Abnormal time node determination method and device

Abstract

The embodiment of the invention provides an abnormal time node determination method and device, and the method comprises the steps: determining a first time window based on a current time node and the width of a sliding time window, and enabling the first time window to comprise a plurality of time nodes including the current time node; obtaining standard data and monitoring data in the first time window, and generating a dynamic threshold based on the standard data in the first time window; and determining that the current time node is an abnormal time node under the condition that the monitoring data in the first time window and the dynamic threshold meet an abnormal judgment condition.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and apparatus for determining abnormal time points. Background Technology

[0002] Non-continuous noise and anomalous spikes are key issues affecting data quality. Traditional data anomaly detection methods mainly rely on single techniques, such as statistical methods or signal processing methods. However, in practical applications, traditional solutions rely only on local data points, making it difficult to distinguish between real anomalies and random noise. Moreover, static anomaly thresholds are difficult to adapt to dynamically changing noise levels, easily leading to false alarms. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide a method and apparatus for determining abnormal time nodes to overcome or at least partially solve the above problems.

[0004] In a first aspect, embodiments of this application provide a method for determining abnormal time points, the method comprising:

[0005] Based on the current time node and the width of the sliding time window, a first time window is determined, which includes multiple time nodes, including the current time node.

[0006] Acquire standard data and monitoring data within the first time window, and generate dynamic thresholds based on the standard data within the first time window;

[0007] If the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the current time node is determined to be an abnormal time node.

[0008] Optionally, generating a dynamic threshold based on standard data within the first time window includes at least one of the following:

[0009] Calculate the first variance and first standard deviation of the standard data within the first time window, and generate the dynamic threshold based on the first variance and first standard deviation;

[0010] Calculate the first difference result of the standard data at each time node within the first time window and the second standard deviation of the first difference result within the first time window, and generate the dynamic threshold based on the first difference result and the second standard deviation of the current time node.

[0011] Optionally, generating the dynamic threshold based on the first variance and the first standard deviation includes:

[0012] The difference between the first variance and N times the first standard deviation is calculated to obtain the first threshold in the dynamic threshold, where N is a value greater than 0;

[0013] The second threshold in the dynamic threshold is obtained by calculating the sum of the first variance and N times the first standard deviation.

[0014] Optionally, if the dynamic threshold includes the first threshold and the second threshold, the method further includes:

[0015] Calculate the second variance of the monitoring data within the first time window;

[0016] If the second variance exceeds the threshold range formed by the first threshold and the second threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions.

[0017] Optionally, generating the dynamic threshold based on the first difference result and the second standard deviation at the current time point includes:

[0018] The difference obtained by subtracting the second standard deviation from the first difference result at the current time node is used to obtain the third threshold in the dynamic threshold.

[0019] The sum of the first difference result at the current time point and the second standard deviation is calculated to obtain the fourth threshold in the dynamic threshold.

[0020] Optionally, if the dynamic threshold includes the third threshold and the fourth threshold, the method further includes:

[0021] The monitoring data at the current time point is differentially calculated to obtain the second differential result;

[0022] If the second difference result exceeds the threshold range formed by the third threshold and the fourth threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions.

[0023] Optionally, after determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes:

[0024] Based on the current time node and the width of the sliding time window, a second time window is determined, wherein multiple time nodes within the second time window are all time nodes after the current time node;

[0025] Acquire standard data and monitoring data within the second time window;

[0026] Image gradient calculation and multilinear trend calculation were performed on the standard data and monitoring data within the second time window, respectively, to obtain the calculation results;

[0027] If the calculated result is less than the preset result, an abnormal alarm will be issued at the current time point;

[0028] If the calculation result is greater than or equal to the preset result, the current time node will be redefined as a normal time node.

[0029] Optionally, obtaining the standard data within the first time window includes:

[0030] Based on the current time point, obtain the first historical data within the first historical time period and the second historical data within the second historical time period;

[0031] The first historical data and the second historical data are weighted and averaged to obtain the standard data.

[0032] Obtain the standard data within the first time window from the standard data.

[0033] Optionally, before determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes:

[0034] Calculate the standard score within the monitoring data in the first time window;

[0035] The step of determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions includes:

[0036] If the monitoring data within the first time window meets the abnormality judgment conditions with the dynamic threshold, and the standard score exceeds the preset score threshold, then the current time node is determined to be an abnormal time node.

