Abnormality detection method and device, electronic equipment and computer storage medium

Abstract

The invention is suitable for the technical field of industrial control equipment anomaly detection, and provides an anomaly detection method and device, electronic equipment and a computer storage medium, and the method comprises the steps: obtaining historical data corresponding to a target index in each threshold value updating period corresponding to the target index, the target index is any index corresponding to the target equipment; updating the current numerical value interval based on the historical data and a preset numerical value adjusting parameter; judging whether the real-time index value corresponding to the target index is located in the updated current value interval or not; and under the condition that the real-time index value exceeds the updated current value interval, determining that the target equipment works abnormally. The accuracy of anomaly detection of the industrial control equipment is improved by dynamically updating the current numerical value interval.

Description

Technical Field

[0001] The present application belongs to the technical field of abnormality detection of industrial control equipment, and in particular, relates to an abnormality detection method, device, electronic equipment and computer storage medium. Background Art

[0002] With the rapid development of industrial technology and intelligent manufacturing, industrial control equipment has become an indispensable part of the industrial production process. Therefore, the anomaly detection of industrial control equipment has attracted more and more attention in the industry.

[0003] At present, the abnormality detection method for industrial control equipment is usually to set a fixed threshold in advance according to the parameter range of the industrial control equipment under normal operating conditions, or to collect historical data of the industrial control equipment under normal operating conditions and analyze the historical data to obtain a fixed threshold. Then, during abnormality detection, the currently collected data is compared with the threshold to determine whether the industrial control equipment is working abnormally and whether an alarm message is generated. Although this method is simple and easy to implement, the threshold is static and fixed and cannot adapt to the dynamic changes in the operating status of the industrial control equipment. It is difficult to fully reflect the actual operating conditions of the industrial control equipment, resulting in false alarms or missed alarms from time to time, and the accuracy of abnormality detection is not high.

[0004] Therefore, how to improve the accuracy of anomaly detection for industrial control equipment has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide anomaly detection methods, devices, electronic devices, and computer storage medium methods and devices, which can solve the problem of how to improve the accuracy of anomaly detection of industrial control equipment.

[0006] In a first aspect, an embodiment of the present application provides an anomaly detection method, comprising:

[0007] In each threshold update cycle corresponding to the target indicator, historical data corresponding to the target indicator is obtained, the target indicator corresponds to a current value interval, and the target indicator is any indicator corresponding to the target device;

[0008] Based on historical data and preset numerical adjustment parameters, update the current numerical range;

[0009] When the real-time indicator value corresponding to the target indicator is outside the updated current value interval, it is determined that the target device is operating abnormally.

[0010] In some embodiments, determining whether the real-time indicator value corresponding to the target indicator is within the updated current value interval further includes:

[0011] According to the current time and the threshold update cycle, determine the valid time period corresponding to the updated current value interval;

[0012] When the generation time of the real-time indicator value is within the valid period, it is determined whether the real-time indicator value is within the updated current value interval.

[0013] In some embodiments, determining that the target device operates abnormally includes:

[0014] In the case where the real-time indicator value exceeds the updated current value interval, the real-time indicator value is determined to be abnormal data, and the abnormal data and the target indicator are associated and stored in a preset storage location;

[0015] In the preset storage location, the total number of abnormal data within the preset alarm time window corresponding to the target indicator is counted;

[0016] When the total number is greater than or equal to the abnormal threshold corresponding to the target indicator, it is determined that the target device is operating abnormally.

[0017] In some embodiments, obtaining historical data corresponding to the target indicator includes:

[0018] When the target indicator corresponds to the first preset acquisition method, determining a first historical time range corresponding to the current time;

[0019] Determine each historical period corresponding to the current time within the first historical time range, and obtain the indicator value corresponding to the target indicator in each historical period;

[0020] When the target indicator corresponds to the second preset acquisition method, determining a second historical time range corresponding to the current time;

[0021] Get the indicator value corresponding to the target indicator within the second historical time range.

[0022] In some embodiments, based on historical data and preset numerical adjustment parameters, updating the current numerical range includes:

[0023] Sort historical data in a preset order;

[0024] Determine the benchmark value interval corresponding to the target indicator from the sorted historical data;

[0025] The reference numerical range is adjusted according to the numerical adjustment parameter, and the adjusted reference numerical range is used as the update result of the current numerical range.

[0026] In some embodiments, the reference value interval includes a reference upper limit value and a reference lower limit value, the updated current value interval includes an indicator upper limit value and an indicator lower limit value, and the value adjustment parameter includes a weight parameter and an offset parameter;

[0027] The reference value range is adjusted according to the value adjustment parameters, including:

[0028] The product of the benchmark difference and the benchmark weight is determined as the benchmark indicator threshold corresponding to the target indicator. The benchmark difference is the difference between the benchmark upper limit and the benchmark lower limit, and the benchmark weight is the sum of the weight parameter and the offset parameter.

[0029] The sum of the benchmark indicator threshold, the benchmark lower limit value and the offset parameter is determined as the indicator upper limit value;

[0030] determining a first difference between the benchmark upper limit value and the benchmark indicator threshold value;

[0031] The difference between the first difference value and the offset parameter is determined as the indicator lower limit value.

[0032] In some embodiments, the method further comprises:

[0033] When it is determined that the target device is operating abnormally, an alarm message is generated based on all abnormal data corresponding to the target indicator in the preset storage location, and all abnormal data corresponding to the target indicator in the preset storage location is cleared. The alarm message is used to indicate that the target device is operating abnormally within the effective period.

