data obtained by periodically decomposing the periodic item data using any candidate period and the periodic item data.

[0093] In practical applications, a period that satisfies the first verification condition or the second verification condition can be used as an alternative period, or a period that satisfies the first verification condition and the second verification condition can be used as an alternative period. Appropriate verification conditions can be selected according to actual business needs, and are not specifically limited here.

[0094] As an implementation manner, selecting a period that satisfies the first verification condition from the candidate periods may specifically include:

[0095] Performing autocorrelation calculation on the periodic item data to obtain an autocorrelation result;

[0096] A period located on a peak of the autocorrelation result is selected from the candidate periods.

[0097] Among them, the autocorrelation function (ACF) can be used to perform autocorrelation calculation on the periodic item data to obtain the ACF autocorrelation result, and then the period located on the peak is selected. In practical applications, if the candidate period does not include the period located on the peak of the ACF autocorrelation result, it can be determined that the time series data to be detected is non-periodic, and the period size of the time series data to be detected can be determined to be 0.

[0098] As an implementation manner, selecting a period that satisfies the second verification condition from the candidate periods may specifically include:

[0099] For any candidate cycle among the candidate cycles, periodically decompose the period item data according to the candidate cycle to obtain periodic result data;

[0100] Calculate the difference between the periodic item data and the periodic result data to obtain calibration residual data;

[0101] Performing a fast Fourier transform on the verification residual data to obtain a second transformation result;

[0102] A period in which a ratio of the energy of the second transformation result to the energy of the first transformation result is less than or equal to a preset threshold is selected from the candidate periods.

[0103] Among them, the periodic decomposition can be to divide the target time series data into sub-data of each cycle according to the period size of any candidate period, and then calculate the average of each sub-data to obtain single-cycle data, and then copy and connect the single-cycle data according to the number of sub-data divided to obtain periodic result data.

[0104] Then, the difference between the periodic item data obtained above and the periodic result data obtained here can be calculated to obtain the check residual data. Then, the check residual data is subjected to FFT fast Fourier transform to obtain the second transformation result of the check residual data. For each candidate period, the ratio of the energy of the second transformation result corresponding to each candidate period to the energy of the first transformation result can be calculated, and the period whose ratio is less than or equal to the preset threshold is selected.

[0105] In actual applications, if it is necessary to select a period that meets the first verification condition and the second verification condition from the candidate periods, as an implementation method, the period that meets the first verification condition can be determined from the candidate periods and the period that meets the second verification condition can be determined from the candidate periods according to the above method, and then the period that meets both the first verification condition and the second verification condition can be selected.

[0106] As another implementation, a cycle satisfying the first verification condition may be selected from the candidate cycles first, and then for the cycle satisfying the first verification condition in the candidate cycles, it is determined whether the cycle satisfies the second verification condition, and then a cycle satisfying both the first verification condition and the second verification condition may be selected. Similarly, a cycle satisfying the second verification condition may be selected from the candidate cycles first, and then for the cycle satisfying the second verification condition in the candidate cycles, it is determined whether the cycle satisfies the first verification condition, and then a cycle satisfying both the first verification condition and the second verification condition may be selected.

[0107] In practical applications, if the candidate cycles do not include a cycle that meets the first verification condition, a cycle that meets the second verification condition, or a cycle that meets both the first verification condition and the second verification condition, it can be determined that the cycle of the timing data to be detected is 0.

[0108] In actual applications, the periods in the candidate periods that do not meet the first verification condition but meet the second verification condition, or the periods that do not meet the second verification condition but meet the first verification condition, can be used as alternative periods. The use of specific verification conditions can be set according to business needs and is not specifically limited here.

[0109] Optionally, if the alternative cycle includes one cycle, the alternative cycle is determined as the cycle of the time series data to be detected; if the alternative cycle includes multiple cycles, the cycle with the largest peak value in the first transformation result among the multiple cycles contained in the alternative cycle is determined as the cycle of the time series data to be detected.

[0110] In practical applications, if the candidate period of the target time series data includes multiple periods, the peak value of the first transformation result may not be used to determine the period of the target time series data, and the multiple periods may be determined as the period of the target time series data. Other screening methods may be used to select the period later. If the candidate period of the target time series data includes one period, other methods may be used to determine the accuracy of the period.

[0111] In order to improve the accuracy of period identification, the target time series data may be divided into multiple sub-data in the embodiment of this specification, and then the sub-data is period identified to determine the degree of similarity between the period of the sub-data and the period of the complete target time series data, thereby determining the period of the time series data to be detected. Optionally, the method in the embodiment of this specification may also include:

[0112] Splitting the target time series data to obtain at least two sub-time series data;

[0113] Perform period identification on each of the sub-time series data to obtain a period corresponding to each of the sub-time series data.

[0114] Determining the period of the time series data to be detected specifically includes: determining the period obtained by period identification of the target time series data, whose degree of similarity with the period corresponding to each of the sub-time series data is greater than or equal to a preset threshold, as the period of the time series data to be detected.

[0115] There may be intersection data between the sub-time series data. For example, the first three-fifths of the target time series data are determined as one sub-time series data, and the last three-fifths of the target time series data are determined as another sub-time series data. For another example, the first three-fifths of the target time series data are determined as one sub-time series data, and the last half of the target time series data are determined as another sub-time series data, and so on.

[0116] There may be no intersection data between the sub-time series data. For example, the first three-fifths of the target time series data are determined as one sub-time series data, and the last two-fifths of the target time series data are determined as another sub-time series data. For another example, the target time series data is divided into five equal parts, each of which can be used as a sub-time series data, and so on. The method of cutting the target time series data is not specifically limited here.

[0117] Among them, the first period obtained by period identification of the target time series data and the second period obtained by period identification of each sub-time series data can calculate the similarity between the first period and the second period, and then determine the period in the first period whose similarity to the second period is less than or equal to a preset threshold as the period of the time series data to be detected.

[0118] In practical applications, if the first cycle contains multiple cycles whose similarity to the second cycle is less than or equal to a preset threshold, the first transformation result obtained by fast Fourier transforming the periodic item data in the target time series data can also be used to select the cycle with the largest peak value in the first transformation result from the multiple cycles and determine it as the period of the time series data to be detected.

[0119] The degree of similarity can be expressed by the difference between the first period and the second period, or by the ratio of the difference between the first period and the second period to the first period, or by other forms that can express the degree of similarity, which is not specifically limited here.

