Abnormal data determination method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an abnormal data determination method and device, equipment and a storage medium. The method comprises the following steps: acquiring service volume data within a preset duration, and determining residual data at a first sampling moment, trend data at a second sampling moment and periodic data at the second sampling moment in the service volume data in a current period; according to the residual data of the first sampling moment, the trend data of the second sampling moment and the periodic data of the second sampling moment, performing prediction processing on the next sampling moment of the first sampling moment to obtain prediction data of the next sampling moment; and determining whether the real data at the next sampling moment is abnormal data or not according to the prediction data at the next sampling moment, the real data at the next sampling moment and the abnormality judgment interval. According to the method, whether the business volume data is abnormal or not is judged more accurately.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for determining abnormal data. Background Art

[0002] From user traffic on internet platforms to transaction flows at some institutions and production progress data in the manufacturing industry, all types of businesses generate massive amounts of real-time data. These real-time indicators are like the "pulse" of business operations, dynamically reflecting the operational status of the business. By monitoring this real-time data, companies can quickly grasp business progress, adjust strategies in a timely manner, and improve operational efficiency.

[0003] Currently, there are a variety of technical means for monitoring real-time data anomalies. Statistical methods are widely used, for example, by setting the range of the mean plus or minus the standard deviation as the normal data range, and any data outside this range is considered abnormal.

[0004] However, real-time data is often high-dimensional, complex and changeable. Traditional statistical methods find it difficult to capture the complex patterns of data and are prone to misjudgment of abnormal data. Summary of the Invention

[0005] The embodiments of the present application provide a method, apparatus, device, and storage medium for determining abnormal data, so as to more accurately determine abnormal data in real-time data.

[0006] In a first aspect, an embodiment of the present application provides a method for determining abnormal data, comprising:

[0007] Acquiring business volume data within a preset time period, wherein the preset time period includes: a plurality of cycles;

[0008] Determining residual data at a first sampling moment in a current cycle, trend data at a second sampling moment, and period data at the second sampling moment in the traffic data, where the second sampling moment is a sampling moment next to the first sampling moment of a previous cycle of the current cycle;

[0009] performing prediction processing on a next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment to obtain predicted data for the next sampling moment;

[0010] Determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, where the abnormality determination interval is determined based on a preset confidence interval ratio, the actual data at the next sampling moment, the expected error data within a preset period, and the standard deviation of the error within the preset period.

[0011] In a possible implementation, before determining whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, the method further includes:

[0012] Determining a first difference between the expected error data and the first data, a first product value of a lower limit value of the preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the expected error data and the first data, and a second product value of an upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment, wherein the first data is a third product value of the error standard deviation data and a first preset coefficient;

[0013] The minimum value of the first difference value and the first product value is determined as the lower limit value of the abnormality determination interval, and the maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormality determination interval.

[0014] In one possible implementation, determining whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval includes:

[0015] Determining a second difference between the actual data at the next sampling moment and the predicted data at the next sampling moment;

[0016] If the second difference is within the abnormality determination interval, determining that the real data at the next sampling moment is not abnormal data;

[0017] If the second difference is outside the abnormality determination interval, the real data at the next sampling moment is determined to be abnormal data.

[0018] In a possible implementation, determining the residual data at a first sampling moment in a current period of the traffic data, the trend data at a second sampling moment, and the periodic data at the second sampling moment includes:

[0019] Obtaining real data at a first sampling moment in the traffic data, periodic data of a previous cycle corresponding to the first sampling moment, residual data of a previous sampling moment corresponding to the first sampling moment, trend data of a previous sampling moment corresponding to the first sampling moment, residual data of a second sampling moment, periodic data at a third sampling moment, real data at the second sampling moment, residual data at a fourth sampling moment, and trend data at the fourth sampling moment, where the third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment;

[0020] The residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment are determined based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment.

[0021] In a possible implementation, determining the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment includes:

[0022] Determine residual data at the first sampling moment based on real data at the first sampling moment, periodic data of a previous period corresponding to the first sampling moment, residual data at a previous sampling moment corresponding to the first sampling moment, and trend data at the previous sampling moment corresponding to the first sampling moment;

[0023] determining trend data at the second sampling moment according to the residual data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment;

[0024] The period data at the second sampling moment is determined according to the true data at the second sampling moment, the residual data at the second sampling moment, and the period data at the third sampling moment.

[0025] In one possible implementation, the predicting the next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment to obtain the predicted data for the next sampling moment includes:

[0026] Determining a second sum of the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment;

[0027] The second sum value is determined as the predicted data for the next sampling moment.

[0028] In a second aspect, an embodiment of the present application provides a device for determining abnormal data, including:

[0029] An acquisition module, configured to acquire traffic data within a preset time period, wherein the preset time period includes: a plurality of cycles;

[0030] a first determining module, configured to determine residual data at a first sampling moment in a current cycle of the traffic data, trend data at a second sampling moment, and periodic data at the second sampling moment, where the second sampling moment is a sampling moment next to the first sampling moment of a previous cycle of the current cycle;

[0031] a prediction module, configured to predict a sampling moment next to the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment, to obtain predicted data for the next sampling moment;

[0032] The second determination module is used to determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, where the abnormality determination interval is determined based on a preset confidence interval ratio, the actual data at the next sampling moment, the expected error data within a preset period, and the standard deviation of the error within the preset period.

[0033] In a possible implementation, before determining whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, the second determining module is further configured to:

[0034] Determining a first difference between the expected error data and the first data, a first product value of a lower limit value of the preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the expected error data and the first data, and a second product value of an upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment, wherein the first data is a third product value of the error standard deviation data and a first preset coefficient;

[0035] The minimum value of the first difference value and the first product value is determined as the lower limit value of the abnormality determination interval, and the maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormality determination interval.

[0036] In a possible implementation, the second determining module is specifically configured to:

[0037] Determining a second difference between the actual data at the next sampling moment and the predicted data at the next sampling moment;

[0038] If the second difference is within the abnormality determination interval, determining that the real data at the next sampling moment is not abnormal data;

[0039] If the second difference is outside the abnormality determination interval, the real data at the next sampling moment is determined to be abnormal data.

[0040] In a possible implementation manner, the first determining module is specifically configured to:

[0041] Obtaining real data at a first sampling moment in the traffic data, periodic data of a previous cycle corresponding to the first sampling moment, residual data of a previous sampling moment corresponding to the first sampling moment, trend data of a previous sampling moment corresponding to the first sampling moment, residual data of a second sampling moment, periodic data at a third sampling moment, real data at the second sampling moment, residual data at a fourth sampling moment, and trend data at the fourth sampling moment, where the third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment;

[0042] The residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment are determined based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment.

[0043] In a possible implementation, the first determining module determines the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment, and is specifically configured to:

[0044] Determine residual data at the first sampling moment based on real data at the first sampling moment, periodic data of a previous period corresponding to the first sampling moment, residual data at a previous sampling moment corresponding to the first sampling moment, and trend data at the previous sampling moment corresponding to the first sampling moment;

[0045] The trend data at the second sampling moment is determined according to the residual data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment.

[0046] In a possible implementation, the prediction module is specifically configured to:

[0047] Determining a second sum of the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment;

[0048] The second sum value is determined as the predicted data for the next sampling moment.

[0049] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor;

[0050] The memory stores computer-executable instructions;

[0051] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0052] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0053] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0054] The abnormal data determination method, apparatus, device, and storage medium provided in the embodiments of the present application obtain business volume data within a preset time period, where the preset time period includes: multiple cycles; determining the residual data of the first sampling moment in the current cycle, the trend data of the second sampling moment, and the periodic data of the second sampling moment in the business volume data, where the second sampling moment is the next sampling moment of the first sampling moment of the previous cycle of the current cycle; predicting the next sampling moment of the first sampling moment based on the residual data of the first sampling moment, the trend data of the second sampling moment, and the periodic data of the second sampling moment to obtain the predicted data of the next sampling moment; determining whether the real data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the real data at the next sampling moment, and the abnormal judgment interval, where the abnormal judgment interval is determined based on a preset confidence interval ratio, the real data at the next sampling moment, the error expectation data within the preset cycle, and the error standard deviation data within the preset cycle. In this technical solution, first, business volume data for multiple periods is acquired, providing a rich historical information foundation for subsequent analysis and helping to discover patterns and trends in the data. Then, the residual data at the first sampling moment in the current period, the trend data and period data at the next sampling moment (i.e., the second sampling moment) after the first sampling moment in the previous period are determined, making the data characteristics more comprehensive and clear, providing multi-dimensional information support for prediction. Third, based on this data, a prediction is made for the next sampling moment, comprehensively considering the different characteristics of the data, enabling a more accurate estimation of data changes and improving the reliability of the prediction. Finally, the actual data is judged to be abnormal based on the predicted data, the actual data, and the anomaly judgment interval determined based on the preset confidence interval ratio, the actual data, the error expectation within the preset period, and the standard deviation data. This method fully considers the fluctuation range and uncertainty of the data and can scientifically and rationally identify abnormal data. Through this solution, anomalies in business volume data can be discovered in a timely manner, such as abnormal access caused by network attacks and system failures, so that corresponding measures can be taken to deal with them, ensuring the stable operation of the system and the security of the data. It also helps to accurately evaluate the business situation and optimize decision-making. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] Figure 1 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 1 ;

[0057] Figure 2 A schematic diagram of daily active user data within a preset time period provided in an embodiment of the present application;

[0058] Figure 3 The comparison between the actual value and the predicted value provided in the embodiment of this application is shown in FIG. Figure 1 ;

[0059] Figure 4 The comparison between the actual value and the predicted value provided in the embodiment of this application is shown in FIG. Figure 2 ;

[0060] Figure 5 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 2 ;

[0061] Figure 6 A schematic diagram of determining abnormal data generated based on a preset confidence interval provided in an embodiment of the present application;

[0062] Figure 7 A schematic diagram of the error range calculated using the normal distribution formula provided in the embodiment of the present application;

[0063] Figure 8 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 3 ;

[0064] Figure 9 A schematic diagram of the structure of an apparatus for determining abnormal data provided in an embodiment of the present application;

[0065] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0066] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0067] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0068] Currently, there are many real-time indicators used to monitor business status. How to accurately and promptly detect real-time data anomalies and analyze the causes of anomalies is an urgent problem that needs to be solved.

