A method and a device for detecting anomalies in time series data

Abstract

The present disclosure relates to the technical field of data processing, and particularly relates to a time series data anomaly detection method and a detection device. The method comprises: obtaining an actual value of a target time series index at a current time, and actual time series data of the target time series index in a historical time period, and at least one set of historical time series data of the target time series index in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period; determining a prediction value corresponding to the start time based on the actual time series data; determining an upper limit curve and a lower limit curve based on the prediction value and the historical time series data; and generating a detection result of the target time series based on an upper limit value of the upper limit curve at the current time, a lower limit value of the lower limit curve at the current time, and the actual value.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to a method and device for anomaly detection in time-series data. Background Technology

[0002] With the rapid iteration and deep integration of Internet big data, Internet of Things, and industrial intelligence, the time-series data generated by various business systems is experiencing explosive growth. Trend prediction and rapid anomaly detection of time-series data have become core research topics in several key areas such as intelligent operation and maintenance, industrial monitoring, financial risk control, and environmental monitoring.

[0003] In intelligent operation and maintenance scenarios, the stability of time-series indicators such as server Central Processing Unit (CPU) utilization and network traffic directly determines service availability. In industrial monitoring, abnormal fluctuations in data such as equipment vibration signals and operating temperature may indicate equipment failure, which is related to production safety. In financial risk control scenarios, sudden changes in time-series financial indicators such as stock prices and transaction flows are key evidence for identifying risks and avoiding losses. These time-series indicators generally have significant trend, seasonal, and periodic characteristics, and are also susceptible to random fluctuations due to external interference factors, leading to hidden anomalies and biased trend predictions.

[0004] Therefore, how to quickly and accurately identify abnormal fluctuations and reliably predict future trends in massive, high-dimensional, and real-time updated time-series data, and how to overcome challenges such as data noise interference and difficulty in feature extraction, are directly related to the stability of system operation and the scientific nature of business decisions. This has important practical significance for reducing operation and maintenance costs, preventing security risks, and improving decision-making efficiency. Summary of the Invention

[0005] To address the aforementioned technical issues, this disclosure provides a method and device for detecting anomalies in time-series data.

[0006] In a first aspect, this disclosure provides a detection device, comprising: a communicator configured to: acquire the actual value of a target time-series indicator at the current moment, the actual time-series data of the target time-series indicator in a historical time period, and at least one set of historical time-series data of the target time-series indicator in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period; and a processor configured to: determine the predicted value corresponding to the start time based on the actual time-series data; determine the upper limit curve and the lower limit curve of the time-series based on the predicted value and the historical time-series data; and generate a detection result of the target time-series based on the upper limit value of the upper limit curve at the current moment, the lower limit value of the lower limit curve at the current moment, and the actual value.

[0007] Secondly, this disclosure provides an anomaly detection method for time series data, comprising: acquiring the actual value of a target time series indicator at the current moment, the actual time series data of the target time series indicator in a historical time period, and at least one set of historical time series data of the target time series indicator in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period; determining the predicted value corresponding to the start time based on the actual time series data; determining the upper limit curve and the lower limit curve of the time series based on the predicted value and the historical time series data; and generating the detection result of the target time series based on the upper limit value of the upper limit curve at the current moment, the lower limit value of the lower limit curve at the current moment, and the actual value.

[0008] Thirdly, this disclosure provides a computer-readable storage medium, including: storing a computer program on the computer-readable storage medium, wherein the computer program is executed by a controller using an anomaly detection method for timing data as provided in any of the second aspects.

[0009] Fourthly, this disclosure provides a computer program product that, when run on a computer, causes the computer to execute an anomaly detection method for timing data as provided in any of the second aspects.

[0010] It should be noted that the aforementioned computer instructions may be stored, in whole or in part, on the first computer-readable storage medium. The first computer-readable storage medium may be packaged together with the controller of the detection device, or it may be packaged separately from the controller of the detection device; this disclosure does not impose any limitations on this.

[0011] The descriptions of the second, third, and fourth aspects in this disclosure can be referenced to the detailed description of the first aspect; and the beneficial effects of the descriptions of the second, third, and fourth aspects can be referenced to the analysis of the beneficial effects of the first aspect, which will not be repeated here.

[0012] In this disclosure, the names of the aforementioned testing devices do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those of this disclosure, they fall within the scope of this disclosure and its equivalents.

[0013] These or other aspects of this disclosure will become more readily apparent in the following description.

[0014] The technical solution provided in this disclosure has the following advantages compared with the prior art: The detection device provided in this disclosure acquires the actual value of the target time-series indicator at the current moment, the actual time-series data of historical time periods, and at least one set of historical time-series data for at least one predicted time period (where the end time of the historical time period is the same as the start time of the predicted time period) through a communicator. This provides a comprehensive and relevant data source for subsequent detection, avoiding detection bias caused by incomplete data. Then, the processor determines the predicted value corresponding to the start time based on the actual time-series data. Combining this predicted value with the historical time-series data, it further determines the upper and lower limit curves of the time-series data, achieving a scientific definition of the fluctuation range of the target time-series indicator and effectively filtering random fluctuations and data noise caused by external interference. Finally, based on the upper limit value of the upper limit curve at the current moment, the lower limit value of the lower limit curve at the current moment, and the actual value, a detection result is generated. This device can quickly and accurately identify abnormal fluctuations of the target time-series indicator and provide a reliable reference for the future trend of the target time-series indicator. It solves the problems in existing technologies such as how to quickly and accurately identify abnormal fluctuations and reliably predict future trends in massive, high-dimensional, and real-time updated time-series data, overcoming difficulties such as data noise interference and feature extraction difficulties. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0016] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts illustrating an anomaly detection method for time-series data provided in this embodiment of the disclosure; Figure 2 A second schematic flowchart of the anomaly detection method for time-series data provided in this embodiment of the disclosure; Figure 3 A third schematic flowchart of the anomaly detection method for time-series data provided in this embodiment of the disclosure; Figure 4 A fourth flowchart illustrating the anomaly detection method for time-series data provided in this embodiment of the disclosure; Figure 5 Fifth flowchart illustrating the anomaly detection method for time-series data provided in this embodiment of the disclosure; Figure 6 A flowchart illustrating the anomaly detection method for time-series data provided in this embodiment of the present disclosure is shown in Figure 6. Figure 7A flowchart illustrating the anomaly detection method for time-series data provided in this embodiment of the present disclosure is shown in Figure 7. Figure 8 Eighth flowchart of the anomaly detection method for time-series data provided in the embodiments of this disclosure; Figure 9 A flowchart illustrating the anomaly detection method for time-series data provided in this embodiment of the disclosure is shown in Figure 9. Figure 10 This is a schematic diagram of the structure of the detection device provided in the embodiments of this disclosure; Figure 11 This is a schematic diagram of a chip system provided in an embodiment of the present disclosure. Detailed Implementation

[0018] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0019] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0020] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0021] The Kafka disclosed in this embodiment is an open-source distributed stream processing platform, originally developed by LinkedIn and later becoming a top-level project of the Apache Software Foundation. It is primarily used for building real-time data pipelines and streaming applications, capable of efficiently processing large-scale data streams.

[0022] The following embodiments use a server as an example to illustrate the method of the time series data anomaly detection method provided in this disclosure.

[0023] This disclosure provides an anomaly detection method for time-series data, such as... Figure 1 As shown, the anomaly detection method for this time series data may include S11-S14.

[0024] S11. Obtain the actual value of the target time series indicator at the current moment, the actual time series data of the target time series indicator in the historical time period, and at least one set of historical time series data of the target time series indicator in at least one prediction time period; wherein, the end time of the historical time period is the same as the start time of the prediction time period. For example, if the historical time period is from 14:10:00 on April 28, 2026 to 14:30:00 on April 28, 2026, then the predicted time period can be from 14:10:00 to 14:30:00 on any day, such as from 14:30:00 on April 28, 2026 to 14:50:00 on April 28, 2026.

[0025] In some examples, the target time-series metrics include any one of the following: Central Processing Unit (CPU) utilization, Queries Per Second (QPS), or Kafka consumption status.