[0037] Secondly, embodiments of this application also provide a device for determining abnormal time points, the device comprising:

[0038] The first determining module is used to determine a first time window based on the current time node and the width of the sliding time window, wherein the first time window includes multiple time nodes including the current time node.

[0039] The generation module is used to acquire standard data and monitoring data within the first time window, and generate dynamic thresholds based on the standard data within the first time window.

[0040] The second determining module is used to determine the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the abnormal determination conditions.

[0041] Thirdly, embodiments of this application also provide an electronic device, including a memory, a transceiver, and a processor:

[0042] A memory for storing computer programs; a transceiver for sending and receiving data under the control of a processor; and a processor for reading the computer programs from the memory and executing the method described in the first aspect above.

[0043] Fourthly, embodiments of this application also provide a processor-readable storage medium storing a computer program for causing the processor to perform the method described in the first aspect above.

[0044] In the embodiments described above, a first time window is determined based on the current time node and the width of the sliding time window. Standard data and monitoring data within the first time window are acquired. A dynamic threshold is generated based on the standard data within the first time window. If the monitoring data within the first time window and the dynamic threshold satisfy the anomaly determination criteria, the current time node is determined to be an anomalous time node. This scheme, because the first time window includes multiple time nodes, including the current time node, rather than relying solely on local data points—that is, transforming single-time-series analysis into correlation analysis of multiple time series—is better able to distinguish between real anomalies and random noise. Furthermore, the anomaly determination threshold is a dynamic threshold obtained based on standard data, which is more adaptable to dynamically changing noise levels and reduces the false alarm rate. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a graph showing the relationship between time and observed values ​​for horizontal drift outliers;

[0047] Figure 2 A flowchart illustrating the method for determining abnormal time points provided in the embodiments of this application;

[0048] Figure 3 A detailed flowchart of the method for determining abnormal time nodes provided in the embodiments of this application;

[0049] Figure 4 A structural block diagram of the device for determining abnormal time nodes provided in the embodiments of this application;

[0050] Figure 5 A structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0052] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0053] The current types of time series anomalies include the following four:

[0054] The first type is additive outliers (AO). Additive outliers do not persist; that is, they only affect the observations at the time the outlier occurs. Therefore, additive outliers have no impact on future predictions and can be understood as isolated events.

[0055] The second type is the Innovational Outlier (IO). This type of outlier not only interferes with the observation at the current time, but also affects all observations in the sequence after the current time. It can be understood as an interventional outlier, a kind of impulsive shock.

[0056] The third type is horizontal shift (LS), which raises or lowers the series mean starting from the point where the outlier occurs. The change in the mean is sudden and permanent, and can be modeled using a step function. Its amplitude is equal to the mean jump amplitude parameter omega. Specifically, as shown... Figure 1 As shown, the horizontal axis represents time, and the vertical axis represents the observed values.

[0057] The fourth type is transient shift (TS) outliers. These outliers have an initial effect when they occur at time T, and then decay exponentially over time depending on the magnitude of the decay factor, eventually returning to normal.

[0058] Of the four main types of time series inflection points mentioned above, this application mainly focuses on the third type. From a business perspective, data spikes at a single time point or short-term time points are possible. However, these spikes and short-term spikes do not affect the overall market and do not require excessive reminders to business personnel.

[0059] Therefore, this application provides a method and apparatus for determining abnormal time points, which can identify inflection points or abrupt changes in time series data, i.e., the locations where abnormal changes occur in the data. Inflection point anomalies usually indicate sudden changes in the data, possibly caused by some sudden event or abnormal situation. The purpose of inflection point anomaly detection is to help identify these abnormal changes so that corresponding measures or adjustment strategies can be taken in a timely manner. Through inflection point anomaly detection, the monitoring and prediction capabilities of data can be improved, manpower can be freed up, and thus, abnormal situations can be responded to more quickly.

[0060] The method for determining abnormal time nodes provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0061] Specifically, embodiments of this application provide a method for determining abnormal time points, such as... Figure 2 As shown, the specific steps may include the following:

[0062] Step 201: Based on the current time node and the width of the sliding time window, determine a first time window, which includes multiple time nodes including the current time node.

