技术领域Technical field
本申请涉及运维数据处理技术领域，特别涉及一种基于时序预测的异常检测方法、装置、设备及介质。This application relates to the technical field of operation and maintenance data processing, and in particular to an anomaly detection method, device, equipment and medium based on time series prediction.
背景技术Background technique
近年来，随着互联网技术的蓬勃发展，用户越来越普遍地通过终端接入互联网办理各种业务，业务规模持续高速成长，业务迭代快，逻辑复杂，关联服务多，当某一业务出现异常情况时，极易发生业务系统的故障或崩溃，因此，业务指标异常检测技术愈发受到相关人员的关注。In recent years, with the vigorous development of Internet technology, users have increasingly accessed the Internet through terminals to handle various services. The business scale has continued to grow rapidly, business iteration is fast, logic is complex, and there are many related services. When a certain business is abnormal, In this situation, business system failure or collapse is very easy to occur. Therefore, business indicator anomaly detection technology has attracted more and more attention from relevant personnel.
目前，传统的异常检测模型中，每个业务指标的监控阈值均为静态阈值，经常在业务正常运行时出现误报的现象，使得业务开发人员在日常运维中对异常告警失去敏感度，误报率较高；另外，由于每个业务指标的监控阈值均为静态阈值，业务开发人员为每个指标单独设置静态阈值的工作量大，人力成本高；还有，由于传统的异常检测模型在业务出现数据量级的数据波动现象时，极易出现误报的现象。Currently, in the traditional anomaly detection model, the monitoring threshold of each business indicator is a static threshold. False alarms often occur when the business is running normally, causing business developers to lose sensitivity to abnormal alarms in daily operation and maintenance. The reporting rate is high; in addition, because the monitoring thresholds of each business indicator are static thresholds, business developers have a heavy workload and high labor costs to set static thresholds for each indicator separately; also, because the traditional anomaly detection model is When business experiences data fluctuations on a data level, false positives are very likely to occur.
因此，现有技术存在的问题还亟需解决和优化。Therefore, the problems existing in the existing technology still need to be solved and optimized urgently.
发明内容Contents of the invention
为解决上述技术问题的至少之一，本申请提供了一种基于时序预测的异常检测方法、装置、设备及介质，其中，该异常检测方法可以有效减少业务的异常误报现象，有效提高业务异常告警的准确率，以及，有效减少人员的工作量。In order to solve at least one of the above technical problems, the present application provides an anomaly detection method, device, equipment and medium based on timing prediction. The anomaly detection method can effectively reduce the abnormal false alarm phenomenon of business and effectively improve business anomalies. The accuracy of the alarm can effectively reduce the workload of personnel.
根据本申请的第一方面，提供了基于时序预测的异常检测方法，包括：According to the first aspect of this application, an anomaly detection method based on time series prediction is provided, including:
获取待异常检测的原始序列数据集和预设的历史时间阈值，所述原始序列数据集包括多个原始序列数据；Obtain an original sequence data set to be anomaly detected and a preset historical time threshold, where the original sequence data set includes multiple original sequence data;
根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，所述基线数据集包括多个基线数据，每个基线数据对应不同的时间序列；According to the historical time threshold, perform data prediction processing on the original sequence data set to obtain a baseline data set, where the baseline data set includes multiple baseline data, each baseline data corresponding to a different time series;
根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，所述相似序列数据集包括多个序列相似度，所述序列相似度用于记录所述基线数据，与对应的所述原始序列数据之间的相似度；According to the baseline data set, the original sequence data set is subjected to normalized similarity processing to obtain a similar sequence data set. The similar sequence data set includes multiple sequence similarities, and the sequence similarity is used to record the baseline. Data, the similarity between the corresponding original sequence data;
根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，所述形状变换数据集用于记录所有所述基线数据与对应的所述原始序列数据之间的形状变换量；According to the similar sequence data set, perform shape transformation processing on the original sequence data set and the baseline data set to obtain a shape transformation data set. The shape transformation data set is used to record all the baseline data and all corresponding The amount of shape transformation between the original sequence data;
对所述形状变换数据集进行基准化处理，得到基准变化集，所述基准变化集包括多个基准变化量；Perform benchmarking processing on the shape transformation data set to obtain a benchmark change set, where the benchmark change set includes a plurality of benchmark changes;
根据所有所述基准变化量，对所述形状变换数据集进行检测处理，得到与所述原始序列数据集对应的异常检测结果。According to all the reference changes, the shape transformation data set is detected and processed, and an anomaly detection result corresponding to the original sequence data set is obtained.
进一步地，在本申请实施例中，所述根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，包括：Further, in this embodiment of the present application, the original sequence data set is subjected to data prediction processing according to the historical time threshold to obtain a baseline data set, including:
获取预设的置信区间；Get the preset confidence interval;
根据所述历史时间阈值，对所述原始序列数据集进行筛选处理，得到第一基础数据集；According to the historical time threshold, filter the original sequence data set to obtain a first basic data set;
根据所述置信区间，对所述第一基础数据集进行数据预处理，得到第二基础数据集；According to the confidence interval, perform data preprocessing on the first basic data set to obtain a second basic data set;
对所述第二基础数据集进行时间序列预测处理，得到所述基线数据集。Perform time series prediction processing on the second basic data set to obtain the baseline data set.
进一步地，在本申请实施例中，所述根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，包括：Further, in the embodiment of the present application, the original sequence data set is subjected to normalized similarity processing according to the baseline data set to obtain a similar sequence data set, including:
对所述基线数据集进行第一归一化处理，得到第一中间数据集；Perform a first normalization process on the baseline data set to obtain a first intermediate data set;
对所述原始序列数据集进行第二归一化处理，得到第二中间数据集；Perform a second normalization process on the original sequence data set to obtain a second intermediate data set;
对所述第一中间数据集和所述第二中间数据集进行余弦相似处理，得到所述相似序列数据集。Cosine similarity processing is performed on the first intermediate data set and the second intermediate data set to obtain the similar sequence data set.
进一步地，在本申请实施例中，所述根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，包括：Further, in the embodiment of the present application, the shape transformation process is performed on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, including:
根据所述基线数据集中的当前基线数据，确定与所述当前基线数据对应的当前序列相似度，以及，当前原始序列数据；According to the current baseline data in the baseline data set, determine the current sequence similarity corresponding to the current baseline data, and the current original sequence data;
对所述当前基线数据和所述当前原始序列数据进行偏差处理，得到第一差值；Perform deviation processing on the current baseline data and the current original sequence data to obtain a first difference;
根据所述当前序列相似度，对所述第一差值进行乘积处理，得到所述形状变换量；According to the current sequence similarity, perform product processing on the first difference to obtain the shape transformation amount;
返回根据所述基线数据中的当前基线数据，确定与所述当前基线数据对应的当前序列相似度，以及，当前原始序列数据这一步骤，直至所述基线数据集中的所有基线数据均已处理过；Return to the step of determining the current sequence similarity corresponding to the current baseline data and the current original sequence data based on the current baseline data in the baseline data until all baseline data in the baseline data set have been processed ;
对所有所述形状变换量进行整合处理，得到所述形状变换数据集。All the shape transformation amounts are integrated to obtain the shape transformation data set.
进一步地，在本申请实施例中，所述对所述形状变换数据集进行基准化处理，得到基准变化集，包括：Further, in the embodiment of the present application, the benchmarking process is performed on the shape transformation data set to obtain a benchmark change set, including:
对所述形状变换数据集进行变点检测处理，得到变点检测结果；Perform change point detection processing on the shape transformation data set to obtain a change point detection result;
根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集。According to the change point detection result, cluster analysis processing is performed on the shape transformation data set to obtain the reference change set.
进一步地，在本申请实施例中，所述根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集，包括：Further, in the embodiment of the present application, cluster analysis is performed on the shape transformation data set according to the change point detection result to obtain the reference change set, which includes:
若所述变点检测结果为否，则对所述形状变换数据集进行第一聚类处理，得到多个第一聚类簇；If the change point detection result is negative, perform a first clustering process on the shape transformation data set to obtain a plurality of first clusters;
对每个第一聚类簇进行第二均值处理，得到所述基准变化集。Perform second mean processing on each first cluster to obtain the baseline change set.
进一步地，在本申请实施例中，所述根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集，包括：Further, in the embodiment of the present application, cluster analysis is performed on the shape transformation data set according to the change point detection result to obtain the reference change set, which includes:
若所述变点检测结果为是，则获取预设的序列阈值；If the change point detection result is yes, obtain the preset sequence threshold;
根据所述序列阈值，对所述形状变换数据集进行二次变换处理，得到第二变换数据集；According to the sequence threshold, perform a secondary transformation process on the shape transformation data set to obtain a second transformation data set;
对所述第二变换数据集进行第二聚类处理，得到多个第二聚类簇；Perform a second clustering process on the second transformed data set to obtain a plurality of second clusters;
对每个第二聚类簇进行第二均值处理，得到所述基准变化集。Perform second mean processing on each second cluster to obtain the baseline change set.
根据本申请的第二方面，提供了一种基于时序预测的异常检测系统，包括：According to the second aspect of the present application, an anomaly detection system based on time series prediction is provided, including:
获取模块，用于获取待异常检测的原始序列数据集和预设的历史时间阈值，所述原始序列数据集包括多个原始序列数据；An acquisition module, configured to acquire an original sequence data set to be detected and a preset historical time threshold, where the original sequence data set includes multiple original sequence data;
预测模块，用于根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，所述基线数据集包括多个基线数据，每个基线数据对应不同的时间序列；A prediction module, configured to perform data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set, where the baseline data set includes multiple baseline data, each baseline data corresponding to a different time series;
相似模块，用于根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，所述相似序列数据集包括多个序列相似度，所述序列相似度用于记录所述基线数据与对应的所述原始序列数据之间的相似度；A similarity module, configured to perform normalized similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, where the similar sequence data set includes multiple sequence similarities, and the sequence similarity is expressed in Recording the similarity between the baseline data and the corresponding original sequence data;
变换模块，用于根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，所述形状变换数据集用于记录所有所述基线数据，与对应的所述原始序列数据之间的形状变换量；A transformation module, configured to perform shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, where the shape transformation data set is used to record all the baselines data, the amount of shape transformation between the corresponding original sequence data;
基准模块，用于对所述形状变换数据集进行基准化处理，得到基准变化集，所述基准变化集包括多个基准变化量；A benchmark module, configured to benchmark the shape transformation data set to obtain a benchmark change set, where the benchmark change set includes multiple benchmark changes;
检测模块，用于根据所有所述基准变化量，对所述形状变换数据集进行检测处理，得到与所述原始序列数据集对应的异常检测结果。A detection module, configured to perform detection processing on the shape transformation data set based on all the reference changes, and obtain anomaly detection results corresponding to the original sequence data set.
根据本申请的第三方面，提供了一种计算机设备，包括：According to a third aspect of the present application, a computer device is provided, including:
至少一个处理器；at least one processor;
至少一个存储器，用于存储至少一个程序；At least one memory for storing at least one program;
当所述至少一个程序被所述至少一个处理器执行，使得所述至少一个处理器实现如上述方面所述的方法。When the at least one program is executed by the at least one processor, the at least one processor implements the method described in the above aspect.
根据本申请的第四方面，提供了一种计算机可读存储介质，其中存储有处理器可执行的程序，所述处理器可执行的程序在由所述处理器执行时用于实现如上述方面所述的方法。According to a fourth aspect of the present application, a computer-readable storage medium is provided, in which a processor-executable program is stored, and the processor-executable program is used to implement the above aspects when executed by the processor. the method described.
本申请实施例提供的技术方案的有益效果是：The beneficial effects of the technical solutions provided by the embodiments of this application are:
本申请提供了一种基于时序预测的异常检测方法，包括：获取待异常检测的原始序列数据集和预设的历史时间阈值，所述原始序列数据集包括多个原始序列数据；根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，所述基线数据集包括多个基线数据，每个基线数据对应不同的时间序列；根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，所述相似序列数据集包括多个序列相似度，所述序列相似度用于记录所述基线数据与对应的所述原始序列数据之间的相似度；根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，所述形状变换数据集用于记录所有所述基线数据，与对应的所述原始序列数据之间的形状变换量对所述形状变换数据集进行基准化处理，得到基准变化集，所述基准变化集包括多个基准变化量；根据所有所述基准变化量，对所述形状变换数据集进行检测处理，得到与所述原始序列数据集对应的异常检测结果。该异常检测方法可以有效减少业务的异常误报现象，有效提高业务异常告警的准确率，以及，有效减少人员的工作量。This application provides an anomaly detection method based on time series prediction, which includes: obtaining an original sequence data set to be anomaly detected and a preset historical time threshold. The original sequence data set includes multiple original sequence data; according to the history time threshold, perform data prediction processing on the original sequence data set to obtain a baseline data set, the baseline data set includes multiple baseline data, each baseline data corresponds to a different time series; according to the baseline data set, all The original sequence data set is subjected to normalized similarity processing to obtain a similar sequence data set. The similar sequence data set includes multiple sequence similarities. The sequence similarity is used to record the baseline data and the corresponding original sequence data. similarity between them; according to the similar sequence data set, perform shape transformation processing on the original sequence data set and the baseline data set to obtain a shape transformation data set, and the shape transformation data set is used to record all the Baseline data, the shape transformation amount between the corresponding original sequence data, and the shape transformation data set are benchmarked to obtain a benchmark change set. The benchmark change set includes multiple benchmark changes; according to all The reference change amount is used to perform detection processing on the shape transformation data set to obtain anomaly detection results corresponding to the original sequence data set. This anomaly detection method can effectively reduce business abnormality false alarms, effectively improve the accuracy of business abnormality alarms, and effectively reduce personnel workload.
附图说明Description of the drawings
图1为本申请实施例提供的一种基于时序预测的异常检测方法的流程图；Figure 1 is a flow chart of an anomaly detection method based on timing prediction provided by an embodiment of the present application;
图2为本申请实施例提供的一种基于时序预测的异常检测方法的逻辑示意图；Figure 2 is a logical schematic diagram of an anomaly detection method based on timing prediction provided by an embodiment of the present application;
图3为本申请实施例提供的一种步骤S102的详细流程图；Figure 3 is a detailed flow chart of step S102 provided by the embodiment of the present application;
图4为本申请实施例提供的一种步骤S103的详细流程图；Figure 4 is a detailed flow chart of step S103 provided by the embodiment of the present application;
图5为本申请实施例提供的一种步骤S104的详细流程图；Figure 5 is a detailed flow chart of step S104 provided by the embodiment of the present application;
图6为本申请实施例提供的一种步骤S105的详细流程图；Figure 6 is a detailed flow chart of step S105 provided by the embodiment of the present application;
图7为本申请实施例提供的第一种步骤S1052的详细流程图；Figure 7 is a detailed flow chart of the first step S1052 provided by the embodiment of the present application;
图8为本申请实施例提供的第二种步骤S1052的详细流程图；Figure 8 is a detailed flow chart of the second step S1052 provided by the embodiment of the present application;
图9为本申请实施例提供的一种基于时序预测的异常检测系统的结构框图；Figure 9 is a structural block diagram of an anomaly detection system based on timing prediction provided by an embodiment of the present application;
图10为本申请实施例提供的一种计算机设备的结构框图。Figure 10 is a structural block diagram of a computer device provided by an embodiment of the present application.
具体实施方式Detailed ways
下面结合说明书附图和具体的实施例对本申请进行进一步的说明。所描述的实施例不应视为对本申请的限制，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。The present application will be further described below in conjunction with the accompanying drawings and specific embodiments. The described embodiments should not be regarded as limitations of this application. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.
在以下的描述中，涉及到“一些实施例”，其描述了所有可能实施例的子集，但是可以理解，“一些实施例”可以是所有可能实施例的相同子集或不同子集，并且可以在不冲突的情况下相互结合。In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or a different subset of all possible embodiments, and Can be combined with each other without conflict.
除非另有定义，本文所使用的所有的技术和科学术语与属于本申请的技术领域的技术人员通常理解的含义相同。本文中所使用的术语只是为了描述本申请实施例的目的，不是旨在限制本申请。Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.
