Traffic anomaly detection method and device, computer device, storage medium and product

Abstract

This application relates to a traffic anomaly detection method, apparatus, computer device, storage medium, and product, belonging to the field of anomaly detection technology. The method includes: generating a first time series based on traffic data within a first time period; smoothing and reconstructing the first time series using a particle swarm optimization algorithm improved with a perturbation factor and a dynamic Bézier curve to obtain a second time series; performing time series prediction based on the second time series to obtain a third time series, which indicates predicted traffic data within the second time period following the first time period; and performing anomaly detection on the actual time series within the second time period based on the third time series to obtain anomaly detection results for the traffic data within the second time period. This method can reduce the interference of occasional fluctuations on anomaly detection in complex and highly randomized scenarios, thereby improving the accuracy and robustness of anomaly detection in complex environments.

Description

Technical Field

[0001] This application relates to the field of anomaly detection technology, and in particular to a method, apparatus, computer equipment, storage medium, and product for detecting abnormal traffic flow. Background Technology

[0002] Due to personnel turnover, the performance indicators of indoor distribution equipment often fluctuate significantly, which poses a considerable obstacle to anomaly detection.

[0003] In related technologies, anomaly detection is usually performed using anomaly detection algorithms. However, most existing anomaly detection algorithms rely on manually set anomaly trends and thresholds, or on manually labeled anomalies to train machine learning models to identify sequence features that match the labels. The methods mentioned above rely too heavily on manually set rules and labels, which makes them less adaptable to complex and highly sporadic indoor distribution scenarios, resulting in low accuracy in anomaly detection. Summary of the Invention

[0004] This application provides a method, apparatus, computer device, storage medium, and product for detecting traffic anomalies. In complex and highly unpredictable scenarios, it reduces the interference of occasional fluctuations on anomaly detection, thereby improving the accuracy and robustness of anomaly detection in complex environments. The technical solution is as follows.

[0005] On the one hand, a method for detecting abnormal traffic flow is provided, the method comprising:

[0006] A first time series is generated based on the traffic data within the first time period;

[0007] The first time series is smoothly reconstructed using a particle swarm optimization algorithm with an improved perturbation factor and a dynamic Bézier curve to obtain the second time series.

[0008] Based on the second time series, a time series prediction is performed to obtain a third time series, which is used to indicate the predicted traffic data in the second time period after the first time period.

[0009] Anomaly detection is performed on the real time series within the second time period based on the third time series to obtain the anomaly detection results of the traffic data within the second time period.

[0010] On the other hand, a traffic anomaly detection device is provided, the device comprising:

[0011] The sequence generation module is used to generate a first time series based on the traffic data within the first time period.

[0012] The sequence reconstruction module is used to smoothly reconstruct the first time series based on the particle swarm algorithm improved by the perturbation factor and the dynamic Bézier curve to obtain the second time series.

[0013] The sequence prediction module is used to perform time series prediction based on the second time series to obtain a third time series, wherein the third time series is used to indicate the predicted traffic data in the second time period after the first time period.

[0014] An anomaly detection module is used to perform anomaly detection on the real time series within the second time period based on the third time series, and obtain the anomaly detection result of the traffic data within the second time period.

[0015] In one possible implementation, the sequence reconstruction module includes:

[0016] The sequence segmentation submodule is used to divide the first time series into multiple subsequences based on the convex points in the first time series.

[0017] The curve insertion submodule is used to insert Bézier curves between adjacent subsequences to obtain multiple smooth subsequences. The control points of each Bézier curve are dynamically determined by a particle swarm algorithm based on the direction of the line connecting the two convex points of the adjacent subsequences and the perturbation factor.

[0018] The recombination submodule is used to recombine the multiple smooth subsequences to obtain the second time series.

[0019] In one possible implementation, the sequence prediction module is used to input the second time series into the sequence prediction model to obtain the third time series output by the sequence prediction model; the sequence prediction model includes a Long Short-Term Memory (LSTM) layer and an attention mechanism layer, the input of the attention mechanism layer is the hidden state sequence of all time steps extracted and output by the LSTM layer, and the output is a feature vector obtained by weighted summation based on the hidden state sequence.

[0020] In one possible implementation, the anomaly detection module includes:

[0021] The wavelet transform submodule is used to perform wavelet transform on the third time series and the real time series respectively to obtain the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series.

[0022] The threshold calculation submodule is used to dynamically calculate the anomaly judgment threshold based on the deviation between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series.

[0023] The comparison submodule is used to compare the wavelet coefficient sequence of the real time series with the corresponding anomaly detection threshold at each time point to obtain the anomaly detection result of the real time series.

[0024] In one possible implementation, the threshold calculation submodule is used for:

[0025] Calculate the absolute difference of wavelet coefficients between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series at each time point;

[0026] The anomaly detection threshold is dynamically determined based on the absolute difference of wavelet coefficients at each time point and the wavelet threshold calculation formula.