[0120] As an implementation method, if the first cycle obtained by period identification of the target time series data is one or more cycles, and the second cycle obtained by period identification of each sub-time series data is one or more cycles, the degree of similarity between any cycle in the first cycle and each cycle in the second cycle corresponding to each sub-time series data can be calculated. If the second cycle corresponding to at least one sub-time series data in each sub-time series data contains a cycle whose degree of similarity to any cycle is less than or equal to a preset threshold, then any cycle can be determined as the cycle of the time series data to be detected. Alternatively, if the second cycle corresponding to each sub-time series data contains a cycle whose degree of similarity to any cycle is less than or equal to a preset threshold, then any cycle can be determined as the cycle of the time series data to be detected.

[0121] In the embodiments of this specification, the period identification can also be performed for each sub-time series data in the same manner as the period identification for the target time series data. As an implementation method, the period identification for each of the sub-time series data can specifically include: for any of the sub-time series data, a box plot or the like can be used to eliminate outliers in the any of the sub-time series data to obtain the eliminated data, the eliminated data can be smoothed by a LOWESS or the like to obtain the trend item data of any of the sub-time series data, and then the difference between the eliminated data and the trend item data can be calculated to obtain the period item data of any of the sub-time series data, and the period item data can be subjected to an FFT fast Fourier transform to obtain an FFT transform result, which is referred to as the third transform result here, and the period corresponding to each peak value of the third transform result is used as the period of any of the sub-time series data, or the period corresponding to the maximum peak value can also be used as the period of any of the sub-time series data. In this way, the period corresponding to each of the sub-time series data can be obtained.

[0122] Optionally, in the embodiments of the present specification, the period determined based on the peak value of the third transformation result can also be checked according to the same check logic as the first check condition and / or the second check condition to determine the period of the sub-time series data.

[0123] Optionally, as an implementation method, the periods corresponding to the peak values ​​of the third transformation result can be determined as candidate periods of any sub-time series data, and the periods satisfying the third verification condition and / or the fourth verification condition can be selected from the candidate periods to obtain the candidate periods of any sub-time series data.

[0124] Among them, the third verification condition is the period located on the peak of the autocorrelation result; the autocorrelation result is the result obtained by performing autocorrelation calculation on the periodic item data of any of the sub-time series data. The fourth verification condition is the period whose energy ratio is less than or equal to the third preset threshold; for any candidate period among the candidate periods of any of the candidate periods of any of the sub-time series data, the energy ratio is the ratio of the energy of the fourth transformation result obtained by performing fast Fourier transformation on the verification residual data to the energy of the third transformation result; the verification residual data is the difference between the periodic result data obtained by periodically decomposing the periodic item data of any of the sub-time series data using any candidate period of the sub-time series data and the periodic item data of any of the sub-time series data.

[0125] In practical applications, the period that meets the third verification condition or the fourth verification condition can be used as an alternative period for the sub-time series data, and the period that meets the first verification condition and the second verification condition can be used as an alternative period for the sub-time series data. The appropriate verification condition can be selected according to actual business needs, and no specific limitation is made here.

[0126] As an implementation method, selecting a period that meets the third verification condition from the candidate periods may specifically include: performing autocorrelation calculation on the periodic item data of any sub-time series data to obtain an autocorrelation result; and selecting a period located on the peak of the autocorrelation result from the candidate periods.

[0127] Among them, the autocorrelation function (ACF) can be used to perform autocorrelation calculation. In practical applications, if the candidate period does not include a period located on the peak of the ACF autocorrelation result, it can be determined that the sub-time series data is non-periodic, and the period size of the sub-time series data can be determined to be 0.

[0128] As an implementation mode, selecting a period that satisfies the fourth verification condition from the candidate periods may specifically include: for any candidate period among the candidate periods of any sub-time series data, performing periodic decomposition on the periodic item data of any sub-time series data according to the any candidate period to obtain periodic result data; calculating the difference between the periodic item data of the sub-time series data and the obtained periodic result data to obtain verification residual data; performing fast Fourier transform on the verification residual data to obtain a fourth transformation result; and selecting a period from the candidate periods of any sub-time series data in which the ratio of the energy of the fourth transformation result to the energy of the third transformation result is less than or equal to a preset threshold.

[0129] Among them, the periodic decomposition of the periodic item data of any of the sub-time series data is consistent with the logic of the periodic decomposition of the target time series data mentioned above. Specifically, any of the sub-time series data can be divided into sub-data of one cycle at a time according to the period size of any candidate period, and then the average of each sub-data is calculated to obtain single-cycle data, and then according to the number of sub-data divided, the number of single-cycle data is copied and connected to obtain periodic result data.

[0130] Then, the difference between the periodic item data obtained above and the periodic result data obtained here can be calculated to obtain the verification residual data. Then, the verification residual data is subjected to FFT fast Fourier transform to obtain the fourth transformation result of the verification residual data. For each candidate period corresponding to each sub-time series data, the ratio of the energy of the fourth transformation result corresponding to each candidate period to the energy of the third transformation result can be calculated, and the period whose ratio is less than or equal to the preset threshold is selected.

[0131] In actual applications, if it is necessary to select a period that meets the third verification condition and the fourth verification condition, as an implementation method, the period that meets the third verification condition can be determined from the candidate periods and the period that meets the fourth verification condition can be determined from the candidate periods according to the above method, and then the period that meets both the third verification condition and the fourth verification condition can be selected.

[0132] As another implementation, a cycle satisfying the third verification condition may be selected from the candidate cycles first, and then for the cycle satisfying the third verification condition in the candidate cycles, it is determined whether the cycle satisfies the fourth verification condition, and then a cycle satisfying both the third verification condition and the fourth verification condition may be selected. Similarly, a cycle satisfying the fourth verification condition may be selected from the candidate cycles first, and then for the cycle satisfying the fourth verification condition in the candidate cycles, it is determined whether the cycle satisfies the third verification condition, and then a cycle satisfying both the third verification condition and the fourth verification condition may be selected.

[0133] In actual applications, if the candidate period does not include a period that meets the third verification condition, does not include a period that meets the fourth verification condition, or does not include a period that meets both the third verification condition and the fourth verification condition, it can be determined that the period of the sub-time series data is 0.

[0134] In practical applications, a period that does not meet the third verification condition but meets the fourth verification condition or a period that does not meet the fourth verification condition but meets the third verification condition can be used as an alternative period, and a period that meets both the third verification condition and the fourth verification condition can be used as an alternative period. The use of the verification condition can be set according to business needs and is not specifically limited here.

[0135] Optionally, if the alternative period of any of the sub-time series data includes one period, the alternative period is determined as the period of any of the sub-time series data; if the alternative period of any of the sub-time series data includes multiple periods, the period with the largest peak value in the third transformation result among the multiple periods contained in the alternative period is determined as the period of any of the sub-time series data.

