TWI848481B - Predicting and alerting system and method, modeling and training systems and methods of information system operation and computer program products thereof - Google Patents

Abstract

The present invention provides a prediction and alarm system and method for information system operation. For historical data of a system data, a modeling training module is used to determine the optimal parameters of a prediction alarm module, so that the prediction alarm module calculates a prediction sequence of the operation data of the system data based on the parameters, and compares the prediction sequence with the corresponding actual operation data, thereby determining whether the system data corresponding to the actual operation data is abnormal, and outputting an abnormality notification.

Description

Prediction and warning system and method, modeling and training system for information system operation and method and computer program product

The present invention relates to a prediction and alarm system and method, in particular, a prediction and alarm system and method for system data generated by the operation of an information system, and a modeling and training system and method thereof.

With the rapid development of software technology and the rapid growth of information and communication networks, the information systems of corporate operations are also expanding. Whether it is the normal operation of servers, host equipment, and network communication infrastructure, or related daily operations such as accounting, factory maintenance, and customer service calls, they all fall within the scope of information systems.

For the system data generated by the operation of the information system, the learning prediction and alarm systems and methods mostly use the moving average and the standard deviation method in statistics to detect abnormal conditions in the system data. Since these methods cannot take into account cyclical factors, such as shutdown in the middle of the night, reduced usage on weekends, etc., if the above factors affect the cycle, it is easy to cause misjudgment during the operation of the information system, and misjudge the normal as abnormal, it will cost a lot of man-hours to correct or eliminate the occurrence of abnormalities. In most information systems, once an error is made in judgment and an erroneous abnormality alarm is issued, the system will need to be restarted or the abnormality will be manually eliminated, which will cause losses to the business operation and reduce efficiency. These problems come from the inability to establish an effective prediction and alarm model for the operation of the information system.

To establish an effective prediction and alarm model, it is necessary to model and train the enterprise's own operating data and internal system data. Therefore, how to establish a prediction and alarm model that can accurately predict system data is an important issue that the current information industry needs to solve.

In view of this, one of the purposes of the present invention is to provide a prediction and alarm system and method, which can find observations that do not conform to the expected pattern in the system data of the information system operation through a deep learning model and judge them as abnormal.

Another purpose of the present invention is to provide a modeling and training system and method that can model and train the enterprise's own operating data and internal system data, and find the optimal parameters of a prediction alarm module through a deep learning model.

To achieve the above-mentioned purpose of the invention, the present invention provides a prediction and alarm method for information system operation, comprising the following steps: an input/output module continuously receives a system data from an information system and stores it in a database, wherein the system data includes an operation data with a time series; and a prediction and alarm module executes the following procedure: according to a data quantity n, a cycle quantity m and a value of a standard deviation multiple k, the operation data stored in the database is read, and according to a time point, a plurality of data vectors [n×1] of m cycles are extracted from the operation data according to the time series, wherein each data vector [n×1] has n data quantity elements, wherein n and m are positive integers, and the value of k is a real number. ; sequentially assign the data vectors [n×1] of the multiple m cycles to a data matrix [n×m], generate an average vector [n×1] and a standard deviation vector [n×1] according to the data matrix [n×m], and then generate a prediction vector [n×1] according to the average vector [n×1], the standard deviation vector [n×1] and the value of the standard deviation multiple k; compare the data elements of the multiple prediction vectors [n×1] with the data elements of the data vectors [n×1] of the multiple corresponding cycles of the operation data in the time series to obtain a comparison result; and, according to the comparison result, determine whether to notify the input/output module to output an abnormal notification.

To achieve the above-mentioned purpose, the present invention further provides a modeling and training method for information system operation, comprising the following steps: receiving a system data from an information system and storing it in a database by an input/output module, wherein the system data includes historical data with a time series; and executing the following procedure by a modeling training module: reading the historical data stored in the database, and extracting a plurality of m-period historical data vectors [n×1] from the historical data according to the time series at a historical point in time, wherein each historical data vector [n×1] has n data elements, wherein n and m are positive integers; sequentially assigning the plurality of m-period historical data vectors [n×1] to a historical data Matrix [n×m], generate a historical average vector [n×1] and a historical standard deviation vector [n×1] according to the historical data matrix [n×m], and then generate a historical prediction vector [n×1] according to the historical average vector [n×1], the historical standard deviation vector [n×1] and a historical standard deviation multiple k, wherein the value of k is a real number; compare the data elements of the historical prediction vector [n×1] with the data elements of the historical data vector [n×1] of the multiple corresponding cycles of the historical data in the time series to obtain a verification result; and, according to the verification result, determine whether the values of n, m and k are used for the prediction and alarm of an operation data of the system data.

To achieve the above-mentioned invention object, the present invention further provides a computer program product for prediction and alarm of operation of an information system. The program is loaded into a computer system for execution: a processor is caused to read a system data stored in a database, the system data including operation data of the information system with a time series; the processor is caused to extract a plurality of data vectors [n×1] of m periods from the operation data according to the time series at a time point, each data vector [n×1] having n data elements, wherein n and m are positive integers; the processor is caused to sequentially assign the plurality of data vectors [n×1] of m periods to a data According to the matrix [n×m], according to the data matrix [n×m], a mean vector [n×1] and a standard deviation vector [n×1] are generated, and then a prediction vector [n×1] is generated according to the mean vector [n×1], the standard deviation vector [n×1] and a value of a standard deviation multiple k, wherein the value of k is a real number; the processor is made to compare the data elements of the data vector [n×1] of the operation data in the multiple corresponding cycles of the time series with the data elements of the prediction vector [n×1] to obtain a comparison result; and the processor is made to determine whether to notify an input/output module to output an abnormal notification according to the comparison result.

To achieve the above-mentioned purpose of the invention, the present invention further provides a computer program product for modeling and training the operation of an information system. The program is loaded into a computer system and executed to: enable a processor to read a system data stored in a database, wherein the system data includes a historical data of the information system having a time series; enable the processor to extract a plurality of m-period historical data vectors [n×1] from the historical data according to the time series at a historical time point, wherein each historical data vector [n×1] has n data elements, wherein n and m are positive integers; enable the processor to sequentially assign the plurality of m-period historical data vectors [n×1] to a historical data matrix [n×m ], generate a historical average vector [n×1] and a historical standard deviation vector [n×1] according to the historical data matrix [n×m], and then generate a historical prediction vector [n×1] according to the historical average vector [n×1], the historical standard deviation vector [n×1] and a historical standard deviation multiple k, wherein the value of k is a real number; compare the data elements of the historical prediction vector [n×1] with the data elements of the historical data vector [n×1] of the corresponding period of the historical data in the time series to obtain a verification result; and, enable the processor to determine whether the values of n, m and k are used for the prediction and alarm of an operation data of the system data according to the verification result.

In order to achieve the above-mentioned invention object, the present invention also provides a prediction and alarm system for information system operation, comprising: a database, storing a system data of an information system, the system data comprising an operation data with a time series; an input/output module, connecting the information system and the database, and receiving the system data from the information system; and a prediction alarm module, connecting the input/output module and the database, and executing: according to a data cycle n, a cycle number m and a standard deviation multiple k, reading the operation data stored in the database, and extracting a plurality of data vectors [n×1] of m cycles from the operation data according to the time series at a time point, each data vector [n×1] having n data elements elements, wherein n and m are positive integers, and the value of k is a real number; sequentially assigning the data vectors [n×1] of the multiple m periods to a data matrix [n×m], generating a mean vector [n×1] and a standard deviation vector [n×1] according to the data matrix [n×m], and then generating a prediction vector [n×1] according to the mean vector [n×1], the standard deviation vector [n×1] and the value of the standard deviation multiple k; comparing the data elements of the prediction vector [n×1] with the data elements of the data vector [n×1] of the corresponding period of the operation data in the time series to obtain a comparison result; and, according to the comparison result, determining whether to notify the input/output module to output an abnormal notification.

