Abnormal degree evaluation method, device and equipment for abnormal time series data
By determining the dynamic threshold range and using sigmoid function normalization, the problem of inconsistent evaluation metrics in multi-model anomaly detection is solved, and the evaluation accuracy and confidence of anomaly time series data are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- DA FANG ELECTRONIC
- Filing Date
- 2024-03-26
- Publication Date
- 2026-04-21
AI Technical Summary
In existing technologies, when using multiple models to detect abnormal time series data, it is impossible to unify the evaluation indicators of the degree of abnormality of different models, resulting in inaccurate evaluation of the degree of abnormality.
By determining the dynamic threshold range of abnormal time series data, calculating the anomaly degree statistics, and using the sigmoid function for normalization, an anomaly degree evaluation index is obtained, which is then combined with a preset anomaly threshold to determine the degree of anomaly.
It achieves unified processing of anomaly assessment indicators for different models, improves the assessment accuracy and confidence of anomaly time series data, and can intuitively illustrate the degree of anomaly.
Smart Images
Figure CN121901872A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of data mining analysis and evaluation indicators, and specifically relates to a method, apparatus and equipment for evaluating the degree of anomaly in abnormal time series data. Background Technology
[0002] There are many methods for anomaly detection in intelligent operation and maintenance time series data, including distribution-based identification, distance-based identification, density-based identification, clustering-based identification, tree model-based identification, dimensionality reduction-based anomaly identification, classification-based anomaly identification, prediction-based anomaly identification, and deep learning-based methods.
[0003] The application of artificial intelligence in anomaly detection includes both supervised and unsupervised methods. Different methods use different criteria to evaluate anomalies. For example, supervised methods include distribution-based methods, which typically use threshold values based on the distribution; exceeding these thresholds indicates an anomaly. Distance-based methods also analyze anomalies by providing a distance threshold. Tree-based methods compare anomaly scores with thresholds to determine anomalies. Dimensionality reduction methods also compare scores with thresholds. Prediction-based methods, such as ARIMA (Autoregressive Integrated Moving Average Model), use various moving average algorithms to determine anomalies by combining the residuals between predicted and actual values with distribution-based methods. Unsupervised methods, including deep learning models, often employ classification approaches when detecting anomalies.
[0004] In current practical applications of intelligent operation and maintenance, multiple models are used to detect whether a certain point is abnormal. However, the existing unsupervised and supervised methods have different methods for evaluating the degree of abnormality. When different models use different evaluation indicators to evaluate the degree of abnormality, they cannot be unified for analysis, which leads to the problem that the evaluation of the degree of abnormality of abnormal time series data is not accurate enough. Summary of the Invention
[0005] To address the problem in existing technologies where multiple models are used to detect anomalies at a given point, resulting in inaccurate assessments of the anomaly severity of time-series data due to inconsistent anomaly assessment metrics across different models, this invention provides a method, apparatus, and device for assessing the anomaly severity of time-series data.
[0006] To achieve the above objectives, the present invention provides the following technical solution:
[0007] A method for assessing the anomaly degree of abnormal time series data includes the following steps:
[0008] Based on the historical anomaly time-series data of intelligent operation and maintenance, the dynamic threshold range of the anomaly time-series data is determined. The dynamic threshold range includes the upper threshold, the lower threshold, and the center of the threshold range.
[0009] Calculate the anomaly severity statistic based on the anomaly time series data value of the anomaly point to be evaluated in the anomaly time series data, the upper threshold, the lower threshold, and the center value of the threshold range;
[0010] The anomaly degree statistics are normalized to obtain an anomaly degree evaluation index.
[0011] The degree of abnormality of the anomaly to be evaluated is determined based on the relationship between the anomaly assessment index of the anomaly to be evaluated and the preset time series data anomaly threshold.
[0012] Furthermore, the step of calculating the anomaly severity statistic based on the anomaly time series data values of the anomaly points to be evaluated, the upper threshold, the lower threshold, and the center value of the threshold range in the anomaly time series data includes:
[0013] When the value of the outlier to be evaluated is greater than the upper threshold, the difference between the value of the outlier to be evaluated and the upper threshold is used to calculate the anomaly degree statistic, which is then divided by the difference between the upper threshold and the center value of the threshold range.
[0014] When the value of the outlier to be evaluated is less than the lower threshold limit, the difference between the lower threshold limit and the value of the outlier to be evaluated is used to calculate the anomaly degree statistic, which is then compared with the difference between the center value of the upper threshold range and the lower threshold limit.