[0136] In practical applications, if the candidate period of the sub-time series data contains multiple periods, the peak value of the FFT transformation result may not be used to determine the period of the sub-time series data, and the multiple periods may be determined as the period of the sub-time series data. Then, these multiple periods are compared with the period obtained by period identification of the target time series data to determine the period of the time series data to be detected.

[0137] As an implementation method, the candidate period corresponding to the peak value can be determined by fast Fourier transform for the target time series data according to the above method, and then the period that satisfies the first verification condition and the second verification condition is selected from each candidate period. Synchronously or asynchronously, the target time series data is cut to obtain at least two sub-time series data. For each sub-time series data, the candidate period corresponding to the peak value can also be determined by fast Fourier transform, and then the period that satisfies the third verification condition and the fourth verification condition is selected. Then, the degree of similarity between the period that satisfies the first verification condition and the second verification condition and the period that satisfies the third verification condition and the fourth verification condition is calculated, so as to determine the period whose degree of similarity is greater than or equal to the preset threshold from the period that satisfies the first verification condition and the second verification condition, and determine the period as the period of the time series data to be detected. If the period whose degree of similarity is greater than or equal to the preset threshold includes multiple periods, the peak values ​​of the multiple periods in the fast Fourier transform result can be determined, and the period with the largest peak value is determined as the period of the time series data to be detected.

[0138] In the embodiment of this specification, if the time series data to be detected does not meet the first prediction condition and / or the second prediction condition, the upper and lower limits can be determined based on the target time series data including the time series data to be detected, and the newly determined upper and lower limits are used to determine whether the time series data to be detected is abnormal. Optionally, the current upper and lower limits determined based on the target time series data in the embodiment of this specification may specifically include:

[0139] Acquire trend item data in the target time series data;

[0140] Subtract the trend item data from the target time series data to obtain first data;

[0141] Determine a period length of the first data within a change point interval to obtain single-period data; the change point interval is a data interval in which the trend of the target time series data changes steadily;

[0142] Performing smoothing processing on the single-cycle data to obtain a single-cycle baseline;

[0143] Copying and connecting multiple single-cycle baselines to obtain a complete baseline;

[0144] The complete baseline is moved according to a preset rule to obtain the current upper and lower limits.

[0145] Among them, the periodic components in the target time series data can be removed according to the identified period, and the data without the periodic components can be smoothed by LOWESS and other methods to obtain the trend item data.

[0146] If there are multiple cycles of data in the change point interval, the data of each cycle can be averaged to obtain single-cycle data. For example, assuming that the change point interval contains 30 points of data from 12:01 to 12:30, assuming that the cycle of the determined time series data to be detected is 10 minutes, it can also be represented by a length of 10 points. In this way, the change point interval contains 3 cycles of data. The data of the 1st to 10th points, the data of the 11th to 20th points, and the data of the 21st to 30th points can be averaged. For example, the data values ​​of the 1st point, the 11th point, and the 21st point are added and divided by 3 to obtain the data value of the first point in the single-cycle data. By analogy, the single-cycle data can be obtained by calculating the average value.

[0147] The change point interval represents a data interval in which the trend of the target time series data changes smoothly. Optionally, if the period of the time series data to be detected determined by period identification of the target time series data is not 0, the Bayesian change point detection method can be used to detect the moment of trend change in the target time series data; according to the moment of trend change, the change point interval in which the trend changes smoothly is determined. If the period is 0, the target time series data can be determined as a change point interval.

[0148] In practical applications, if the identified period is not 0, the Bayesian change point detection method or other detection methods, such as likelihood ratio test, cumulative sum control chart, moving average control chart, support vector machine, neural network, etc., can be used to detect the moment when the trend changes in the target time series data, and select a relatively stable interval according to the change moment as the change point interval for baseline extraction. Among them, the relatively stable interval can represent an interval where the change trend is less than or equal to the preset threshold. If the identified period is 0, the start and end moments of the target time series data are directly returned, and the entire target time series data is used as the data of the change point interval.

[0149] The process of smoothing the obtained single-cycle data can be one time or multiple times, until the similarity between the data before and after smoothing reaches a certain threshold, and a relatively smooth single-cycle baseline can be obtained.

[0150] The data of the single-cycle baseline that needs to be copied and connected can be determined based on the number of cycles contained in the target time series data, and the length of the obtained complete baseline can be equal to the length of the target time series data. After determining the complete baseline, the baseline can be moved up and down to obtain the current upper and lower limits.

[0151] As an implementation manner, the above-mentioned moving the complete baseline according to a preset rule to obtain the current upper and lower limits may specifically include:

[0152] Calculating the difference between the target time series data and the complete baseline;

[0153] Calculating the quantile of the difference to determine the baseline shift amplitude;

[0154] The complete baseline is moved according to the baseline moving amplitude to obtain the current upper and lower limits.

[0155] The target time series data includes data at multiple time points, and the complete baseline also includes the baseline values ​​at the corresponding time points. The difference between the value in the target time series data at each time point and the value in the corresponding complete baseline can be calculated. The time point can be represented by timestamp, natural time, world time, etc., which is not limited here.

[0156] The differences greater than 0 can be sorted, and then the quantile calculation can be performed to obtain the amplitude of the upward movement; similarly, the differences less than 0 can be sorted, and then the quantile calculation can be performed to obtain the amplitude of the downward movement, and then the complete baseline can be moved according to the obtained movement amplitude to obtain the current upper and lower limits.

[0157] For example, for a difference array greater than 0, the 90% quantile multiplied by a proportional coefficient can be taken as the upper limit; similarly, for a difference array less than 0, the 90% quantile multiplied by a proportional coefficient can be taken as the lower limit. The two proportional coefficients can be the same or different, for example, any integer or decimal from 1 to 3 can be selected as the proportional coefficient.

[0158] In order to ensure the accuracy of the current upper and lower limits extracted based on the target time series data, the extracted current upper and lower limits may also be modified in the embodiment of this specification. Optionally, the method in the embodiment of this specification may also include:

[0159] Using the current upper and lower limits to eliminate abnormal points in the target time series data, to obtain first eliminated data;

[0160] Extracting a first baseline corresponding to the first eliminated data;

[0161] Based on the first baseline, determining first upper and lower limits corresponding to the first eliminated data;

[0162] Determine whether a first similarity between the first upper and lower limits and the current upper and lower limits is greater than or equal to a third preset threshold;

[0163] If the first similarity is greater than or equal to a third preset threshold, the first upper and lower limits are determined as valid upper and lower limits.

[0164] The determining whether the time series data to be detected exceeds the current upper and lower limits may specifically include: determining whether the time series data to be detected exceeds the valid upper and lower limits.