To achieve the above-mentioned invention purpose, the present invention also provides a modeling and training system for information system operation, comprising: a database storing system data of an information system, the system data comprising historical data with a time series; and a modeling training module connected to the database and executing: reading the historical data stored in the database, and extracting a plurality of m-period historical data vectors [n×1] from the historical data according to the time series at a historical point in time, each historical data vector [n×1] having n data elements, wherein n and m are positive integers; sequentially assigning the plurality of m-period historical data vectors [n×1] to a historical data matrix [ n×m], generate a historical average vector [n×1] and a historical standard deviation vector [n×1] according to the historical data matrix [n×m], and then generate a historical prediction vector [n×1] according to the historical average vector [n×1], the historical standard deviation vector [n×1] and a historical standard deviation multiple k, wherein the value of k is a real number; compare the data elements of the historical prediction vector [n×1] with the data elements of the historical data vector [n×1] of the corresponding period of the historical data in the time series to obtain a verification result; and determine whether the values of n, m and k are used for the prediction and alarm of an operation data of the system data according to the verification result.

In summary, according to the prediction and alarm system and method implemented by the present invention, and the modeling and training system and method thereof, a modeling training module is used to calculate a historical prediction vector through the historical data of the system data, and the optimal parameters applicable to a prediction alarm module are verified to achieve a more accurate prediction and alarm rate; and the optimal parameters are used by the prediction alarm module to calculate a prediction vector through the operation data of the system data, and the actual operation data is compared to determine whether an abnormality occurs, and whether to output an abnormality notification. In addition, the present invention uses convolution operations and adaptive mask matrix design to obtain a smooth prediction sequence, which can reduce the sensitivity of prediction abnormalities to increase the stability of system operation.

In addition, the present invention can process a large amount of system data generated by the operation of the information system, for example: operation data includes real-time order number GMV (Gross Merchandise Volume), turnover, consumption amount, number of online users, PV (Page View), RV (Repeat Visitors), UV (Unique Visitor), IP number, traffic source, region, device used, user browsing event, service website or application operation behavior, customer service call record, etc.; internal system data includes system LOG, infrastructure operation data, system indicators such as: CPU, memory usage, I/O number (Read/Write PS), network outflow/inflow, packet outflow/inflow, number of flexible open machines/clusters, Swap number, QPS (Queries Per Second), etc. Second), RPS, number of DB connections, machine response time, etc.

1: Information system

2: System data database

3: Input and output module

4: Prediction and alarm database

5: Prediction and alarm module

6: Modeling training module

7: Alignment position

8: Calculation range

10: Prediction and warning system

X : Data matrix/historical data matrix

Y : Forecast matrix/historical forecast matrix

M: mask matrix

S : Smoothed forecast series/smoothed historical forecast series

L: Batch history data volume/batch operation data volume

:平均向量/歷史平均向量

:Average vector/historical average vector

:標準差向量/歷史標準差向量

:Standard deviation vector/historical standard deviation vector

:預測向量/歷史預測向量

:Prediction vector/historical prediction vector

S101~S111: Steps

S201~S212: Steps

Figure 1 is a diagram of the architecture of the prediction and alarm system of the information system operation of the present invention.

Figure 2 is a flow chart of the prediction and alarm method of the information system operation of the present invention.

Figure 3 is a schematic diagram showing the prediction and alarm method of the information system of the present invention, which assigns the data matrix in sequence according to the time series to obtain the smooth prediction matrix for comparison.

Figure 4 is a schematic diagram of the prediction and alarm method for the operation of the information system of the present invention, which compares the operation data from the pth cycle with the prediction sequence according to the time series.

Figure 5 is a flow chart of the modeling and training method for the operation of the information system of the present invention.

FIG6 is a schematic diagram showing the validation results based on the set of n, m, and k values by assigning the modeling and training method of the information system operation of the present invention to the historical data matrix multiple times according to the time series to obtain the smoothed historical prediction matrix.

FIG7A is a schematic diagram of the modeling and training method of the information system operation of the present invention for verifying the fit of the historical prediction sequence calculated based on historical data and the set of n, m, and k values since period p.

FIG7B is a schematic diagram of the modeling and training method of the information system operation of the present invention, which verifies the historical prediction sequence calculated by the set of n, m, and k values using historical anomalies of historical data since period p.

FIG8A is a schematic diagram of the modeling and training method of the information system operation of the present invention, which verifies the consistency of the historical prediction sequence calculated based on the batch historical data volume L and the set of n, m, k values from a corresponding period in the time series.

FIG8B is a schematic diagram of the prediction and alarm method for the operation of the information system of the present invention, which compares the operation data from a corresponding cycle of a batch of operation data with the prediction sequence according to the time series.

進行卷積運算之示意圖，其中該遮罩矩陣與預測矩陣的疊合未超過週期範圍。 FIG. 9A shows a method of the present invention for predicting elements of a matrix based on a mask matrix.

Schematic diagram of performing a convolution operation, where the overlap of the mask matrix and the prediction matrix does not exceed the cycle range.

的卷積運算的計算範圍內各關聯週期的數據與遮罩矩陣的各元素對應之示意圖，其中該對應關係均在一個週期內。 FIG9B is a prediction sequence of the prediction matrix shown in FIG9A expanded according to the time series, in which the element

A schematic diagram showing the correspondence between the data of each associated cycle within the calculation range of the convolution operation and the elements of the mask matrix, wherein the correspondence is within one cycle.

與

的卷積運算為例，並考量預測向量關聯前、後接續週期的接續數據，其計算範圍包含遮罩矩陣的元素與接續數據對應之示意圖。 Figure 10 shows the overlap of the mask matrix and the prediction matrix when it exceeds the period range.

and

The convolution operation of is taken as an example, and the subsequent data of the previous and subsequent cycles associated with the prediction vector are considered, and the calculation scope includes a schematic diagram of the correspondence between the elements of the mask matrix and the subsequent data.

與

的卷積運算為例，但不考量預測向量關聯前、後接續週期的接續數據，其計算範圍不包含遮罩矩陣的元素與接續數據對應之示意圖。 Figure 11 shows the mask matrix and the prediction matrix when the overlap exceeds the period range.

and

The convolution operation of is taken as an example, but the subsequent data of the consecutive cycles before and after the prediction vector is associated are not considered, and the calculation range does not include the schematic diagram of the correspondence between the elements of the mask matrix and the subsequent data.

與

的卷積運算為例，並考量預測向量關聯前、後接續週期的接續數據，其計算範圍包含遮罩矩陣的元素與接續數據對應之示意圖。 FIG12 shows the first prediction vector of the prediction matrix corresponding to the 7th cycle. The mask matrix performs convolution operation on the first prediction vector, with element

and

The convolution operation of is taken as an example, and the subsequent data of the previous and subsequent cycles associated with the prediction vector are considered, and the calculation scope includes a schematic diagram of the correspondence between the elements of the mask matrix and the subsequent data.

與

的卷積運算為例，但不考量預測向量關聯前、後接續週期的接續數據，其計算範圍不包含遮罩矩陣的元素與接續數據對應之示意圖。 FIG13 shows the first prediction vector of the prediction matrix corresponding to the 7th cycle. The mask matrix performs convolution operation on the first prediction vector, with element

and

The convolution operation of is taken as an example, but the subsequent data of the consecutive cycles before and after the prediction vector is associated are not considered, and the calculation range does not include the schematic diagram of the correspondence between the elements of the mask matrix and the subsequent data.

FIG14 is a schematic diagram showing the correspondence between a smoothed prediction sequence S formed by expanding a smoothed prediction matrix formed by performing a convolution operation on a periodic prediction matrix Y through a mask matrix and the expansion of the prediction matrix Y before the convolution operation.

The following is a specific example to illustrate the implementation of the present invention.

First, please refer to Figure 1, which shows the architecture of the prediction and alarm system 10 of the information system operation of the present invention. The prediction and alarm system 10 of the present invention communicates with the external information system 1 to read the system data stored in the system data database 2 of the information system 1. The system data includes historical data and recent operation data generated by the operation of the information system 1. The prediction and alarm system 10 and method of the present invention can be modeled and trained based on the historical data of the system data to determine the best parameters for predicting and alarming whether the operation data has abnormal conditions, such as: the periodicity and standard deviation multiples of the system data.

In one embodiment of the present invention, a prediction and alarm system 10 for information system operation includes an input/output module 3, a prediction alarm database 4, a prediction alarm module 5, and a modeling training module 6, wherein the input/output module 3 reads system data stored in a system data database 2 connected to an information system 1, and stores the system data in the prediction alarm database 4. The modeling training module 6 reads a historical data with a time series of system data from the prediction alarm database 4. The modeling and training module 6 executes the modeling and training method of the present invention as shown in FIG5 , and verifies the optimal parameters applicable to the prediction and alarm module 5 based on the historical data of the system data, so that the prediction and alarm module 5 can achieve more accurate prediction and alarm efficiency. In a preferred embodiment, the optimal parameters include a data cycle n value, a cycle quantity m value, and a standard deviation multiple k value.

