Summary of the invention
This specification one or more embodiment describes a kind of abnormal movement detection method and device based on many index, energyIt is enough effectively to merge many index, better detection effect is provided.
In a first aspect, providing a kind of abnormal movement detection method based on many index, method includes:
Obtain the time series data of many index of the system in current time period；
According to the time series data of many index, timing image is generated, the timing image includes a plurality of timing curve,The corresponding Xiang Zhibiao of every timing curve；
Using the timing image as the input of neural network model trained in advance, pass through the neural network modelWhether output obtains system in current time period abnormal.
In a kind of possible embodiment, the when ordinal number of many index for obtaining the system in current time periodAccording to, comprising:
The number of data, every preset time period at the beginning of many index of system in acquisition current time periodAccording to the data of, finish time.
In a kind of possible embodiment, the time series data according to many index generates timing image, packetIt includes:
The many index is sorted according to preset rules；
According to the time series data of indices in many index, the corresponding timing curve of indices is generated；
The corresponding timing curve of indices is added in piece image in ranked order, obtains timing image.
It is further, described that many index sorts according to preset rules, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index pointFor first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers toThe possible value of target is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, to the time series data of the second class indexIt averages, according to the corresponding average value of indices, many index is sorted.
Further, it is corresponding to generate indices for the time series data according to indices in many indexTiming curve, comprising:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index pointFor first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers toThe possible value of target is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, after taking logarithm with the time series data of the indexValue is ordinate, obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is obtained for the second class index in indices using the time as horizontal axisTo the corresponding timing curve of the index.
In a kind of possible embodiment, the neural network model includes convolutional neural networks CNN, the CNN'sConvolution kernel includes the matrix of N row N column, wherein and N >=2.
Further, the element of a wherein column for the matrix is all 1, remaining element is all 0.
Further, the element of wherein a line of the matrix is all 1, remaining element is all 0.
In a kind of possible embodiment, the neural network model is trained in the following way:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked eventHinder section；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, whether it regard subgraph as the neural network mould extremelyThe sample label of type is trained the neural network model.
It is further, described that the training is divided into multiple subgraphs with timing image, comprising:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along that time shaft intercepted length is the length of windowOne subgraph；
Initial position is updated according to preset progressive window, is opened from the training with the initial position of timing imageBegin, is the second subgraph of the length of window along time shaft intercepted length.
Second aspect, provides a kind of alteration detecting device based on many index, and device includes:
Acquiring unit, the time series data of many index for obtaining the system in current time period；
Generation unit, the time series data of many index for being obtained according to the acquiring unit generate timing image, instituteStating timing image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve；
Detection unit, the timing image for generating the generation unit is as neural network model trained in advanceWhether abnormal input obtains system in current time period by the output of the neural network model.
The third aspect provides a kind of computer readable storage medium, is stored thereon with computer program, when the calculatingWhen machine program executes in a computer, enable computer execute first aspect method.
Fourth aspect provides a kind of calculating equipment, including memory and processor, and being stored in the memory can holdLine code, when the processor executes the executable code, the method for realizing first aspect.
The method and apparatus provided by this specification embodiment, the system in acquisition current time period is multinomial firstThe time series data of index generates timing image then according to the time series data of many index, and the timing image includes moreTiming curve, the corresponding Xiang Zhibiao of every timing curve, finally using the timing image as the neural network trained in advanceWhether abnormal the input of model obtains system in current time period by the output of the neural network model.ThereforeUnusual fluctuation detection processing is carried out by image recognition, can effectively merge many index, better detection effect is provided.
Specific embodiment
With reference to the accompanying drawing, the scheme provided this specification is described.
Fig. 1 is the implement scene schematic diagram of one embodiment that this specification discloses.The implement scene is related to based on multinomialThe unusual fluctuation of index detects.In the embodiment, using depth convolutional neural networks (convolutional neural networks,CNN) model is as unusual fluctuation identification model, wherein is related to the training process to depth CNN model, and utilizes trained depthSpend the prediction process of CNN model.It is understood that need to construct training set in the training process of depth CNN model,Be exactly timing image and system whether Yi Chang corresponding relationship, timing image can be time sequence image data, according to many indexTime series data can be generated the timing image including a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve.Utilize instructionDuring the prediction for the depth CNN model perfected, also to be generated according to the time series data of many index includes a plurality of timing curveTiming image, whether every timing curve corresponding Xiang Zhibiao abnormal by trained depth CNN model output system,The result for namely whether needing to alarm.Wherein, either in the training process, or during prediction, in timing imageIn a plurality of timing curve to guarantee certain sequence, that is to say, that sequence of many index in timing image can not arbitrarily changeBecome, will pass through trained depth CNN model, according to the correlation between many index, whether output system is abnormal.
Fig. 2 shows the abnormal movement detection method flow charts based on many index according to one embodiment, and this method can be with baseIn application scenarios shown in FIG. 1.As shown in Fig. 2, the abnormal movement detection method in the embodiment based on many index includes following stepIt is rapid: step 21, to obtain the time series data of many index of the system in current time period；Step 22, according to the multinomial fingerTarget time series data generates timing image, and the timing image includes a plurality of timing curve, and every timing curve corresponding one refers toMark；Step 23, using the timing image as the input of neural network model trained in advance, pass through the neural network modelOutput whether obtain in current time period system abnormal.The specific executive mode of above each step is described below.
First in step 21, the time series data of many index of the system in current time period is obtained.It is understood thatIt is in this specification embodiment, to obtain the time series data of indices, that is to say, that obtain indices when multipleCarve corresponding data (i.e. index value).Wherein, above-mentioned many index specifically includes which index this specification embodiment does not limitIt is fixed, for example, can be, but not limited to comprising response time, handling capacity, resource utilization etc..
In one example, obtain current time period in system many index at the beginning of data, everyData, the data of finish time of preset time period.For example, the time series data of many index obtained can be as shown in Table 1.
Table one: the time series data list of many index
| Index name | Time point | Index value |
| Dim1 | 2018-01-01 00:00:00 | 50 |
| Dim1 | 2018-01-01 00:01:00 | 56 |
| … | … | … |
| Dim2 | 2018-01-01 00:00:00 | 98 |
| Dim2 | 2018-01-01 00:01:00 | 108 |
| … | … | … |
| Dim_N | 2018-01-01 00:00:00 | 502 |
| … | … | … |
Referring to table one, one shares N number of index, each index from the outset between to end time, 1 data per minute, total MData.
Then timing image is generated according to the time series data of many index in step 22, the timing image includesA plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve.It is understood that individually dividing with common each timing curveAnalysis is different, in this specification embodiment, by generating the timing image comprising a plurality of timing curve, by timing image analysisTo determine that whether extremely system, is conducive to merge multi objective, provides better detection effect.
In one example, many index is sorted according to preset rules；Referred to according to items in many indexTarget time series data generates the corresponding timing curve of indices；By the corresponding timing curve of indices by suitable after sequenceSequence is added in piece image, obtains timing image.For example, the horizontal axis of timing curve represents the time, the longitudinal axis represents index value, willThe corresponding timing curve of indices in ranked order, is sequentially overlaid in piece image along y direction, obtains timingImage.
Further, the described many index sorts according to preset rules can be in the following way: according to describedThe many index is divided into first kind index and by the possibility value of indices and the relationship of preset threshold in many indexTwo class indexs；The possibility value of the first kind index is all larger than preset threshold, and the possibility value of the second class index is smallIn preset threshold；It averages after taking logarithm to the time series data of the first kind index, to the timing of the second class indexData are averaged, and according to the corresponding average value of indices, many index is sorted.
Wherein, above-mentioned preset threshold can be 1, and above-mentioned first kind index can have exhausted for response time, handling capacity etc.The index of logarithm, for example, the response time is 1ms, above-mentioned second class index can have relative value for resource utilization etc.Index, for example, resource utilization be 30%.
It should be noted that in other words, being sorted and being advised using different timing curves using different index ordering rulesThen, it but substantially only has modified and puts in order, be considered as consistent with this programme.
Further, it is corresponding to generate indices for the time series data according to indices in many indexTiming curve, can be in the following way: according to the possibility value of indices in many index and the pass of preset thresholdSystem, is divided into first kind index and the second class index for many index；The possibility value of the first kind index is all larger than pre-If threshold value, the possibility value of the second class index is respectively less than preset threshold；For the first kind index in indices, with whenBetween be horizontal axis, the value after taking logarithm using the time series data of the index obtains the corresponding timing curve of the index as ordinate；ForThe second class index in indices, using the time series data of the index as ordinate, it is corresponding to obtain the index using the time as horizontal axisTiming curve.