[0165] Among them, the processing logic for extracting the first baseline corresponding to the first eliminated data can be the same as the processing logic for extracting the baseline of the target time series data mentioned above. Specifically, the trend item data in the first eliminated data can be obtained. For example, the periodic components in the first eliminated data can be removed according to the identified period, and the data with the periodic components removed can be smoothed by LOWESS or the like to obtain the trend item data. Then, the trend item data in the first eliminated data is subtracted from the first eliminated data to obtain the second data; the data of a period length of the second data within the change point interval corresponding to the first eliminated data is determined to obtain the single-period data corresponding to the first eliminated data. Among them, the change point interval can be a data interval in which the trend changes smoothly in the first eliminated data. Then, the single-period data is smoothed to obtain a single-period baseline; multiple single-period baselines are copied and connected to obtain a complete baseline corresponding to the first eliminated data, that is, the first baseline corresponding to the first eliminated data. Among them, the specific determination method of the change point interval, the single-period baseline and the complete baseline can be referred to the above content, and will not be elaborated here.

[0166] The specific logic for determining the first upper and lower limits corresponding to the first eliminated data based on the baseline corresponding to the first eliminated data can also be the same as the logic for determining the current upper and lower limits corresponding to the target time series data. Specifically, the difference between the first eliminated data and the baseline corresponding to the first eliminated data can be calculated; the quantile calculation can be performed on the difference to determine the baseline movement amplitude; the first baseline corresponding to the first eliminated data is moved according to the baseline movement amplitude to obtain the first upper and lower limits corresponding to the first eliminated data. Among them, the specific process of determining the baseline movement amplitude using quantiles can also be referred to the above-mentioned related content, which will not be repeated here.

[0167] In practical applications, clustering algorithms such as k-sigma can also be used to remove abnormal points from the target time series data to obtain preliminary eliminated data; and then the above-mentioned current upper and lower limits can be used to remove abnormal points from the preliminary eliminated data to obtain the above-mentioned first eliminated data.

[0168] If the similarity is greater than or equal to the third preset threshold, the upper and lower limits corresponding to the eliminated data can be determined as valid upper and lower limits. Of course, since the current upper and lower limits determined based on the target time series data are similar to the upper and lower limits corresponding to the eliminated data, the current upper and lower limits determined based on the target time series data can also be determined as valid upper and lower limits.

[0169] If the similarity is less than the third preset threshold, the baseline correction may be further performed. Optionally, the method in the embodiment of this specification may further include:

[0170] If the first similarity is less than the third preset threshold, using the first upper and lower limits to eliminate abnormal points in the target time series data to obtain second eliminated data;

[0171] Extracting a second baseline corresponding to the second eliminated data;

[0172] Based on the second baseline, determining second upper and lower limits corresponding to the second eliminated data;

[0173] Determine whether a second similarity between the second upper and lower limits and the first upper and lower limits is greater than or equal to a fourth preset threshold;

[0174] If the fourth similarity is greater than or equal to a fourth preset threshold, the second upper and lower limits are determined as valid upper and lower limits.

[0175] Similar to the above processing logic, the trend item data in the second eliminated data can be obtained. For example, the periodic components in the second eliminated data can be removed according to the identified period, and the data after the periodic components are eliminated can be smoothed by LOWESS or the like to obtain the trend item data. Then, the trend item data in the second eliminated data is subtracted from the second eliminated data to obtain the third data; the data of a period length of the third data within the change point interval corresponding to the second eliminated data is determined to obtain the single-period data corresponding to the second eliminated data. The change point interval can be a data interval in which the trend changes smoothly in the second eliminated data. Then, the single-period data is smoothed to obtain a single-period baseline; multiple single-period baselines are copied and connected to obtain a complete baseline corresponding to the second eliminated data, that is, the second baseline corresponding to the second eliminated data. Among them, the specific determination method of the change point interval, the single-period baseline and the complete baseline can be referred to the above content, and will not be elaborated here.

[0176] Similarly, the difference between the second eliminated data and the second baseline corresponding to the second eliminated data can also be calculated; the quantile calculation is performed on the difference to determine the baseline shift amplitude; the second baseline corresponding to the second eliminated data is shifted according to the baseline shift amplitude to obtain the second upper and lower limits corresponding to the second eliminated data. The specific process of determining the baseline shift amplitude using the quantile can also be referred to the above-mentioned related content, which will not be repeated here.

[0177] In practical applications, the above-mentioned use of the first upper and lower limits to eliminate abnormal points in the target time series data to obtain the second eliminated data can also be performed by using the first upper and lower limits to eliminate abnormal points in the target time series data using a clustering algorithm such as k-sigma to obtain abnormal points in the preliminary eliminated data to obtain the second eliminated data.

[0178] The correction logic for the upper and lower limits can be executed in a loop until the similarity between the new upper and lower limits determined in the previous round is greater than a preset threshold; the number of loop executions can also be set, such as 3 times, 5 times, etc. If the similarity between the new upper and lower limits and the upper and lower limits determined in the previous round is greater than the preset threshold within this number of times, the execution of the correction logic can be terminated to determine the latest determined upper and lower limits as valid upper and lower limits; if there are no upper and lower limits with a similarity greater than the preset threshold within this number of times, the upper and lower limits determined for the last time can also be determined as valid upper and lower limits.

[0179] In the embodiments of this specification, relevant similarity calculation methods or network models such as vector machines and neural networks can be used to calculate similarity. The specific values ​​of the above-mentioned preset thresholds can be set according to actual needs, and can be the same or different, and are not specifically limited here.

[0180] In the embodiments of this specification, some rules may also be used to judge the situation of the time series data to be detected. As an implementation mode, the method in the embodiments of this specification may also include:

[0181] Calculating the first-order difference of the target time series data to obtain first result data;

[0182] Determine a first abnormal data set corresponding to the first result data using a first clustering algorithm;

[0183] Calculating a period difference value of a first-order difference of the target time series data to obtain second result data;

[0184] Determine a second abnormal data set corresponding to the second result data using a second clustering algorithm;

[0185] Common abnormal data of the first abnormal data set and the second abnormal data set included in the time series data to be detected is determined as abnormal data.

[0186] The first clustering algorithm and the second clustering algorithm can be the same clustering algorithm or different clustering algorithms. For example, k-sigma is used to find abnormal data for the first-order difference of the target time series data and the periodic difference value of the first-order difference, and the common data of the abnormal data of the two is found as the common abnormal data. If the time series data to be detected is the common abnormal data or the time series data to be detected contains the common abnormal data, it can be determined that the time series data to be detected is abnormal.

[0187] It can be understood that the embodiments of this specification are aimed at anomaly detection of time series data, and the first anomaly data set and the second anomaly data set may include specific values ​​of the anomaly data and may also include information such as timestamps.