In the embodiment of the present invention, the prediction alarm module 5 obtains the n value, m value and k value of the optimal parameter from the modeling training module 6, and reads an operation data with a time series of the system data from the prediction alarm database 4. The prediction alarm module 5 executes the prediction and alarm method of the present invention as shown in FIG2 to calculate a prediction sequence of the operation data, and compares the prediction sequence with the corresponding actual operation data, and then determines whether the system data corresponding to the actual operation data is abnormal, and outputs an abnormal notification to inform relevant personnel to handle it immediately.

Please refer to FIG. 2, FIG. 3 and FIG. 4 in conjunction with FIG. 1. FIG. 2 shows a flow chart of the prediction and alarm method of the system operation of the present invention. FIG. 3 shows a schematic diagram of the prediction and alarm method of the information system operation of the present invention assigning data to a data matrix in sequence according to a time series to obtain a smooth prediction matrix for comparison. FIG. 4 shows a schematic diagram of the prediction and alarm method of the information system operation of the present invention comparing the operation data from the p cycle with the prediction sequence according to the time series. In the embodiment of the present invention, the flow chart shown in FIG. 2 is executed by the prediction and alarm module 5. The prediction and alarm method of the present invention includes: step S101, the input/output module 3 reads system data from a system data database 2 of an information system, and the system data includes operation data with a time series, as shown in FIG4.

In step S102, the prediction alarm module 5 determines a data cycle n, a cycle number m and a standard deviation multiple k, wherein the n value, the m value and the k value are the optimal parameter values provided by the modeling training module 6, and the values of n and m are positive integers, and the value of k is a real number. Next, in step S103, referring to FIG. 3, the prediction alarm module 5 extracts a data volume of n×m data elements from the operation data according to a time point of the time series, and divides the data volume into data vectors [n×1] of m periods, each data vector [n×1] having n data elements, and the starting time point of each data vector [n×1] of m periods differs from the starting time point of the data vector [n×1] of the previous m periods by one cycle of data vectors, and the m data vectors [n×1] are assigned to a data matrix X [n×m] according to the time series, as shown in FIG. 4. The data matrix X [n×m] can be represented by the following formula:

[n×1]與一標準差向量

[n×1]。該平均向量

與該標準差向量

可由以下式子計算獲得：

,

,i=1…n Step S104, the prediction alarm module 5 calculates an average vector according to the data matrix X [n×m]

[n×1] and a standard deviation vector

[n×1]. The average vector

and the standard deviation vector

It can be calculated by the following formula:

,

, i =1… n

,

,i=1…n

,

, i =1… n

[n×1]、該標準差向量

[n×1]與該標準差倍數k的值以計算獲得一預測向量

[n×1]。該預測向量

[n×1]可由以下式子計算獲得：

Step S105, referring to FIG3, the prediction alarm module 5 further generates a prediction result according to the average vector

[n×1], the standard deviation vector

[n×1] and the value of the standard deviation multiple k to calculate a prediction vector

[n×1]. The prediction vector

[n×1] can be calculated by the following formula:

[n×1]加上或減去該標準差向量

[n×1]與該標準差倍數k的值之積，並依照不同情境，能夠調整所取用的範圍，例如預測一上限值、或下限值、或一區間。 In another embodiment of the present invention, the average vector

[n×1] plus or minus the standard deviation vector

The product of [n×1] and the value of the standard deviation multiple k can be used to adjust the range used according to different situations, such as predicting an upper limit, a lower limit, or an interval.

[n×1]與一標準差向量

[n×1]，據此進一步依序生成多個預測向量

[n×1]。 Step S106, please refer to Figures 3 and 4 at the same time, the prediction alarm module 5 sequentially assigns the data vectors of the m cycles from the second cycle to the m+1th cycle after the time point to the data matrix X [n×m]. Each time it returns to step S104 and step S105, and calculates an average vector based on the newly assigned data matrix X [n×m].

[n×1] and a standard deviation vector

[n×1], and then further generate multiple prediction vectors in sequence

[n×1].

[n×1]可用於監督該運作資料在該時間序列的一對應週期的運行狀況。在本發明中，該對應週期之起始時間點可依使用情況選擇，例如緊接著前述所取之該等運作資料之下一個週期、或下一年的相同時間點、或使用者使用期間的相應時點等，根據不同使用情境調整該對應關係，使該預測向量

[n×1]用於監督該運作資料在該對應週期的運行狀況；換言之，參考圖4，該預測告警模組5以多個m個週期的數據量來預測其對應週期的預測值，每個週期以一個向量[n×1]表示。 Specifically, the prediction vectors

[n×1] can be used to monitor the operation status of the operation data in a corresponding cycle of the time series. In the present invention, the starting time point of the corresponding cycle can be selected according to the usage situation, such as the next cycle immediately following the aforementioned operation data, or the same time point in the next year, or the corresponding time point during the user's use, etc. The corresponding relationship is adjusted according to different usage scenarios so that the prediction vector

[n×1] is used to monitor the operating status of the operating data in the corresponding cycle; in other words, referring to FIG. 4 , the prediction alarm module 5 uses the data of multiple m cycles to predict the predicted value of the corresponding cycle, and each cycle is represented by a vector [n×1].

[n×1]生成一預測矩陣Y。接著步驟S108，參考圖3，該預測告警模組5將該預測矩陣Y根據一遮罩矩陣M，對該預測矩陣Y進行卷積運算，透過卷積運算將該預測矩陣Y進行平滑化，以獲得一平滑預測矩陣。關於根據一遮罩矩陣M對該預測矩陣Y進行卷積運算與依時間序列展開之預測序列S之運算方式，其中預測矩陣Y與平滑化預測序列S的第一個週期係該運作資料在時間序列上的該對應週期，將在後面的圖9A與圖9B進一步詳細說明卷積運算。 Step S107, referring again to FIG. 3, the prediction alarm module 5 uses a plurality of prediction vectors

[n×1] generates a prediction matrix Y. Then, in step S108, referring to FIG3, the prediction alarm module 5 performs a convolution operation on the prediction matrix Y according to a mask matrix M, and smoothes the prediction matrix Y through the convolution operation to obtain a smooth prediction matrix. Regarding the operation method of performing a convolution operation on the prediction matrix Y according to a mask matrix M and the prediction sequence S unfolded according to the time series, wherein the first cycle of the prediction matrix Y and the smoothed prediction sequence S is the corresponding cycle of the operation data on the time series, the convolution operation will be further described in detail in the following FIG9A and FIG9B.

[n×1]，再經平滑化預測矩陣Y而展開為平滑預測序列S，其中預測矩陣Y與平滑化預測序列S的第一個週期係該運作資料在時間序列上的該對應週期。在本發明的實施例中，步驟S106，係確認該預測矩陣Y可包含數個或足夠多的預測向量

[n×1]後，才進行步驟S107、步驟S108以對該預測矩陣Y進行卷積運算，進而獲得一平滑預測矩陣，再依時間序列展開為預測序列S。 Therefore, the multiple data matrices X [n×m] are processed from step S104 to step S108 to generate the prediction matrix Y and the smoothed prediction sequence S. The prediction alarm module 5 assigns the m data vectors [n×1] of the second period to the m+1 period to the data matrix X [n×m] in a time series. From the data obtained, it can be regarded as removing the data vector [n×1] of the first period from the data matrix X [n×m], combining the data vectors [n×1] of the second period to the m+1 period in a time series to form the data matrix X [n×m], and so on. Therefore, the data matrix X [n×m] used for calculation each time maintains the same size [n×m]. As shown in Figure 4, the data matrix X [n×m] is a moving window of m cycles, based on which the prediction vector of the next cycle is calculated successively.

[n×1], and then unfolded into a smoothed prediction sequence S through a smoothed prediction matrix Y , wherein the first cycle of the prediction matrix Y and the smoothed prediction sequence S is the corresponding cycle of the operation data in the time series. In the embodiment of the present invention, step S106 is to confirm that the prediction matrix Y can contain a plurality of or sufficient prediction vectors

[n×1], steps S107 and S108 are performed to perform convolution operations on the prediction matrix Y , thereby obtaining a smoothed prediction matrix, which is then expanded into a prediction sequence S according to the time series.

