Data display method, device, equipment, readable storage medium and program product

Abstract

This application discloses a data visualization method, apparatus, device, readable storage medium, and program product. The method includes: determining, based on time-series data, at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; each event cluster includes one anomalous event or at least two adjacent anomalous events; calculating an importance score for each event cluster; the importance score is related to the anomalous state of the event cluster; and determining a target visualization percentage for each event cluster on a time axis based on the importance score of the event cluster; the time axis is a coordinate axis of a chart displaying the events and their attribute characteristics. This solution calculates an importance score related to the anomalous state of the event cluster and displays different event clusters with different visualization effects, thus event clusters with higher importance scores have a larger visualization percentage on the time axis.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a data display method, apparatus, device, readable storage medium, and program product. Background Technology

[0002] In scenarios such as industrial monitoring and system maintenance, the visualization of time series data typically uses a linear timeline, arranging time points chronologically and marking abnormal events. Existing solutions mainly display individual anomalies by statically marking them or using color to distinguish different types of anomalies, but this has the following limitations: statically marking individual anomalies cannot intuitively display abnormal events over a continuous time period; the fixed mapping between the timeline and the positions of abnormal events makes it difficult to adapt to data with different time granularities. Therefore, the existing visualization of time series data fails to meet users' needs for quickly grasping the temporal distribution range of abnormal events. Summary of the Invention

[0003] At least one embodiment of this application provides a data display method, apparatus, device, readable storage medium, and program product to solve the problem that the visualization display effect of time series data in the prior art is difficult to meet the user's need to quickly grasp the time distribution range of abnormal events.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide a data display method, including:

[0006] Based on time series data, identify at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; each event cluster includes one anomalous event or at least two adjacent anomalous events.

[0007] Calculate an importance score for each event cluster; the importance score is related to the abnormal state of the event cluster.

[0008] Based on the importance score of the event cluster, the target visualization percentage of each event cluster on the time axis is determined; the time axis is a coordinate axis of a chart that displays the events and their attribute characteristics.

[0009] Optionally, based on the acquired time-series data, at least two events ordered by time and attribute characteristics of each event are determined, including:

[0010] Based on the mapping relationship between time data and time sequence in the time series data, at least two events are determined in chronological order;

[0011] Extract the attribute features of each event from the time series data;

[0012] The attribute features include at least one of the following: occurrence time, end time, duration, occurrence frequency, and anomaly level for each event.

[0013] Optionally, based on the time series data, at least two event clusters are determined, including at least one of the following:

[0014] An event cluster is defined as an event whose duration in the time series data is greater than a preset duration.

[0015] Determine at least two abnormal events in the time series data that occur at a time interval less than a preset interval as an event cluster.

[0016] Optionally, an importance score is calculated for each of the event clusters, including:

[0017] Based on the time series data, determine the importance index value for each event cluster;

[0018] The importance scores of each event cluster are obtained by weighting the values ​​of the importance indicators.

[0019] The importance indicators include at least one of the following: the number of abnormal events per unit time, and the abnormality level and impact range of the included abnormal events.

[0020] Optionally, based on the importance score of the event cluster, the target visualization percentage of each event cluster on the timeline is determined, including:

[0021] The scaling factor is determined based on the importance score;

[0022] Based on the scaling factor, a mapping ratio is determined to characterize the mapping relationship of each event cluster on the time axis.

[0023] Optionally, a scaling factor is determined based on the importance score, including:

[0024] The scaling factor is determined using the importance score as the independent variable through a linear regression model.

[0025] Optionally, determining the mapping ratio of each event cluster on the time axis based on the scaling factor includes:

[0026] Based on the duration of the event cluster, determine the initial percentage of the event cluster's visualization on the timeline;

[0027] The initial visualization percentage is adjusted based on the scaling factor to determine the target visualization percentage for the event cluster.

[0028] Optionally, the method further includes:

[0029] Based on the importance score of the event cluster, determine the display strategy of the event cluster on the chart;

[0030] The display strategy includes at least one of the following: display elements and display methods.

[0031] Secondly, embodiments of this application provide a data display device, including:

[0032] The first determining module is used to determine, based on time series data, at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; the event clusters include one anomalous event or at least two adjacent anomalous events.

[0033] A calculation module is used to calculate the importance score for each event cluster; the importance score is related to the abnormal state of the event cluster.

[0034] The second determining module is used to determine the target visualization percentage of each event cluster on the time axis based on the importance score of the event cluster; the time axis is a coordinate axis of a chart that displays the events and the attribute characteristics of the events.

[0035] Thirdly, embodiments of this application provide a terminal device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method described in the first aspect.

[0036] Fourthly, embodiments of this application provide a computer-readable storage medium storing a program, which, when executed by a processor, implements the steps of the data display method described above.

[0037] Fifthly, embodiments of this application provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the data display method described above.

[0038] Compared with existing technologies, the data display method, apparatus, device, readable storage medium, and program product provided in this application, through time series data, determine at least two events ordered by time, attribute characteristics of each time period, and at least two event clusters; and by calculating the importance score of the event clusters, determine the target visualization percentage of each event cluster on the time axis of the chart, thereby displaying the event clusters at different visualization percentages on the time axis according to their different importance scores. The data display method of this application, by calculating the importance score related to the abnormal state of the event cluster, can display event clusters with different abnormal states with different display effects, so that the higher the importance score of the event cluster, the greater the visualization percentage on the time axis. This solves the problem that the visualization display effect of time series data in existing technologies is difficult to meet the user's need to quickly grasp the time distribution range of abnormal events. Attached Figure Description

[0039] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0040] Figure 1 This is a schematic diagram illustrating the steps of the data display method according to an embodiment of this application;

[0041] Figure 2 This is a schematic diagram of the structure of the data display system according to an embodiment of this application;

[0042] Figure 3 This is a schematic diagram of the modules of the data display device according to an embodiment of this application;

[0043] Figure 4 This is a schematic diagram of the structure of a terminal device according to an embodiment of this application. Detailed Implementation

[0044] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0045] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as one in which the sender explicitly informs the receiver of specific information, the operation to be performed, or the requested result, etc.; an indirect instruction can be understood as one in which the receiver determines the corresponding information based on the instruction sent by the sender, or makes a judgment and determines the operation to be performed or the requested result, etc., based on the judgment result.

[0046] As described in the background section, in existing technologies, the visualization of time series data typically uses a linear timeline, arranging time points in chronological order and marking anomalous events. Existing solutions mainly display individual anomalies by statically marking them or by using color to distinguish different types of anomalies, but this has the following limitations: statically marking individual anomalies cannot intuitively display anomalous events over a continuous time period; the fixed mapping between the timeline and the positions of anomalous events makes it difficult to adapt to data with different time granularities. This makes it difficult to meet users' needs for quickly grasping the temporal distribution range of anomalous events. To solve these problems, embodiments of this application provide a data display method that can reduce or avoid the above situations, improve communication efficiency, and enhance user experience.

[0047] This application provides a data display method and apparatus. The method and apparatus are based on the same concept, and since they solve problems based on similar principles, their implementations can be mutually referenced; repeated details will not be repeated.

[0048] like Figure 1 As shown in the embodiment of this application, a data display method includes the following steps:

[0049] Step 101: Based on the time series data, determine at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; the event cluster includes one anomalous event or at least two adjacent anomalous events.

[0050] Step 102: Calculate the importance score for each event cluster; the importance score is related to the abnormal state of the event cluster.

[0051] Step 103: Determine the target visualization percentage of each event cluster on the time axis based on the importance score of the event cluster; the time axis is a coordinate axis of a chart that displays the events and their attribute characteristics.

[0052] Optionally, the time series data is a time series data table;

[0053] The time series data table includes the event corresponding to each time point and the anomaly level of each event.

[0054] Optionally, the anomaly levels include: normal, alarm, and fault;

[0055] The abnormal events are those with an abnormality level of alarm or fault.

[0056] The data visualization method provided in this application, through time series data, identifies at least two events ordered by time, attribute characteristics of each time period, and at least two event clusters. By calculating the importance score of each event cluster, it determines the target visualization percentage of each event cluster on the time axis of a chart. Therefore, based on the different importance scores of the event clusters, they are displayed at different visualization percentages on the time axis. This data visualization method, by calculating the importance score related to the abnormal state of the event cluster, can display event clusters with different abnormal states with different display effects. Thus, event clusters with higher importance scores have a larger visualization percentage on the time axis. This solves the problem in the prior art where the visualization effect of time series data is difficult to meet users' needs for quickly grasping the time distribution range of abnormal events.

[0057] Optionally, before determining, based on time-series data, at least two events ordered by time, attribute characteristics of each event, and at least two event clusters, the method further includes:

[0058] The time series data is preprocessed.

[0059] The data preprocessing of the time series data includes:

[0060] The time series data is filtered for invalid data and missing data is filled in.

[0061] In this embodiment of the application, the invalid data includes: data with format errors, data corresponding to invalid timestamps, and data that exceeds the range of the icon's representation;

[0062] The missing data in the time series data were filled using linear interpolation.

[0063] Optionally, based on the acquired time-series data, at least two events ordered by time and attribute characteristics of each event are determined, including:

[0064] Based on the mapping relationship between time data and time sequence in the time series data, at least two events are determined in chronological order;

[0065] Extract the attribute features of each event from the time series data;

[0066] The attribute features include at least one of the following for each event: event type, occurrence time, end time, duration, occurrence frequency, scope of impact, and anomaly level.

[0067] Optionally, based on the mapping relationship between time data and time sequence in the time series data, at least two events ordered by time are determined, including:

[0068] Traverse the time series data table and sort the times according to time.

[0069] Optionally, based on the time series data, at least two event clusters are determined, including at least one of the following:

[0070] An event cluster is defined as an event whose duration in the time series data is greater than a preset duration.

[0071] Determine at least two abnormal events in the time series data that occur at a time interval less than a preset interval as an event cluster.

[0072] In this embodiment of the application, based on the attribute characteristics of the time, at least two time periods that are consecutive in time or have a time interval less than a preset interval are identified to form the event cluster.

[0073] It should be noted that the preset interval is adjusted according to the density of abnormal events in the event (an adjustment strategy of increasing the preset threshold when abnormal events are dense can be adopted).

[0074] For example, the preset interval is 5 minutes.

[0075] Specifically, based on the time series data, at least two event clusters are identified, including:

[0076] Collect the timestamp index of abnormal events and generate an event array;

[0077] Sort the array in ascending order of time and calculate the time difference between adjacent abnormal events.

[0078] Optionally, the event clusters can be filtered using a sliding window method;

[0079] Specifically, the size of the animated window is set to k (which can be dynamically adjusted, with a default value of 5 min).

[0080] If the time difference between adjacent abnormal events is less than or equal to k, the adjacent abnormal events are considered to be consecutive and are merged into the same event cluster.

[0081] If the time difference between adjacent abnormal events is greater than k, the search for the current event cluster ends and a new event cluster begins.

[0082] The data display method of this application solves the problem in the prior art that continuous anomalies cannot be displayed by single-point marking by constructing event clusters.

[0083] Optionally, an importance score is calculated for each of the event clusters, including:

[0084] Based on the time series data, determine the importance index value for each event cluster;

[0085] The importance scores of each event cluster are obtained by weighting the values ​​of the importance indicators.

[0086] The importance indicators include at least one of the following: the number of abnormal events per unit time, and the abnormality level and impact range of the included abnormal events.

[0087] In this embodiment of the application, for each time unit to be mapped on the chart (e.g., a 5-minute window), the importance index value of each event cluster is calculated;

[0088] Specifically, the importance score is calculated using the following formula:

[0089] I=w1⋅Dnormalized+w2⋅Snormalized+w3⋅mnormalized;

[0090] Where Dnormalized is the normalized abnormal event density, that is, the number of abnormal events in the event cluster per unit time.

[0091] Snormalized is the normalized average time severity, which is the average anomalous level of the anomalous events contained in the event cluster.

[0092] mnormalized is the normalized business impact indicator, which is the abnormality level and impact range of the abnormal events contained in the event cluster.

[0093] These are configurable weighting coefficients, and w1+w2+w3=1.

[0094] The data display method of this application calculates the importance score of each event cluster and uses the importance index value as the mapping benchmark of the event cluster. Unlike the traditional method of "amplifying when there are many anomalies", this method only amplifies "serious" anomalies. Critical fault periods are automatically stretched and amplified in the time axis direction, while minor alarms or normal periods are appropriately compressed. This greatly improves the efficiency of operation and maintenance personnel in locating core problems and achieves true intelligent adaptive scaling.

[0095] Optionally, based on the importance score of the event cluster, the target visualization percentage of each event cluster on the timeline is determined, including:

[0096] The scaling factor is determined based on the importance score;

[0097] Based on the scaling factor, a mapping ratio is determined to characterize the mapping relationship of each event cluster on the time axis.

[0098] Optionally, a scaling factor is determined based on the importance score, including:

[0099] The scaling factor is determined using the importance score as the independent variable through a linear regression model.

[0100] Specifically, the linear regression model is as follows:

[0101] α = 1 + klog(I+1);

[0102] Wherein, α is the scaling factor;

[0103] k is the adjustment coefficient (i.e., the regression coefficient), and its default value is 0.5;

[0104] I represents the importance score.

[0105] It should be noted that when I increases (indicating that the time period is unusually dense, severe, or has a significant impact on business), α increases, and the display ratio of the time axis in this area is lengthened (enlarged) to accommodate more details;

[0106] When I decreases, α (response value) decreases, and the display scale is compressed (shrunk) to avoid redundant information occupying interface space.

[0107] Optionally, determining the mapping ratio of each event cluster on the time axis based on the scaling factor includes:

[0108] Based on the duration of the event cluster, determine the initial percentage of the event cluster's visualization on the timeline;

[0109] The initial visualization percentage is adjusted based on the scaling factor to determine the target visualization percentage for the event cluster.

[0110] In this embodiment of the application, physical time t (H:m) is mapped to the final visual position percentage P':

[0111] Where H represents time in hours and m represents time in minutes;

[0112] Basic linear mapping: P = ((h + m / 60) / 24) * 100%;

[0113] Apply dynamic scaling: P′=P×α;

[0114] And the boundary constraint algorithm ensures that P' always falls within the effective visible range of [0, 100%].

[0115] The data display method of this application embodiment can dynamically map abnormal time series to the time axis through the above mapping mechanism, and realize an intelligent leap from "amplifying the abnormal dense area" to "prioritizing the business key area".

[0116] Optionally, the method further includes:

[0117] Based on the importance score of the event cluster, determine the display strategy of the event cluster on the chart;

[0118] The display strategy includes at least one of the following: display elements and display methods.

[0119] Optionally, the display elements include display colors, and the display method includes flashing display.

[0120] In this embodiment of the application, the rendering style is dynamically adjusted based on the importance score to realize the priority display of information, multi-view linkage and responsive design, adapt to different devices and usage scenarios, and balance information integrity and readability.

[0121] Specifically, the rendering component design includes:

[0122] 1. Intelligent Timeline:

[0123] Basic scale: During normal periods, it displays H:m (minute level), and in abnormally dense areas, it is automatically refined to H:m:s (second level);

[0124] Dynamic grid lines: Thick grid lines are added to the boundaries of anomaly clusters to highlight the time range;

[0125] 2. Event Cluster Visualization:

[0126] Fault cluster: a red semi-transparent background block, the transparency of which is positively correlated with the severity of the fault (abnormality level);

[0127] Alarm cluster: A yellow semi-transparent background block whose height varies with eventCount (abnormal event density);

[0128] Cluster markers: A severity icon is displayed at the center of the cluster (e.g., red indicates high severity);

[0129] 3. Reinforcement at key time points:

[0130] Cluster start / end: ​​Add triangle markers to distinguish the start and end;

[0131] Latest anomaly: A blinking animation is used (the frequency changes with severity).

[0132] 4. Multi-view linkage:

[0133] Main view: Displays the full timeline and event clusters;

[0134] Details view: Clicking on a cluster will bring up a list of events and a trend chart for that time period;

[0135] Thumbnail view: The right side displays a full-time thumbnail axis, marking the current view position.

[0136] In this embodiment of the application, the responsive rendering strategy of the data display method includes:

[0137] Display screen width <768px (mobile): Hide secondary scales and only display high severity clusters;

[0138] 768px ≤ display screen width < 1200px (tablet): Simplify cluster tags while retaining core information;

[0139] Display screen width ≥ 1200px (PC): Displays complete details and supports multi-cluster comparison.

[0140] In this embodiment of the application, the method further includes:

[0141] Receive the first operation;

[0142] In response to the first operation, the target content is displayed on the icon.

[0143] Optionally, the first operation is a click operation on a target event cluster;

[0144] The target content refers to the attribute characteristics of the events included in the target event cluster.

[0145] Specifically, after a click operation on the target event cluster, the target time cluster and associated events (such as historical anomalies of the same device) are highlighted.

[0146] Optionally, the first operation is a double-click operation on the target event cluster;

[0147] The target content is the attribute characteristics of the events included in the target event cluster, magnified.

[0148] Specifically, after a double-click operation on the target event cluster, the view is focused on the target event cluster, and the details are magnified.

[0149] Optionally, the first operation is a right-click operation;

[0150] The target content is the operation menu (e.g., export data, mark as processed, etc.).

[0151] Specifically, a menu will pop up for right-click operations.

[0152] Optionally, the first operation is a right-click operation;

[0153] The target content is an error information pop-up.

[0154] Specifically, an error message pops up for right-click operations.

[0155] Optionally, the error information pop-up includes:

[0156] Basic information: event list, time distribution, scope of impact;

[0157] Correlation analysis: Displays related events (such as pre-alarms from the same device);

[0158] Recommended solutions: Recommend solutions based on historical data (e.g., "Check the cooling system").

[0159] In the data display method of this invention embodiment, the user drags the bidirectional slider to select 10:00-12:00 → the system automatically highlights two event clusters within this range → hovering over event cluster 1 → displaying "10:15-10:45, 3 motor overheating faults, high severity" → clicking on event cluster 1 → a details pop-up window appears, displaying the event list and associated temperature trend graph → right-clicking and selecting "Mark as processed" → the background of the event cluster turns gray, marking the processing status.

[0160] Optionally, the method further includes:

[0161] Obtain the user's first action data at the first moment;

[0162] The first operation data is corrected based on the operation data and historical operation data.

[0163] Optionally, the method further includes:

[0164] Construct a feedback-driven parameter optimization model and establish a mapping relationship between behavioral features and model parameters;

[0165] Real-time monitoring and adaptive adjustment triggering, a new model performance monitoring module has been added to calculate the metrics of rendering efficiency and recognition accuracy in real time.

[0166] In this embodiment of the application, the operation data includes:

[0167] Time axis scaling frequency (e.g., the number of times to scale the abnormal dense area from 10:00 to 10:10), abnormal point click duration (the dwell time when clicking on a fault point), and associated query path (the number of times to jump from "Fault A" to "Associated Alarm B").

[0168] In this embodiment of the application, the first operation data is corrected based on the operation data and historical operation data, including:

[0169] User-defined "false positives" (such as correcting a system-identified "intensive" event to an "independent event") and custom anomaly thresholds (such as adjusting the time interval threshold for "intensive" event determination).

[0170] Furthermore, the data acquisition operation and the correction operation are quantized into feature vectors, such as [scaling frequency, click duration, number of corrections, custom threshold].

[0171] The data display method of this application embodiment transforms the collected user's first operation data into precise and automated adjustments to the core algorithm parameters of the system; its core is to construct a rule-based mapping function set and a weighted feedback loop mechanism, thereby achieving intelligent self-optimization.

[0172] The specific mechanism is implemented as follows:

[0173] Establish a parameter mapping rule base: The system has a pre-defined, expandable rule base. Each rule defines a quantitative or qualitative relationship between "behavioral characteristics" and "parameter adjustments." The rules adopt the IF-THEN form, but the execution result is no longer a simple Boolean judgment, but rather generates a specific parameter adjustment amount ΔP.

[0174] Specifically, rule one: adaptive time granularity adjustment

[0175] Triggering condition: IF Scaling frequency of a certain time period > N1 (times / hour) AND Abnormal density of that time period > Dthreshold.

[0176] Explanation of the rules:

[0177] N1 is a system-preset constant. For example, the system can default to N1=5, meaning that if a user zooms in and out more than 5 times per hour during a certain time period, the user's exploration behavior in that area is considered very frequent.

[0178] Dthreshold is a dynamically changing density threshold used to intelligently distinguish between normal and abnormally dense areas. This threshold is not a fixed value but is dynamically calculated based on global or recent historical data. The formula is as follows: Dthreshold = μ + n * σ, where μ is the average abnormal density across all time periods over the past 24 hours, σ is its standard deviation, and n is a configurable sensitivity coefficient (typically 1.5 or 2). This calculation ensures that the threshold adapts to the distribution characteristics of the data itself, and only statistically significant high-density areas will trigger optimization.

[0179] Dthreshold determines whether the data is abnormally dense. N1 determines whether user behavior is abnormally frequent. The two are combined through AND logic to ensure that the rule is only triggered when "the user is actually exploring a truly noteworthy high-density area", greatly improving the accuracy of decision-making.

[0180] Action executed: THEN calculates the time granularity adjustment amount ΔG = -ƒ(N). Where ƒ(N) is a decreasing function (e.g., ΔG = -Base * e^(-k*N)), meaning that the higher the scaling frequency, the finer the time granularity adjustment (e.g., jumping from "hour level" to "minute level"), but the adjustment range tends to be smoother as the frequency increases, preventing over-adjustment.

[0181] Rule 2: Dynamically optimize clustering algorithm parameters

[0182] Triggering condition: IF The user's manual correction rate for the "intensive" anomaly clusters automatically determined by the system is greater than Rthreshold (e.g., 30%).

[0183] Action executed: THEN dynamically adjusts the neighborhood radius parameter Eps of the density clustering algorithm (such as DBSCAN). The adjustment strategy is: Eps_new = Eps_old * (1 - β * R);

[0184] Where β is the learning rate and R is the correction ratio. This means that the more corrections the user makes, the faster the parameters converge, thus reducing subsequent misclassifications.

[0185] Rule 3: Resource Priority Reallocation

[0186] Triggering condition: IF the average user click duration of a certain type of abnormal event > Tthreshold (e.g., 3 seconds).

[0187] Actions executed: THEN not only increases its rendering priority but also allocates higher data query priority and computing resource quotas to it. When system resources are limited, real-time calculation and loading of such abnormally related data are prioritized to ensure a smooth user experience for the focus areas.

[0188] In order to avoid frequent parameter oscillations caused by a single accidental action, the data display method of this application assigns a confidence score (CS) to the calculation result of each triggered rule.

[0189] Confidence score calculation: CS = ƒ(persistence of behavioral data, frequency of behavior occurrence, consistency of behavior among multiple users). For example, if multiple users correct the same type of anomaly, then the confidence score of that correction behavior is extremely high.

[0190] Delayed implementation: The calculated parameter adjustment ΔP does not take effect immediately but is placed in a buffer pool. Only when the cumulative confidence level ΣCS of the adjustment exceeds a preset threshold is the adjustment officially submitted to the system core module for implementation. This ensures the stability and reliability of parameter changes.

[0191] In this embodiment of the application, the rendering efficiency is as follows: the rendering time of abnormal areas is monitored, and when the time exceeds a threshold (e.g., 500ms), the lightweight rendering mode is automatically started (e.g., the abnormal marking style of non-interested areas is simplified).

[0192] Recognition accuracy: Compare the user-corrected anomaly labels with the system's initial recognition results. When the accuracy is less than 70%, trigger parameter retraining (such as recalculating the time interval threshold for "dense" anomalies).

[0193] The data display method of this application embodiment safely and reliably applies the high confidence parameter update instruction (ΔP) generated by the above-mentioned optimization model to the production environment, completing the closed loop from "decision-making" to "execution", thereby causing a substantial change in the system behavior.

[0194] The specific implementation is as follows:

[0195] 1. Instruction distribution and synchronization mechanism:

[0196] The parameter tuning command ΔP generated by the optimization engine is broadcast via an internal message queue (such as Kafka or RabbitMQ) along with its unique transaction ID and confidence score (CS).

[0197] The core module listens for the algorithm services in steps two (continuous abnormal event identification) and three (time-location dynamic mapping), which subscribe to this message queue as consumers. Upon receiving a new parameter instruction, it immediately merges it with the parameters currently in memory.

[0198] Atomicity update: The parameter update operation is atomic, ensuring that during the update process, ongoing anomaly identification or mapping calculation will not read inconsistent parameter states, thus guaranteeing system stability.

[0199] 2. Differentiated application strategy:

[0200] The system will adopt different application strategies based on the confidence level (CS) and parameter type to balance the radicalness of the change with system stability.

[0201] High confidence command (CS>0.8): Takes effect immediately. For example, the new neighborhood radius Eps_new calculated after multiple user corrections can directly replace the old value.

[0202] Low to medium confidence commands (CS <= 0.8): Use incremental updates or A / B testing. For example, the new scaling sensitivity (knew) will not be applied to all users immediately, but will be distributed to 10% of user requests first to observe the effect before deciding whether to push it to all users.

[0203] Render priority directive: Takes effect immediately and will redraw strongly related UI components.

[0204] 3. Effect monitoring and feedback re-injection:

[0205] Parameter changes are not the end goal. The system will build a lightweight performance tracker to monitor key metrics and evaluate the effectiveness of the optimization.

[0206] Positive performance metrics: Has the frequency of user zooming in this area decreased? Has the rate of manual correction of similar anomalies decreased?

[0207] Negative performance indicators: Whether the system load increases abnormally; whether the recognition accuracy decreases;

[0208] These performance data will be used as new feedback signals and re-injected into the second-step optimization model to adjust the weights and learning rate used in subsequent calculations, forming an enhanced learning loop that enables the system's self-optimization capabilities to continuously improve.

[0209] For example:

[0210] Assume the optimization model outputs the instruction: ΔP2 = -0.5 (reducing the DBSCAN Eps parameter from 3.0 minutes to 2.5 minutes), with a confidence level of CS = 0.9.

[0211] Application: This instruction is synchronized in real time to the "Continuous Abnormal Event Recognition" algorithm service.

[0212] Effective: Upon receiving the data, the algorithm service will immediately update the Eps parameter to 2.5.

[0213] Result: Subsequently, the system will be more stringent in identifying "dense" anomalies. Anomalies that were previously aggregated at intervals of 2.5-3 minutes will now be split into two independent event clusters.

[0214] Monitoring: The effect tracker found that the rate of subsequent manual corrections of "intensive" anomalies by users decreased by 40%.

[0215] Feedback: This positive signal of "decreased correction ratio" is recorded and used to improve the confidence calculation of similar optimization instructions in the future, thereby strengthening the optimization path.

[0216] Through the above mechanisms, this step ensures that optimization decisions are not only implemented, but also that their effects are measurable and feedback-able, ultimately driving the system to continuously evolve adaptively and accurately respond to user needs and business changes.

[0217] Taking a business system monitoring scenario as an example:

[0218] In a business system's operational status monitoring system, an intelligent visualization solution for anomaly events in time-series data has demonstrated significant application value.

[0219] After receiving time-series data on key parameters such as system success rate and request latency from the business system, the system does not simply display the data directly. Instead, it first performs multi-dimensional preprocessing and feature enhancement. In addition to extracting basic information such as time values ​​and vibration amplitude, it also calculates derived features of abnormal events, such as the time interval between two adjacent abnormalities and the fluctuation deviation of vibration amplitude. Based on these features, it labels abnormal events with patterns such as "continuous," "dense," and "sudden." For example, when the system detects vibration exceeding the standard for three consecutive minutes at 10:15, 10:16, and 10:17, it will automatically mark it as a "continuous" abnormality; while temperature abnormalities at 10:30, 10:33, and 10:35, which are not consecutive in time but are all within 3 minutes apart, will be marked as "dense" abnormalities.

[0220] In the anomaly event identification phase, the system employs a hybrid algorithm combining sliding window and density clustering. By setting a 5-minute sliding window, further density clustering analysis is triggered when the number of anomalies within the window reaches a threshold. Using the DBSCAN algorithm, with a neighborhood radius set to 3 minutes, it accurately aggregates anomalies with discontinuous time indices but strong actual correlations, forming complete anomaly event clusters. This approach overcomes the limitations of traditional methods that rely solely on index continuity to determine anomalies, making hidden anomaly patterns impossible to conceal.

[0221] In terms of visualization, the system implements adaptive granularity mapping between time and location. The display precision of the timeline is dynamically adjusted based on the density of abnormal events: during peak abnormality periods such as 10:00-11:00, the timeline automatically refines to the minute level, ensuring each abnormal point is clearly displayed; while during sparse abnormality periods, the time granularity is appropriately coarsened to avoid visual redundancy. Simultaneously, different patterns of abnormalities are presented with differentiated styles: continuous abnormalities are marked with solid red background blocks, dense abnormalities with gradient red background blocks, and sudden abnormalities are highlighted with flashing red dots, allowing monitoring personnel to quickly identify the type of abnormality.

[0222] In terms of user experience, the system features intelligent recommendation functionality. When a monitoring user clicks on an anomaly, the system automatically recommends other potentially related anomaly events based on a pre-defined anomaly association rule library. For example, clicking on the vibration anomaly at 10:15 will prompt the user to check the bearing temperature anomaly between 9:50 and 10:00, helping to quickly pinpoint the root cause of the fault.

[0223] More importantly, the system can self-optimize by learning from user interactions. It records monitoring personnel's attention duration to anomalies, corrective actions, and other behavioral data, continuously adjusting anomaly identification thresholds and display strategies. If monitoring personnel frequently zoom in on the 10:00-12:00 time range, the system will default to designating this period as a key monitoring area and increasing its visualization priority. If the judgment results of "dense" anomalies are manually corrected multiple times, the system will automatically fine-tune the parameters of the density clustering algorithm to improve the accuracy of subsequent identifications.

[0224] This solution provides an efficient and intuitive tool for monitoring the status of industrial equipment through in-depth analysis, intelligent identification, precise display, and dynamic optimization of abnormal events, greatly improving the efficiency of abnormal event handling and the accuracy of fault diagnosis.

[0225] The data display method in this application embodiment is as follows: Figure 2 The data display system shown is implemented as follows:

[0226] Data input layer: Receives time-series data (such as alarm data, device logs, and sensor data).

[0227] Data processing layer: Completes data cleaning, anomaly classification, and event attribute feature extraction;

[0228] The core algorithm layer includes core algorithms such as continuous abnormal event identification (construction of event clusters) and dynamic mapping of event clusters on the time axis;

[0229] Visualization rendering layer: generates timelines, exception markers, and interactive components;

[0230] Interaction layer: Handles user actions (slider dragging, hovering, etc.) and provides feedback on the results;

[0231] Self-optimization layer: Optimizes model parameters based on user behavior and feedback.

[0232] The various methods of the embodiments of this application have been described above. Apparatus for implementing the above methods will now be provided.

[0233] like Figure 3 As shown in the illustration, this application also provides a data display device, including:

[0234] The first determining module 301 is used to determine, based on time series data, at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; the event clusters include one anomalous event or at least two adjacent anomalous events.

[0235] The calculation module 302 is used to calculate the importance score for each of the event clusters; the importance score is related to the abnormal state of the event clusters.

[0236] The second determining module 303 is used to determine the target visualization percentage of each event cluster on the time axis based on the importance score of the event cluster; the time axis is a coordinate axis of a chart that displays the events and the attribute characteristics of the events.

[0237] The data display device provided in this application embodiment uses time series data to determine at least two events ordered by time, attribute characteristics of each time period, and at least two event clusters. By calculating the importance score of each event cluster, it determines the target visualization percentage of each event cluster on the time axis of a chart, thereby displaying the event cluster at different visualization percentages on the time axis according to its different importance scores. The data display method in this application embodiment, by calculating the importance score related to the abnormal state of the event cluster, can display event clusters with different abnormal states with different display effects. Therefore, event clusters with higher importance scores have a larger visualization percentage on the time axis. This solves the problem in the prior art where the visualization display effect of time series data is difficult to meet users' needs for quickly grasping the time distribution range of abnormal events.

[0238] Another embodiment of this application provides a terminal device, such as... Figure 4 As shown, it includes a transceiver 410, a processor 400, a memory 420, and a program or instructions stored in the memory 420 and executable on the processor 400; when the processor 400 executes the program or instructions, it implements the various processes of the above-described terminal-side method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0239] The transceiver 410 is used to receive and send data under the control of the processor 400.

[0240] Among them, Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 400 and memory represented by memory 420 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. Transceiver 410 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, user interface 430 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0241] The processor 400 is responsible for managing the bus architecture and general processing, while the memory 420 can store the data used by the processor 400 when performing operations.

[0242] This application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described data display method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0243] This application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described data display method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0244] It should be noted that the collection, gathering, updating, analysis, processing, use, transmission, and storage of user personal information involved in this disclosed technical solution all comply with relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken to prevent unauthorized access to user personal information data and to safeguard user personal information security and network security.

[0245] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0246] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0247] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data display method, characterized in that, include: Based on time series data, determine at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; The event cluster includes one anomalous event or at least two adjacent anomalous events; Calculate the importance score for each of the event clusters; The importance score is related to the abnormal state of the event cluster; Based on the importance score of the event cluster, the target visualization percentage of each event cluster on the time axis is determined; the time axis is a coordinate axis of a chart that displays the events and their attribute characteristics.

2. The method according to claim 1, characterized in that, Based on the acquired time-series data, determine at least two events ordered by time and the attribute characteristics of each event, including: Based on the mapping relationship between time data and time sequence in the time series data, at least two events are determined in chronological order; Extract the attribute features of each event from the time series data; The attribute features include at least one of the following: occurrence time, end time, duration, occurrence frequency, and anomaly level for each event.

3. The method according to claim 1, characterized in that, Based on the time series data, at least two event clusters are identified, including at least one of the following: An event cluster is defined as an event whose duration in the time series data is greater than a preset duration. Determine at least two abnormal events in the time series data that occur at a time interval less than a preset interval as an event cluster.

4. The method according to claim 1, characterized in that, Calculate the importance score for each of the event clusters, including: Based on the time series data, determine the importance index value for each event cluster; The importance scores of each event cluster are obtained by weighting the values ​​of the importance indicators. The importance indicators include at least one of the following: the number of abnormal events per unit time, and the abnormality level and impact range of the included abnormal events.

5. The method according to claim 1, characterized in that, Based on the importance scores of the event clusters, determine the target visualization percentage of each event cluster on the timeline, including: The scaling factor is determined based on the importance score; Based on the scaling factor, a mapping ratio is determined to characterize the mapping relationship of each event cluster on the time axis.

6. The method according to claim 5, characterized in that, Based on the importance score, a scaling factor is determined, including: The scaling factor is determined using the importance score as the independent variable through a linear regression model.

7. The method according to claim 5, characterized in that, Determining the mapping ratio of each event cluster on the time axis based on the scaling factor includes: Based on the duration of the event cluster, determine the initial percentage of the event cluster's visualization on the timeline; The initial visualization percentage is adjusted based on the scaling factor to determine the target visualization percentage for the event cluster.

8. The method according to claim 1, characterized in that, The method further includes: Based on the importance score of the event cluster, determine the display strategy of the event cluster on the chart; The display strategy includes at least one of the following: display elements and display methods.

9. A data display device, characterized in that, include: The first determining module is used to determine, based on time series data, at least two events ordered by time, attribute characteristics of each event, and at least two event clusters; the event clusters include one anomalous event or at least two adjacent anomalous events. The calculation module is used to calculate the importance score for each of the event clusters; The importance score is related to the abnormal state of the event cluster; The second determining module is used to determine the target visualization percentage of each event cluster on the time axis based on the importance score of the event cluster; the time axis is a coordinate axis of a chart that displays the events and the attribute characteristics of the events.

10. A terminal device, characterized in that, include: Transceiver, processor, memory, and programs or instructions stored in the memory and executable on the processor; When the processor executes the program or instructions, it implements the steps of the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 8.

Images