[0188] In practical applications, if it is determined that the time series data to be detected contains abnormal time series data that exceeds the current upper and lower limits or the effective upper and lower limits according to the above-mentioned current upper and lower limits or the effective upper and lower limits, the accuracy of the abnormal time series data can also be further determined according to the above-mentioned rules. For example, the above-mentioned determination of the common abnormal data of the first abnormal data set and the second abnormal data set contained in the time series data to be detected as abnormal data may specifically include:

[0189] Determine whether the time series data exceeding the current upper and lower limits in the time series data to be detected is included in the common abnormal data;

[0190] The time series data exceeding the current upper and lower limits in the time series data to be detected and included in the common abnormal data are determined as abnormal data.

[0191] In the embodiments of this specification, the accuracy of anomaly detection can be improved through judgments in multiple dimensions or multiple levels.

[0192] As another implementation, the method in the embodiment of this specification may also include:

[0193] Smoothing the target time series data to obtain smoothed data;

[0194] Determine a stable interval contained in the smoothed data; the stable interval is a data interval whose variation range is less than or equal to a fifth preset threshold;

[0195] Determine whether the stable interval is within the period interval of the target time series data;

[0196] If the stable interval is not within the periodic interval, the data within the stable interval is determined to be abnormal data.

[0197] In practical applications, if it is necessary to determine abnormal data in the target time series data, the data in the target time series data that is located in the stable interval but not in the periodic interval can be determined as abnormal data. If it is necessary to determine abnormal data in the time series data to be detected, the data in the target time series data that is located in the stable interval but not in the periodic interval can be determined as initial abnormal data, and then it is determined whether the time series data to be detected contains the data in the initial abnormal data, and the data in the initial abnormal data contained in the time series data to be detected can be determined as abnormal data in the time series data to be detected.

[0198] Among them, algorithms such as LOWESS can be used to smooth the target time series data.

[0199] The stationary interval can be a specific period of time in the time series data, in which the data presents relatively stable and unchanged statistical properties. During this period, the statistical parameters such as the mean and variance of the time series remain relatively constant and are not affected by time, and the autocorrelation coefficient also decays rapidly to near zero with the increase of lag. In practical applications, the determination of the stationary interval can usually be combined with graphical diagnosis, such as time series diagrams, autocorrelation diagrams, etc., or with statistical tests, such as ADF test, KPSS test, etc. to determine the stationary interval.

[0200] The periodic interval may be a recurring pattern or regularity in the time series data, and this pattern is usually related to a specific time length. In other words, the periodic interval may be a phenomenon or value in the time series data that shows a fixed periodicity, and a similar fluctuation pattern is repeated every once in a while. In the embodiments of this specification, the periodic intervals contained in the target time series data can be determined based on the period of the time series data to be detected determined by period identification of the target time series data, and the above-mentioned specific time length may be the length of the period of the time series data to be detected.

[0201] For example, most of the target time series data is distributed in the form of a sine wave. Assume that it contains 5 half-sine waves, but there is a stable interval between the first wave and the second wave, but not between other waves. It can be determined that the stable interval is not within the periodic interval, and the data within the stable interval can be determined as abnormal data.

[0202] In actual applications, after determining the abnormal data, the server can feed back the abnormal data to the exception handling server, which can determine the corresponding processing strategy by analyzing the abnormal data. The detection personnel can also view the abnormal data and determine whether the abnormal data is false detection data or whether there is missed detection data through manual or processing result feedback information. For false detection or missed detection data, the server can calculate the false detection point closest to the upper and lower limits among all false detection data based on the data timestamp of the false detection data, and calculate the proportional coefficient that makes the false detection data be judged as normal, and reset the coefficient to a new proportional coefficient. Similarly, the server can also calculate the missed detection point closest to the upper and lower limits among all missed detections based on the data timestamp of the missed detection data, and calculate the proportional coefficient that makes the missed detection be judged as abnormal. The upper and lower limits can be adjusted by adjusting the proportional coefficient.

[0203] In the embodiments of this specification, subsequent data can also be predicted based on the target time series data, and the predicted upper and lower limits of the subsequent data can be predicted. As an implementation method, a first preset number of time series data can be intercepted from the periodic data of the target time series data according to the period of the data to be identified, and the intercepted time series data can be determined as the predicted period item data. The AutoARIMA algorithm or other algorithms can also be used to fit the past second preset number of time series data including the time series data to be detected, and the first preset number of data in the future can be predicted to obtain the predicted trend item data. The predicted period item data and the predicted trend item data can be added to obtain a predicted baseline, which can be the predicted baseline of the first preset number of future time series data. Then, the baseline movement amplitude calculated in the process of determining the current upper and lower limits of the time series data to be detected can be used to move the predicted baseline to obtain the predicted upper and lower limits. The predicted upper and lower limits can be used to detect the time series data at the next moment or the next batch. The predicted upper and lower limits can include the numerical values ​​of the upper and lower limits, and can also include corresponding timestamps and other information.

[0204] For example, the first preset number is 10. For the periodic item data, the data of 10 points of the periodic data can be copied and intercepted according to the period size; for the trend item data, the AutoARIMA algorithm is used to fit the data of the past 200 points to predict the data of the next 10 points. Then the predicted periodic item data and trend item data are added to obtain a baseline with a predicted length of 10. Then the predicted baseline is shifted according to the amplitude of the previous shift of the upper and lower limits to obtain the predicted upper and lower limits. In this way, the predicted upper and lower limits can be the predicted upper and lower limits corresponding to the time series data of the next 10 points. If it is determined by point-by-point judgment that the time series data of the next 10 points are all within the upper and lower limits, and the period of each time series data in the time series data of the next 10 points is close to the period of the adjacent previous historical time series data, the time series data of the next 10 points can be used without executing the relevant steps of extracting the upper and lower limits. Since the predicted upper and lower limits are only applicable to the data of the next 10 points, there are no upper and lower limits that can be verified for the time series data of the 11th point in the future, and the relevant steps of extracting the upper limit need to be executed for the time series data of the 11th point. In the embodiments of this specification, the time series data can be detected according to the predicted upper and lower limits, which can improve the detection efficiency.

[0205] Similarly, the above-mentioned prediction upper and lower limits used in the detection process of the time series data to be detected can also be generated according to the above-mentioned logic. Optionally, the above-mentioned prediction upper and lower limits based on the historical time series data can be generated by the following steps: according to the period of the historical time series data to be detected, a first preset amount of time series data is intercepted from the period data of the historical target time series data. Then, the intercepted time series data can be determined as the prediction period item data.

