Abnormality detection method and device for time series data, electronic equipment and program product
By combining trend prediction models and residual prediction models, the problem of low anomaly detection accuracy of time series data prediction models under short-term fluctuations is solved, and higher anomaly detection accuracy is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JUHAOKAN TECH CO LTD
- Filing Date
- 2025-12-29
- Publication Date
- 2026-05-05
AI Technical Summary
Existing time-series data prediction models have low anomaly detection accuracy when there are short-term sudden fluctuations in the training data.
By training trend prediction models and residual prediction models, the trends and residuals of time series data are predicted respectively. Anomaly detection is performed by combining confidence intervals, taking into account both long-term trends and short-term fluctuations.
It improves the accuracy of anomaly detection in time series data, enabling more accurate identification of anomalous data.
Smart Images
Figure CN121980447A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of data processing technology, and in particular relates to a method, apparatus, electronic device and program product for anomaly detection of time series data. Background Technology
[0002] Currently, anomaly detection methods for time series data typically involve inputting the time series data into a pre-trained time series data prediction model. The time series data prediction model then predicts the trend of the time series data based on the predicted trend, allowing for anomaly detection.
[0003] However, when there are short-term sudden fluctuations in the training data used to train the time series data prediction model, the trend of the time series data predicted by the time series data prediction model will have a large error, which will reduce the accuracy of anomaly detection in the time series data. Summary of the Invention
[0004] In view of this, embodiments of this application provide a method, apparatus, electronic device, and program product for anomaly detection of time-series data, in order to solve the technical problem of low accuracy in anomaly detection of time-series data in the prior art.
[0005] In a first aspect, embodiments of this application provide a method for anomaly detection in time-series data, including: Acquire target time-series data, and determine the target historical data and target real-time data of the target time-series data; Based on the target historical data, a trend prediction model is trained to predict the trend of time series data changes, and the trend prediction value and first confidence interval corresponding to the target time series data are determined by the trend prediction model. Based on the trend prediction value and the target real-time data, a residual prediction model for predicting the residuals of time series data is trained, and the residual prediction value and the second confidence interval corresponding to the target time series data are determined through the residual prediction model. The target confidence interval is determined based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval. Based on the target confidence interval, anomaly detection processing is performed on the target time series data.
[0006] Optionally, determining the target historical data and target real-time data of the target time series data includes: A first time period and a second time period are determined. The time span of the first time period is greater than the time span of the second time period, and the difference between the end time of the first time period and the current time, and the difference between the end time of the second time period and the current time are both less than a preset time threshold. Based on the first time period, the initial historical data of the target time series data is obtained, and the initial historical data is downsampled according to the sampling time interval corresponding to the target time series data to obtain the target historical data. Based on the second time period, the initial real-time data of the target time series data is obtained, and the initial real-time data is filtered based on the absolute median difference of the target time series data to obtain the target real-time data.
[0007] Optionally, determining the trend prediction value corresponding to the target time series data through the trend prediction model includes: Using the trend prediction model, for each timestamp corresponding to the target real-time data, a sub-predicted trend value corresponding to that timestamp is determined, and based on the sub-predicted trend value corresponding to each timestamp, the trend prediction value corresponding to the target time series data is determined.
[0008] Optionally, the step of training a residual prediction model for predicting time-series data residuals based on the trend prediction value and the target real-time data includes: Based on the trend prediction value and the target real-time data, determine the residual corresponding to each of the timestamps, and determine the residual sequence based on the residual corresponding to each of the timestamps; The residual prediction model is trained based on the residual sequence.
[0009] Optionally, training the residual prediction model based on the residual sequence includes: Based on the residual sequence, determine the residual range; For each residual in the residual sequence, determine whether the residual is within the residual range. If not, correct the residual to obtain the corrected residual sequence. The residual prediction model is trained based on the corrected residual sequence.
[0010] Optionally, determining the target confidence interval based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval includes: The target predicted value is determined based on the trend prediction value and the residual prediction value; The target standard deviation is determined based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval; The target confidence interval is determined based on the target predicted value and the target standard deviation.