目前，传统的异常检测模型中，每个业务指标的监控阈值均为静态阈值，经常在业务正常运行时出现误报的现象，使得业务开发人员在日常运维中对异常告警失去敏感度，误报率较高；另外，由于每个业务指标的监控阈值均为静态阈值，业务开发人员为每个指标单独设置静态阈值的工作量大，人力成本高；还有，由于传统的异常检测模型在业务出现数据量级的数据波动现象时，极易出现误报的现象。Currently, in the traditional anomaly detection model, the monitoring threshold of each business indicator is a static threshold. False alarms often occur when the business is running normally, causing business developers to lose sensitivity to abnormal alarms in daily operation and maintenance. The reporting rate is high; in addition, because the monitoring thresholds of each business indicator are static thresholds, business developers have a heavy workload and high labor costs to set static thresholds for each indicator separately; also, because the traditional anomaly detection model is When business experiences data fluctuations on a data level, false positives are very likely to occur.
有鉴于此，本申请实施例提供了一种基于时序预测的异常检测方法、装置、设备及介质，其中，该异常检测方法可以有效减少业务的异常误报现象，有效提高业务异常告警的准确率，以及，有效减少人员的工作量。In view of this, embodiments of the present application provide an anomaly detection method, device, equipment and medium based on timing prediction. The anomaly detection method can effectively reduce the abnormal false alarm phenomenon of business and effectively improve the accuracy of business anomaly alarms. , and effectively reduce personnel workload.
本申请实施例提供的一种基于时序预测的异常检测方法、系统、设备及介质，具体可以通过如下实施例进行说明，首先描述本申请实施例中的一种基于时序预测的异常检测方法。An anomaly detection method, system, device and medium based on timing prediction provided by embodiments of the present application can be specifically described through the following embodiments. First, an anomaly detection method based on timing prediction in an embodiment of the present application is described.
本申请实施例提供的基于时序预测的异常检测方法，可以应用于运维数据处理(云服务)应用场景中。在运维数据处理应用场景中，运维人员可以通过本申请实施例提供的异常检测方法来对业务进行异常检测，可以有效减少业务的异常误报现象，有效提高业务异常告警的准确率，以及，有效减少人员的工作量。The anomaly detection method based on time series prediction provided by the embodiments of this application can be applied to operation and maintenance data processing (cloud service) application scenarios. In the operation and maintenance data processing application scenario, operation and maintenance personnel can use the anomaly detection method provided by the embodiment of this application to detect business anomalies, which can effectively reduce the abnormality and false alarms of the business, effectively improve the accuracy of business anomaly alarms, and , effectively reducing personnel workload.
本申请可用于众多通用或专用的计算机系统环境或配置中。例如：个人计算机、服务器计算机、手持设备或便携式设备、平板型设备、多处理器系统、基于微处理器的系统、置顶盒、可编程的消费电子设备、网络PC、小型计算机、大型计算机、包括以上任何系统或设备的分布式计算环境等等。本申请可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本申请，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。The application may be used in a variety of general or special purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, including Distributed computing environment for any of the above systems or devices, etc. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.
需要说明的是，在本申请的各个具体实施方式中，当涉及到需要根据用户信息、用户行为数据，用户历史数据以及用户位置信息等与用户身份或特性相关的数据进行相关处理时，都会先获得用户的许可或者同意，而且，对这些数据的收集、使用和处理等，都会遵守相关法律法规和标准。此外，当本申请实施例需要获取用户的敏感个人信息时，会通过弹窗或者跳转到确认页面等方式获得用户的单独许可或者单独同意，在明确获得用户的单独许可或者单独同意之后，再获取用于使本申请实施例能够正常运行的必要的用户相关数据。It should be noted that in each specific implementation of the present application, when it comes to relevant processing based on user information, user behavior data, user historical data, user location information and other data related to user identity or characteristics, the first step is to perform relevant processing. Obtain the user's permission or consent, and the collection, use and processing of this data will comply with relevant laws, regulations and standards. In addition, when the embodiment of this application needs to obtain the user's sensitive personal information, it will obtain the user's separate permission or separate consent through a pop-up window or jump to a confirmation page. After clearly obtaining the user's separate permission or separate consent, it will then Obtain necessary user-related data for normal operation of the embodiment of the present application.
参照图1和图2，图1是本申请实施例提供的一种基于时序预测的异常检测方法的一个可选的流程图，其可以包括但不限于步骤S101至步骤S106。Referring to Figures 1 and 2, Figure 1 is an optional flow chart of an anomaly detection method based on timing prediction provided by an embodiment of the present application, which may include but is not limited to steps S101 to S106.
步骤S101、获取待异常检测的原始序列数据集和预设的历史时间阈值，所述原始序列数据集包括多个原始序列数据；Step S101: Obtain the original sequence data set to be anomaly detected and the preset historical time threshold. The original sequence data set includes multiple original sequence data;
在本申请实施例中，原始序列数据集可以来源于各业务系统中的业务指标日志、系统指标日志、应用指标日志等多维度的日志文件，在采集到多维度的日志文件后，根据日志文件所述的日志类型附加上时间序列信息，并将附加后的日志文件发送到kafka消息队列中，以时间序列信息为时间横轴解析为JSON格式的原始序列数据，然后将多个原始序列数据整合作为原始序列数据集。历史时间阈值的具体数值可以根据实际需求设置，具体可以是3天、5天、7天、10天等中的任意一种，本申请示例仅作说明，并非对本申请作出任何限制。值得说明的是，在本申请实施例中，以历史时间阈值为7天进行介绍说明。In the embodiment of this application, the original sequence data set can be derived from multi-dimensional log files such as business indicator logs, system indicator logs, and application indicator logs in each business system. After the multi-dimensional log files are collected, the The log type is appended with time series information, and the attached log file is sent to the Kafka message queue. The time series information is used as the horizontal axis of time and is parsed into original sequence data in JSON format, and then multiple original sequence data are integrated. as a raw sequence data set. The specific value of the historical time threshold can be set according to actual needs, and can be any one of 3 days, 5 days, 7 days, 10 days, etc. The examples in this application are only for illustration and do not impose any restrictions on this application. It is worth noting that in the embodiment of this application, the historical time threshold is set to 7 days for introduction and explanation.
步骤S102、根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，所述基线数据集包括多个基线数据，每个基线数据对应不同的时间序列；Step S102: Perform data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set. The baseline data set includes multiple baseline data, and each baseline data corresponds to a different time series;
参照图3，所述步骤S102、根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，包括：Referring to Figure 3, the step S102 is to perform data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set, including:
步骤S1021、获取预设的置信区间；Step S1021: Obtain the preset confidence interval;
步骤S1022、根据所述历史时间阈值，对所述原始序列数据集进行筛选处理，得到第一基础数据集；Step S1022: Filter the original sequence data set according to the historical time threshold to obtain a first basic data set;
步骤S1023、根据所述置信区间，对所述第一基础数据集进行数据预处理，得到第二基础数据集；Step S1023: Perform data preprocessing on the first basic data set according to the confidence interval to obtain a second basic data set;
步骤S1024、对所述第二基础数据集进行时间序列预测处理，得到所述基线数据集。Step S1024: Perform time series prediction processing on the second basic data set to obtain the baseline data set.
可以理解的是，置信区间可以是预先设置的区间，也可以是根据原始序列数据集或者第一基础数据集计算得出的估计区间；在本申请实施例中，可以根据历史时间阈值，通过业务系统中的搜索引擎查询过去7天的原始序列数据集，并将查询到的序列数据集作为第一基础数据集；然后根据置信区间，对第一基础数据集中，处于置信区间外的第一基础数据进行剔除，并对缺失值进行填补，得到第二基础数据集；接着，基于第二基础数据集进行时间序列预测，示例性地，对第二基础数据集进行数据序列预测可以通过时序数据预测(Prophet)算法实现，本申请在此就不再多余赘述。It can be understood that the confidence interval can be a preset interval, or an estimated interval calculated based on the original sequence data set or the first basic data set; in the embodiment of the present application, the confidence interval can be based on the historical time threshold, through the business The search engine in the system queries the original sequence data set for the past 7 days, and uses the queried sequence data set as the first basic data set; then based on the confidence interval, the first basic data set outside the confidence interval is The data is eliminated and missing values are filled in to obtain a second basic data set; then, time series prediction is performed based on the second basic data set. For example, data sequence prediction for the second basic data set can be performed through time series data prediction. (Prophet) algorithm implementation, this application will not go into details here.
步骤S103、根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，所述相似序列数据集包括多个序列相似度，所述序列相似度用于记录所述基线数据与对应的所述原始序列数据之间的相似度；Step S103: According to the baseline data set, perform normalized similarity processing on the original sequence data set to obtain a similar sequence data set. The similar sequence data set includes multiple sequence similarities, and the sequence similarities are used to record The similarity between the baseline data and the corresponding original sequence data;
参照图4，所述步骤S103、根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，包括：Referring to Figure 4, the step S103 is to perform normalization and similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set, including:
步骤S1031、对所述基线数据集进行第一归一化处理，得到第一中间数据集；Step S1031: Perform a first normalization process on the baseline data set to obtain a first intermediate data set;
步骤S1032、对所述原始序列数据集进行第二归一化处理，得到第二中间数据集；Step S1032: Perform a second normalization process on the original sequence data set to obtain a second intermediate data set;
步骤S1033、对所述第一中间数据集和所述第二中间数据集进行余弦相似处理，得到所述相似序列数据集。Step S1033: Perform cosine similarity processing on the first intermediate data set and the second intermediate data set to obtain the similar sequence data set.
在本申请实施例中，首先可以先确定基线数据集和原始序列数据集均包含了相同长度的数据点(即每个基线数据均对应有一个原始序列数据)，然后通过极值归一化(Min-max normalization)、平均归一化(Mean normalization)等中的任意一种归一化方法，对基线数据集和原始序列数据集进行归一化处理，以此得到第一中间数据集和第二中间数据集；接着，通过计算第一中间数据集和第二中间数据集之间的余弦相似度，得到若干个序列相似度，该序列相似度用于记录每个基线数据与对应的原始序列数据之间的相似度，然后根据时间顺序，将若干个序列相似度组成一个相似序列数据集。In the embodiment of this application, it is first determined that both the baseline data set and the original sequence data set contain data points of the same length (that is, each baseline data corresponds to an original sequence data), and then normalized by extreme values ( Min-max normalization), mean normalization (Mean normalization), etc., normalize the baseline data set and the original sequence data set to obtain the first intermediate data set and the first Two intermediate data sets; then, by calculating the cosine similarity between the first intermediate data set and the second intermediate data set, several sequence similarities are obtained. This sequence similarity is used to record each baseline data and the corresponding original sequence. The similarity between data is then combined into a similar sequence data set based on time order.
示例性地，第一中间数据集和第二中间数据集之间的相似度的等效公式可以表示为：Illustratively, the equivalent formula of the similarity between the first intermediate data set and the second intermediate data set can be expressed as:
其中，similarity为序列相似度的集合(即相似序列数据集)，A为第一中间数据集，B为第二中间数据集，dot_product(A,B)为第一中间数据集和第二中间数据集的点积，norm(A)为第一中间数据集的范数，norm(B)为第二中间数据集的范数。Among them, similarity is the set of sequence similarities (i.e. similar sequence data sets), A is the first intermediate data set, B is the second intermediate data set, dot_product(A,B) is the first intermediate data set and the second intermediate data The dot product of sets, norm(A) is the norm of the first intermediate data set, and norm(B) is the norm of the second intermediate data set.
步骤S104、根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，所述形状变换数据集用于记录所有所述基线数据，与对应的所述原始序列数据之间的形状变换量；Step S104. According to the similar sequence data set, perform shape transformation processing on the original sequence data set and the baseline data set to obtain a shape transformation data set. The shape transformation data set is used to record all the baseline data, The amount of shape transformation between the corresponding original sequence data;
参照图5，所述步骤S104、根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，包括：Referring to Figure 5, the step S104 is to perform shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set, including:
步骤S1041、根据所述基线数据集中的当前基线数据，确定与所述当前基线数据对应的当前序列相似度，以及，当前原始序列数据；Step S1041: Determine the current sequence similarity corresponding to the current baseline data and the current original sequence data according to the current baseline data in the baseline data set;
步骤S1042、对所述当前基线数据和所述当前原始序列数据进行偏差处理，得到第一差值；Step S1042: Perform deviation processing on the current baseline data and the current original sequence data to obtain a first difference;
步骤S1043、根据所述当前序列相似度，对所述第一差值进行乘积处理，得到所述形状变换量；Step S1043: Perform product processing on the first difference according to the current sequence similarity to obtain the shape transformation amount;
步骤S1044、返回根据所述基线数据中的当前基线数据，确定与所述当前基线数据对应的当前序列相似度，以及，当前原始序列数据这一步骤，直至所述基线数据集中的所有基线数据均已处理过；Step S1044: Return to the step of determining the current sequence similarity corresponding to the current baseline data and the current original sequence data based on the current baseline data in the baseline data until all baseline data in the baseline data set are processed;
步骤S1045、对所有所述形状变换量进行整合处理，得到所述形状变换数据集。Step S1045: Integrate all the shape transformation amounts to obtain the shape transformation data set.
在本申请实施例中，相似序列数据集可以作为权重，以此为原始序列数据集和/或基线数据集提供基于时间序列的数据量级，从而消除数据量级对业务指标的影响。具体地，首先可以确定当前时间点下的基线数据、原始序列数据以及对应的序列相似度；接着，通过计算基线数据与原始序列数据之间的绝对差值，并将计算得到的绝对差值作为第一差值；然后，根据当前序列相似度的补集，对第一差值进行乘积处理，得到当前时间点下的形状变换量。在得到当前时间点下的形状变换量后，可以循环步骤S1041至步骤S1044，直至所有时间点下的形状变换量均已得到后退出循环，将得到的所有形状变换量组合，得到形状变换数据集。In the embodiment of this application, similar sequence data sets can be used as weights to provide time series-based data magnitudes for the original sequence data sets and/or baseline data sets, thereby eliminating the impact of data magnitudes on business indicators. Specifically, first, the baseline data, original sequence data and corresponding sequence similarity at the current time point can be determined; then, the absolute difference between the baseline data and the original sequence data is calculated, and the calculated absolute difference is used as The first difference value; then, based on the complement of the current sequence similarity, the first difference value is multiplied to obtain the shape transformation amount at the current time point. After obtaining the shape transformation amounts at the current time point, steps S1041 to S1044 can be looped until the shape transformation amounts at all time points have been obtained and then the loop is exited. All obtained shape transformation amounts are combined to obtain a shape transformation data set. .
值得一提的是，由于每个基线数据经处理后，均会生成一个对应的形状变换量，故步骤S1044中的循环退出条件实质等同于基线数据集中的所有基线数据均已处理过，本申请在此就不再多余赘述。需要说明的是，形状变换量的等效公式可以表示为：It is worth mentioning that since each baseline data will generate a corresponding shape transformation amount after being processed, the loop exit condition in step S1044 is essentially equivalent to that all baseline data in the baseline data set have been processed. This application There is no need to go into details here. It should be noted that the equivalent formula of the shape transformation can be expressed as:
svi＝(1-similarityi)×|Xi-Yi|svi =(1-similarityi )×|Xi -Yi |
其中，svi为第i个形状变换量，similarityi为第i个序列相似度，Xi为基线数据集中的第i个基线数据，Yi为原始序列数据集中的第i个原始序列数据。Among them, svi is the i-th shape transformation amount, similarityi is the i-th sequence similarity, Xi is thei -th baseline data in the baseline data set, and Yi is the i-th original sequence data in the original sequence data set.
步骤S105、对所述形状变换数据集进行基准化处理，得到基准变化集，所述基准变化集包括多个基准变化量；Step S105: Perform benchmarking processing on the shape transformation data set to obtain a benchmark change set, where the benchmark change set includes multiple benchmark changes;
参照图6，所述步骤S105、对所述形状变换数据集进行基准化处理，得到基准变化集，包括：Referring to Figure 6, the step S105 is to perform benchmarking processing on the shape transformation data set to obtain a benchmark change set, including:
步骤S1051、对所述形状变换数据集进行变点检测处理，得到变点检测结果；Step S1051: Perform change point detection processing on the shape transformation data set to obtain a change point detection result;
在本申请实施例中，变点是形状变换数据集中的形状变换量趋近于0或等于0的异常点，变点检测结果用于记录形状变换数据集中，每个形状变换量是否为变点。具体地，可以预设设置一个形状阈值或者差值阈值，通过形状阈值或差值阈值，实现对形状变换数据集中每个形状变换量的变点检测。In the embodiment of the present application, a change point is an abnormal point where the shape transformation amount in the shape transformation data set approaches 0 or equals 0. The change point detection result is used to record whether each shape transformation amount in the shape transformation data set is a change point. . Specifically, a shape threshold or difference threshold can be preset, and through the shape threshold or difference threshold, change point detection of each shape transformation amount in the shape transformation data set is implemented.