[0063] Specifically, when determining whether the current time node is an abnormal time node, the width of the current time node and the sliding time window are obtained. Based on the current time node and the width of the sliding time window, the first time window including the current time node can be determined.

[0064] In one embodiment, the first time window includes multiple time nodes (e.g., six time nodes), with the current time node being the last time node. For example, the current time node is 07:00 on July 20th, and the first time window includes six time nodes: 6:35, 6:40, 6:45, 6:50, 6:55, and 7:00.

[0065] In one embodiment, the time difference between two adjacent time nodes can be set to 5 minutes. To ensure that the algorithm matches the current time node during execution, a rounding operation of 5 is adopted. That is, when the rounding position is 5, the processing method of whether to carry over 1 to the next position is usually processed according to the "rounding up" rule, i.e., carry over.

[0066] Step 202: Obtain standard data and monitoring data within the first time window, and generate a dynamic threshold based on the standard data within the first time window.

[0067] After determining the first time window, standard data and monitoring data within the first time window are acquired, and a dynamic threshold is generated based on the standard data within the first time window. The threshold for anomaly detection is a dynamic threshold obtained based on the standard data. The dynamic threshold is more adaptable to dynamically changing noise levels and reduces the false alarm rate.

[0068] It should be noted that, due to the width of the sliding time window, to avoid the monitoring period of the day not meeting the width of the sliding time window, the monitoring period of the monitoring data is set to the current time node and the previous day, and then the monitoring data within the first time window is obtained from the monitoring data of the current time node and the previous day.

[0069] Step 203: If the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, determine the current time node as an abnormal time node.

[0070] Specifically, it is determined whether the monitoring data and dynamic threshold within the first time window meet the anomaly judgment conditions. If the monitoring data and dynamic threshold within the first time window meet the anomaly judgment conditions, the current time node can be determined as an abnormal time node, and an anomaly alarm can be issued for the current time node as an abnormal time node.

[0071] In the embodiments described above, a first time window is determined based on the current time node and the width of the sliding time window. Standard data and monitoring data within the first time window are acquired. A dynamic threshold is generated based on the standard data within the first time window. If the monitoring data within the first time window and the dynamic threshold satisfy the anomaly determination criteria, the current time node is determined to be an anomalous time node. This scheme, because the first time window includes multiple time nodes, including the current time node, rather than relying solely on local data points—that is, transforming single-time-series analysis into correlation analysis of multiple time series—is better able to distinguish between real anomalies and random noise. Furthermore, the anomaly determination threshold is a dynamic threshold obtained based on standard data, which is more adaptable to dynamically changing noise levels and reduces the false alarm rate.

[0072] In one optional specific embodiment, the system periodically (e.g., hourly) pulls monitoring data from a certain node. Each data record has a timestamp indicating the time point of the data. The system compares the time point at which the data should have been received (i.e., the current time point) with the actual time point at which the data was received (i.e., the data's timestamp). If the current time point and the data's timestamp do not match (e.g., the current time point is 10:00, but the received data's timestamp is 8:00), it indicates data delay or data anomaly, and the algorithm returns 0 (indicating that no valid data was obtained this time). If the last digit of the returned data is 0 (i.e., the units digit is 0), and the sum of the last six digits is 0 (e.g., the data is 000000, 100000, 000000000, etc.), then a data missing alarm message is output, indicating that no data was collected during this time period, and the system returns a placeholder value of "all zeros". If the last digit of the returned data is 0, but the sum of the last six digits is not 0 (e.g., the data is 123450, 000010, 999990, etc.), then an alarm message indicating that the node data has not been updated will be output, indicating that the node has data, but it is not the latest data (e.g., old data may be returned repeatedly or the cache may not be refreshed).

[0073] In an optional specific embodiment, step 202, acquiring standard data within the first time window, includes:

[0074] Based on the current time point, obtain the first historical data within the first historical time period and the second historical data within the second historical time period;

[0075] The first historical data and the second historical data are weighted and averaged to obtain the standard data.

[0076] Obtain the standard data within the first time window from the standard data.

[0077] Specifically, based on the current time point, a first historical time period and a second historical time period are determined. These two historical time periods are two distinct historical periods. First historical data within the first historical time period and second historical data within the second historical time period are acquired. To avoid excessive noise interference, similar to spikes in a single node or short time series, the first and second historical data are first standardized to achieve initial data smoothing. A weighted average is then calculated between the standardized first and second historical data to obtain standard data. Standard data within the first time window is then extracted from this standard data.

[0078] For example: the current time point is 07:00 on July 20th, the monitoring period is from 00:00 on July 19th to 07:00 on July 20th, the first historical time period is from 00:00 on July 17th to 00:00 on July 18th, and the second historical time period is from 00:00 on July 6th to 00:00 on July 7th. Based on weighted scores, the historical data for each time point are regenerated to obtain a new time series, i.e., standard data. The standard data corresponding to the first time window is then obtained from the standard data.

[0079] The weight of historical data closer to the current time point is higher, and the weight of historical data farther away from the current time point is lower. For example, since the first historical time period is closer to the current time point, its corresponding weight value is 0.7, and since the second historical time period is farther away from the current time point, its corresponding weight value is 0.3.

[0080] In an optional specific embodiment, step 202 generates a dynamic threshold based on standard data within the first time window, including at least one of the following:

[0081] The first step: Calculate the first variance and the first standard deviation of the standard data within the first time window, and generate the dynamic threshold based on the first variance and the first standard deviation.

[0082] The second step is to calculate the first difference result of the standard data at each time node within the first time window and the second standard deviation of the first difference result within the first time window, and to generate the dynamic threshold based on the first difference result and the second standard deviation of the current time node.

[0083] In one embodiment, based on standard data within a first time window, a first variance and a first standard deviation of the standard data within the first time window are calculated to eliminate the impact of periodic "glitch" and single-time-node anomalies. A dynamic threshold (which can be defined as a first dynamic threshold) is then generated based on the first variance and the first standard deviation. If the monitoring data within the first time window meets the anomaly determination criteria with respect to the first dynamic threshold, the current time node is determined to be an abnormal time node.

[0084] In one embodiment, based on standard data within a first time window, a first difference result of the standard data at each time node within the first time window is calculated, and a second standard deviation within the first time window is calculated based on the first difference results of each time node within the first time window. A dynamic threshold (which can be defined as a second dynamic threshold) is generated based on the first difference result and the second standard deviation of the current time node. If the monitoring data within the first time window and the second dynamic threshold satisfy the anomaly determination condition, the current time node is determined to be an abnormal time node. The first difference result can be the difference result obtained by performing a first-order difference on the standard data at each time node. The second standard deviation is obtained by calculating the standard deviation of the first difference results for all time nodes within the first time window.

[0085] In one embodiment, based on standard data within a first time window, a first variance and a first standard deviation of the standard data within the first time window are calculated, and a dynamic threshold (which can be defined as a first dynamic threshold) is generated based on the first variance and the first standard deviation. Furthermore, based on the standard data within the first time window, a first difference result of the standard data at each time node within the first time window is calculated, and a second standard deviation within the first time window is calculated based on the first difference result of each time node within the first time window. A dynamic threshold (which can be defined as a second dynamic threshold) is generated based on the first difference result and the second standard deviation of the current time node. If the monitoring data within the first time window, the first dynamic threshold, and the second dynamic threshold all meet the anomaly determination criteria, the current time node is determined to be an abnormal time node.

[0086] In an optional specific embodiment, the step of generating the dynamic threshold based on the first variance and the first standard deviation in the first item above specifically includes:

[0087] The difference between the first variance and N times the first standard deviation is calculated to obtain the first threshold in the dynamic threshold, where N is a value greater than 0;

[0088] The second threshold in the dynamic threshold is obtained by calculating the sum of the first variance and N times the first standard deviation.

[0089] Specifically, after obtaining the first variance and the first standard deviation, the difference obtained by subtracting N times the first standard deviation from the first variance is calculated. This difference is used as the first threshold in the dynamic threshold, where N is a value greater than 0. The value of N can be set as needed; a larger N indicates a higher tolerance for this short period. Furthermore, the sum obtained by adding N times the first standard deviation to the first variance is calculated, and this sum is used as the second threshold in the dynamic threshold. The first threshold and the second threshold form a threshold range, which are the upper and lower limits of this threshold range.

[0090] In an optional specific embodiment, where the dynamic threshold includes the first threshold and the second threshold, the method further includes:

[0091] Calculate the second variance of the monitoring data within the first time window;

[0092] If the second variance exceeds the threshold range formed by the first threshold and the second threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions.

