Abnormality detection method and device for time series data, electronic equipment and storage medium
By acquiring the characteristics of timing data, intelligently selecting detection algorithms, and selecting comparison data from historical data, the problem of insufficient accuracy of timing data abnormal detection in the prior art is solved, and higher detection accuracy and reliability are achieved.
Patent Information
- Application Number
- CN202510354726.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-25
- Publication Date
- 2025-06-27
AI Technical Summary
The existing timing data anomaly detection algorithm cannot meet the abnormal detection accuracy requirements of different types of timing data, and the performance of a single algorithm in different scenarios has advantages and disadvantages.
By obtaining the target timing characteristics of the target timing data, we intelligently select the adaptive target detection algorithm, and select the target comparison data from the historical timing data to perform abnormal detection.
The accuracy of timing data abnormal detection is improved, and the reliability of detection results is enhanced by matching suitable detection algorithms and using historical normal data as standards.
Smart Images
Figure CN120217246A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the technical field of data processing, and in particular, to an anomaly detection method, device, electronic device, and storage medium for time series data. Background Art
[0002] Time series data is a data sequence recorded over time, such as stock prices, device sensor readings, etc. In a real-time environment, quickly and accurately detecting anomalies in time series data is crucial for preventing failures and timely responses. Existing anomaly detection algorithms are mainly divided into statistical-based anomaly detection algorithms, machine learning-based anomaly detection algorithms, and deep learning-based anomaly detection algorithms. However, each type of algorithm has its own advantages and disadvantages, resulting in the inability to meet the anomaly detection accuracy requirements of different types of time series data using a fixed and single anomaly detection algorithm. Summary of the Invention
[0003] This application provides an anomaly detection method, device, electronic device, and storage medium for time series data, which can improve the accuracy of anomaly detection for time series data. The technical solution is as follows:
[0004] According to one aspect of this application, an anomaly detection method for time series data is provided. The method includes:
[0005] Obtain the target time series features of the target time series data to be detected;
[0006] Based on the target time series features, determine the target detection algorithm for performing anomaly detection on the target time series data, where different target time series features correspond to different target detection algorithms;
[0007] Based on the target time series data, determine target comparison data from historical time series data, where the target comparison data is historical normal time series data;
[0008] Perform anomaly detection on the target time series data based on the target comparison data and the target detection algorithm to obtain the anomaly detection result of the target time series data.
[0009] According to another aspect of this application, an anomaly detection device for time series data is provided. The device includes:
[0010] An acquisition module, configured to obtain the target time series features of the target time series data to be detected;
[0011] A first determination module, configured to determine the target detection algorithm for performing anomaly detection on the target time series data based on the target time series features, where different target time series features correspond to different target detection algorithms;
[0012] A second determination module, configured to determine target comparison data from historical time series data based on the target time series data, where the target comparison data is historical normal time series data;
[0013] An anomaly detection module, configured to perform anomaly detection on the target time series data based on the target comparison data and the target detection algorithm, to obtain an anomaly detection result of the target time series data.
[0014] According to one aspect of the present application, there is provided an electronic device, including: a processor and a memory storing a program, where the program includes instructions that, when executed by the processor, cause the processor to execute the anomaly detection method of the time series data as described above.
[0015] According to another aspect of the present application, there is provided a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to cause the computer to execute the anomaly detection method of the time series data as described above.
[0016] According to another aspect of the present application, there is provided a computer program product, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the anomaly detection method of the above-mentioned time series data.
[0017] The beneficial effects brought by the technical solutions provided in the embodiments of the present application at least include:
[0018] By obtaining the target time series features of the target time series data, intelligently selecting an adapted target detection algorithm for the target time series data according to the target time series features, and selecting target comparison data from the historical time series data according to the target time series data, and then performing anomaly detection on the target time series data according to the target detection algorithm and the target comparison data. Compared with the single anomaly detection algorithm in the related art, the embodiments of the present application can select an adapted target detection algorithm according to the target time series features of the target time series data, improve the matching degree between the anomaly detection algorithm and the time series data, and thus improve the accuracy of anomaly detection of the time series data; in addition, normal time series data can be selected from the historical time series data as the standard for anomaly detection, which can further improve the accuracy of anomaly detection of the time series data. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] In the following description of the exemplary embodiments with reference to the accompanying drawings, more details, features and advantages of the present application are disclosed. In the drawings:
[0020] Figure 1 A flowchart of an anomaly detection method for time series data according to an exemplary embodiment of the present application is shown;
[0021] Figure 2 The flowchart of another method for detecting anomalies in time-series data according to an exemplary embodiment of the present application is shown;
[0022] Figure 3 It is a schematic structural diagram of a device for detecting anomalies in time-series data provided by an embodiment of the present application;
[0023] Figure 4 The block diagram of an exemplary electronic device capable of implementing the embodiments of the present application is shown. Detailed implementation manners
[0024] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to more thoroughly and completely understand the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not used to limit the protection scope of the present application.
[0025] It should be understood that the steps described in the method embodiments of the present application can be executed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this regard.
[0026] The term "including" and its variants used herein are open-ended, that is, "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts such as "first" and "second" mentioned in the present application are only used to distinguish different devices, modules or units, and are not used to limit the order of functions executed by these devices, modules or units or their interdependent relationships. It should be noted that the modifications of "one" and "multiple" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly stated in the context, it should be understood as "one or more". The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only for illustrative purposes and are not used to limit the scope of these messages or information.
[0027] The solutions of the present invention are described below with reference to the accompanying drawings, and the technical solutions provided by the embodiments of the present invention are described in detail through specific embodiments and their application scenarios.
[0028] Please refer to Figure 1, which shows a flowchart of an abnormal detection method for time-series data according to an exemplary embodiment of the present application. This method is described by taking an example of being applied to an electronic device. As Figure 1 shown, this method includes:
[0029] Step 101, obtain the target time-series features of the target time-series data to be detected.
[0030] In the related art, anomaly detection algorithms are mainly divided into statistical-based anomaly detection algorithms, machine learning-based anomaly detection algorithms, and deep learning-based anomaly detection algorithms. Each type of anomaly detection algorithm has its own advantages and disadvantages, and the detection effects of the same anomaly detection algorithm on different types of time-series data also have advantages and disadvantages. Therefore, using a single anomaly detection algorithm cannot meet the accuracy requirements in the scenario of time-series data anomaly detection. In view of the problems existing in the time-series data anomaly detection in the related art, the embodiments of the present application integrate multiple anomaly detection algorithms and analyze the anomaly detection algorithms suitable for different types of time-series data, so as to intelligently select an anomaly detection algorithm during actual anomaly detection. In a possible implementation manner, after obtaining the target time-series data to be detected from the time-series database, first perform feature extraction on the target time-series data to obtain the target time-series features of the target time-series data to be detected, so as to intelligently select an anomaly detection algorithm based on the target time-series features subsequently.
[0031] Among them, the target time-series features refer to features such as periodicity, seasonality, trend, or offset possessed by the target time-series data for a period of time. Exemplarily, taking the time-series data as the CPU occupancy rate, the CPU occupancy rate trend is normally stable within a certain range, and the corresponding target time-series feature is a stable trend type.
[0032] Regarding the method of extracting the target time-series features of the target time-series data, in order to ensure the accuracy of the extracted target time-series features, the time-series data of a preset time period including the target time-series data will be selected to analyze the target time-series features of the target time-series data. Exemplarily, if the target time-series data is the time-series data on January 20th, the time-series data from January 10th to January 20th can be obtained to determine the target time-series features of the target time-series data.
[0033] Optionally, for the same type of time-series data, its corresponding target time-series features generally do not change. After extracting the target time-series features once, the target time-series features can be associated with the corresponding time-series data, and subsequently, the target time-series features of the target time-series data can be directly obtained according to the association relationship.
[0034] Optionally, in order to avoid changes in the target time-series features, the target time-series features of the time-series data can also be re-analyzed and updated every preset period.
[0035] Step 102: Based on the target time series characteristics, determine the target detection algorithm for anomaly detection of the target time series data. Different target time series characteristics correspond to different target detection algorithms.
