CN110888788A - Anomaly detection method and device, computer equipment and storage medium - Google Patents
Anomaly detection method and device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN110888788A CN110888788A CN201910985364.2A CN201910985364A CN110888788A CN 110888788 A CN110888788 A CN 110888788A CN 201910985364 A CN201910985364 A CN 201910985364A CN 110888788 A CN110888788 A CN 110888788A
- Authority
- CN
- China
- Prior art keywords
- index
- detected
- monitoring result
- preset time
- prediction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 53
- 238000012544 monitoring process Methods 0.000 claims abstract description 100
- 230000002159 abnormal effect Effects 0.000 claims abstract description 88
- 238000012423 maintenance Methods 0.000 claims abstract description 35
- 230000000737 periodic effect Effects 0.000 claims abstract description 31
- 238000000034 method Methods 0.000 claims abstract description 10
- 230000005856 abnormality Effects 0.000 claims description 23
- 238000001228 spectrum Methods 0.000 claims description 22
- 230000003068 static effect Effects 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 15
- 238000004364 calculation method Methods 0.000 claims description 5
- 230000002547 anomalous effect Effects 0.000 claims 1
- 230000009466 transformation Effects 0.000 claims 1
- 238000013024 troubleshooting Methods 0.000 abstract description 3
- 238000013473 artificial intelligence Methods 0.000 abstract description 2
- 238000010586 diagram Methods 0.000 description 9
- 238000004422 calculation algorithm Methods 0.000 description 4
- 238000012545 processing Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 230000001537 neural effect Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000003595 spectral effect Effects 0.000 description 2
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 description 1
- 238000012896 Statistical algorithm Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000000205 computational method Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3447—Performance evaluation by modeling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3476—Data logging
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The application relates to the technical field of artificial intelligence, and particularly discloses an anomaly detection method and device, computer equipment and a storage medium. The method comprises the following steps: if the index to be detected is a periodic significant index, acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point; inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to a preset time point; acquiring a monitoring result corresponding to a preset time point, and calculating a residual error between a dynamic prediction result and the monitoring result; if the residual error exceeds the preset range, recording the monitoring result into an abnormal log, and detecting whether an abnormal event exists or not based on the abnormal log; and if the abnormal event exists, sending an abnormal event alarm to the operation and maintenance terminal. The method is based on the prediction result and the actual monitoring result of the periodic significant indexes, and can find the abnormity in the hidden danger stage and inform manual troubleshooting so as to avoid real system faults caused by the follow-up hidden troubles of faults.
Description
Technical Field
The present application relates to the field of artificial intelligence technologies, and in particular, to an anomaly detection method and apparatus, a computer device, and a storage medium.
Background
In the intelligent operation and maintenance monitoring and management, the anomaly detection is an important part in the whole link. Because the abnormal labels of the monitoring index sequence are difficult to provide in large quantity, the existing detection method is mainly based on an unsupervised learning algorithm or a statistical algorithm, and meanwhile, a deep learning algorithm also exists. However, the existing algorithm has low detection accuracy for some indexes (such as indexes with obvious periodicity), and cannot detect the indexes when the indexes are abnormal but not obvious enough.
Disclosure of Invention
In order to solve the technical problem that detection accuracy of indexes with obvious periodicity is low in the prior art, the application provides an abnormality detection method, an abnormality detection device, computer equipment and a storage medium.
In a first aspect, the present application provides an anomaly detection method, including:
detecting whether the index to be detected is a periodic significant index;
if the index to be detected is a periodic significant index, acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point to obtain a plurality of historical prediction data;
inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point;
acquiring a monitoring result corresponding to the index to be detected at the preset time point, and calculating a residual error between the dynamic prediction result and the monitoring result;
if the residual error exceeds a preset range, recording the monitoring result into an abnormal log, and detecting whether an abnormal event exists or not based on the abnormal log;
and if the abnormal event exists, sending an abnormal event alarm to the operation and maintenance terminal.
In a second aspect, the present application also provides an abnormality detection apparatus, the apparatus including:
the detection module is used for detecting whether the index to be detected is a periodic significant index;
the acquisition module is used for acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point if the index to be detected is a periodic significant index, so as to obtain a plurality of historical prediction data;
the prediction module is used for inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point;
the calculation module is used for acquiring a monitoring result corresponding to the index to be detected at the preset time point and calculating a residual error between the dynamic prediction result and the monitoring result;
the abnormal event detection module is used for recording the monitoring result into an abnormal log if the residual error exceeds a preset range, and detecting whether an abnormal event exists or not based on the abnormal log;
and the alarm module is used for sending an abnormal event alarm to the operation and maintenance terminal if the abnormal event exists.
In a third aspect, the present application further provides a computer device comprising a memory and a processor; the memory is used for storing a computer program; the processor is configured to execute the computer program and implement the above-mentioned abnormality detection method when executing the computer program.
In a fourth aspect, the present application also provides a computer-readable storage medium storing a computer program which, when executed by a processor, causes the processor to implement the anomaly detection method as described above.
According to the method and the device, based on the prediction result and the actual monitoring result of the periodic significant index, the anomaly can be found in the hidden danger stage and the manual troubleshooting can be informed, so that the real system fault caused by the follow-up hidden trouble can be avoided.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a schematic flowchart of an anomaly detection method according to an embodiment of the present application;
FIG. 2 is a schematic flow chart diagram illustrating sub-steps of the anomaly detection method of FIG. 1;
FIG. 3 is a schematic flow chart of the step of determining a significance indicator of FIG. 2;
FIG. 4 is a schematic flow chart diagram illustrating sub-steps of the anomaly detection method of FIG. 1;
FIG. 5 is a schematic flow chart diagram illustrating sub-steps of the anomaly detection method of FIG. 1;
FIG. 6 is a schematic block diagram of an anomaly detection apparatus provided by an embodiment of the present application;
fig. 7 is a block diagram schematically illustrating a structure of a computer device according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some, but not all, embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The flow diagrams depicted in the figures are merely illustrative and do not necessarily include all of the elements and operations/steps, nor do they necessarily have to be performed in the order depicted. For example, some operations/steps may be decomposed, combined or partially combined, so that the actual execution sequence may be changed according to the actual situation.
It is to be understood that the terminology used in the description of the present application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the specification of the present application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should also be understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
The embodiment of the application provides an abnormality detection method, an abnormality detection device, computer equipment and a storage medium.
Some embodiments of the present application will be described in detail below with reference to the accompanying drawings. The embodiments described below and the features of the embodiments can be combined with each other without conflict.
Referring to fig. 1, fig. 1 is a schematic flow chart of an embodiment of an anomaly detection method according to the present application.