In step S109, the prediction alarm module 5 compares the operation data of the system data from the corresponding period of the time sequence with the smoothed prediction sequence S according to the time sequence. The prediction sequence S expanded by smoothing the prediction matrix is compared with the operation data of the corresponding period of the system data to obtain a comparison result.

In step S110, the prediction alarm module 5 monitors whether the system data has an abnormality. If the prediction sequence of the smooth prediction matrix is expanded and compared with the matched operation data, if it is judged that there is no abnormality, it returns to S101, and the input/output module 3 reads the next system data from the system data database 2 of the information system. When it is judged that an abnormality has occurred, step S111 is executed. Referring to Figure 4, for example, when the operation data appears to be higher than the value of the prediction sequence S in the p+1th cycle, it is judged that an abnormality has occurred. In step S111, the prediction alarm module 5 issues an abnormality notification through the input/output module 3 and records the abnormality notification in the prediction alarm database 4.

FIG. 3 is a diagram showing the prediction and alarm method of the system operation of the present invention, in which steps S104 to S108 are assigned to the data matrix multiple times according to the time series to obtain a smooth prediction matrix for comparison. In this embodiment, the prediction alarm module further executes the following procedures: read the data vector [n×1] of the operation data from the 2nd cycle to the m+1th cycle at the time point stored in the prediction alarm database, assign the data vector [n×1] of the 2nd cycle to the m+1th cycle to the data matrix X [n×m] according to the time series; and calculate the prediction vector [n×1] of the next cycle (i.e., the p+1th cycle) of the corresponding cycle according to the assigned data matrix X [n×m]. Similarly, the operation data stored in the prediction alarm database is read, and the data vectors [n×1] of m cycles from the 3rd cycle to the m+2th cycle are sequentially assigned to the data matrix X [n×m] in time series to calculate a plurality of prediction vectors [n×1]. Therefore, a prediction matrix Y is obtained by generating a plurality of prediction vectors [n×1] from the corresponding period according to the time series, and a convolution operation is performed on the prediction matrix Y according to a mask matrix M to obtain a smooth prediction matrix, and a smooth prediction sequence S expanded from the smooth prediction matrix can correspond to the data vector [n×1] of the operation data from the corresponding period; and one or more data elements of the operation data from the corresponding period of the time series are compared with one or more data elements of the smooth prediction sequence S to obtain the comparison result.

[n×1]與一標準差向量

[n×1]，再根據該平均向量

[n×1]、該標準差向量

[n×1]與該標準差倍數k的值以計算獲得一預測向量

[n×1]，該預測向量

[n×1]用於監督該運作資料在該時間序列的一對應週期p的狀況；比對該運作資料在該時間序列的該對應週期的數據向量[n×1]的數據元素與該預測向量

[n×1]的數據元素，以獲得一比對結果，計算之該平滑預測矩陣展開的預測序列S的數據元素與該運作資料對應 的數據元素進行比對，根據該比對結果，以決定是否通知該輸出入模組輸出一異常通知。 FIG4 is a schematic diagram showing the prediction and alarm method of the system operation of the present invention, which compares the operation data of the time series from the pth period with the prediction sequence S expanded by the smooth prediction matrix. In this embodiment, the prediction alarm module calculates an average vector according to the data matrix X [n×m].

[n×1] and a standard deviation vector

[n×1], and then based on the average vector

[n×1], the standard deviation vector

[n×1] and the value of the standard deviation multiple k to calculate a prediction vector

[n×1], the prediction vector

[n×1] is used to monitor the status of the operation data in a corresponding cycle p of the time series; compare the data elements of the data vector [n×1] of the operation data in the corresponding cycle of the time series with the prediction vector

[n×1] data elements are used to obtain a comparison result, and the data elements of the prediction sequence S calculated by expanding the smooth prediction matrix are compared with the data elements corresponding to the operation data. According to the comparison result, it is determined whether to notify the input/output module to output an abnormal notification.

Please refer to FIG. 5, FIG. 6 and FIG. 7A in conjunction with FIG. 1. FIG. 5 shows a flow chart of the modeling and training method of the system operation of the present invention. FIG. 6 shows a schematic diagram of the modeling and training method of the information system operation of the present invention, which assigns to the historical data matrix multiple times according to the time series to obtain the smoothed historical prediction matrix, and compares them accordingly. FIG. 7A shows an embodiment of the modeling and training method of the information system operation of the present invention, which shows a schematic diagram of comparing the historical data from the p period of the time series with the historical prediction sequence. In the embodiment of the present invention, the flow chart shown in FIG. 5 is executed by the modeling training module 6. The modeling and training method of the present invention includes: step S201, the input/output module 3 reads system data from a system data database 2 of an information system, and the system data includes historical data with a time series, as shown in FIG7A.

Pre-selected parameters are stored in the prediction alarm database 4, which include a data cycle n, a cycle quantity m, and a standard deviation multiple k, and the value range of each parameter is determined in advance, where the values of n and m are positive integers, and the value of k is a real number. The modeling training module 6 will perform modeling and training based on the value range of all parameters.

In step S202, the modeling training module 6 selects a combination of n, m and k values from their respective value ranges. Then in step S203, referring to FIG6 , the modeling training module 6 selects a combination of n, m and k values according to step S202, and extracts a data volume of n×m historical data elements from the historical data according to a historical point in time of the time series, and divides the data volume into historical data vectors [n×1] of m periods, each historical data vector [n×1] having n historical data elements, and assigns the m historical data vectors [n×1] to a historical data matrix X [n×m] according to the time series, as shown in FIG7A . The historical data matrix X [n×m] can be represented by the following formula (1):

[n×1]與一歷史標準差向量

[n×1]。該歷史平均向量

與該歷史標準差向量

可由以下式子計算獲得：

,

,i=1…n Step S204, the modeling training module 6 calculates a historical average vector according to the historical data matrix X [n×m]

[n×1] and a historical standard deviation vector

[n×1]. The historical average vector

and the historical standard deviation vector

It can be calculated by the following formula:

,

, i =1… n

,

,i=1…n

,

, i =1… n

[n×1]、該歷史標準差向量

[n×1]與該標準差倍數k的值以計算獲得一歷史預測向量

[n×1]。該歷史預測向量

[n×1]可由以下式子計算獲得：

Step S205, referring to FIG6, the modeling training module 6 further uses the historical average vector

[n×1], the historical standard deviation vector

[n×1] and the value of the standard deviation multiple k to calculate a historical forecast vector

[n×1]. The historical prediction vector

[n×1] can be calculated by the following formula:

[n×1]加上或減去該歷史標準差向量

[n×1]與該標準差倍數k的值之積，並依照不同情境，能夠調整所取用的範圍，例如預測一上限值、或下限值、或一區間。 In another embodiment of the present invention, the historical average vector

[n×1] plus or minus the historical standard deviation vector

The product of [n×1] and the value of the standard deviation multiple k can be used to adjust the range used according to different situations, such as predicting an upper limit, a lower limit, or an interval.

[n×1]與一歷史標準差向量

[n×1]，據此進一步依序生成多個歷史預測向量

[n×1]。 Step S206, please refer to Figure 6 and Figure 7A at the same time, the modeling training module 6 sequentially assigns the data vectors of m cycles from the second cycle to the m+1th cycle after the time point to the historical data matrix X [n×m]. Each time it returns to step S204 and step S205, and calculates a historical average vector based on the newly assigned historical data matrix X [n×m].

[n×1] and a historical standard deviation vector

[n×1], and then further generate multiple historical prediction vectors in sequence

[n×1].

[n×1]可分別用於判斷該歷史資料在該時間序列的一對應週期的歷史狀況。在本發明中，該等對應週期之起始時間點可依使用情況選擇，例如緊接著前述所取之該等歷史資料之下一個週期、或該歷史資料之時間序列上之下一年的相同時間點、或使用者使用期間的相應時點等，根據不同使用情境調整該對應關係，使該預測向量

[n×1]用於判斷該歷史資料在該歷史時點的對應週期的狀況；換言之，參考圖7A，該建模訓練模組6以多個m個週期的數據量來訓練其歷史對應週期的歷史預測值，每個週期以一個向量[n×1]表示。 Specifically, the historical forecast vectors

[n×1] can be used to judge the historical status of the historical data in a corresponding period of the time series. In the present invention, the starting time points of the corresponding periods can be selected according to the usage situation, such as the next period immediately following the historical data taken above, or the same time point of the next year on the time series of the historical data, or the corresponding time point during the user's use, etc. The corresponding relationship is adjusted according to different usage scenarios so that the prediction vector

[n×1] is used to determine the status of the corresponding period of the historical data at the historical point in time; in other words, referring to FIG. 7A , the modeling training module 6 uses a data volume of multiple m periods to train the historical prediction values of its historical corresponding period, and each period is represented by a vector [n×1].