[0069] This is because: when data anomalies occur, if the anomalies can be discovered as soon as possible, the corresponding business can be adjusted to minimize losses as much as possible; and the anomalies can be accurately discovered. Frequent false alarms will cause relevant personnel to lose trust in the alarms and thus fail to handle them in a timely manner.

[0070] Accordingly, in the prior art, common practices are as follows:

[0071] The first type is the year-on-year comparison method: the current value is compared with the value of the previous period. If the overall data of the day increases or decreases, there will be very frequent alarms;

[0072] The second method is the month-on-month method: the current value is compared with the previous value. If the data fluctuates periodically, false positives may occur, and the data with the largest month-on-month change is not necessarily abnormal.

[0073] Based on the above technical problems, the inventor's technical conception is as follows: the characteristics of business data in time series can be fully utilized, and anomaly detection can be achieved through detailed analysis of data in multiple periods, that is, the triple exponential sliding smoothing method (full name in English: Hot-Winters) can be used to determine the residual data, trend data, and periodic data to obtain predicted data. Among them, the residual data can reflect the degree of deviation of the current data from the overall trend, the trend data shows the change trend of business volume over time, and the periodic data contains the characteristics of cyclical fluctuations in the business. These three types of data characterize the characteristics of business data from different dimensions, which can make the predicted data more accurate.

[0074] Furthermore, an anomaly determination interval can be set to determine whether the actual data is anomaly. This determination can be based on a pre-set confidence interval ratio, the actual data at the next sampling moment, the expected error data within a preset period, and the error standard deviation data. The pre-set confidence interval ratio reflects the strictness of the anomaly determination, while the expected error and standard deviation data quantify the fluctuation range of the data from a statistical perspective, thereby increasing the accuracy of the anomaly determination interval to a certain extent.

[0075] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0076] Figure 1 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the method includes:

[0077] Step 11: Obtaining business volume data within a preset time period;

[0078] The preset duration includes: multiple cycles.

[0079] In this step, the business volume data within the preset time period can be obtained through database query, log file analysis, and statistical tools.

[0080] 1) Database query: According to the preset time requirement, use the corresponding database query language to determine the query statement, and the database will return the business volume data records that meet the conditions.

[0081] 2) Log file analysis: Based on the format of the log file, determine the parsing program to extract the business volume data. In the process of parsing the log content, filter out the business volume data that meets the requirements according to the preset time conditions;

[0082] 3) Select appropriate third-party statistical tools based on business scenarios and needs, and integrate them with business systems to ensure that the tools can accurately collect business volume data.

[0083] Optionally, the business volume data may include visit volume, active user data, purchase volume, page click volume, and the like.

[0084] In one possible implementation, Figure 2 This is a schematic diagram of daily active user data within a preset time period provided in an embodiment of the present application, such as Figure 2 As shown, 5 periods are taken as an example, one period is 1 day, the business volume data is active user data as an example, and every 10 minutes is a sampling point.

[0085] Correspondingly, the number of sampling points included in one cycle is 6*24=144.

[0086] Step 12: determining residual data at a first sampling moment in a current cycle, trend data at a second sampling moment, and periodic data at the second sampling moment in the traffic data;

[0087] The second sampling time is a sampling time next to the first sampling time of the previous cycle of the current cycle;

[0088] In this step, in order to obtain the predicted data of the next sampling moment of the first sampling moment in the current cycle, combined with the cubic exponential sliding smoothing method in the present technical concept, the residual data of the first sampling moment, the trend data of the second sampling moment, and the periodic data of the second sampling moment can be obtained first.

[0089] Among them, residual data is used to indicate the difference between the true value and the predicted value (or fitted value), representing the part of the data that cannot be explained by the model after considering factors such as trends and cycles; trend data is used to describe the overall change direction and trend of the data over a long period of time; periodic data is used to represent the periodic fluctuation pattern in the data, which can be seasonal (such as the annual sales peak season and off-season), monthly, weekly or other fixed cycles (in this embodiment, the cycle is days).

[0090] For example, if the first sampling time is 13:00 on the 2nd, then the second sampling time is 13:10 on the 1st; accordingly, with 10 minutes as a sampling point, the next sampling time of the first sampling is 13:10 on the 2nd.

[0091] Taking the forecast data (forecast value) without trend data as an example, in one possible implementation, Figure 3 The comparison between the actual value and the predicted value provided in the embodiment of this application is shown in FIG. Figure 1 ,like Figure 3 As shown in the figure, the predicted value is a comparison without trend data. In a cycle, when the data in the early morning and evening continuously decrease and increase, the predicted value has a certain lag, that is, the predicted data is inaccurate.

[0092] exist Figure 3 In the figure, the blue line is the actual data and the yellow line is the predicted data without trend data.

[0093] Step 13: predicting the next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment to obtain predicted data for the next sampling moment;

[0094] In this step, after the residual data of the first sampling moment, the trend data of the second sampling moment, and the period data of the second sampling moment are determined above, the residual data of the first sampling moment, the trend data of the second sampling moment, and the period data of the second sampling moment are processed to obtain prediction data that combines factors such as trend, period, and residual.

[0095] Optionally, step 13 may be implemented by: determining a second sum of the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment; and determining the second sum as the predicted data at the next sampling moment.

[0096] In one possible implementation, the predicted data x at the next sampling moment is i+1 The calculation formula is as follows:

[0097] x i+1 =s i +ti+1-k +p i+1-k

[0098] Where i is the first sampling moment, i+1 is the next sampling moment, and i+1-k is the next sampling moment after the first sampling moment of the previous cycle; correspondingly, s i is the residual data at the first sampling moment, t i+1-k is the trend data at the second sampling moment, p i+1-k is the periodic data at the second sampling moment.

[0099] In one possible implementation, Figure 4 The comparison between the actual value and the predicted value provided in the embodiment of this application is shown in FIG. Figure 2 ,like Figure 4 As shown in the figure, the predicted value is compared with the trend data. In a cycle, when the data in the early morning and evening continuously decreases and increases, the predicted value is closer to the true value.

[0100] exist Figure 4 In the figure, the blue line is the actual data, and the yellow line is the predicted data including trend data.

[0101] Step 14: Determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval;

[0102] The abnormality determination interval is determined based on a preset confidence interval ratio, actual data at the next sampling moment, expected error data within a preset period, and standard deviation of error data within a preset period.

[0103] In this step, in order to determine whether the real data at the next sampling moment is abnormal data, after determining the predicted data at the next sampling moment, the real data at the next sampling moment is obtained, and based on the real data at the next sampling moment and the predicted data at the next sampling moment, they are compared with the abnormal judgment interval. Based on the comparison result, it is determined whether the real data at the next sampling moment is abnormal data.

[0104] Furthermore, when it is determined that the real data at the next sampling moment is abnormal data, an alarm is triggered so that relevant personnel can quickly handle the abnormality.

[0105] In a possible implementation, step 41 may include the following steps:

[0106] Step 1: Determine the second difference between the actual data at the next sampling moment and the predicted data at the next sampling moment;

[0107] In this implementation, the second difference actually represents the deviation between the actual data at the next sampling moment and the predicted data at the next sampling moment.

[0108] For example, the actual data at the next sampling moment is 20004, and the predicted data at the next sampling moment is 20000, then the second difference is 4.

[0109] Step 2: If the second difference is within the abnormality determination interval, it is determined that the real data at the next sampling moment is not abnormal data;

[0110] In this implementation, the abnormality determination interval includes a lower limit value and an upper limit value. For example, if the lower limit value is 3 and the upper limit value is 17, the real data at the next sampling moment is not abnormal data.

[0111] Step 3: If the second difference is outside the abnormality determination interval, the real data at the next sampling moment is determined to be abnormal data.

[0112] In this implementation, the abnormality determination interval includes a lower limit value and an upper limit value. For example, if the lower limit value is 12 and the upper limit value is 17, the real data at the next sampling moment is abnormal data.

[0113] The method for determining abnormal data provided by an embodiment of the present application obtains business volume data within a preset time period, where the preset time period includes: multiple cycles; determines the residual data of the first sampling moment in the current cycle, the trend data of the second sampling moment, and the periodic data of the second sampling moment in the business volume data, where the second sampling moment is the next sampling moment of the first sampling moment of the previous cycle of the current cycle; predicts the next sampling moment of the first sampling moment based on the residual data of the first sampling moment, the trend data of the second sampling moment, and the periodic data of the second sampling moment to obtain the predicted data of the next sampling moment; determines whether the real data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the real data at the next sampling moment, and the abnormal judgment interval, where the abnormal judgment interval is determined based on a preset confidence interval ratio, the real data at the next sampling moment, the error expectation data within the preset cycle, and the error standard deviation data within the preset cycle. In this technical solution, first, business volume data for multiple periods is acquired, providing a rich historical information foundation for subsequent analysis and helping to discover patterns and trends in the data. Then, the residual data at the first sampling moment in the current period, the trend data and period data at the next sampling moment (i.e., the second sampling moment) after the first sampling moment in the previous period are determined, making the data characteristics more comprehensive and clear, providing multi-dimensional information support for prediction. Third, based on this data, a prediction is made for the next sampling moment, comprehensively considering the different characteristics of the data, enabling a more accurate estimation of data changes and improving the reliability of the prediction. Finally, the actual data is judged to be abnormal based on the predicted data, the actual data, and the anomaly judgment interval determined based on the preset confidence interval ratio, the actual data, the error expectation within the preset period, and the standard deviation data. This method fully considers the fluctuation range and uncertainty of the data and can scientifically and rationally identify abnormal data. Through this solution, anomalies in business volume data can be discovered in a timely manner, such as abnormal access caused by network attacks and system failures, so that corresponding measures can be taken to deal with them, ensuring the stable operation of the system and the security of the data. It also helps to accurately evaluate the business situation and optimize decision-making.

[0114] Based on the above embodiments, Figure 5 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 2 ,like Figure 5 As shown, before step 14, the method further includes:

[0115] Step 51: Determine a first difference between the expected error data and the first data, a first product value of a lower limit value of a preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the expected error data and the first data, and a second product value of an upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment;

[0116] The first data is a third product value of the error standard deviation data and the first preset coefficient;

[0117] In this step, the error expectation data μ is the average value of the error, where the error is the difference between the predicted data and the actual data. The error expectation data can be the average value of the difference between the predicted data and the actual data of multiple sampling points within a preset time length; the error standard deviation data δ is the standard deviation of the error, the standard deviation of the difference between the predicted data and the actual data of multiple sampling points within a preset time length.

[0118] Optionally, the preset confidence interval ratio may be plus or minus 0.06, i.e., -0.06 and 0.06.

[0119] in:

[0120] The calculation formula for the first difference is: μ-2.58*δ;

[0121] The calculation formula of the first product value is: -0.06*y; where y is the real data at the next sampling moment.

[0122] The calculation formula of the first sum is: μ+2.58*δ;

[0123] The calculation formula for the second product value is: 0.06*y.

[0124] In one possible implementation, the error standard deviation data and the error expectation data may be calculated using the predicted data and actual data for the most recent 60 minutes, that is, the data from the most recent 6 sampling points.

[0125] Optional, Figure 6 A schematic diagram of determining abnormal data generated based on a preset confidence interval provided in an embodiment of the present application is shown as follows: Figure 6 As shown, the preset confidence interval uses the default upper and lower limits of 6% (6% of the predicted value) to set the upper limit of the confidence interval (upper limit value) and the lower limit of the confidence interval (lower limit value), taking one cycle as an example.

[0126] Among them, red is the true value, yellow is the predicted value, blue is the upper bound of the confidence interval, and green is the lower bound of the confidence interval.

[0127] The above method can determine abnormal data to a certain extent, but in order to be more accurate, the abnormality determination interval is determined in combination with the features in step 51.

[0128] Optionally, the abnormality judgment interval is determined by the error in the normal distribution. Figure 7 This is a schematic diagram of the error range calculated using the normal distribution formula provided in the embodiment of the present application, as shown in FIG. Figure 7 Shown, including:

[0129] In the μ±δ interval (plus or minus 1 standard deviation), the red area accounts for 68.27% of the total area; in the μ±2δ interval (plus or minus 2 standard deviations), the red area + blue area accounts for 95.44% of the total area; in the μ±3δ interval (plus or minus 3 standard deviations), the red area + blue area + green area accounts for 99.74% of the total area.

[0130] For a normal distribution, statistics has a concept called a 95% prediction interval, meaning that if a value falls within the prediction interval with a 95% probability, and the remaining 5% is considered an anomaly, the data is considered abnormal. This embodiment uses a 99% prediction interval, i.e., μ - 2.58 * δ, μ + 2.58 * δ, which accounts for 99% of the total area. Because the prediction interval is based on the error value, when the error is small, the prediction interval is very small, which can cause a certain degree of false positives.

[0131] also, Figure 7 Also included: 90% area and 95% area.

[0132] Step 52: Determine the minimum value of the first difference value and the first product value as the lower limit value of the abnormality determination interval, and determine the maximum value of the first product value and the first sum value as the upper limit value of the abnormality determination interval.

[0133] In this step, the lower limit value of the abnormality determination interval is min(μ-2.58*δ, -0.06*y), and the upper limit value of the abnormality determination interval is max(μ+2.58*δ, 0.06*y).

[0134] In one possible implementation, combining the example in step 14 above:

[0135] For example, the lower limit value of the abnormality determination interval is determined to be -0.06*y, which is 12, and the upper limit value of the abnormality determination interval is determined to be μ+2.58*δ, which is 17. If the second difference is determined to be 4, then 4 is outside the abnormality determination interval, and the real data at the next sampling moment is considered to be abnormal data.

[0136] The method for determining abnormal data provided in an embodiment of the present application determines a first difference between the error expected data and the first data, a first product value of the lower limit value of the preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the error expected data and the first data, and a second product value of the upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment, where the first data is the third product value of the error standard deviation data and the first preset coefficient; the minimum value of the first difference and the first product value is determined as the lower limit value of the abnormal judgment interval, and the maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormal judgment interval. In this technical solution, first, by calculating the first difference between the error expectation data and the first data composed of the third product value of the error standard deviation data and the first preset coefficient, as well as the first product value of the lower limit value of the preset confidence interval ratio and the real data at the next sampling moment, basic data is provided for determining the lower limit of the abnormal judgment interval from the two dimensions of data fluctuation and the lower limit of the confidence interval. The minimum value of the two is determined as the lower limit value of the abnormal judgment interval. The discrete degree of the data itself and the preset lower limit requirement of the confidence interval are comprehensively considered, avoiding the situation where the lower limit setting is unreasonable due to a single factor, so that the lower limit value can be More accurately reflects the boundaries of the normal data range; in addition, the calculation error expected data and the first data of the first sum, as well as the preset confidence interval ratio of the upper limit value and the second product value of the real data at the next sampling moment, also provide a basis for determining the upper limit of the abnormal judgment interval from the two perspectives of data fluctuation and the upper limit of the confidence interval. The maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormal judgment interval. This not only takes into account the possible upper limit of normal data fluctuation, but also combines the upper limit requirement of the preset confidence interval ratio to ensure that the upper limit value can reasonably cover the fluctuation range of normal data and prevent the normal fluctuation data from being misjudged as abnormal. Determining the abnormal judgment interval by the above calculation method can more accurately determine whether the real data at the next sampling moment is abnormal, providing reliable support for the monitoring and analysis of business data.

