Abnormality detection method, device and equipment

Abstract

The embodiment of the invention discloses an anomaly detection method, device and equipment. The method comprises the following steps: receiving an anomaly detection request for UPS (Uninterrupted Power Supply) equipment; in response to the anomaly detection request, acquiring state time sequence data of the UPS equipment; determining global features and local features of the state time sequence data by using a pre-trained anomaly detection model, determining an anomaly detection result of the UPS equipment according to the global features and the local features, and determining whether the UPS equipment is abnormal or not according to the anomaly detection result of the UPS equipment; and under the condition that the UPS equipment is determined to be abnormal based on the abnormal detection result of the UPS equipment, a target abnormal path corresponding to the UPS is determined based on the topological connection relation between the equipment, and abnormal early warning processing is carried out on the target abnormal path.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, and device. Background Technology

[0002] With the rapid development of mobile communication networks, the operation and maintenance management of uninterruptible power supply (UPS) equipment has become crucial to ensure users' network service experience.

[0003] UPS equipment can be managed manually through inspections. For example, after receiving an alarm notification of a UPS equipment failure, maintenance personnel can manually query data relationships or communicate with relevant personnel to understand the affected network elements and equipment. This leads to low efficiency and accuracy in fault location and resolution. Therefore, a technical solution is needed to improve the efficiency and accuracy of anomaly detection of UPS equipment and its affected links, so as to quickly and accurately locate and handle faults. Summary of the Invention

[0004] The purpose of this invention is to provide a technical solution for quickly and accurately locating and handling faults by improving the efficiency and accuracy of anomaly detection of UPS equipment and its affected links.

[0005] To solve the above-mentioned technical problems, the embodiments of the present invention are implemented as follows: In a first aspect, an anomaly detection method is provided by an embodiment of the present invention, the method comprising: Receive anomaly detection requests for UPS equipment; In response to the anomaly detection request, the status timing data of the UPS device is obtained; Using a pre-trained anomaly detection model, the global and local features of the state time series data are determined respectively. Based on the global and local features, the anomaly detection result of the UPS device is determined, and based on the anomaly detection result of the UPS device, it is determined whether the UPS device has an anomaly. If an anomaly is determined to exist in the UPS device based on the anomaly detection results, a target anomaly path corresponding to the UPS is determined based on the topological connection relationship between the devices, and anomaly warning processing is performed on the target anomaly path.

[0006] Secondly, embodiments of the present invention provide an anomaly detection device, the device comprising: The request receiving module is used to receive anomaly detection requests for UPS equipment. The data acquisition module is used to acquire the status timing data of the UPS device in response to the anomaly detection request; An anomaly detection module is used to determine the global and local features of the state time series data using a pre-trained anomaly detection model, and to determine the anomaly detection result of the UPS device based on the global and local features, and to determine whether the UPS device has an anomaly based on the anomaly detection result of the UPS device. The anomaly warning module is used to determine the target anomaly path corresponding to the UPS based on the topological connection relationship between the devices when the anomaly detection result of the UPS device indicates that the UPS device is abnormal, and to perform anomaly warning processing on the target anomaly path.

[0007] Thirdly, embodiments of the present invention provide an anomaly detection device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the anomaly detection method provided in the above embodiments.

[0008] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the anomaly detection method provided in the above embodiments.

[0009] Fifthly, embodiments of the present invention provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the anomaly detection method provided in the above embodiments. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating an anomaly detection method according to the present invention; Figure 2 This is a flowchart illustrating the process for determining anomaly detection results according to the present invention. Figure 3 This is a schematic diagram of the data processing process of an anomaly detection model according to the present invention; Figure 4 This is a flowchart illustrating an abnormal path determination method according to the present invention. Figure 5This is a flowchart illustrating an anomaly detection method according to the present invention; Figure 6 This is a schematic diagram of the structure of an anomaly detection device according to the present invention; Figure 7 This is a schematic diagram of the structure of an anomaly detection device according to the present invention. Detailed Implementation

[0012] This invention provides an anomaly detection method, apparatus, and device.