可以理解的是，本申请实施例中介绍的变点检测处理可以通过以下两种方式实现，第一种方式为通过形状阈值判断形状变换量是否趋近于0或等于0的方式，当形状变换量小于等于形状阈值时，变点检测结果为是，当形状变换量大于形状阈值时，变点检测结果为否。第二种方式为通过差值阈值判断形状变换量是否趋近于0或等于0的方式，当第一差值小于等于差值阈值时，变点检测结果为是，当第一差值大于差值阈值时，变点检测结果为否。It can be understood that the change point detection process introduced in the embodiment of the present application can be implemented in the following two ways. The first way is to use a shape threshold to determine whether the shape transformation amount approaches 0 or is equal to 0. When the shape transformation When the amount is less than or equal to the shape threshold, the change point detection result is yes; when the shape transformation amount is greater than the shape threshold, the change point detection result is no. The second way is to use the difference threshold to determine whether the shape transformation amount is close to 0 or equal to 0. When the first difference is less than or equal to the difference threshold, the change point detection result is yes. When the first difference is greater than the difference When the threshold value is reached, the change point detection result is no.
值得说明的是，由于在本申请实施例中的形状变换量为第一差值和序列相似度的乘积，当第一差值趋近于0或等于0时，形状变换量也趋近于0或等于0；另外，差值阈值和形状阈值的具体数值可以根据实际情况设置，本申请在此就不再多余赘述。It is worth noting that since the shape transformation amount in the embodiment of the present application is the product of the first difference and the sequence similarity, when the first difference approaches 0 or equals 0, the shape transformation amount also approaches 0. Or equal to 0; in addition, the specific values of the difference threshold and the shape threshold can be set according to the actual situation, and this application will not go into details here.
步骤S1052、根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集。Step S1052: Perform cluster analysis on the shape transformation data set according to the change point detection result to obtain the reference change set.
参照图7，所述步骤S1052、根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集，包括：Referring to Figure 7, the step S1052 is to perform cluster analysis on the shape transformation data set according to the change point detection result to obtain the reference change set, including:
步骤S10521、若所述变点检测结果为否，则对所述形状变换数据集进行第一聚类处理，得到多个第一聚类簇；Step S10521: If the change point detection result is negative, perform first clustering processing on the shape transformation data set to obtain multiple first clusters;
步骤S10522、对每个第一聚类簇进行第二均值处理，得到所述基准变化集。Step S10522: Perform second mean processing on each first cluster to obtain the reference change set.
在本申请实施例中，当变点检测结果为否时，则说明形状变换数据集中的所有形状变换量均不属于变点，此时可以将每个形状变换量都对应为一个样本数据，通过对样本数据之间的距离值进行直方图统计，再使用K均值(K-Means)聚类、密度(Dbscan)聚类、均值漂移(Mean Shift)聚类等聚类算法中的任意一种，得到若干个聚类簇，然后在计算每个第一聚类簇的均值，得到若干个基准变化量，并将所有的基准变化量组合成基准变化集。In the embodiment of the present application, when the change point detection result is no, it means that all the shape transformation quantities in the shape transformation data set do not belong to the change points. At this time, each shape transformation quantity can be corresponding to a sample data, by Perform histogram statistics on the distance values between sample data, and then use any one of the clustering algorithms such as K-Means clustering, density (Dbscan) clustering, and mean shift (Mean Shift) clustering. Several clusters are obtained, and then the mean value of each first cluster is calculated to obtain several baseline changes, and all the baseline changes are combined into a baseline change set.
参照图8，所述步骤S1052、根据所述变点检测结果，对所述形状变换数据集进行聚类分析处理，得到所述基准变化集，包括：Referring to Figure 8, the step S1052 is to perform cluster analysis processing on the shape transformation data set according to the change point detection result to obtain the reference change set, including:
步骤S10525、若所述变点检测结果为是，则获取预设的序列阈值；Step S10525: If the change point detection result is yes, obtain the preset sequence threshold;
步骤S10526、根据所述序列阈值，对所述形状变换数据集进行二次变换处理，得到第二变换数据集；Step S10526: Perform secondary transformation processing on the shape transformation data set according to the sequence threshold to obtain a second transformation data set;
步骤S10527、对所述第二变换数据集进行第二聚类处理，得到多个第二聚类簇；Step S10527: Perform a second clustering process on the second transformed data set to obtain multiple second clusters;
步骤S10528、对每个第二聚类簇进行第二均值处理，得到所述基准变化集。Step S10528: Perform second mean processing on each second cluster to obtain the reference change set.
在本申请实施例中，当变点检测结果为是时，则说明形状变换数据集中的部分形状变换量属于变点，此时可以先确定属于变点的形状变换量，然后根据序列阈值，确定与属于变点的形状变换量对应的相邻数据，并根据该相邻数据对属于变点的形状变换量进行补偿，得到补偿后的形状变换量。在对所有属于变点的形状变换量进行补偿后，将形状变换数据集中正常的形状变换量，和补偿后的形状变换量进行组合，得到第二变换数据集。In the embodiment of the present application, when the change point detection result is yes, it means that part of the shape transformation amounts in the shape transformation data set belong to change points. At this time, the shape transformation amounts belonging to the change points can be determined first, and then based on the sequence threshold, determine The adjacent data corresponds to the shape transformation amount belonging to the change point, and the shape transformation amount belonging to the change point is compensated based on the adjacent data to obtain the compensated shape transformation amount. After compensating all the shape transformation amounts belonging to the change points, the normal shape transformation amounts in the shape transformation data set and the compensated shape transformation amounts are combined to obtain the second transformation data set.
示例性地，以序列阈值为1，即选取属于变点的形状变换量的前一个形状变换量作为相邻数据时，根据相邻数据对属于变点的形状变换量进行补偿的等效公式可以表示为：For example, when the sequence threshold is 1, that is, when the previous shape transformation amount of the shape transformation amount belonging to the change point is selected as the adjacent data, the equivalent formula for compensating the shape transformation amount belonging to the change point according to the adjacent data can be Expressed as:
其中，为补偿后的形状变换量，similarityi为第i个序列相似度，svi-1为第i-1个形状变换量，svi为第i个形状变换量。in, is the compensated shape transformation amount, similarityi is the i-th sequence similarity, svi-1 is the i-1 shape transformation amount, and svi is the i-th shape transformation amount.
可以理解的是，序列阈值的具体数值可以根据实际情况自行设置，另外，序列阈值还可以用于表征时间单位，例如，序列阈值为1，则可以表示选取属于变点的形状变换量的前一分钟的形状变换量作为相邻数据，本申请示例仅作说明，满足实际需求即可。值得说明的是，步骤S10527和步骤S10528与前述的步骤S10521和S10522类似，可以类推得到，本申请在此就不再多余赘述。It can be understood that the specific value of the sequence threshold can be set according to the actual situation. In addition, the sequence threshold can also be used to characterize the time unit. For example, if the sequence threshold is 1, it can mean that the previous shape transformation amount belonging to the change point is selected. The shape transformation amount in minutes is used as adjacent data. The example in this application is only for illustration and can meet actual needs. It is worth noting that steps S10527 and S10528 are similar to the aforementioned steps S10521 and S10522 and can be derived by analogy, and will not be described in detail here.
步骤S106、根据所有所述基准变化量，对所述形状变换数据集进行检测处理，得到与所述原始序列数据集对应的异常检测结果。Step S106: Perform detection processing on the shape transformation data set based on all the reference changes to obtain anomaly detection results corresponding to the original sequence data set.
在本申请实施例中，由于基准变化量为与形状变换数据集或第二变换数据集对应的聚类结果，每个基准变化量可以用于作为与原始序列数据集对应的，且多级别的异常阈值。具体地，以聚类处理采用的是密度聚类算法为例，通过设定最小样本数量MinPts为3，可以得出三个聚类簇，然后依据获得的三个聚类簇，确定出三个基准变化量，其可以作为通知级别、危险级别和灾难级别的异常阈值。In the embodiment of the present application, since the reference variation is a clustering result corresponding to the shape transformation data set or the second transformation data set, each reference variation can be used as a multi-level cluster corresponding to the original sequence data set. Exception threshold. Specifically, taking the density clustering algorithm used for clustering processing as an example, by setting the minimum number of samples MinPts to 3, three clusters can be obtained, and then three clusters can be determined based on the obtained three clusters. Baseline change amount, which can be used as the abnormal threshold for notification level, danger level and disaster level.
值得一提的是，在本申请实施例中，形状变换数据集可以有多个状态，其可以是形状变换处理后直接得到的形状变换数据集，也可以是二次变换处理后得到的第二变换数据集(集故对形状变换数据集进行检测处理可以是对形状变换处理后直接得到的形状变换数据集进行检测，也可以是二次变换处理后得到的第二变换数据集进行检测，两种方式中出现大于基准变化量的情形时，可以根据具体级别进行告警。It is worth mentioning that in the embodiment of the present application, the shape transformation data set can have multiple states. It can be a shape transformation data set obtained directly after the shape transformation process, or it can be a second shape transformation data set obtained after the secondary transformation process. Transform data set (set). Therefore, the detection processing of the shape transformation data set can be performed on the shape transformation data set obtained directly after the shape transformation processing, or it can be detected on the second transformation data set obtained after the secondary transformation processing. Both When a change greater than the baseline occurs in one of these methods, an alarm can be issued based on the specific level.
综上，本申请提供的基于时序预测的异常检测方法可以根据输入的数据动态调控异常阈值，便捷性高；通过变换量消除了数据抖升因素和不同数据特征之间的量纲差异，可以有效提高异常检测的准确性和稳定性，有效减少检测过程中因对量纲敏感而导致的误告现象；以及，通过变点检测，实现了对数据异常点的补偿，可以进一步地提高异常检测的准确性和实时性。In summary, the anomaly detection method based on time series prediction provided by this application can dynamically adjust the abnormal threshold according to the input data, and is highly convenient; the data jitter factor and the dimensional difference between different data features are eliminated through the transformation amount, which can effectively Improve the accuracy and stability of anomaly detection, effectively reducing false alarms caused by sensitivity to dimensions during the detection process; and, through change point detection, compensation for data abnormal points can be achieved, which can further improve the accuracy of anomaly detection. Accuracy and real-time.
图9为本申请实施例提供的一种基于时序预测的异常检测系统的框架示意图，包括：Figure 9 is a schematic framework diagram of an anomaly detection system based on timing prediction provided by an embodiment of the present application, including:
获取模块310，用于获取待异常检测的原始序列数据集和原始序列数据集，以及，预设的历史时间阈值，所述原始序列数据集包括多个原始序列数据；The acquisition module 310 is used to acquire the original sequence data set to be detected and the original sequence data set, and the preset historical time threshold. The original sequence data set includes multiple original sequence data;
预测模块320，用于根据所述历史时间阈值，对所述原始序列数据集进行数据预测处理，得到基线数据集，所述基线数据集包括多个基线数据，每个基线数据对应不同的时间序列；The prediction module 320 is configured to perform data prediction processing on the original sequence data set according to the historical time threshold to obtain a baseline data set. The baseline data set includes multiple baseline data, and each baseline data corresponds to a different time series. ;
相似模块330，用于根据所述基线数据集，对所述原始序列数据集进行归一相似处理，得到相似序列数据集，所述相似序列数据集包括多个序列相似度，所述序列相似度用于记录所述基线数据与对应的所述原始序列数据之间的相似度；Similarity module 330 is configured to perform normalized similarity processing on the original sequence data set according to the baseline data set to obtain a similar sequence data set. The similar sequence data set includes multiple sequence similarities. The sequence similarity Used to record the similarity between the baseline data and the corresponding original sequence data;
变换模块340，用于根据所述相似序列数据集，对所述原始序列数据集和所述基线数据集进行形状变换处理，得到形状变换数据集，所述形状变换数据集用于记录所有所述基线数据，与对应的所述原始序列数据之间的形状变换量；The transformation module 340 is configured to perform shape transformation processing on the original sequence data set and the baseline data set according to the similar sequence data set to obtain a shape transformation data set. The shape transformation data set is used to record all the The amount of shape transformation between the baseline data and the corresponding original sequence data;
基准模块350，用于对所述形状变换数据集进行基准化处理，得到基准变化集，所述基准变化集包括多个基准变化量；The benchmark module 350 is used to benchmark the shape transformation data set to obtain a benchmark change set, where the benchmark change set includes multiple benchmark changes;
检测模块360，用于根据所有所述基准变化量，对所述形状变换数据集进行检测处理，得到与所述原始序列数据集对应的异常检测结果。可以理解的是，上述方法实施例中的内容均适用于本系统实施例中，本系统实施例所具体实现的功能与上述方法实施例相同，并且达到的有益效果与上述方法实施例所达到的有益效果也相同。The detection module 360 is configured to perform detection processing on the shape transformation data set based on all the reference changes, and obtain anomaly detection results corresponding to the original sequence data set. It can be understood that the contents in the above method embodiments are applicable to this system embodiment. The functions implemented by this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are the same as those achieved by the above method embodiments. The beneficial effects are the same.
图10为本申请实施例提供的一种计算机设备的结构示意图，包括：Figure 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application, including:
至少一个处理器980；At least one processor 980;
至少一个存储器920，用于存储至少一个程序；At least one memory 920 for storing at least one program;
当所述至少一个程序被所述至少一个处理器980执行，使得所述至少一个处理器980实现如前述各个实施例所述的方法。When the at least one program is executed by the at least one processor 980, the at least one processor 980 implements the methods described in the foregoing embodiments.
本申请实施例还提供的一种计算机可读存储介质，其中存储有处理器可执行的程序，所述处理器可执行的程序在由所述处理器980执行时用于实现如前述各个实施例所述的方法。An embodiment of the present application also provides a computer-readable storage medium in which a processor-executable program is stored. The processor-executable program, when executed by the processor 980, is used to implement the foregoing embodiments. the method described.
图10具体地，计算机设备可以是用户终端，也可以是服务器。Specifically, in Figure 10, the computer device may be a user terminal or a server.
本申请实施例以计算机设备是用户终端为例，具体如下：In the embodiment of this application, the computer device is a user terminal as an example, and the details are as follows:
如图10所示，计算机设备900可以包括RF(Radio Frequency，射频)电路910、包括有一个或一个以上计算机可读存储介质的存储器920、输入单元930、显示单元940、传感器950、音频电路960、WiFi模块970、包括有一个或者一个以上处理核心的处理器980、以及电源990等部件。本领域技术人员可以理解，图10中示出的设备结构并不构成对电子设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。As shown in FIG. 10 , the computer device 900 may include an RF (Radio Frequency, radio frequency) circuit 910 , a memory 920 including one or more computer-readable storage media, an input unit 930 , a display unit 940 , a sensor 950 , and an audio circuit 960 , WiFi module 970, a processor 980 including one or more processing cores, a power supply 990 and other components. Those skilled in the art can understand that the device structure shown in Figure 10 does not constitute a limitation of the electronic device, and may include more or fewer components than shown, or combine certain components, or arrange different components.
RF电路910可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，交由一个或者一个以上处理器980处理；另外，将涉及上行的数据发送给基站。通常，RF电路910包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、用户身份模块(SIM)卡、收发信机、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等。此外，RF电路910还可以通过无线通信与网络和其他设备通信。无线通信可以使用任一通信标准或协议，包括但不限于GSM(Global System of Mobile communication，全球移动通讯系统)、GPRS(General Packet Radio Service，通用分组无线服务)、CDMA(CodeDivision Multiple Access，码分多址)、WCDMA(Wideband Code Division MultipleAccess,宽带码分多址)、LTE(Long Term Evolution,长期演进)、电子邮件、SMS(ShortMessaging Service，短消息服务)等。The RF circuit 910 can be used to receive and transmit information or signals during a call. In particular, after receiving the downlink information of the base station, it is handed over to one or more processors 980 for processing; in addition, the uplink data is sent to the base station. . Typically, the RF circuit 910 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, and an LNA (Low Noise Amplifier). , duplexer, etc. In addition, RF circuitry 910 can also communicate with networks and other devices through wireless communications. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication, global mobile communication system), GPRS (General Packet Radio Service, general packet radio service), CDMA (CodeDivision Multiple Access, code division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution, Long Term Evolution), email, SMS (Short Messaging Service, Short Message Service), etc.