[0011] Optionally, determining the target standard deviation based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval includes: Obtain the first weight parameter corresponding to the trend prediction model and the second weight parameter corresponding to the residual prediction model; The target standard deviation is determined based on the first standard deviation, the second standard deviation, the first weighting parameter, and the second weighting parameter.
[0012] Secondly, embodiments of this application provide an anomaly detection device for time-series data, comprising: A data acquisition unit is used to acquire target time-series data and determine the target historical data and target real-time data of the target time-series data; The first determining unit is used to train a trend prediction model for predicting the trend of time series data changes based on the target historical data, and to determine the trend prediction value and the first confidence interval corresponding to the target time series data through the trend prediction model. The second determining unit is used to train a residual prediction model for predicting the residuals of time series data based on the trend prediction value and the target real-time data, and to determine the residual prediction value and the second confidence interval corresponding to the target time series data through the residual prediction model. The third determining unit is used to determine the target confidence interval based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval; An anomaly detection unit is used to perform anomaly detection processing on the target time series data based on the target confidence interval.
[0013] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the anomaly detection method for timing data as described in any of the first aspects above.
[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the anomaly detection method for time-series data as described in any of the first aspects above.
[0015] Fifthly, embodiments of this application provide a computer program product that, when run on a control device, causes the control device to perform each step of the time-series data anomaly detection method as described in any of the first aspects above.
[0016] The anomaly detection method, apparatus, electronic device, and program product for time-series data provided in this application have the following beneficial effects: In the anomaly detection method for time series data provided in this application embodiment, the target time series data is first acquired, and the target historical data and target real-time data of the target time series data are determined. Then, based on the target historical data, a trend prediction model for predicting the changing trend of the time series data is trained, and the trend prediction value and the first confidence interval corresponding to the target time series data are determined through the trend prediction model. Based on the trend prediction value and the target real-time data, a residual prediction model for predicting the residuals of the time series data is trained, and the residual prediction value and the second confidence interval corresponding to the target time series data are determined through the residual prediction model. Then, based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval, the target confidence interval is determined. Finally, anomaly detection processing is performed on the target time series data based on the target confidence interval. In this application, the target confidence interval used for anomaly detection processing of the target time series data is determined jointly by the trend prediction model and the residual prediction model. The trend prediction model and the residual prediction model are trained based on the target historical data and the target real-time data of the target time series data, respectively. Therefore, the determined target confidence interval not only takes into account the long-term trend of the target time series data, but also takes into account the short-term fluctuations of the target time series data, which can improve the accuracy of anomaly detection of time series data. Attached Figure Description
[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 A flowchart illustrating the implementation of the anomaly detection method for time-series data provided in this application embodiment; Figure 2 A schematic diagram of the structure of an anomaly detection device for time-series data provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0019] It should be noted that the terminology used in the embodiments of this application is only for explaining specific embodiments of this application and is not intended to limit this application. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more, "at least one" or "one or more" means one, two or more. The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.
[0020] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.
[0021] The execution subject of the time-series data anomaly detection method provided in this application embodiment can be an electronic device, wherein the electronic device may include, but is not limited to, electronic devices such as laptops, desktop computers, tablets and mobile phones.
[0022] The anomaly detection method for time-series data provided in this application can be applied to any scenario requiring anomaly detection of time-series data. In practical applications, time-series data may include, but is not limited to, CPU utilization time-series data, flow time-series data, temperature time-series data, humidity time-series data, device energy consumption time-series data, and device vibration signal time-series data. Specifically, when anomaly detection of any time-series data is required, the various steps of the anomaly detection method for time-series data provided in this application can be executed through an electronic device, thereby improving the accuracy of anomaly detection of time-series data.
[0023] Please see Figure 1 , Figure 1 The flowchart illustrates the implementation of the time-series data anomaly detection method provided in this application embodiment. The time-series data anomaly detection method provided in this application embodiment may include S101~S105, as detailed below: In S101, the target time series data is acquired, and the target historical data and target real-time data of the target time series data are determined.
[0024] In this embodiment of the application, the electronic device can determine the target historical data and the target real-time data of the target time series data through steps a to c, as detailed below: In step a, a first time period and a second time period are determined. The time span of the first time period is greater than that of the second time period, and the difference between the end time of the first time period and the current time, and the difference between the end time of the second time period and the current time are both less than a preset time threshold.
[0025] In this implementation, the first time period is used to acquire long-term historical data from the time series data, and the second time period is used to acquire short-term real-time data from the time series data. For example, the start time of the first time period can be one year ago, and the end time of the first time period can be the current moment; the start time of the second time period can be one hour ago, and the end time of the second time period can be the current moment.
[0026] In step b, based on the first time period, the initial historical data of the target time series data is obtained, and based on the sampling time interval corresponding to the target time series data, the initial historical data is downsampled to obtain the target historical data.
[0027] In this implementation, after determining the first time period, all time-series data included in the target time-series data within the first time period can be identified as the initial historical data.
[0028] Because the first time period spans a large range, the initial historical data is quite large. Therefore, in order to reduce the amount of data processing, the initial historical data can be downsampled according to the sampling time interval corresponding to the target time series data to obtain the target historical data.
[0029] In practical applications, the sampling time interval can be determined based on the amount and type of the target time series data. For example, it can be 30 minutes. Based on this, sampling can be performed every 30 minutes in the initial historical data to downsample the initial historical data and obtain the target historical data.
[0030] Furthermore, in the process of downsampling the initial historical data to obtain the target historical data, it is not necessary to filter the initial historical data, so as to preserve the fluctuation characteristics and periodic features in the initial historical data.
[0031] In step c, based on the second time period, the initial real-time data of the target time series data is obtained, and the initial real-time data is filtered based on the absolute median difference of the target time series data to obtain the target real-time data.
[0032] In this implementation, after determining the second time period, all time-series data included in the target time-series data within the second time period can be identified as the initial real-time data. After determining the initial real-time data, since the absolute median difference of the target time-series data is insensitive to outliers and can effectively filter the initial real-time data, the initial real-time data can be filtered based on the absolute median difference of the target time-series data to remove outliers and obtain the target real-time data.
[0033] In S102, a trend prediction model is trained based on the target historical data to predict the trend of time series data changes, and the trend prediction value and first confidence interval corresponding to the target time series data are determined through the trend prediction model.
[0034] In this embodiment of the application, after determining that the target historical data has been obtained, a trend prediction model can be trained based on the target historical data and a preset algorithm.
[0035] Optionally, the preset algorithm can be the Prophet algorithm. Based on this, the preset initial model can be trained using the Prophet algorithm and the target historical data, so that the initial model can decompose the trend, seasonality and holiday effects in the target historical data, thereby obtaining a trend prediction model.
[0036] Optionally, after obtaining the trend prediction model, updated historical data of the target can be obtained periodically to update the trend prediction model.
[0037] After training the trend prediction model, the electronic device can use the model to determine the trend prediction value and first confidence interval corresponding to the target time series data. The electronic device can determine the trend prediction value of the target time series data in the following ways: For each timestamp corresponding to the target real-time data, a sub-predicted trend value is determined for that timestamp. Based on the sub-predicted trend value for each timestamp, the trend prediction value for the target time series data is determined. It can be understood that each timestamp corresponding to the target real-time data can be determined by the sampling time interval corresponding to the target time series data.
[0038] In S103, a residual prediction model for predicting the residuals of time series data is trained based on the trend prediction value and the target real-time data, and the residual prediction value and the second confidence interval corresponding to the target time series data are determined through the residual prediction model.
[0039] In this embodiment of the application, after determining the trend prediction value corresponding to the target time series data through the trend prediction model, a residual prediction model for predicting the residuals of the time series data can be trained based on the trend prediction value and the target real-time data in the following manner: Based on the trend prediction value and the target real-time data, the residual corresponding to each time point is determined, and the residual sequence is determined based on the residual corresponding to each time point; the residual prediction model is trained based on the residual sequence.
[0040] Specifically, for each time point in the target real-time data, the electronic device can determine the difference between the trend prediction value corresponding to that time point and the target real-time data as the residual corresponding to that time point. In this way, the residual corresponding to each time point in the target real-time data can be obtained. Furthermore, based on the residual corresponding to each time point in the target real-time data, a residual sequence can be determined. Finally, based on the residual sequence, a residual prediction model can be trained.
[0041] The residual can be used to represent short-term fluctuations and noise that trend forecasting models cannot predict.
[0042] In one possible implementation, the electronic device can train a residual prediction model based on the residual sequence in the following way: First, the electronic device can determine the residual range based on the residual sequence. Specifically, the residual sequence is first arranged in numerical order. Based on the number of residuals and a first preset percentage, a first residual value is determined from the arranged residual sequence as the maximum value of the residual range. Similarly, based on the number of residuals and a second preset percentage, a second residual value is determined from the arranged residual sequence as the minimum value of the residual range. For example, if the number of residuals is 100 and the first preset percentage is 5%, the fifth largest residual value in the residual sequence can be determined as the first residual value, thus determining the fifth largest residual value as the maximum value of the residual range. If the number of residuals is 100 and the second preset percentage is 95%, the 95th largest residual value in the residual sequence can be determined as the second residual value, thus determining the 95th largest residual value as the minimum value of the residual range.
[0043] After determining the residual range, the electronic device can determine whether each residual in the residual sequence falls within the residual range. If not, the residual is corrected to obtain a corrected residual sequence. For example, if residual 1 in the residual sequence has a residual value greater than the maximum value of the residual range, then residual 1 can be corrected to the maximum value of the residual range; if residual 2 in the residual sequence has a residual value less than the minimum value of the residual range, then residual 2 can be corrected to the minimum value of the residual range.
[0044] After obtaining the corrected residual sequence, a residual prediction model can be trained based on it. This model can be used to predict the residuals of time-series data at future timestamps. Furthermore, it can also be used to predict the second confidence interval. In practical applications, the specific training method for the residual prediction model can be set according to actual needs and is not limited here.
[0045] After training the residual prediction model, the residual prediction value and second confidence interval corresponding to the target time series data can be determined through the residual prediction model.
[0046] In S104, the target confidence interval is determined based on the trend forecast, the residual forecast, the first confidence interval, and the second confidence interval.
[0047] In one possible implementation, the electronic device can first determine the target predicted value based on the trend predicted value and the residual predicted value. Specifically, the electronic device can determine the target predicted value as the sum of the trend predicted value and the residual predicted value.
[0048] Furthermore, the electronic device can determine the target standard deviation based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval. Specifically, the electronic device can first obtain the first weight parameter corresponding to the trend prediction model and the second weight parameter corresponding to the residual prediction model. Then, the electronic device can determine the target standard deviation based on the first standard deviation, the second standard deviation, the first weight parameter, and the second weight parameter. For example, the sum of the first weight parameter and the second weight parameter can be 1, and the electronic device can determine the target standard deviation using the following formula: σ_combined = α Where σ_combined represents the target standard deviation, Indicates the second standard deviation. Indicates the first standard deviation. This is represented as the second weighting parameter. It is represented as the first weight parameter.
[0049] The first standard deviation corresponding to the first confidence interval can be used to describe the historical stability of the target time series data, and the second standard deviation corresponding to the second confidence interval can be used to describe the short-term volatility of the target time series data.
[0050] In practical applications, It can be used to balance the historical stability and short-term volatility of target time series data. If the user is more concerned with the historical stability of the target time series data, it can reduce... The value of can be improved if the user is more concerned about the short-term volatility of the target time series data. In practical applications, the value of is... The specific value can be set according to actual needs, and is not limited here.
[0051] After determining the target standard deviation, the electronic device can determine the target confidence interval based on the target predicted value and the target standard deviation. Specifically, the electronic device can determine the target confidence interval using the following formula: yhat_upper = y_hat(t) + k * σ_combined yhat_lower = y_hat(t) - k * σ_combined Where yhat_upper represents the maximum value of the target confidence interval, yhat_lower represents the minimum value of the target confidence interval, y_hat(t) represents the target predicted value, σ_combined can be represented as the target standard deviation, and k can be represented as the scaling parameter.
[0052] The specific value of k can be determined based on the user's tolerance for fluctuations in the target time series data. If the user has a high tolerance for fluctuations, k can be set to a larger value; if the user has a low tolerance for fluctuations, k can be set to a smaller value. For example, k can be 2 or 3.
[0053] In S105, anomaly detection processing is performed on the target time series data based on the target confidence interval.
[0054] In this embodiment of the application, after determining the target confidence interval, the sub-time series data corresponding to the current time in the target time series data can be determined first. Then, the sub-time series data corresponding to the current time in the target time series data can be compared with the target confidence interval. If the sub-time series data corresponding to the current time is not in the target confidence interval, the sub-time series data corresponding to the current time can be determined as abnormal data. If the sub-time series data corresponding to the current time is in the target confidence interval, the sub-time series data corresponding to the current time can be determined as normal data.
[0055] It is understandable that at each current moment in the future, electronic devices can perform anomaly detection processing on the target time series data in the above manner, thereby determining whether the sub-time series data corresponding to each current moment in the future is abnormal data.
[0056] As can be seen from the above, in the anomaly detection method for time series data provided in the embodiments of this application, the target time series data is first acquired, and the target historical data and target real-time data of the target time series data are determined. Then, based on the target historical data, a trend prediction model for predicting the changing trend of the time series data is trained, and the trend prediction value and the first confidence interval corresponding to the target time series data are determined through the trend prediction model. Based on the trend prediction value and the target real-time data, a residual prediction model for predicting the residuals of the time series data is trained, and the residual prediction value and the second confidence interval corresponding to the target time series data are determined through the residual prediction model. Then, based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval, the target confidence interval is determined. Finally, based on the target confidence interval, anomaly detection processing is performed on the target time series data. In this application, the target confidence interval used for anomaly detection processing of the target time series data is determined jointly by the trend prediction model and the residual prediction model. The trend prediction model and the residual prediction model are trained based on the target historical data and the target real-time data of the target time series data, respectively. Therefore, the determined target confidence interval not only takes into account the long-term trend of the target time series data, but also takes into account the short-term fluctuations of the target time series data, which can improve the accuracy of anomaly detection of time series data.
[0057] Based on the time-series data anomaly detection method provided in the above embodiments, this application further provides a time-series data anomaly detection apparatus for implementing the above method embodiments. Please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the structure of an anomaly detection device for time-series data provided in an embodiment of this application. Figure 2 As shown, the anomaly detection device 20 for time-series data may include: a data acquisition unit 21, a first determination unit 22, a second determination unit 23, a third determination unit 24, and an anomaly detection unit 25. Wherein: The data acquisition unit 21 is used to acquire target time series data and determine the target historical data and target real-time data of the target time series data.
[0058] The first determining unit 22 is used to train a trend prediction model based on the target historical data to predict the trend of time series data changes, and to determine the trend prediction value and the first confidence interval corresponding to the target time series data through the trend prediction model.
[0059] The second determining unit 23 is used to train a residual prediction model for predicting the residuals of time series data based on the trend prediction value and the target real-time data, and to determine the residual prediction value and the second confidence interval corresponding to the target time series data through the residual prediction model.
[0060] The third determining unit 24 is used to determine the target confidence interval based on the trend forecast value, the residual forecast value, the first confidence interval, and the second confidence interval.
[0061] The anomaly detection unit 25 is used to perform anomaly detection processing on the target time series data based on the target confidence interval.
[0062] Optionally, the data acquisition unit 21 is specifically used for: Determine a first time period and a second time period. The time span of the first time period is greater than the time span of the second time period, and the difference between the end time of the first time period and the current time, and the difference between the end time of the second time period and the current time are both less than a preset time threshold. Based on the first time period, the initial historical data of the target time series data is obtained, and the initial historical data is downsampled according to the sampling time interval corresponding to the target time series data to obtain the target historical data. Based on the second time period, the initial real-time data of the target time series is obtained, and the initial real-time data is filtered according to the absolute median difference of the target time series data to obtain the target real-time data.
[0063] Optionally, the first determining unit 22 is specifically used for: By using a trend prediction model, for each timestamp corresponding to the target real-time data, a sub-predicted trend value corresponding to that timestamp is determined, and based on the sub-predicted trend value corresponding to each timestamp, the trend prediction value corresponding to the target time series data is determined.
[0064] Optionally, the second determining unit 23 is specifically used for: Based on the trend forecast and the target real-time data, determine the residual corresponding to each time stamp, and determine the residual sequence based on the residual corresponding to each time stamp. A residual prediction model is trained based on the residual sequence.
[0065] Optionally, the second determining unit 23 is specifically used for: Determine the range of residuals based on the residual sequence; For each residual in the residual sequence, determine whether the residual is within the residual range. If not, correct the residual to obtain the corrected residual sequence. The residual prediction model is trained based on the corrected residual sequence.
[0066] Optionally, the third determining unit 24 is specifically used for: The target forecast value is determined based on the trend forecast value and the residual forecast value; Determine the target standard deviation based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval; Determine the target confidence interval based on the target predicted value and the target standard deviation.
[0067] Optionally, the third determining unit 24 is specifically used for: Obtain the first weight parameter corresponding to the trend prediction model and the second weight parameter corresponding to the residual prediction model; The target standard deviation is determined based on the first standard deviation, the second standard deviation, the first weighting parameter, and the second weighting parameter.
[0068] It should be noted that the information interaction and execution process between the above-mentioned units are based on the same concept as the method embodiments of this application. Their specific functions and technical effects can be referred to the method embodiments section, and will not be repeated here.
[0069] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 3 As shown, the electronic device 3 provided in this embodiment may include: a processor 30, a memory 31, and a computer program 32 stored in the memory 31 and executable on the processor 30, such as a program corresponding to a time-series data anomaly detection method. When the processor 30 executes the computer program 32, it implements the steps described above in the embodiment of the time-series data anomaly detection method, for example... Figure 1 S101~S105 are shown. Alternatively, when processor 30 executes computer program 32, it implements the functions of each module / unit in the above-described embodiment of the timing data anomaly detection device, for example... Figure 2 The functions of units 21-25 shown.
[0070] For example, computer program 32 can be divided into one or more modules / units, one or more of which are stored in memory 31 and executed by processor 30 to complete this application. One or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of computer program 32 in electronic device 3. For example, computer program 32 can be divided into a data acquisition unit 21, a first determination unit 22, a second determination unit 23, a third determination unit 24, and an anomaly detection unit 25. For the specific functions of each unit, please refer to [link to relevant documentation]. Figure 2 The relevant descriptions in the corresponding embodiments are not repeated here.
[0071] Those skilled in the art will understand that Figure 3 This is merely an example of electronic device 3 and does not constitute a limitation on electronic device 3. It may include more or fewer components than shown, or combine certain components, or use different components.
[0072] The processor 30 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.
[0073] The memory 31 can be an internal storage unit of the electronic device 3, such as a hard disk or RAM. The memory 31 can also be an external storage device of the electronic device 3, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, or flash card. Furthermore, the memory 31 can include both internal and external storage units of the electronic device 3. The memory 31 is used to store computer programs and other programs and data required by the electronic device. The memory 31 can also be used to temporarily store data that has been output or will be output.
[0074] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units is merely an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the time-series data anomaly detection device can be divided into different functional units to complete all or part of the functions described above. The functional units in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0075] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps in the various method embodiments described above.
[0076] This application provides a computer program product that, when run on a terminal device, enables the terminal device to implement the steps described in the various method embodiments above.
[0077] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, refer to the relevant descriptions of other embodiments.
[0078] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0079] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.
Claims
1. A method for anomaly detection in time-series data, characterized in that, include: Acquire target time-series data, and determine the target historical data and target real-time data of the target time-series data; Based on the target historical data, a trend prediction model is trained to predict the trend of time series data changes, and the trend prediction value and first confidence interval corresponding to the target time series data are determined by the trend prediction model. Based on the trend prediction value and the target real-time data, a residual prediction model for predicting the residuals of time series data is trained, and the residual prediction value and the second confidence interval corresponding to the target time series data are determined through the residual prediction model. The target confidence interval is determined based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval. Based on the target confidence interval, anomaly detection processing is performed on the target time series data.
2. The method according to claim 1, characterized in that, The determination of the target historical data and target real-time data of the target time series data includes: A first time period and a second time period are determined. The time span of the first time period is greater than the time span of the second time period, and the difference between the end time of the first time period and the current time, and the difference between the end time of the second time period and the current time are both less than a preset time threshold. Based on the first time period, the initial historical data of the target time series data is obtained, and the initial historical data is downsampled according to the sampling time interval corresponding to the target time series data to obtain the target historical data. Based on the second time period, the initial real-time data of the target time series data is obtained, and the initial real-time data is filtered based on the absolute median difference of the target time series data to obtain the target real-time data.
3. The method according to claim 1, characterized in that, The step of determining the trend prediction value corresponding to the target time series data through the trend prediction model includes: Using the trend prediction model, for each timestamp corresponding to the target real-time data, a sub-predicted trend value corresponding to that timestamp is determined, and based on the sub-predicted trend value corresponding to each timestamp, the trend prediction value corresponding to the target time series data is determined.
4. The method according to claim 3, characterized in that, The step of training a residual prediction model for predicting time-series data residuals based on the trend prediction value and the target real-time data includes: Based on the trend prediction value and the target real-time data, determine the residual corresponding to each of the timestamps, and determine the residual sequence based on the residual corresponding to each of the timestamps; The residual prediction model is trained based on the residual sequence.
5. The method according to claim 4, characterized in that, The step of training the residual prediction model based on the residual sequence includes: Based on the residual sequence, determine the residual range; For each residual in the residual sequence, determine whether the residual is within the residual range. If not, correct the residual to obtain the corrected residual sequence. The residual prediction model is trained based on the corrected residual sequence.
6. The method according to any one of claims 1 to 5, characterized in that, Determining the target confidence interval based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval includes: The target predicted value is determined based on the trend prediction value and the residual prediction value; The target standard deviation is determined based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval; The target confidence interval is determined based on the target predicted value and the target standard deviation.
7. The method according to claim 6, characterized in that, The step of determining the target standard deviation based on the first standard deviation corresponding to the first confidence interval and the second standard deviation corresponding to the second confidence interval includes: Obtain the first weight parameter corresponding to the trend prediction model and the second weight parameter corresponding to the residual prediction model; The target standard deviation is determined based on the first standard deviation, the second standard deviation, the first weighting parameter, and the second weighting parameter.
8. An anomaly detection device for time-series data, characterized in that, include: A data acquisition unit is used to acquire target time-series data and determine the target historical data and target real-time data of the target time-series data; The first determining unit is used to train a trend prediction model for predicting the trend of time series data changes based on the target historical data, and to determine the trend prediction value and the first confidence interval corresponding to the target time series data through the trend prediction model. The second determining unit is used to train a residual prediction model for predicting the residuals of time series data based on the trend prediction value and the target real-time data, and to determine the residual prediction value and the second confidence interval corresponding to the target time series data through the residual prediction model. The third determining unit is used to determine the target confidence interval based on the trend prediction value, the residual prediction value, the first confidence interval, and the second confidence interval; An anomaly detection unit is used to perform anomaly detection processing on the target time series data based on the target confidence interval.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements each step of the anomaly detection method for time-series data as described in any one of claims 1 to 7.
10. A computer program product, characterized in that, When the computer program product is executed by a processor, it implements the steps of the anomaly detection method for time-series data as described in any one of claims 1 to 7.