[0013] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0014] This specification provides an anomaly detection method, apparatus, and equipment. Manual inspections are used for UPS equipment movement management. For example, after receiving an alarm notification of a UPS equipment failure, maintenance personnel can manually query data relationships or communicate with relevant personnel to understand the affected network elements and equipment. This leads to low efficiency and accuracy in fault location and resolution. Therefore, a technical solution is needed to improve the efficiency and accuracy of anomaly detection for UPS equipment and its affected links, enabling rapid and accurate fault location and handling. In this solution, an anomaly detection request for the UPS equipment is received. In response to the request, the status time-series data of the UPS equipment is acquired. Using a pre-trained anomaly detection model, the global and local features of the status time-series data are determined. Based on these features, the anomaly detection result is determined, and the presence of an anomaly in the UPS equipment is determined. If an anomaly is determined based on the anomaly detection result, a target anomaly path corresponding to the UPS is determined based on the topological connection relationship between devices, and anomaly warning processing is performed on the target anomaly path. In this way, by using UPS status timing data and anomaly detection models, it is possible to quickly and accurately determine whether there are any anomalies in the UPS equipment, improving the efficiency and accuracy of fault detection. If an anomaly is confirmed in the UPS equipment, the impact path (i.e., the target anomaly path) can be quickly determined based on the topological connections between the devices, accelerating fault location and avoiding the inefficiency of manually querying relational data for fault location. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services. Specific processing details can be found in the following embodiments.

[0015] like Figure 1 As shown, this embodiment of the invention provides an anomaly detection method. The execution subject of this method can be a terminal device or a server. The terminal device can be a mobile terminal device such as a mobile phone, tablet computer, or smartwatch, or a terminal device such as a computer. The server can be an independent server or a server cluster composed of multiple servers. Specifically, the method may include the following steps: In step S102, an anomaly detection request for the UPS equipment is received.

[0016] Among them, the UPS equipment can be any UPS equipment to be tested. A UPS equipment is an uninterruptible power supply containing an energy storage device, which can be used to provide uninterrupted power to some equipment with high requirements for power stability.

[0017] In implementation, different detection cycles can be set for UPS equipment corresponding to different services, so that when the corresponding detection cycle is reached, an abnormal detection request for the UPS equipment corresponding to that detection cycle can be triggered.

[0018] The testing cycle for UPS equipment corresponding to different services can be determined based on the service priority, historical UPS operation and maintenance data, and the type of UPS equipment.

[0019] In step S104, in response to an anomaly detection request, the status timing data of the UPS device is acquired.

[0020] The status timing data can be constructed based on the status data of the UPS obtained within a preset detection period. The status data may include voltage, current, etc.

[0021] In implementation, the server can obtain the status data of the UPS device at each time point within a preset detection period and construct the status time sequence data of the UPS device. The time interval between each time point within the preset detection period can be determined based on the historical operation and maintenance data of the UPS device, the type of UPS device, and the business corresponding to the UPS device.

[0022] For example, assuming the preset detection period is 2 hours and the preset time interval can be half an hour, the server can obtain the voltage, current and other status data of the UPS equipment every half hour during these 2 hours, and construct status time sequence data based on the status data obtained at each time point.

[0023] In step S106, the pre-trained anomaly detection model is used to determine the global and local features of the state time series data, and the anomaly detection result of the UPS device is determined based on the global and local features. The anomaly detection result of the UPS device is then used to determine whether the UPS device has an anomaly.

[0024] Among them, the anomaly detection model can be obtained by training a model constructed by a preset machine learning algorithm based on historical state time series data.

[0025] In implementation, the server can input the status time-series data of the UPS equipment into a pre-trained anomaly detection model. The pre-trained anomaly detection model can then extract the global and local features of the status time-series data. Based on the extracted global and local features, the server can then determine the anomaly detection result of the UPS equipment.

[0026] The anomaly detection results of UPS equipment can include anomaly detection scores, anomaly types, etc. The server can determine whether the UPS equipment is malfunctioning based on these results.

[0027] In step S108, if it is determined that there is an anomaly in the UPS device based on the anomaly detection result of the UPS device, the target anomaly path corresponding to the UPS is determined based on the topological connection relationship between the devices, and anomaly warning processing is performed on the target anomaly path.

[0028] In implementation, when the server determines that a UPS device is malfunctioning based on the UPS device's anomaly detection results, it can obtain the topological connection relationships between the devices corresponding to that UPS device. Then, based on these topological connection relationships, the server can determine the target malfunction path corresponding to that UPS device.

[0029] For example, the server can obtain the path containing the UPS device based on the topological connection relationship between the devices, and identify the obtained path as the target abnormal path. Alternatively, the server can also perform anomaly detection processing on other devices in the obtained path, obtain the detection results, and filter out the target abnormal paths in the obtained path that contain anomalies based on the detection results.

[0030] Specifically, assuming the obtained path includes a UPS device, device 1, device 2, and device 3, the server can obtain the operating data of device 1, device 2, and device 3, and based on the obtained operating data, determine whether device 1, device 2, and device 3 are abnormal, obtaining the detection result for each device. If the server determines that the number of abnormal devices exceeds a preset device number threshold based on the detection results, it can determine that the path is a target abnormal path.

[0031] Furthermore, there are various methods for determining the target abnormal path, and different methods can be selected according to different actual application scenarios. This specification does not specifically limit this method in the embodiments.

[0032] After identifying the target abnormal path, the server can perform abnormal warning processing for the target abnormal path. For example, the server can send preset alarm information to maintenance personnel. In addition, the server can also send the detection results of the devices in the target abnormal path and / or the abnormal detection results of the UPS devices to the maintenance personnel.

[0033] In addition, the server can present the anomaly detection results to maintenance personnel in the form of charts, so that maintenance personnel can take timely measures when anomalies occur through real-time monitoring and alarms.

[0034] In this way, by accurately detecting and locating faults, problems and node failures in the network cloud leased line topology data can be quickly identified, allowing for timely repair measures and improving network stability and reliability. This helps avoid service interruptions and user complaints, increases customer satisfaction, and enhances network stability and reliability.

[0035] By employing anomaly detection algorithms and topology-aware visualization, accurate fault location can be achieved, avoiding unnecessary waste of resources and manpower. Rapid fault location reduces troubleshooting time and costs, improving maintenance efficiency and lowering overall costs.

[0036] This invention provides an anomaly detection method. It receives an anomaly detection request for a UPS device, and in response, acquires the UPS device's state time-series data. Using a pre-trained anomaly detection model, it determines the global and local features of the state time-series data, and based on these features, determines the anomaly detection result for the UPS device. Based on the anomaly detection result, it determines whether the UPS device is abnormal. If an anomaly is determined based on the anomaly detection result, it determines the target anomaly path corresponding to the UPS based on the topological connection relationship between devices, and performs anomaly warning processing on the target anomaly path. In this way, by using the UPS's state time-series data and the anomaly detection model, it is possible to quickly and accurately determine whether the UPS device is abnormal, improving the efficiency and accuracy of fault detection. When an anomaly is determined, the impact path (i.e., the target anomaly path) of the UPS device can be quickly determined based on the topological connection relationship between devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0037] In practical applications, step S106 above utilizes a pre-trained anomaly detection model to determine the global and local features of the state time series data. Based on these global and local features, the anomaly detection result of the UPS device is determined. The specific processing methods for determining whether the UPS device has an anomaly based on the anomaly detection result can vary. One optional processing method is provided below, such as... Figure 2 As shown, the specific process may include the following steps S1062 to S1064.

[0038] In step S1062, the global features of the state time series data are determined by using the first module of the pre-trained anomaly detection model, and the local features of the state time series data are determined by using the second module of the pre-trained anomaly detection model and the extraction results of the first module.

[0039] The first module is built based on the transformer algorithm, and the second module is built based on the LSTM algorithm.

[0040] In implementation, since attention mechanisms can be used to capture global dependencies and complex patterns, and recurrent neural networks (RNNs) can capture local features of sequences through their recurrent structures, attention mechanisms can compensate for the shortcomings of RNN structures in capturing global information. At the same time, RNNs can enhance the learning of local features by attention mechanisms and can effectively learn the temporal features of sequences. Therefore, attention mechanisms and recurrent neural networks can be integrated to build an anomaly detection model to effectively identify anomalies in UPS equipment and achieve rapid fault detection.

[0041] Specifically, the server can choose a transformer as the self-attention mechanism architecture and a long short-term memory network (LSTM) as the RNN architecture, and then combine the two to construct a system like... Figure 3 The anomaly detection model shown is an example of a model that captures global features of a sequence (i.e., state-time data) using the transformer in the first module, and then captures local features of the sequence using LSTM.

[0042] In step S1064, the global and local features of the state time series data are fused to obtain the target features, and the abnormal detection result of the UPS equipment is determined based on the target features.

[0043] In implementation, such as Figure 3As shown, the anomaly detection model can perform feature fusion processing on the global and local features of the state time series data to obtain target features, and then determine the anomaly detection results for the UPS device based on the target features.

[0044] In addition, the server can prevent overfitting by increasing the number of layers and neurons in the model and adding necessary regularization techniques, such as Dropout.

[0045] In practical applications, the specific processing methods for performing feature fusion processing on the global and local features of the state time sequence data in step S1064 above to obtain the target features can be varied. The state time sequence data of the UPS equipment can include the voltage, current, temperature and load of the UPS equipment at each time point within a preset detection period. Accordingly, the following provides an optional processing method, which can specifically include the processing of steps A1 to A5.

[0046] In step A1, the global and local features of voltage in the state time series data are fused to obtain the first feature corresponding to the voltage.

[0047] In step A2, the global and local features of the current in the state time series data are fused to obtain the second feature corresponding to the current.

[0048] In step A3, the global and local features of temperature in the state time series data are fused to obtain the third feature corresponding to the temperature.

[0049] In step A4, the global and local features of the load in the state time series data are fused to obtain the fourth feature corresponding to the load.

[0050] In step A5, one or more of the first feature, second feature, third feature, and fourth feature are weighted to obtain the target feature.