[0206] Among them, the historical time series data to be detected may be the historical time series data before the time series data to be detected that does not meet the first prediction condition and / or the second prediction condition and needs to extract the upper and lower limits. Specifically, the historical time series data to be detected may be the historical time series data that is closest to the time series data to be detected before the time series data to be detected and needs to extract the upper and lower limits. The period of the historical time series data to be detected may be a period determined based on period identification of the historical target time series data, such as the logic of the above-mentioned period identification. The historical target time series data may include a preset number of historical time series data including the above-mentioned historical time series data to be detected. The data volume or length of the historical target time series data may be the same as or different from the above-mentioned target time series data and may be set according to actual needs, and is not specifically limited here.

[0207] A second amount of time series data may also be intercepted from the historical time series data corresponding to the historical time series data to be detected.

[0208] The second amount of time series data may be intercepted starting from or ending with the historical time series data to be detected, and the intercepted second amount of time series data may include the historical time series data to be detected.

[0209] The intercepted second quantity of time series data is fitted to obtain predicted trend item data.

[0210] The AutoARIMA algorithm may be used for fitting, or other fitting algorithms may be used, which are not specifically limited here.

[0211] Then the forecast baseline can be obtained by adding the forecast period item data and the forecast trend item data.

[0212] The predicted upper and lower limits can be obtained by moving the predicted baseline using the baseline movement amplitude calculated in the process of determining the current upper and lower limits of the historical time series data to be detected. The predicted upper and lower limits can be used to detect the above-mentioned time series data to be detected.

[0213] Among them, the logic of the process of determining the current upper and lower limits of the historical time series data to be detected is the same as the logic of determining the current upper and lower limits of the time series data to be detected introduced above, and will not be repeated here.

[0214] The following table shows the F1-score balance F scores of different algorithms on multiple data sets. The data sets include the constructed data set 1 and the constructed data set 2 randomly constructed by computers, and the public data set AIOPS composed of public real data.

[0215]

[0216]

[0217] From the F1-score balanced F scores corresponding to the different algorithms in the above table, it can be seen that the detection method for time series data provided in the embodiments of this specification has better performance.

[0218] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method. Figure 3 This is a schematic diagram of a time series data detection device provided in an embodiment of this specification. Figure 3 As shown, the device may include:

[0219] The data acquisition module 302 is used to acquire target time series data including the time series data to be detected. The target time series data also includes target historical time series data within a preset time period before the time series data to be detected.

[0220] The judgment module 304 is used to judge whether the time series data to be detected meets the first prediction condition and the second prediction condition based on the target time series data. The first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data. The second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to the first preset threshold.

[0221] The result determination module 306 is used to determine that the time series data to be detected has no abnormality if the time series data to be detected meets the first prediction condition and the second prediction condition.

[0222] based on Figure 3 The present specification also provides some specific implementation plans, which are described below.

[0223] Optionally, the determination module 304 may be specifically used for:

[0224] Determine whether the value of the time series data to be detected exceeds the data interval represented by the predicted upper and lower limits, and determine whether the timestamp of the time series data to be detected exceeds the time period corresponding to the predicted upper and lower limits;

[0225] If the value of the time series data to be detected is within the data interval represented by the prediction upper and lower limits and the timestamp of the time series data to be detected is within the time period corresponding to the prediction upper and lower limits, it is determined that the time series data to be detected meets the first prediction condition.

[0226] Optionally, the device further comprises:

[0227] The upper and lower limit determination module is used to determine the current upper and lower limits based on the target time series data if the time series data to be detected does not meet the first prediction condition or the second prediction condition.

[0228] Correspondingly, the above-mentioned determination module 304 can be specifically used for:

[0229] If the time series data to be detected does not exceed the current upper and lower limits, it is determined that the time series data to be detected has no abnormality;

[0230] If the time series data to be detected includes data exceeding the current upper and lower limits, the time series data exceeding the current upper and lower limits in the time series data to be detected is determined as abnormal data.

[0231] Optionally, the device may further include: a period identification module, configured to perform period identification on the target time series data and determine the period of the time series data to be detected.

[0232] Optionally, the period identification module can be used to: extract period item data from the target time series data; perform fast Fourier transform processing on the period item data to obtain a first transformation result; determine the period value corresponding to each peak in the first transformation result as a candidate period; if the candidate period includes one period, then determine the candidate period as the period of the time series data to be detected; if the candidate period includes multiple periods, then determine the period with the largest peak value in the first transformation result among the multiple periods as the period of the time series data to be detected.

[0233] Optionally, the period identification module can also be used to: select a period that meets the first verification condition and / or the second verification condition from the candidate periods to obtain an alternative period; wherein the first verification condition is a period located on the peak of the autocorrelation result; the autocorrelation result is the result obtained by performing autocorrelation calculation on the periodic item data; the second verification condition is a period whose energy ratio is less than or equal to a second preset threshold; for any candidate period among the candidate periods, the energy ratio is the ratio of the energy of the second transformation result obtained by performing fast Fourier transformation on the verification residual data to the energy of the first transformation result; the verification residual data is the difference between the periodic result data obtained by periodically decomposing the periodic item data using any of the candidate periods and the periodic item data.

[0234] Correspondingly, if the candidate cycle includes one cycle, then the candidate cycle is determined as the cycle of the time series data to be detected, which specifically includes: if the candidate cycle includes one cycle, then the candidate cycle is determined as the cycle of the time series data to be detected.

[0235] Correspondingly, if the candidate period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods is determined as the period of the timing data to be detected, specifically including: if the alternative period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods included in the alternative period is determined as the period of the timing data to be detected.

[0236] Optionally, the cycle identification module may also be used to: cut the target time series data to obtain at least two sub-time series data; and perform cycle identification on each of the sub-time series data to obtain a cycle corresponding to each of the sub-time series data.

[0237] Correspondingly, determining the period of the time series data to be detected may specifically include: determining the period obtained by period identification of the target time series data, whose degree of similarity with the period corresponding to each of the sub-time series data is greater than or equal to a preset threshold, as the period of the time series data to be detected.

[0238] Optionally, the upper and lower limit determination module can be used to: obtain trend item data in the target time series data; subtract the trend item data from the target time series data to obtain first data; determine data of a cycle length of the first data within the change point interval to obtain single-cycle data; the change point interval is a data interval in the target time series data where the trend changes smoothly; smooth the single-cycle data to obtain a single-cycle baseline; copy and connect multiple single-cycle baselines to obtain a complete baseline; move the complete baseline according to preset rules to obtain the current upper and lower limits.

