Method, device, electronic device, and storage medium for monitoring abnormalities in time series data

Abstract

The present application provides a method, device, electronic device, and storage medium for monitoring anomalies in time-series data, the method including the steps of acquiring multiple pieces of feature information of the time-series data, generating a combination of target features based on the multiple pieces of feature information, and monitoring anomalies based on the combination of target features. The method for monitoring anomalies in the present application uses the combination of target features to monitor anomalies, eliminating the need to set a fixed threshold or acquire label data, and thus achieving low cost and high scalability.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to a patent application filed by Jingdong City (Beijing) Digital Technology Limited Company on December 30, 2021, entitled "Method, apparatus, electronic device and storage medium for monitoring anomalies in time series data" and bearing Chinese patent application number "202011606882.8". [Technical field]

[0002] The present application relates to the field of data processing technology, and in particular to a method, device, electronic device, and storage medium for monitoring anomalies in time-series data. [Background technology]

[0003] Currently, abnormality monitoring of time series data is widely applied in production and life. For example, monitoring the flow rate of a commercial area can prevent accidents caused by excessive flow, and monitoring the abnormal status of information systems can be used.

[0004] In related technologies, anomaly monitoring of time series data is often based on rules provided by experts in the field, for example, normal intervals of each technical index are defined based on the experts' experience and daily monitoring values, and data within the normal intervals are judged to be normal, and data outside the normal intervals are judged to be abnormal. However, this method has poor flexibility and accuracy, high costs, and low scalability.

[0005] In related technology, anomalies in time-series data can be monitored using automatic machine learning methods. However, in order to provide feedback and adjust models and parameters, label information is required to establish metrics for evaluating the merits and demerits of models. However, in practice, it is difficult to obtain label data. Summary of the Invention

[0006] An embodiment of the first aspect of the present application provides a method for anomaly monitoring of time series data, which uses a combination of target features to monitor anomalous results, without the need to set fixed thresholds or obtain label data, and is low cost and highly scalable.

[0007] An embodiment of the second aspect of the present application provides an apparatus for monitoring anomalies in time-series data.

[0008] An embodiment of a third aspect of the present application provides an electronic device.

[0009] An embodiment of the present invention provides a computer-readable storage medium.

[0010] An embodiment of a first aspect of the present application provides a method for monitoring anomalies in time series data, including the steps of acquiring a plurality of pieces of feature information of time series data, generating a combination of target features based on the plurality of pieces of feature information, and monitoring anomaly results based on the combination of target features.

[0011] In the method for monitoring anomalies in time-series data according to the embodiment of the present application, first, multiple pieces of feature information of the time-series data are obtained, a combination of target features is generated based on the multiple pieces of feature information, and then anomalies are monitored based on the combination of target features. By using the combination of target features to monitor anomalies, there is no need to set a fixed threshold or obtain label data, and the cost is low and the scalability is high.

[0012] Furthermore, the method for monitoring anomalies in time-series data according to the above-described embodiment of the present invention may have the following additional technical features.

[0013] In one embodiment of the present application, the step of acquiring a plurality of feature information of the time series data includes the step of acquiring a plurality of features of a proximity deviation feature, a periodic deviation feature, a trend deviation feature, and a residual feature of the time series data.

[0014] In one embodiment of the present application, the step of generating a target feature combination based on the plurality of feature information includes the steps of generating a plurality of feature combinations based on the plurality of feature information, and selecting the target feature combination from the plurality of feature combinations.

[0015] In one embodiment of the present application, the step of selecting the target feature combination from the plurality of feature combinations includes the steps of: calculating a correlation coefficient between the plurality of features for each of the feature combinations; and selecting the target feature combination from the plurality of feature combinations based on the correlation coefficient.

[0016] In one embodiment of the present application, the above-mentioned method for monitoring anomalies in time series data further includes a step of calculating a minimum variance between the multiple features among each of the feature combinations, and selecting the target feature combination from the multiple feature combinations based on the correlation coefficient and the minimum variance.