[0034] In a second aspect, an embodiment of the present application provides an abnormality detection device, including:

[0035] An acquisition module, used for acquiring historical data corresponding to a target indicator in each threshold update cycle corresponding to the target indicator, the target indicator corresponding to a current value interval, and the target indicator is any indicator corresponding to the target device;

[0036] An update module, used to update the current value range based on historical data and preset value adjustment parameters;

[0037] The determination module is used to determine that the target device is operating abnormally when the real-time indicator value is outside the updated current value interval.

[0038] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements the anomaly detection method as described in any embodiment of the first aspect.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, including: the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the anomaly detection method as described in any embodiment of the first aspect is implemented.

[0040] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the anomaly detection method described in any one of the above-mentioned first aspects.

[0041] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0042] Through the threshold update cycle corresponding to the target indicator of the target device, the corresponding historical data is periodically obtained to achieve dynamic acquisition of historical data, avoiding only obtaining historical data based on a specific time period, and based on the obtained historical data and the preset numerical adjustment parameters, the current numerical interval corresponding to the target indicator is updated to achieve dynamic adjustment of the threshold range corresponding to the target indicator, so that the threshold in the updated current data interval can better adapt to the dynamic changes in the operating state of the target device (such as industrial control equipment) and reflect the actual operation of the industrial control equipment. In this way, the target device is detected for anomalies based on the real-time indicator values ​​corresponding to the target indicators collected at different times and the latest current numerical interval at the current time, achieving the purpose of detecting anomalies of industrial control equipment based on the dynamically changing current numerical interval, considering the impact of the dynamic changes in the operating data when the equipment is running on the indicator value, thereby improving the accuracy of anomaly detection of industrial control equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 It is a structural schematic diagram of an anomaly detection system applicable to the anomaly detection method of the present application provided in an embodiment of the present application;

[0045] Figure 2 It is a flowchart of an anomaly detection method provided in an embodiment of the present application;

[0046] Figure 3 It is a schematic diagram of the workflow of an anomaly detection method in an application scenario of an embodiment of the present application;

[0047] Figure 4 is a schematic diagram of a threshold configuration interface in an application scenario of an embodiment of the present application;

[0048] Figure 5 It is a workflow diagram for updating the current numerical interval corresponding to the target indicator in an application scenario of an embodiment of the present application;

[0049] Figure 6 is a flowchart of another anomaly detection method provided in an embodiment of the present application;

[0050] Figure 7 This is a schematic diagram of the workflow of generating alarm information in an application scenario of an embodiment of the present application;

[0051] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0052] Fig. 9 It is a structural schematic diagram of an abnormality detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0054] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0055] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0056] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0057] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0058] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0059] In response to the problems in the background technology, the embodiments of the present application provide an anomaly detection method, device, electronic device and computer storage medium, which utilize information such as pre-configured threshold update cycles corresponding to various indicators of target devices, such as industrial control equipment, to achieve dynamic acquisition of historical data and dynamic update of the current numerical range corresponding to the indicators, thereby improving the accuracy of identifying abnormal states of industrial control equipment.

[0060] Figure 1 is a schematic diagram of the structure of an anomaly detection system applicable to the anomaly detection method of the present application, such as Figure 1 The system shown includes a server, a gateway and at least one industrial control device, and the gateway is electrically connected to each industrial control device via at least one gateway probe.

[0061] The gateway is used to collect, for each industrial control device, a real-time indicator value corresponding to at least one indicator of the industrial control device through a gateway probe connected to the industrial control device, and send the collected real-time indicator value to the server;

[0062] The server is used to store the real-time indicator value corresponding to each indicator of each industrial control device sent by the gateway; in response to the user's configuration operation on any indicator of any industrial control device, generate and store the configuration information corresponding to the indicator, the configuration information includes the threshold update period corresponding to the indicator and the preset data adjustment parameters; in each threshold update period corresponding to the indicator, obtain the historical data corresponding to the indicator, the indicator corresponds to a current numerical range; when the real-time indicator value corresponding to the indicator is received at the current time, determine whether the real-time indicator value corresponding to the indicator is within the updated current numerical range, and when the real-time indicator value corresponding to the indicator is outside the updated current numerical range, determine that the target device to which the indicator belongs is operating abnormally.

[0063] In some embodiments, the system also includes a display screen; the server is further used to display a threshold configuration interface on the display screen, so as to facilitate the user to pre-configure the configuration information corresponding to any indicator of any industrial control device.

[0064] In some embodiments, the user can input attribute information corresponding to any industrial control device in the displayed threshold configuration interface, and the attribute information includes the device identification, indicator set and device type corresponding to the industrial control device. The server is also used to receive the attribute information corresponding to the industrial control device entered by the user in the threshold configuration interface, query the device type in its own device library, and if the device type exists in the device library, bind the indicator set and the device identification of the industrial control device to the device type; if the device type does not exist in the device library, the indicator set, the device identification of the industrial control device and the device type are associated and stored in the device library to facilitate future data queries.

[0065] The following describes in detail the abnormality detection method of the embodiment of the present application. Figure 2 The flowchart of an abnormality detection method in the implementation of the present application is shown, and the method includes the following steps:

[0066] Step S101, obtaining historical data corresponding to the target indicator within each threshold update period corresponding to the target indicator.

[0067] The abnormality detection method of this embodiment can be performed by a computer, a notebook, a desktop computer or Figure 1 The server or other electronic device shown is executed, and the embodiments of the present application do not limit the specific type of electronic device.