[0093] Specifically, if the dynamic threshold includes a first threshold and a second threshold, it is also necessary to calculate the second variance of the monitoring data within the first time window and determine whether the second variance falls within the threshold range formed by the first and second thresholds. That is, to determine whether the second variance is greater than or equal to the first threshold and whether the second variance is less than or equal to the second threshold. If the second variance exceeds the threshold range formed by the first and second thresholds, that is, the second variance is less than the first threshold or greater than the second threshold, then it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions, and the current time node can be further determined as an abnormal time node.

[0094] In an optional specific embodiment, the step of generating the dynamic threshold based on the first difference result and the second standard deviation at the current time point in the second item above specifically includes:

[0095] The difference obtained by subtracting the second standard deviation from the first difference result at the current time node is used to obtain the third threshold in the dynamic threshold.

[0096] The sum of the first difference result at the current time point and the second standard deviation is calculated to obtain the fourth threshold in the dynamic threshold.

[0097] Specifically, after obtaining the first difference result and the second standard deviation at the current time, the difference obtained by subtracting the second standard deviation from the first difference result at the current time node is calculated, and this difference is used as the third threshold in the dynamic threshold. Furthermore, the sum obtained by adding the first difference result and the second standard deviation at the current time node is calculated, and this sum is used as the fourth threshold in the dynamic threshold. The third threshold and the fourth threshold form a threshold range, which are the upper and lower limits of this threshold range.

[0098] In an optional specific embodiment, where the dynamic threshold includes the third threshold and the fourth threshold, the method further includes:

[0099] The monitoring data at the current time point is differentially calculated to obtain the second differential result;

[0100] If the second difference result exceeds the threshold range formed by the third threshold and the fourth threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions.

[0101] Specifically, if the dynamic threshold includes a third and a fourth threshold, a first-order difference calculation is needed to obtain the second difference result from the monitoring data at the current time point. It is then determined whether the second difference result falls within the threshold range formed by the third and fourth thresholds; that is, whether the second difference result is greater than or equal to the third threshold and less than or equal to the fourth threshold. If the second difference result exceeds the threshold range formed by the third and fourth thresholds (i.e., the second difference result is less than the third threshold or greater than the fourth threshold), then the monitoring data within the first time window meets the anomaly determination criteria with the dynamic threshold, and the current time point can be further identified as an abnormal time point.

[0102] In an optional specific embodiment, before determining the current time node as an abnormal time node in step 203, where the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes:

[0103] Calculate the standard score within the monitoring data in the first time window;

[0104] The step of determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions includes:

[0105] If the monitoring data within the first time window meets the abnormality judgment conditions with the dynamic threshold, and the standard score exceeds the preset score threshold, then the current time node is determined to be an abnormal time node.

[0106] Specifically, after determining the first time window and the monitoring data within it, a standard score (zscore) is calculated for the monitoring data within the first time window to check if the current time point is an outlier. Furthermore, after determining the dynamic threshold, if the monitoring data within the first time window and the dynamic threshold meet the anomaly criteria, and the standard score exceeds a preset score threshold, then the current time point is determined to be an anomalous time point. Conversely, if the monitoring data within the first time window and the dynamic threshold meet the anomaly criteria, and the standard score does not exceed the preset score threshold, then the current time point is determined to be a normal time point; if the monitoring data within the first time window and the dynamic threshold do not meet the anomaly criteria, and the standard score exceeds the preset score threshold, then the current time point is determined to be a normal time point; if the monitoring data within the first time window and the dynamic threshold do not meet the anomaly criteria, and the standard score does not exceed the preset score threshold, then the current time point is determined to be a normal time point.

[0107] In an optional specific embodiment, after determining the current time node as an abnormal time node in step 203, where the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes:

[0108] Based on the current time node and the width of the sliding time window, a second time window is determined, wherein multiple time nodes within the second time window are all time nodes after the current time node;

[0109] Acquire standard data and monitoring data within the second time window;

[0110] Image gradient calculation and multilinear trend calculation were performed on the standard data and monitoring data within the second time window, respectively, to obtain the calculation results;

[0111] If the calculated result is less than the preset result, an abnormal alarm will be issued at the current time point;

[0112] If the calculation result is greater than or equal to the preset result, the current time node will be redefined as a normal time node.

[0113] For the time points where anomalies are identified through anomaly detection criteria, since the future development trend of the point is unknown when making judgments at the current time point, it is necessary to perform anomaly verification again. Specifically:

[0114] As the sliding time window moves along the time axis, a second time window is determined based on the current time node and the width of the sliding time window. Multiple time points within this second time window are future time nodes following the current time node, with the first time node in the second time window being the next time node after the current time node. Standard data within the second time window is obtained from standard data, and monitoring data within the second time window is also obtained from the monitoring data throughout the entire monitoring period. Image gradient calculation and multilinear trend calculation are performed on both the standard data and the monitoring data within the second time window to obtain the calculation results. The calculation results are compared with preset results. If the calculation result is less than the preset result, the current time node is determined to be an abnormal time node, and an abnormal alarm is issued for the current time node. If the calculation result is greater than or equal to the preset result, the current time node is redefined as a normal time node, and no alarm is issued.

[0115] In one embodiment, the process of calculating image gradients and multiple linear trends for the standard data and the monitoring data within the second time window is as follows:

[0116] Image gradient calculations are performed on both the standard data and the monitored data within the second time window to obtain standard gradient sequences and monitored gradient sequences. Multiple linear trend calculations are then performed on both sequences to obtain standard slope vectors and monitored slope vectors. The similarity value between these two vectors is then calculated. If the similarity value is less than a preset value, an anomaly alarm is triggered for the current time node. If the similarity value is greater than or equal to the preset value, the current time node is redefined as a normal time node to avoid false alarms.

[0117] like Figure 3 As shown, the above solution will be illustrated below through a specific embodiment:

[0118] Step 301: Determine the first time window based on the current time node and the width of the sliding time window.

[0119] Step 302: Based on the current time node, obtain the first historical data within the first historical time period and the second historical data within the second historical time period.

[0120] Step 303: Calculate the weighted average of the first historical data and the second historical data to obtain the standard data.

[0121] Step 304: Obtain the standard data within the first time window from the standard data, and obtain the monitoring data within the first time window from the monitoring data within the monitoring period.

[0122] Step 305: Generate a dynamic threshold based on the standard data within the first time window.

[0123] Step 306: If the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, determine the second time window based on the current time node and the width of the sliding time window.

[0124] Step 307: Obtain standard data and monitoring data within the second time window.

[0125] Step 308: Perform image gradient calculation and multiple linear trend calculation on the standard data and monitoring data within the second time window respectively to obtain the calculation results.

[0126] Step 309: If the calculation result is less than the preset result, determine the current time node as an abnormal time node.

[0127] Step 310: If the monitoring data and dynamic threshold within the first time window do not meet the abnormal judgment conditions, or if the calculation result is greater than or equal to the preset result, determine the current time node as a normal time node.

[0128] In summary, the embodiments of this application, by including multiple time points, including the current time point, within the first time window instead of relying solely on local data points—that is, transforming single-time-series analysis into correlation analysis of multiple time series—are better able to distinguish between genuine anomalies and random noise. Furthermore, by using moving variance and moving standard deviation, spikes and bumps in the data are smoothed, reducing the impact of noise. Moreover, the anomaly detection threshold is a dynamic threshold derived from standard data; this dynamic threshold is better able to adapt to dynamically changing noise levels, reducing the false alarm rate.

[0129] The above describes the method for determining abnormal time nodes provided in the embodiments of this application. The following will describe the device for determining abnormal time nodes provided in the embodiments of this application with reference to the accompanying drawings.

[0130] like Figure 4 As shown in the figure, this application embodiment also provides a device 400 for determining abnormal time nodes, the device comprising:

[0131] The first determining module 401 is used to determine a first time window based on the current time node and the width of the sliding time window, wherein the first time window includes multiple time nodes including the current time node.

[0132] The generation module 402 is used to acquire standard data and monitoring data within the first time window, and generate a dynamic threshold based on the standard data within the first time window;

[0133] The second determining module 403 is used to determine the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the abnormal determination conditions.

[0134] Optionally, when generating a dynamic threshold based on standard data within the first time window, the generation module 402 is specifically used for at least one of the following:

[0135] Calculate the first variance and first standard deviation of the standard data within the first time window, and generate the dynamic threshold based on the first variance and first standard deviation;

[0136] Calculate the first difference result of the standard data at each time node within the first time window and the second standard deviation of the first difference result within the first time window, and generate the dynamic threshold based on the first difference result and the second standard deviation of the current time node.

[0137] Optionally, when generating the dynamic threshold based on the first variance and the first standard deviation, the generation module 402 is specifically used for:

[0138] The difference between the first variance and N times the first standard deviation is calculated to obtain the first threshold in the dynamic threshold, where N is a value greater than 0;

[0139] The second threshold in the dynamic threshold is obtained by calculating the sum of the first variance and N times the first standard deviation.

[0140] Optionally, if the dynamic threshold includes the first threshold and the second threshold, the device further includes:

[0141] The first calculation module is used to calculate the second variance of the monitoring data within the first time window;

[0142] The third determining module is used to determine that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions when the second variance exceeds the threshold range formed by the first threshold and the second threshold.

[0143] Optionally, when generating the dynamic threshold based on the first difference result and the second standard deviation at the current time point, the generation module 402 is specifically used for:

[0144] The difference obtained by subtracting the second standard deviation from the first difference result at the current time node is used to obtain the third threshold in the dynamic threshold.

[0145] The sum of the first difference result at the current time point and the second standard deviation is calculated to obtain the fourth threshold in the dynamic threshold.

[0146] Optionally, if the dynamic threshold includes the third threshold and the fourth threshold, the device further includes:

[0147] The second calculation module is used to perform differential calculation on the monitoring data at the current time node to obtain the second differential result;

[0148] The fourth determining module is used to determine that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions when the second difference result exceeds the threshold range formed by the third threshold and the fourth threshold.

[0149] Optionally, the device further includes:

[0150] The fifth determining module is used to determine a second time window based on the current time node and the width of the sliding time window, wherein multiple time nodes within the second time window are time nodes after the current time node;

[0151] The acquisition module is used to acquire standard data and monitoring data within the second time window;

[0152] The third calculation module is used to perform image gradient calculation and multiple linear trend calculation on the standard data and monitoring data within the second time window, respectively, to obtain the calculation results.

[0153] The alarm module is used to issue an abnormal alarm at the current time node if the calculation result is less than the preset result;

[0154] The sixth determining module is used to redetermine the current time node as a normal time node if the calculation result is greater than or equal to the preset result.

[0155] Optionally, when the generation module 402 acquires the standard data within the first time window, it is specifically used for:

[0156] Based on the current time point, obtain the first historical data within the first historical time period and the second historical data within the second historical time period;

[0157] The first historical data and the second historical data are weighted and averaged to obtain the standard data.

[0158] Obtain the standard data within the first time window from the standard data.

[0159] Optionally, the device further includes:

[0160] The fourth calculation module is used to calculate the standard score within the monitoring data in the first time window;

[0161] The second determining module 403 is specifically used for:

[0162] If the monitoring data within the first time window meets the abnormality judgment conditions with the dynamic threshold, and the standard score exceeds the preset score threshold, then the current time node is determined to be an abnormal time node.

[0163] It should be noted that the above-mentioned abnormal time node determination device provided in this application embodiment can implement all the method steps implemented in the above-mentioned abnormal time node determination method embodiment, and can achieve the same technical effect. Here, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail.

[0164] It should be noted that the division of units in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0165] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0166] like Figure 5 As shown, embodiments of this application also provide an electronic device, including a memory 620, a transceiver 610, and a processor 600:

[0167] Memory 620 is used to store computer programs;

[0168] Transceiver 610 is used to send and receive data under the control of the processor;

[0169] Processor 600 is configured to read a computer program from memory and execute the steps of the method for determining abnormal time points as described in any of the above embodiments.

[0170] Among them, Figure 5 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 600) and memory (memory 620). The bus architecture can also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 610 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical fibers, etc. The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 during operation.

[0171] The processor 600 can be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor can also adopt a multi-core architecture.

[0172] The processor executes the method for determining abnormal time points provided in this application embodiment by calling a computer program stored in memory, according to the obtained executable instructions. The processor and memory can also be physically separated.

[0173] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above-mentioned method embodiment for determining abnormal time nodes, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0174] Embodiments of this application also provide a processor-readable storage medium storing a computer program for causing the processor to execute the above-described method for determining abnormal time nodes.

[0175] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0176] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0177] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0178] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0179] These processors can execute instructions that can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0180] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for determining abnormal time points, characterized in that, The method includes: Based on the current time node and the width of the sliding time window, a first time window is determined, which includes multiple time nodes, including the current time node. Acquire standard data and monitoring data within the first time window, and generate dynamic thresholds based on the standard data within the first time window; If the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the current time node is determined to be an abnormal time node.

2. The method according to claim 1, characterized in that, The generation of dynamic thresholds based on standard data within the first time window includes at least one of the following: Calculate the first variance and first standard deviation of the standard data within the first time window, and generate the dynamic threshold based on the first variance and first standard deviation; Calculate the first difference result of the standard data at each time node within the first time window and the second standard deviation of the first difference result within the first time window, and generate the dynamic threshold based on the first difference result and the second standard deviation of the current time node.

3. The method according to claim 2, characterized in that, The step of generating the dynamic threshold based on the first variance and the first standard deviation includes: The difference between the first variance and N times the first standard deviation is calculated to obtain the first threshold in the dynamic threshold, where N is a value greater than 0; The second threshold in the dynamic threshold is obtained by calculating the sum of the first variance and N times the first standard deviation.

4. The method according to claim 3, characterized in that, When the dynamic threshold includes the first threshold and the second threshold, the method further includes: Calculate the second variance of the monitoring data within the first time window; If the second variance exceeds the threshold range formed by the first threshold and the second threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions.

5. The method according to claim 2, characterized in that, The process of generating the dynamic threshold based on the first difference result and the second standard deviation at the current time point includes: The difference obtained by subtracting the second standard deviation from the first difference result at the current time node is used to obtain the third threshold in the dynamic threshold. The sum of the first difference result at the current time point and the second standard deviation is calculated to obtain the fourth threshold in the dynamic threshold.

6. The method according to claim 5, characterized in that, When the dynamic threshold includes the third threshold and the fourth threshold, the method further includes: The monitoring data at the current time point is differentially calculated to obtain the second differential result; If the second difference result exceeds the threshold range formed by the third threshold and the fourth threshold, it is determined that the monitoring data within the first time window and the dynamic threshold meet the anomaly judgment conditions.

7. The method according to claim 1, characterized in that, After determining that the current time node is an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes: Based on the current time node and the width of the sliding time window, a second time window is determined, wherein multiple time nodes within the second time window are all time nodes after the current time node; Acquire standard data and monitoring data within the second time window; Image gradient calculation and multilinear trend calculation were performed on the standard data and monitoring data within the second time window, respectively, to obtain the calculation results; If the calculated result is less than the preset result, an abnormal alarm will be issued at the current time point; If the calculation result is greater than or equal to the preset result, the current time node will be redefined as a normal time node.

8. The method according to claim 1, characterized in that, The acquisition of standard data within the first time window includes: Based on the current time point, obtain the first historical data within the first historical time period and the second historical data within the second historical time period; The first historical data and the second historical data are weighted and averaged to obtain the standard data. Obtain the standard data within the first time window from the standard data.

9. The method according to any one of claims 1 to 8, characterized in that, Before determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions, the method further includes: Calculate the standard score within the monitoring data in the first time window; The step of determining the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the anomaly determination conditions includes: If the monitoring data within the first time window meets the abnormality judgment conditions with the dynamic threshold, and the standard score exceeds the preset score threshold, then the current time node is determined to be an abnormal time node.

10. A device for determining abnormal time points, characterized in that, The device includes: The first determining module is used to determine a first time window based on the current time node and the width of the sliding time window, wherein the first time window includes multiple time nodes including the current time node. The generation module is used to acquire standard data and monitoring data within the first time window, and generate dynamic thresholds based on the standard data within the first time window. The second determining module is used to determine the current time node as an abnormal time node when the monitoring data within the first time window and the dynamic threshold meet the abnormal determination conditions.

11. An electronic device, characterized in that, Includes memory, transceiver, and processor: Memory, used to store computer programs; Transceiver, used to send and receive data under the control of the processor; A processor is configured to read a computer program from the memory and execute the method for determining an abnormal time point as described in any one of claims 1 to 9.

12. A processor-readable storage medium, characterized in that, The processor-readable storage medium stores a computer program for causing the processor to execute the method for determining abnormal time points as described in any one of claims 1 to 9.

Images