[0017] In one embodiment of the present application, the step of monitoring anomaly results based on the combination of target features includes the steps of inputting the combination of target features into a plurality of anomaly monitoring models to generate anomaly points and normal points recognized by each of the anomaly monitoring models, selecting a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the anomaly points and normal points output by each of the anomaly monitoring models, and monitoring anomaly results based on the combination of target features and the target anomaly monitoring model.

[0018] In one embodiment of the present application, the step of selecting a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the anomaly points and the normal points output by each of the anomaly monitoring models includes a step of acquiring a distance between the anomaly points and the normal points, and a step of selecting a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the distance between the anomaly points and the normal points.

[0019] In one embodiment of the present application, the anomaly points are multiple, and the method further includes a step of obtaining an average distance between the multiple anomaly points and the normal points, and selecting a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the distance between the anomaly points and the normal points and the average distance.

[0020] An embodiment of the second aspect of the present application provides an anomaly monitoring device for time series data, comprising: an acquisition module that acquires multiple pieces of feature information of time series data; a generation module that generates a combination of target features based on the multiple pieces of feature information; and a monitoring module that monitors anomaly results based on the combination of target features.

[0021] In the time-series data anomaly monitoring device according to the embodiment of the present application, an acquisition module acquires multiple pieces of feature information of the time-series data, a generation module generates a combination of target features based on the multiple pieces of feature information, and a monitoring module monitors anomaly results based on the combination of target features. In this way, by monitoring anomaly results using the combination of target features, there is no need to set a fixed threshold or acquire label data, resulting in low cost and high scalability.

[0022] Furthermore, the time-series data anomaly monitoring device according to the above embodiment of the present application can have the following additional technical features.

[0023] In one embodiment of the present application, the acquisition module specifically acquires a plurality of features of the time series data, including a proximity deviation feature, a periodic deviation feature, a trend deviation feature and a residual feature.

[0024] In one embodiment of the present application, the generation module includes a first generation unit that generates a combination of multiple features based on the multiple feature information, and a first selection unit that selects the target feature combination from the multiple feature combinations.

[0025] In one embodiment of the present application, the first selection unit specifically calculates a correlation coefficient between the multiple features in each of the feature combinations, and selects the target feature combination from the multiple feature combinations based on the correlation coefficient.

[0026] In one embodiment of the present application, the first selection unit further calculates a minimum variance between the multiple features for each of the feature combinations, and selects the target feature combination from the multiple feature combinations based on the correlation coefficient and the minimum variance.

[0027] In one embodiment of the present application, the monitoring module includes a second generation unit that inputs the combination of target features into a plurality of anomaly monitoring models to generate abnormal points and normal points recognized by each of the anomaly monitoring models, a second selection unit that selects a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the abnormal points and the normal points output by each of the anomaly monitoring models, and a monitoring unit that monitors anomaly results based on the combination of target features and the target anomaly monitoring model.

[0028] In one embodiment of the present application, the second selection unit specifically obtains a distance between the abnormal point and the normal point, and selects a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the distance between the abnormal point and the normal point.

[0029] In one embodiment of the present application, the anomaly points are multiple, and the second selection unit further obtains an average distance between the multiple anomaly points and the normal points, and selects a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the distance between the anomaly points and the normal points and the average distance.

[0030] An embodiment of the third aspect of the present application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable by the processor, the processor, when executing the program, realizing the method for monitoring anomalies in time series data described in the embodiment of the first aspect above.

[0031] The electronic device of the embodiment of the present application has a processor executing a computer program stored in a memory and monitors for anomalous results using a combination of target features, eliminating the need to set fixed thresholds or acquire label data, making it low cost and highly scalable.

[0032] An embodiment of the fourth aspect of the present application provides a computer-readable storage medium having a computer program stored therein, the computer-readable storage medium realizing the method for monitoring anomalies in time-series data described in the embodiment of the first aspect above, when the program is executed by a processor.

[0033] A computer-readable storage medium according to an embodiment of the present application stores a computer program executed by a processor to monitor for abnormal results using a combination of target features, eliminating the need to set fixed thresholds or acquire label data, and is low cost and highly scalable.

[0034] Additional aspects and advantages of the present application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the present application. [Brief description of the drawings]

[0035] The above and / or additional aspects and advantages of the present application will become apparent and understandable from the following description of the embodiments in conjunction with the drawings. [Figure 1] 1 is a schematic flowchart of a method for monitoring anomalies in time-series data according to an embodiment of the present invention. [Diagram 2] 11 is a schematic flowchart of a method for monitoring anomalies in time-series data according to another embodiment of the present application. [Diagram 3] 1 is a schematic block diagram of an anomaly monitoring device for time-series data according to an embodiment of the present invention; [Figure 4] FIG. 1 is a schematic diagram illustrating the configuration of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0036] Hereinafter, the embodiments of the present specification will be described in detail. The embodiments are shown in the drawings, and the same or similar reference numerals throughout the drawings represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the drawings are examples for explaining the present application, and cannot be understood as limitations on the present application.

[0037] Hereinafter, a method, device, electronic device, and storage medium for monitoring anomalies in time-series data according to embodiments of the present application will be described with reference to the accompanying drawings.

[0038] The method for monitoring anomalies in time series data provided by the embodiments of the present application can be executed by an electronic device, which may be a PC (Personal Computer), a tablet, a server, or the like, but is not limited thereto.

[0039] In an embodiment of the present application, the electronic device may be provided with a processing component, a storage component, and a driving component. Optionally, the driving component and the processing component can be integrated and configured, and the storage component can store an operating system, an application program, or other program modules, and the processing component executes the application program stored in the storage component to realize the method for monitoring anomalies in time-series data provided by the embodiment of the present application.

[0040] FIG. 1 is a schematic flowchart of a method for monitoring anomalies in time-series data according to an embodiment of the present invention.

[0041] The time series data anomaly monitoring method of the embodiment of the present application can be performed by a time series data anomaly monitoring device provided by the embodiment of the present application, which can be disposed in an electronic device, thereby obtaining multiple feature information of the time series data, generating a combination of target features based on the multiple feature information, and monitoring anomaly results based on the combination of target features, thereby eliminating the need to set fixed thresholds or obtain label data, and having low cost and high scalability.

[0042] When possible, the method for monitoring anomalies in time-series data according to the embodiment of the present application may be executed on the server side, or the server may be a cloud server, and the method for monitoring anomalies in time-series data may be executed on the cloud side.

[0043] As shown in FIG. 1, this method for monitoring anomalies in time-series data can include steps 101 to 103.

[0044] Step 101: obtain a plurality of feature information of time series data, which may include a plurality of features among a proximity deviation feature, a periodic deviation feature, a trend deviation feature, and a residual feature of the time series data.

[0045] The time series data described in this embodiment may be sales history data of a shopping platform, for example, sales history data within a time period (e.g., one day, one week, one month, etc.) on the shopping platform side, page browsing history data of the shopping platform, or traffic flow history data of a trade area, and is not limited here. The shopping platform may include a shopping site, a shopping APP (Application, mobile phone software), a shopping system, etc.

[0046] Step 102, generate a target feature combination based on the plurality of feature information.

[0047] In an embodiment of the present application, the electronic device can generate a model or a pre-defined algorithm based on the feature combination to generate a target feature combination based on multiple feature information.

[0048] It should be noted that the feature combination generation model described in this embodiment can be pre-trained and pre-stored in the storage space of the electronic device to facilitate retrieval, and this storage space is not limited to a physically-based storage space, such as a hard disk, and this storage space can also be the storage space (cloud storage space) of a network hard disk connected to the electronic device. The preset algorithm described in this embodiment can be oriented based on the actual situation.

[0049] Step 103, monitor for abnormal results based on the combination of target features.

[0050] Specifically, the electronic device can obtain time series data from the shopping platform, analyze and calculate the time series data to generate multiple feature information of the time series data, generate a target feature combination based on a preset algorithm and the multiple feature information, and finally monitor abnormal results based on the target feature combination.

[0051] In general, time series data that has a large change range between relatively recent and periodic data is highly likely to be abnormal. However, the method for monitoring abnormalities in time series data according to an embodiment of the present application makes it possible to monitor the relatively recent and periodic change range of time series data in real time.