[0068] In this embodiment, the target indicator corresponds to a current numerical range, and the target indicator is any indicator corresponding to the target device. The electronic device pre-stores configuration information corresponding to multiple indicators under multiple industrial control devices, and the configuration information includes a threshold update cycle corresponding to the indicator and a preset data adjustment parameter, and the target device is any one of the multiple industrial control devices. The electronic device can periodically read the configuration information corresponding to each indicator under each industrial control device. For any indicator under any device, that is, for the target indicator under the target device, the electronic device can determine the threshold update cycle corresponding to the target indicator based on the configuration information corresponding to the target indicator. Within each threshold update cycle corresponding to the target indicator, determine the historical time range corresponding to the current time, and obtain the indicator value corresponding to the target indicator in the historical time range, so as to obtain historical data.

[0069] In one implementation, the electronic device may provide a threshold configuration interface, and in response to a user's creation operation for configuration information of a target indicator, pre-generate configuration information corresponding to the target indicator.

[0070] In one implementation, obtaining historical data corresponding to the target indicator includes the following steps (1) to (4):

[0071] Step (1), when the target indicator corresponds to the first preset acquisition method, determine the first historical time range corresponding to the first acquisition method corresponding to the current time.

[0072] The first preset acquisition method includes a historical time range determined based on the current time, and each historical period corresponding to the current time within the historical time range, and also includes a threshold update period corresponding to the target indicator. It can be understood that the electronic device can preferentially determine the threshold update period corresponding to the target indicator based on the first preset acquisition method or the second preset acquisition method corresponding to the target indicator, and then parse the first preset acquisition method or the second preset acquisition method to determine the specific method for obtaining the indicator value corresponding to the target indicator.

[0073] Step (2) determines each historical time period corresponding to the current time within the first historical time range, and obtains the indicator value corresponding to the target indicator in each historical time period.

[0074] In one implementation, the first preset acquisition method may be: take the hourly data for each day in the past week, and update the current numerical value interval once an hour. Then the electronic device can determine that the threshold update cycle corresponding to the target indicator is 1 hour, the historical time range is the week before the date of the current time, and each historical period is a period corresponding to the current time every day and delayed by one hour. For example, assuming that within a threshold update cycle corresponding to the target indicator, the current time is 14:00 on February 8, then the historical time range is from February 1 to February 7, and each historical period is from 14:00 to 15:00 every day from February 1 to February 7. The electronic device can use the indicator value corresponding to the target indicator from 14:00 to 15:00 every day from February 1 to February 7 as historical data.

[0075] In one implementation, the first preset acquisition method may be: take the data of the current day of each week in the past month, and update the current value interval once a day. Then the electronic device can determine that the threshold update cycle corresponding to the target indicator is 1 day, the historical time range is the month before the current date, and each historical period is the day of the week of the current time in each week of the previous month. Still referring to the above example, if February 8 is Wednesday, the historical time range is January 7 to February 7, and every Wednesday in the historical period from January 7 to February 7.

[0076] Step (3), when the target indicator corresponds to the second preset acquisition method, determine the second historical time range corresponding to the current time.

[0077] Step (4), obtaining the indicator value corresponding to the target indicator within the second historical time range.

[0078] The second preset acquisition method includes a historical time range determined based on the current time, and also includes a threshold value update period corresponding to the target indicator.

[0079] In one implementation, the second preset acquisition method may be: take the data of the past day and update the current value interval every 10 minutes. Then the electronic device may determine that the threshold update period corresponding to the target indicator is 10 minutes, and the historical time range is the day before the current date. Still referring to the above example, the historical time range is February 7.

[0080] In one implementation, the second preset acquisition method may be: take the data of the past week and update the current value interval once an hour. Then the electronic device may determine that the threshold update cycle corresponding to the target indicator is 1 hour, and the historical time range is the week before the current date. Still referring to the above example, the historical time range is from February 1 to February 7.

[0081] In the above technical solution, different historical time ranges are selected according to different preset acquisition methods and different current time dynamics, or the values ​​of each indicator in different historical periods within the historical time range are selected as historical data, so as to ensure the dynamic change of historical data when the current numerical range corresponding to the target indicator is subsequently updated, and then the updated current numerical range changes dynamically, thereby improving the accuracy of subsequent anomaly detection.

[0082] In one application scenario, combined with Figure 1 , Figure 3 as well as Figure 4 , situational awareness platform (the platform is concentrated in electronic equipment, which is Figure 1 The server shown in the figure first performs the device initialization step to enable the platform to access the data of the industrial control device under test. Specifically, the platform first collects the indicator values ​​corresponding to the indicators of the industrial control device under test through the gateway. After the indicator value collection is completed, the platform can generate the industrial control device assets corresponding to the industrial control device (an example of device identification) based on the indicator values. At this time, the user needs to manually import the physical model (an example of an indicator set) of the indicator values ​​corresponding to the industrial control device collected by the gateway into the electronic device. The electronic device will bind the physical model to the industrial control device assets to facilitate subsequent queries on the configuration information corresponding to the indicators of the industrial control device.

[0083] Afterwards, the user can configure the threshold model of any indicator corresponding to the industrial control equipment (an example of configuration information corresponding to any indicator). Figure 4, the platform can display the relevant configuration interface (an example of the threshold configuration interface), in which the user sets the name of any monitored indicator in the monitored industrial control equipment, selects the applicable asset type corresponding to the industrial control equipment (an example of the equipment type), and then specifies the industrial control equipment asset (i.e., the applicable asset) that the threshold model is adapted to the industrial control equipment. Furthermore, the platform can query and display the indicators of the industrial control equipment that can be monitored by the platform based on the object model bound to the industrial control equipment asset, so that the user can select the indicator applicable to the threshold model in the configuration interface.

[0084] Then the user can set the threshold generation strategy of the threshold model in the configuration interface (used to instruct the electronic device to update the current numerical range corresponding to the target indicator based on historical data and data adjustment parameters). The user can select the sensitivity level (an example of a numerical adjustment parameter, the sensitivity level affects the fluctuation range of the generated threshold) and select the baseline frequency (an example of the first or second preset acquisition method, the baseline frequency includes the threshold update period and the historical time range, in other words, the baseline frequency limits the time window of the generated indicator threshold range). Exemplarily, four baseline frequencies may be included, namely:

[0085] Year-on-year daily baseline (an example of the first preset acquisition method): take the hourly data of each day in the past week and generate a threshold range once an hour (an example of updating the current value difference);

[0086] Year-on-year weekly baseline (another example of the first preset acquisition method): take the data of the current day of each week in the past month and generate a threshold range once a day;

[0087] The month-on-month daily baseline (an example of the second preset acquisition method): take the data of the past day and generate a threshold range every 10 minutes;

[0088] Weekly baseline (another example of the second preset acquisition method): take the data of the past week and generate the (indicator) threshold range once an hour.

[0089] After the configuration is completed, the user clicks the Save button to save the configuration, and the electronic device can then obtain the corresponding historical data and regularly update the indicator threshold range corresponding to the target indicator (an example of the current numerical range) to facilitate subsequent abnormal detection of the target device.

[0090] Step S102: updating the current numerical range based on historical data and preset numerical adjustment parameters.

[0091] The configuration information also includes the numerical adjustment parameters corresponding to the indicators, and the historical data includes multiple indicator values ​​corresponding to the target indicator at multiple historical times. In one example, the electronic device can perform statistical distribution or data quantile processing on each indicator value in the historical data, determine an upper limit value and a lower limit value, and then adjust the upper limit value and the lower limit value based on the numerical adjustment parameters to obtain the latest numerical interval, and use the obtained numerical interval as the updated current numerical interval.

[0092] In one implementation, based on historical data and preset numerical adjustment parameters, the current numerical range is updated, including:

[0093] Sort historical data in a preset order;

[0094] Determine the benchmark value interval corresponding to the target indicator from the sorted historical data;

[0095] The reference numerical range is adjusted according to the numerical adjustment parameter, and the adjusted reference numerical range is used as the update result of the current numerical range.

[0096] The electronic device can sort the indicator values ​​in the historical data in ascending order, and select the indicator values ​​of the low percentile (for example, 15th percentile or 20th percentile, etc.) and the high percentile (85th percentile or 90th percentile, etc.) from the sorted historical data, and the selected indicator values ​​form the benchmark value interval. The electronic device can subsequently adjust the indicator values ​​in the benchmark value interval upward or downward based on the numerical adjustment parameters to obtain the adjusted benchmark value interval, thereby updating the current value interval corresponding to the target indicator.

[0097] In the above technical solution, a reference value interval is first determined based on the sorted historical data, and then the reference value interval is adjusted based on the value adjustment parameter to update the current value interval. By introducing the value adjustment parameter, further dynamic adjustment of the reference data value interval is achieved, taking into account the actual working conditions of the industrial control equipment, so that the adjusted value interval can reflect the actual operating conditions of the industrial control equipment, thereby improving the reliability of the update of the current value interval, and further improving the accuracy of equipment abnormality detection.

[0098] In one implementation, the reference value interval includes a reference upper limit value and a reference lower limit value, the updated current value interval includes an indicator upper limit value and an indicator lower limit value, and the value adjustment parameter includes a weight parameter and an offset parameter;

[0099] The reference value range is adjusted according to the value adjustment parameters, including:

[0100] The product of the benchmark difference and the benchmark weight is determined as the benchmark indicator threshold corresponding to the target indicator. The benchmark difference is the difference between the benchmark upper limit and the benchmark lower limit, and the benchmark weight is the sum of the weight parameter and the offset parameter.

[0101] The sum of the benchmark indicator threshold, the benchmark lower limit value and the offset parameter is determined as the indicator upper limit value;

[0102] determining a first difference between the benchmark upper limit value and the benchmark indicator threshold value;

[0103] The difference between the first difference value and the offset parameter is determined as the indicator lower limit value.

[0104] The electronic device may determine the upper limit value of the indicator in the updated current numerical interval by the following formula 1, and may determine the lower limit value of the indicator in the updated current numerical interval by the following formula 2.

[0105] Formula 1: UpperValue=(item.Q1-item.Q2)*(K+sensitive)+item.Q2+K;

[0106] Formula 2: LowerValue=item.Q1-(item.Q1-item.Q2)*(K+sensitive)-K;

[0107] Among them, item.Q1 represents the benchmark upper limit, item.Q2 represents the benchmark lower limit, UpperValue represents the indicator upper limit, LowerValue represents the indicator lower limit, K represents the offset parameter, sensitive represents the weight parameter, item.Q1-item.Q2 represents the benchmark difference, and K+sensitive represents the benchmark weight.