[0051] In practice, the training and application of the anomaly detection model can be as follows: (1) Data collection and preprocessing: The system collects status data of the UPS equipment during historical monitoring periods, including voltage, current, temperature, and load, and constructs historical status time-series data for the UPS equipment based on the collected data. This historical status time-series data is time-series data, meaning the status data is arranged in chronological order. The server can clean, denoise, and standardize the constructed historical status time-series data to facilitate model training.

[0052] (2) Data partitioning: The historical time-series data is divided into training, validation, and test sets in an 8:1:1 ratio. The data in the training set is used to train the anomaly detection model, the data in the validation set is used to validate and fine-tune the anomaly detection model, and the data in the test set is used to test the model's performance.

[0053] (3) Feature selection and sequence modeling: Historical state time-series data, constructed from voltage, current, temperature, and load data at each time point, is used as input to the anomaly detection model. Additionally, the server can employ a sliding window approach, setting different sliding window sizes (e.g., 5, 10, etc.) to collect state data through the sliding window, thereby constructing different historical state time-series data for different time windows.

[0054] (4) Data processing flow of the anomaly detection model: ① Given the input sequences (i.e., state-time data) of parameters such as voltage, current, temperature, and load at time t, assume that the input sequence of any one of these parameters can be represented by {xt1, xt2, ..., xti, ..., xtn}, where n represents the sequence length and xtn is the nth parameter. For example... Figure 3 As shown, the server can use embedding technology to encode the input sequence, obtaining the implicit representation {ht1',ht2',...,hti',...,htn'} of the input sequence. The formula for the encoding process can be: {ht1',ht2',...,hti',...,htn'}=Embedding({xt1,xt2,...,xti,...,xtn}).

[0055] ② To obtain the global features of the input sequence, the server can first send the input sequence into the first module, the transformer, to obtain the extraction results. The data processing formula for the first module can be: {ht1,ht2,...hti,...,htn}=Transformer({ht1',ht2',...,hti',...,htn'}).

[0056] Then, global features of the input sequence can be obtained through pooling techniques (such as average pooling). The corresponding data processing formula can be: pGlobal=Average-Pooling({ht1,ht2,...hti,...,htn}).

[0057] ③ To enhance the local features of the sequence and capture its strong temporal dependencies, the server can feed the extraction results {ht1,ht2,...,hti,...,htn} obtained from the first module transformer into the second module LSTM. The hidden state at time step (t-1) is \(h_{t-1}i\), and the input at the current time step (t) is \(x_ti\). The hidden state update of the LSTM can then be expressed as: \[h_ti = \sigma(W_{hx} x_ti + W_{hh} h_{t-1}i + b_h)\] in: - \(h_ti\) is the hidden state of time step (t).

[0058] - \(x_ti\) is the input for time step (t).

[0059] - \(W_{hx}\) is the weight matrix input to the hidden state.

[0060] - \(W_{hh}\) is the weight matrix from hidden state to hidden state.

[0061] - \(b_h\) is the bias vector.

[0062] - \(\sigma\) is the activation function, usually the sigmoid or tanh function.

[0063] Therefore, the local features of the input sequence can be obtained through the second module LSTM: pLocal=LSTM({ht1,ht2,...,hti,...,htn}).

[0064] ④ Finally, the server can perform feature fusion processing on the global feature pGlobal and the local feature pLocal to obtain the output result of a certain parameter at a given time t (i.e., the features corresponding to parameters such as voltage, current, temperature, and load). The fusion formula is as follows: p=λpGlobal+(1-λ)pLocal, where λ is a learnable parameter.

[0065] ⑤ Finally, the results of voltage, current, temperature, load and other parameters at time t are fused by summing the learnable parameters to obtain the final result. The calculation formula is as follows: result = w1*pvoltage + w2*pcurrent + w3*ptemperature + w4*pload, where w1, w2, w3, and w4 are learnable parameters, and pvoltage, pcurrent, ptemperature, and pload represent the features corresponding to voltage, current, temperature, and load that are fused with global and local features, respectively.

[0066] (5) Model training: The anomaly detection model is trained using a training set. The training objective can be to minimize the error between the predicted and actual values. The error can be determined by a loss function or by the mean squared error (MSE).

[0067] (6) Verification and optimization: The anomaly detection model is validated using a validation set, and performance metrics such as loss value and accuracy are monitored. Based on the validation results, the anomaly detection model is adjusted, such as by adjusting the learning rate, increasing training data, and fine-tuning model parameters. A stable set of model parameters is then obtained based on current, voltage, load, and temperature.

[0068] (7) Feedback and iteration: Based on the actual detection results, the anomaly detection model is improved through feedback and iterative refinement. By continuously optimizing the model architecture, feature selection, and hyperparameters, the accuracy and stability of anomaly detection can be enhanced.

[0069] In practical applications, the specific processing method for determining the target abnormal path corresponding to the UPS based on the topological connection relationship between devices in step S108 above can be varied. The following provides one optional processing method, such as... Figure 4 As shown, the specific process may include the following steps S1082 to S1084.

[0070] In step S1082, target graph structure data based on the topological connection relationship between devices is obtained.

[0071] In implementation, the server can use graph algorithms to analyze the topological connections between devices. First, the server can use graph algorithms such as Neo4j to establish nodes and relationships based on a preset resource model to represent the topological connections between devices, so as to obtain the target graph structure data.

[0072] When performing data modeling, the server can represent each device as a node, and the connections between devices can be represented as undirected relationships. Furthermore, appropriate node and relationship attributes need to be defined to store information about the devices. Additionally, the server can update the node attributes in the target graph structure data in real time based on the anomaly detection results of the UPS devices.

[0073] The nodes in the target graph structure data can have the device's own attribute information, such as name, identifier, voltage, current, load, temperature, etc. The relationships between nodes can have information such as the two ends of the topological relationship and the relationship type.

[0074] In addition, the server can synchronize UPS device information, topology connection information, and related storage information to the Neo4j database in real time for topology presentation and analysis. Simultaneously, anomaly detection results based on the anomaly detection model can also be stored in the database in real time for subsequent display.

[0075] In step S1084, a pre-trained path determination model is used to determine the target anomaly path corresponding to the UPS based on the target graph structure data.

[0076] The path determination model can be constructed based on a preset graph analysis algorithm.

[0077] In implementation, the server can use Neo4j's Cypher query language to perform graph analysis tasks (i.e., detecting abnormal paths to the target). The server can also use the Graph Algorithms Library to perform graph analysis tasks such as shortest path and centrality calculations.

[0078] The server can use the anomaly detection results of the UPS equipment detected by the anomaly detection model as node attribute information and synchronize them to the Neo4j database. The synchronized anomaly detection results can be displayed in real time and intuitively on the nodes of the topology graph (i.e., the target graph structure data), clearly showing the anomaly information of the nodes. At the same time, the paths associated with the anomaly nodes (i.e., the target anomaly paths) can be explicitly marked as the influencing paths on the topology graph, enabling timely anomaly warnings for UPS equipment in a topology graph manner, guiding operation and maintenance work.

[0079] Thus, firstly, the anomaly detection model built on RNN can quickly identify whether there are anomalies in UPS equipment, enabling timely early warnings when anomalies are found. Secondly, based on the early warning information, graph algorithms are used to present the topological relationships and impacts between devices, allowing users to view related nodes and connections upwards or downwards through the topology graph, assess the impact, and provide handling suggestions.

[0080] In practical applications, the specific processing method for determining whether the UPS equipment has an anomaly based on the anomaly detection result in step S106 above can be varied. The following provides one optional processing method, such as... Figure 5 As shown, the specific process may include the following steps, S1066.

[0081] In step S1066, it is determined whether there is an anomaly in the UPS equipment based on whether the anomaly detection score in the anomaly detection result of the UPS equipment is greater than a preset score threshold.

[0082] The preset score threshold can be determined based on historical anomaly data of the UPS equipment and the warning priority of the corresponding business of the UPS equipment.

[0083] In practice, if the anomaly detection score of a UPS device exceeds a preset threshold, it can be determined that the UPS device is malfunctioning.

[0084] In this way, fault detection based on anomaly detection models and rapid impact analysis based on graph engine correlation analysis can improve work efficiency, save labor costs, and shorten troubleshooting time.

[0085] Among them, the anomaly detection model can integrate the transformer and LSTM models to model parameters such as UPS voltage, current, temperature, and load. It determines the features corresponding to each parameter through the weight formula (result=w1*p voltage+w2*p current+w3*p temperature+w4*p load), and then determines the anomaly detection score based on the target features. If the anomaly detection score is greater than the preset score threshold, it is determined that there is an anomaly in the UPS equipment, which can realize rapid prediction and analysis of anomalies.

[0086] Based on graph engines and Graph Algorithms Library algorithms, network devices can be associated with resource data and presented in the form of a graph library. Predictive analysis can be used to obtain early warnings of anomalies and guidance on potential hazards, and the impact of failures can be displayed through the graph engine.

[0087] This solution can be widely used in the operation and maintenance of operators' core network, and has the following application scenarios: 1. Accelerated Fault Handling Scenarios: Anomaly detection algorithms and topology correlation analysis can be used to quickly locate faults, shorten fault handling time, and reduce fault handling costs.

[0088] 2. Network optimization decision-making scenarios: The application of knowledge graphs can provide clearer visualization of network topology, helping operations and maintenance personnel to make more effective network optimization and expansion decisions.

[0089] 3. Fault early warning scenario: Through anomaly detection algorithms, early warnings can be issued before anomalies occur, improving the ability to prevent and handle faults.

[0090] 4. Business migration planning scenario: In the event of a disaster such as a power outage in the data center, topology correlation analysis can be used to quickly assess the scope of impact and help with business migration planning.

[0091] This specification provides an anomaly detection method. It receives an anomaly detection request for a UPS device, and in response, acquires the UPS device's state timing data. Using a pre-trained anomaly detection model, it determines the global and local features of the state timing data. Based on these features, it determines the anomaly detection result for the UPS device and whether an anomaly exists. If an anomaly is determined based on the anomaly detection result, it determines the target anomaly path corresponding to the UPS based on the topological connections between devices and performs anomaly warning processing on the target anomaly path. In this way, by using the UPS's state timing data and the anomaly detection model, it is possible to quickly and accurately determine whether an anomaly exists in the UPS device, improving the efficiency and accuracy of fault detection. When an anomaly is determined, the impact path (i.e., the target anomaly path) of the UPS device can be quickly determined based on the topological connections between devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0092] The above describes the anomaly detection method provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an anomaly detection device, such as... Figure 6 As shown.

[0093] The anomaly detection device includes: a request receiving module 601, a data acquisition module 602, an anomaly detection module 603, and an anomaly early warning module 604, wherein: The request receiving module 601 is used to receive anomaly detection requests for UPS equipment. Data acquisition module 602 is used to acquire the status timing data of the UPS device in response to the anomaly detection request; The anomaly detection module 603 is used to determine the global and local features of the state time series data using a pre-trained anomaly detection model, and to determine the anomaly detection result of the UPS device based on the global and local features, and to determine whether the UPS device has an anomaly based on the anomaly detection result of the UPS device. The anomaly warning module 604 is used to determine the target anomaly path corresponding to the UPS based on the topological connection relationship between the devices when it is determined that the UPS device has an anomaly based on the anomaly detection result of the UPS device, and to perform anomaly warning processing on the target anomaly path.

[0094] In the embodiments described in this specification, the anomaly detection module 603 is used for: Using the first module of the pre-trained anomaly detection model, the global features of the state time series data are determined, and using the extraction results of the second module of the pre-trained anomaly detection model and the first module, the local features of the state time series data are determined; wherein, the first module is constructed based on the transformer algorithm, and the second module is constructed based on the LSTM algorithm; The global and local features of the state time series data are fused to obtain target features, and the anomaly detection result of the UPS equipment is determined based on the target features.

[0095] In the embodiments of this specification, the status timing data of the UPS device includes the voltage, current, temperature and load of the UPS device at each time point within a preset detection period.

[0096] In the embodiments described in this specification, the anomaly detection module 603 is used for: The global and local features of voltage in the state time series data are fused to obtain the first feature corresponding to the voltage. The global and local features of the current in the state time series data are fused to obtain the second feature corresponding to the current. The global and local features of temperature in the state time series data are fused to obtain a third feature corresponding to the temperature. The global and local features of the load in the state time series data are fused to obtain the fourth feature corresponding to the load. The target feature is obtained by weighting one or more of the first feature, the second feature, the third feature, and the fourth feature.

[0097] In the embodiments described in this specification, the anomaly warning module 604 is used for: Obtain target graph structure data based on the topological connections between devices; Using a pre-trained path determination model, the target anomaly path corresponding to the UPS is determined based on the target graph structure data. The path determination model is constructed based on a preset graph analysis algorithm.

[0098] In the embodiments described in this specification, the anomaly warning module 604 is used for: The presence or absence of an anomaly in the UPS device is determined by whether the anomaly detection score in the anomaly detection results is greater than a preset score threshold.

[0099] This specification provides an anomaly detection device that receives an anomaly detection request for a UPS device, acquires the UPS device's state timing data in response to the request, uses a pre-trained anomaly detection model to determine the global and local features of the state timing data, and determines the anomaly detection result of the UPS device based on the global and local features. Based on the anomaly detection result, it determines whether the UPS device is abnormal. If the anomaly detection result indicates that the UPS device is abnormal, it determines the target abnormal path corresponding to the UPS based on the topological connection relationship between the devices, and performs anomaly warning processing on the target abnormal path. In this way, by using the UPS's state timing data and the anomaly detection model, it is possible to quickly and accurately determine whether the UPS device is abnormal, improving the efficiency and accuracy of fault detection. When an anomaly is determined, the influence path (i.e., the target abnormal path) of the UPS device can be quickly determined based on the topological connection relationship between the devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0100] The above are the anomaly detection devices provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide an anomaly detection device, such as... Figure 7 As shown.

[0101] The anomaly detection device can provide terminal equipment or servers, etc., for the above embodiments.

[0102] Anomaly detection devices can vary significantly due to differences in configuration and performance. They may include one or more processors 701 and memory 702, with memory 702 storing one or more application programs or data. Memory 702 can be temporary or persistent storage. The application programs stored in memory 702 may include one or more modules (not shown), each module including a series of computer-executable instructions for the anomaly detection device. Furthermore, processor 701 may be configured to communicate with memory 702, executing the series of computer-executable instructions stored in memory 702 on the anomaly detection device. The anomaly detection device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input / output interfaces 705, and one or more keyboards 706.

[0103] Specifically, in this embodiment, the anomaly detection device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the anomaly detection device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following: Receive anomaly detection requests for UPS equipment; In response to the anomaly detection request, the status timing data of the UPS device is obtained; Using a pre-trained anomaly detection model, the global and local features of the state time series data are determined respectively. Based on the global and local features, the anomaly detection result of the UPS device is determined, and based on the anomaly detection result of the UPS device, it is determined whether the UPS device has an anomaly. If an anomaly is determined to exist in the UPS device based on the anomaly detection results, a target anomaly path corresponding to the UPS is determined based on the topological connection relationship between the devices, and anomaly warning processing is performed on the target anomaly path.

[0104] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the anomaly detection device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0105] This specification provides an anomaly detection device that receives an anomaly detection request for a UPS device, acquires the UPS device's state time-series data in response, uses a pre-trained anomaly detection model to determine the global and local features of the state time-series data, and determines the anomaly detection result of the UPS device based on these features. It then determines whether the UPS device is faulty based on the anomaly detection result. If the anomaly detection result indicates that the UPS device is faulty, it determines the target fault path corresponding to the UPS based on the topological connection relationship between the devices, and performs anomaly warning processing on the target fault path. In this way, by using the UPS's state time-series data and the anomaly detection model, it is possible to quickly and accurately determine whether the UPS device is faulty, improving the efficiency and accuracy of fault detection. When a fault is determined to exist in the UPS device, the influence path (i.e., the target fault path) of the UPS device can be quickly determined based on the topological connection relationship between the devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0106] Furthermore, based on the above Figures 1 to 5 The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process: Receive anomaly detection requests for UPS equipment; In response to the anomaly detection request, the status timing data of the UPS device is obtained; Using a pre-trained anomaly detection model, the global and local features of the state time series data are determined respectively. Based on the global and local features, the anomaly detection result of the UPS device is determined, and based on the anomaly detection result of the UPS device, it is determined whether the UPS device has an anomaly. If an anomaly is determined to exist in the UPS device based on the anomaly detection results, a target anomaly path corresponding to the UPS is determined based on the topological connection relationship between the devices, and anomaly warning processing is performed on the target anomaly path.

[0107] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0108] This specification provides a storage medium that receives an anomaly detection request for a UPS device, and in response, acquires the UPS device's status time-series data. Using a pre-trained anomaly detection model, it determines the global and local features of the status time-series data, and based on these features, determines the anomaly detection result for the UPS device. Based on the anomaly detection result, it determines whether the UPS device is abnormal. If an anomaly is determined based on the anomaly detection result, it determines the target anomaly path corresponding to the UPS based on the topological connection relationship between devices, and performs anomaly warning processing for the target anomaly path. In this way, by using the UPS's status time-series data and the anomaly detection model, it is possible to quickly and accurately determine whether the UPS device is abnormal, improving the efficiency and accuracy of fault detection. When an anomaly is determined, the influence path (i.e., the target anomaly path) of the UPS device can be quickly determined based on the topological connection relationship between devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0109] Furthermore, based on the above Figures 1 to 5 The method shown in this specification, along with one or more embodiments, also provides a computer program product including a computer program that, when executed by a processor, performs the following process: Receive anomaly detection requests for UPS equipment; In response to the anomaly detection request, the status timing data of the UPS device is obtained; Using a pre-trained anomaly detection model, the global and local features of the state time series data are determined respectively. Based on the global and local features, the anomaly detection result of the UPS device is determined, and based on the anomaly detection result of the UPS device, it is determined whether the UPS device has an anomaly. If an anomaly is determined to exist in the UPS device based on the anomaly detection results, a target anomaly path corresponding to the UPS is determined based on the topological connection relationship between the devices, and anomaly warning processing is performed on the target anomaly path.

[0110] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described embodiment of a computer program product is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the description of the method embodiment.

[0111] This specification provides a computer program product that receives an anomaly detection request for a UPS device, and in response, acquires the UPS device's status time-series data. Using a pre-trained anomaly detection model, it determines the global and local features of the status time-series data, and based on these features, determines the anomaly detection result for the UPS device. Based on the anomaly detection result, it determines whether the UPS device is faulty. If an anomaly is determined based on the anomaly detection result, it determines the target anomaly path corresponding to the UPS based on the topological connections between devices, and performs anomaly warning processing for the target anomaly path. In this way, by using the UPS's status time-series data and the anomaly detection model, it is possible to quickly and accurately determine whether the UPS device is faulty, improving the efficiency and accuracy of fault detection. When an anomaly is determined, the influence path (i.e., the target anomaly path) of the UPS device can be quickly determined based on the topological connections between devices, accelerating fault location and avoiding the low efficiency of fault location and processing caused by manually querying relational data. This improves the efficiency and accuracy of network problem handling and ensures the normal operation of network services.

[0112] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0113] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0114] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0115] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0116] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0117] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0121] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0123] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0125] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0126] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0127] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0128] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An anomaly detection method characterized by, The method comprises: receiving an anomaly detection request for a UPS device; in response to the anomaly detection request, obtaining state time series data of the UPS device; using a pre-trained anomaly detection model, determining global features and local features of the state time series data respectively, and determining an anomaly detection result of the UPS device according to the global features and the local features, and determining whether the UPS device has an anomaly according to the anomaly detection result of the UPS device; in the case where it is determined that the UPS device has an anomaly based on the anomaly detection result of the UPS device, determining a target abnormal path corresponding to the UPS based on a topological connection relationship between devices, and performing anomaly warning processing on the target abnormal path.

2. The method of claim 1, wherein, The use of a pre-trained anomaly detection model to determine global features and local features of the state time series data respectively, and to determine an anomaly detection result of the UPS device according to the global features and the local features, comprises: using a first module of the pre-trained anomaly detection model to determine global features of the state time series data, and using a second module of the pre-trained anomaly detection model and the extraction result of the first module to determine local features of the state time series data; wherein the first module is constructed based on a transformer algorithm, and the second module is constructed based on an LSTM algorithm; performing feature fusion processing on the global features and the local features of the state time series data to obtain target features, and determining the anomaly detection result of the UPS device according to the target features.

3. The method of claim 2, wherein, The state time series data of the UPS device includes voltage, current, temperature and load of the UPS device corresponding to each time point in a preset detection period.

4. The method of claim 3, wherein, The feature fusion processing on the global features and the local features of the state time series data to obtain target features comprises: performing feature fusion processing on the global features and the local features of the voltage in the state time series data to obtain first features corresponding to the voltage; performing feature fusion processing on the global features and the local features of the current in the state time series data to obtain second features corresponding to the current; performing feature fusion processing on the global features and the local features of the temperature in the state time series data to obtain third features corresponding to the temperature; performing feature fusion processing on the global features and the local features of the load in the state time series data to obtain fourth features corresponding to the load; performing weighting processing on one or more of the first features, the second features, the third features and the fourth features to obtain the target features.

5. The method of claim 1, wherein, The determination of a target abnormal path corresponding to the UPS based on a topological connection relationship between devices comprises: obtaining target graph structure data constructed based on a topological connection relationship between devices; using a pre-trained path determination model to determine a target abnormal path corresponding to the UPS based on the target graph structure data, wherein the path determination model is constructed based on a preset graph analysis algorithm.

6. The method of claim 1, wherein, The determining whether the UPS device has an abnormality according to the abnormality detection result of the UPS device comprises: According to whether an abnormality detection score in the abnormality detection result of the UPS device is greater than a preset score threshold, it is determined whether the UPS device has an abnormality.

7. An abnormality detection device characterized by comprising: The device comprises: A request receiving module configured to receive an abnormality detection request for a UPS device; A data obtaining module configured to obtain state time series data of the UPS device in response to the abnormality detection request; An abnormality detection module configured to determine global features and local features of the state time series data respectively by using a pre-trained abnormality detection model, to determine an abnormality detection result of the UPS device according to the global features and the local features, and to determine whether the UPS device has an abnormality according to the abnormality detection result of the UPS device; An abnormality early warning module configured to determine a target abnormality path corresponding to the UPS based on a topological connection relationship between devices if it is determined that the UPS device has an abnormality based on the abnormality detection result of the UPS device, and to perform abnormality early warning processing on the target abnormality path.

8. An anomaly detection device characterized by comprising: The computer program is stored on the memory and can be run on the processor, and when the computer program is executed by the processor, the steps of the abnormality detection method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that, The computer program is stored on the memory and can be run on the processor, and when the computer program is executed by the processor, the steps of the abnormality detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterised in that, The computer program is stored on the memory and can be run on the processor, and when the computer program is executed by the processor, the steps of the abnormality detection method according to any one of claims 1 to 6 are implemented.

Images