[0027] In one possible implementation, the comparison submodule is used for,

[0028] In the real time series, traffic data with wavelet coefficients less than the corresponding abnormal deviation threshold are identified as abnormal traffic data.

[0029] Traffic data in the real time series whose wavelet coefficients are greater than or equal to the corresponding abnormal deviation threshold are defined as normal traffic data.

[0030] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the above-described traffic anomaly detection method.

[0031] On the other hand, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer program, which is loaded and executed by a processor to implement the above-described traffic anomaly detection method.

[0032] On the other hand, a computer program product is provided, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to execute to implement the traffic anomaly detection method provided in the various optional implementations described above.

[0033] The technical solution provided in this application may include the following beneficial effects:

[0034] The traffic anomaly detection method provided in this application generates a first time series based on traffic data within a first time period. It then uses a particle swarm optimization (PSO) algorithm with an improved perturbation factor combined with a dynamic Bézier curve to smoothly reconstruct the first time series, obtaining a second time series. Subsequently, it predicts traffic data for a future second time period based on the second time series, obtaining a third time series. Finally, it uses the third time series as a reference to perform anomaly detection on the actual time series within the second time period, obtaining the anomaly detection result for the traffic data within the second time period. In this method, the improved PSO algorithm and dynamic Bézier curve for smooth reconstruction can reduce the interference of occasional fluctuations on anomaly detection in complex and highly sporadic scenarios, thereby improving the accuracy and robustness of anomaly detection in complex environments.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0037] Figure 1 A flowchart of a traffic anomaly detection method provided in an exemplary embodiment of this application is shown;

[0038] Figure 2 A flowchart of a traffic anomaly detection method provided in another exemplary embodiment of this application is shown;

[0039] Figure 3 A schematic diagram of a traffic anomaly detection method provided in an exemplary embodiment of this application is shown;

[0040] Figure 4 A block diagram of a traffic anomaly detection device provided in an exemplary embodiment of this application is shown;

[0041] Figure 5 A structural block diagram of a computer device illustrated in an exemplary embodiment of this application is shown;

[0042] Figure 6 A structural block diagram of a computer device illustrated in an exemplary embodiment of this application is shown. Detailed Implementation

[0043] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0044] To improve traffic anomaly detection in complex and highly unpredictable scenarios, this application provides a traffic anomaly detection method. Figure 1 This application illustrates a flowchart of a traffic anomaly detection method provided in an exemplary embodiment. This method can be executed by a computer device, which can be implemented as a server or a terminal, such as... Figure 1 As shown, the method may include the following steps.

[0045] Step 110: Generate a first time series based on the traffic data within the first time period.

[0046] The traffic data can be obtained by computer equipment processing the raw traffic data collected by the RRU (Remote Radio Unit) device. The data collection frequency can be set according to actual needs, and this application does not limit this. The raw traffic data includes uplink traffic, downlink traffic, and the average number of RRC (Radio Resource Control) connections. Schematic, the data processing method can be represented as follows:

[0047]

[0048] The duration of the first time period can be set based on actual needs. This first time series contains traffic data at each time point within the first time period. This first time series can be implemented as a time-traffic data polyline, or it can be implemented as a key-value pair format stored in chronological order.

[0049] Step 120: The first time series is smoothly reconstructed based on the particle swarm algorithm improved by the perturbation factor and the dynamic Bézier curve to obtain the second time series.

[0050] In complex and highly unpredictable scenarios, such as indoor distributed antenna systems, traffic flow data curves often have many spikes and sharp angles, which can easily lead to misjudgments in anomaly detection. Therefore, in this embodiment, the first time series is smoothed and reconstructed to obtain a smooth curve that is easy to learn trends, thereby improving the usability of the data.

[0051] Among them, the perturbation factor improved particle swarm optimization (PSO) algorithm is used to minimize the error between the smoothed sequence and the original sequence while maintaining the smoothness of the curve. In the embodiments of this application, the perturbation factor improved PSO algorithm optimization is used to optimize the selection of key points in the smooth reconstruction process of the first time series; the dynamic Bézier curve is used to smooth the reconstruction of the first time series based on the optimized key points, so that the smoothed reconstruction of the second time series can remove high-frequency noise while retaining the trend of the first time series, thereby improving the accuracy of subsequent sequence prediction.

[0052] Step 130: Perform time series forecasting based on the second time series to obtain a third time series, which is used to indicate the predicted traffic data in the second time period after the first time period.

[0053] After obtaining the second time series, the computer equipment can predict traffic data for a future period based on the second time series, that is, predict traffic data within the second time period; wherein the duration of the second time period is shorter than the duration of the first time period, in order to ensure the validity of the data and the accuracy of the prediction.

[0054] In this embodiment of the application, the computer device can perform sequence prediction by analyzing the data of the second time series. Schematic, the computer device can analyze the sequence characteristics of the second time series through a sequence prediction model and predict the predicted traffic data within the second time period based on the sequence characteristics.

[0055] Step 140: Based on the third time series, perform anomaly detection on the real time series within the second time period to obtain the anomaly detection results of the traffic data within the second time period.

[0056] The computer device uses a third time series as a reference series to detect anomalies in the real time series within a second time period. In one possible implementation, the computer device can compare the third time series with the real time series point-by-point, identifying traffic data with numerical deviations exceeding a threshold as abnormal traffic data. This deviation threshold can be a dynamic threshold determined based on the mean and standard deviation of the residual series calculated using a sliding window. In another possible implementation, the computer device can determine a residual threshold by performing residual analysis on the real and third time series, identifying traffic data in the real time series where the residual at a single time point exceeds the residual threshold as abnormal traffic data. Yet another possible implementation is that the computer device can use dynamic wavelet transform with the third time series as a reference series to detect anomalies in the real time series. The anomaly detection result can include the time information of the anomaly points, and further, it can include the degree of anomaly at each point, which can be determined by the computer device based on the difference between the anomaly point and a threshold set by the corresponding judgment method.

[0057] In summary, the traffic anomaly detection method provided in this application generates a first time series based on traffic data within a first time period. It then uses a particle swarm optimization (PSO) algorithm with an improved perturbation factor combined with a dynamic Bézier curve to smoothly reconstruct the first time series, obtaining a second time series. Subsequently, it predicts traffic data for a future second time period based on the second time series, obtaining a third time series. Finally, it uses the third time series as a reference to perform anomaly detection on the actual time series within the second time period, obtaining the anomaly detection result for the traffic data within the second time period. In this method, the improved PSO algorithm and the smooth reconstruction using a dynamic Bézier curve can reduce the interference of occasional fluctuations on anomaly detection in complex and highly random scenarios, thereby improving the accuracy and robustness of anomaly detection in complex environments.

[0058] Taking the example of computer equipment using dynamic wavelet transform to detect anomalies in a real time series with a third time series as a reference sequence. Figure 2 A flowchart of a traffic anomaly detection method provided in another exemplary embodiment of this application is shown. This method can be executed by a computer device, which can be implemented as a server or a terminal, such as... Figure 2 As shown, the method may include the following steps.

[0059] Step 210: Generate a first time series based on the traffic data within the first time period.

[0060] The traffic data can be collected from complex and highly sporadic scenarios. In such scenarios, the first time series generated based on the traffic data fluctuates beyond the fluctuation threshold over time, i.e., the fluctuation is large.

[0061] Step 220: The first time series is smoothly reconstructed based on the particle swarm algorithm improved by the perturbation factor and the dynamic Bézier curve to obtain the second time series.

[0062] To adapt to the complexity of data in complex and highly unpredictable scenarios, this application embodiment uses a particle swarm optimization algorithm with improved perturbation factors and dynamic Bézier curves to smooth and reconstruct the first time series. While ensuring that the trend is not destroyed, the first time series is reconstructed into a smooth curve that is easier to learn the trend, thereby improving the usability of the original data.

[0063] Convex-preserving interpolation in a plane refers to constructing a planar curve that passes through a monotonic convex point sequence in the plane and maintains the same convexity as this sequence. This application employs a convex-preserving interpolation method based on dynamic Bézier curves for smooth reconstruction. Specifically, a Bézier curve is inserted between every two adjacent convex points in the first time series. The control points of each inserted Bézier curve segment are determined using the direction of motion of the broken line connecting the convex point sequences. This allows for multi-point smooth reconstruction of the first time series, which fluctuates significantly over time, to avoid sharp overshoots at individual nodes. To further improve the smooth reconstruction effect, this application also incorporates a particle swarm optimization algorithm with improved perturbation factors to enhance the accuracy of control point determination when determining the control points for Bézier defects. This enhances the algorithm's ability to escape local extrema, thereby improving the smooth reconstruction effect on the first time series. This process can be implemented as follows:

[0064] The first time series is divided into multiple subsequences based on the convex points in the first time series.

[0065] By inserting Bézier curves between adjacent subsequences, multiple smooth subsequences are obtained; the control points of each Bézier curve are dynamically determined by a particle swarm algorithm based on the direction of the line connecting the two convex points of the adjacent subsequences and the perturbation factor.

[0066] The second time series is obtained by recombining multiple smooth subsequences.

[0067] Among them, the convex point is a local extreme point in the time series, that is, a local maximum or minimum value, which can reflect the turning point of the trend; computer equipment can determine the convex point as the beginning or end of a subsequence, thereby dividing the first time series into multiple subsequences.

[0068] Taking a cubic Bézier curve as an example, the expression for a cubic Bézier curve can be expressed as:

[0069]

[0070] Where P1 and P3 are the starting and ending points of the Bézier curve, P0 and P2 are the two control points in the middle of the Bézier curve, t∈[0,1] is the tension coefficient, and Pi(t) represents the i-th curve, i.e. the i-th subsequence.

[0071] The expressions for the first and second derivatives of a cubic Bézier curve are as follows:

[0072]

[0073] The shortest cost function is:

[0074]

[0075] Where Ri is the i-th subsequence, when there are a total of n subsequences, and n approaches infinity, the overall curve can be rewritten as:

[0076]

[0077] The cost function is:

[0078] f len_B =minJ

[0079] After processing the first time series into multiple smoothed subsequences, they are then connected end-to-end to form a complete smooth curve, ensuring the continuity of the curve at the connection points. However, since high-order Bézier curves are computationally intensive and have complex derivations, the smoothing of low-order Bézier curves may miss some nodes with trend patterns. During the splicing of multiple curve segments, the optimization problem increases with the number of sub-curves, leading to higher optimization difficulty in the smoothing process of Bézier curves. Therefore, in this embodiment, a particle swarm optimization algorithm with improved perturbation factor is added to optimize the control points of the Bézier curve to ensure the smoothness of the sub-curves at the connection points, thereby enhancing the optimization algorithm's ability to escape local extrema. By perturbing the current particles (i.e., the control points initially determined based on the Bézier curve) in a small range, premature convergence of individual particles is avoided, which is beneficial for particles to search in a large area and increases their ability to escape local extrema. For each particle, the particle velocity update method can be expressed as:

[0080]

[0081] in, This represents the velocity of particle i in the (k+1)th iteration along the d-th dimension. Let represent the velocity of particle i in the k-th iteration along the d-th dimension, i.e., the current velocity; c1 and c2 are acceleration constants; and r1 and r2 are random numbers in the interval [0,1]. This represents the historical best position of particle i in the d-th dimension. This represents the current position of particle i in the d-th dimension. newp represents the globally optimal position of the population in dimension d. g The term represents the random perturbation, i.e., the new global optimum position after the perturbation, and β is the weight of the perturbation coefficient. Let γ be the velocity of the globally optimal particle in the current iteration, γ be the random perturbation intensity coefficient, r3 be a random number in the interval [0,1], and η be the offset constant. After the optimization is completed, the optimal position of control point i can be obtained.

[0082] In the optimization process, the first step is to initialize the parameters of the improved particle swarm optimization algorithm and obtain the velocity and position of each particle, initialize the curve points, and select (t) n Traffic n Using (t0, Traffic0) as input to the smoothing algorithm, (t1, Traffic1) is taken as the starting point of the first sub-curve, (t0, Traffic0) as the ending point of the first sub-curve, and (t1, Traffic1) as the starting point of the second sub-curve, and so on. The decision variable P for the particle swarm optimization algorithm is selected, and the particle cost is calculated. Illustratively, the decision variable P can be the set of coordinates of all Bézier curve control points, with each particle's position representing a set of control point configurations. When calculating the particle cost, curve smoothness (such as continuity error of the derivative of the connection points) and data fit (such as mean square error) must be considered comprehensively. In each iteration, the current cost of each particle is compared with the previously obtained best cost P. best For comparison, if the particle's current cost is better than its historical best cost P best Then update P best Given the current value, the globally optimal cost G best The best P among all particles best By dynamically updating the position and velocity of particles, and further dynamically updating random perturbations, until the maximum number of iterations is reached, the global optimal value of each particle is finally output, which is then used as the coordinates of the corresponding control points to generate the optimal smooth curve.

[0083] Step 230: Perform time series prediction based on the second time series to obtain a third time series, which is used to indicate the predicted traffic data in the second time period after the first time period.

[0084] In this embodiment, a computer device performs time series prediction based on a second time series using a sequence prediction model. This sequence prediction model can be trained on a training sample set, which includes time series samples and corresponding predicted sequence labels. The training samples in this set can be constructed based on known historical time series. The process of predicting a third time series using the sequence prediction model can be implemented as follows:

[0085] The second time series is input into the sequence prediction model to obtain the third time series output by the sequence prediction model. The sequence prediction model includes a Long Short-Term Memory (LSTM) layer and an attention mechanism layer. The input of the attention mechanism layer is the hidden state sequence of all time steps extracted and output by the LSTM layer, and the output is the feature vector obtained by weighted summation based on the hidden state sequence.

[0086] In other words, this sequence prediction model can be an attention-based LSTM-integrated prediction model that can extract multi-scale features of time series. First, a one-dimensional convolutional layer processes the input data to extract periodic changes and trend features. Then, an LSTM layer is used to capture long-term dependencies, and an attention mechanism is introduced to adaptively weight the output of the LSTM layer. Through the combination of the Dropout mechanism and the attention layer, the model can dynamically allocate weights, focusing on the most informative parts of the learning sequence. This ensures that the model can automatically identify and strengthen key features in complex time series data, thereby improving the accuracy and robustness of predictions. Finally, a multilayer perceptron (MLP) is used to further extract deep features from different time periods and to standardize the trends of business indicator data from each indoor distribution station. The MLP nonlinearly combines the high-order features output from the convolutional and LSTM layers to ultimately generate a standardized sequence representation, i.e., the third time series.

[0087] An LSTM layer can consist of a forget gate, an input gate, and an output gate. The forget gate determines the degree to which information from the previous time step is retained. Its workflow is as follows: at each time step, the forget gate receives two inputs: the hidden state h from the previous time step. t-1 and the input x at the current time t These two inputs are processed by a sigmoid activation function, and the output is a multiplication of weights between 0 and 1, thereby controlling the amount of information retained from the previous unit:

[0088] f t =σ|W f ·[H t-1 x t ]+b f |

[0089] Among them, f tThe output value of the forget gate is represented by σ, where σ is the Sigmoid activation function and W is the output value of the forget gate. f Here is the trainable weight matrix for the forget gate, [h t-1 x t ] indicates the hidden state h in the previous moment. t-1 and the current input x t The concatenated vector, b f This is the bias term for the forget gate.

[0090] The input gates coordinately control the inflow of new information through a dual-gate control mechanism. Their working principle can be divided into candidate information generation and information quantity regulation. Specifically, during candidate information generation, the input gates first use the tanh function to generate candidate cell states.

[0091]

[0092] Among them, W c Let b be the weight matrix. c As a bias term, this step will use the current input x t and the previous hidden state h t-1 Convert into new candidate memory content.

[0093] When controlling the amount of information, the input gate value i is calculated using the sigmoid function. t :

[0094] i t =σ|W t ·[H t-1 ,x t ]+b t |

[0095] The input gating value determines the candidate state. The retention ratio, and the final cell state update is as follows:

[0096]

[0097] The output gate controls the output of information at the current moment through a gating mechanism. Its workload is divided into output gating calculation and hidden state generation. During output gating calculation, the output gate first calculates the output weight O using the sigmoid function. t :

[0098] O t =σ|W O ·[H t-1 x t ]+b O |

[0099] Among them, W O b is the trainable weight matrix for the output gate. OAs a bias term, the output weights determine the current cell state C. t Which information will be output?

[0100] During hidden state generation, the final hidden state H is generated by combining the cell states after tanh transformation. t :

[0101] H t =O t ×tanh(C t )

[0102] The hidden state output by the output gate of the LSTM layer becomes the input of the attention layer. The calculation process of the attention mechanism can be represented as follows:

[0103] S i =tanh(WH i +b i )

[0104] a i =softmax(S i )

[0105]

[0106] Among them, H i Let W represent the hidden state output by the LSTM model at time step i, where W is the learnable weight matrix and b is the hidden state. i S represents the bias term. i Let a be the raw attention score at time step i. i C represents the attention weights after softmax normalization. i The context vector is a weighted sum of the hidden states over k time steps.

[0107] The output of the attention mechanism layer at each time step can be processed sequentially through a fully connected layer and a softmax function for normalization to obtain a set of weights. This set of weights is used to indicate the relative contribution of the hidden state at each time step to the final prediction result. The hidden state sequence is weighted and summed using this set of weights to obtain a feature vector. This allows the prediction module of the sequence prediction model (such as a fully connected network) to further perform time series prediction based on the above feature vector and output a third time series.

[0108] Step 240: Perform wavelet transform on the third time series and the real time series respectively to obtain the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series.

[0109] In this embodiment, the third time series predicted by the sequence prediction model is used as a reference sequence for the corresponding device without anomalies. It is compared with the real time series of the same date to determine whether the traffic data in the device is abnormal on that date. The real time series can be the time series obtained by smoothing and reconstructing the time series corresponding to the traffic data in the second time period. It should be noted that the smoothing and reconstruction process of the first time series and the time series corresponding to the second time period can be carried out synchronously or asynchronously. When carried out synchronously, the computer device can perform smoothing and reconstruction of the time series of the two time periods, and then divide the smoothed and reconstructed time series into the second time series of the first time period and the real time series of the second time period.

[0110] The wavelet coefficient sequences corresponding to each sequence can be obtained by decomposing the flow data in the corresponding sequence using discrete wavelet transform.

[0111] Step 250: Based on the deviation between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series, dynamically calculate the anomaly judgment threshold.

[0112] In this embodiment, by setting the reference sequence as the signal sequence and the real time sequence as the transformed sequence, the current wavelet threshold is calculated in reverse. The process of calculating the anomaly determination threshold at each time point can be implemented as follows:

[0113] Calculate the absolute difference of wavelet coefficients between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series at each time point;

[0114] Based on the absolute difference of wavelet coefficients at each time point and the wavelet threshold calculation formula, the anomaly detection threshold corresponding to each time point is determined.

[0115] To avoid the fixed deviation in wavelet coefficients after quantization caused by the threshold determined by the soft thresholding function, which reduces the accuracy of signal reconstruction and leads to distortion, and to avoid the hard thresholding function setting coefficients exceeding a preset threshold to zero, which may cause unnecessary oscillations in the reconstructed signal and discontinuities at the threshold, this application uses a non-negative dynamic wavelet thresholding function for threshold calculation. Specifically, the wavelet threshold calculation formula is a non-negative dynamic wavelet thresholding function; whereby the non-negative dynamic wavelet thresholding function can be expressed as:

[0116]

[0117] Among them, W i,k Represents the original wavelet coefficients. This represents the estimated wavelet coefficients after thresholding, and λ represents the global threshold parameter used to distinguish noise from valid signals.

[0118] Schematic illustration: If the wavelet coefficients at one time point in the third time series are The wavelet coefficients of the real time series at the corresponding time points are When calculating the absolute difference between wavelet coefficients at each time point, the absolute difference at that time point is... Then, the anomaly detection threshold λ is inversely calculated based on the non-negative dynamic wavelet threshold function.

[0119] In one possible implementation, the computer device can determine the corresponding anomaly judgment threshold window by window by setting a sliding window. For example, the anomaly judgment threshold corresponding to the sliding window can be inferred from the average or median of the absolute differences at each time point within the sliding window. This enables dynamic determination of the anomaly judgment threshold to adapt to the characteristic that the wavelet coefficients of the useful signal gradually increase, resulting in a gradual decrease in noise reduction granularity. The size of the sliding window can be set according to actual needs, and this application does not impose any restrictions on it.

[0120] Step 260: Compare the wavelet coefficient sequence of the real time series with the corresponding anomaly detection threshold at each time point to obtain the anomaly detection result of the real time series.

[0121] Among them, traffic data with wavelet coefficients less than the corresponding abnormal deviation threshold in the real time series are identified as abnormal traffic data;

[0122] Traffic data with wavelet coefficients greater than or equal to the corresponding abnormal deviation threshold in the real time series are defined as normal traffic data.

[0123] In summary, the traffic anomaly detection method provided in this application generates a first time series based on traffic data within a first time period. It then uses a particle swarm optimization (PSO) algorithm with an improved perturbation factor combined with a dynamic Bézier curve to smoothly reconstruct the first time series, obtaining a second time series. Subsequently, it predicts traffic data for a future second time period based on the second time series, obtaining a third time series. Finally, it uses the third time series as a reference to perform anomaly detection on the actual time series within the second time period, obtaining the anomaly detection result for the traffic data within the second time period. In this method, the improved PSO algorithm and the smooth reconstruction using a dynamic Bézier curve can reduce the interference of occasional fluctuations on anomaly detection in complex and highly random scenarios, thereby improving the accuracy and robustness of anomaly detection in complex environments.

[0124] Furthermore, when making anomaly detection, based on the multi-scale characteristics of wavelet transform, the anomaly detection threshold is dynamically adjusted by the amplitude of each scale coefficient, so that the anomaly detection threshold adapts to the local time-frequency characteristics of the signal, thereby further improving the accuracy of anomaly detection.

[0125] The embodiments of this application provide an example of detecting abnormal traffic data of indoor distributed antenna system (DAS) devices in an indoor distributed antenna system (DAS) scenario. The computer device acquires 24-hour granular traffic data per user from the original RRU device for 15 consecutive days (i.e., the first time period), uses the time series of the first 14 days as the basis for generating a reference sequence, and predicts the time series of the next day (i.e., the second time period) for 24 hours (i.e., the third time series). Figure 3 A schematic diagram of a traffic anomaly detection method provided in an exemplary embodiment of this application is shown, such as... Figure 3 As shown, in this process, the computer equipment first acquires traffic data per user at a granular level for 15 consecutive days (24 hours), and then smooths and reconstructs the data using a Bézier curve improved by a particle swarm optimization algorithm based on a perturbation factor, resulting in a smoothed time series. This time series is then divided into two sequences of 14+1: the first 14 days' time series is used as the second time series, and the next day's time series is used as the time series to be detected, i.e., the true time series of the second time period. Based on the second time series, a sequence prediction model is used to predict the reference time series for the next day, i.e., the third time series. Anomaly judgment values ​​are dynamically calculated based on the third time series and the true time series. Anomaly judgment is then performed on the true time series for the next day using the dynamic judgment values, resulting in the anomaly detection result for the true time series.

[0126] Figure 4 This invention illustrates a block diagram of a traffic anomaly detection device provided in an exemplary embodiment of this application, which can perform functions such as... Figure 1 or Figure 2 All or part of the steps in the illustrated embodiments, such as Figure 4 As shown, the device may include the following modules.

[0127] Sequence generation module 410 is used to generate a first time series based on traffic data within a first time period;

[0128] The sequence reconstruction module 420 is used to smoothly reconstruct the first time series based on the particle swarm algorithm improved by the perturbation factor and the dynamic Bézier curve to obtain the second time series.

[0129] The sequence prediction module 430 is used to perform time series prediction based on the second time series to obtain a third time series, wherein the third time series is used to indicate the predicted flow data in the second time period after the first time period.

[0130] The anomaly detection module 440 is used to perform anomaly detection on the real time series within the second time period based on the third time series, and obtain the anomaly detection result of the traffic data within the second time period.

[0131] In one possible implementation, the sequence reconstruction module 420 includes:

[0132] The sequence segmentation submodule is used to divide the first time series into multiple subsequences based on the convex points in the first time series.

[0133] The curve insertion submodule is used to insert Bézier curves between adjacent subsequences to obtain multiple smooth subsequences. The control points of each Bézier curve are dynamically determined by a particle swarm algorithm based on the direction of the line connecting the two convex points of the adjacent subsequences and the perturbation factor.

[0134] The recombination submodule is used to recombine the multiple smooth subsequences to obtain the second time series.

[0135] In one possible implementation, the sequence prediction module 430 is used to input the second time series into the sequence prediction model to obtain the third time series output by the sequence prediction model; the sequence prediction model includes a Long Short-Term Memory (LSTM) layer and an attention mechanism layer, the input of the attention mechanism layer is the hidden state sequence of all time steps extracted and output by the LSTM layer, and the output is a feature vector obtained by weighted summation based on the hidden state sequence.

[0136] In one possible implementation, the anomaly detection module 440 includes:

[0137] The wavelet transform submodule is used to perform wavelet transform on the third time series and the real time series respectively to obtain the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series.

[0138] The threshold calculation submodule is used to dynamically calculate the anomaly judgment threshold based on the deviation between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series.

[0139] The comparison submodule is used to compare the wavelet coefficient sequence of the real time series with the corresponding anomaly detection threshold at each time point to obtain the anomaly detection result of the real time series.

[0140] In one possible implementation, the threshold calculation submodule is used for:

[0141] Calculate the absolute difference of wavelet coefficients between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series at each time point;

[0142] The anomaly detection threshold is dynamically determined based on the absolute difference of wavelet coefficients at each time point and the wavelet threshold calculation formula.

[0143] In one possible implementation, the comparison submodule is used for,

[0144] In the real time series, traffic data with wavelet coefficients less than the corresponding abnormal deviation threshold are identified as abnormal traffic data.

[0145] Traffic data in the real time series whose wavelet coefficients are greater than or equal to the corresponding abnormal deviation threshold are defined as normal traffic data.

[0146] In summary, the traffic anomaly detection device provided in this application generates a first time series based on traffic data within a first time period. It then uses a particle swarm optimization algorithm with an improved perturbation factor combined with a dynamic Bézier curve to smoothly reconstruct the first time series, obtaining a second time series. Subsequently, it predicts traffic data for a future second time period based on the second time series, obtaining a third time series. Finally, it uses the third time series as a reference to perform anomaly detection on the actual time series within the second time period, obtaining the anomaly detection result for the traffic data within the second time period. In this device, the improved PSO algorithm and dynamic Bézier curve for smooth reconstruction can reduce the interference of occasional fluctuations on anomaly detection in complex and highly sporadic scenarios, thereby improving the accuracy and robustness of anomaly detection in complex environments.

[0147] Figure 5 A structural block diagram of a computer device 500 illustrated in an exemplary embodiment of this application is shown. This computer device can be implemented as a server as described in the above-described scheme of this application. The computer device 500 includes a Central Processing Unit (CPU) 501, a system memory 504 including Random Access Memory (RAM) 502 and Read-Only Memory (ROM) 503, and a system bus 505 connecting the system memory 504 and the CPU 501. The computer device 500 also includes a mass storage device 506 for storing an operating system 509, application programs 510, and other program modules 511. The aforementioned system memory 504 and mass storage device 506 can be collectively referred to as memory.

[0148] According to various embodiments of this disclosure, the computer device 500 can also be connected to a remote computer on a network, such as the Internet. That is, the computer device 500 can be connected to a network 508 via a network interface unit 507 connected to the system bus 505, or it can use the network interface unit 507 to connect to other types of networks or remote computer systems (not shown).

[0149] The memory also includes at least one instruction, at least one program, code set, or instruction set, which are stored in the memory. The central processing unit 501 executes the at least one instruction, at least one program, code set, or instruction set to implement all or part of the steps in the traffic anomaly detection methods shown in the above embodiments.

[0150] Figure 6 A structural block diagram of a computer device 600 illustrating an exemplary embodiment of this application is shown. The computer device 600 can be implemented as a terminal device in the above-described scheme, such as a smartphone, tablet computer, laptop computer, desktop computer, etc. The computer device 600 may also be referred to as user equipment, portable terminal, laptop terminal, desktop terminal, or other names.

[0151] Typically, computer device 600 includes a processor 601 and a memory 602.

[0152] In some embodiments, the computer device 600 may optionally include a peripheral device interface 603 and at least one peripheral device. The processor 601, memory 602, and peripheral device interface 603 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 603 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of the following: a radio frequency circuit 604, a display screen 605, a camera assembly 606, an audio circuit 607, and a power supply 608.

[0153] In some embodiments, the computer device 600 further includes one or more sensors 609. The one or more sensors 609 include, but are not limited to, an accelerometer 610, a gyroscope 611, a pressure sensor 612, an optical sensor 613, and a proximity sensor 614.

[0154] Those skilled in the art will understand that Figure 6 The structure shown does not constitute a limitation on the computer device 600, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0155] In one exemplary embodiment, a computer-readable storage medium is also provided, which stores at least one computer program that is loaded and executed by a processor to implement all or part of the steps in the traffic anomaly detection method described above. For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, or optical data storage device, etc.

[0156] In one exemplary embodiment, a computer program product is also provided, comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the above-described actions. Figure 1 or Figure 2 All or part of the steps of the traffic anomaly detection method shown in the embodiments.

[0157] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.

[0158] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting abnormal flow rates, characterized in that, The method includes: A first time series is generated based on the traffic data within the first time period; The first time series is smoothly reconstructed using a particle swarm optimization algorithm with an improved perturbation factor and a dynamic Bézier curve to obtain the second time series. Based on the second time series, a time series prediction is performed to obtain a third time series, which is used to indicate the predicted traffic data in the second time period after the first time period. Anomaly detection is performed on the real time series within the second time period based on the third time series to obtain the anomaly detection results of the traffic data within the second time period.

2. The method according to claim 1, characterized in that, The particle swarm optimization algorithm based on the perturbation factor and the dynamic Bézier curve are used to smoothly reconstruct the first time series to obtain the second time series, including: The first time series is divided into multiple sub-series based on the convex points in the first time series; By inserting Bézier curves between adjacent subsequences, multiple smooth subsequences are obtained; the control points of each Bézier curve are dynamically determined by a particle swarm algorithm based on the direction of the line connecting the two convex points of the adjacent subsequences and the perturbation factor. The multiple smooth subsequences are recombined to obtain the second time series.

3. The method according to claim 1 or 2, characterized in that, The step of predicting the third time series based on the second time series includes: The second time series is input into the sequence prediction model to obtain the third time series output by the sequence prediction model. The sequence prediction model includes a Long Short-Term Memory (LSTM) layer and an attention mechanism layer. The input of the attention mechanism layer is the hidden state sequence of all time steps extracted and output by the LSTM layer, and the output is a feature vector obtained by weighted summation based on the hidden state sequence.

4. The method according to claim 1, characterized in that, The step of performing anomaly detection on the real time series within the second time period based on the third time series to obtain anomaly detection results for the traffic data within the second time period includes: Wavelet transforms are performed on the third time series and the real time series respectively to obtain the wavelet coefficient sequences of the third time series and the wavelet coefficient sequences of the real time series. Based on the deviation between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series, the anomaly judgment threshold is dynamically calculated. The wavelet coefficient sequence of the real time series is compared with the anomaly detection threshold at each time point to obtain the anomaly detection result of the real time series.

5. The method according to claim 4, characterized in that, The dynamic calculation of the anomaly detection threshold based on the deviation between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series includes: Calculate the absolute difference of wavelet coefficients between the wavelet coefficient sequence of the third time series and the wavelet coefficient sequence of the real time series at each time point; The anomaly detection threshold is dynamically determined based on the absolute difference of wavelet coefficients at each time point and the wavelet threshold calculation formula.

6. The method according to claim 4, characterized in that, The wavelet coefficient sequence of the real time series is compared with the corresponding anomaly detection threshold at each time point to obtain the anomaly detection result of the real time series, including: In the real time series, traffic data with wavelet coefficients less than the corresponding abnormal deviation threshold are identified as abnormal traffic data. Traffic data in the real time series whose wavelet coefficients are greater than or equal to the corresponding abnormal deviation threshold are defined as normal traffic data.

7. A flow anomaly detection device, characterized in that, The device includes: The sequence generation module is used to generate a first time series based on the traffic data within the first time period. The sequence reconstruction module is used to smoothly reconstruct the first time series based on the particle swarm algorithm improved by the perturbation factor and the dynamic Bézier curve to obtain the second time series. The sequence prediction module is used to perform time series prediction based on the second time series to obtain a third time series, wherein the third time series is used to indicate the predicted traffic data in the second time period after the first time period. An anomaly detection module is used to perform anomaly detection on the real time series within the second time period based on the third time series, and obtain the anomaly detection result of the traffic data within the second time period.

8. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one computer program, which is loaded and executed by the processor to implement the traffic anomaly detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the traffic anomaly detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer device, cause the computer device to perform the traffic anomaly detection method as described in any one of claims 1 to 6.

Images