As shown in fig. 1, the abnormality detection method specifically includes steps S10 to S60.
And step S10, detecting whether the index to be detected is a periodic significant index.
In this embodiment, monitoring data of the index to be detected within a period of time may be obtained, and whether the index to be detected changes periodically is analyzed through the monitoring data, and if so, the index to be detected is a periodic significant index. The index to be detected may be an index such as a CPU utilization rate of a certain system, a certain service access amount, and the like, and is not limited herein.
In an alternative embodiment, referring to fig. 2, fig. 2 is a flow chart illustrating sub-steps of the anomaly detection method of fig. 1. As shown in fig. 2, step S10 includes steps S101 to S106.
Step S101, obtaining historical monitoring data of the index to be detected in a preset time.
In this embodiment, the to-be-detected index may be an index such as a CPU usage rate of a certain system, a certain service access amount, and the like, and the following description specifically takes a CPU usage rate of a certain system as an example. In this embodiment, the preset duration may be one year, four months, or one month, and is specifically selected according to actual needs, which is not limited herein. For example, the CPU usage of each whole point (i.e., zero point, one point, two points … … twenty-three points) in a past month of a certain system is obtained as historical monitoring data, or the average value of the CPU usage of each day in a month is obtained as historical monitoring data.
And step S102, carrying out fast Fourier transform on the historical monitoring data to obtain frequency domain map information data.
In this embodiment, after the historical detection data is obtained, fast fourier transform is performed on the obtained historical monitoring data. Fast Fourier Transform (FFT), a generic name for an efficient and Fast computational method that utilizes a computer to compute a Discrete Fourier Transform (DFT), is referred to as FFT. And carrying out fast Fourier change on the historical monitoring data to obtain frequency domain map information data corresponding to the historical monitoring data.
Step S103, determining the frequency spectrum component corresponding to the daily frequency position and the frequency spectrum component corresponding to other frequency positions according to the frequency domain map information data.
In this embodiment, after the frequency domain map information data is obtained, amplitude components (i.e., spectrum components) of the historical monitoring data at each frequency can be obtained according to the frequency domain map information data. For example, the daily frequency position of the historical monitoring data obtained according to the frequency domain map information data corresponds to the frequency spectrum component P1, and the frequency spectrum components corresponding to other frequency positions are P2, P3 and P4 … … Pn, respectively.
And step S104, calculating the average value of the frequency spectrum components corresponding to the other frequency positions, and calculating the difference value between the frequency spectrum components corresponding to the daily frequency position and the average value.
In this embodiment, the average value P of the spectrum components (P2, P3, P4 … … Pn, respectively) corresponding to other frequency positions is calculated, and the difference between P1 and P is calculated and is denoted as P1c。
Step S105, calculating a standard deviation of the spectral component corresponding to the daily frequency position and the spectral components corresponding to the other frequency positions.
In this embodiment, the standard deviation of the daily frequency position corresponding spectrum component P1 and the other frequency position corresponding spectrum components P2, P3, P4 … … Pn is further calculated and denoted as P.
And S106, if the difference is larger than or equal to the standard deviation of a preset multiple, determining that the index to be detected is a periodic significant index.
In this embodiment, the preset multiple is based onActually, it is necessary to set, for example, to 25, i.e., compare PcWhether greater than or equal to 25 times P. If PcAnd if the P is more than or equal to 25 times, determining that the data to be detected is high significance data. In this embodiment, the daily frequency, i.e. the index, shows the rule of day-to-day variation, if PcIf P is larger than or equal to the preset multiple, the regularity of the index changing according to days is very strong, and therefore the index is determined to be a periodic significant index.
Further, referring to fig. 3, fig. 3 is a schematic flowchart of the step of determining the significant indicator in fig. 2. As shown in fig. 3, step S106 includes steps S1061 to S1062.
Step S1061, if the difference is greater than or equal to the standard deviation of a preset multiple, determining saturation and autocorrelation coefficients corresponding to the daily frequency position according to the frequency domain map information data.
In this embodiment, on the basis of detecting that the difference is greater than or equal to the standard deviation of the preset multiple, saturation and autocorrelation coefficients corresponding to the daily frequency position are further obtained according to the frequency domain map information data. The saturation corresponding to the daily frequency position and the autocorrelation coefficient are included in the frequency domain map information data, so that the saturation and the autocorrelation coefficient can be directly obtained from the frequency domain map information data.
Step S1062, if the saturation is greater than a first threshold and the autocorrelation coefficient is greater than a second threshold, determining that the index to be detected is a periodic significant index.
In this embodiment, it is detected whether the saturation is greater than a first threshold, and whether the autocorrelation coefficient is greater than a second threshold, and only when the saturation is greater than the first threshold and the autocorrelation coefficient is greater than the second threshold, it is determined that the indicator to be detected is a periodic significant indicator. The specific values of the first preset threshold and the second preset threshold are set according to actual needs, for example, the first preset threshold is set to 0.3, and the second preset threshold is set to 0.2. In this embodiment, on the basis of detecting that the difference is greater than or equal to the preset multiple of the standard deviation, whether the index to be detected is a periodic significant index is further determined according to the saturation corresponding to the daily frequency position and the autocorrelation coefficient, so that the type of the index to be detected is more accurately determined.
Step S20, if the index to be detected is a periodic significant index, obtaining historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point, and obtaining a plurality of historical prediction data.
In this embodiment, if the index to be detected is a periodic significant index, historical prediction data corresponding to the index to be detected at n time points before a preset time point is obtained. The size of n is set according to actual needs, for example, 10. Taking the CPU usage rate as an example, if the preset time point is a certain integer, for example, 13 points 3 month, 3 day, then obtaining a CPU usage rate predicted value 3 points 3 month, 3 day, and 4 points 3 month, … … 3 a CPU usage rate predicted value 12 days 3 month, 3 day; if the preset time point is a certain day, for example, 3 months and 13 days, the CPU utilization rate predicted value of 3 months and 3 days and the CPU utilization rate predicted value of 3 months and 4 days are obtained and … … 3 is obtained, and the CPU utilization rate predicted value of 3 months and 12 days is obtained.
In this embodiment, when a prediction model is used for a first prediction at a certain time node T1, the actual CPU utilization rates monitored by the previous 10 time nodes (n1, n2 … … n10) of T1 are obtained, the actual CPU utilization rates monitored by n1, n2 … … n10 are input to the prediction model to obtain a predicted value of a next time node T2, then the predicted values of n2 … … n10 and T2 are input to the prediction model to obtain a predicted value of the next time node T3, then the predicted values of n3 … … n10, T2 and T3 are input to the prediction model to obtain a predicted value … … of the next time node T4, that is, n real data input for the first time is obtained, and first prediction data is obtained; inputting n-1 real data and the first prediction data for the second time to obtain second prediction data; inputting n-2 real data and the first and second predicted data for the third time to obtain … … inputting 1 real data for the nth time and the first to n-1 predicted data to obtain nth predicted data; and (n + 1) th time, inputting the previous n prediction data to obtain n +1 th prediction data, and obtaining a subsequent prediction value through the previous prediction data in the subsequent time. In this embodiment, the time interval between T1 and the preset time point is far enough, so as to ensure that historical prediction data corresponding to n time points before the preset time point can be obtained.
And step S30, inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point.
In this embodiment, the prediction model is an LSTM long-short term memory network, which includes: RNN recurrent neural network and valve nodes of each layer; the valve node comprises: forgetting a valve, an input valve and an output valve;
the forgetting valve is as follows:
ft＝σ(Wf[ht-1，xt]+bf)
it＝σ(Wi[ht-1，xt]+bi)
the input valve is as follows:
after the processing of the forgetting gate and the input gate, the past memory and the current memory content are combined, and the generated value is as follows:
ot＝σ(Wo[ht-1，xt]+bo)
the output valve is as follows:
ht＝ot*tanh(Ct)
h istIs the output result of the prediction model; wherein W is weight, b is offset, ht-1Representing the last network output, xtRepresenting the current network input, Ct-1Representing the old neuronal state, CtIs a new neuronal state, ftIs a number between 0 and 1, itIs a number between 0 and 1,
is a number of-1 to 1, otIs a number between 0 and 1.
In this embodiment, the CPU utilization actually monitored in a past period of time is collected in advance, and LSTM modeling is performed according to the collected data to fit the historical trend of the index. Wherein LSTM is one-way LSTM, the loss function of training is MSE, and the optimization algorithm is ADAM. The LSTM model is established and optimally trained through a tensoflow library in Python.
In this embodiment, a plurality of historical prediction data are input into the prediction model, and a dynamic prediction result corresponding to the preset time point can be obtained. Namely, the current predicted value is obtained through the previous predicted value.
Step S40, obtaining a monitoring result of the index to be detected corresponding to the preset time point, and calculating a residual error between the dynamic prediction result and the monitoring result.
In this embodiment, the monitoring result corresponding to the index to be detected at the preset time point is a monitoring result that is actually monitored by the index to be detected at the preset time point. For example, the monitoring result of the CPU utilization at the preset time point may be directly obtained from the system information. And then, residual calculation is carried out on the dynamic prediction result and the monitoring result to obtain the residual between the dynamic prediction result and the monitoring result.
Step S50, if the residual error exceeds the preset range, recording the monitoring result into an abnormal log, and detecting whether an abnormal event exists based on the abnormal log;
in this embodiment, if the residual error between the dynamic prediction result and the monitoring result exceeds the preset range, which indicates that the difference between the current prediction result and the actually monitored result is large, it is determined that the current actually monitored result is abnormal data, and therefore the monitoring result is recorded in the abnormal log.
Further, referring to fig. 4, fig. 4 is a flowchart illustrating sub-steps of the abnormality detection method of fig. 1. As shown in fig. 4, recording the monitoring result into an abnormality log includes steps S501 to S504.
Step S501, obtaining historical monitoring data corresponding to a plurality of time points before a preset time point of the index to be detected.
In this embodiment, if it is determined that the current monitoring result is abnormal data according to the dynamic prediction result, historical monitoring data (i.e., data that has been actually monitored) corresponding to the index to be detected at a plurality of time points before the preset time point is further obtained, so as to obtain a plurality of historical monitoring data.
Step S502, inputting a plurality of historical monitoring data into a prediction model to obtain a static prediction result corresponding to the preset time point.
In this embodiment, a plurality of historical monitoring data are input into the prediction model, and a static prediction result corresponding to a preset time point (i.e., a prediction result obtained according to the actually monitored data) is obtained.
Step S503, calculating a difference between the static prediction result and the monitoring result.
In this embodiment, a residual between the static prediction result and the monitoring result is calculated (i.e., a difference between the static prediction result and the monitoring result is calculated).
Step S504, if the difference value exceeds a preset range, recording the monitoring result into an abnormal log.
In this embodiment, it is detected whether a difference between the static prediction result and the monitoring result exceeds a preset range, and if a residual between the static prediction result and the monitoring result exceeds the preset range, it is determined that the monitoring result is abnormal data, and therefore, the monitoring result is recorded in an abnormal log. In this embodiment, if the current monitoring result is determined to be abnormal data according to the dynamic prediction result (the prediction result obtained according to the prediction value), whether a difference between the static prediction result (the prediction result obtained according to the actually monitored data) and the current monitoring result exceeds a preset range is further detected, and if the difference between the static prediction result and the monitoring result also exceeds the preset range, the current monitoring result is determined to be abnormal data, and the accuracy of abnormality determination is improved through a double determination mechanism.
Further, in an embodiment, after step S503, the method further includes:
and if the difference value does not exceed the preset range, determining the monitoring result as a normal monitoring result.
In this embodiment, if the difference does not exceed the preset range, it indicates that the static prediction result is similar to the current monitoring result, and therefore, if the current monitoring result is determined to be a normal monitoring result, the monitoring result is not recorded in the abnormal log.
Further, in an embodiment, detecting whether there is an abnormal event based on the abnormal log includes:
detecting whether a time difference corresponding to two monitoring results in the abnormal log is smaller than or equal to a preset time difference; and if the time difference corresponding to the two monitoring results in the abnormal log is smaller than or equal to the preset time difference, determining that an abnormal event exists.
In this embodiment, according to the above steps, if the monitoring result corresponding to the preset time point 1 is recorded in the abnormal log, the monitoring result corresponding to the preset time point 2 is also recorded in the abnormal log, and the time difference between the preset time point 1 and the preset time point 2 is smaller than or equal to the preset time difference, which indicates that two abnormal monitoring results occur in a short time, it is determined that an abnormal event exists currently. That is, in this embodiment, if it is detected that the time difference corresponding to the two monitoring results in the abnormal log is smaller than or equal to the preset time difference, it is determined that an abnormal event exists.
And step S60, if an abnormal event exists, sending an abnormal event alarm to the operation and maintenance terminal.
In this embodiment, if an abnormal event exists, an abnormal event alarm is sent to the operation and maintenance terminal. Specifically, the operation and maintenance system can be notified to the responsible personnel in the form of mails or short messages, so that the problems of the operation and maintenance related computer hardware and system can be manually and timely checked and repaired, and the normal operation of the system can be recovered.
In this embodiment, whether the index to be detected is a periodic significant index is detected; if the index to be detected is a periodic significant index, acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point to obtain a plurality of historical prediction data; inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point; acquiring a monitoring result corresponding to the index to be detected at the preset time point, and calculating a residual error between the dynamic prediction result and the monitoring result; if the residual error exceeds a preset range, recording the monitoring result into an abnormal log, and detecting whether an abnormal event exists or not based on the abnormal log; and if the abnormal event exists, sending an abnormal event alarm to the operation and maintenance terminal. According to the method and the device, based on the prediction result and the actual monitoring result of the periodic significant indexes, the abnormality can be found in the hidden danger stage and the manual investigation is informed, so that the real system fault caused by the hidden trouble is avoided.
Further, referring to fig. 5, fig. 5 is a flowchart illustrating sub-steps of the abnormality detection method of fig. 1. As shown in fig. 5, step S60 includes steps S601 to S602.
Step S601, if there is an abnormal event, acquiring state information of each operation and maintenance terminal.
In this embodiment, an operation and maintenance terminal is equipped for each operation and maintenance person, and the operation and maintenance person operates on the operation and maintenance terminal according to the self condition to adjust the state information of the operation and maintenance terminal, where the state information includes: the method comprises the steps of busy state and idle state, and when abnormal events exist, state information of each operation and maintenance terminal is obtained. Specifically, the status information may be an identifier, for example, the obtained status information is an identifier 1, which indicates that the corresponding operation and maintenance terminal is in a busy state, and the obtained status information is an identifier 2, which indicates that the corresponding operation and maintenance terminal is in an idle state.
Step S602, based on the state information, determining a target operation and maintenance terminal in an idle state, and sending an abnormal event alarm to the target operation and maintenance terminal.
In this embodiment, according to the acquired state information of each operation and maintenance terminal, a target operation and maintenance terminal is randomly determined from the operation and maintenance terminals of which the state information is an idle state, and an abnormal event alarm is sent to the target operation and maintenance terminal, so that a human can perform troubleshooting and repair problems of operation and maintenance related computer hardware and systems at the first time, and the normal operation of the system is recovered.
Referring to fig. 6, fig. 6 is a schematic block diagram of an abnormality detection apparatus according to an embodiment of the present application, the abnormality detection apparatus being configured to perform the foregoing abnormality detection method.
As shown in fig. 6, the abnormality detection device includes:
the detection module 10 is used for detecting whether the index to be detected is a periodic significant index;
the obtaining module 20 is configured to obtain historical prediction data corresponding to the to-be-detected index at multiple time points before a preset time point if the to-be-detected index is a periodic significant index, so as to obtain multiple historical prediction data;
the prediction module 30 is configured to input a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point;
the calculation module 40 is configured to obtain a monitoring result corresponding to the to-be-detected indicator at the preset time point, and calculate a residual between the dynamic prediction result and the monitoring result;
an abnormal event detection module 50, configured to record the monitoring result into an abnormal log if the residual exceeds a preset range, and detect whether an abnormal event exists based on the abnormal log;
and the alarm module 60 is configured to send an abnormal event alarm to the operation and maintenance terminal if the abnormal event exists.
Further, in one embodiment, the detection module 10 includes:
the acquisition unit is used for acquiring historical monitoring data of the index to be detected within a preset time length;
the data processing unit is used for carrying out fast Fourier change on the historical monitoring data to obtain frequency domain map information data;
the first determining unit is used for determining the frequency spectrum component corresponding to the daily frequency position and the frequency spectrum component corresponding to other frequency positions according to the frequency domain map information data;
the calculating unit is used for calculating the average value of the frequency spectrum components corresponding to the other frequency positions and calculating the difference value between the frequency spectrum components corresponding to the daily frequency position and the average value; calculating the standard deviation of the frequency spectrum component corresponding to the daily frequency position and the frequency spectrum components corresponding to the other frequency positions;
and the second determining unit is used for determining the index to be detected as a periodic significant index if the difference value is greater than or equal to the standard deviation of a preset multiple.
Further, in an embodiment, the second determining unit includes:
the first determining subunit is configured to determine, according to the frequency domain map information data, a saturation and an autocorrelation coefficient corresponding to a daily frequency position if the difference is greater than or equal to a preset multiple of the standard deviation;
and the second determining subunit is configured to determine that the indicator to be detected is a periodic significant indicator if the saturation is greater than the first threshold and the autocorrelation coefficient is greater than the second threshold.
Further, in one embodiment, the abnormal event detection module 50 includes:
the acquisition unit is used for acquiring historical monitoring data corresponding to the index to be detected at a plurality of time points before a preset time point;
the static prediction unit is used for inputting a plurality of historical monitoring data into a prediction model to obtain a static prediction result corresponding to the preset time point;
the calculating unit is used for calculating the difference value between the static prediction result and the monitoring result;
and the recording unit is used for recording the monitoring result into an abnormal log if the difference value exceeds a preset range.
Further, in an embodiment, the abnormality detecting apparatus further includes:
and the judging module is used for determining the monitoring result as a normal monitoring result if the difference value does not exceed the preset range.
Further, in an embodiment, the abnormal event detecting module 50 further includes:
the detection unit is used for detecting whether the time difference corresponding to the two monitoring results in the abnormal log is smaller than or equal to a preset time difference;
and the abnormal event judging unit is used for determining that an abnormal event exists if the time difference corresponding to the two monitoring results in the abnormal log is less than or equal to the preset time difference.
Further, in an embodiment, the alarm module 60 includes:
the state information acquisition unit is used for acquiring the state information of each operation and maintenance terminal if an abnormal event exists;
and the alarm unit is used for determining the target operation and maintenance terminal in an idle state based on the state information and sending an abnormal event alarm to the target operation and maintenance terminal.
It should be noted that, as will be clear to those skilled in the art, for convenience and brevity of description, the specific working processes of the apparatus and the modules described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
The apparatus described above may be implemented in the form of a computer program which is executable on a computer device as shown in fig. 7.
Referring to fig. 7, fig. 7 is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device may be a server.
Referring to fig. 7, the computer device includes a processor, a memory, and a network interface connected through a system bus, wherein the memory may include a nonvolatile storage medium and an internal memory.
The non-volatile storage medium may store an operating system and a computer program. The computer program includes program instructions that, when executed, cause a processor to perform any of the anomaly detection methods.
The processor is used for providing calculation and control capability and supporting the operation of the whole computer equipment.
The internal memory provides an environment for running a computer program in the non-volatile storage medium, which when executed by the processor, causes the processor to perform any one of the anomaly detection methods.
The network interface is used for network communication, such as sending assigned tasks and the like. Those skilled in the art will appreciate that the architecture shown in fig. 7 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
It should be understood that the Processor may be a Central Processing Unit (CPU), and the Processor may be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Wherein a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
Wherein, in one embodiment, the processor is configured to run a computer program stored in the memory to implement the steps of the various embodiments of the anomaly detection method as described above.
The embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, where the computer program includes program instructions, and the processor executes the program instructions to implement any one of the abnormality detection methods provided in the embodiments of the present application.
The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, for example, a hard disk or a memory of the computer device. The computer readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like provided on the computer device.
While the invention has been described with reference to specific embodiments, the scope of the invention is not limited thereto, and those skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the invention. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. An abnormality detection method characterized by comprising:
detecting whether the index to be detected is a periodic significant index;
if the index to be detected is a periodic significant index, acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point to obtain a plurality of historical prediction data;
inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point;
acquiring a monitoring result corresponding to the index to be detected at the preset time point, and calculating a residual error between the dynamic prediction result and the monitoring result;
if the residual error exceeds a preset range, recording the monitoring result into an abnormal log, and detecting whether an abnormal event exists or not based on the abnormal log;
and if the abnormal event exists, sending an abnormal event alarm to the operation and maintenance terminal.
2. The abnormality detection method according to claim 1, wherein said detecting whether the index to be detected is a periodic significant index includes:
acquiring historical monitoring data of an index to be detected within a preset time;
carrying out fast Fourier transformation on the historical monitoring data to obtain frequency domain map information data;
determining frequency spectrum components corresponding to daily frequency positions and frequency spectrum components corresponding to other frequency positions according to the frequency domain map information data;
calculating the average value of the frequency spectrum components corresponding to the other frequency positions, and calculating the difference value between the frequency spectrum components corresponding to the daily frequency position and the average value;
calculating the standard deviation of the frequency spectrum component corresponding to the daily frequency position and the frequency spectrum components corresponding to the other frequency positions;
and if the difference is larger than or equal to the standard deviation of the preset multiple, determining that the index to be detected is a periodic significant index.
3. The abnormality detection method according to claim 2, wherein determining that the index to be detected is a periodic significant index if the difference is greater than or equal to a preset multiple of the standard deviation includes:
if the difference is larger than or equal to the standard deviation of a preset multiple, determining saturation and autocorrelation coefficients corresponding to daily frequency positions according to the frequency domain map information data;
and if the saturation is greater than a first threshold and the autocorrelation coefficient is greater than a second threshold, determining that the index to be detected is a periodic significant index.
4. The anomaly detection method according to claim 1, wherein said recording said monitoring result into an anomaly log comprises:
acquiring historical monitoring data corresponding to the index to be detected at a plurality of time points before a preset time point;
inputting a plurality of historical monitoring data into a prediction model to obtain a static prediction result corresponding to the preset time point;
calculating a difference between the static prediction result and the monitoring result;
and if the difference value exceeds a preset range, recording the monitoring result into an abnormal log.
5. The anomaly detection method according to claim 4, wherein said calculating a difference between said static prediction result and said monitoring result further comprises:
and if the difference value does not exceed the preset range, determining the monitoring result as a normal monitoring result.
6. The anomaly detection method according to claim 1, wherein said detecting whether there is an anomalous event based on said anomaly log comprises:
detecting whether a time difference corresponding to two monitoring results in the abnormal log is smaller than or equal to a preset time difference;
and if the time difference corresponding to the two monitoring results in the abnormal log is smaller than or equal to the preset time difference, determining that an abnormal event exists.
7. The method according to any one of claims 1 to 6, wherein the sending an abnormal event alarm to the operation and maintenance terminal if an abnormal event exists comprises:
if an abnormal event exists, acquiring the state information of each operation and maintenance terminal;
and determining a target operation and maintenance terminal in an idle state based on the state information, and sending an abnormal event alarm to the target operation and maintenance terminal.
8. An abnormality detection device characterized by comprising:
the detection module is used for detecting whether the index to be detected is a periodic significant index;
the acquisition module is used for acquiring historical prediction data corresponding to the index to be detected at a plurality of time points before a preset time point if the index to be detected is a periodic significant index, so as to obtain a plurality of historical prediction data;
the prediction module is used for inputting a plurality of historical prediction data into a prediction model to obtain a dynamic prediction result corresponding to the preset time point;
the calculation module is used for acquiring a monitoring result corresponding to the index to be detected at the preset time point and calculating a residual error between the dynamic prediction result and the monitoring result;
the abnormal event detection module is used for recording the monitoring result into an abnormal log if the residual error exceeds a preset range, and detecting whether an abnormal event exists or not based on the abnormal log;
and the alarm module is used for sending an abnormal event alarm to the operation and maintenance terminal if the abnormal event exists.
9. A computer device, wherein the computer device comprises a memory and a processor;
the memory is used for storing a computer program;
the processor for executing the computer program and implementing the anomaly detection method of any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, causes the processor to implement the abnormality detection method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910985364.2A CN110888788B (en) | 2019-10-16 | 2019-10-16 | Abnormality detection method, abnormality detection device, computer device, and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910985364.2A CN110888788B (en) | 2019-10-16 | 2019-10-16 | Abnormality detection method, abnormality detection device, computer device, and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110888788A true CN110888788A (en) | 2020-03-17 |
| CN110888788B CN110888788B (en) | 2024-09-10 |
Family
ID=69746238
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910985364.2A Active CN110888788B (en) | 2019-10-16 | 2019-10-16 | Abnormality detection method, abnormality detection device, computer device, and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110888788B (en) |
Cited By (40)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111178645A (en) * | 2020-04-14 | 2020-05-19 | 深圳市朝阳辉电气设备有限公司 | Power equipment abnormality detection method and device, control equipment and storage medium |
| CN111447193A (en) * | 2020-03-23 | 2020-07-24 | 网宿科技股份有限公司 | Method and device for anomaly detection of real-time data stream |
| CN111767938A (en) * | 2020-05-09 | 2020-10-13 | 北京奇艺世纪科技有限公司 | Abnormal data detection method and device and electronic equipment |
| CN111783883A (en) * | 2020-06-30 | 2020-10-16 | 平安普惠企业管理有限公司 | Abnormal data detection method and device |
| CN112202875A (en) * | 2020-09-28 | 2021-01-08 | 北京八分量信息科技有限公司 | Method and device for safety detection based on block link point weight and related product |
| CN112288021A (en) * | 2020-11-02 | 2021-01-29 | 广东柯内特环境科技有限公司 | Medical wastewater monitoring data quality control method, device and system |
| CN112346939A (en) * | 2020-11-02 | 2021-02-09 | 长沙市到家悠享网络科技有限公司 | Alarm method, device, equipment and storage medium |
| CN112463531A (en) * | 2020-11-24 | 2021-03-09 | 中国建设银行股份有限公司 | File transmission early warning method, device, equipment and storage medium |
| CN112527608A (en) * | 2020-12-10 | 2021-03-19 | 北京自如信息科技有限公司 | Alarm method and device and computer equipment |
| CN112541399A (en) * | 2020-11-19 | 2021-03-23 | 山东信通电子股份有限公司 | Transmission line monitoring control method and device |
| CN112579665A (en) * | 2020-12-10 | 2021-03-30 | 珠海格力电器股份有限公司 | Energy equipment control method and device and energy equipment |
| CN112633583A (en) * | 2020-12-29 | 2021-04-09 | 南方电网调峰调频发电有限公司 | Generator set vibration prediction method and device, computer equipment and storage medium |
| CN112800068A (en) * | 2021-02-22 | 2021-05-14 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN112882911A (en) * | 2021-02-01 | 2021-06-01 | 中电科网络空间安全研究院有限公司 | Abnormal performance behavior detection method, system, device and storage medium |
| CN113011745A (en) * | 2021-03-19 | 2021-06-22 | 中国南方电网有限责任公司 | Abnormity detection method, device, equipment and medium in power grid safety operation and maintenance |
| CN113033613A (en) * | 2021-02-26 | 2021-06-25 | 广东核电合营有限公司 | State display method and device of nuclear power equipment, computer equipment and storage medium |
| CN113110961A (en) * | 2021-04-30 | 2021-07-13 | 平安国际融资租赁有限公司 | Equipment abnormality detection method and device, computer equipment and readable storage medium |
| CN113127305A (en) * | 2021-04-22 | 2021-07-16 | 北京百度网讯科技有限公司 | Abnormality detection method and apparatus |
| CN113138875A (en) * | 2021-04-22 | 2021-07-20 | 深圳感臻科技有限公司 | Fault detection method, terminal and computer storage medium |
| CN113220648A (en) * | 2021-05-25 | 2021-08-06 | 广州绿怡信息科技有限公司 | Audio function detection method and device |
| CN113313591A (en) * | 2021-05-26 | 2021-08-27 | 中国银行股份有限公司 | Data abnormity warning method and device |
| CN113312239A (en) * | 2021-06-11 | 2021-08-27 | 腾讯云计算（北京）有限责任公司 | Data detection method, device, electronic equipment and medium |
| CN113326177A (en) * | 2021-06-17 | 2021-08-31 | 深圳前海微众银行股份有限公司 | Index anomaly detection method, device, equipment and storage medium |
| CN113420422A (en) * | 2021-05-31 | 2021-09-21 | 济南浪潮数据技术有限公司 | Alarm log proportion prediction method, system, device and medium |
| CN113448828A (en) * | 2020-03-26 | 2021-09-28 | 阿里巴巴集团控股有限公司 | Object data detection method and device, electronic equipment and computer storage medium |
| CN113590392A (en) * | 2021-06-30 | 2021-11-02 | 中国南方电网有限责任公司超高压输电公司昆明局 | Converter station equipment abnormality detection method and device, computer equipment and storage medium |
| US20210374755A1 (en) * | 2020-05-29 | 2021-12-02 | Sap Se | Unsupervised universal anomaly detection for situation handling |
| CN113746735A (en) * | 2020-05-28 | 2021-12-03 | 阿里巴巴集团控股有限公司 | Detection method, device and equipment of controller and computer storage medium |
| CN113821416A (en) * | 2021-09-18 | 2021-12-21 | 中国电信股份有限公司 | Monitoring alarm method, device, storage medium and electronic equipment |
| CN113869618A (en) * | 2020-06-30 | 2021-12-31 | 支付宝实验室(新加坡)有限公司 | Transaction detection method and device and electronic equipment |
| CN114095337A (en) * | 2020-08-10 | 2022-02-25 | 中国移动通信集团浙江有限公司 | KPI (Key Performance indicator) anomaly detection method and device, computing equipment and computer storage medium |
| CN114138617A (en) * | 2022-02-07 | 2022-03-04 | 杭州朗澈科技有限公司 | Self-learning frequency conversion monitoring method and system, electronic equipment and storage medium |
| CN114295365A (en) * | 2022-03-09 | 2022-04-08 | 深圳市信润富联数字科技有限公司 | Method, system, equipment and storage medium for monitoring pin inserting machine precision abnormity |
| CN114401494A (en) * | 2022-01-14 | 2022-04-26 | 平安壹钱包电子商务有限公司 | Short message issuing abnormity detection method and device, computer equipment and storage medium |
| CN115168154A (en) * | 2022-07-26 | 2022-10-11 | 北京优特捷信息技术有限公司 | Abnormal log detection method, device and equipment based on dynamic baseline |
| CN115334560A (en) * | 2022-08-19 | 2022-11-11 | 中国联合网络通信集团有限公司 | Method, device and equipment for monitoring base station abnormity and computer readable storage medium |
| CN115424368A (en) * | 2022-08-25 | 2022-12-02 | 武汉迪昌科技有限公司 | Unpowered grouping test method and device for motor train unit |
| CN115512813A (en) * | 2022-09-20 | 2022-12-23 | 海南金域医学检验中心有限公司 | Sample monitoring method, model training method, device and medium |
| CN117422425A (en) * | 2023-12-18 | 2024-01-19 | 国网浙江省电力有限公司宁波供电公司 | On-site potential safety hazard management method and system based on instant messaging |
| CN118094450A (en) * | 2024-04-26 | 2024-05-28 | 江苏中天互联科技有限公司 | Fault early warning method and related equipment |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106886481A (en) * | 2017-02-28 | 2017-06-23 | 深圳市华傲数据技术有限公司 | A kind of system health degree static analysis Forecasting Methodology and device |
| CN107480703A (en) * | 2017-07-21 | 2017-12-15 | 阿里巴巴集团控股有限公司 | Transaction fault detection method and device |
| CN108089962A (en) * | 2017-11-13 | 2018-05-29 | 北京奇艺世纪科技有限公司 | A kind of method for detecting abnormality, device and electronic equipment |
| CN109542740A (en) * | 2017-09-22 | 2019-03-29 | 阿里巴巴集团控股有限公司 | Method for detecting abnormality and device |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN110231447A (en) * | 2019-06-10 | 2019-09-13 | 精锐视觉智能科技（深圳）有限公司 | The method, apparatus and terminal device of water quality abnormality detection |
| US20190294485A1 (en) * | 2018-03-22 | 2019-09-26 | Microsoft Technology Licensing, Llc | Multi-variant anomaly detection from application telemetry |
-
2019
- 2019-10-16 CN CN201910985364.2A patent/CN110888788B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106886481A (en) * | 2017-02-28 | 2017-06-23 | 深圳市华傲数据技术有限公司 | A kind of system health degree static analysis Forecasting Methodology and device |
| CN107480703A (en) * | 2017-07-21 | 2017-12-15 | 阿里巴巴集团控股有限公司 | Transaction fault detection method and device |
| CN109542740A (en) * | 2017-09-22 | 2019-03-29 | 阿里巴巴集团控股有限公司 | Method for detecting abnormality and device |
| CN108089962A (en) * | 2017-11-13 | 2018-05-29 | 北京奇艺世纪科技有限公司 | A kind of method for detecting abnormality, device and electronic equipment |
| US20190294485A1 (en) * | 2018-03-22 | 2019-09-26 | Microsoft Technology Licensing, Llc | Multi-variant anomaly detection from application telemetry |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN110231447A (en) * | 2019-06-10 | 2019-09-13 | 精锐视觉智能科技（深圳）有限公司 | The method, apparatus and terminal device of water quality abnormality detection |
Cited By (56)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111447193A (en) * | 2020-03-23 | 2020-07-24 | 网宿科技股份有限公司 | Method and device for anomaly detection of real-time data stream |
| CN113448828A (en) * | 2020-03-26 | 2021-09-28 | 阿里巴巴集团控股有限公司 | Object data detection method and device, electronic equipment and computer storage medium |
| CN111178645A (en) * | 2020-04-14 | 2020-05-19 | 深圳市朝阳辉电气设备有限公司 | Power equipment abnormality detection method and device, control equipment and storage medium |
| CN111767938A (en) * | 2020-05-09 | 2020-10-13 | 北京奇艺世纪科技有限公司 | Abnormal data detection method and device and electronic equipment |
| CN111767938B (en) * | 2020-05-09 | 2023-12-19 | 北京奇艺世纪科技有限公司 | Abnormal data detection method and device and electronic equipment |
| CN113746735B (en) * | 2020-05-28 | 2023-04-28 | 阿里巴巴集团控股有限公司 | Method, device and equipment for detecting controller and computer storage medium |
| CN113746735A (en) * | 2020-05-28 | 2021-12-03 | 阿里巴巴集团控股有限公司 | Detection method, device and equipment of controller and computer storage medium |
| US11455639B2 (en) * | 2020-05-29 | 2022-09-27 | Sap Se | Unsupervised universal anomaly detection for situation handling |
| US20210374755A1 (en) * | 2020-05-29 | 2021-12-02 | Sap Se | Unsupervised universal anomaly detection for situation handling |
| CN113869618A (en) * | 2020-06-30 | 2021-12-31 | 支付宝实验室(新加坡)有限公司 | Transaction detection method and device and electronic equipment |
| CN111783883A (en) * | 2020-06-30 | 2020-10-16 | 平安普惠企业管理有限公司 | Abnormal data detection method and device |
| CN114095337A (en) * | 2020-08-10 | 2022-02-25 | 中国移动通信集团浙江有限公司 | KPI (Key Performance indicator) anomaly detection method and device, computing equipment and computer storage medium |
| CN112202875A (en) * | 2020-09-28 | 2021-01-08 | 北京八分量信息科技有限公司 | Method and device for safety detection based on block link point weight and related product |
| CN112346939A (en) * | 2020-11-02 | 2021-02-09 | 长沙市到家悠享网络科技有限公司 | Alarm method, device, equipment and storage medium |
| CN112288021B (en) * | 2020-11-02 | 2022-04-29 | 广东柯内特环境科技有限公司 | Medical wastewater monitoring data quality control method, device and system |
| CN112288021A (en) * | 2020-11-02 | 2021-01-29 | 广东柯内特环境科技有限公司 | Medical wastewater monitoring data quality control method, device and system |
| CN112541399B (en) * | 2020-11-19 | 2022-11-15 | 山东信通电子股份有限公司 | Transmission line monitoring control method and device |
| CN112541399A (en) * | 2020-11-19 | 2021-03-23 | 山东信通电子股份有限公司 | Transmission line monitoring control method and device |
| CN112463531A (en) * | 2020-11-24 | 2021-03-09 | 中国建设银行股份有限公司 | File transmission early warning method, device, equipment and storage medium |
| CN112579665A (en) * | 2020-12-10 | 2021-03-30 | 珠海格力电器股份有限公司 | Energy equipment control method and device and energy equipment |
| CN112527608A (en) * | 2020-12-10 | 2021-03-19 | 北京自如信息科技有限公司 | Alarm method and device and computer equipment |
| CN112633583A (en) * | 2020-12-29 | 2021-04-09 | 南方电网调峰调频发电有限公司 | Generator set vibration prediction method and device, computer equipment and storage medium |
| CN112882911B (en) * | 2021-02-01 | 2023-12-29 | 中电科网络空间安全研究院有限公司 | Abnormal performance behavior detection method, system, device and storage medium |
| CN112882911A (en) * | 2021-02-01 | 2021-06-01 | 中电科网络空间安全研究院有限公司 | Abnormal performance behavior detection method, system, device and storage medium |
| CN112800068A (en) * | 2021-02-22 | 2021-05-14 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN113033613A (en) * | 2021-02-26 | 2021-06-25 | 广东核电合营有限公司 | State display method and device of nuclear power equipment, computer equipment and storage medium |
| CN113011745A (en) * | 2021-03-19 | 2021-06-22 | 中国南方电网有限责任公司 | Abnormity detection method, device, equipment and medium in power grid safety operation and maintenance |
| CN113138875B (en) * | 2021-04-22 | 2022-12-06 | 深圳感臻智能股份有限公司 | Fault detection method, terminal and computer storage medium |
| CN113127305A (en) * | 2021-04-22 | 2021-07-16 | 北京百度网讯科技有限公司 | Abnormality detection method and apparatus |
| CN113138875A (en) * | 2021-04-22 | 2021-07-20 | 深圳感臻科技有限公司 | Fault detection method, terminal and computer storage medium |
| CN113110961A (en) * | 2021-04-30 | 2021-07-13 | 平安国际融资租赁有限公司 | Equipment abnormality detection method and device, computer equipment and readable storage medium |
| CN113220648A (en) * | 2021-05-25 | 2021-08-06 | 广州绿怡信息科技有限公司 | Audio function detection method and device |
| CN113313591A (en) * | 2021-05-26 | 2021-08-27 | 中国银行股份有限公司 | Data abnormity warning method and device |
| CN113420422B (en) * | 2021-05-31 | 2023-04-07 | 济南浪潮数据技术有限公司 | Alarm log proportion prediction method, system, device and medium |
| CN113420422A (en) * | 2021-05-31 | 2021-09-21 | 济南浪潮数据技术有限公司 | Alarm log proportion prediction method, system, device and medium |
| CN113312239B (en) * | 2021-06-11 | 2024-03-15 | 腾讯云计算（北京）有限责任公司 | Data detection method, device, electronic equipment and medium |
| CN113312239A (en) * | 2021-06-11 | 2021-08-27 | 腾讯云计算（北京）有限责任公司 | Data detection method, device, electronic equipment and medium |
| CN113326177B (en) * | 2021-06-17 | 2024-07-26 | 深圳前海微众银行股份有限公司 | Index anomaly detection method, device, equipment and storage medium |
| CN113326177A (en) * | 2021-06-17 | 2021-08-31 | 深圳前海微众银行股份有限公司 | Index anomaly detection method, device, equipment and storage medium |
| CN113590392A (en) * | 2021-06-30 | 2021-11-02 | 中国南方电网有限责任公司超高压输电公司昆明局 | Converter station equipment abnormality detection method and device, computer equipment and storage medium |
| CN113590392B (en) * | 2021-06-30 | 2024-04-02 | 中国南方电网有限责任公司超高压输电公司昆明局 | Converter station equipment abnormality detection method, device, computer equipment and storage medium |
| CN113821416A (en) * | 2021-09-18 | 2021-12-21 | 中国电信股份有限公司 | Monitoring alarm method, device, storage medium and electronic equipment |
| CN114401494A (en) * | 2022-01-14 | 2022-04-26 | 平安壹钱包电子商务有限公司 | Short message issuing abnormity detection method and device, computer equipment and storage medium |
| CN114401494B (en) * | 2022-01-14 | 2023-05-26 | 平安壹钱包电子商务有限公司 | Short message issuing abnormality detection method, device, computer equipment and storage medium |
| CN114138617B (en) * | 2022-02-07 | 2022-05-24 | 杭州朗澈科技有限公司 | Self-learning frequency conversion monitoring method and system, electronic equipment and storage medium |
| CN114138617A (en) * | 2022-02-07 | 2022-03-04 | 杭州朗澈科技有限公司 | Self-learning frequency conversion monitoring method and system, electronic equipment and storage medium |
| CN114295365A (en) * | 2022-03-09 | 2022-04-08 | 深圳市信润富联数字科技有限公司 | Method, system, equipment and storage medium for monitoring pin inserting machine precision abnormity |
| CN115168154B (en) * | 2022-07-26 | 2023-06-23 | 北京优特捷信息技术有限公司 | Abnormal log detection method, device and equipment based on dynamic baseline |
| CN115168154A (en) * | 2022-07-26 | 2022-10-11 | 北京优特捷信息技术有限公司 | Abnormal log detection method, device and equipment based on dynamic baseline |
| CN115334560B (en) * | 2022-08-19 | 2024-05-07 | 中国联合网络通信集团有限公司 | Base station abnormality monitoring method, device, equipment and computer readable storage medium |
| CN115334560A (en) * | 2022-08-19 | 2022-11-11 | 中国联合网络通信集团有限公司 | Method, device and equipment for monitoring base station abnormity and computer readable storage medium |
| CN115424368A (en) * | 2022-08-25 | 2022-12-02 | 武汉迪昌科技有限公司 | Unpowered grouping test method and device for motor train unit |
| CN115512813A (en) * | 2022-09-20 | 2022-12-23 | 海南金域医学检验中心有限公司 | Sample monitoring method, model training method, device and medium |
| CN117422425A (en) * | 2023-12-18 | 2024-01-19 | 国网浙江省电力有限公司宁波供电公司 | On-site potential safety hazard management method and system based on instant messaging |
| CN117422425B (en) * | 2023-12-18 | 2024-04-30 | 国网浙江省电力有限公司宁波供电公司 | On-site potential safety hazard management method and system based on instant messaging |
| CN118094450A (en) * | 2024-04-26 | 2024-05-28 | 江苏中天互联科技有限公司 | Fault early warning method and related equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110888788B (en) | 2024-09-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110888788B (en) | Abnormality detection method, abnormality detection device, computer device, and storage medium | |
| US10402511B2 (en) | System for maintenance recommendation based on performance degradation modeling and monitoring | |
| Hu et al. | Cause-effect analysis of industrial alarm variables using transfer entropies | |
| US7702485B2 (en) | Method and apparatus for predicting remaining useful life for a computer system | |
| CN111045894B (en) | Database abnormality detection method, database abnormality detection device, computer device and storage medium | |
| US9218570B2 (en) | Determining an anomalous state of a system at a future point in time | |
| US11165799B2 (en) | Anomaly detection and processing for seasonal data | |
| US8949676B2 (en) | Real-time event storm detection in a cloud environment | |
| CN112162878A (en) | Database fault discovery method and device, electronic equipment and storage medium | |
| CN112732983A (en) | Data detection method and device based on artificial intelligence, server and storage medium | |
| US10379146B2 (en) | Detecting non-technical losses in electrical networks based on multi-layered statistical techniques from smart meter data | |
| US20210224699A1 (en) | Building time series based prediction / forecast model for a telecommunication network | |
| US9244711B1 (en) | Virtual machine capacity planning | |
| Quevedo et al. | Combining learning in model space fault diagnosis with data validation/reconstruction: Application to the Barcelona water network | |
| EP2613263B1 (en) | Operations management device, operations management method, and program | |
| De Oca et al. | A cusum change-point detection algorithm for non-stationary sequences with application to data network surveillance | |
| US10904126B2 (en) | Automated generation and dynamic update of rules | |
| EP2975564A1 (en) | Warranty cost estimation based on computing a projected number of failures of products | |
| CN114978956A (en) | Method and device for detecting abnormal performance mutation points of network equipment in smart city | |
| CN114528190A (en) | Single index abnormality detection method and device, electronic equipment and readable storage medium | |
| JPWO2017150286A1 (en) | System analysis apparatus, system analysis method, and program | |
| CN108334427A (en) | Method for diagnosing faults in storage system and device | |
| CN113221096A (en) | Method and system for analyzing correlation of random events in chaotic engineering | |
| CN110458713B (en) | Model monitoring method, device, computer equipment and storage medium | |
| US20230308461A1 (en) | Event-Based Machine Learning for a Time-Series Metric |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |