HK1247692B - Index abnormality detection method and device and electronic equipment - Google Patents

Description

Method, device and electronic device for detecting abnormality of indicators

Technical Field

This specification relates to the field of computer software technology, and in particular to an indicator anomaly detection method, device, and electronic device.

Background Art

With the rapid development of computer and Internet technologies, many businesses can be conducted online, which brings convenience to users but also places higher demands on the reliability of various corresponding business systems.

Generally, it's possible to monitor some key metrics within a business system. For example, in a third-party payment system, these metrics might include the number of payment account theft events triggered per minute and the payment request latency per minute. Furthermore, based on this monitoring data, these metrics can be detected for anomalies. If anomalies are detected, operations or R&D personnel can promptly address them to ensure the reliability of the business system.

In the existing technology, anomalies are usually detected for a single monitoring point using the historical mean, variance, and jitter of the monitored indicator.

Based on existing technologies, a more accurate indicator anomaly detection solution is needed.

Summary of the Invention

The embodiments of this specification provide an indicator anomaly detection method, device, and electronic device to solve the following technical problem: a more accurate indicator anomaly detection solution is needed.

To solve the above technical problems, the embodiments of this specification are implemented as follows:

The embodiments of this specification provide a method for detecting anomalies in indicators, including:

Obtain data on each monitoring point of the monitored indicator over a period of time;

Using a Gaussian model to extract the mean and variance of the data of the monitoring point;

Calculating the probability of occurrence of the data at each monitoring point based on the mean and variance of the data at the monitoring point;

Calculating, based on the respectively calculated probabilities, a joint probability of occurrence of data of each of the monitoring points included in a window divided by the time period;

Whether the monitored indicator is abnormal is detected according to the joint probability corresponding to each of the windows.

An embodiment of this specification provides an indicator anomaly detection device, comprising:

The acquisition module obtains the data of each monitoring point included in the monitored indicator within a period of time;

An extraction module, which uses a Gaussian model to extract the mean and variance of the data of the monitoring point;

A first calculation module calculates the probability of occurrence of the data of each monitoring point according to the mean and variance of the data of the monitoring point;

A second calculation module calculates, based on the respectively calculated probabilities, a joint probability of occurrence of data of each of the monitoring points included in the window divided by the time period;

The detection module detects whether the monitored indicator is abnormal according to the joint probability corresponding to each of the windows.

An electronic device provided in an embodiment of this specification includes:

at least one processor; and,

a memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

Obtain data on each monitoring point of the monitored indicator over a period of time;

Using a Gaussian model to extract the mean and variance of the data of the monitoring point;

Calculating the probability of occurrence of the data at each monitoring point based on the mean and variance of the data at the monitoring point;

Calculating, based on the respectively calculated probabilities, a joint probability of occurrence of data of each of the monitoring points included in a window divided by the time period;

Whether the monitored indicator is abnormal is detected according to the joint probability corresponding to each of the windows.

At least one of the above-mentioned technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects: since anomaly detection is performed on the indicator based on a Gaussian model and a window of multiple monitoring points containing the indicator, it is beneficial to prevent the jitter of a single monitoring point from misleading anomaly detection, and thus facilitate more accurate indicator anomaly detection.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

FIG1 is a schematic diagram of an overall architecture of the solution of this specification in a practical application scenario;

FIG2 is a flow chart of an indicator anomaly detection method provided in an embodiment of this specification;

FIG3 is a schematic diagram showing a specific implementation scheme of the above-mentioned indicator anomaly detection method in an actual application scenario provided in an embodiment of this specification;

FIG4 is a flowchart of a specific implementation scheme of the above-mentioned indicator anomaly detection method in an actual application scenario provided in the examples of this specification;

FIG5 is a schematic structural diagram of an indicator abnormality detection device corresponding to FIG1 provided in an embodiment of this specification.

DETAILED DESCRIPTION

The embodiments of this specification provide a method, device, and electronic device for detecting anomalies in indicators.