[0052] In the embodiment of the present application, first, multiple feature information of time series data is obtained, a combination of target features is generated based on the multiple feature information, and then anomaly results are monitored based on the combination of target features, thereby eliminating the need to set a fixed threshold or obtain label data by using the combination of target features to monitor anomaly results, and thus reducing costs and increasing scalability.

[0053] To clarify the above-mentioned embodiment, in one embodiment of the present application, the step of acquiring multiple feature information of the time series data may include acquiring multiple features of the time series data, including a proximity deviation feature, a periodic deviation feature, a trend deviation feature, and a residual feature.

[0054] In the embodiment of the present application, the proximity deviation value, periodic deviation value, trend deviation value, and residual value of the calculated time series data can be calculated by the following formulas (1), (2), (3), and (4), respectively.

number

number

[0055] Specifically, after obtaining the time series data, the electronic device calculates the proximity deviation value, periodic deviation value, trend deviation value, and residual value of the time series data according to the above formulas (1), (2), (3), and (4), respectively, and then generates the proximity deviation feature, periodic deviation feature, trend deviation feature, and residual feature of the time series data according to the proximity deviation value, periodic deviation value, trend deviation value, and residual value of the time series data, respectively, and the preset feature generation algorithm. The preset feature generation algorithm can be localized according to the actual situation.

[0056] In addition, the larger the residual value described in this embodiment, the greater the deviation of the current time from the average value, i.e., the higher the possibility of an abnormality. In a classical anomaly monitoring method based on statistical time series data, a variance of three or more times the average value is considered to be abnormal, i.e., the residual value is an important feature in determining time series abnormalities.

[0057] In addition, there may be different types of abnormalities, such as excessive abnormalities and under-excess abnormalities. For excessive abnormalities, the calculation method of the proximity deviation value is max(Xt-Xt-1,0), and the calculation methods of other deviation system indexes (e.g., periodic deviation value, trend deviation value, and residual value) are similar. For under-excess abnormalities, the calculation method of the proximity deviation value is min(Xt-Xt-1,0).

[0058] Further, in one embodiment of the present application, the step of generating a target feature combination based on a plurality of feature information includes the steps of generating a plurality of feature combinations based on the plurality of feature information, and selecting a target feature combination from the plurality of feature combinations.

[0059] Specifically, the electronic device can acquire multiple feature information of time series data, then perform feature combination and dimensionality reduction on the proximity deviation feature, periodic deviation feature, trend deviation feature, and residual feature of the time series data of the multiple feature information, and finally perform reconstruction based on the effect of feature evaluation to acquire multiple feature combinations.The electronic device can then select the best feature combination (i.e., the feature combination with the highest evaluation effect) from the multiple feature combinations based on the effect of feature evaluation as a target feature combination.

[0060] The dimension reduction described in this embodiment corresponds to performing correlation feature synthesis and noise removal processing on features.

[0061] To clarify the above embodiment, in one embodiment of the present application, the step of selecting a target feature combination from the plurality of feature combinations may include the steps of calculating a correlation coefficient between the plurality of features in each feature combination, and selecting the target feature combination from the plurality of feature combinations based on the correlation coefficient.

[0062] In addition, the larger the correlation coefficient between features, the more uniform the features, the poorer the quality of the features. Correlation can usually be evaluated by the Pearson correlation coefficient, which can be equivalent to cosine similarity.

[0063] In the embodiment of the present application, the correlation coefficient between multiple features among each combination of features can be calculated by the following formula (5).

number

number

number

number

[0064] Specifically, the electronic device generates multiple feature combinations based on multiple feature information, then calculates the correlation coefficient between the multiple features for each feature combination using the above equation (5), compares the correlation coefficients between the multiple features for each feature combination, determines the smallest correlation coefficient between the multiple features, and selects the feature combination corresponding to this correlation coefficient as the target feature combination, i.e., selects the feature combination with the smallest correlation coefficient from each feature combination as the target feature combination.

[0065] Furthermore, in one embodiment of the present application, the method for monitoring anomalies in time series data further includes a step of calculating a minimum variance between multiple features among each feature combination, and selecting a target feature combination from the multiple feature combinations based on the correlation coefficient and the minimum variance.

[0066] In the embodiment of the present application, the minimum variance between multiple features among each combination of features can be calculated by the following formula (6).

number

number

number

[0067] Specifically, the electronic device can calculate the correlation coefficient between the features of each feature combination, and then calculate the minimum variance between the features of each feature combination according to the above formula (6), and compare the minimum variances between the features of each feature combination to generate a first comparison result. Then, the electronic device can calculate the correlation coefficient between the features of each feature combination according to the above formula (5), and compare the correlation coefficients between the features of each feature combination to generate a second comparison result. Finally, the electronic device can select a target feature combination from the feature combinations based on the first comparison result and the second comparison result. For example, the smallest correlation coefficient between the features and the smallest variance can be selected, and the corresponding feature combination can be set as the target feature combination. This allows the selected target feature combination to be more compatible with the current time series data.

[0068] In one embodiment of the present application, as shown in FIG. 2, the step of monitoring for abnormal results based on a combination of target features may include steps 201-203.

[0069] Step 201: input the combination of target features into multiple anomaly monitoring models to generate abnormal points and normal points recognized by each anomaly monitoring model. Both the abnormal points and the normal points may be multiple, and the multiple anomaly monitoring models may include a KNN (k-Nearest Neighbor) model, a one-class SVM (One-Class Support Vector Machine) model, an Isolation Forest model, etc.

[0070] It should be noted that the multiple anomaly monitoring models described in this embodiment may be pre-trained and pre-stored in the storage space of the electronic device for easy recall.

[0071] In addition, the training and generation of the above-mentioned multiple anomaly monitoring models can be performed by a related server, which may be a cloud service or a computer host, and a communication connection, which is at least one of a wireless network connection and a wired network connection, is established between the server and the electronic device capable of executing the time-series data anomaly monitoring method provided by the embodiment of the present application. The server can send the trained multiple anomaly monitoring models to the electronic device to prevent the electronic device from calling them when necessary, which can greatly reduce the calculation stress of the electronic device.

[0072] Specifically, after acquiring a combination of target features, the electronic device inputs the combination of target features into a plurality of anomaly monitoring models, and processes the combination of target features using the plurality of anomaly monitoring models, respectively, so that each anomaly monitoring model can output abnormal points and normal points, i.e., the abnormal points and normal points recognized by each anomaly monitoring model.

[0073] Step 202: Select a target anomaly monitoring model suitable for the time series from among the multiple anomaly monitoring models based on the abnormal points and normal points output by each anomaly monitoring model.

[0074] In one embodiment of the present application, the step of selecting a target anomaly monitoring model suitable for the time series from among the multiple anomaly monitoring models based on the abnormal points and normal points output by each anomaly monitoring model includes the steps of acquiring a distance between the abnormal point and the normal point, and selecting a target anomaly monitoring model suitable for the time series from among the multiple anomaly monitoring models based on the distance between the abnormal point and the normal point. Note that the distance described in this embodiment may be the closest distance between the abnormal point and the normal point.

[0075] In the embodiment of the present application, the distance between the abnormal point and the normal point can be calculated by the following formula (7).

number

number

number

[0076] In addition, the present application can evaluate the expression of each anomaly monitoring model based on the nearest distance between the abnormal points and normal points output by each anomaly monitoring model, where the nearest distance refers to the minimum distance between the abnormal points and normal points, and generally, the greater the minimum distance, the more significant the anomaly discrimination effect is, i.e., the higher the expression effect of the model.

[0077] Step 203, monitor the anomaly results based on the combination of target features and the target anomaly monitoring model.

[0078] Specifically, after acquiring the abnormal points and normal points recognized by each anomaly monitoring model, the electronic device calculates the nearest distance between the abnormal points and normal points output by each anomaly monitoring model according to the above formula (7), compares the nearest distance between the abnormal points and normal points output by each anomaly monitoring model, determines the nearest distance between the farthest abnormal point and normal point, and sets the anomaly monitoring model corresponding to this nearest distance as the target anomaly monitoring model.The electronic device then monitors anomaly results based on this combination of target features and the target anomaly monitoring model.

[0079] In order to improve the accuracy of selecting a target anomaly monitoring model suitable for a time series, in one embodiment of the present application, there may be a plurality of anomaly points, and the method for monitoring anomaly in time series data may include a step of obtaining an average distance between the plurality of anomaly points and normal points, and selecting a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the distance between the anomaly points and the normal points and the average distance. Note that the average distance described in this embodiment may be an average nearest distance between the plurality of anomaly points and the normal points.

[0080] In the embodiment of the present application, the average distance between a plurality of abnormal points and normal points can be calculated by the following formula (8).

number

number

number

number

[0081] In addition, the present application can evaluate the expression of each anomaly monitoring model based on the average nearest distance between multiple abnormal points and normal points output by each anomaly monitoring model, and this average nearest distance can refer to the average of the nearest distances between multiple abnormal points and normal points, and generally, the greater the average nearest distance, the better the expression performance of the model.

[0082] Specifically, after acquiring the abnormal points and normal points recognized by each anomaly monitoring model, the electronic device can calculate the average value of the nearest distance between the multiple abnormal points and normal points output by each anomaly monitoring model according to the above formula (8), and compare the averages of the nearest distance between the abnormal points and normal points output by each anomaly monitoring model to generate a third comparison result. Then, the electronic device can calculate the nearest distance between the abnormal points and normal points output by each anomaly monitoring model according to the above formula (7), and compare the nearest distance between the abnormal points and normal points output by each anomaly monitoring model to generate a fourth comparison result. Finally, the electronic device can select a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the third comparison result and the fourth comparison result. For example, the nearest distance between the farthest abnormal point and the normal point and the average value of the nearest distances can be selected, and the corresponding anomaly monitoring model can be set as the target anomaly monitoring model. This allows the selected target anomaly monitoring model to be more adapted to the current time series data.

[0083] As described above, the method for monitoring anomalies in time-series data according to the embodiment of the present application first acquires multiple pieces of feature information of the time-series data, generates a combination of target features based on the multiple pieces of feature information, and then monitors anomalies based on the combination of target features. In this way, by using the combination of target features to monitor anomalies, there is no need to set a fixed threshold or acquire label data, and the cost is low and the scalability is high.

[0084] FIG. 3 is a schematic block diagram of an apparatus for monitoring anomalies in time-series data according to an embodiment of the present invention.

[0085] The time series data anomaly monitoring device of the embodiment of the present application can be placed in an electronic device, thereby acquiring multiple feature information of the time series data, generating a combination of target features based on the multiple feature information, and monitoring anomaly results based on the combination of target features, thereby eliminating the need to set fixed thresholds or acquire label data, and is low cost and highly scalable.

[0086] As shown in FIG. 3, the time-series data anomaly monitoring device 300 may include an acquisition module 310, a generation module 320, and a monitoring module 330.

[0087] The acquiring module 310 acquires a plurality of feature information of the time series data.

[0088] The generation module 320 generates a combination of target features based on the plurality of feature information.

[0089] The monitoring module 330 monitors for anomalous results based on the combination of target features.

[0090] In one embodiment of the present application, the acquiring module 310 specifically acquires multiple features of the proximity deviation feature, the periodic deviation feature, the trend deviation feature, and the residual feature of the time series data.

[0091] In an embodiment of the present application, as shown in FIG. 3, the generating module 320 may include a first generating unit 321 and a first selecting unit 322.

[0092] The first generation unit 321 generates a combination of multiple features based on multiple feature information.

[0093] The first selection unit 322 selects a target feature combination from the multiple feature combinations.

[0094] In one embodiment of the present application, the first selection unit 322 specifically calculates a correlation coefficient between multiple features in each feature combination, and selects a target feature combination from the multiple feature combinations based on the correlation coefficient.

[0095] In one embodiment of the present application, the first selection unit 322 further calculates the minimum variance between the multiple features among each feature combination, and selects a target feature combination from the multiple feature combinations based on the correlation coefficient and the minimum variance.

[0096] In one embodiment of the present application, as shown in FIG. 3, the monitoring module 330 may include a second generating unit 331, a second selecting unit 332 and a monitoring unit 333.

[0097] The second generation unit 331 inputs a combination of target features into multiple anomaly monitoring models to generate abnormal points and normal points recognized by each anomaly monitoring model.

[0098] The second selection unit 332 selects a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the abnormal points and normal points output by each anomaly monitoring model.

[0099] The monitoring unit 333 monitors the anomaly results based on the combination of the target features and the target anomaly monitoring model.

[0100] In one embodiment of the present application, the second selection unit 332 specifically obtains the distance between the abnormal point and the normal point, and selects a target anomaly monitoring model suitable for the time series from a plurality of anomaly monitoring models based on the distance between the abnormal point and the normal point.

[0101] In one embodiment of the present application, there may be multiple abnormal points, and the second selection unit 332 further obtains an average distance between the multiple abnormal points and normal points, and selects a target anomaly monitoring model suitable for the time series from the multiple anomaly monitoring models based on the distance between the abnormal points and the normal points and the average distance.

[0102] In addition, for details not described in the device for monitoring anomalies in time-series data according to an embodiment of the present invention, please refer to the details described in the method for monitoring anomalies in time-series data according to an embodiment of the present invention, and therefore detailed explanations will be omitted.

[0103] As described above, the time-series data anomaly monitoring device according to the embodiment of the present application acquires multiple pieces of feature information of the time-series data using an acquisition module, generates a combination of target features based on the multiple pieces of feature information using a generation module, and monitors anomaly results based on the combination of target features using a monitoring module. In this way, by monitoring anomaly results using the combination of target features, there is no need to set a fixed threshold or acquire label data, resulting in low cost and high scalability.

[0104] In order to realize the above embodiment, as shown in FIG. 4, the present invention provides an electronic device 400, which includes a memory 410, a processor 420, and a computer program stored in the memory 410 and executable by the processor 420, and when the processor 420 executes the program, it realizes the method for monitoring anomalies in time series data described in the above embodiment of the present application.

[0105] The electronic device of the embodiment of the present application has a processor executing a computer program stored in a memory to monitor for abnormal results using a combination of target features, eliminating the need to set fixed thresholds or acquire label data, making it low cost and highly scalable.

[0106] In order to realize the above-mentioned embodiments, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, realizes the method for monitoring anomalies in time-series data described in the above-mentioned embodiments of the present application.

[0107] A computer-readable storage medium according to an embodiment of the present application stores a computer program executed by a processor to monitor abnormal results using a combination of target features, eliminating the need to set fixed thresholds or acquire label data, and is low cost and highly scalable.

[0108] In the present description, the terms "first" and "second" are used for descriptive purposes only and cannot be understood to indicate the relative importance or to imply or imply the number of technical features indicated. Thus, a feature defined as "first" or "second" can explicitly or implicitly include at least one feature. In the present description, "plurality" means at least two, e.g., two, three, etc., unless otherwise specified and limited.

[0109] In the description of this specification, a description referring to the terms "one embodiment", "several embodiments", "examples", "specific examples", or "several examples" means that the specific features, structures, materials, or particular points described in connection with this embodiment or example are included in at least one embodiment or example of the present application. In this specification, general expressions of the above terms do not necessarily have to be directed to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. Furthermore, if not inconsistent, a person skilled in the art can mix and match different embodiments or examples described herein, and features of different embodiments or examples.

[0110] Although the embodiments of the present application have been shown and described above, the above-described embodiments are illustrative and cannot be understood as limitations on the present application. It is understood that those skilled in the art can change, modify, substitute, and alter the above-described embodiments within the scope of the present application.