[0015] Further, the step of determining the degree of abnormality of the abnormal point to be evaluated based on the relationship between the abnormality evaluation index and the preset abnormality threshold includes:
[0016] When the anomaly assessment index of the anomaly point to be evaluated is greater than the preset anomaly threshold, the further the anomaly assessment index is from the preset anomaly threshold, the greater the degree of anomaly of the anomaly point to be evaluated; otherwise, the degree of anomaly of the anomaly point to be evaluated is smaller.
[0017] Furthermore, the center of the threshold range is calculated using an average value method.
[0018] Furthermore, the anomaly statistic is normalized using the sigmoid function to obtain the anomaly assessment index.
[0019] Furthermore, the relevant formula for the anomaly assessment index is as follows:
[0020]
[0021]
[0022]
[0023] thre = a or b
[0024] Where x_statis is the anomaly statistic, center is the center of the threshold range, a is the lower limit of the endpoint values of the dynamic threshold range, and b is the upper limit of the endpoint values of the dynamic threshold range.
[0025] Furthermore, the dynamic threshold is determined and updated based on historical abnormal time-series data closest to the current time period.
[0026] An apparatus for assessing the degree of anomalousness of anomalous time-series data, comprising:
[0027] The first processing module is used to determine the dynamic threshold range of the abnormal time series data based on the historical abnormal time series data of intelligent operation and maintenance. The dynamic threshold range includes the upper limit of the threshold, the lower limit of the threshold, and the center of the threshold range.
[0028] The second processing module is used to calculate the anomaly degree statistics based on the abnormal time series data values of the anomalies to be evaluated in the abnormal time series data, the upper threshold, the lower threshold, and the center value of the threshold range of the anomalies to be evaluated in the abnormal time series data.
[0029] The third processing module is used to normalize the anomaly degree statistics to obtain an anomaly degree evaluation index.
[0030] The anomaly assessment module is used to determine the degree of anomaly of the anomaly to be assessed based on the relationship between the anomaly assessment index of the anomaly to be assessed and the preset time series data anomaly threshold.
[0031] A computer device includes a memory and a processor, wherein the memory stores computer execution instructions, and the processor executes the computer execution instructions stored in the memory to implement a method for evaluating the degree of anomaly of abnormal time-series data as described above.
[0032] The method for evaluating the anomaly degree of abnormal time series data provided by this invention has the following beneficial effects:
[0033] This invention designs an anomaly severity statistic based on the values of outliers to be evaluated in abnormal time-series data, the upper threshold, lower threshold, and the center of the threshold range. This achieves unified processing of anomaly severity evaluation indicators from different models. The anomaly severity statistic is then normalized to obtain an anomaly severity evaluation index. By judging the relationship between the anomaly severity evaluation index value and a preset anomaly threshold, the degree of anomaly of the outlier is determined. On the one hand, the normalization process can be combined with actual probabilistic meaning to illustrate the confidence level of the anomaly; on the other hand, it can also intuitively illustrate the degree of anomaly. This invention solves the problem in existing technologies where, when using multiple models to detect whether a point is abnormal, the inconsistent anomaly severity evaluation index of different models leads to inaccurate anomaly severity evaluation of abnormal time-series data. Attached Figure Description
[0034] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0035] Figure 1 This is a flowchart of the evaluation method in an embodiment of the present invention;
[0036] Figure 2 This is a schematic diagram showing the positional relationship between the point to be evaluated and the threshold range in an embodiment of the method of the present invention;
[0037] Figure 3 This is a probability curve of the sigmod function in an embodiment of the method of the present invention. Detailed Implementation
[0038] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.
[0039] Method Implementation Examples
[0040] This invention provides a method for evaluating the anomaly degree of anomalous time-series data, which belongs to the unsupervised model, specifically as follows: Figure 1 As shown, this involves determining a dynamic threshold based on historical anomaly time-series data using statistical, machine learning, or deep learning methods. The threshold could be an upper or lower bound of the sequence, or both. Then, the center of the threshold range is determined based on the data; points exceeding the threshold range are considered outliers. Figure 2As shown, denote the left and right endpoints (upper and lower limits) of the dynamic threshold range as a (lower limit) and b (upper limit) respectively, and the center of the threshold range as center (default ). If the anomaly detection value x of the point to be evaluated satisfies x > b or x < a, then this point is an anomaly point.