[0026] In some examples, the historical time period is within the same time period as the current time, such as a time period of days.

[0027] In some examples, when obtaining at least one set of historical time series data for at least one prediction period, it is necessary to collect the actual time series data of the target time series indicator in the prediction period of each day in the historical period (such as a week, a month, half a year, a year or a user-defined time period), and use the actual time series data of the target time series indicator in the prediction period of any day as a set of historical time series data.

[0028] For example, taking the target time-series metric of business process CPU utilization as an example, the process of obtaining relevant data for the target time-series metric is explained as follows: 1) Customize the collection of data from the previous 7 days as training data, that is, determine the collection time range as 7 days before the current time to the current time; 2) Construct two types of data structures: Historical Synchronous Data (HIS) is used to store historical time-series data corresponding to the prediction period, and Original Value Calculation Interval Collection Data (ORI) is used to store actual time-series data for the historical period. Both data structures contain two core fields: collection timestamp and business process CPU utilization, and support multi-threaded concurrent reading. 3) The communication device of the detection equipment establishes a connection with the time series database (such as InfluxDB) via the Java Database Connectivity (JDBC) protocol. It adopts a multi-threaded concurrent acquisition method to synchronously retrieve ORI data and HIS data. The ORI data corresponds to the actual time series data of the historical time period (7 days before the current time to the current time, such as 14:30:00 on April 21, 2026 to 14:30:00 on April 28, 2026), and the HIS data corresponds to 3 prediction time periods. The prediction period consists of historical time-series data for the following time periods (14:30:00 on April 25, 2026 to 14:30:00 on April 26, 2026, 14:30:00 on April 26, 2026 to 14:30:00 on April 27, 2026, and 14:30:00 on April 27, 2026 to 14:30:00 on April 28, 2026), with the start time of each prediction period consistent with the end time of the corresponding historical time period. 4) The collected ORI data and HIS data were filtered using a sliding window filtering algorithm to remove obvious outliers and high-frequency spikes with numerical changes exceeding 30%, thereby reducing the impact of random fluctuations on subsequent calculations. 5) To address the potential inconsistency in time series data length after filtering, linear interpolation is used to interpolate the missing value positions in the two types of data (ORI data and HIS data) to ensure data continuity. Simultaneously, the communicator acquires the actual CPU utilization at the current time (April 28, 2026, 14:30:00) at a preset acquisition frequency of 1 minute per acquisition, assumed to be 78%. Ultimately, this completes the acquisition of the target time series indicator's actual value at the current time, the actual time series data for historical time periods (processed ORI data), and the three sets of historical time series data corresponding to the three prediction time periods (processed HIS data), providing a complete, clean, and reliable data source for subsequent prediction calculations, time series upper and lower limit curve definition, and detection result generation.

[0029] S12. Based on the actual time series data, determine the predicted value corresponding to the starting time; In some examples, when determining the predicted value corresponding to the starting time based on actual time series data, the fitting formula can be determined based on the actual time series data; then, the predicted value corresponding to the starting time can be determined based on the fitting formula and the starting time.

[0030] For example, referring to the example given in S11 above, the process of determining the fitting formula based on actual time series data, and then determining the predicted value corresponding to the starting time based on the fitting formula and the starting time, is explained. The specific implementation process includes: 1) Construct an initial value calculation window. The window duration of the historical time period can be flexibly set using a custom configuration method. This disclosure defaults to setting the window duration of the historical time period to a 20-minute interval, that is, the first 20 minutes of the prediction interval. Based on the example given in S11, the current time (14:30:00 on April 28, 2026) corresponds to the initial value calculation window from 14:10:00 on April 28, 2026 to 14:30:00 on April 28, 2026. This window is used to extract valid data of the corresponding interval from the ORI data (actual time series data of the historical time period) to provide an accurate data range for the initial value calculation. 2) Build a preprocessor and call the Median Absolute Deviation (MAD) algorithm to smooth the ORI data that has been filtered and interpolated in S11 again, further filtering out residual small fluctuations and potential outliers, reducing the impact of data noise on the fitting model, and ensuring that the data input to the fitting model is more stable and reliable. 3) Construct a fitting model containing a quadratic equation. Use 20 minutes of ORI time-series data within the initial value calculation window as input. The duration corresponding to the collection timestamp (in minutes, with the window start time 14:10:00 as 0, and sequentially labeled 0, 1, 2…19, 20) is used as the independent variable X, and the corresponding CPU utilization value is used as the dependent variable Y. Solve the quadratic equation using the least squares method. (Where a, b, and c are fitting parameters), generate a fitting model that adapts to the data in this window. A specific fitting example is shown below: Key time-series data points of ORI data within the initial value calculation window were extracted (collected at a frequency of 1 minute / time, totaling 21 data points; key data points are selected for illustration, the remaining data points are used in the fitting calculation but are not listed individually). Specifically, X=0 (14:10:00), Y=72.0%; X=5 (14:15:00), Y=73.2%; X=10 (14:20:00), Y=75.1%; X=15 (14:25:00), Y=76.3%; X=20 (14:30:00), Y=78.0%. Substituting all 21 data points and solving using the least squares method, the fitting parameters were obtained: a=0.0075, b=0.152, c=71.978. Therefore, the quadratic fitting equation is: ; 4) Calculate the initial prediction value `origin`, with the prediction interval from 14:30:00 to 14:40:00 on April 28, 2026 (connecting with the end time of the initial value calculation window at 14:30:00). The duration attribute of the prediction interval is used as the X parameter and input into the above fitting equation. The starting time of the prediction interval (14:30:00) corresponds to X=20 (consistent with the X value at the end time of the initial value calculation window). Substitute these values ​​into the fitting parameters to calculate: Step 1 calculates 0.0075× =0.0075×400=3.0, the second step is to calculate 0.152×20=3.04, the third step is to sum 3.0+3.04+71.978=78.018, and finally obtain the initial value within the prediction interval, origin=78.02% (retain two decimal places to match the actual precision of CPU utilization). This initial value will serve as the core basic parameter for defining the subsequent prediction curve and the upper and lower limit curves of the time series, ensuring the accuracy and rationality of subsequent calculations.

[0031] In some examples, when determining the predicted value corresponding to the starting time based on actual time-series data, the actual time-series data can be input into the prediction model for processing to determine the theoretical value corresponding to at least one theoretical time. Then, the theoretical value corresponding to the same theoretical time as the starting time is used as the predicted value. Here, the theoretical time is a time after the historical time period. The training process of the prediction model includes: Obtain first training sample data and first labeling results of the first training sample data; wherein, the first training sample data includes at least one set of historical actual time series data, and the first labeling results include the theoretical values ​​corresponding to each set of historical actual time series data at at least one theoretical time.

[0032] The first training sample data is input into the first neural network model for learning, and the first prediction result of the first neural network model on the first training sample data is obtained.

[0033] Based on the first prediction result and the first labeling result, the network parameters of the first neural network model are adjusted until the first neural network model converges, and the converged first neural network model is used as the prediction model.

[0034] S13. Based on the predicted values ​​and historical time series data, determine the upper limit curve and the lower limit curve of the time series.

[0035] In some examples, when determining the upper and lower time series curves based on predicted values ​​and historical time series data, the upper and lower time series curves can be determined based on at least one set of historical time series data and corresponding feature data; the prediction curve can be determined based on the predicted values ​​and at least one set of feature data; and the upper and lower time series curves can be determined based on at least one set of feature data and the prediction curve.

[0036] In some examples, the feature data includes one or more of the following: maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centered sequence corresponding to at least one point.

[0037] In some examples, based on at least one set of historical time-series data, feature data corresponding to at least one set of historical time-series data is determined, including: Taking the feature data including maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centering sequence corresponding to at least one point as an example, and combining the example given in S12 above, the calculation process for determining the feature data corresponding to at least one set of historical time series data based on at least one set of historical time series data is as follows: 1) First, a date classifier is constructed with preset date classification rules (weekdays are Monday to Friday, and holidays are weekends and statutory holidays). The three sets of HIS data (historical data from the same period) collected in S11 above are classified. The time periods corresponding to the three sets of HIS data are April 25, 2026 (Friday, weekday), April 26, 2026 (Saturday, holiday), and April 27, 2026 (Sunday, holiday). Therefore, after classification, one set of weekday HIS data (April 25) and two sets of holiday HIS data (April 26 and April 27) are obtained. At the same time, it is determined that the date corresponding to the current prediction interval (14:30:00 to 14:40:00 on April 28, 2026) is Monday (weekday). Therefore, the HIS data corresponding to the weekday (CPU utilization time series data from 14:30:00 to 14:40:00 on April 25) is selected as the training data for this feature calculation.

[0038] 2) Calculate the data characteristics for all time periods in the HIS data for this weekday (April 25th, 14:30:00 to 14:40:00, collected every minute, totaling 11 data points). Specific data points (selected complete data for calculation to ensure accurate characteristics) are as follows: X=0 (14:30:00) Y=77.8%, X=1 (14:31:00) Y=78.1%, X=2 (14:32:00) Y=78.3%, X=3 (14:33:00) Y=78.5%. The following data sets show the following characteristics: X=4 (14:34:00) Y=78.4%, X=5 (14:35:00) Y=78.6%, X=6 (14:36:00) Y=78.8%, X=7 (14:37:00) Y=78.7%, X=8 (14:38:00) Y=78.9%, X=9 (14:39:00) Y=79.0%, X=10 (14:40:00) Y=79.2%. Based on this data, the following results were calculated for various characteristics: Peak value = 79.2. %, Mean = (77.8 + 78.1 + 78.3 + 78.5 + 78.4 + 78.6 + 78.8 + 78.7 + 78.9 + 79.0 + 79.2) ÷ 11 ≈ 78.65%; Slope (calculated using linear fitting) = 0.136 (i.e., CPU utilization increases by an average of 0.136% for every additional minute); Standard Deviation ≈ 0.42 (Calculation process: first calculate the sum of squared differences between each data point and the mean, then divide by the number of data points, 11, and finally take the square root); Amplitude Sequence (Actual Value Sequence – Real The actual value sequence [0] is the actual value of each point minus the actual value of the first point in the time series data: 0%, 0.3%, 0.5%, 0.7%, 0.6%, 0.8%, 1.0%, 0.9%, 1.1%, 1.2%, 1.4%; the centered sequence (actual value sequence – mean): -0.85%, -0.55%, -0.35%, -0.15%, -0.25%, -0.05%, 0.15%, 0.05%, 0.25%, 0.35%, 0.55%.

[0039] 3) Filter the HIS data features obtained from the above calculations. Use the slope and interquartile range (IQR) scoring method to filter out scenarios with significant fluctuations. Specifically: First, calculate the slope IQR value (0.08) and standard deviation IQR value (0.15) for all HIS data (including weekdays and holidays). Set a filtering threshold (filter if the slope exceeds the range of [mean - 1.5 × IQR, mean + 1.5 × IQR] or the standard deviation exceeds the range of [mean - 1.5 × IQR, mean + 1.5 × IQR]). The slope of the selected weekday HIS data (0.136) and standard deviation (0.42) are both within the threshold range, so this set of features is retained as stationary features for subsequent calculations.

[0040] 4) Calculate the standard deviation of the forecast within the forecast period: Using the IQR combined with the mean, select the standard deviation data from all stationary features (only one group of weekday stationary features is used in this case, with a standard deviation of 0.42; if there are multiple stationary features, all standard deviation data must be included in the calculation). First, calculate the IQR value of the standard deviation = 0.15 (same as step 3). Remove the outlier standard deviations that exceed the range of [0.42-1.5×0.15, 0.42+1.5×0.15] (i.e., [0.195, 0.645]) (there are no outliers in this case). Then calculate the mean of the remaining standard deviations = 0.42. This mean is the forecast standard deviation within the forecast period (14:30:00 to 14:40:00 on April 28, 2026). Subsequently, this forecast standard deviation will be combined with the forecast initial value origin to define the upper limit curve and the lower limit curve of the time series.

[0041] In some examples, the predicted value is the initial predicted value calculated in S12, origin=78.02% (the value corresponding to the start time of the prediction interval). At least one set of feature data is the stationary features of the weekday HIS data retained after filtering in S13, focusing on the amplitude sequence (historical amplitude sequence for the same period: 0%, 0.3%, 0.5%, 0.7%, 0.6%, 0.8%, 1.0%, 0.9%, 1.1%, 1.2%, 1.4%). This historical amplitude sequence is used as the predicted amplitude sequence to calculate the predicted trend. Based on the predicted value and at least one set of feature data, the prediction curve is determined, including: 1) Determine the time dimension of the prediction curve. The prediction interval is from 14:30:00 to 14:40:00 on April 28, 2026. The sampling frequency is 1 minute / time, with a total of 11 points, corresponding to the duration attribute X (X=20 at the start time of the prediction interval 14:30:00, and incremented by 1, i.e. X=20, 21, 22...30). Each point corresponds one-to-one with the 11 values ​​of the prediction amplitude sequence. 2) Clarify the calculation logic and strictly follow the formula "Forecast_trend = Predicted initial value (origin) + Predicted amplitude sequence (amplitude_sequence)". Add origin=78.02% to the value of each point in the predicted amplitude sequence one by one to calculate the predicted value of each prediction point to ensure the accuracy of the numerical calculation. 3) Calculate the predicted value point by point, as follows: X=20 (14:30:00) Predicted value = 78.02% + 0% = 78.02%; X=21 (14:31:00) Predicted value = 78.02% + 0.3% = 78.32%; X=22 (14:32:00) Predicted value = 78.02% + 0.5% = 78.52%; X=23 (14:33:00) Predicted value = 78.02% + 0.7% = 78.72%; X=24 (14:34:00) Predicted value = 78.02% + 0.6% = 78.62%; X=25 (14:35: X=26 (14:36:00) Predicted value = 78.02% + 0.8% = 78.82%; X=27 (14:37:00) Predicted value = 78.02% + 0.9% = 78.92%; X=28 (14:38:00) Predicted value = 78.02% + 1.1% = 79.12%; X=29 (14:39:00) Predicted value = 78.02% + 1.2% = 79.22%; X=30 (14:40:00) Predicted value = 78.02% + 1.4% = 79.42%; 4) Generate prediction curves by smoothing and fitting the (X, predicted value) data of the above 11 prediction points to obtain complete prediction curves.

[0042] In some examples, the forecast trend (forecast_trend) corresponding to the forecast curve is the value of the 11 points calculated above (X=20 to 30, corresponding to forecast values ​​of 78.02%, 78.32%, 78.52%, 78.72%, 78.62%, 78.82%, 79.02%, 78.92%, 79.12%, 79.22%, 79.42%); at least one set of feature data is the stationary feature of weekday HIS data retained after filtering in S3, including the forecast center sequence (i.e., the center sequence in S3: -0.85%, -0.55%, -0.35%, -0.15%, -0.25%, -0.05%, 0.15%, 0.05%, 0.25%, 0.35%, 0.55%), and the forecast standard deviation = 0.42. Based on at least one set of feature data and the forecast curve, the upper limit curve and the lower limit curve of the time series are determined, including: 1) Perform IQR smoothing filtering on the predicted centered sequence in S13, using the standard deviation IQR value calculated in S13 = 0.15, and set the filtering threshold as [mean - 1.5 × IQR, mean + 1.5 × IQR], where the mean of the predicted centered sequence = (-0.85 - 0.55 - 0.35 - 0.15 - 0.25 - 0.05 + 0.15 + 0.05 + 0.25 + 0.35 + 0.55) ÷ 11 ≈ -0.045%, and the threshold range is [- [0.045-1.5×0.15, -0.045+1.5×0.15], which is [-0.27%, 0.18%]; after filtering, values ​​exceeding the threshold are removed (only -0.85% corresponding to X=0 and 0.55% corresponding to X=10 exceed the threshold and are removed). The remaining filtered data list is: -0.55%, -0.35%, -0.15%, -0.25%, -0.05%, 0.15%, 0.05%, 0.25%, 0.35%; 2) The filtered data list is aligned. Due to the smoothing process, two values ​​are deleted. To ensure alignment with the 11 points of the predicted trend, linear interpolation is used to supplement the two missing values ​​(interpolation of -0.70% for X=0 and 0.45% for X=10). Finally, a 1×11 dimension matrix is ​​obtained (consistent with the number of points of the predicted trend). The matrix data is: [-0.70%, -0.55%, -0.35%, -0.15%, -0.25%, -0.05%, 0.15%, 0.05%, 0.25%, 0.35%, 0.45%]; 3) Calculate the feature attributes for the same column data (i.e., the value corresponding to each point) of the 1×11 dimension matrix. Since there is only one set of stationary features, the standard deviation of each column data is the dispersion of the column values. The calculated standard deviation sequence is as follows (11 values ​​in total, corresponding to 11 prediction points): 0.02%, 0.015%, 0.01%, 0.012%, 0.018%, 0.008%, 0.014%, 0.011%, 0.016%, 0.013%, 0.021%; 4) Calculate the adaptive prediction interval. According to the formula "Prediction Interval = Prediction Trend ± 3 × Standard Deviation Sequence", calculate the upper limit value (prediction trend + 3 × standard deviation sequence) and the lower limit value (prediction trend - 3 × standard deviation sequence) for each point. The specific calculation is as follows: X=20 (14:30:00): upper limit=78.02%+3×0.02%=78.08%, lower limit=78.02%-3×0.02%=77.96%; X=21 (14:31:00): upper limit=78.32%+3×0.015%=78.365%, lower limit=78.32%-3×0.015%=78.275%; X=22 (14:32:00): upper limit=78.52%+3×0.01%=78.55%, lower limit=78.52%-3×0.01%=78.49%; X=23 (14:33:00): upper limit=78.72%+3×0.012%=78.756%, lower limit=78.72%-3×0.012%=78.684%; X=24 (14:34:00): upper limit=78.62%+3×0.018%=78.674%, lower limit=78.62%-3×0.018%=78.566%; X=25 (14:35:00): upper limit=78.82%+3×0.008%=78.844%, lower limit=78.82%-3×0.008%=78.796%; X=26 (14:36:00): upper limit=79.02%+3×0.014%=79.062%, lower limit=79.02%-3×0.014%=78.978%; X=27 (14:37:00): upper limit=78.92%+3×0.011%=78.953%, lower limit=78.92%-3×0.011%=78.887%; X=28 (14:38:00): upper limit=79.12%+3×0.016%=79.168%, lower limit=79.12%-3×0.016%=79.072%; X=29 (14:39:00): upper limit=79.22%+3×0.013%=79.259%, lower limit=79.22%-3×0.013%=79.181%; X=30 (14:40:00): upper limit=79.42%+3×0.021%=79.483%, lower limit=79.42%-3×0.021%=79.357%; Connecting the upper time limits of the 11 points sequentially yields the upper time limit curve; connecting the lower time limits of the 11 points sequentially yields the lower time limit curve.

[0043] or, According to the formula "Forecast period = Forecast trend ± 3 × Forecast standard deviation", where the forecast standard deviation = 0.42 (calculated in step S3), the upper and lower limits of the time series are calculated point by point, as follows: The uniform offset of all predicted points = 3 × 0.42% = 1.26%; X=20 (14:30:00): upper limit=78.02%+1.26%=79.28%, lower limit=78.02%-1.26%=76.76%; X=21 (14:31:00): upper limit=78.32%+1.26%=79.58%, lower limit=78.32%-1.26%=77.06%; X=22 (14:32:00): upper limit=78.52%+1.26%=79.78%, lower limit=78.52%-1.26%=77.26%; X=23 (14:33:00): upper limit=78.72%+1.26%=79.98%, lower limit=78.72%-1.26%=77.46%; X=24 (14:34:00): upper limit=78.62%+1.26%=79.88%, lower limit=78.62%-1.26%=77.36%; X=25 (14:35:00): upper limit=78.82%+1.26%=80.08%, lower limit=78.82%-1.26%=77.56%; X=26 (14:36:00): upper limit=79.02%+1.26%=80.28%, lower limit=79.02%-1.26%=77.76%; X=27 (14:37:00): upper limit=78.92%+1.26%=80.18%, lower limit=78.92%-1.26%=77.66%; X=28 (14:38:00): upper limit=79.12%+1.26%=80.38%, lower limit=79.12%-1.26%=77.86%; X=29 (14:39:00): upper limit=79.22%+1.26%=80.48%, lower limit=79.22%-1.26%=77.96%; X=30 (14:40:00): upper limit=79.42%+1.26%=80.68%, lower limit=79.42%-1.26%=78.16%; Connecting the upper time limits of the 11 points sequentially yields the upper time limit curve; connecting the lower time limits of the 11 points sequentially yields the lower time limit curve.

[0044] In some examples, when determining the upper and lower bound curves of a time series based on predicted values ​​and historical time series data, the predicted values ​​and historical time series data can be input into the curve model for prediction, resulting in theoretical upper and lower bound curves. Then, the theoretical upper bound curve is used as the upper bound curve of the time series, and the theoretical lower bound curve is used as the lower bound curve. The training process of the curve model includes: Obtain the second training sample data and the second labeling result of the second training sample data; wherein, the second training sample data includes at least one set of test data, and the second labeling result includes the theoretical upper limit curve and the theoretical lower limit curve corresponding to each set of test data, and the set of test data includes the predicted value and historical time series data.

[0045] The second training sample data is input into the second neural network model for learning, and the second prediction result of the second neural network model is obtained.

[0046] Based on the second prediction result and the second labeling result, the network parameters of the second neural network model are adjusted until the second neural network model converges, and the converged second neural network model is used as the curve model.

[0047] S14. Based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value, generate the detection result of the target time series.

[0048] In some examples, the detection results of the target time series are generated based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value, including: If the actual value is greater than the upper limit of the time series curve at the current time, or if the actual value is less than the lower limit of the time series curve at the current time, the detection result of the target time series is determined to be an anomaly.

[0049] When the actual value is greater than or equal to the lower limit and less than or equal to the upper limit, the detection result of the target time series is determined to be normal.

[0050] For example, based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value, the detection result of the target time series is generated, including: 1) Predictive Data Storage: Construct a metric data structure containing core fields: collection timestamp, target time-series metric name (business process CPU utilization), forecast trend (forecast_trend), upper limit value, lower limit value, and forecast standard deviation. These fields are associated with and populated into the metric data structure. For example, the metric data corresponding to X=20 (14:30:00) is: timestamp=2026-04-2814:30:00, metric name=business process CPU utilization, forecast trend value=78.02%, time-series upper limit value=78.08%, time-series lower limit value=77.96%, and forecast standard deviation=0.42%. After filling in the data for all 11 forecast points, the metric data structure is uploaded in batches to the time-series database (InfluxDB) via the JDBC protocol for storage, facilitating subsequent data traceability, review, and anomaly analysis.

[0051] 2) Anomaly Detection: Based on actual data (real-time collected CPU usage of business processes), anomaly detection and alarm push are completed according to the following steps: 1. Set a custom trust threshold: Based on the needs of intelligent operation and maintenance scenarios, a custom trust threshold of 0.99 is set (the trust threshold range is 0-1, which can be adjusted according to the business's requirements for anomaly sensitivity. The closer the threshold is to 1, the stricter the anomaly judgment and the lower the false negative rate; the closer the threshold is to 0, the more lenient the anomaly judgment and the lower the false positive rate). This is used to adjust the strictness of the upper and lower limits of prediction to adapt to the anomaly detection needs of actual business scenarios.