Claims

1. A method for monitoring anomalies in time-series data executed by an apparatus for monitoring anomalies in time-series data, comprising: Obtaining a plurality of pieces of feature information of time series data; generating a target feature combination based on the plurality of feature information; monitoring for anomalous results based on the combination of target features; Including, the step of acquiring a plurality of pieces of feature information of the time series data includes a step of acquiring a plurality of features from among a proximity deviation feature, a periodic deviation feature, a trend deviation feature, and a residual feature of the time series data; monitoring for anomalous results based on the combination of target features, inputting the combination of target features into a plurality of anomaly monitoring models to generate abnormal points and normal points recognized by each of the anomaly monitoring models; selecting a target anomaly monitoring model suitable for the time series from among the plurality of anomaly monitoring models based on the anomaly points and the normal points output by each of the anomaly monitoring models; monitoring anomaly results based on the combination of target features and the target anomaly monitoring model; A method for monitoring anomalies in time series data, comprising:

2. generating a combination of target features based on the plurality of feature information, generating a combination of a plurality of features based on the plurality of feature information; selecting the target feature combination from the plurality of feature combinations; The method for monitoring anomalies in time-series data according to claim 1 , further comprising:

3. selecting the target feature combination from the plurality of feature combinations, calculating a correlation coefficient between the features for each of the feature combinations; selecting the target feature combination from the plurality of feature combinations based on the correlation coefficient; The method for monitoring anomalies in time-series data according to claim 2 , further comprising:

4. 4. The method for monitoring anomalies in time series data according to claim 3, further comprising the steps of: calculating a minimum variance between the plurality of features among each of the feature combinations; and selecting the target feature combination from the plurality of feature combinations based on the correlation coefficient and the minimum variance.

5. selecting a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the anomaly points and the normal points output by each of the anomaly monitoring models, obtaining a distance between the abnormal point and the normal point; selecting a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on a distance between the anomaly point and the normal point; The method for monitoring anomalies in time-series data according to claim 1 , further comprising:

6. The abnormal points are multiple, 6. The method for monitoring anomalies in time series data according to claim 5, further comprising the steps of: acquiring an average distance between the plurality of anomaly points and the normal points; and selecting a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the distance between the anomaly points and the normal points and the average distance.

7. An acquisition module for acquiring multiple feature information of time series data; a generation module for generating a combination of target features based on the plurality of feature information; a monitoring module that monitors for anomalous results based on the combination of target features; Equipped with The acquisition module acquires a plurality of features among a proximity deviation feature, a periodic deviation feature, a trend deviation feature, and a residual feature of the time series data; The monitoring module: a second generation unit for inputting the combination of the target features into a plurality of anomaly monitoring models to generate abnormal points and normal points recognized by each of the anomaly monitoring models; a second selection unit that selects a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the anomaly points and the normal points output by each of the anomaly monitoring models; a monitoring unit for monitoring anomaly results based on the combination of target features and the target anomaly monitoring model; An anomaly monitoring device for time series data comprising:

8. The generation module: a first generating unit for generating a combination of a plurality of features based on the plurality of feature information; a first selection unit for selecting the target feature combination from the plurality of feature combinations; The time-series data abnormality monitoring device according to claim 7 .

9. 9. The time-series data anomaly monitoring device according to claim 8, wherein the first selection unit calculates a correlation coefficient between the plurality of features among each of the feature combinations, and selects the target feature combination from the plurality of feature combinations based on the correlation coefficient.

10. 10. The time-series data anomaly monitoring device according to claim 9, wherein the first selection unit calculates a minimum variance between the plurality of features among each of the feature combinations, and selects the target feature combination from the plurality of feature combinations based on the correlation coefficient and the minimum variance.

11. The second selection unit: Obtaining a distance between the abnormal point and the normal point; The device for monitoring anomalies in time-series data according to claim 7 , wherein a target anomaly monitoring model suitable for the time series is selected from the plurality of anomaly monitoring models based on a distance between the abnormal point and the normal point.

12. The abnormal points are multiple, 12. The time series data anomaly monitoring device according to claim 11, wherein the second selection unit acquires an average distance between the plurality of anomaly points and the normal points, and selects a target anomaly monitoring model suitable for the time series from the plurality of anomaly monitoring models based on the distance between the anomaly points and the normal points and the average distance.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, the electronic device realizing the method for monitoring anomalies in time-series data according to any one of claims 1 to 6 when the processor executes the program.

14. A computer-readable storage medium having a computer program stored thereon, A computer-readable storage medium that, when executed by a processor, realizes the method for monitoring anomalies in time-series data according to claim 1 .

Images