Finally in step 23, using the timing image as the input of neural network model trained in advance, by describedWhether the output of neural network model obtains system in current time period abnormal.It is understood that above-mentioned neural network mouldType can be various image recognition models, such as can use the structure of ResNet.
In one example, the neural network model includes convolutional neural networks CNN, and the convolution kernel of the CNN includes NThe matrix of row N column, wherein N >=2.
For above-mentioned convolution kernel, in addition to common 3*3 convolution kernel, this specification embodiment also proposed level(horizontal) convolution kernel, vertical (vertical) convolution kernel.
Horizontal (horizontal) convolution kernel, the element of wherein a line of matrix are all 1, remaining element is all 0.For example,Convolution kernel shown in the b in a or Fig. 3 in Fig. 3, convolution kernel are the images of a 4*4, each cell indicates pixel,It is used as and is inputted using every row, for example be all 1 pixel in Fig. 3.
The element of vertically (vertical) convolution kernel, a wherein column for matrix is all 1, remaining element is all 0.For example, Fig. 4In a or Fig. 4 in b shown in convolution kernel, convolution kernel is the image of a 4*4, each cell indicates pixel, is usedEach column is used as input, for example 1 pixel is all in Fig. 4.
It is understood that being directed to different abnormality detection scenes, different convolution kernels can be used.
In one example, the neural network model is trained in the following way: being obtained comprising a plurality of timing curveTraining timing image, the training timing image includes marked fault section；The training timing image is drawnIt is divided into multiple subgraphs；According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；Described in subgraph is used asThe sample characteristics of neural network model, by subgraph whether the sample label extremely as the neural network model, to the mindIt is trained through network model.
Fig. 5 is a kind of schematic diagram trained with timing image that this specification embodiment provides.The N number of index that will acquireTime series data takes log, and horizontal axis is time, 0 corresponding initial time, horizontal axis maximum value corresponding termination time, after index is according to log is takenAverage value size sequence, generate timing image shown in fig. 5.Referring to Fig. 5, which includes two timing curves, in rectangle frameIn be not meet expected curve caused by occurring as failure to fluctuate.
Further, described that the training is divided into multiple subgraphs with timing image, it can be in the following way: according toSubgraph number to be obtained, determines the length of window of each subgraph；Since the training is with the coordinate origin of timing image, along whenBetween axis intercepted length be the length of window the first subgraph；Initial position is updated according to preset progressive window, from instituteThe initial position for stating training timing image starts, and is the second subgraph of the length of window along time shaft intercepted length.
For example, construction includes the training set of multiple subgraphs in the following way:
Select length of window M and progressive window B, wherein length of window M < image length, by the trained used time shown in fig. 5Sequence image is many subgraphs along horizontal axis cutting, such as: M=10 (length of each subgraph is 10000/10=1000), B=500,The subgraph then obtained after cutting can be as shown in Figure 6.
If subgraph contains fault time point, which is flagged as abnormal subgraph, and corresponding relationship can be withAs shown in Table 2.
Table two: subgraph whether be abnormal subgraph mapping table
| Subgraph serial number | Whether abnormal subgraph |
| 1 | 0 |
| 2 | 0 |
Obviously, the subgraph comprising fault time point is exactly failure subgraph, for example, being exactly failure shaped like subgraph as Fig. 7Subgraph.
After being trained by above-mentioned subgraph to neural network model, so that it may utilize the neural network model root after trainingJudge whether system is abnormal according to timing image, thus successfully by time series forecasting Task Switching at image recognition tasks.
The method provided by this specification embodiment obtains many index of the system in current time period firstTime series data generates timing image, the timing image includes a plurality of timing then according to the time series data of many indexCurve, the corresponding Xiang Zhibiao of every timing curve, finally using the timing image as neural network model trained in advanceWhether abnormal input obtains system in current time period by the output of the neural network model.Therefore by figureAs identifying to carry out unusual fluctuation detection processing, many index can be effectively merged, better detection effect is provided.
According to the embodiment of another aspect, a kind of alteration detecting device based on many index is also provided, which is used forExecute the abnormal movement detection method based on many index that this specification embodiment provides.Fig. 8 shows the base according to one embodimentIn the schematic block diagram of the alteration detecting device of many index.As shown in figure 8, the device 800 includes:
Acquiring unit 81, the time series data of many index for obtaining the system in current time period；
Generation unit 82, the time series data of many index for being obtained according to the acquiring unit 81 generate timing diagramPicture, the timing image include a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve；
Detection unit 83, the timing image for generating the generation unit 82 is as neural network mould trained in advanceWhether abnormal the input of type obtains system in current time period by the output of the neural network model.
Optionally, as one embodiment, the acquiring unit 81, specifically for obtaining the system in current time periodMany index at the beginning of data, the data of every preset time period, the data of finish time.
Optionally, as one embodiment, the generation unit 82 includes:
Sorting subunit, for many index to sort according to preset rules；
Subelement is generated, for the time series data according to indices in many index, it is corresponding to generate indicesTiming curve；
It is superimposed subelement, the corresponding timing curve of indices for generating the generation subelement, by the rowLaminated structure after the sequence of sequence subelement obtains timing image into piece image.
Further, the sorting subunit, is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index pointFor first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers toThe possible value of target is respectively less than preset threshold；
It averages after taking logarithm to the time series data of the first kind index, to the time series data of the second class indexIt averages, according to the corresponding average value of indices, many index is sorted.
Further, the generation subelement, is specifically used for:
According to the possibility value of indices in many index and the relationship of preset threshold, by many index pointFor first kind index and the second class index；The possibility value of the first kind index is all larger than preset threshold, and second class refers toThe possible value of target is respectively less than preset threshold；
For the first kind index in indices, using the time as horizontal axis, after taking logarithm with the time series data of the indexValue is ordinate, obtains the corresponding timing curve of the index；
It, using the time series data of the index as ordinate, is obtained for the second class index in indices using the time as horizontal axisTo the corresponding timing curve of the index.
Optionally, as one embodiment, the neural network model includes convolutional neural networks CNN, the volume of the CNNProduct core includes the matrix of N row N column, wherein and N >=2.
Further, the element of a wherein column for the matrix is all 1, remaining element is all 0.
Further, the element of wherein a line of the matrix is all 1, remaining element is all 0.
Optionally, as one embodiment, described device further include:
Training unit, for being trained in the following way to the neural network model:
The training timing image comprising a plurality of timing curve is obtained, the training timing image includes marked eventHinder section；
The training is divided into multiple subgraphs with timing image；
According to whether including partial fault section in subgraph, mark the subgraph whether abnormal；
Using subgraph as the sample characteristics of the neural network model, whether it regard subgraph as the neural network mould extremelyThe sample label of type is trained the neural network model.
Further, the training unit is used to the training being divided into multiple subgraphs with timing image, comprising:
According to subgraph number to be obtained, the length of window of each subgraph is determined；
Since the training is with the coordinate origin of timing image, along that time shaft intercepted length is the length of windowOne subgraph；
Initial position is updated according to preset progressive window, is opened from the training with the initial position of timing imageBegin, is the second subgraph of the length of window along time shaft intercepted length.
The device provided by this specification embodiment, first acquiring unit 81 obtain the system in current time periodThe time series data of many index, then generation unit 82 generates timing image according to the time series data of many index, describedTiming image includes a plurality of timing curve, the corresponding Xiang Zhibiao of every timing curve, and last detection unit 83 is by the timing diagramAs the input as neural network model trained in advance, current time period is obtained by the output of the neural network modelWhether interior system is abnormal.Therefore unusual fluctuation detection processing is carried out by image recognition, it can effectively merge multinomial fingerMark, provides better detection effect.
According to the embodiment of another aspect, a kind of computer readable storage medium is also provided, is stored thereon with computer journeySequence enables computer execute method described in conjunction with Figure 2 when the computer program executes in a computer.
According to the embodiment of another further aspect, a kind of calculating equipment, including memory and processor, the memory are also providedIn be stored with executable code, when the processor executes the executable code, realize method described in conjunction with Figure 2.
Those skilled in the art are it will be appreciated that in said one or multiple examples, function described in the inventionIt can be realized with hardware, software, firmware or their any combination.It when implemented in software, can be by these functionsStorage in computer-readable medium or as on computer-readable medium one or more instructions or code transmitted.
Above-described specific embodiment has carried out further the purpose of the present invention, technical scheme and beneficial effectsIt is described in detail, it should be understood that being not intended to limit the present invention the foregoing is merely a specific embodiment of the inventionProtection scope, all any modification, equivalent substitution, improvement and etc. on the basis of technical solution of the present invention, done should allIncluding within protection scope of the present invention.