[0137] Based on the above embodiments, Figure 8 Schematic diagram of the process of determining abnormal data provided in the embodiment of the present application Figure 3 ,like Figure 8 As shown, step 12 may include:

[0138] Step 81: Acquire, from the traffic data, real data at a first sampling moment, periodic data of a previous period corresponding to the first sampling moment, residual data at a previous sampling moment corresponding to the first sampling moment, trend data at a previous sampling moment corresponding to the first sampling moment, residual data at a second sampling moment, periodic data at a third sampling moment, real data at the second sampling moment, residual data at a fourth sampling moment, and trend data at a fourth sampling moment.

[0139] The third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment;

[0140] In this step, the real data of the first sampling moment and the real data of the second sampling moment of the current cycle can be directly obtained from the business volume data, and the periodic data of the previous cycle corresponding to the first sampling moment, the residual data of the previous sampling moment corresponding to the first sampling moment, the trend data of the previous sampling moment corresponding to the first sampling moment, the residual data of the second sampling moment, the periodic data of the third sampling moment, the residual data of the fourth sampling moment, and the trend data of the fourth sampling moment can be determined from the business volume data.

[0141] For some data, the implementation can be, taking the second sampling time as an example, the third sampling time and the fourth sampling time are similar:

[0142] 1) The periodic data at the second sampling moment is: γ*(real data at the second sampling moment - residual data at the second sampling moment) + (1-γ)*periodic data of the previous cycle corresponding to the second sampling moment;

[0143] That is, p i+1-k =γ*(x i+1-k -s i+1-k )+(1-γ)*p i+1-k-k

[0144] The previous cycle corresponding to the second sampling moment is the third sampling moment described below.

[0145] 2) The residual data at the second sampling moment is: α*(real data at the second sampling moment - periodic data of the previous period corresponding to the second sampling moment) + (1-α)*(residual data at the previous sampling moment corresponding to the second sampling moment + trend data at the previous sampling moment corresponding to the second sampling moment);

[0146] That is, s i+1-k =α*(x i+1-k -p i+1-k-k )+(1-α)*(s i-k +t i-k )

[0147] The previous sampling moment corresponding to the second sampling moment is the fourth sampling moment described below.

[0148] 3) The trend data at the second sampling moment is: β*(residual data at the second sampling moment-residual data at the previous sampling moment corresponding to the second sampling moment)*(1-β)*trend data at the previous sampling moment corresponding to the second sampling moment.

[0149] That is, ti+1-k =β*(s i+1-k -s i-k )+(1-β)*t i-k

[0150] The values ​​of α, β, and γ all lie between [0, 1]. For example, the closer α is to 1, the closer the smoothed data value is to the current data value, and the less smooth the data is. The closer α is to 0, the closer the smoothed value is to the smoothed value of the previous i data points, and the smoother the data is. The value of α can usually be adjusted several times to achieve the best results. In this project, after multiple attempts, α = 0.8; β = 0.2; and γ = 0.2 achieved the best data prediction results.

[0151] In addition, for the periodic data, trend data, and residual data at the initial sampling moment, the residual data = the corresponding real data, the trend data = the next real data - the corresponding real data, the smoothing value is accumulated, and the periodic data = 0.

[0152] Step 82: Determine the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment.

[0153] In this step, based on the real data at the first sampling moment, the periodic data at the second sampling moment, the residual data at the second sampling moment, the trend data at the second sampling moment, the residual data at the third sampling moment, the trend data at the third sampling moment, the real data at the second sampling moment, and the periodic data at the third sampling moment obtained above, the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment are determined based on the following steps respectively.

[0154] Optionally, step 82 may include the following implementation:

[0155] Step 1: Determine the residual data at the first sampling moment based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, and the trend data at the previous sampling moment corresponding to the first sampling moment;

[0156] In this implementation, the residual data at the first sampling moment = α*(the true value at the first sampling moment - the periodic data of the previous period corresponding to the first sampling moment) + (1-α)*(the residual data at the previous sampling moment corresponding to the first sampling moment + the trend data at the previous sampling moment corresponding to the first sampling moment).

[0157] Step 2: determining the trend data at the second sampling moment based on the residual data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment;

[0158] In this implementation, the trend data at the second sampling moment is: β*(residual data at the second sampling moment-residual data at the previous sampling moment corresponding to the second sampling moment)*(1-β)*trend data at the previous sampling moment corresponding to the second sampling moment.

[0159] That is, the fourth sampling time is the previous sampling time corresponding to the second sampling time.

[0160] Step 3: Determine the periodic data at the second sampling moment based on the true data at the second sampling moment, the residual data at the second sampling moment, and the periodic data at the third sampling moment.

[0161] In this implementation, the periodic data at the second sampling moment is: γ*(real data at the second sampling moment-residual data at the second sampling moment)+(1-γ)*periodic data of the previous cycle corresponding to the second sampling moment.

[0162] That is, the periodic data at the third sampling moment is the periodic data of the previous period corresponding to the second sampling moment.

[0163] The method for determining abnormal data provided by an embodiment of the present application obtains the real data of the first sampling moment in the business volume data, the periodic data of the previous cycle corresponding to the first sampling moment, the residual data of the previous sampling moment corresponding to the first sampling moment, the trend data of the previous sampling moment corresponding to the first sampling moment, the residual data of the second sampling moment, the periodic data of the third sampling moment, the real data of the second sampling moment, the residual data of the fourth sampling moment, and the trend data of the fourth sampling moment; wherein the third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment; according to the real data of the first sampling moment, the periodic data of the previous cycle corresponding to the first sampling moment, the residual data of the previous sampling moment corresponding to the first sampling moment, the trend data of the previous sampling moment corresponding to the first sampling moment, the residual data of the second sampling moment, the periodic data of the third sampling moment, the real data of the second sampling moment, the residual data of the fourth sampling moment, and the trend data of the fourth sampling moment, the residual data of the first sampling moment, the trend data of the second sampling moment, and the periodic data of the second sampling moment are determined. In this technical solution, by obtaining multi-dimensional information such as real data, periodic data, residual data, trend data, etc. from the business volume data at multiple sampling moments, and based on these rich data, determining the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment, it provides a more comprehensive, accurate and targeted data foundation for subsequent analysis and processing of the business volume data based on these key data (such as prediction, anomaly determination, etc.), which helps to improve the accuracy and reliability of business volume data related analysis.

[0164] Figure 9 A schematic diagram of the structure of the device for determining abnormal data provided in an embodiment of the present application is shown as follows: Figure 9 As shown, the device includes:

[0165] An acquisition module 91 is configured to acquire traffic data within a preset time period, where the preset time period includes: a plurality of cycles;

[0166] A first determining module 92 is configured to determine residual data at a first sampling moment in a current cycle of the traffic data, trend data at a second sampling moment, and period data at the second sampling moment, where the second sampling moment is a sampling moment next to the first sampling moment of a previous cycle of the current cycle;

[0167] A prediction module 93 is configured to predict the next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment, to obtain predicted data for the next sampling moment;

[0168] The second determination module 94 is used to determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval. The abnormality determination interval is determined based on a preset confidence interval ratio, the actual data at the next sampling moment, the error expectation data within a preset period, and the error standard deviation data within the preset period.

[0169] In one possible implementation, before determining whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, the second determination module 94 is further configured to:

[0170] Determining a first difference between the expected error data and the first data, a first product value of a lower limit value of a preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the expected error data and the first data, and a second product value of an upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment, wherein the first data is a third product value of the error standard deviation data and a first preset coefficient;

[0171] The minimum value of the first difference value and the first product value is determined as the lower limit value of the abnormality determination interval, and the maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormality determination interval.

[0172] In a possible implementation, the second determining module 94 is specifically configured to:

[0173] Determining a second difference between the actual data at the next sampling moment and the predicted data at the next sampling moment;

[0174] If the second difference is within the abnormality determination interval, it is determined that the real data at the next sampling moment is not abnormal data;

[0175] If the second difference is outside the abnormality determination interval, the real data at the next sampling moment is determined to be abnormal data.

[0176] In a possible implementation, the first determining module 92 is specifically configured to:

[0177] Acquire the real data at a first sampling moment in the traffic data, the periodic data of the previous cycle corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at a third sampling moment, the real data at the second sampling moment, the residual data at a fourth sampling moment, and the trend data at the fourth sampling moment; the third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment;

[0178] Based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data of the previous sampling moment corresponding to the first sampling moment, the trend data of the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment, the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment are determined.

[0179] In one possible implementation, the first determination module 92 determines the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment. Specifically, the module is configured to:

[0180] Determine residual data at the first sampling moment based on real data at the first sampling moment, periodic data of a previous period corresponding to the first sampling moment, residual data at a previous sampling moment corresponding to the first sampling moment, and trend data at a previous sampling moment corresponding to the first sampling moment;

[0181] Determining trend data at the second sampling moment based on the residual data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment;

[0182] The period data at the second sampling moment is determined according to the true data at the second sampling moment, the residual data at the second sampling moment, and the period data at the third sampling moment.

[0183] In a possible implementation, the prediction module 93 is specifically configured to:

[0184] Determining a second sum of the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment;

[0185] The second sum value is determined as the predicted data for the next sampling moment.

[0186] The device for determining abnormal data provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0187] Figure 10This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 10 As shown, the electronic device provided by this embodiment includes: at least one processor 101 and a memory 102. Optionally, the device further includes a communication component 103. The processor 101, the memory 102 and the communication component 103 are connected via a bus 104.

[0188] During the specific implementation process, at least one processor 101 executes the computer-executable instructions stored in the memory 102, so that the at least one processor 101 performs the above method.

[0189] The specific implementation process of the processor 101 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0190] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules in the processor.

[0191] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory.

[0192] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be classified into address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0193] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0194] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0195] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0196] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0197] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0198] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0199] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0200] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0201] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0202] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A method for determining abnormal data, characterized in that: include: Acquiring business volume data within a preset time period, wherein the preset time period includes: a plurality of cycles; Determining residual data at a first sampling moment in a current cycle, trend data at a second sampling moment, and period data at the second sampling moment in the traffic data, where the second sampling moment is a sampling moment next to the first sampling moment of a previous cycle of the current cycle; performing prediction processing on a next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment to obtain predicted data for the next sampling moment; Determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, where the abnormality determination interval is determined based on a preset confidence interval ratio, the actual data at the next sampling moment, the expected error data within a preset period, and the standard deviation of the error within the preset period.

2. The method according to claim 1, characterized in that Before determining whether the real data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the real data at the next sampling moment, and the abnormality determination interval, the method further includes: Determining a first difference between the expected error data and the first data, a first product value of a lower limit value of the preset confidence interval ratio and the actual data at the next sampling moment, a first sum value of the expected error data and the first data, and a second product value of an upper limit value of the preset confidence interval ratio and the actual data at the next sampling moment, wherein the first data is a third product value of the error standard deviation data and a first preset coefficient; The minimum value of the first difference value and the first product value is determined as the lower limit value of the abnormality determination interval, and the maximum value of the first product value and the first sum value is determined as the upper limit value of the abnormality determination interval.

3. The method according to claim 1, characterized in that Determining whether the real data at the next sampling moment is abnormal data according to the predicted data at the next sampling moment, the real data at the next sampling moment, and the abnormality determination interval includes: Determining a second difference between the actual data at the next sampling moment and the predicted data at the next sampling moment; If the second difference is within the abnormality determination interval, determining that the real data at the next sampling moment is not abnormal data; If the second difference is outside the abnormality determination interval, the real data at the next sampling moment is determined to be abnormal data.

4. The method according to any one of claims 1 to 3, characterized in that The determining of the residual data at a first sampling moment in a current cycle of the traffic data, the trend data at a second sampling moment, and the periodic data at the second sampling moment includes: Obtaining real data at a first sampling moment in the traffic data, periodic data of a previous cycle corresponding to the first sampling moment, residual data of a previous sampling moment corresponding to the first sampling moment, trend data of a previous sampling moment corresponding to the first sampling moment, residual data of a second sampling moment, periodic data at a third sampling moment, real data at the second sampling moment, residual data at a fourth sampling moment, and trend data at the fourth sampling moment, where the third sampling moment is the second sampling moment of the previous cycle, and the fourth sampling moment is the previous sampling moment corresponding to the second sampling moment; The residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment are determined based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment.

5. The method according to claim 4, characterized in that The determining, based on the real data at the first sampling moment, the periodic data of the previous period corresponding to the first sampling moment, the residual data at the previous sampling moment corresponding to the first sampling moment, the trend data at the previous sampling moment corresponding to the first sampling moment, the residual data at the second sampling moment, the periodic data at the third sampling moment, the real data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment, the residual data at the first sampling moment, the trend data at the fourth sampling moment, and the periodic data at the second sampling moment, includes: Determine residual data at the first sampling moment based on real data at the first sampling moment, periodic data of a previous period corresponding to the first sampling moment, residual data at a previous sampling moment corresponding to the first sampling moment, and trend data at the previous sampling moment corresponding to the first sampling moment; determining trend data at the second sampling moment according to the residual data at the second sampling moment, the residual data at the fourth sampling moment, and the trend data at the fourth sampling moment; The period data at the second sampling moment is determined according to the true data at the second sampling moment, the residual data at the second sampling moment, and the period data at the third sampling moment.

6. The method according to any one of claims 1 to 3, characterized in that The step of predicting the next sampling moment after the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the periodic data at the second sampling moment to obtain the predicted data for the next sampling moment includes: Determining a second sum of the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment; The second sum value is determined as the predicted data for the next sampling moment.

7. A device for determining abnormal data, characterized in that: include: An acquisition module, configured to acquire traffic data within a preset time period, wherein the preset time period includes: a plurality of cycles; a first determining module, configured to determine residual data at a first sampling moment in a current cycle of the traffic data, trend data at a second sampling moment, and periodic data at the second sampling moment, where the second sampling moment is a sampling moment next to the first sampling moment of a previous cycle of the current cycle; a prediction module, configured to predict a sampling moment next to the first sampling moment based on the residual data at the first sampling moment, the trend data at the second sampling moment, and the period data at the second sampling moment, to obtain predicted data for the next sampling moment; The second determination module is used to determine whether the actual data at the next sampling moment is abnormal data based on the predicted data at the next sampling moment, the actual data at the next sampling moment, and the abnormality determination interval, where the abnormality determination interval is determined based on a preset confidence interval ratio, the actual data at the next sampling moment, the expected error data within a preset period, and the standard deviation of the error within the preset period.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when the computer program is executed by a processor.

Images