[0239] Optionally, the above-mentioned moving the complete baseline according to preset rules to obtain the current upper and lower limits may specifically include: calculating the difference between the target time series data and the complete baseline; performing quantile calculation on the difference to determine the baseline moving amplitude; moving the complete baseline according to the baseline moving amplitude to obtain the current upper and lower limits.

[0240] Optionally, the upper and lower limit determination module can also be used for: if the period is not 0, using the Bayesian change point detection method to detect the moment when the trend changes in the target time series data; based on the moment when the trend changes, determining the change point interval where the trend changes smoothly; if the period is 0, determining the target time series data as the change point interval.

[0241] Optionally, the device may also include a correction module, which can be used to: use the current upper and lower limits to eliminate abnormal points in the target time series data to obtain first eliminated data; extract a first baseline corresponding to the first eliminated data; based on the first baseline, determine the first upper and lower limits corresponding to the first eliminated data; determine whether the first similarity between the first upper and lower limits and the current upper and lower limits is greater than or equal to a third preset threshold; if the first similarity is greater than or equal to the third preset threshold, determine the first upper and lower limits as valid upper and lower limits.

[0242] Correspondingly, the above-mentioned judging whether the time series data to be detected exceeds the current upper and lower limits may specifically include: judging whether the time series data to be detected exceeds the valid upper and lower limits.

[0243] Optionally, the correction module can also be used to: if the first similarity is less than the third preset threshold, use the first upper and lower limits to eliminate abnormal points in the target time series data to obtain second eliminated data; extract the second baseline corresponding to the second eliminated data; based on the second baseline, determine the second upper and lower limits corresponding to the second eliminated data; determine whether the second similarity between the second upper and lower limits and the first upper and lower limits is greater than or equal to a fourth preset threshold; if the second similarity is greater than or equal to the fourth preset threshold, determine the second upper and lower limits as valid upper and lower limits.

[0244] Optionally, the device may also include a first rule judgment module, which can be used to: calculate the first-order difference of the target time series data to obtain first result data; use a first clustering algorithm to determine a first abnormal data set corresponding to the first result data; calculate the periodic difference value of the first-order difference of the target time series data to obtain second result data; use a second clustering algorithm to determine a second abnormal data set corresponding to the second result data; and determine the common abnormal data of the first abnormal data set and the second abnormal data set contained in the time series data to be detected as abnormal data.

[0245] Optionally, the device may also include a second rule judgment module, which can be used to: smooth the target time series data to obtain smoothed data; determine the stable interval contained in the smoothed data; the stable interval is a data interval with a change amplitude less than or equal to a fifth preset threshold; determine whether the stable interval is within the period interval of the target time series data; if the stable interval is not within the period interval, determine that the data in the stable interval is abnormal data.

[0246] Optionally, the device may also include a prediction module, which can be used to: intercept a first preset number of time series data from the period data of historical target time series data according to the period of historical time series data to be detected; the historical target time series data includes the historical time series data to be detected and a preset number of historical time series data before the historical time series data to be detected; determine the intercepted first preset number of time series data as predicted period item data; intercept a second preset number of time series data from the historical time series data corresponding to the historical time series data to be detected; fit the intercepted second preset number of time series data to obtain predicted trend item data; add the predicted period item data and the predicted trend item data to obtain a predicted baseline; move the predicted baseline using the baseline movement amplitude calculated in the process of determining the current upper and lower limits of the historical time series data to be detected to obtain the predicted upper and lower limits.

[0247] Optionally, the time series data to be detected may include at least one of system indicator data and business data; the system indicator data includes at least one of CPU utilization, GPU utilization, memory occupancy, and QPS (Queries Per Second) query rate per second; the business data includes at least one of visits, transaction volume, transaction amount, payment amount, traffic flow, electricity consumption, and agricultural output.

[0248] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method.

[0249] Figure 4 This is a schematic diagram of the structure of a time series data detection device provided in an embodiment of this specification. Figure 4 As shown, the device 400 may include:

[0250] at least one processor 410; and,

[0251] A memory 430 is communicatively connected to the at least one processor; wherein,

[0252] The memory 430 stores instructions 420 that can be executed by the at least one processor 410. The instructions are executed by the at least one processor 410 so that the at least one processor 410 can perform the above-mentioned method for detecting time series data.

[0253] Based on the same idea, the embodiment of this specification also provides a computer-readable medium corresponding to the above method. The computer-readable medium stores computer-readable instructions, and the computer-readable instructions can be executed by a processor to implement the above method for detecting time series data.

[0254] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. Figure 4 As for the device shown, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0255] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0256] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0257] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0258] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0259] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0260] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0261] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0262] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0263] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0264] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0265] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0266] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0267] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0268] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0269] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0270] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for detecting time series data, comprising: Obtain target time series data including the time series data to be detected; The target time series data also includes target historical time series data within a preset time period before the time series data to be detected; Based on the target time series data, determine whether the time series data to be detected meets the first prediction condition and the second prediction condition; the first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data; the second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to the first preset threshold; If the time series data to be detected meets the first prediction condition and the second prediction condition, it is determined that the time series data to be detected has no abnormality.

2. According to the method of claim 1, determining whether the time series data to be detected meets the first prediction condition specifically comprises: Determine whether the value of the time series data to be detected exceeds the data interval represented by the predicted upper and lower limits, and determine whether the timestamp of the time series data to be detected exceeds the time period corresponding to the predicted upper and lower limits; If the value of the time series data to be detected is within the data interval represented by the prediction upper and lower limits and the timestamp of the time series data to be detected is within the time period corresponding to the prediction upper and lower limits, it is determined that the time series data to be detected meets the first prediction condition.

3. The method according to claim 1, further comprising: If the time series data to be detected does not meet the first prediction condition or the second prediction condition, determining the current upper and lower limits based on the target time series data; Determine whether the time series data to be detected exceeds the current upper and lower limits; If the time series data to be detected does not exceed the current upper and lower limits, it is determined that the time series data to be detected has no abnormality; If the time series data to be detected includes data exceeding the current upper and lower limits, the time series data exceeding the current upper and lower limits in the time series data to be detected is determined as abnormal data.

4. The method according to claim 1, after acquiring the target time series data including the time series data to be detected, further comprising: Perform period identification on the target time series data to determine the period of the time series data to be detected.

5. According to the method of claim 4, the step of performing period identification on the target time series data and determining the period of the time series data to be detected specifically comprises: Extracting period item data from the target time series data; Performing fast Fourier transform processing on the periodic term data to obtain a first transformation result; Determine the period value corresponding to each peak value in the first transformation result as a candidate period; If the candidate period includes one period, determining the candidate period as the period of the time series data to be detected; If the candidate period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods is determined as the period of the time series data to be detected.