[n×1]生成一歷史預測矩陣Y。接著步驟S208，參考圖6，該建模訓練模組6將該歷史預測矩陣Y根據一遮罩矩陣M，對該歷史預測矩陣Y進行卷積運算，透過卷積運算將該歷史預測矩陣Y進行平滑化，以獲得一平滑歷史預測矩陣。關於根據一遮罩矩陣M對該歷史預測矩陣Y進行卷積運算與依歷史預測矩陣展開之歷史預測序列S之運算方式，其中歷史預測矩陣Y與平滑化歷史預測序列S的第一個週期係該歷史資料在時間序列上的該對應週期，將在後面的圖9A與圖9B進一步詳細說明卷積運算。 Step S207, referring again to FIG. 6, the modeling training module 6 uses multiple historical prediction vectors

[n×1] generates a historical prediction matrix Y. Then, in step S208, referring to FIG6, the modeling training module 6 performs a convolution operation on the historical prediction matrix Y according to a mask matrix M, and smoothes the historical prediction matrix Y through the convolution operation to obtain a smoothed historical prediction matrix. Regarding the convolution operation of the historical prediction matrix Y according to a mask matrix M and the operation method of the historical prediction sequence S expanded according to the historical prediction matrix, wherein the first period of the historical prediction matrix Y and the smoothed historical prediction sequence S is the corresponding period of the historical data in the time series, the convolution operation will be further explained in detail in the following Figures 9A and 9B.

[n×1]，再經平滑化歷史預測矩陣Y而展開為平滑歷史預測序列S。在本發明的實施例中，步驟S206，係確認該預測矩陣Y包含數個或足夠多的歷史預測向量

[n×1]後，才進行步驟S207、步驟S208以對該歷史預測矩陣Y進行卷積運算，進而獲得一平滑歷史預測矩陣，再依時間序列展開為歷史預測序列S。 Therefore, the multiple historical data matrices X [n×m] are calculated from step S204 to step S208 to update the historical prediction matrix Y and the smoothed historical prediction matrix. The modeling training module 6 assigns the historical data vectors [n×1] from the second period to the m+1 period to the historical data matrix X [n×m] according to the time series. From the data obtained, it can be regarded as removing the historical data vectors [n×1] of the first period from the historical data matrix X [n×m], and combining the historical data vectors [n×1] from the second period to the m+1 period according to the time series to become the historical data matrix X [n×m], and so on. Therefore, the historical data matrix X [n×m] used for calculation each time maintains the same size [n×m]. As shown in FIG7A, the historical data matrix X [n×m] is a moving window with m periods, and the historical prediction vector of the next period is calculated successively.

[n×1], and then the smoothed historical prediction matrix Y is unfolded into a smoothed historical prediction sequence S. In the embodiment of the present invention, step S206 is to confirm that the prediction matrix Y contains a plurality of or sufficient historical prediction vectors

[n×1], steps S207 and S208 are performed to perform convolution operations on the historical prediction matrix Y , thereby obtaining a smoothed historical prediction matrix, which is then expanded into a historical prediction sequence S according to the time series.

In step S209, the modeling training module 6 compares the historical data of the system data from the corresponding period of the time series with the smoothed historical prediction sequence S according to the time series. The historical prediction sequence S expanded by smoothing the historical prediction matrix is compared with the historical data of the corresponding period of the system data to obtain a verification result. Then in step S210, the modeling training module 6 records the combination of the data period n, the period quantity m and the standard deviation multiple k of the verification result after comparing the historical prediction sequence S expanded by smoothing the historical prediction matrix with the historical data of the corresponding period of the system data in the prediction alarm database 4.

In step S211, the modeling training module 6 determines whether all combinations of n, m and k values within the given range of each parameter have been calculated; if there are still uncalculated combinations of n, m and k values within the range of each parameter, steps S202 to S210 are executed again; if all combinations of n, m and k values within the range of each parameter have been calculated, step S212 is executed. The values of each parameter can be randomly selected or selected iteratively such as by grid search; that is, the number of cycles m can be analyzed in advance. In step S212, the modeling training module 6 will determine the optimal values of the data cycle n, the cycle number m and the standard deviation multiple k based on the recorded verification results, and provide them to the prediction and alarm module 5 to further execute the prediction and alarm method of the system operation as shown in Figure 2. Later, the verification methods of different embodiments will be explained in conjunction with Figures 7A and 7B to determine the optimal values of parameters such as the data cycle n, the cycle number m and the standard deviation multiple k.

FIG. 6 is a schematic diagram showing the modeling and training method of the system operation of the present invention, and the verification results of steps S202 to S210 are assigned to the historical data matrix multiple times according to the time series to obtain the smoothed historical prediction matrix for comparison. In this embodiment, the modeling training module 6 further executes the following procedures: reading the historical data vector [n×1] of the 2nd cycle to the m+1th cycle at the time point stored in the prediction alarm database 4, assigning the historical data vector [n×1] of the 2nd cycle to the m+1th cycle to the historical data matrix X [n×m] according to the time series; and calculating the historical prediction vector [ n×1] of the next cycle (i.e., the p+1th cycle) of the corresponding cycle according to the assigned historical data matrix X [n×m]. Similarly, the historical data stored in the prediction alarm database 4 is read, and the historical data vectors [n×1] of m periods from the 3rd period to the m+2th period are sequentially assigned to the historical data matrix X [n×m] in order to calculate a plurality of historical prediction vectors [n×1]. Therefore, a historical prediction matrix Y is obtained by combining multiple historical prediction vectors [n×1] from the corresponding period according to the time series, and a convolution operation is performed on the historical prediction matrix Y according to a mask matrix M to obtain a smoothed historical prediction matrix. The smoothed prediction sequence S expanded from the smoothed prediction matrix can correspond to the data vector [n×1] of the historical data from the corresponding period; and one or more historical data elements of the historical data from the corresponding period of the time series are compared with one or more data elements of the smoothed historical prediction matrix to obtain the verification result.

Please refer to FIG. 7A and FIG. 7B , which respectively show the verification methods of different embodiments of the present invention to determine the optimal values of parameters such as the data cycle n, the number of cycles m, and the standard deviation multiple k. As shown in FIG. 7A , a modeling and training method for the system operation of an embodiment of the present invention, a corresponding cycle of the time series is the p cycle of the historical time point, and in step S209, the historical data from the p cycle at the historical time point is compared with the smoothed historical prediction matrix to form a smoothed historical prediction sequence S. The comparison method is to use the root mean square error (RMSE) between the corresponding data elements of the two as the verification result, and the smaller the value, the more accurate the n, m, and k values of the modeling and training are. Therefore, step S212 will obtain all the verification results from the records of step S210, and select the one with the smallest difference between the historical data and the smoothed historical prediction sequence S since period p (i.e., the minimum root mean square error), that is, the best fit between the two, and then calculate the combination of n, m and k values of the smoothed historical prediction sequence S as the optimal value of the parameters.

As shown in FIG. 7B , the modeling and training method of the system operation of another embodiment of the present invention, when a corresponding period of the time series is the p period at the historical time point, the historical anomaly of the historical data from the p period is used to verify the historical prediction sequence S calculated by the set of n, m, and k values for comparison. In step S204, the historical data from the p period at the historical time point has a known historical anomaly; in step S209, the historical data from the p period at the historical time point is compared with the smoothed historical prediction sequence S expanded by the smoothed historical prediction matrix, and the comparison method is that the data element of the historical anomaly exceeds the smoothed historical prediction sequence S as the verification result. Therefore, step S212 will obtain all the verification results from the records of step S210, select the historical anomalies of the historical data since period p that can be accurately detected by the smoothed historical prediction sequence S , and then calculate the combination of n, m and k values of the smoothed historical prediction sequence S as the optimal value of the parameters.

Please refer to FIG. 8A and FIG. 8B, which respectively show schematic diagrams of a modeling and training method and a prediction and alarm method of another embodiment of the present invention. In another embodiment of the present invention, the modeling and training method is based on batch historical data volume L for modeling and training. For example, the historical data volume of May is used to form a historical data matrix, and a historical prediction vector is calculated based on it. The historical prediction vector is used to judge the historical status of the historical data in a corresponding period of the historical data volume of June, and the optimal values of parameters such as the data period n, the period quantity m, and the standard deviation multiple k are obtained. Based on the optimal values of parameters such as data cycle n, cycle quantity m and standard deviation multiple k, the prediction and alarm method is based on the batch operation data volume L for prediction and supervision. For example, the data matrix is composed of the operation data volume in May, and a prediction vector is calculated based on it. The prediction vector is used to monitor the operation status of the corresponding cycle of the operation data volume in June, so as to monitor whether the operation data volume in June is abnormal.

FIG8A is a schematic diagram of a modeling and training method for information system operation according to another embodiment of the present invention, which verifies the fit of the historical prediction sequence calculated based on the batch historical data volume L and the set of n, m, and k values from a corresponding period in a time series. Taking the historical data volume of May as an example to form a historical data matrix and verifying it with the historical data volume of June, refer to FIG5. After selecting the values of n, m, and k in step S202, step S203 combines the data vectors of the first to mth periods of the historical data volume of May into a historical data matrix. After step S204 and step S205, a historical prediction vector is calculated, and in step S206, a data vector is sequentially assigned to the historical data matrix from the m+1th cycle of the historical data in May, thereby obtaining a historical prediction matrix. The historical prediction matrix is used to determine the historical status of the historical data from a corresponding cycle of the historical data in June, and the corresponding cycle can be the first cycle of the historical data in June, or an intermediate cycle between the first and the mth cycle, or the mth cycle. Therefore, through different implementations of the corresponding period, the smoothed historical forecast sequence S obtained by selecting the values of n, m and k in step S202 can be evaluated and verified for the closeness of the historical data in June to determine the optimal values of n, m and k.

FIG8B is a schematic diagram of the prediction and alarm method of information system operation according to another embodiment of the present invention, which compares the operation data from a corresponding cycle of a batch of operation data L with the prediction sequence according to the time series. Taking the operation data of May as an example to monitor the operation data of June, refer to FIG2. After the values of n, m and k are determined in step S102, step S103 combines the data vectors of the first to mth cycles of the operation data of May into a data matrix. After step S104 and step S105, a prediction vector is calculated, and in step S107, a data vector is sequentially assigned to the data matrix from the m+1th cycle of the May operation data, thereby obtaining a prediction matrix. The prediction matrix is used to monitor whether the operation status from a corresponding cycle of the June operation data is abnormal, and the corresponding cycle can be the first cycle of the June operation data, or an intermediate cycle between the first and the mth cycle, or the mth cycle. In other words, in another embodiment of the present invention, the data vectors of the 1st to mth cycles of the May operation data are used to predict the data vectors of the 1st cycle of the June operation data, or the intermediate cycle between the 1st and mth cycles, or the mth cycle. The corresponding cycle can be determined by the modeling training module 6 when evaluating the optimal values of n, m, and k.

進行卷積運算之示意圖；圖9B為顯示圖9A所示預測矩陣依時間序列展開之預測序列，在元素

的卷積運算的計算範圍內各關聯週期的數據與遮罩矩陣M的各元素對應之示意圖。該運算如圖9A所示，以n=6，預測矩陣Y的第7、8、9週期的預測向量為例，而該遮罩矩陣M如以下式子為例：

Next, referring to FIG. 9A and FIG. 9B, step S108 of the process shown in FIG. 2 and step S208 of the process shown in FIG. 5 will be described, regarding the convolution operation of the prediction matrix Y according to a mask matrix M and the prediction sequence S expanded according to the time series. FIG. 9A shows the method of the present invention, according to a mask matrix M, for performing a convolution operation on the elements of the prediction matrix.

FIG9B is a diagram showing the prediction sequence of the prediction matrix shown in FIG9A unfolded according to the time series, in which the element

The convolution operation of FIG. 9A shows the correspondence between the data of each associated period within the calculation range and each element of the mask matrix M. The operation is shown in FIG. 9A , taking n=6, the prediction vectors of the 7th, 8th, and 9th periods of the prediction matrix Y as an example, and the mask matrix M is as follows:

In this embodiment of the present invention, the mask matrix M is designed as a symmetrical matrix with upper and lower triangles, and the weight values of the upper left triangle and the lower left triangle are 0, and the remaining weight values are non-zero values. The arrangement shape of the non-zero values is a triangle, with the center of the last row as the maximum value, decreasing to the left and up and down. Since the convolution operation finally takes the average value, the weight size and range of the weight value are not limited; the larger the weight setting, the larger the final weighted total number, and the larger the value divided by.

In detail, the mask matrix M[a×b] is pre-designed, and its width b is approximately 1/2 of the width of the prediction matrix Y to be convolutionally calculated. The arrangement shape of the non-zero values is: a triangle with the bth row of the matrix as the base and the height b, and an element of the bth row is used as the alignment position aligned with the prediction matrix Y during the convolution operation. The alignment position is preferably at the center of the row, and it is the maximum value of the non-zero values, which can be set to b/2 and is not limited to an integer. The other non-zero values decrease from the alignment position to the left and up and down, and the decreasing difference is not limited to 1. In addition, the mask matrix M[a×b] can also use machine learning to obtain a better size.

進行卷積運算的計算範圍8，包含該遮罩矩陣M對預測矩陣Y的重疊元素。元素

進行卷積運算如以下式子表示：

As shown in FIG9A , the mask matrix M has an alignment position 7. When the mask matrix M performs a convolution operation on the prediction matrix Y , a smooth prediction matrix can be obtained by aligning each element of the prediction matrix Y one by one with the alignment position 7 of the mask matrix M.

The calculation range 8 for performing the convolution operation includes the overlapping elements of the mask matrix M and the prediction matrix Y.

The convolution operation is expressed as follows:

；或者亦可在

或

代表考慮待測時間點及該點在其他週期之對應時間點之前、後的影響。遮罩矩陣M的尺寸亦可 嘗試不同大小。非零數值的權重值亦可僅有上半部三角形，代表不考慮待測時間點及該點在其他週期之對應時間點之後的影響。 The above formula is only an example of the calculation of FIG. 9A. The calculation of the mask matrix M on the prediction matrix Y will have different overlaps according to different overlapping elements. A smooth prediction matrix can be obtained by aligning the alignment position 7 of the mask matrix M with each element of the prediction matrix Y one by one. In addition, according to different designs of the mask matrix M, its alignment position 7 can also have different positions. For example, the alignment position 7 shown in FIG. 9A is

Or you can

or

It means that the influence of the time point to be tested and the time point before and after the corresponding time point in other cycles is considered. The size of the mask matrix M can also be tried in different sizes. The non-zero weight value can also only have the upper triangle, which means that the influence of the time point to be tested and the time point after the corresponding time point in other cycles is not considered.

。當卷積運算的重疊元素都在預測矩陣Y的前接續週期的範圍內時，如圖9A所示計算範圍8，該遮罩矩陣M與該預測矩陣的卷積運算，是基於該預測矩陣中該預測向量[n×1]關聯前接續週期的預測向量的影響。如圖9B所示，以預測序列了解卷積運算的計算範圍，該遮罩矩陣M的對準位置7對準預測序列的第9週期之元素y₃時，卷積運算是關聯前接續第7與第8週期，計算範圍包含前接續第7與第8週期的5個重疊元素。 Please refer to FIG. 9B , when the prediction matrix Y is expanded into a prediction sequence according to the time series, the element y ₃ of the 9th period is the element of the prediction matrix Y

. When the overlapping elements of the convolution operation are all within the range of the previous successive cycle of the prediction matrix Y , the calculation range is 8 as shown in FIG9A , and the convolution operation of the mask matrix M and the prediction matrix is based on the influence of the prediction vector [n×1] in the prediction matrix being associated with the prediction vector of the previous successive cycle. As shown in FIG9B , the calculation range of the convolution operation is understood by the prediction sequence, and when the alignment position 7 of the mask matrix M is aligned with the element y ₃ of the 9th cycle of the prediction sequence, the convolution operation is associated with the 7th and 8th previous successive cycles, and the calculation range includes 5 overlapping elements of the 7th and 8th previous successive cycles.