[0108] In the above technical solution, after obtaining the benchmark numerical interval, the difference between the benchmark upper limit value and the benchmark lower limit value is multiplied by the benchmark weight to obtain the benchmark indicator threshold, and the benchmark upper limit value and the benchmark lower limit value are adjusted based on the benchmark indicator threshold and the offset parameter, so as to obtain the corresponding updated current numerical interval. The weight parameter corresponding to the target indicator is used to realize the flexible adjustment of the benchmark numerical interval, and the offset parameter is introduced to add an additional adjustment factor to the adjustment of the benchmark numerical interval, which further increases the flexibility of the adjustment of the benchmark numerical interval. The benchmark upper limit value and the benchmark lower limit value can also be displaced by the offset parameter to ensure that even in the extreme case where the benchmark upper limit value and the benchmark lower limit value are close, the final indicator upper limit value and the indicator lower limit value will not fall near zero, which provides a safety boundary for the updated current data difference, so that it can maintain a suitable range separation, thereby improving the reliable update of the current data indicator corresponding to the target indicator, and providing a reliable data basis for subsequent anomaly detection.

[0109] In one application scenario, combined with Figures 3 to 5 , users can configure the sensitivity (an example of weight parameter) and other information corresponding to any indicator of any industrial control device in the configuration interface, and the threshold model can be enabled after the user configuration is completed. The situation awareness platform can extract the threshold model regularly and generate the indicator threshold range according to the configuration in the threshold model. After obtaining the threshold model corresponding to any indicator, the situation awareness platform can determine whether the time at that time meets the time window requirement of the baseline frequency in the threshold model (that is, whether the time difference between the current time and the start time calculated from the start time is the time interval indicated by the threshold update cycle). If not, the current process will be repeated. If it is satisfied, the historical data corresponding to the corresponding indicator in the corresponding industrial control device can be obtained based on the industrial control device assets, indicators and baseline frequency configured in the threshold model. If the corresponding industrial control device has been connected to the platform and successfully obtained historical data, the 85th percentile and 15th percentile of the historical data obtained will be used as the indicator high value (an example of the upper limit of the benchmark) and low value (an example of the lower limit of the benchmark) respectively, and then the indicator threshold range corresponding to the indicator at the current time will be updated (or generated) through formula 1 and formula 2.

[0110] Step S103: When the real-time indicator value corresponding to the target indicator is outside the updated current value interval, it is determined that the target device is operating abnormally.

[0111] When an electronic device collects or receives a real-time indicator value, it will search for the indicator value of which industrial control device the real-time indicator value belongs to at the current time based on the indicator identifier (for example, indicator name or indicator serial number, etc.) and device identifier (for example, device serial number or device name or device code, etc.) included in the real-time indicator value. If it is the indicator value of the target indicator under the target device, it will determine whether the real-time indicator value corresponding to the target indicator is within the updated current numerical range.

[0112] When the electronic device determines that the real-time indicator value corresponding to the target indicator is within the updated current value interval, the electronic device determines that the real-time indicator value is normal data and stores the data. If the electronic device determines that the real-time indicator value is outside the updated current value interval, it determines that the target device is working abnormally.

[0113] In one implementation, before determining that the target device is operating abnormally, the method further includes:

[0114] According to the current time and the threshold update cycle, determine the valid time period corresponding to the updated current value interval;

[0115] When the generation time of the real-time indicator value is within the valid period, it is determined whether the real-time indicator value is within the updated current value interval.

[0116] The electronic device will use the current time as the start time of the effective period, and the sum of the current time and the time interval in the threshold update cycle as the end time of the effective period. For example, if the current time is 15:00 and the threshold update cycle is updated every 1 hour, the start time is 15:00, the end time is 16:00, and the effective period is from 15:00 to 16:00.

[0117] After determining the valid time period corresponding to the updated current numerical interval, the electronic device will also store the updated current numerical interval and the valid time period in the cache corresponding to the target indicator, and delete the current numerical range (before update) corresponding to the target indicator in the cache, so that when the electronic device collects the real-time indicator value corresponding to the target indicator after the current time, it can quickly search the updated current numerical interval from the cache.

[0118] In the above technical scheme, within each threshold update cycle corresponding to the target indicator, the updated current numerical interval corresponds to different valid time periods, so that the target device is detected for anomalies only when the generation time of the real-time indicator value is within the corresponding valid time period, thereby achieving the unification of the updated current numerical interval and the real-time indicator value in the time dimension, avoiding comparing the real-time indicator values ​​of other time periods with the updated current numerical interval at the current time, reducing misjudgment and thus improving the accuracy of anomaly detection.

[0119] In one implementation, combining Figure 4 , determine whether the real-time indicator value is within the updated current value range, including:

[0120] When the threshold value mode corresponding to the target indicator is an upper threshold value and the real-time indicator value is less than or equal to the indicator upper limit value, determining that the real-time indicator value is within the updated current value interval;

[0121] When the threshold mode corresponding to the target indicator is a lower threshold and the real-time indicator value is greater than or equal to the indicator lower limit value, determining that the real-time indicator value is within the updated current value interval;

[0122] When the threshold mode corresponding to the target indicator is a dynamic threshold and the indicator lower limit value ≤ real-time indicator value ≤ indicator upper limit value, it is determined that the real-time indicator value is within the updated current value range.

[0123] The user can set the threshold method corresponding to the target indicator in the threshold configuration interface in advance, and the electronic device can subsequently determine whether the real-time indicator value is within the updated current value range based on the threshold method set by the user.

[0124] In one implementation, combining Figure 4 The user can also pre-set the threshold type corresponding to the target indicator in the threshold configuration interface. If the threshold type is a static threshold, the electronic device will determine the static numerical range corresponding to the target indicator based on the historical data corresponding to the target indicator within a preset historical time range; if the threshold type is a dynamic threshold, the electronic device executes the anomaly detection method of the embodiment of the present application.

[0125] Continue to combine Figures 3 to 5 After the situation awareness platform dynamically generates the indicator threshold range of the current time window (an example of the current numerical interval after the update), the time window from the current time to the next time node (determined based on the threshold update cycle) is added to the generated indicator threshold range as the threshold matching validity period (an example of the valid period), and then the indicator threshold range generated this time is added to the cache, and the indicator threshold range of the previous time node that has expired (also called the invalid indicator threshold range, an example of the current numerical interval before the update) is removed from the cache.

[0126] After the current situation awareness platform receives a piece of real-time operation data through the message queue telemetry transmission protocol (Message Queuing Teleme tryTransport, MQTT) (first determine whether the ID of the industrial control device in the data (an example of device identification) is the industrial control device managed by the platform. If the industrial control device is the industrial control device managed by the platform, then determine the threshold range of all non-invalid indicators associated with it based on the ID of the industrial control device (that is, the valid indicator threshold range, including the updated current value interval corresponding to the target indicator), and traverse the cache to compare each real-time indicator value in the real-time operation data with the relative motion valid indicator threshold range. If the indicator value corresponding to any of the indicators (an example of the real-time indicator value corresponding to the target indicator) exceeds the corresponding indicator threshold range, the real-time operation data is considered to be abnormal data. If the indicator values ​​corresponding to all the indicators do not exceed the corresponding indicator threshold range, the real-time operation data is considered to be normal, and the current cycle ends, waiting for the next comparison of the indicator threshold range of the real-time operation data.

[0127] In the embodiment of the present application, the corresponding historical data is periodically acquired through the threshold update cycle corresponding to the target indicator of the target device, and the dynamic acquisition of historical data is realized, avoiding the acquisition of historical data based on a specific time period only, and based on the acquired historical data and the preset numerical adjustment parameters, the current numerical interval corresponding to the target indicator is updated, and the threshold range corresponding to the target indicator is dynamically adjusted, so that the threshold in the updated current data interval better adapts to the dynamic changes in the operating state of the target device (such as industrial control equipment) and reflects the actual operation of the industrial control equipment. In this way, the target device is detected for abnormalities based on the real-time indicator value corresponding to the target indicator collected at different times and the latest current numerical interval at the current time, achieving the purpose of abnormal detection of industrial control equipment based on the dynamically changing current numerical interval, considering the impact of the dynamic change of operating data on the indicator value when the equipment is running, thereby improving the accuracy of abnormal detection of industrial control equipment.

[0128] Figure 6 FIG. 1 is a flow chart of another abnormality detection method in an embodiment of the present application. Figure 6 As shown, the method comprises the following steps:

[0129] Step S201: acquiring historical data corresponding to the target indicator within each threshold update period corresponding to the target indicator.

[0130] Step S202: updating the current numerical range based on historical data and preset numerical adjustment parameters.

[0131] For details of steps S201 to S202, see Figure 2Steps S101 to S102 in the embodiment are not described in detail here.

[0132] In one implementation, determining that the target device is operating abnormally includes the following steps S203 to S205:

[0133] Step S203, when the real-time indicator value is outside the updated current value interval, determine that the real-time indicator value is abnormal data, and store the abnormal data and the target indicator in a preset storage location in association.

[0134] The user can pre-configure the preset alarm time window and abnormal threshold corresponding to the target indicator in the threshold configuration interface, and the electronic device uses this preset alarm time window and abnormal threshold to determine whether to generate an alarm message.

[0135] In one application scenario, continue to refer to Figure 4 as well as Figure 3 When configuring the threshold model of any indicator corresponding to any industrial control equipment, the user can also configure the alarm generation strategy corresponding to the indicator in the threshold model, set the cumulative alarm time window (that is, the preset alarm time window, the time range of the platform statistics of alarm events, that is, the occurrence time of abnormal data) and the number of alarm exceeding the threshold (that is, the abnormal threshold, within the specified time window, the number of alarm event triggering is counted). For example, the cumulative alarm time window is 5 minutes and the number of alarm exceeding the threshold is 2 times.

[0136] Step S204: In a preset storage location, the total number of abnormal data within a preset alarm time window corresponding to the target indicator is counted.

[0137] In the preset storage location, the electronic device will count the storage time of each abnormal data corresponding to the target indicator, and then determine the total number of abnormal data in the preset alarm time window based on the time difference between the storage times of each abnormal data. For example, the preset alarm time window is 5 minutes, and there are 3 abnormal data corresponding to the target indicator in the preset storage location, and the storage times of the 3 abnormal data are 14:35, 14:36 ​​and 14:40 respectively, then the total number of abnormal data within 5 minutes (14:35 to 14:40) is 3.

[0138] Step S205: When the total number is greater than or equal to the abnormal threshold corresponding to the target indicator, it is determined that the target device is operating abnormally.

[0139] The abnormal threshold and the preset alarm time window can be set by the user in the threshold configuration interface, and the embodiment of the present application does not impose any specific restrictions.

[0140] In one implementation, the method further includes the following step S206:

[0141] Step S206, when it is determined that the target device is working abnormally, an alarm message is generated according to all abnormal data corresponding to the target indicator in the preset storage location, and all abnormal data corresponding to the target indicator in the preset storage location is cleared.