[0041] The present invention is mainly about the calculation method for evaluating the degree of anomaly. It is already known through other methods that this point is anomalous. Next, a unified formula is needed to represent the degree of anomaly of this point because different methods represent the degree of anomaly in different ways, and some methods calculate anomaly scores greater than 1. When using multiple methods to evaluate an anomaly point, it is impossible to be unified. Moreover, in most actual productions, only one side of the endpoint is concerned. For example, for the access volume, generally when the value of the access volume is relatively large, it is considered that it may be a DDOS attack behavior, and the nature of this indicator determines that its value is non - negative. So in this case, only the upper limit is considered, and the lower limit is not considered.
[0042] The center of the threshold range can have other calculation methods (or determination methods). When there are upper and lower thresholds, the average value method can be used, or there can be other methods to calculate this value, such as using the median, mode, average value, etc. as the center of the threshold range.
[0043] In this embodiment, the following method is adopted to combine the statistic with the properties of the sigmod function to evaluate the anomaly degree evaluation index of this anomaly point:
[0044]
[0045]
[0046] Among them, center is the center of the threshold range, thre = a or b, a is the lower limit of the endpoint value of the dynamic threshold range, b is the upper limit of the endpoint value of the dynamic threshold range. Then, anomaly judgment is performed on the newly generated data, and the points outside the threshold range are considered anomaly points.
[0047] Such as Figure 3 As shown, it can be known from the properties of the sigmod function that the value of abnormal_prob is between (0, 1). The function is simple, smooth, differentiable at any order, and the gradient is easy to calculate, and it can map (-∞, +∞) to (0, 1), so it can be combined with the actual probability meaning. In the logistic regression model, this function is used to map the continuous value of the regression prediction to (0, 1), and when > 0.5, it is considered abnormal, and when <= 0.5, it is considered normal.
[0048] If X_statis > 0, and the corresponding abnormal_prob > 0.5, it clearly indicates an anomaly. Furthermore, as x is further away from b, x_statis increases, while the abnormal_prob value gets closer to 1. Therefore, the abnormal_prob value can indicate both the confidence level of the anomaly and the degree of the anomaly.
[0049] This invention designs a statistic with a value greater than 0, which, combined with the sigmoid function, evaluates the degree of anomalousness of outliers. The anomaly evaluation index value is in the range of (0.5, 1), and the larger the value, the farther away from the threshold, and the greater the degree of anomalousness.
[0050] In this embodiment, anomaly detection analysis is performed on the time-series data of monitoring metrics collected by Zabbix. The most recent time-series data X = (x1, x2, ..., x...) is selected. t ,...,x L The data is of length L. After preprocessing, the dynamic threshold determination method for anomaly detection uses a fusion of multiple statistical methods and unsupervised machine learning methods to determine the upper limit b of the threshold for this indicator over this period. The median (X) is chosen as the threshold center point. Further, outliers are identified. Assuming two outliers (x, y, y) are detected... abnormal_1 ,x abnormal_2 Based on the above-mentioned method for calculating the anomaly assessment statistic, and combining the value of the outlier with the upper and lower thresholds determined by the model, the statistic and anomaly assessment index are calculated. Because the designed statistic is greater than 0, the anomaly assessment index value is 0.5 < abnormal_prob. abnormal_i <1, (i∈(1,2)), the larger the value, the more anomalous the point. The anomalousness evaluation indexes corresponding to the two anomalous points are 0.6 and 0.9 respectively, so the second point is more anomalous than the first point.
[0051] The anomaly assessment index calculated using the method of this invention is consistent with the confidence assessment of anomaly degree and other supervised classification methods. This method can be used to evaluate outliers calculated by all methods during anomaly detection, avoiding the difficulty of using different assessment indices for different algorithms to evaluate anomaly degree.
[0052] Device Examples
[0053] This invention provides an apparatus for assessing the anomaly level of abnormal time-series data, comprising:
[0054] The first processing module is used to determine the dynamic threshold range of abnormal time series data based on the historical abnormal time series data of intelligent operation and maintenance. The dynamic threshold range includes the upper limit of the threshold, the lower limit of the threshold, and the center of the threshold range.
[0055] The second processing module is used to calculate the anomaly degree statistics based on the abnormal time series data values of the anomaly points to be evaluated in the abnormal time series data, the upper threshold, the lower threshold, and the center value of the threshold range.
[0056] The third processing module is used to normalize the anomaly degree statistics to obtain an anomaly degree evaluation index.
[0057] The anomaly assessment module is used to determine the degree of anomaly of the anomaly to be assessed based on the relationship between the anomaly assessment index of the anomaly to be assessed and the preset time series data anomaly threshold.
[0058] Equipment Examples
[0059] The present invention provides a computer device, including a memory and a processor. The memory stores computer execution instructions, and the processor executes the computer execution instructions stored in the memory to implement a method for evaluating the degree of abnormality of abnormal time-series data as described above. The method has been described in detail in the method embodiments and will not be repeated here.