6. The method according to claim 5, further comprising: Selecting a period that satisfies the first verification condition and / or the second verification condition from the candidate periods to obtain a candidate period; Wherein, the first verification condition is a period located on the peak of the autocorrelation result; the autocorrelation result is a result obtained by performing autocorrelation calculation on the periodic item data; the second verification condition is a period whose energy ratio is less than or equal to a second preset threshold; for any candidate period among the candidate periods, the energy ratio is a ratio of the energy of a second transformation result obtained by performing fast Fourier transformation on the verification residual data to the energy of the first transformation result; the verification residual data is a difference between the periodic result data obtained by periodically decomposing the periodic item data using any candidate period and the periodic item data; If the candidate cycle includes one cycle, determining the candidate cycle as the cycle of the time series data to be detected specifically includes: if the candidate cycle includes one cycle, determining the candidate cycle as the cycle of the time series data to be detected; If the candidate period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods is determined as the period of the time series data to be detected, specifically including: if the alternative period includes multiple periods, the period with the largest peak value in the first transformation result among the multiple periods included in the alternative period is determined as the period of the time series data to be detected.

7. The method according to claim 4, further comprising: Splitting the target time series data to obtain at least two sub-time series data; Performing period identification on each of the sub-time series data to obtain a period corresponding to each of the sub-time series data; The determining the period of the time series data to be detected specifically includes: Among the cycles obtained by period identification of the target time series data, the cycles whose degree of similarity with the cycles corresponding to each of the sub-time series data is greater than or equal to a preset threshold are determined as the cycles of the time series data to be detected.

8. According to the method of claim 3, determining the current upper and lower limits based on the target time series data specifically comprises: Acquire trend item data in the target time series data; Subtract the trend item data from the target time series data to obtain first data; Determine a period length of the first data within a change point interval to obtain single-period data; the change point interval is a data interval in which the trend of the target time series data changes steadily; Performing smoothing processing on the single-cycle data to obtain a single-cycle baseline; Copying and connecting multiple single-cycle baselines to obtain a complete baseline; The complete baseline is moved according to a preset rule to obtain the current upper and lower limits.

9. The method according to claim 8, wherein the step of moving the complete baseline according to a preset rule to obtain the current upper and lower limits specifically comprises: Calculating the difference between the target time series data and the complete baseline; Calculating the quantile of the difference to determine the baseline shift amplitude; The complete baseline is moved according to the baseline moving amplitude to obtain the current upper and lower limits.

10. The method according to claim 8, further comprising: If the period is not 0, a Bayesian change point detection method is used to detect the moment when the trend in the target time series data changes; According to the time when the trend changes, determining the change point interval where the trend changes steadily; If the period is 0, the target time series data is determined as the change point interval.

11. The method according to claim 3, The method further comprises: Using the current upper and lower limits to eliminate abnormal points in the target time series data, to obtain first eliminated data; Extracting a first baseline corresponding to the first eliminated data; Based on the first baseline, determining first upper and lower limits corresponding to the first eliminated data; Determine whether a first similarity between the first upper and lower limits and the current upper and lower limits is greater than or equal to a third preset threshold; If the first similarity is greater than or equal to a third preset threshold, determining the first upper and lower limits as valid upper and lower limits; The determining whether the time series data to be detected exceeds the current upper and lower limits specifically includes: Determine whether the time series data to be detected exceeds the valid upper and lower limits.

12. The method according to claim 11, further comprising: If the first similarity is less than the third preset threshold, using the first upper and lower limits to eliminate abnormal points in the target time series data to obtain second eliminated data; Extracting a second baseline corresponding to the second eliminated data; Based on the second baseline, determining second upper and lower limits corresponding to the second eliminated data; Determine whether a second similarity between the second upper and lower limits and the first upper and lower limits is greater than or equal to a fourth preset threshold; If the second similarity is greater than or equal to a fourth preset threshold, the second upper and lower limits are determined as valid upper and lower limits.

13. The method according to claim 1, further comprising: Calculating the first-order difference of the target time series data to obtain first result data; Determine a first abnormal data set corresponding to the first result data using a first clustering algorithm; Calculating a period difference value of a first-order difference of the target time series data to obtain second result data; Determine a second abnormal data set corresponding to the second result data using a second clustering algorithm; Common abnormal data of the first abnormal data set and the second abnormal data set included in the time series data to be detected is determined as abnormal data.

14. The method according to claim 1, further comprising: Smoothing the target time series data to obtain smoothed data; Determining a stationary interval contained in the smoothed data; The stable interval is a data interval whose variation range is less than or equal to the fifth preset threshold; Determine whether the stable interval is within the period interval of the target time series data; If the stable interval is not within the periodic interval, the data within the stable interval is determined to be abnormal data.

15. According to the method of claim 1, the prediction upper and lower limits based on the historical time series data are generated by the following steps: According to the cycle of the historical time series data to be detected, a first preset number of time series data is intercepted from the cycle data of the historical target time series data; the historical target time series data includes the historical time series data to be detected and a preset number of historical time series data before the historical time series data to be detected; Determining the intercepted first preset quantity of time series data as prediction period item data; Extracting a second preset amount of time series data from the historical time series data corresponding to the historical time series data to be detected; Fitting the intercepted second preset number of time series data to obtain predicted trend item data; Adding the forecast period item data to the forecast trend item data to obtain a forecast baseline; The predicted baseline is moved using the baseline movement amplitude calculated in the process of determining the current upper and lower limits of the historical time series data to be detected to obtain the predicted upper and lower limits.

16. According to the method described in claim 1, the time series data to be detected includes at least one of system indicator data and business data; the system indicator data includes at least one of CPU usage, GPU usage, memory occupancy, and QPS query rate per second; the business data includes at least one of visit volume, transaction volume, transaction amount, payment amount, traffic flow, electricity consumption, and agricultural output.

17. A device for detecting time series data, comprising: A data acquisition module, used to acquire target time series data including time series data to be detected; The target time series data also includes target historical time series data within a preset time period before the time series data to be detected; A judgment module, for judging whether the time series data to be detected meets a first prediction condition and a second prediction condition based on the target time series data; the first prediction condition is that the time series data to be detected does not exceed the upper and lower limits of the prediction obtained based on the historical time series data; the second prediction condition is that the difference between the period size of the time series data to be detected and the period size of the adjacent historical time series data to be detected is less than or equal to a first preset threshold; The result determination module is used to determine that the time series data to be detected has no abnormality if the time series data to be detected meets the first prediction condition and the second prediction condition.

18. A time series data detection device, comprising: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method for detecting time series data according to any one of claims 1 to 16.

19. A computer-readable medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method for detecting time series data according to any one of claims 1 to 16.

Images