[0036] Among them, different target detection algorithms (anomaly detection algorithms) are set in advance according to different target time series characteristics. Exemplarily, the association relationships between different time series characteristics and anomaly detection algorithms can be shown in Table 1.
[0037] Table 1
[0038]
[0039] As can be seen from Table 1, if the target time series characteristic is stationary, a threshold detection algorithm or a 3-sigma detection algorithm can be used; if the target time series characteristic is periodic, algorithms such as an Autoregressive Integrated Moving Average (ARIMA) model, a Holt-Winters model, an exponential smoothing algorithm, or a random forest algorithm can be used; if the target time series characteristic is non-numerical, a semantic parsing algorithm or a feature comparison algorithm can be used.
[0040] In a possible implementation manner, after obtaining the target time series characteristics corresponding to the target time series data to be detected, the target detection algorithm for anomaly detection of the target time series data can be determined based on the target time series characteristics and the association relationships shown in Table 1, and then the adapted target detection algorithm can be used to perform anomaly detection on the target time series data.
[0041] Step 103: Based on the target time series data, determine the target comparison data from the historical time series data. The target comparison data is historical normal time series data.
[0042] When performing anomaly detection on the target time series data, in addition to selecting its adapted anomaly detection algorithm, it is also necessary to clarify the characteristics that the normal target time series data should possess. Therefore, it is also necessary to determine the target comparison data from the historical time series data according to the target time series data. The target comparison data is the historical normal time series data of the same type of time series data, which can provide normal data characteristics for subsequent anomaly detection.
[0043] Step 104: Based on the target comparison data and the target detection algorithm, perform anomaly detection on the target time series data to obtain the anomaly detection result of the target time series data.
[0044] After obtaining the target comparison data and the target detection algorithm, the abnormal detection of the target time-series data can be performed based on the target comparison data and the target detection algorithm. The target detection algorithm extracts the data features of the normal time-series data from the target comparison data, and then determines whether the target time-series data satisfies the data features, so as to obtain the abnormal detection result of the target time-series data.
[0045] In summary, the embodiments of the present application provide a method for abnormal detection of time-series data: by obtaining the target time-series features of the target time-series data, intelligently selecting an appropriate target detection algorithm for the target time-series data according to the target time-series features, and selecting target comparison data from the historical time-series data according to the target time-series data, and then performing abnormal detection on the target time-series data according to the target detection algorithm and the target comparison data. Compared with the single abnormal detection algorithm in the related art, the embodiments of the present application can select an appropriate target detection algorithm according to the target time-series features of the target time-series data, improve the matching degree of the abnormal detection algorithm and the time-series data, and thus improve the accuracy of the abnormal detection of the time-series data; in addition, normal time-series data can be selected from the historical time-series data as the standard for abnormal detection, which can further improve the accuracy of the abnormal detection of the time-series data.
[0046] Considering the characteristics of time-series data, there may be significant differences between holidays and working days. Therefore, when selecting target comparison data, it is necessary to select historical data in the most recent time period as much as possible, and the influence of holiday specificity needs to be excluded.
[0047] Please refer to Figure 2 , which shows a flowchart of another method for abnormal detection of time-series data according to an exemplary embodiment of the present application. This method is described by taking its application to an electronic device as an example. As Figure 2 shown, this method includes:
[0048] Step 201, obtain the target time-series features of the target time-series data to be detected.
[0049] Step 202, based on the target time-series features, determine a target detection algorithm for performing abnormal detection on the target time-series data, and different target time-series features correspond to different target detection algorithms.
[0050] The implementation manners of Step 201 and Step 202 can refer to Step 101 and Step 102, and are not elaborated herein in this embodiment.
[0051] Step 203, obtain the target time period corresponding to the target time-series data.
[0052] Considering that there may be significant differences in the time series data between working days and rest days, when selecting the target comparison data corresponding to the target time series data, first analyze the target time attribute (which can also be called the holiday feature) corresponding to the target time series data. Correspondingly, obtain the target time period corresponding to the target time series data, and then determine the target time attribute to which it belongs based on the target time period.
[0053] Step 204, determine the target time attribute to which the target time period belongs, and the target time attribute includes rest days or working days.
[0054] If the target time period is within the working day period, its target time attribute is a working day; if the target time period is within the rest day period, its target time attribute is a rest day.
[0055] Exemplarily, if the target time period is Monday, it belongs to a working day; if the target time period is Saturday, it belongs to a rest day.
[0056] Step 205, determine the target comparison data from the historical time series data based on the target time attribute, and the time attribute corresponding to the target comparison data is consistent with the target time attribute.
[0057] To avoid the differences between working days and rest days from affecting the accuracy of anomaly detection of time series data. When selecting the target comparison data, it should be ensured as much as possible that the time attribute corresponding to the target comparison data is consistent with the time attribute corresponding to the target time series data. Correspondingly, the target comparison data can be selected from the historical time series data based on the target time attribute.
[0058] Specifically, if the target time attribute is a rest day, in an exemplary example, Step 205 may include Step 205A and Step 205B.
[0059] Step 205A, if the target time attribute is a rest day, obtain the first time series data corresponding to the historical rest days from the historical time series data.
[0060] Step 205B, determine the first time series data as the target comparison data.
[0061] If the target time attribute of the target time series data is a rest day, obtain the first time series data corresponding to the nearest historical rest day from the historical time series data, and determine the first time series data as the target comparison data. Exemplarily, if the target time series data is the time series data of this Saturday, and Saturday is a rest day, then select the first time series data of last Saturday from the historical time series data and determine it as the target comparison data.
[0062] Optionally, to further improve the accuracy of anomaly detection, the first time-series data corresponding to multiple recent historical rest days can be obtained from historical time-series data. Exemplarily, if the target time-series data is the time-series data of a Saturday in this week, and Saturday is a rest day, the first time-series data of last Saturday and the Saturday before last week are selected from the historical time-series data and determined as the target comparison data.
[0063] If the target time attribute is a working day, in another exemplary example, step 205 may include step 205C and step 205D.
[0064] Step 205C, if the target time attribute is a working day, obtain the second time-series data corresponding to historical working days from the historical time-series data.
[0065] If the target time attribute is a working day, when selecting the target comparison data, obtain the second time-series data corresponding to the most recent historical working day from the historical time-series data, and determine the second time-series data as the target comparison data.
[0066] When selecting the most recent historical working day, generally the most recent 7 consecutive historical working days will be preferentially selected. For the most recent 7 consecutive historical working days corresponding to determining the target time period, there are also two situations: no rest days are included within 7 consecutive days, and rest days are included within 7 consecutive days. Therefore, step 205C may further include steps 205C1 to 205C3.
[0067] Step 205C1, determine whether the preset time period before the target time period includes a rest day.
[0068] Among them, the preset time period may be 7 days. In a possible implementation manner, first determine whether the preset time period before the target time period includes a rest day, that is, determine whether a rest day is included within 7 days before the target time period, and then respectively execute step 205C2 or step 305C2 according to the two judgment results.
[0069] Step 205C2, if no rest day is included, determine the historical time-series data corresponding to the preset time period as the second time-series data.
[0070] If no rest day is included, it means that the preset time period before the target time period is all working days, and the historical time-series data corresponding to the preset time period can be directly determined as the second time-series data.
[0071] Step 205C3, if a rest day is included, exclude the holiday period in the preset time period to obtain the first time period; and determine the second time period from before the preset time period based on the duration of the holiday period; determine the historical time-series data corresponding to the first time period and the second time period as the second time-series data.
[0072] If it includes rest days and there is a historical period inconsistent with the target time attribute within the preset period before the target time period, in order to avoid introducing historical time series data with inconsistent target time attributes and causing inaccurate anomaly detection, first eliminate the holiday periods (i.e., rest day periods) in the preset period to obtain the first period; secondly, in order to ensure that the target comparison data meets a certain amount of data, determine the second period from before the preset period based on the duration of the holiday period to make up for the missing historical periods, and determine the historical time series data corresponding to the first period and the second period as the second time series data.
[0073] Exemplarily, if the target time period is this Wednesday, the preset period is from last Wednesday to this Tuesday, and there are holiday periods (last Saturday and last Sunday) between last Wednesday and this Tuesday, then eliminate this holiday period (last Saturday and last Sunday) to obtain the first period (from last Wednesday to last Friday + this Monday to this Tuesday), and based on the two days of the eliminated holiday period, determine the second period (last Monday and last Tuesday) from before the preset period. Furthermore, by combining the first period and the second period, the historical working days of the target comparison data are (last Monday to last Friday and this Monday and this Tuesday).
[0074] Step 205D, determine the second time series data as the target comparison data.
[0075] Step 206, perform anomaly detection on the target time series data based on the target comparison data and the target detection algorithm to obtain the anomaly detection result of the target time series data.
[0076] In an exemplary example, step 206 may further include steps 206A to 206C.
[0077] Step 206A, input the target comparison data into the target detection algorithm to determine the target recognition features.
[0078] Step 206B, if the target time series data does not meet the target recognition features, determine that the target time series data is abnormal.
[0079] Step 206C, if the target time series data meets the target recognition features, determine that the target time series data is normal.
[0080] When performing anomaly detection on the target time series data based on the target comparison data and the target detection algorithm, first input the target comparison data into the target detection algorithm to determine the target recognition features, and then use the target detection algorithm to determine whether the target time series data meets the target recognition features. If it meets the target recognition features, determine that the target time series data is normal and there is no abnormal time series data; if it does not meet the target time series features, determine that the target time series data is abnormal.
[0081] Optionally, the abnormality detection methods corresponding to different target detection algorithms may also be different. Exemplarily, if the target detection algorithm is a threshold detection algorithm, first determine the upper and lower threshold limits that the target time series data needs to meet from the target comparison data according to the threshold detection algorithm, and the upper and lower threshold limits are the target identification features, and then judge whether each time series data in the target time series data meets the upper and lower threshold limits. If so, it is determined that the target time series data meets the target identification features and the target time series data is normal; if not, it is determined that the target time series data does not meet the target identification features and the target time series data is abnormal.
[0082] If the target detection algorithm is a feature comparison algorithm, the target time series data and the target comparison data can also be input into the target detection algorithm together to compare the similarity between the two. If the similarity is greater than a preset threshold, it is determined to be normal; if the similarity is less than the preset threshold, it is determined that an abnormality exists.
[0083] Optionally, considering that each type of target time series feature shown in Table 1 corresponds to multiple target detection algorithms, in order to improve the accuracy of anomaly detection of time series data, the anomaly detection results of the target time series data under multiple target detection algorithms can be obtained separately, and then the multiple anomaly detection results can be combined to determine the final anomaly detection result.
[0084] Exemplarily, if the target detection algorithms corresponding to the target time series data include algorithm 1, algorithm 2 and algorithm 3, the detection result 1 of the target time series data by algorithm 1, the detection result 2 of the target time series data by algorithm 2, and the detection result 3 of the target time series data by algorithm 3 are obtained respectively. If the proportion of the target time series data indicating abnormality in the detection result 1, the detection result 2 and the detection result 3 is greater than the first preset threshold value (60%), the final abnormal detection result is determined to be abnormal; if the proportion of the target time series data indicating normality in the detection result 1, the detection result 2 and the detection result 3 is greater than the second preset threshold value (70%), the final abnormal detection result is determined to be normal.
[0085] Optionally, after determining that the target time series data has an anomaly, the abnormal time series data is removed from the target time series data; the target time series data after the abnormal time series data is removed is stored in a time series database, and the target time series data after the abnormal time series data is removed is used for anomaly detection of the latest time series data.
[0086] Optionally, after determining that there is no anomaly in the target time series data, the target time series data can be directly stored in the time series database so as to be used for anomaly detection of the latest time series data later.
[0087] Optionally, if the target time series data is determined to be abnormal data, the time point of the target time series data will be recorded. The person in charge will be notified through various contact channels such as phone calls, text messages, and emails to detect the abnormal point and conduct manual analysis and positioning.
[0088] In this embodiment, by extracting target time attribute features from the target time series data as the basis for selecting the target comparison data, the differential effects of weekdays and rest days on the accuracy of anomaly detection are avoided, and the accuracy of detecting anomalies in time series data is further improved.
[0089] Please refer to Figure 3 , which is a schematic structural diagram of an anomaly detection device for time series data provided by an embodiment of the present application.
[0090] Exemplarily, as Figure 3 shown, the device 300 includes:
[0091] An acquisition module 301, configured to acquire target time series features of target time series data to be detected;
[0092] A first determination module 302, configured to determine a target detection algorithm for performing anomaly detection on the target time series data based on the target time series features, where different target time series features correspond to different target detection algorithms;
[0093] A second determination module 303, configured to determine target comparison data from historical time series data based on the target time series data, where the target comparison data is historical normal time series data;
[0094] An anomaly detection module 304, configured to perform anomaly detection on the target time series data based on the target comparison data and the target detection algorithm, and obtain an anomaly detection result of the target time series data.
[0095] Optionally, the second determination module 303 is further configured to:
[0096] Obtain a target time period corresponding to the target time series data;
[0097] Determine a target time attribute to which the target time period belongs, where the target time attribute includes a rest day or a weekday;
[0098] Determine the target comparison data from the historical time series data based on the target time attribute, where the time attribute of the target comparison data is consistent with the target time attribute.
[0099] Optionally, the second determination module 303 is further configured to:
[0100] If the target time attribute is the rest day, obtain first time series data corresponding to historical rest days from the historical time series data;
[0101] Determine the first time series data as the target comparison data.
[0102] Optionally, the second determination module 303 is further configured to:
[0103] If the target time attribute is a working day, obtain second time series data corresponding to the historical working day from the historical time series data;
[0104] Determine the second time series data as the target comparison data.
[0105] Optionally, the second determination module 303 is further configured to:
[0106] Determine whether a preset time period before the target time period includes the rest day;
[0107] If the rest day is not included, determine the historical time series data corresponding to the preset time period as the second time series data;
[0108] If the rest day is included, exclude the holiday time period from the preset time period to obtain a first time period; and determine a second time period from before the preset time period based on the duration of the holiday time period; determine the historical time series data corresponding to the first time period and the second time period as the second time series data.
[0109] Optionally, the anomaly detection module 304 is further configured to:
[0110] Input the target comparison data into the target detection algorithm to determine target recognition features;
[0111] If the target time series data does not satisfy the target recognition features, determine that the target time series data is abnormal;
[0112] If the target time series data satisfies the target recognition features, determine that the target time series data is normal.
[0113] Optionally, the device further includes:
[0114] An exclusion module, configured to exclude abnormal time series data from the target time series data after determining that the target time series data is abnormal;
[0115] A storage module, configured to store the target time series data after excluding the abnormal time series data in a time series database, and the target time series data after excluding the abnormal time series data is used for anomaly detection of the latest time series data.
[0116] An exemplary embodiment of the present application further provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, it is used to cause the electronic device to execute the abnormal detection method for time series data according to the embodiment of the present application.
[0117] An exemplary embodiment of the present application further provides a non-transitory computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor of a computer, it is used to cause the computer to execute the abnormal detection method for time series data according to the embodiment of the present application.
[0118] An exemplary embodiment of the present application further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor of a computer, it is used to cause the computer to execute the abnormal detection method for time series data according to the embodiment of the present application.
[0119] Reference Figure 4 , the structural block diagram of the electronic device 400 that can be used as the server or client of the present application will now be described. It is an example of a hardware device applicable to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer devices, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital processors, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.
[0120] As Figure 4 shown, the electronic device 400 includes a computing unit 401, which can execute various appropriate actions and processes according to the computer program stored in the ROM 402 or the computer program loaded from the storage unit 408 into the RAM 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. The I / O interface 405 is also connected to the bus 404.
[0121] Multiple components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 can be any type of device capable of inputting information into the electronic device 400. The input unit 406 can receive input digital or character information and generate key signal inputs related to user settings and / or function controls of the electronic device. The output unit 407 can be any type of device capable of presenting information and can include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include, but is not limited to, magnetic disks and optical discs. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks and can include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.
[0122] The computing unit 401 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 executes the various methods and processes described above. For example, in some embodiments, Figure 1 , Figure 2 the method shown can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 400 via the ROM 402 and / or the communication unit 409. In some embodiments, the computing unit 401 can be configured to execute Figure 1 , Figure 2 the method shown by any other suitable means (e.g., by means of firmware).
[0123] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowchart and / or block diagram are implemented. The program codes can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.
[0124] In the context of this application, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0125] As used in this application, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., a disk, optical disk, memory, programmable logic device (PLD)) that can be used to provide machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal that can be used to provide machine instructions and / or data to a programmable processor.
[0126] To provide for interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can also be used to provide for interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic, speech, or tactile input).
[0127] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected to each other by digital data communication in any form or medium (e.g., a communication network). Examples of communication networks include: local area network (LAN), wide area network (WAN), and the Internet.
[0128] A computer system can include clients and servers. The clients and servers are generally remote from each other and typically interact through a communication network. The client - server relationship is created by computer programs that run on the respective computers and have a client - server relationship with each other.
Claims
1. A method for detecting anomalies in time series data, characterized in that: The method comprises: Obtain target time series features of target time series data to be detected; Based on the target time series features, determining a target detection algorithm for performing anomaly detection on the target time series data, where different target time series features correspond to different target detection algorithms; Determining target comparison data from historical time series data based on the target time series data, wherein the target comparison data is historical normal time series data; Anomaly detection is performed on the target time series data based on the target comparison data and the target detection algorithm to obtain an anomaly detection result of the target time series data.
2. The method according to claim 1, characterized in that The determining target comparison data from historical time series data based on the target time series data includes: Obtaining a target time period corresponding to the target time series data; Determine a target time attribute to which the target time period belongs, wherein the target time attribute includes a rest day or a working day; The target comparison data is determined from the historical time series data based on the target time attribute, and the time attribute corresponding to the target comparison data is consistent with the target time attribute.
3. The method according to claim 2, characterized in that The determining the target comparison data from the historical time series data based on the target time attribute includes: If the target time attribute is the holiday, obtaining first time series data corresponding to the historical holiday from the historical time series data; The first time series data is determined as the target comparison data.
4. The method according to claim 2, characterized in that: The determining the target comparison data from the historical time series data based on the target time attribute includes: If the target time attribute is the working day, obtaining second time series data corresponding to the historical working day from the historical time series data; The second time series data is determined as the target comparison data.
5. The method according to claim 4, characterized in that The acquiring second time series data corresponding to the historical working day from the historical time series data includes: Determining whether a preset time period before the target time period includes the rest day; If the rest day is not included, the historical time series data corresponding to the preset time period is determined as the second time series data; If the rest day is included, the holiday period in the preset time period is eliminated to obtain the first time period; and based on the length of the holiday period, the second time period is determined from before the preset time period; the historical time series data corresponding to the first time period and the second time period are determined as the second time series data.
6. The method according to any one of claims 1 to 5, characterized in that: The performing anomaly detection on the target time series data based on the target comparison data and the target detection algorithm to obtain an anomaly detection result of the target time series data includes: Inputting the target comparison data into the target detection algorithm to determine target identification features; If the target time series data does not satisfy the target identification feature, determining that the target time series data is abnormal; If the target time series data meets the target identification feature, it is determined that the target time series data is normal.
7. The method according to claim 6, characterized in that The method further comprises: After determining that the target time series data is abnormal, removing the abnormal time series data from the target time series data; The target time series data after the abnormal time series data is removed is stored in a time series database, and the target time series data after the abnormal time series data is removed is used for abnormality detection of the latest time series data.
8. A device for detecting anomalies in time series data, characterized in that: The device comprises: An acquisition module, used for acquiring target time series features of target time series data to be detected; A first determination module is used to determine a target detection algorithm for performing anomaly detection on the target time series data based on the target time series feature, where different target time series features correspond to different target detection algorithms; A second determination module is used to determine target comparison data from historical time series data based on the target time series data, wherein the target comparison data is historical normal time series data; The anomaly detection module is used to perform anomaly detection on the target time series data based on the target comparison data and the target detection algorithm to obtain anomaly detection results of the target time series data.
9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to execute the method for detecting anomalies in time series data according to any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable the computer to execute the method for detecting anomalies in time series data according to any one of claims 1 to 7.