[0060] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0061] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0062] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.
[0063] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0064] It should be noted that the specific embodiments described above enable those skilled in the art to more fully understand the present invention, but do not limit the present invention in any way. Therefore, although the present invention has been described in detail in this specification and embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention; and all technical solutions and improvements that do not depart from the spirit and scope of the present invention are covered within the protection scope of the patent of the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.
Claims
1. A method for assessing the degree of anomalousness in abnormal time-series data, characterized in that, Includes the following steps: Based on the historical anomaly time-series data of intelligent operation and maintenance, the dynamic threshold range of the anomaly time-series data is determined. The dynamic threshold range includes the upper threshold, the lower threshold, and the center of the threshold range. Calculate the anomaly severity statistic based on the anomaly time series data value of the anomaly point to be evaluated in the anomaly time series data, the upper threshold, the lower threshold, and the center value of the threshold range; The anomaly degree statistics are normalized to obtain an anomaly degree evaluation index. The degree of abnormality of the anomaly to be evaluated is determined based on the relationship between the anomaly assessment index of the anomaly to be evaluated and the preset time series data anomaly threshold.
2. The method for assessing the degree of anomalousness of abnormal time-series data according to claim 1, characterized in that, The step of calculating the anomaly severity statistic based on the anomaly time series data value of the anomaly point to be evaluated, the upper threshold, the lower threshold, and the center value of the threshold range of the anomaly time series data includes: When the value of the outlier to be evaluated is greater than the upper threshold, the difference between the value of the outlier to be evaluated and the upper threshold is used to calculate the anomaly degree statistic, which is then divided by the difference between the upper threshold and the center value of the threshold range. When the value of the outlier to be evaluated is less than the lower threshold limit, the difference between the lower threshold limit and the value of the outlier to be evaluated is used to calculate the anomaly degree statistic, which is then compared with the difference between the center value of the upper threshold range and the lower threshold limit.
3. The method for assessing the degree of anomalousness of anomalous time-series data according to claim 1, characterized in that, The step of determining the degree of abnormality of the abnormal point to be evaluated based on the relationship between the abnormality evaluation index and the preset abnormality threshold includes: When the anomaly assessment index of the anomaly point to be evaluated is greater than the preset anomaly threshold, the further the anomaly assessment index is from the preset anomaly threshold, the greater the degree of anomaly of the anomaly point to be evaluated; otherwise, the degree of anomaly of the anomaly point to be evaluated is smaller.
4. The method for assessing the degree of anomalousness of anomalous time-series data according to claim 1, characterized in that, The center of the threshold range is calculated using the average value method.
5. The method for assessing the degree of anomalousness of anomalous time-series data according to claim 1, characterized in that, The anomaly assessment index is obtained by normalizing the anomaly statistic using the sigmoid function.
6. The method for assessing the degree of anomalousness of anomalous time-series data according to claim 3, characterized in that, The relevant formula for the anomaly assessment index is: thre = a or b Where x_statis is the anomaly statistic, center is the center of the threshold range, a is the lower limit of the endpoint values of the dynamic threshold range, and b is the upper limit of the endpoint values of the dynamic threshold range.
7. The method for assessing the degree of anomalousness of anomalous time-series data according to claim 1, characterized in that, The dynamic threshold is determined and updated based on historical abnormal time-series data that is closest to the current time period.
8. A device for assessing the degree of anomalousness of abnormal time-series data, characterized in that, include: The first processing module is used to determine the dynamic threshold range of the abnormal time series data based on the historical abnormal time series data of intelligent operation and maintenance. The dynamic threshold range includes the upper limit of the threshold, the lower limit of the threshold, and the center of the threshold range. The second processing module is used to calculate the anomaly degree statistics based on the abnormal time series data values of the anomalies to be evaluated in the abnormal time series data, the upper threshold, the lower threshold, and the center value of the threshold range of the anomalies to be evaluated in the abnormal time series data. The third processing module is used to normalize the anomaly degree statistics to obtain an anomaly degree evaluation index. The anomaly assessment module is used to determine the degree of anomaly of the anomaly to be assessed based on the relationship between the anomaly assessment index of the anomaly to be assessed and the preset time series data anomaly threshold.
9. A computer device, comprising a memory and a processor, characterized in that, The memory stores computer execution instructions, and the processor executes the computer execution instructions stored in the memory to implement a method for evaluating the degree of abnormality of abnormal time-series data as described in any one of claims 1-7.