Therefore, the distance between the corresponding time points of the previous successive cycles and the time point of the alignment position 7 will be processed by the mask matrix M according to the preset weight value. The purpose of the convolution calculation is to smooth the predicted sequence to avoid causing the system to be overly sensitive and misjudged. In addition to the detected value itself (the element corresponding to the alignment position 7), the previous and subsequent elements of the previous and subsequent time units on the vertical axis and the corresponding elements of the same time point in the previous successive cycle are also referred to for calculation according to different weights.

When the overlapping elements of the mask matrix M on the prediction matrix Y exceed the range of the previous successive cycle of the prediction matrix Y , different embodiments of the present invention will have different calculation ranges. In one embodiment of the present invention, the convolution operation of the mask matrix M and the prediction matrix is based on the influence of the prediction vector [n×1] in the prediction matrix on the continuous data of the previous successive cycle or the subsequent successive cycle according to the time series, and the calculation range of the convolution operation includes calculating the product of the continuous data of the prediction vector of the previous successive cycle or the subsequent successive cycle associated with the calculation and the corresponding weight value of the mask matrix M, as shown in Figures 10 and 12. In another embodiment of the present invention, the convolution operation of the mask matrix M and the prediction matrix is based on the influence of the prediction vector in the prediction matrix on the successive data of the time series that is not associated with the prediction vector of the previous successive cycle or the subsequent successive cycle, and the calculation range of the convolution operation does not include the product of the successive data of the prediction vector of the previous cycle or the subsequent cycle that is associated with the calculation and the corresponding weight value of the mask matrix M, as shown in Figures 11 and 13.

與

的卷積運算為例，在本發明的一種實施例中，卷積運算關聯前接續週期或後接續週期的預測向量依該時間序列之接續數據的影響。當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將包含前接續第6、7、8週期的接續數據y ₅與y ₆；當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將包含後接續第8、9、10週期的接續數據y ₁與y _z。 Referring to FIG. 10 , it is shown that when the mask matrix M and the prediction matrix are superimposed over a period range, the element

and

As an example, in one embodiment of the present invention, the convolution operation is used to associate the prediction vector of the previous successive cycle or the next successive cycle with the influence of the successive data of the time series.

When performing convolution operation, the calculation range 8 will include the continuous data y ₅ and y ₆ of the previous 6th, 7th and 8th cycles; when the mask matrix M is

When performing convolution operations, calculation range 8 will include the subsequent data y ₁ and y _z of the 8th, 9th, and 10th cycles.

與

的卷積運算為例，在本發明的另一種實施例中，卷積運算不關聯前接續週期或後接續週期的預測向量依該時間序列之接續數據的影響。當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將不包含前接續第6、7、8週期的接續數據y ₅與y ₆；當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將不包含後接續第8、9、10週期的接續數據y ₁與y ₂。 Referring to FIG. 11, it is shown that when the mask matrix M and the prediction matrix are superimposed over a period range, the element

and

As an example, in another embodiment of the present invention, the convolution operation is not associated with the influence of the prediction vector of the previous successive cycle or the subsequent successive cycle on the successive data of the time series.

When performing convolution operation, the calculation range 8 will not include the continuous data y ₅ and y ₆ of the previous 6th, 7th, and 8th cycles; when the mask matrix M is

When performing convolution operations, the calculation range 8 will not include the subsequent data y ₁ and y ₂ of the 8th, 9th, and 10th cycles.

進行卷積運算如以下式子表示：

The calculation method of the matrix mask M shown in Figure 10 can theoretically obtain more accurate results for smoothing. However, since the overlap of the mask matrix M and the prediction matrix exceeds the period range, it will result in more calculations.

The convolution operation is expressed as follows:

The above formula is only an implementation example of the calculation of Figure 10. The calculation of the mask matrix M on the prediction matrix Y will have different overlaps according to the overlapping elements. A smooth prediction matrix can be obtained by aligning each element of the prediction matrix Y one by one with the alignment position of the mask matrix M and performing operations.

進行卷積運算如以下式子表示：

Correspondingly, another method, such as the matrix mask M calculation method in Figure 11, will mask the part beyond the matrix boundary, and then not consider the calculation, or give it zero weight so that it does not affect the calculation, and limit the calculation range, which can reduce the amount of calculation, and will not produce a difference that is enough to affect the accuracy of the smoothing process.

The convolution operation is expressed as follows:

The above formula is only an implementation example of the calculation in Figure 11. The calculation of the mask matrix M on the prediction matrix Y will have different overlaps according to the overlapping elements. A smooth prediction matrix can be obtained by aligning each element of the prediction matrix Y one by one with the alignment position of the mask matrix M and performing operations.

與

的卷積運算為例，則該遮罩矩陣M與預測矩陣的疊合超過週期範圍。在本發明的一種實施例中，卷積運算關聯前接續週期或後接續週期的預測向量依該時間序列之接續數據的影響。當遮罩矩陣M對元素

進行卷積運算時，計算範圍8僅包含第7週期的疊合元素，並無前接續週期的接續數據；當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將包含後接續第8週期的接續數據y ₁與y ₂，並無前接續週期的接續數據。 Referring to FIG. 12 , it is shown that if the 7th cycle corresponds to the first prediction vector of the prediction matrix, the mask matrix M performs a convolution operation on the first prediction vector, with the element

and

For example, the convolution operation of the mask matrix M and the prediction matrix overlaps the cycle range. In one embodiment of the present invention, the convolution operation is associated with the influence of the prediction vector of the previous successive cycle or the subsequent successive cycle on the successive data of the time series.

When performing convolution operations, the calculation range 8 only includes the superposition elements of the 7th cycle, and does not include the continuation data of the previous cycle; when the mask matrix M is

When performing convolution operation, the calculation range 8 will include the subsequent data y ₁ and y ₂ of the 8th cycle, but not the subsequent data of the previous cycle.

與

的卷積運算為例，則該遮罩矩陣M與預測矩陣的疊合超過週期範圍。在本發明的另一種實施例中，卷積運算不關聯前接續週期或後接續週期的預測向量依該時間序列之接續數據的影響。當遮罩矩陣M對元素

進行卷積運算時，計算範圍8僅包含第7週期的疊合元素，並無前接續週期的接續數據；當遮罩矩陣M對元素

進行卷積運算時，計算範圍8將包含後接續第8週期的接續數據y ₁與y ₂，並無前接續週期以及後接續週期的接續數據。 Referring to FIG. 13 , it is shown that if the 7th cycle corresponds to the first prediction vector of the prediction matrix, the mask matrix M performs a convolution operation on the first prediction vector, with the element

and

For example, the convolution operation of the mask matrix M and the prediction matrix exceeds the cycle range. In another embodiment of the present invention, the convolution operation is not associated with the influence of the prediction vector of the previous or subsequent cycle on the subsequent data of the time series.

When performing convolution operations, the calculation range 8 only includes the superposition elements of the 7th cycle, and does not include the continuation data of the previous cycle; when the mask matrix M is

When performing convolution operation, the calculation range 8 will include the subsequent data y ₁ and y ₂ of the 8th subsequent cycle, and will not include the subsequent data of the previous and subsequent cycles.

Referring to FIG. 14 , a corresponding graph is shown of a smoothed prediction sequence S formed by expanding a smoothed prediction matrix formed by performing a convolution operation on a periodic prediction matrix Y through a mask matrix M and the prediction matrix Y before the convolution operation. The longitudinal variation amplitude of the smoothed prediction sequence S after the prediction matrix Y is expanded and after the smoothed convolution operation slows down, wherein the first period of the prediction matrix Y and the smoothed prediction sequence S is the corresponding period on the time series. In another embodiment of the present invention, the variation range of the vertical axis value of the smoothed prediction sequence S is significantly lower than the expansion of the prediction matrix Y , so as to achieve the purpose of convolution calculation, that is, to smooth the prediction sequence to avoid causing the system detection to be too sensitive and misjudgment.