In order to help those skilled in the art better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

Figure 1 is a schematic diagram of the overall architecture involved in the solution of this specification in an actual application scenario. In the overall architecture (a), there are mainly two parts: the device where the monitoring data is located and the device where the Gaussian model is located. The device where the monitoring data is located sends the monitoring data of the monitored indicators to the device where the Gaussian model is located through the network. The device where the Gaussian model is located can process the monitoring data based on the window and the Gaussian model, and then perform indicator anomaly detection based on the processing results. It should be noted that in actual applications, the monitoring data and the Gaussian model may be on the same device. In this case, the overall architecture (b) can be adopted.

Based on the above overall architecture, the solution of this specification is described in detail below.

Figure 2 is a flow chart of a method for detecting anomalies in an indicator provided in an embodiment of this specification. This process can be executed separately for each of one or more monitored indicators. Possible execution entities of this process include, but are not limited to, the following devices that can function as servers or terminals: mobile phones, tablets, smart wearable devices, vehicle computers, personal computers, mid-range computers, computer clusters, etc.

The process in Figure 2 may include the following steps:

S202: Obtain data of each monitoring point included in the monitored indicator within a period of time.

In the embodiment of this specification, a period of time may include multiple monitoring points.

For example, if the monitored indicator is the number of payment account theft events triggered per minute, assuming the time period is the most recent day and the first minute of every hour is a monitoring point, then the time period can include 24 monitoring points. If the time period is the most recent hour and each minute is a monitoring point, then the time period can include 60 monitoring points.

In addition, in actual applications, monitoring points may not be evenly distributed. For example, they may be relatively dense during the day and relatively sparse at night.

In the embodiments of the present specification, the data of the monitored indicator at the monitoring point may refer to the original monitoring data of the monitored indicator, that is, the value of the monitored indicator obtained at the monitoring point. For example, assuming that the values of the monitored indicator of the number of payment account theft incidents in a period of time are 2, 8, and 1 respectively at three monitoring points, then 2, 8, and 1 may be used as the data of the corresponding monitoring points; the data of the monitored indicator at the monitoring point may also refer to the data obtained by performing specific processing on the original monitoring data, and the specific processing may be for more effectively implementing the solution of the present specification.

For example, the specific processing may be logarithmic processing, through which the original monitoring data can be converted into a smaller change, which is beneficial to reducing the adverse effects of jitter of a single monitoring point on indicator abnormality detection; for example, the logarithms of the above-mentioned 2 items, 8 items, and 1 item can be taken as the data of the corresponding monitoring points.

For another example, the specific processing may be a homogenization processing, which may be performed by deleting or adding a portion of data from the original monitoring data so that the processed data is more homogenous than the original monitoring data before processing.

S204: Using a Gaussian model to extract the mean and variance of the data of the monitoring point.

In the embodiments of this specification, it can be assumed that the data corresponding to each monitoring point follows a Gaussian distribution. Based on this assumption, a Gaussian model is used to extract the mean and variance of the data at the monitoring point. Specifically, the Gaussian model can be used to estimate the data at the monitoring point, and then the mean and variance of the data at the monitoring point are obtained based on the estimated Gaussian model. The Gaussian model can specifically include a Gaussian mixture model.

S206: Calculate the probability of occurrence of the data at each monitoring point according to the mean and variance of the data at the monitoring point.

In the embodiment of this specification, the probability of occurrence of data corresponding to each monitoring point can be calculated respectively using the mean and variance of the data of the monitoring points and the Gaussian model used to extract the mean and variance of the data of the monitoring points.

S208: Calculate, based on the respectively calculated probabilities, the joint probability of occurrence of the data of each of the monitoring points included in the window divided by the time period.

In the embodiments of this specification, instead of performing indicator anomaly detection on a single monitoring point, indicator anomaly detection can be performed on a window containing multiple monitoring points. Specifically, the period of time in step S202 can be divided into multiple windows. For each divided window, the monitoring points contained in the window are treated as a whole, and the monitored indicator is then detected for anomalies based on the whole.

In an embodiment of the present specification, based on the probability of occurrence of data corresponding to each monitoring point that has been calculated separately, the joint probability of occurrence of data corresponding to each monitoring point in the divided window can be further calculated. The joint probability can reflect the level of the monitored indicator in the corresponding window relative to other windows.

S210: Detecting whether the monitored indicator is abnormal based on the joint probability corresponding to each of the windows.

In the embodiment of the present invention, based on the joint probability corresponding to each window, the probability of occurrence of the joint probability corresponding to each window can be further calculated to serve as a basis for abnormality detection of the monitored indicator.

According to the method of FIG2 , since anomaly detection is performed on the indicator based on a Gaussian model and a window of multiple monitoring points containing the indicator, it is helpful to prevent the jitter of a single monitoring point from misleading anomaly detection, thereby facilitating more accurate indicator anomaly detection.

Based on the method of FIG2 , the examples of this specification also provide some specific implementation plans and extension plans of the method, which are described below.

In the embodiment of the present specification, it is assumed that the original monitoring data is logarithmically processed in advance to obtain the data of the monitored indicator at the corresponding monitoring point. Then, for step S202, before obtaining the monitoring data of the monitored indicator within a period of time, the following can be performed: obtaining the original monitoring data of each monitoring point included in the monitored indicator within a period of time; performing logarithm processing on the original monitoring data, and using it as the data of each monitoring point included in the monitored indicator within the period of time, for the indicator anomaly detection.

In the embodiments of this specification, each window may be divided first and then the corresponding joint probabilities may be calculated respectively. Alternatively, the windows may be divided while the joint probabilities corresponding to the currently divided windows are calculated.

Taking the first method in the above paragraph as an example, for step S208, the joint probability of occurrence of the data of each monitoring point contained in the window divided by the period of time is calculated based on the respectively calculated probabilities, which can specifically include: determining multiple different windows divided by the period of time; for each window, respectively, according to the probability of the data of each monitoring point contained in the window in the respectively calculated probabilities, calculating the joint probability of occurrence of the data of each monitoring point contained in the window.

The multiple different windows may preferably completely cover the period of time.

In the embodiments of this specification, there are many specific ways to divide windows. For example, windows can be divided according to set time intervals, or according to business characteristics (such as account level, region, etc.).

Taking dividing the windows according to a set time interval as an example, dividing the time interval into multiple different windows may include dividing the time interval into multiple different windows according to a set time interval and window length, wherein the start times of adjacent windows differ by the time interval.

More specifically, for example, assuming the time period is 1000 minutes, the time interval is set to 5 minutes, and the window length is 10 minutes, then the first 10 minutes are divided into a window, the fifth 15th minute into a window, the tenth 20th minute into a window, the fifteenth 25th minute into a window, and so on, resulting in 199 windows. In this example, adjacent windows overlap, but in practice, this is not necessary. Furthermore, the time interval and window length can also be flexible.

In an embodiment of the present specification, for step S210, detecting whether the monitored indicator is abnormal based on the joint probability corresponding to each of the windows may specifically include: extracting the mean and variance of the joint probability corresponding to each of the windows using a Gaussian model; calculating the probability of occurrence of the joint probability corresponding to each of the windows based on the mean and variance of the joint probability; and detecting whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to the window.

It can be seen that the Gaussian model can be used again here. The main difference between the two uses is that the Gaussian model used here is for the window, while the Gaussian model used in step S204 is for the monitoring point.

In the embodiment of the present specification, based on the probability of occurrence of the joint probability, it can be detected whether the monitored indicator is abnormal within the window corresponding to the joint probability.

For example, detecting whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to the window may specifically include: detecting whether the monitored indicator is abnormal within the window using the 3σ criterion based on the mean and variance of the joint probability and the probability of occurrence of the joint probability corresponding to the window.

More specifically, according to the 3σ criterion, if the probability of the joint probability deviating from the mean of the joint probability calculated above by 3 standard deviations above and below (the standard deviation is the arithmetic square root of the variance of the joint probability calculated above), then it can be considered that the corresponding monitored indicator is abnormal within the corresponding window.

It should be noted that, in practical applications, the threshold of the joint probability and/or the threshold of the probability of occurrence of the joint probability may be set manually to detect abnormal windows, without necessarily using the 3σ criterion.

After detecting an abnormal window, specific measures can be taken to further analyze which monitoring points in the window mainly cause the abnormality. This will help to solve related business system problems more accurately and effectively in the future.

Based on the above description, the embodiment of this specification further provides a specific implementation plan of the above-mentioned indicator anomaly detection method in an actual application scenario, which is described in conjunction with Figures 3 and 4.

Figure 3 is a schematic diagram of the principle of this embodiment. Figure 4 is a schematic diagram of the process of this embodiment compared with Figure 3.

The box in FIG3 represents the current window, and the circle in the box represents the monitoring point. Referring to FIG3 , the process in FIG4 may include the following steps:

S402: Obtaining original monitoring data of a monitored indicator and performing logarithmic processing to obtain monitoring data;

S404: Using the Gaussian model to extract the mean μ ₁ and variance Δ ₁ of the data at each monitoring point;

S406: Calculate the probability of occurrence of data at each monitoring point based on μ ₁ and Δ ₁ ;

S408: Calculate the joint probability of occurrence of data of each monitoring point included in the window based on the respectively calculated probability of occurrence of data of each monitoring point;

S410: Calculate the mean μ ₂ and variance Δ ₂ of the joint probability;

S412: Calculate the probability of occurrence of the joint probability corresponding to the window based on μ ₂ and Δ ₂ ;

S414: Use the 3σ criterion to calculate whether the probability of occurrence of the joint probability corresponding to the window deviates from μ ₂ above and below. If so, it is detected that the monitored indicator is abnormal in the window.

For ease of understanding, the following formula can be used to calculate the probability p(X) of the joint probability corresponding to the current window:

Wherein, σ ₁ represents the arithmetic square root of Δ ₁ , σ ₂ represents the arithmetic square root of Δ ₂ , k represents the number of monitoring points contained in the current window, p( _xi | _μ1 , _σ1 ) represents the probability of occurrence of the data of the i-th monitoring point contained in the current window, and represents the joint probability of occurrence of the data of the k monitoring points contained in the current window.

If p(X) deviates from μ ₂ by three σ ₂ above and below, it can be considered that the monitored indicator is abnormal in the current window.

For example, if the monitored metric is the number of payment account theft events triggered per minute, each 6-minute window is divided into a window, and each window contains 6 monitoring points, as shown in Figure 3.

Assume that the original monitoring data corresponding to each monitoring point in the current window are: 2 items, 8 items, 1 item, 20 items, 1 item, and 1 item respectively; take the logarithm (assuming natural logarithm is used) of the original monitoring data of the current window to obtain the data of each monitoring point included in the monitored indicator in the current window, which are: In2, In8, 0, In20, 0, 0 respectively.

Similarly, by taking logarithmic data, we can obtain the data for each monitoring point within the time period of the monitored indicator. Furthermore, we can use a Gaussian model to extract the mean and variance of the monitoring point data, calculate the probability of occurrence of the joint probability corresponding to the current window using Formula 1 above, and use the 3σ criterion to detect whether the monitored indicator has an anomaly in the current window. This approach allows us to check whether the monitored indicator has an anomaly in any window divided by the time period.

The indicator anomaly detection scheme based on window and Gaussian model is helpful to reduce false positives and improve the accuracy of detection results.

Based on the same idea, the embodiments of this specification also provide a corresponding device, as shown in FIG5 .

FIG5 is a schematic diagram of the structure of an indicator anomaly detection device corresponding to FIG2 provided in an embodiment of this specification. The dashed boxes represent optional modules. The device can be located on the execution body of the process in FIG2 and includes:

An acquisition module 501 acquires data of each monitoring point of a monitored indicator within a period of time, wherein the period of time includes multiple monitoring points;

Extraction module 502, extracting the mean and variance of the data of the monitoring point using a Gaussian model;

A first calculation module 503 calculates the probability of occurrence of the data of each monitoring point according to the mean and variance of the data of the monitoring point;

A second calculation module 504 calculates a joint probability of occurrence of data of each of the monitoring points included in the window divided by the time period based on the respectively calculated probabilities;

The detection module 505 detects whether the monitored indicator is abnormal according to the joint probability corresponding to each of the windows.

Optionally, the device further comprises:

The logarithm module 506 obtains the original monitoring data of each monitoring point included in a period of time before the acquisition module 501 obtains the data of each monitoring point included in the monitored indicator in a period of time, and after performing logarithm processing on the original monitoring data, uses it as the data of each monitoring point included in the monitored indicator in the period of time for the indicator anomaly detection.

Optionally, the second calculation module 504 calculates the joint probability of occurrence of the data of each monitoring point included in the window divided by the time period according to the respectively calculated probabilities, specifically including:

The second calculation module 504 determines a plurality of different windows divided by the period of time;

For each window, the joint probability of occurrence of the data of each monitoring point included in the window is calculated according to the probabilities of the data corresponding to each monitoring point included in the window in the respectively calculated probabilities.

Optionally, dividing the period of time into a plurality of different windows includes:

According to the set time interval and window length, the period of time is divided into a plurality of different windows, wherein the start times of adjacent windows differ by the time interval.

Optionally, the detection module 505 detects whether the monitored indicator is abnormal based on the joint probability corresponding to each window, specifically including:

The detection module 505 uses a Gaussian model to extract the mean and variance of the joint probability corresponding to each of the windows;

Calculating the probability of occurrence of the joint probability corresponding to each of the windows according to the mean and variance of the joint probability;

Whether the monitored indicator is abnormal is detected according to the probability of occurrence of the joint probability corresponding to the window.

Optionally, the detection module 505 detects whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to the window, specifically including:

The detection module 505 detects whether the monitored indicator is abnormal within the window using the 3σ criterion based on the mean and variance of the joint probability and the probability of occurrence of the joint probability corresponding to the window.

Optionally, the Gaussian model includes a Gaussian mixture model.

Based on the same idea, the embodiments of this specification also provide a corresponding electronic device, including:

at least one processor; and,

a memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

Obtain data on each monitoring point of the monitored indicator over a period of time;

Using a Gaussian model to extract the mean and variance of the data of the monitoring point;

Calculating the probability of occurrence of the data at each monitoring point based on the mean and variance of the data at the monitoring point;

Calculating, based on the respectively calculated probabilities, a joint probability of occurrence of data of each of the monitoring points included in a window divided by the time period;

Whether the monitored indicator is abnormal is detected according to the joint probability corresponding to each of the windows.

Based on the same idea, the embodiments of this specification also provide a corresponding non-volatile computer storage medium, which stores computer-executable instructions, and the computer-executable instructions are configured as follows:

Obtain data on each monitoring point of the monitored indicator over a period of time;

Using a Gaussian model to extract the mean and variance of the data of the monitoring point;

Calculating the probability of occurrence of the data at each monitoring point based on the mean and variance of the data at the monitoring point;

Calculating, based on the respectively calculated probabilities, a joint probability of occurrence of data of each of the monitoring points included in a window divided by the time period;

Whether the monitored indicator is abnormal is detected according to the joint probability corresponding to each of the windows.

The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

The various embodiments in this specification are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other, and each embodiment focuses on the differences between the other embodiments. In particular, the device, electronic device, and non-volatile computer storage medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simplified. For relevant details, refer to the descriptions of the method embodiments.

The apparatus, electronic device, and non-volatile computer storage medium provided in the embodiments of this specification correspond to the method. Therefore, the apparatus, electronic device, and non-volatile computer storage medium also have similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding apparatus, electronic device, and non-volatile computer storage medium will not be repeated here.

In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and/or hardware.

Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

This specification is described with reference to the flowcharts and/or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the processes and/or boxes in the flowchart and/or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

The foregoing is merely an embodiment of the present invention and is not intended to limit the present application. For those skilled in the art, various modifications and variations may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included within the scope of the claims of the present application.

Claims (13)

1. A method for detecting anomalies in indicators, comprising: Obtain data from each monitoring point within a given time period for the monitored metric; The mean and variance of the data from the monitoring points were extracted using a Gaussian model. Based on the mean and variance of the data from the monitoring points, calculate the probability of the data appearing at each monitoring point. Based on the separately calculated probabilities, calculate the joint probability of the occurrence of data from each of the monitoring points contained in the window divided by the time period; Based on the joint probability corresponding to each window, detect whether the monitored indicator is abnormal; specifically, this includes: using a Gaussian model to extract the mean and variance of the joint probability corresponding to each window; calculating the probability of occurrence of the joint probability corresponding to each window based on the mean and variance of the joint probability; and detecting whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to each window. 2. The method as described in claim 1, wherein before acquiring the data of each monitoring point included in a period of time for the monitored indicator, the method further includes: Obtain the original monitoring data of each monitoring point included in the monitored indicator over a period of time; After performing logarithmic processing on the original monitoring data, it is used as the data of each monitoring point included in the monitored indicator within the time period, for the purpose of detecting anomalies in the indicator. 3. The method as described in claim 1, wherein calculating the joint probability of data occurrence of each monitoring point contained within the window divided by the time period based on the separately calculated probabilities specifically includes: Determine multiple distinct windows divided by the time period; For each window, the joint probability of the occurrence of data from each monitoring point included in the window is calculated based on the probability of the data corresponding to each monitoring point included in the window, which is calculated separately. 4. The method of claim 3, wherein dividing the time period into multiple different windows includes: Based on the set time interval and window length, the time period is divided into multiple different windows, wherein the start time of adjacent windows differs by the time interval. 5. The method as described in claim 1, wherein detecting whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to the window specifically includes: Based on the mean and variance of the joint probability, and the probability of the joint probability occurring according to the window, the 3σ criterion is used to detect whether the monitored indicator is abnormal within the window. 6. The method according to any one of claims 1 to 5, wherein the Gaussian model includes a Gaussian mixture model. 7. An abnormal indicator detection device, comprising: The acquisition module retrieves data from various monitoring points within a given time period for the monitored metric. The extraction module uses a Gaussian model to extract the mean and variance of the data from the monitoring points; The first calculation module calculates the probability of data occurrence at each monitoring point based on the mean and variance of the data at the monitoring points. The second calculation module calculates the joint probability of the occurrence of data from each monitoring point contained in the window divided by the time period, based on the separately calculated probabilities. The detection module detects whether the monitored indicator is abnormal based on the joint probability corresponding to each window. Specifically, it uses a Gaussian model to extract the mean and variance of the joint probability corresponding to each window; calculates the probability of occurrence of the joint probability corresponding to each window based on the mean and variance of the joint probability; and detects whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to each window. 8. The apparatus of claim 7, further comprising: The logarithm module acquires the original monitoring data of each monitoring point within a certain period of time before the acquisition module acquires the data of each monitoring point of the monitored indicator within a certain period of time. After performing logarithmic processing on the original monitoring data, it serves as the data of each monitoring point of the monitored indicator within the certain period of time for the detection of anomalies in the indicator. 9. The apparatus of claim 7, wherein the second calculation module calculates the joint probability of data occurrence of each monitoring point contained in the window divided by the time period based on the separately calculated probabilities, specifically including: The second calculation module determines multiple different windows divided by the time period; For each window, the joint probability of the occurrence of data from each monitoring point included in the window is calculated based on the probability of the data corresponding to each monitoring point included in the window, which is calculated separately. 10. The apparatus of claim 9, wherein dividing the time period into multiple different windows comprises: Based on the set time interval and window length, the time period is divided into multiple different windows, wherein the start time of adjacent windows differs by the time interval. 11. The apparatus of claim 7, wherein the detection module detects whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to the window, specifically including: The detection module uses the 3σ criterion to detect whether the monitored indicator is abnormal within the window based on the mean and variance of the joint probability and the probability of the joint probability occurring according to the window. 12. The apparatus according to any one of claims 7 to 11, wherein the Gaussian model comprises a Gaussian mixture model. 13. An electronic device, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: Obtain data from each monitoring point within a given time period for the monitored metric; The mean and variance of the data from the monitoring points were extracted using a Gaussian model. Based on the mean and variance of the data from the monitoring points, calculate the probability of the data appearing at each monitoring point. Based on the separately calculated probabilities, calculate the joint probability of the occurrence of data from each of the monitoring points contained in the window divided by the time period; Based on the joint probability corresponding to each window, detect whether the monitored indicator is abnormal; specifically, this includes: using a Gaussian model to extract the mean and variance of the joint probability corresponding to each window; calculating the probability of occurrence of the joint probability corresponding to each window based on the mean and variance of the joint probability; and detecting whether the monitored indicator is abnormal based on the probability of occurrence of the joint probability corresponding to each window.