[0142] The alarm information is used to indicate that the target device is working abnormally during the effective period.

[0143] In one application scenario, combined with Figure 3 as well as Figure 7 As shown, the situation awareness platform receives the real-time operation data (an example of the target indicator corresponding to the real-time indicator value) of the monitored indicator (an example of the target indicator) of the industrial control equipment to be monitored (an example of the target equipment), and can find the threshold model corresponding to the indicator based on the ID of the industrial control equipment in the real-time operation data, so as to obtain the cumulative alarm time window, the number of alarm exceeding the threshold value and the effective indicator threshold range corresponding to the indicator (an example of the current value interval after the target indicator is updated). Compare the indicator value in the real-time operation data with the effective indicator threshold range to determine whether the indicator value in the real-time operation data exceeds the effective indicator threshold range. If not, end the process. If so, determine that the real-time operation data is abnormal data, add one to the number of abnormal data in the alarm cache (an example of a preset storage location), and then determine whether the number of abnormalities (the total number of abnormal data) in the cumulative alarm time window (that is, the preset alarm time window) meets the number of alarm exceeding the threshold value. If the condition is not met, the real-time operation data is stored in the alarm cache, and then the cycle is ended, and the next real-time operation data is compared. If the condition is met, the abnormal data in the alarm cache corresponding to the target indicator is cleared, and an alarm message is assembled at the same time. That is to say Figure 7 "If it exceeds the threshold range, it is considered to be an abnormal operation data, and the alarm cache corresponding to the indicator is obtained, and the alarm generation strategy in the matching threshold model" and "If the alarm generation strategy is met (including the storage time of the abnormal data is within the cumulative alarm time window, and the total number of abnormal data is greater than or equal to the number of alarm exceeding the threshold) requirements, the abnormal data in the alarm cache will be cleared, and then an alarm message will be generated."

[0144] In the embodiment of the present application, the actual abnormal frequency currently corresponding to the target indicator is determined based on the total number of abnormal data corresponding to the target indicator in the preset storage location and the storage time, so that when the actual abnormal frequency matches the preset abnormal frequency, the target device is determined to be working abnormally, so that the number of occurrences of abnormal data within a period of time is considered when judging the abnormality, rather than determining the abnormal operation of the target device based on a single abnormal data, and the efficiency of generating alarm information is optimized, thereby enhancing the adaptability of abnormal detection of industrial control equipment in complex environments, providing users with more accurate and timely equipment operation situation awareness services, and improving the accuracy of abnormal detection. In addition, alarm information is generated when it is determined that the target device is working abnormally, so that users can grasp the abnormal situation of industrial control equipment in a timely manner, and the user experience is friendly.

[0145] Figure 8 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 8 As shown, the electronic device 6 of this embodiment includes: at least one processor 60 ( Figure 8 Only one is shown in the figure) a processor, a memory 61, and a computer program 62 stored in the memory 61 and executable on the at least one processor 60, and when the processor 60 executes the computer program 62, the steps in any of the above-mentioned method embodiments are implemented.

[0146] The electronic device 6 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will appreciate that Figure 8 It is only an example of the electronic device 6 and does not constitute a limitation on the electronic device 6. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0147] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0148] In some embodiments, the memory 61 may be an internal storage unit of the electronic device 6, such as a hard disk or memory of the electronic device 6. In other embodiments, the memory 61 may also be an external storage device of the electronic device 6, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 6. Further, the memory 61 may also include both an internal storage unit of the electronic device 6 and an external storage device. The memory 61 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0149] Corresponding to the anomaly detection method described in the above embodiment, Fig. 9 A structural block diagram of an abnormality detection device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0150] Reference Fig. 9 , the device comprises:

[0151] An acquisition module 100 is used to acquire historical data corresponding to a target indicator in each threshold update period corresponding to the target indicator, wherein the target indicator corresponds to a current value interval, and the target indicator is any indicator corresponding to the target device;

[0152] An updating module 200, for updating the current numerical range based on historical data and preset numerical adjustment parameters;

[0153] The determination module 400 is used to determine that the target device is operating abnormally when the real-time indicator value corresponding to the target indicator is outside the updated current value interval.

[0154] In some embodiments, the apparatus further comprises:

[0155] The determination module is further used to determine the valid period corresponding to the updated current value interval according to the current time and the threshold update cycle;

[0156] The judgment module is used to judge whether the real-time indicator value is within the updated current value interval when the generation time of the real-time indicator value is within the valid time period.

[0157] In some embodiments, the determining module is further configured to:

[0158] When the real-time indicator value is outside the updated current value range, the real-time indicator value is determined to be abnormal data, and the abnormal data and the target indicator are associated and stored in a preset storage location;

[0159] In the preset storage location, the total number of abnormal data within the preset alarm time window corresponding to the target indicator is counted;

[0160] When the total number is greater than or equal to the abnormal threshold corresponding to the target indicator, it is determined that the target device is operating abnormally.

[0161] In some embodiments, the acquisition module is further configured to:

[0162] When the target indicator corresponds to the first preset acquisition method, determining a first historical time range corresponding to the current time;

[0163] Determine each historical period corresponding to the current time within the first historical time range, and obtain the indicator value corresponding to the target indicator in each historical period;

[0164] When the target indicator corresponds to the second preset acquisition method, determining a second historical time range corresponding to the current time;

[0165] Get the indicator value corresponding to the target indicator within the second historical time range.

[0166] In some embodiments, the update module is further configured to:

[0167] Sort historical data in a preset order;

[0168] Determine the benchmark value interval corresponding to the target indicator from the sorted historical data;

[0169] The reference numerical range is adjusted according to the numerical adjustment parameter, and the adjusted reference numerical range is used as the update result of the current numerical range.

[0170] In some embodiments, the reference value interval includes a reference upper limit value and a reference lower limit value, the updated current value interval includes an indicator upper limit value and an indicator lower limit value, and the value adjustment parameter includes a weight parameter and an offset parameter;

[0171] Update module, also used for:

[0172] The product of the benchmark difference and the benchmark weight is determined as the benchmark indicator threshold corresponding to the target indicator. The benchmark difference is the difference between the benchmark upper limit and the benchmark lower limit, and the benchmark weight is the sum of the weight parameter and the offset parameter.

[0173] The sum of the benchmark indicator threshold, the benchmark lower limit value and the offset parameter is determined as the indicator upper limit value;

[0174] determining a first difference between the benchmark upper limit value and the benchmark indicator threshold value;

[0175] The difference between the first difference value and the offset parameter is determined as the indicator lower limit value.

[0176] In some embodiments, the apparatus further comprises:

[0177] When it is determined that the target device is operating abnormally, a generation module is used to generate alarm information based on all abnormal data corresponding to the target indicators in the preset storage location, and clear all abnormal data corresponding to the target indicators in the preset storage location. The alarm information is used to indicate that the target device is operating abnormally within the effective period.

[0178] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0179] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0180] An embodiment of the present application also provides a network device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the above-mentioned method embodiments when executing the computer program.

[0181] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0182] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0183] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0184] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0185] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0186] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0187] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0188] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An anomaly detection method, characterized in that: include: In each threshold update cycle corresponding to the target indicator, historical data corresponding to the target indicator is obtained, the target indicator corresponds to a current value interval, and the target indicator is any indicator corresponding to the target device; Based on the historical data and the preset numerical adjustment parameters, updating the current numerical range; When the real-time indicator value corresponding to the target indicator is outside the updated current value interval, it is determined that the target device is operating abnormally.

2. The method according to claim 1, characterized in that Before determining that the target device is working abnormally, the method further includes: Determine, according to the current time and the threshold update period, a valid period corresponding to the updated current value interval; In the case that the generation time of the real-time indicator value is within the valid period, it is determined whether the real-time indicator value is within the updated current value interval.

3. The method according to claim 2, characterized in that The determining that the target device is operating abnormally includes: In the case where the real-time indicator value is outside the updated current numerical range, determining that the real-time indicator value is abnormal data, and storing the abnormal data and the target indicator in a preset storage location in association with each other; In the preset storage location, counting the total number of abnormal data within the preset alarm time window corresponding to the target indicator; When the total number is greater than or equal to the abnormal threshold corresponding to the target indicator, it is determined that the target device is operating abnormally.

4. The method according to claim 1, characterized in that Obtaining historical data corresponding to the target indicator, including: In a case where the target indicator corresponds to the first preset acquisition method, determining a first historical time range corresponding to the current time; Determine each historical time period corresponding to the current time within the first historical time range, and obtain the indicator value corresponding to the target indicator in each historical time period; In a case where the target indicator corresponds to a second preset acquisition method, determining a second historical time range corresponding to the current time; Obtain the indicator value corresponding to the target indicator within the second historical time range.

5. The method according to any one of claims 2 to 4, characterized in that: Based on the historical data and the preset numerical adjustment parameters, updating the current numerical range includes: Sorting the historical data according to a preset order; Determine a reference value interval corresponding to the target indicator from the sorted historical data; The reference numerical interval is adjusted according to the numerical adjustment parameter, and the adjusted reference numerical interval is used as an update result of the current numerical interval.

6. The method according to claim 5, characterized in that The reference numerical interval includes a reference upper limit value and a reference lower limit value, the updated current numerical interval includes an indicator upper limit value and an indicator lower limit value, and the numerical adjustment parameter includes a weight parameter and an offset parameter; The step of adjusting the reference numerical value interval according to the numerical value adjustment parameter includes: The product of the benchmark difference and the benchmark weight is determined as the benchmark indicator threshold corresponding to the target indicator, the benchmark difference is the difference between the benchmark upper limit and the benchmark lower limit, and the benchmark weight is the sum of the weight parameter and the offset parameter; Determine the sum of the benchmark indicator threshold, the benchmark lower limit value, and the offset parameter as the indicator upper limit value; determining a first difference between the benchmark upper limit value and the benchmark indicator threshold value; A difference between the first difference and the offset parameter is determined as the indicator lower limit value.

7. The method according to claim 3, characterized in that The method further comprises: When it is determined that the target device is operating abnormally, an alarm message is generated based on all abnormal data corresponding to the target indicator in the preset storage location, and all abnormal data corresponding to the target indicator in the preset storage location is cleared, and the alarm message is used to indicate that the target device is operating abnormally within the effective period.

8. An abnormality detection device, characterized in that: The device comprises: An acquisition module, used for acquiring historical data corresponding to a target indicator within each threshold value update period corresponding to the target indicator, wherein the target indicator corresponds to a current value interval, and the target indicator is any indicator corresponding to a target device; An updating module, configured to update the current numerical range based on the historical data and a preset numerical adjustment parameter; The determination module is used to determine that the target device is operating abnormally when the real-time indicator value corresponding to the target indicator is outside the updated current value interval.

9. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the abnormality detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for detecting method abnormality according to any one of claims 1 to 7 is implemented.

Images