[0052] 2. Judgment of Exceeding Actual Data Limits: The communicator of the detection equipment acquires the actual CPU utilization data of each point within the prediction interval (a total of 11 points) at a sampling frequency of 1 minute / time. Combining the judgment logic of "prediction upper and lower limits × trust threshold", both adaptive prediction upper and lower limits and unified prediction upper and lower limits are used for double verification (to avoid misjudgment or missed judgment caused by a single method). The specific actual data and judgment process are as follows (the actual data simulates real fluctuations and includes 1 outlier): Actual values ​​(corresponding to 11 points in the prediction interval): X=20 (14:30:00) = 78.00%, X=21 (14:31:00) = 78.35%, X=22 (14:32:00) = 78.50%, X=23 (14:33:00) = 79.00%, X=24 (14:34:00) = 78.60%, X=25 (14:35:00) = 78.85%, X=26 (14:36:00) = 79.10%, X=27 (14:37:00) = 78.90%, X=28 (14:38:00) = 79.50%, X=29 (14:39:00) = 79.20%, X=30 (14:40:00) = 79.40%; Calculate the adjusted upper and lower bounds; where the adjusted upper bound is equal to the product of the predicted upper bound and the confidence threshold, and the adjusted lower bound is equal to the product of the predicted lower bound and the confidence threshold (the confidence threshold can be 0.99). The adaptively adjusted upper and lower limits (taking the outlier X=28 as an example): Upper limit = 79.168% × 0.99 ≈ 78.38%, Lower limit = 79.072% × 0.99 ≈ 78.28%; Determine the relationship between the actual values ​​of X=20 (14:30:00), X=21 (14:31:00), X=22 (14:32:00), X=23 (14:33:00), X=24 (14:34:00), X=25 (14:35:00), X=26 (14:36:00), X=27 (14:37:00), X=28 (14:38:00), X=29 (14:39:00), and X=30 (14:40:00) and their upper and lower limits.

[0053] Since the actual values ​​of X=22 (14:32:00), X=23 (14:33:00), X=24 (14:34:00), X=25 (14:35:00), X=26 (14:36:00), X=27 (14:37:00), X=28 (14:38:00), X=29 (14:39:00), and X=30 (14:40:00) are all greater than the upper limit value of 75.21%, it is determined that X=20 (14:30:00) and X=21 (14:31) are greater than the upper limit value of 75.21%. X=22 (14:32:00), X=23 (14:33:00), X=24 (14:34:00), X=25 (14:35:00), X=26 (14:36:00), X=27 (14:37:00), X=28 (14:38:00), X=29 (14:39:00), and X=30 (14:40:00) are all anomalous feature points; X=20 (14:30:00) and X=21 (14:31:00) are normal feature points.

[0054] 3. Alarm Event Push: Construct an alarm event data structure containing core fields: alarm timestamp (2026-04-28 14:38:00), alarm level (medium, set according to the exceedance range, exceeding the upper limit by less than 0.5% is considered medium), abnormal indicator (business process CPU utilization), abnormal point (e.g., X=28, 14:38:00), actual observed value (e.g., 79.50%), adjusted upper limit value (e.g., 78.38%), and abnormal cause (sudden change in CPU utilization, exceeding the prediction range). This alarm event data structure is pushed to the operation and maintenance alarm platform via Hypertext Transfer Protocol (HTTP). Upon receiving the data, the platform immediately sends SMS and platform message notifications to the operation and maintenance personnel, prompting them to promptly check the server's operating status to avoid service instability caused by abnormal CPU utilization, thus completing the abnormal feature point judgment and alarm closure loop.

[0055] As described above, the time series data anomaly detection method provided in this embodiment of the present disclosure obtains the actual value of the target time series indicator at the current moment, the actual time series data of historical time periods, and at least one set of historical time series data for at least one predicted time period (where the end time of the historical time period is the same as the start time of the predicted time period), providing a comprehensive and relevant data source for subsequent detection and avoiding detection bias caused by incomplete data. Then, based on the actual time series data, the predicted value corresponding to the start time is determined, and combined with the predicted value and historical time series data, the upper limit curve and lower limit curve of the time series are further determined, achieving a scientific definition of the fluctuation range of the target time series indicator, effectively filtering random fluctuations and data noise caused by external interference, and solving the problem of difficult feature extraction. Finally, based on the upper limit value of the upper limit curve at the current moment, the lower limit value of the lower limit curve at the current moment, and the actual value, a detection result is generated, which can quickly and accurately identify abnormal fluctuations of the target time series indicator and provide a reliable reference for the future trend of the target time series indicator.

[0056] In some feasible examples, combining Figure 1 ,like Figure 2 As shown, the above S12 can be implemented by the following S120 and S121.

[0057] S120. Determine the fitting formula based on actual time series data; In some examples, when determining the fitting formula based on actual time-series data, the actual time-series data can be input into the formula model for processing to obtain the theoretical formula. Then, the theoretical formula is used as the fitting formula. The training process of the formula model includes: Obtain the third training sample data and the third labeling result of the third training sample data; wherein, the third training sample data includes at least one set of historical actual time series data, and the third labeling result includes the actual formula corresponding to each set of historical actual time series data.

[0058] The third training sample data is input into the third neural network model for learning, and the third prediction result of the third neural network model on the third training sample data is obtained.

[0059] Based on the third prediction result and the third labeling result, the network parameters of the third neural network model are adjusted until the third neural network model converges, and the converged third neural network model is used as the formula model.

[0060] S121. Based on the fitting formula and the starting time, determine the predicted value corresponding to the starting time.

[0061] As described above, the time series data anomaly detection method provided in this embodiment determines a fitting formula based on actual time series data; then, based on the fitting formula and the start time, it determines the predicted value corresponding to the start time, so that the predicted value can accurately match the change pattern of the actual time series data, avoiding the problem of inaccurate definition of the subsequent time series upper limit curve and time series lower limit curve due to the deviation of the predicted value, providing strong support for the subsequent generation of accurate detection results of target time series indicators, and helping to quickly and accurately identify abnormal fluctuations of target time series indicators.

[0062] In some feasible examples, the prediction time period includes at least one location; combined with Figure 1 ,like Figure 3 As shown, the above S13 can be implemented by the following S130-S132.

[0063] S130. Based on at least one set of historical time series data, determine at least one set of feature data corresponding to at least one set of historical time series data; wherein, the feature data includes one or more of the following: maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centered sequence corresponding to at least one point. In some examples, a set of historical time-series data corresponds to a set of feature data.

[0064] In some examples, when determining the feature data corresponding to at least one set of historical time-series data, the at least one set of historical time-series data can be input into an extraction model for processing to determine the feature data corresponding to the at least one set of historical time-series data. The training process of the extraction model includes: Obtain the fourth training sample data and the fourth labeling result of the fourth training sample data; wherein, the fourth training sample data includes at least one set of historical time series data, and the fourth labeling result includes the feature data corresponding to each set of historical time series data.

[0065] The fourth training sample data is input into the fourth neural network model for learning, and the fourth prediction result of the fourth neural network model on the fourth training sample data is obtained.

[0066] Based on the fourth prediction result and the fourth labeling result, the network parameters of the fourth neural network model are adjusted until the fourth neural network model converges, and the converged fourth neural network model is used as the extraction model.

[0067] S131. Determine the prediction curve based on the predicted value and at least one set of feature data.

[0068] In some examples, when determining a prediction curve based on predicted values ​​and at least one set of feature data, the predicted values ​​and at least one set of feature data can be input into a pre-defined model for processing to obtain the prediction curve. The training process of the pre-defined model includes: Obtain the fifth training sample data and the fifth labeling result of the fifth training sample data. The fifth training sample data includes at least one set of historical data, and the fifth labeling result includes the prediction curve corresponding to each set of historical data. Each set of historical data includes the predicted value and at least one set of feature data.

[0069] The fifth training sample data is input into the fifth neural network model for learning, and the fifth prediction result of the fifth neural network model on the fifth training sample data is obtained.

[0070] Based on the fifth prediction results and the fifth labeling results, the network parameters of the fifth neural network model are adjusted until the fifth neural network model converges, and the converged fifth neural network model is used as the preset model.

[0071] S132. Based on at least one set of feature data and prediction curves, determine the upper limit curve and the lower limit curve of the time series.

[0072] In some examples, combined with the example given in S13 above, the predicted trend corresponding to the predicted curve is: X=20 to 30 (corresponding to 14:30:00 to 14:40:00), with predicted values ​​of 78.02%, 78.32%, 78.52%, 78.72%, 78.62%, 78.82%, 79.02%, 78.92%, 79.12%, 79.22%, and 79.42% respectively; at least one set of feature data (stationary features after filtering in S13): peak value = 79.2%, mean value = 78.65%, slope = 0.136, standard deviation = 0.42, and centered sequence (filtered matrix data): [-0.70%, -0.55%, -0.35%, -0.15%, -0.25%, -0.05%, 0.15%, 0.05%, 0.25%, 0.35%, 0.45%]. This paper describes how to determine the upper and lower bound curves of a time series based on at least one set of feature data and prediction curves. The specific implementation process includes: 1. Feature weight allocation: Based on the influence of each feature on the time series fluctuation, feature weights are customized (the sum of weights is 1) for the calculation of dynamic fluctuation coefficient. Among them: standard deviation (reflecting the overall degree of fluctuation) weight 0.4, slope (reflecting the rate of change of trend) weight 0.2, mean absolute value of centered sequence (reflecting the degree of data dispersion) weight 0.3, peak deviation (difference between peak value and mean value) weight 0.1; 2. Calculate the standardized values ​​of each feature (eliminating the influence of dimensions). The standardization formula is: Standardized value = (actual feature value - minimum feature value) / (maximum feature value - minimum feature value). After this calculation, the standardized values ​​of each feature are: Standard deviation = 0.65, Slope = 0.72, Mean of absolute value of centered sequence = 0.58, Peak deviation = 0.60.

[0073] 3. Calculation of Upper and Lower Limit Offsets: Based on the forecast standard deviation (0.42%) calculated in S13, and combined with the dynamic fluctuation coefficient of each point, the upper and lower limit offsets of each point are calculated. The calculation formula is: Offset = Forecast Standard Deviation × Dynamic Fluctuation Coefficient × 2 (The dynamic fluctuation coefficient is used to reasonably cover the normal fluctuation range and can be adjusted according to business needs); the offsets are calculated point by point as follows: Offset for X=20 = 0.42% × 0.62 × 2 ≈ 0.521%; Offset for X=21 = 0.42% × 0.59 × 2 ≈ 0.496%; Offset for X=22 = 0.42% × 0.56 × 2 ≈ 0.470%; Offset for X=23 = 0.42% × 0.53 × 2 ≈ 0.445%; Offset for X=24 = 0.42% × 0.55 × 2 ≈ 0.462%; Offset for X=25 = 0.42% × 0.51 × 2 ≈ 0.428%; Offset for X=26 = 0.42% × 0.57 × 2 ≈ 0.479%; Offset for X=27 = 0.42% × 0.54 × 2 ≈ 0.454%; Offset for X=28 = 0.42% × 0.60 × 2 ≈ 0.504%; Offset for X=29 = 0.42% × 0.58 × 2 ≈ 0.487%; Offset for X=30 = 0.42% × 0.63 × 2 ≈ 0.529%.

[0074] 4. Determination of upper and lower limit curves for the time series: Following the logic of "upper limit value = predicted trend value + offset, lower limit value = predicted trend value - offset", the upper and lower limits of each prediction point are calculated point by point. The specific calculation is as follows: X=20 (14:30:00): upper limit=78.02%+0.521%=78.541%, lower limit=78.02%-0.521%=77.499%; X=21 (14:31:00): upper limit=78.32%+0.496%=78.816%, lower limit=78.32%-0.496%=77.824%; X=22 (14:32:00): upper limit=78.52%+0.470%=78.990%, lower limit=78.52%-0.470%=78.050%; X=23 (14:33:00): upper limit=78.72%+0.445%=79.165%, lower limit=78.72%-0.445%=78.275%; X=24 (14:34:00): upper limit=78.62%+0.462%=79.082%, lower limit=78.62%-0.462%=78.158%; X=25 (14:35:00): upper limit=78.82%+0.428%=79.248%, lower limit=78.82%-0.428%=78.392%; X=26 (14:36:00): upper limit=79.02%+0.479%=79.499%, lower limit=79.02%-0.479%=78.541%; X=27 (14:37:00): upper limit=78.92%+0.454%=79.374%, lower limit=78.92%-0.454%=78.466%; X=28 (14:38:00): upper limit=79.12%+0.504%=79.624%, lower limit=79.12%-0.504%=78.616%; X=29 (14:39:00): upper limit=79.22%+0.487%=79.707%, lower limit=79.22%-0.487%=78.733%; X=30 (14:40:00): upper limit=79.42%+0.529%=79.949%, lower limit=79.42%-0.529%=78.891%; Finally, the upper limits of the 11 predicted points are connected smoothly in sequence to form the time series upper limit curve; the lower limits of the 11 points are connected smoothly in sequence to form the time series lower limit curve.

[0075] As described above, the anomaly detection method for time series data provided in this disclosure, based on at least one set of historical time series data, determines one or more of the following feature data: maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centered sequence corresponding to at least one point. This method can comprehensively mine the core features of historical time series data. Subsequently, a prediction curve is determined based on the predicted value and at least one set of feature data to ensure that the prediction curve conforms to the changing pattern of the target time series indicator and avoids prediction deviation. Then, based on at least one set of feature data and the prediction curve, the upper limit curve and the lower limit curve of the time series are determined to achieve a scientific and accurate definition of the fluctuation range of the target time series indicator, thereby providing a strong guarantee for generating accurate detection results based on the upper and lower limits and the actual values ​​at the current time.

[0076] In some feasible examples, combining Figure 3 ,like Figure 4 As shown, the above S131 can be specifically implemented through the following S1310 and S1311.

[0077] S1310. Filter at least one set of feature data to obtain at least one set of filtered data; wherein, one set of filtered data includes any set of feature data; S1311. Determine the prediction curve based on the predicted values ​​and at least one set of filtered data.

[0078] As described above, the anomaly detection method for time series data provided in this embodiment of the present disclosure, by filtering at least one set of feature data to obtain at least one set of filtered data (wherein one set of filtered data includes any set of feature data), can effectively remove invalid information such as noise and redundancy from the feature data, further refining the core value of the feature data; then, based on the predicted value and at least one set of filtered data, a prediction curve is determined, so that the prediction curve can better fit the trend, seasonality, and periodic characteristics of the target time series indicator; then, based on the feature data and the prediction curve, the determination of the upper limit curve and the lower limit curve of the time series provides strong support, helping the detection equipment to accurately define the fluctuation range of the target time series indicator, generate accurate detection results, and achieve the purpose of quickly identifying abnormal fluctuations and reliably predicting future trends.

[0079] In some feasible examples, combining Figure 4 ,like Figure 5 As shown, the above S1310 can be specifically implemented through the following S13100.

[0080] S13100. Use the interquartile range method to filter at least one set of feature data to obtain at least one set of filtered data.

[0081] As described above, the anomaly detection method for time series data provided in this embodiment of the present disclosure filters at least one set of feature data using the interquartile range method to obtain at least one set of filtered data (wherein one set of filtered data includes any set of feature data). This effectively removes invalid information such as noise and redundancy from the feature data, further refining the core value of the feature data. Subsequently, a prediction curve is determined based on the predicted value and at least one set of filtered data, making the prediction curve more closely match the trend, seasonality, and periodicity characteristics of the target time series indicator. Then, the determination of the upper and lower limit curves of the time series based on the feature data and the prediction curve provides strong support, helping the detection equipment to accurately define the fluctuation range of the target time series indicator, generate accurate detection results, and achieve the purpose of quickly identifying abnormal fluctuations and reliably predicting future trends.

[0082] In some feasible examples, combining Figure 4 ,like Figure 6 As shown, the above S1311 can be specifically implemented through the following S13110-S13112.

[0083] S13110. Based on the amplitude sequence corresponding to at least one point in at least one set of filtered data, determine the mean of the amplitude sequence of at least one point. S13111. Based on the mean and predicted values ​​of the amplitude sequence at at least one point, determine at least one fusion difference value; In some examples, when determining at least one fusion difference value based on the mean and predicted values ​​of the amplitude sequence at at least one location, the predicted value can be summed with the mean of the amplitude sequence corresponding to each location to obtain the fusion difference value for that location. Based on the amplitude sequence corresponding to at least one location in at least one set of filtered data, the mean of the amplitude sequence for at least one location is determined. Then, the fusion difference value is determined as "fusion difference value = predicted value + (mean of amplitude sequence - minimum value of amplitude sequence)", and the predicted value and corresponding amplitude value are substituted point by point to calculate the fusion difference value for each location.

[0084] For example, referring to the example given in S13 above, the predicted values ​​for the 11 points are 78.02%, 78.32%, 78.52%, 78.72%, 78.62%, 78.82%, 79.02%, 78.92%, 79.12%, 79.22%, and 79.42%, respectively. Sum the amplitude values ​​of the 11 points and divide by 11 to get the mean of the amplitude sequence = (0.3+0.5+0.4+0.2+0.3+0.1+0.4+0.3+0.5+0.4+0.6)÷11≈0.36%.

[0085] The fusion difference value = predicted value (forecast_trend) + (mean of amplitude sequence - minimum value of amplitude sequence), which retains the core pattern of the predicted trend and corrects the deviation by combining amplitude characteristics; X=20 (14:30): Fusion difference = 78.02% + (0.36% - 0.1%) = 78.02% + 0.26% = 78.28%; X=21 (14:01): Fusion difference = 78.32% + (0.5% - 0.1%) = 78.32% + 0.4% = 78.72%; X=22 (14:02): Fusion difference = 78.52% + (0.4% - 0.1%) = 78.52% + 0.3% = 78.82%; X=23 (14:03): Fusion difference = 78.72% + (0.2% - 0.1%) = 78.72% + 0.1% = 78.82%; X=24 (14:04): Fusion difference = 78.62% + (0.3% - 0.1%) = 78.62% + 0.2% = 78.82%; X=25 (14:05): Fusion difference = 78.82% + (0.1% - 0.05%) = 78.82% + 0.05% = 78.87%; X=26 (14:06): Fusion difference = 79.02% + (0.4% - 0.1%) = 79.02% + 0.3% = 79.32%; X=27 (14:07): Fusion difference = 78.92% + (0.3% - 0.05%) = 78.92% + 0.25% = 79.17%; X=28 (14:08): Fusion difference = 79.12% + (0.5% - 0.2%) = 79.12% + 0.3% = 79.42%; X=29 (14:09): Fusion difference = 79.22% + (0.4% - 0.1%) = 79.22% + 0.3% = 79.52%; X=30 (14:10): Fusion difference value = 79.42% + (0.6% - 0.3%) = 79.42% + 0.3% = 79.72%. Thus, at least one fusion difference value is obtained.

[0086] S13112. Generate a prediction curve based on at least one fusion difference value.

[0087] As described above, the anomaly detection method for time series data provided in this disclosure determines the mean of the amplitude sequence of at least one point based on the amplitude sequence corresponding to at least one point in at least one set of filtered data. This effectively integrates the discrete information of the amplitude sequence in the filtered data, weakens the interference caused by random fluctuations, and purifies the core features of the amplitude sequence, providing accurate data support for determining the fusion difference value. Subsequently, based on the mean of the amplitude sequence of at least one point and the predicted value, at least one fusion difference value is determined, achieving accurate fusion of the predicted value and the core features of the filtered data, avoiding deviations caused by a single data dimension. Then, a prediction curve is generated based on at least one fusion difference value, making the prediction curve more closely match the trend, seasonality, and periodicity characteristics of the target time series indicator, further improving the accuracy of the prediction curve. This provides more reliable support for determining the upper and lower limit curves of the time series, helping the detection equipment to accurately define the fluctuation range of the target time series indicator, generate accurate detection results, and achieve the purpose of quickly identifying abnormal fluctuations and reliably predicting future trends.

[0088] In some feasible examples, combining Figure 3 ,like Figure 7 As shown, the above S132 can be specifically implemented through the following S1320 and S1321.

[0089] S1320. Determine the mean of the standard deviations based on the standard deviations in at least one set of feature data; S1321. Based on the mean of the standard deviation and the prediction curve, determine the upper limit curve and the lower limit curve of the time series.

[0090] As described above, the anomaly detection method for time series data provided in this disclosure determines the mean of the standard deviation based on the standard deviation of at least one set of feature data. This effectively integrates the discrete information of the standard deviation in the feature data, weakens the interference caused by random fluctuations, purifies the core features of the standard deviation, and avoids deviations in the range of fluctuations caused by a single standard deviation. This provides a precise and reliable calculation basis for determining the upper and lower limit curves of the time series. Subsequently, based on the mean of the standard deviation and the prediction curve, the upper limit curve and the lower limit curve of the time series are determined, achieving a scientific and precise definition of the fluctuation range of the target time series indicator. This not only conforms to the trend, seasonality, and periodic characteristics of the target time series indicator but also reasonably covers the normal fluctuation range and distinguishes abnormal fluctuations. This provides a strong guarantee for the detection equipment to generate accurate detection results based on the upper and lower limit values ​​and the actual values ​​at the current time, helping to quickly and accurately identify abnormal fluctuations of the target time series indicator, reliably predict its future trend, and ensure the stability of system operation.

[0091] In some feasible examples, combining Figure 7 ,like Figure 8 As shown, the above S1321 can be specifically implemented through the following S13210 and S13211.

[0092] S13210. Determine the upper limit curve of the time series based on the sum of the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations. S13211. Determine the time series lower limit curve based on the difference between the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations.

[0093] As described above, the time-series data anomaly detection method provided in this embodiment determines the upper limit curve of the time series based on the sum of the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations. Then, it determines the lower limit curve of the time series based on the difference between the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations. This method accurately combines the core feature of the prediction curve (fusion difference value) with the mean of the standard deviations, achieving a refined and point-specific definition of the upper and lower limit curves of the time series. This not only fully aligns with the trend, seasonality, and periodic characteristics of the target time-series indicator but also reasonably covers the normal fluctuation range of the target time-series indicator through the mean of the standard deviations. It effectively avoids the problems of missed anomalies due to overly broad upper and lower limit definitions and false detections due to overly narrow definitions, further improving the accuracy and rationality of the upper and lower limit curves of the time series. This provides solid support for generating accurate detection results based on the actual values ​​at the current moment and the upper and lower limit values, helping to quickly and accurately identify abnormal fluctuations in the target time-series indicator, reliably predict its future trends, and ensure the stability of system operation.

[0094] In some feasible examples, combining Figure 1 ,like Figure 9 As shown, the above S14 can be implemented in the following S140.

[0095] S140. When the actual value is greater than the upper limit of the time series curve at the current time, or when the actual value is less than the lower limit of the time series curve at the current time, the detection result of the target time series is determined to be an anomaly.

[0096] As described above, the time series data anomaly detection method provided in this embodiment determines the detection result of the target time series as an anomaly when the actual value is greater than the upper limit of the time series upper limit curve at the current time, or when the actual value is less than the lower limit of the time series lower limit curve at the current time. This allows for rapid response to abnormal fluctuations in the actual value, timely output of anomaly detection results, and provides timely basis for subsequent anomaly handling and risk prevention, further improving detection efficiency and accuracy, helping to quickly and accurately identify abnormal fluctuations in target time series indicators, and ensuring system operational stability.

[0097] The foregoing primarily describes the solutions provided by the embodiments of this disclosure from a methodological perspective. To achieve the aforementioned functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this disclosure can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0098] This disclosure embodiment can divide the detection device into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing unit. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this disclosure embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0099] like Figure 10 As shown, an embodiment of this disclosure provides a schematic diagram of a detection device. It includes a communicator 101 and a controller 102.

[0100] The communicator 101 is configured to: acquire the actual value of the target time series indicator at the current time, the actual time series data of the target time series indicator in a historical time period, and at least one set of historical time series data of the target time series indicator in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period. Controller 102 is configured as follows: Based on actual time-series data, determine the predicted value corresponding to the starting time; Based on the predicted values ​​and historical time-series data, determine the upper and lower time-series curves; The detection results of the target time series are generated based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value.

[0101] In some implementable examples, the controller is further configured to: determine the predicted value corresponding to the start time based on actual time-series data. Based on actual time series data, determine the fitting formula; Based on the fitting formula and the starting time, the predicted value corresponding to the starting time is determined.

[0102] In some feasible examples, the prediction time period includes at least one location; the controller 102 is further configured to: determine the upper and lower time series curves based on the predicted values ​​and historical time series data. Based on at least one set of historical time series data, at least one set of feature data corresponding to at least one set of historical time series data is determined; wherein, the feature data includes one or more of the following: maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centered sequence corresponding to at least one point; Determine the prediction curve based on the predicted values ​​and at least one set of feature data; Based on at least one set of feature data and prediction curves, determine the upper limit curve and the lower limit curve of the time series.

[0103] In some implementable examples, controller 102 is further configured to: determine the prediction curve based on the predicted values ​​and feature data. Filter at least one set of feature data to obtain at least one set of filtered data; wherein, one set of filtered data includes any set of feature data; Determine the prediction curve based on the predicted values ​​and at least one set of filtered data.

[0104] In some implementable examples, when the controller 102 performs filtering on at least one set of feature data to obtain at least one set of filtered data, it is further configured to: At least one set of feature data is filtered using the interquartile range method to obtain at least one set of filtered data.

[0105] In some implementable examples, controller 102 is further configured to determine the prediction curve based on the predicted values ​​and at least one set of filtered data: Based on the amplitude sequence corresponding to at least one point in at least one set of filtered data, determine the mean of the amplitude sequence of at least one point. Based on the mean and predicted values ​​of the amplitude sequence at at least one point, determine at least one fusion difference value; A prediction curve is generated based on at least one fusion difference value.

[0106] In some implementable examples, controller 102 is further configured to determine the upper and lower time-series curves based on at least one set of feature data and prediction curves: Determine the mean of the standard deviations based on the standard deviations in at least one set of feature data; Based on the mean of the standard deviation and the prediction curve, the upper limit curve and the lower limit curve of the time series are determined.

[0107] In some implementable examples, controller 102 is further configured to: determine the upper and lower bound curves of the time series when performing mean and forecast curves based on standard deviation. The upper limit curve of the time series is determined based on the sum of the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations. The lower limit curve of the time series is determined based on the difference between the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations.

[0108] In some implementable examples, when the controller 102 generates the detection result of the target time series based on the upper limit value of the upper limit curve at the current time, the lower limit value of the lower limit curve at the current time, and the actual value, it is further configured to: If the actual value is greater than the upper limit of the time series curve at the current time, or if the actual value is less than the lower limit of the time series curve at the current time, the detection result of the target time series is determined to be an anomaly.

[0109] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and their functions will not be repeated here.

[0110] Of course, the detection device provided in this embodiment includes, but is not limited to, the modules described above. For example, the detection device may also include a memory 103. The memory 103 may be used to store the program code of the detection device, and may also be used to store data generated by the detection device during operation, such as data in write requests.

[0111] like Figure 11 As shown, this disclosure also provides a chip system that can be applied to the detection device in the foregoing embodiments. The chip system includes at least one processor 1501 and at least one interface circuit 1502. The processor 1501 can be the processor in the aforementioned detection device. The processor 1501 and the interface circuit 1502 can be interconnected via lines. The processor 1501 can receive and execute computer instructions from the memory of the aforementioned detection device through the interface circuit 1502. When the computer instructions are executed by the processor 1501, the detection device can perform the various steps performed by the detection device in the foregoing embodiments. Of course, the chip system may also include other discrete devices, and this disclosure does not specifically limit this.

[0112] This disclosure also provides a computer-readable storage medium for storing computer instructions for operating the aforementioned detection device.

[0113] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A testing device, characterized in that, include: The communicator is configured to: acquire the actual value of a target time series indicator at the current moment, the actual time series data of the target time series indicator in a historical time period, and at least one set of historical time series data of the target time series indicator in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period. The controller is configured as follows: Based on the actual time series data, determine the predicted value corresponding to the start time; Based on the predicted values ​​and the historical time-series data, determine the upper limit curve and the lower limit curve of the time series; The detection result of the target time series is generated based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value.

2. The detection device according to claim 1, characterized in that, When the controller determines the predicted value corresponding to the start time based on the actual time-series data, it is further configured to: Based on the actual time series data, a fitting formula is determined; Based on the fitting formula and the starting time, the predicted value corresponding to the starting time is determined.

3. The detection device according to claim 1, characterized in that, The predicted time period includes at least one location; When the controller determines the upper and lower time-series curves based on the predicted values ​​and the historical time-series data, it is further configured to: Based on at least one set of historical time series data, at least one set of feature data corresponding to at least one set of historical time series data is determined; wherein, the feature data includes one or more of the following: maximum value, minimum value, slope, standard deviation, amplitude sequence corresponding to at least one point, and centered sequence corresponding to at least one point; Based on the predicted value and the at least one set of feature data, a prediction curve is determined; Based on the at least one set of feature data and the prediction curve, the upper limit curve and the lower limit curve of the time series are determined.

4. The detection device according to claim 3, characterized in that, When the controller determines the prediction curve based on the predicted value and the feature data, it is further configured to: Filter at least one set of the feature data to obtain at least one set of filtered data; wherein, the set of filtered data includes any one set of the feature data; Based on the predicted value and the at least one set of filtered data, a prediction curve is determined.

5. The detection device according to claim 4, characterized in that, When the controller performs filtering on at least one set of the feature data to obtain at least one set of filtered data, it is further configured to: The interquartile range method is used to filter at least one set of the feature data to obtain at least one set of filtered data.

6. The detection device according to claim 4, characterized in that, When the controller performs the task of determining the prediction curve based on the predicted value and the at least one set of filtered data, it is further configured to: Based on the amplitude sequence corresponding to at least one point in the at least one set of filtered data, determine the mean of the amplitude sequence of at least one point; Based on the mean of the amplitude sequence at at least one point and the predicted value, at least one fusion difference value is determined; A prediction curve is generated based on the at least one fusion difference value.

7. The detection device according to claim 3, characterized in that, When the controller performs the task of determining the upper and lower time-series curves based on the at least one set of feature data and the prediction curve, it is further configured to: The mean of the standard deviations is determined based on the standard deviations in the at least one set of feature data. Based on the mean of the standard deviation and the prediction curve, the upper limit curve and the lower limit curve of the time series are determined.

8. The detection device according to claim 7, characterized in that, When the controller determines the upper and lower time series curves based on the mean of the standard deviation and the prediction curve, it is further configured to: The upper limit curve of the time series is determined based on the sum of the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations. The lower limit curve of the time series is determined based on the difference between the fusion difference value corresponding to at least one point in the prediction curve and the mean of one or more standard deviations.

9. The detection device according to claim 1, characterized in that, When the controller generates the detection result of the target time series based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value, it is further configured to: When the actual value is greater than the upper limit of the time series curve at the current time, or when the actual value is less than the lower limit of the time series curve at the current time, the detection result of the target time series is determined to be an anomaly.

10. A method for anomaly detection in time-series data, characterized in that, include: The system acquires the actual value of the target time series indicator at the current moment, the actual time series data of the target time series indicator in a historical time period, and at least one set of historical time series data of the target time series indicator in at least one prediction time period; wherein the end time of the historical time period is the same as the start time of the prediction time period. Based on the actual time series data, determine the predicted value corresponding to the start time; Based on the predicted values ​​and the historical time-series data, determine the upper limit curve and the lower limit curve of the time series; The detection result of the target time series is generated based on the upper limit value of the time series upper limit curve at the current time, the lower limit value of the time series lower limit curve at the current time, and the actual value.

Images