S101~S111: Steps

Claims (10)

A prediction and alarm method for system operation includes the following steps: an input/output module continuously receives system data from an information system and stores it in a database, wherein the system data includes operation data with a time series; and a prediction and alarm module executes the following procedure: according to a data quantity n, a cycle quantity m and a standard deviation multiple k, reads the operation data stored in the database. As data, and according to a time point, a plurality of data vectors [n×1] of m periods are captured from the operation data according to the time series, the starting time point of each data vector [n×1] of m periods is different from the starting time point of the data vector [n×1] of the previous m periods by one period, and each data vector [n×1] has n data elements, wherein n and m are positive integers, and k The value of is a real number; sequentially assigning the data vector [n×1] of each m-period of the data vectors [n×1] of the multiple m-periods to a data matrix [n×m], generating a mean vector [n×1] and a standard deviation vector [n×1] according to the data matrix [n×m], and then generating a prediction vector [n×1] according to the mean vector [n×1], the standard deviation vector [n×1] and the value of the standard deviation multiple k to generate multiple prediction vectors; comparing the data elements of the multiple prediction vectors [n×1] with the data elements of the data vectors [n×1] corresponding to the multiple prediction vectors in the time series of the operation data to obtain a comparison result; and determining whether to notify the input/output module to output an abnormal notification according to the comparison result. The prediction and alarm method as described in claim 1 further includes the following procedures executed by the prediction alarm module: generating a prediction matrix with the multiple prediction vectors [n×1] according to the time series; performing a convolution operation on the prediction matrix according to a mask matrix to generate a smooth prediction sequence; and comparing the data elements of the smooth prediction sequence with the data elements of the operation data corresponding to the multiple prediction vectors on the time series to obtain the comparison result. The prediction and warning method as described in claim 2, wherein in the convolution operation, the mask matrix [a×b] includes a times b mask elements; in the mask matrix [a×b], the non-zero mask elements present a triangle with the bth row as the base and the bth height, and an alignment position with the prediction matrix is located at the bth row, and the values of the mask elements decrease from the alignment position to the top, bottom, and left of the mask matrix [a×b]; and the range of the convolution operation only includes the data elements of the prediction matrix that overlap with the mask matrix [a×b] when the mask matrix [a×b] is aligned with the alignment position. A system operation modeling and training method includes the following steps: an input/output module receives system data from an information system and stores it in a database, wherein the system data includes historical data with a time series; and a modeling training module executes the following procedures: reading the historical data stored in the database, and extracting a plurality of m periods of history from the historical data according to the time series at a historical point in time. The starting time point of each m-period historical data vector [n×1] is one-period historical data vector different from the starting time point of the previous m-period historical data vector [n×1], and each historical data vector [n×1] has n data elements, wherein n and m are positive integers; the starting time point of each m-period historical data vector [n×1] is one-period historical data vector different from the starting time point of the previous m-period historical data vector [n×1], and each historical data vector [n×1] has n data elements, wherein n and m are positive integers; the starting time point of each m-period historical data vector [n×1] is one-period historical data vector different from the previous m-period historical data vector [n×1], and each historical data vector [n×1] has n data elements, wherein n and m are positive integers; The historical data vector [n×1] is assigned to a historical data matrix [n×m], and a historical average vector [n×1] and a historical standard deviation vector [n×1] are generated according to the historical data matrix [n×m], and a historical forecast vector [n×1] is generated according to the historical average vector [n×1], the historical standard deviation vector [n×1] and a historical standard deviation multiple k, so as to generate multiple Historical prediction vectors, wherein the value of k is a real number; comparing the data elements of the multiple historical prediction vectors [n×1] with the data elements of the historical data vector [n×1] corresponding to the multiple historical prediction vectors in the time series of the historical data to obtain a verification result; and according to the verification result, determining whether the values of n, m and k are used for the prediction and alarm of an operation data of the system data. The modeling and training method as described in claim 4, wherein the modeling training module further performs the following procedures: generating the multiple historical prediction vectors [n×1] according to the time series to obtain a historical prediction matrix; performing a convolution operation on the historical prediction matrix according to a mask matrix to obtain a smoothed historical prediction sequence; and comparing the data elements of the smoothed historical prediction sequence with the data elements corresponding to the multiple historical prediction vectors of the historical data on the time series to obtain the verification result. The modeling and training method as described in claim 5, wherein in the convolution operation, the mask matrix [a×b] includes a times b mask elements; in the mask matrix [a×b], the non-zero mask elements present a triangle with the bth row as the base and the bth height, and an alignment position with the historical prediction matrix is located at the bth row, and the values of the mask elements decrease from the alignment position to the top, bottom, and left of the mask matrix [a×b]; and the range of the convolution operation only includes the data elements of the historical prediction matrix that overlap with the mask matrix [a×b] when the mask matrix [a×b] is aligned with the alignment position. The modeling and training method as described in any one of claim items 4 to 6 further comprises the following procedures: selecting the values of n, m and k from their respective value ranges, and verifying the data elements of the historical prediction vector [n×1] generated according to the selected values of n, m, k and the data elements corresponding to the historical data, and recording the values of n, m, k; and, from the recorded values of n, m, k, determining the optimal values of n, m, k to provide to the prediction and alarm module of the prediction and alarm method as described in claim item 1 for the prediction and alarm of the operation data of the system data. A computer program product is used for prediction and alarm of the operation of an information system. The program contained in the computer program product is loaded into a computer system and executed to: cause a processor to read a system data stored in a database, the system data containing operation data of the information system with a time series; cause the processor to extract a plurality of m-period data vectors [n×1], the starting time point of each m-period data vector [n×1] is one-period data vector away from the starting time point of the previous m-period data vector [n×1], each data vector [n×1] has n data elements, wherein n and m are positive integers; the processor sequentially converts the plurality of m-period data vectors [n×1] The data vector [n×1] of each m cycles of the operation data is assigned to a data matrix [n×m], and a mean vector [n×1] and a standard deviation vector [n×1] are generated according to the data matrix [n×m], and a prediction vector [n×1] is generated according to the mean vector [n×1], the standard deviation vector [n×1] and a standard deviation multiple k, so as to generate a plurality of prediction vectors, wherein the value of k is a real number; the processor is made to compare the data elements of the plurality of prediction vectors [n×1] with the data elements of the data vector [n×1] corresponding to the plurality of prediction vectors in the time series of the operation data to obtain a comparison result; and the processor is made to decide whether to notify an input/output module to output an abnormal notification according to the comparison result. A computer program product is used for modeling and training the operation of an information system. The program contained in the computer program product is loaded into a computer system and executed to: enable a processor to read a system data stored in a database, wherein the system data includes a historical data with a time series of the information system; enable the processor to extract a plurality of m periods of historical data vectors from the historical data according to the time series according to a historical time point. [n×1], the starting time point of each m-cycle historical data vector [n×1] is one cycle of historical data vectors different from the starting time point of the previous m-cycle historical data vector [n×1], and each historical data vector [n×1] has n data elements, wherein n and m are positive integers; the processor sequentially converts the historical data elements of each m-cycle of the plurality of m-cycle historical data vectors [n×1] into a historical data vector. According to the vector [n×1]: assign to a historical data matrix [n×m], generate a historical average vector [n×1] and a historical standard deviation vector [n×1] according to the historical data matrix [n×m], and then generate a historical prediction vector [n×1] according to the historical average vector [n×1], the historical standard deviation vector [n×1] and a historical standard deviation multiple k, so as to generate a plurality of historical prediction vectors, The value of k is a real number; the processor compares the data elements of the multiple historical prediction vectors [n×1] with the data elements of the historical data vectors [n×1] corresponding to the multiple historical prediction vectors in the time series of the historical data to obtain a verification result; and the processor determines whether the values of n, m and k are used for the prediction and alarm of an operation data of the system data according to the verification result. A prediction and alarm system for system operation, comprising: a database storing system data of an information system, the system data comprising operation data with a time series; an input/output module connecting the information system and the database, and receiving the system data from the information system; and a prediction alarm module connecting the input/output module and the database, and executing: according to a data cycle n, a cycle number m, and a value of a standard deviation multiple k, reading the operation data stored in the database, and extracting a plurality of data vectors [n×1] of m cycles from the operation data according to the time series at a time point, each data vector [n×1] having n data elements, wherein n and m are positive integers, and the value of k is a real number; Sequentially assign the data vectors [n×1] of each m-period of the multiple m-period data vectors [n×1] to a data matrix [n×m], generate a mean vector [n×1] and a standard deviation vector [n×1] based on the data matrix [n×m], and then generate a prediction vector [n×1] based on the mean vector [n×1], the standard deviation vector [n×1] and the value of the standard deviation multiple k; compare the data elements of the multiple prediction vectors [n×1] with the data elements of the data vectors [n×1] corresponding to the multiple prediction vectors in the time series of the operation data to obtain a comparison result; and determine whether to notify the input/output module to output an abnormal notification based on the comparison result.