存储器920可用于存储软件程序以及模块。处理器980通过运行存储在存储器920的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器920可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据设备900的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器920可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器920还可以包括存储器控制器，以提供处理器980和输入单元930对存储器920的访问。虽然图10示出了RF电路910，但是可以理解的是，其并不属于设备900的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。Memory 920 may be used to store software programs and modules. The processor 980 executes various functional applications and data processing by running software programs and modules stored in the memory 920 . The memory 920 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the storage data area may store the program based on Data created by the use of device 900 (such as audio data, phone book, etc.), etc. In addition, memory 920 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 920 may also include a memory controller to provide the processor 980 and the input unit 930 with access to the memory 920 . Although FIG. 10 shows an RF circuit 910, it can be understood that it is not a necessary component of the device 900 and can be omitted as needed without changing the essence of the invention.
输入单元930可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。具体地，输入单元930可包括触敏表面932以及其他输入设备931。触敏表面932，也称为触摸显示屏或者触控板，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触敏表面932上或在触敏表面932附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触敏表面932可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器980，并能接收处理器980发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触敏表面932。除了触敏表面932，输入单元930还可以包括其他输入设备931。具体地，其他输入设备931可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。The input unit 930 may be used to receive input numeric or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 930 may include a touch-sensitive surface 932 and other input devices 931 . The touch-sensitive surface 932, also known as a touch display or a trackpad, can collect the user's touch operations on or near it (for example, the user uses a finger, a stylus, or any suitable object or accessory to touch the touch-sensitive surface 932 or in the vicinity). operations near the touch-sensitive surface 932), and drive the corresponding connection device according to the preset program. Optionally, the touch-sensitive surface 932 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact point coordinates, and then sends it to the touch controller. to the processor 980, and can receive commands sent by the processor 980 and execute them. In addition, the touch-sensitive surface 932 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 932, the input unit 930 may also include other input devices 931. Specifically, other input devices 931 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), trackball, mouse, joystick, etc.
显示单元940可用于显示由用户输入的信息或提供给用户的信息以及控制900的各种图形用户接口，这些图形用户接口可以由图形、文本、图标、视频和其任意组合来构成。显示单元940可包括显示面板941，可选的，可以采用LCD(Liquid Crystal Display，液晶显示器)、OLED(Organic Light-Emitting Diode,有机发光二极管)等形式来配置显示面板941。进一步的，触敏表面932可覆盖在显示面板941之上，当触敏表面932检测到在其上或附近的触摸操作后，传送给处理器980以确定触摸事件的类型，随后处理器980根据触摸事件的类型在显示面板941上提供相应的视觉输出。虽然在图10中，触敏表面932与显示面板941是作为两个独立的部件来实现输入和输入功能，但是在某些实施例中，可以将触敏表面932与显示面板941集成而实现输入和输出功能。The display unit 940 may be used to display information input by the user or provided to the user and control various graphical user interfaces 900 , which may be composed of graphics, text, icons, videos, and any combination thereof. The display unit 940 may include a display panel 941. Optionally, the display panel 941 may be configured in the form of LCD (Liquid Crystal Display, liquid crystal display), OLED (Organic Light-Emitting Diode, organic light-emitting diode), etc. Further, the touch-sensitive surface 932 can cover the display panel 941. When the touch-sensitive surface 932 detects a touch operation on or near it, it is sent to the processor 980 to determine the type of the touch event, and then the processor 980 determines the type of the touch event according to The type of touch event provides corresponding visual output on display panel 941. Although in FIG. 10 , the touch-sensitive surface 932 and the display panel 941 are used as two independent components to implement input and input functions, in some embodiments, the touch-sensitive surface 932 and the display panel 941 can be integrated to implement input. and output functions.
计算机设备900还可包括至少一种传感器950，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板941的亮度，接近传感器可在设备900移动到耳边时，关闭显示面板941和/或背光。作为运动传感器的一种，重力加速度传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于设备900还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。Computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor may adjust the brightness of the display panel 941 according to the brightness of the ambient light. The proximity sensor may close the display panel 941 when the device 900 is moved to the ear. /or backlight. As a kind of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in various directions (usually three axes). It can detect the magnitude and direction of gravity when stationary. It can be used to identify applications of mobile phone posture (such as horizontal and vertical screen switching, related Games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, knock), etc.; as for other sensors such as gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc. that the device 900 can also be configured, we will not mention them here. Again.
音频电路960、扬声器961，传声器962可提供用户与设备900之间的音频接口。音频电路960可将接收到的音频数据转换后的电信号，传输到扬声器961，由扬声器961转换为声音信号输出；另一方面，传声器962将收集的声音信号转换为电信号，由音频电路960接收后转换为音频数据，再将音频数据输出处理器980处理后，经RF电路910以发送给另一控制设备，或者将音频数据输出至存储器920以便进一步处理。音频电路960还可能包括耳塞插孔，以提供外设耳机与设备900的通信。Audio circuit 960, speaker 961, and microphone 962 may provide an audio interface between the user and device 900. The audio circuit 960 can transmit the electrical signal converted from the received audio data to the speaker 961, and the speaker 961 converts it into a sound signal for output; on the other hand, the microphone 962 converts the collected sound signal into an electrical signal, and the audio circuit 960 After receiving, it is converted into audio data, and then processed by the audio data output processor 980, and then sent to another control device through the RF circuit 910, or the audio data is output to the memory 920 for further processing. Audio circuitry 960 may also include an earphone jack to provide for communication of peripheral headphones with device 900 .
设备900通过WiFi模块970可以与对战设备上设置的无线传输模块进行信息的传输。The device 900 can transmit information with the wireless transmission module set on the rival device through the WiFi module 970 .
处理器980是设备900的控制中心，利用各种接口和线路连接整个控制设备的各个部分，通过运行或执行存储在存储器920内的软件程序和/或模块，以及调用存储在存储器920内的数据，执行设备900的各种功能和处理数据，从而对控制设备进行整体监控。可选的，处理器980可包括一个或多个处理核心；可选的，处理器980可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器950中。The processor 980 is the control center of the device 900, using various interfaces and lines to connect various parts of the entire control device, by running or executing software programs and/or modules stored in the memory 920, and calling data stored in the memory 920 , execute various functions of the device 900 and process data, thereby overall monitoring the control device. Optionally, the processor 980 may include one or more processing cores; optionally, the processor 980 may integrate an application processor and a modem processor, where the application processor mainly processes the operating system, user interface and application programs. etc., the modem processor mainly handles wireless communications. It can be understood that the above-mentioned modem processor may not be integrated into the processor 950.
设备900还包括给各个部件供电的电源990(比如电池)，优选的，电源可以通过电源管理系统与处理器980逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。电源990还可以包括一个或一个以上的直流或交流电源、再充电系统、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。The device 900 also includes a power supply 990 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 980 through a power management system, so that functions such as charging, discharging, and power consumption management can be implemented through the power management system. Power supply 990 may also include one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components.
尽管未示出，设备900还可以包括摄像头、蓝牙模块等，在此不再赘述。Although not shown, the device 900 may also include a camera, a Bluetooth module, etc., which will not be described again here.
本申请实施例还提供一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时，使得所述处理器执行前述各个实施例所述的方法。Embodiments of the present application also provide a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, it causes the processor to execute the methods described in the foregoing embodiments.
本申请的说明书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或装置不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或装置固有的其它步骤或单元。The terms "first", "second", "third", "fourth", etc. (if present) in the description of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe specific objects. Sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the application described herein can, for example, be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or apparatus that includes a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.
应当理解，在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，“a和b”，“a和c”，“b和c”，或“a和b和c”，其中a，b，c可以是单个，也可以是多个。It should be understood that in this application, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And/or" is used to describe the relationship between associated objects, indicating that there can be three relationships. For example, "A and/or B" can mean: only A exists, only B exists, and A and B exist simultaneously. , where A and B can be singular or plural. The character "/" generally indicates that the related objects are in an "or" relationship. “At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items). For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c" ”, where a, b, c can be single or multiple.
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机装置(可以是个人计算机，服务器，或者网络装置等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，简称ROM)、随机存取存储器(Random Access Memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., which can store program code. medium.
对于上述方法实施例中的步骤编号，其仅为了便于阐述说明而设置，对步骤之间的顺序不做任何限定，实施例中的各步骤的执行顺序均可根据本领域技术人员的理解来进行适应性调整。The step numbers in the above method embodiments are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiments can be carried out according to the understanding of those skilled in the art. Adaptability.
以上是对本申请的较佳实施进行了具体说明，但本申请并不限于所述实施例，熟悉本领域的技术人员在不违背本申请精神的前提下还可做作出种种的等同变形或替换，这些等同的变形或替换均包含在本申请权利要求所限定的范围内。The above is a detailed description of the preferred implementation of the present application, but the present application is not limited to the embodiments. Those skilled in the art can also make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are included within the scope defined by the claims of this application.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311508481.2ACN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311508481.2ACN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
| Publication Number | Publication Date |
|---|---|
| CN117454196Atrue CN117454196A (en) | 2024-01-26 |
| CN117454196B CN117454196B (en) | 2024-10-29 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311508481.2AActiveCN117454196B (en) | 2023-11-13 | 2023-11-13 | Anomaly detection method, device, equipment and medium based on time sequence prediction |
| Country | Link |
|---|---|
| CN (1) | CN117454196B (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6064770A (en)* | 1995-06-27 | 2000-05-16 | National Research Council | Method and apparatus for detection of events or novelties over a change of state |
| US20050141782A1 (en)* | 2003-12-31 | 2005-06-30 | Honeywell International Inc. | Principal component analysis based fault classification |
| CN107609574A (en)* | 2017-08-18 | 2018-01-19 | 上海电力学院 | Wind turbines fault early warning method based on data mining |
| CN112685273A (en)* | 2020-12-29 | 2021-04-20 | 京东数字科技控股股份有限公司 | Anomaly detection method and device, computer equipment and storage medium |
| CN114048782A (en)* | 2021-11-16 | 2022-02-15 | 东莞市人民医院 | Anesthesia depth monitoring method based on artificial intelligence |
| CN114385869A (en)* | 2021-12-20 | 2022-04-22 | 珠海格力电器股份有限公司 | Method and device for detecting data abnormity, storage medium and computer equipment |
| CN114818969A (en)* | 2022-05-13 | 2022-07-29 | 清华大学 | Method and device for detecting position and type of change point |
| CN114969738A (en)* | 2022-05-27 | 2022-08-30 | 天翼爱音乐文化科技有限公司 | Interface abnormal behavior monitoring method, system, device and storage medium |
| CN115169225A (en)* | 2022-06-30 | 2022-10-11 | 中国人民解放军国防科技大学 | Adaptive weighting method applied to sea ice multi-mode ensemble prediction |
| CA3123281A1 (en)* | 2021-06-25 | 2022-12-25 | Cenovus Energy Inc. | Apparatus and method for oil production forecasting |
| CN115907181A (en)* | 2022-12-01 | 2023-04-04 | 郑州铁路职业技术学院 | Urban rail transit passenger flow prediction method and system |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6064770A (en)* | 1995-06-27 | 2000-05-16 | National Research Council | Method and apparatus for detection of events or novelties over a change of state |
| US20050141782A1 (en)* | 2003-12-31 | 2005-06-30 | Honeywell International Inc. | Principal component analysis based fault classification |
| CN107609574A (en)* | 2017-08-18 | 2018-01-19 | 上海电力学院 | Wind turbines fault early warning method based on data mining |
| CN112685273A (en)* | 2020-12-29 | 2021-04-20 | 京东数字科技控股股份有限公司 | Anomaly detection method and device, computer equipment and storage medium |
| CA3123281A1 (en)* | 2021-06-25 | 2022-12-25 | Cenovus Energy Inc. | Apparatus and method for oil production forecasting |
| CN114048782A (en)* | 2021-11-16 | 2022-02-15 | 东莞市人民医院 | Anesthesia depth monitoring method based on artificial intelligence |
| CN114385869A (en)* | 2021-12-20 | 2022-04-22 | 珠海格力电器股份有限公司 | Method and device for detecting data abnormity, storage medium and computer equipment |
| CN114818969A (en)* | 2022-05-13 | 2022-07-29 | 清华大学 | Method and device for detecting position and type of change point |
| CN114969738A (en)* | 2022-05-27 | 2022-08-30 | 天翼爱音乐文化科技有限公司 | Interface abnormal behavior monitoring method, system, device and storage medium |
| CN115169225A (en)* | 2022-06-30 | 2022-10-11 | 中国人民解放军国防科技大学 | Adaptive weighting method applied to sea ice multi-mode ensemble prediction |
| CN115907181A (en)* | 2022-12-01 | 2023-04-04 | 郑州铁路职业技术学院 | Urban rail transit passenger flow prediction method and system |
| Title |
|---|
| HUORONG REN ET AL.: "A Piecewise Aggregate pattern representation approach for anomaly detection in time series", KNOWLE DGE-BASE D SYSTEMS, vol. 135, 20 July 2017 (2017-07-20), pages 29* |
| JEDELYN CABRIETO ET AL.: "Detecting correlation changes in multivariate time series: A comparison of four non-parametric change point detection methods", BEHAV RES, vol. 49, 6 July 2016 (2016-07-06), pages 988, XP036271595, DOI: 10.3758/s13428-016-0754-9* |
| MARKUS SCHNEIDER ET AL.: "Expected similarity estimation for large-scale batch and streaming anomaly detection", MACH LEARN, vol. 105, 18 May 2016 (2016-05-18), pages 305, XP036237339, DOI: 10.1007/s10994-016-5567-7* |
| 商明菊;胡尧;周江娥;王丹;: "基于R-FPOP变点检测的城市路段旅行时间预测", 贵州大学学报(自然科学版), no. 02, 28 April 2019 (2019-04-28)* |
| 梁捷;梁广明;: "基于ARMA和K-means聚类的用电量数据异常识别", 湖北电力, no. 04, 28 August 2019 (2019-08-28)* |
| 王庆庆;吴共庆;李磊;: "结合相似度量和反馈调节的推荐算法", 合肥工业大学学报(自然科学版), no. 09, 28 September 2015 (2015-09-28)* |
| Publication number | Publication date |
|---|---|
| CN117454196B (en) | 2024-10-29 |
| Publication | Publication Date | Title |
|---|---|---|
| CN112214390B (en) | Test case generation method, device, system, equipment and medium | |
| CN110334124B (en) | Compression algorithm selection method, device and equipment | |
| CN112256748A (en) | Abnormity detection method and device, electronic equipment and storage medium | |
| CN112100655A (en) | A data detection method, device, electronic device and readable storage medium | |
| WO2019024646A1 (en) | Application management and control method, apparatus, and electronic device | |
| CN115378791A (en) | Data management method, device, storage medium and electronic equipment | |
| CN112256732A (en) | Abnormity detection method and device, electronic equipment and storage medium | |
| CN115729783A (en) | Failure risk monitoring method, device, storage medium and program product | |
| CN113918757A (en) | Application recommended method, device, electronic device and storage medium | |
| CN114817419A (en) | Kafka-based media asset data storage method and device, electronic equipment and storage medium | |
| CN107103086B (en) | Data acquisition auditing method and system, and computer readable storage medium | |
| CN117454196B (en) | Anomaly detection method, device, equipment and medium based on time sequence prediction | |
| CN109508425B (en) | A setting item recommendation method and terminal device | |
| CN112363895A (en) | System fault positioning method and device and electronic equipment | |
| CN114661515B (en) | Alarm information convergence method and device, electronic equipment and storage medium | |
| CN115565215B (en) | Face recognition algorithm switching method and device and storage medium | |
| CN113419795B (en) | Call relation display method and device, computer equipment and storage medium | |
| CN116383224A (en) | Data storage method, device, medium and equipment | |
| WO2019000473A1 (en) | Coefficient calculation method, component calling method, device, medium, server, and terminal | |
| CN117149990A (en) | Text retrieval method, text retrieval device, electronic equipment and storage medium | |
| CN107526668B (en) | CPU monitoring method and device, computer equipment and computer readable storage medium | |
| CN117574222B (en) | A method, system, device and medium for classifying benthic habitats | |
| CN120687484A (en) | A database query optimization method, system, device and medium | |
| CN116303520A (en) | Account entry data storage searching method and device, storage medium and electronic equipment | |
| CN119380116A (en) | Image recognition method and related device |
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |