TWI819385B - Abnormal alarm methods, devices, equipment and storage media - Google Patents

Abstract

Embodiments of the present invention provide an abnormality alarm method, device, equipment and storage medium. The method includes: detecting the index data to be detected; determining that the index data to be detected is abnormal data when the detection result satisfies the first preset abnormality condition; generating an abnormal identification for the abnormal data, and inserting the abnormal identification into the data identification queue, Generate abnormal alarm information based on data identification queue. According to the embodiments of the present invention, the number of invalid alarms can be reduced and the accuracy of alarms can be improved.

Description

Abnormal alarm methods, devices, equipment and storage media

The present invention relates to the field of operation and maintenance technology, and in particular to an abnormality alarm method, device, equipment and storage medium.

At present, abnormality alarm is an important part of smart operation and maintenance. The traditional abnormality alarm solution mainly detects whether the target system's indicator data is abnormal to timely detect whether the target system is abnormal or faulty.

However, in the case of transient jitter in indicator data, traditional abnormal alarm solutions will trigger multiple short-term invalid alarms, resulting in low alarm accuracy.

Embodiments of the present invention provide an abnormality alarm method, device, equipment and storage medium, which can reduce the number of invalid alarms and improve alarm accuracy.

In a first aspect, embodiments of the present invention provide an abnormality alarm method, which method includes:

Detect indicator data to be tested;

When the detection result meets the first preset abnormality condition, determine that the index data to be detected is abnormal data;

Generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, and generate abnormal alarm information based on the data identifier queue.

In a second aspect, an embodiment of the present invention provides an abnormality alarm device, which includes:

Detection module, used to detect indicator data to be detected;

Determine the module, used when the detection result meets the first preset abnormal condition In this case, it is determined that the indicator data to be detected is abnormal data;

The generation module is used to generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, and generate abnormal alarm information based on the data identifier queue.

In a third aspect, embodiments of the present invention provide an abnormality alarm device. The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the abnormality alarm method described in the first aspect.

In a fourth aspect, embodiments of the present invention provide a computer-readable storage medium. The computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a processor, the abnormality alarm method described in the first aspect is implemented.

An abnormality alarm method, device, equipment and storage medium provided by embodiments of the present invention, by detecting the index data to be detected, determine that the index data to be detected is abnormal data when the detection result satisfies the first preset abnormal condition. Generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, generate abnormal alarm information based on the data identifier queue, and enter the alarm state, thereby reducing invalid alarms caused by transient jitter of indicator data and improving alarm accuracy.

110: Electronic equipment

120:Server

600: Abnormal alarm device

610:Detection module

620: Confirm module

630: Generate module

700: Abnormal alarm equipment

701:Input device

702: Input interface

703:CPU

704:Memory

705:Output interface

706:Output device

710:Bus

A,B,C: Anomaly detection model

D(X,Y): average Manhattan distance

S210,S220,S230,S301,S302,S03,S304,S305,S306,S307,S308,S309,S310,S311,S312,S313,S314,S315: Steps

T: The number of data in the indicator data to be detected

x _t : represents the t-th data in the indicator data to be detected

y _t : The tth data in the reference indicator data

In order to explain the technical solutions of the embodiments of the present invention more clearly, the drawings needed to be used in the embodiments of the present invention will be briefly introduced below. For those of ordinary skill in the art, without exerting creative efforts, they can also Other schemas can be derived from these schemas.

Figure 1 is a schematic architectural diagram of an abnormality alarm system provided by an embodiment of the present invention;

Figure 2 is a schematic flowchart of an abnormality alarm method provided by an embodiment of the present invention;

Figure 3 is a schematic flow chart of another abnormality alarm method provided by an embodiment of the present invention;

Figure 4 is a schematic diagram of the alarm effect of the traditional abnormality alarm solution;

Figure 5 is a schematic diagram of an alarm effect provided by an embodiment of the present invention;

Figure 6 is a schematic structural diagram of an abnormality alarm device provided by an embodiment of the present invention;

Figure 7 is a schematic structural diagram of an abnormality alarm device provided by an embodiment of the present invention.

Features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described here only explain the invention, rather than limit the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations are mutually exclusive. any such actual relationship or sequence exists between them. Furthermore, the terms "comprises," "comprises," or any other variations thereof are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also those not expressly listed other elements, or elements inherent to the process, method, article or equipment. Without further limitation, an element defined by the statement "comprising..." does not exclude the presence of additional identical elements in a process, method, article, or device that includes the stated element.

At present, traditional abnormality alarm solutions usually generate abnormality alarm information immediately after the indicator data is determined to be abnormal data. However, in actual application scenarios, it is found that in the case of temporary jitter in indicator data caused by transient network jitter, multiple short-term invalid alarms will be triggered, resulting in low alarm accuracy.

Therefore, in order to solve the above problem of low alarm accuracy, embodiments of the present invention provide an abnormality alarm method, device, equipment and storage medium. By detecting the index data to be detected, when the detection result satisfies the first preset abnormality condition, the index data to be detected is determined to be abnormal data. Generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, generate abnormal alarm information based on the data identifier queue, and enter the alarm state, thereby reducing invalid alarms caused by transient jitter of indicator data and improving alarm accuracy.

In the following, the present invention will be explained through specific embodiments and application scenarios in combination with the drawings. The abnormality alarm method, device, equipment and storage medium provided by the embodiments will be described in detail.

Figure 1 is a schematic architectural diagram of an abnormality alarm system provided by an embodiment of the present invention. As shown in Figure 1, the abnormality alarm system may include an electronic device 110 and a server 120. The electronic device 110 may be a mobile electronic device or a server. For non-mobile electronic devices. For example, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palmtop computer or an Ultra-Mobile Personal Computer (UMPC), etc. The non-mobile electronic device can be a server, network attached storage (Network Attached Storage, NAS) or Personal Computer (Personal Computer, PC), etc. The server 120 represents the target system to be monitored, which may be a financial, social, or entertainment system. The electronic device 110 and the server 120 communicate through a network, where the network may be a wired communication network or a wireless communication network.

As an example, the anomaly alarm system can be applied to scenarios such as monitoring financial, social, or entertainment systems. Referring to FIG. 1 , the electronic device 110 can receive the indicator data to be detected sent by the server 120 in real time. Among them, the indicator data to be detected can be real-time monitoring time series indicator data of the target detection system. Then, the index data to be detected is detected, and when the detection result satisfies the first preset abnormality condition, the index data to be detected is determined to be abnormal data. Then generate an exception identifier for the abnormal data, insert the abnormal identifier into the data identifier queue, generate abnormal alarm information according to the data identifier queue, and enter the alarm state, thereby reducing invalid alarms caused by transient jitter of indicator data and improving alarm accuracy. Accuracy.

The abnormal alarm method provided by the embodiment of the present invention will be introduced below. The execution subject of the abnormality alarm method may be the electronic device 110 in the abnormality alarm system shown in FIG. 1 , or a module in the electronic device 110 .

Figure 2 is a schematic flow chart of an abnormality alarm method provided by an embodiment of the present invention. As shown in Figure 2, the abnormality alarm method may include the following steps:

S210, detect the index data to be detected.

Specifically, the indicator data to be detected is obtained and tested. Among them, the indicator data to be detected is the indicator data at the current moment, that is, the indicator data of the time series, which can include industry service indicator data and/or hardware indicator data. For example, the business indicator data can be the number of transactions, transaction success rate, etc., and the hardware indicator data can be central processing unit (Central Processing Unit, CPU) usage, memory usage, network delay, etc. As an example, you can obtain the original index data to be detected, perform data preprocessing on the original index data to be detected, such as interpolation and zero padding, and obtain the index data to be detected.

In one embodiment, at least two anomaly detection models can be used to detect different data characteristics of the index data to be detected. Among them, each anomaly detection model is generated by learning different data features of historical indicator data. That is to say, each anomaly detection model can correspond to one data feature type. For example, the data characteristics of the index data to be detected may include at least two of statistical characteristics, trend characteristics and regression characteristics.

For example, the data characteristics of the indicator data to be detected can include statistical characteristics, trend characteristics and regression characteristics. Correspondingly, the anomaly detection model can include the 3-Sigma principle model, the exponentially weighted moving average control chart model and the polynomial regression model.

S220: When the detection result satisfies the first preset abnormality condition, determine that the index data to be detected is abnormal data.

Referring to S210, the detection results may include detection results of at least two anomaly detection models. For example, a voting algorithm, such as a hard voting algorithm or a soft voting algorithm, may be used to analyze the detection results of at least two anomaly detection models. When the analysis result meets the second preset abnormality condition, the index data to be detected is determined to be abnormal data, otherwise it is normal data, thereby improving the accuracy of abnormal data detection.

For example, there are three anomaly detection models A, B, and C. The detection result of anomaly detection model A is abnormal, the detection result of anomaly detection model B is abnormal, and the detection result of anomaly detection model C is normal. Use the hard voting algorithm for analysis, and the analysis result is that the number of normal votes is 2 and the number of abnormal votes is 1. Determine whether the number of abnormal votes is greater than or equal to the preset vote threshold, such as 2. If so, determine that the indicator data to be detected is abnormal data. , otherwise it is normal data. It can be seen that the index data to be detected at this time is abnormal.

It is worth noting that the data type of the indicator data to be detected can affect the detection test results. Therefore, in one example, when the analysis result satisfies the second preset abnormal condition, the data type of the indicator data to be detected can be determined, and the relationship between the indicator data to be detected and the reference indicator data can be calculated based on the data type of the indicator data to be detected. similarity. Among them, the reference indicator data is preset historical indicator data, such as the data at the same time on the previous day, the data at the same time on the previous week, or the data on the previous hour, etc. Refer to S210. The reference indicator data may be data after data preprocessing.

In one example, the similarity algorithm corresponding to the data type can be used to calculate the similarity between the index data to be detected and the reference index data. When the similarity meets the preset similarity conditions, the index data to be detected is determined to be abnormal data, and otherwise it is normal data, thereby avoiding the impact of data type on detection, reducing misjudgments, and improving the accuracy of abnormal data detection.

For example, the data type may include a quantity type or a rate type. For the situation where the indicator data to be detected is a quantitative type, for example, the indicator data to be detected is the number of transactions, refer to the characteristics of this type of indicator data that are different on rest days and working days, but have the same trend, you can choose Pearson similarity. The algorithm calculates the similarity between the index data to be detected and the reference index data to determine anomalies in the numerical type of the index data to be detected. When the similarity is less than or equal to the first preset similarity threshold, the index data to be detected is determined to be abnormal data, and otherwise it is normal data to avoid misjudgments caused by changes in magnitude during rest days.

For the situation where the indicator data to be detected is a rate numerical type, for example, the indicator data to be detected is the transaction success rate. Considering that the periodic short-term local fluctuations of this type of indicator data can easily lead to misjudgments, the average Manhattan distance algorithm can be selected. Calculate the similarity between the index data to be detected and the reference index data to determine the abnormality of the numerical type of the index data to be detected. When the similarity is greater than or equal to the second preset similarity threshold, the index data to be detected is determined to be abnormal data, and otherwise it is normal data to avoid misjudgments caused by periodic short-term local fluctuations in the index data to be detected.

In a specific example, the formula for the average Manhattan distance algorithm can be as follows:

Among them, D(X,Y) represents the average Manhattan distance, that is, the similarity between the index data to be detected and the reference index data, T represents the number of data in the index data to be detected, x _t represents the tth index data in the index data to be detected data, y _t represents the t-th data in the reference indicator data, such as the t-th data in the historical indicator data at the same time yesterday.

S230: Generate an exception identifier for the abnormal data, insert the exception identifier into the data identifier queue, and generate abnormal alarm information according to the data identifier queue.

In one embodiment, an abnormality identifier can be generated for abnormal data, the abnormality identifier can be inserted into the data identification queue, new data to be detected can be continuously detected, and the data identification queue can be updated in real time. When the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, abnormal alarm information is generated, that is, the alarm state is entered.

Among them, the length of the data identification queue can be flexibly set according to actual needs. The preset abnormality identification threshold can be set according to the business corresponding to the monitored object, that is, the indicator data to be detected, and the timeliness or importance of the indicator data to be detected.

In the embodiment of the present invention, by detecting the index data to be detected, when the detection result satisfies the first preset abnormality condition, the index data to be detected is determined to be abnormal data. Generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, generate abnormal alarm information based on the data identifier queue, and enter the alarm state, thereby reducing invalid alarms caused by transient jitter of indicator data and improving alarm accuracy.

What needs to be known is that during the period of abnormality, the indicator data to be detected may experience transient fluctuations, leading to a false recovery phenomenon. Therefore, in one embodiment, after generating the abnormal alarm information, that is, after entering the alarm state, the method may also include:

When the detection result does not meet the first preset abnormality condition, the index data to be detected is determined to be normal data. Then generate normal identifiers for normal data, insert the normal identifiers into the data identifier queue, continuously detect new data to be detected, and update the data identifier queue in real time. When the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold, abnormal recovery information is generated, that is, the alarm state is terminated. In this way, the alarm recovery time can be accurately perceived, the problem of inaccurate alarm recovery can be solved, and multiple duplicate alarms can be avoided.

Among them, the preset abnormal identification threshold and the preset normal identification threshold can be the same, so that the time it takes to confirm the alarm generation and the time it takes to confirm the alarm disappears can be offset in the alarm recovery process to make up for the time it takes to confirm the alarm occurrence and determine the alarm. True duration.

Considering that after entering the alarm state, the historical indicator data judged to be abnormal may affect the indicator data to be detected. In one embodiment, after generating the abnormal alarm information, the method may further include:

In response to the abnormal alarm information, the first preset abnormal condition is adjusted, that is, the detection of abnormalities is appropriately relaxed, making it easier to determine that the indicator data to be detected is abnormal, and it is more strict to determine that the indicator data to be detected is normal. When the detection result does not meet the adjusted first preset abnormal condition, the index data to be detected is determined to be normal data. Generate normal identifiers for normal data, insert the normal identifiers into the data identifier queue, continuously detect new data to be detected, and update the data identifier queue in real time. When the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold, abnormal recovery information is generated to avoid the impact of historical indicator data judged to be abnormal to the detected indicator data, and to more accurately perceive the alarm recovery time. .

It can be understood that after this alarm ends, that is, after the abnormality is restored, the adjusted conditions will be restored to the state before adjustment.

Taking the abnormal alarm method applied to the financial system monitoring scenario as an example, the abnormal alarm method provided by the embodiment of the present invention will be described in detail below. As shown in Figure 3, the method may include the following steps:

S301: Obtain the current indicator data to be detected.

S302: Use at least two anomaly detection models to detect different data characteristics of the index data to be detected.

The 3-Sigma principle model, exponentially weighted moving average control chart model and polynomial regression model are used to detect the statistical characteristics, trend characteristics and regression characteristics of the indicator data to be detected respectively.

S303: When the detection results of at least two anomaly detection models meet the first preset abnormal condition, determine that the index data to be detected is abnormal data.

Specifically, a voting algorithm is used to analyze the detection results of at least two anomaly detection models. When the analysis result meets the second preset abnormality condition, the data type of the abnormal data is determined. Then, based on the similarity algorithm corresponding to the data type of the abnormal data, the similarity between the index data to be detected and the reference index data is calculated. When the similarity meets the preset similarity conditions, the index data to be detected is determined to be abnormal data.

S304: Generate an exception identifier for the abnormal data.

S305: Insert the exception identifier into the data identifier queue.

S306: Determine whether the number of abnormal flags is greater than or equal to the preset abnormal flag threshold.

If yes, execute S307; otherwise, return to S301.

S307, generate abnormal alarm information.

S308: Respond to the abnormal alarm information and adaptively adjust the first preset abnormal condition.

That is to say, the detection of abnormalities is appropriately relaxed, making it easier to judge that the index data to be detected is abnormal, and it is more strict to judge the index data to be detected to be normal.

S309: Obtain the current indicator data to be detected.

S310: Use at least two anomaly detection models to detect different data characteristics of the index data to be detected.

S311: When the detection results of at least two anomaly detection models do not meet the adjusted first preset abnormal condition, determine that the index data to be detected is normal data.

The specific details are similar to S303 and will not be described here for the sake of simplicity.

S312, generate a normal identifier for normal data.

S313: Insert the normal identifier into the data identifier queue.

S314: Determine whether the number of normal identifications is greater than or equal to the preset normal identification threshold.

If yes, execute S315; otherwise, return to S309. The preset abnormal identification threshold is the same as the preset normal identification threshold.

S315, generate abnormal recovery information.

At this point, the alarm and recovery process is completed.

For example, a comparison of the effects of the traditional abnormality alarm solution and the abnormality alarm method provided by the embodiment of the present invention can be seen in Figures 4 and 5. Figure 4 shows the alarm effect of a traditional abnormality alarm solution, and Figure 5 shows an alarm effect provided by an embodiment of the present invention. In Figures 4 and 5, the abscissa is the detection time, the ordinate is the number of transactions, 1 is normal, and 0 is an abnormal alarm. Compared with the multiple alarms in Figure 4, Figure 5 only generates one during the three abnormal periods. Alarm information. In addition, different types of index data to be detected were randomly selected for verification, and Table 1 shows the alarm data within 3 days between the traditional abnormality alarm scheme and the abnormality alarm method provided by the embodiment of the present invention.

It can be seen from the above that the embodiment of the present invention can rely on the mechanism of data identification queuing and strict alarm entry and exit, and can effectively filter false anomalies caused by transient jitter of data while ensuring timely alarms for real anomalies, while avoiding Frequent alarms caused by false recovery during the abnormality period can significantly reduce the number of alarms.

Based on the abnormality alarm method provided by the embodiment of the present invention, the embodiment of the present invention also provides an abnormality alarm device. As shown in Figure 6, the abnormality alarm device 600 may include: a detection module 610, a determination module 620, and a generation module 630. .

Among them, the detection module 610 is used to detect the index data to be detected.

The determination module 620 is used to determine that the index data to be detected is abnormal data when the detection result satisfies the first preset abnormality condition.

The generation module 630 is used to generate exception identifiers for abnormal data, insert the exception identifiers into the data identifier queue, and generate abnormal alarm information based on the data identifier queue.

In one embodiment, the generation module 630 includes: a generation unit for When the number of exception identifiers in the data identifier queue is greater than or equal to the preset exception identifier threshold, abnormal alarm information is generated.

In one embodiment, the detection module 610 includes: a detection unit configured to use at least two anomaly detection models to detect different data characteristics of the index data to be detected. Among them, the data characteristics of the index data to be detected include at least two of the following items: statistical characteristics, trend characteristics and regression characteristics.

In one embodiment, the detection results include detection results of at least two anomaly detection models.

The determination module 620 includes an analysis unit configured to analyze the detection results of at least two anomaly detection models using a voting algorithm.

The determination unit is used to determine that the index data to be detected is abnormal data when the analysis result satisfies the second preset abnormality condition.

In one embodiment, the determining unit is specifically configured to determine the data type of the index data to be detected when the analysis result satisfies the second preset abnormal condition.

According to the data type of the index data to be detected, the similarity between the index data to be detected and the reference index data is calculated.

When the similarity meets the preset similarity conditions, the index data to be detected is determined to be abnormal data.

In one embodiment, the data type includes a quantity type or a rate type.

In one embodiment, when the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, after generating the abnormal alarm information, the determination module 620 is also used to determine if the detection result does not meet the first predetermined value. In the case of abnormal conditions, determine that the index data to be detected is normal data.

The generation unit is also used to generate normal identifiers for normal data, insert the normal identifiers into the data identifier queue, and generate abnormal recovery information when the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold.

In one embodiment, when the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, after generating the abnormal alarm information, the abnormal alarm device 600 further includes:

The adjustment module is used to respond to abnormal alarm information and adjust the first preset abnormal condition.

The determination module 620 is also used to determine that the index data to be detected is normal data when the detection result does not meet the adjusted first preset abnormal condition.

The generation unit is also used to generate normal identifiers for normal data, insert the normal identifiers into the data identifier queue, and generate abnormal recovery information when the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold.

In one embodiment, the preset abnormal identification threshold is the same as the preset normal identification threshold.

It can be understood that each module/unit in the abnormality alarm device 600 shown in Figure 6 has the function of realizing each step in the abnormality alarm method provided by the embodiment of the present invention, and can achieve its corresponding technical effect. For the sake of simplicity, I won’t go into details here.

Figure 7 is a schematic structural diagram of an abnormality alarm device provided by an embodiment of the present invention.

As shown in Figure 7, the abnormality alarm device 700 in this embodiment includes an input device 701, an input interface 702, a central processing unit 703, a memory 704, an output interface 705, and an output device 706. Among them, the input interface 702, the central processing unit 703, the memory 704, and the output interface 705 are connected to each other through the bus 710. The input device 701 and the output device 706 are connected to the bus 710 through the input interface 702 and the output interface 705 respectively, and then are connected to the bus 710. Other components of the abnormality alarm device 700 are connected.

Specifically, the input device 701 receives input information from the outside and transmits the input information to the central processor 703 through the input interface 702; the central processor 703 processes the input information based on computer executable instructions stored in the memory 704 to generate Output information, temporarily or permanently store the output information in the memory 704, and then use the output interface 705 The output information is sent to the output device 706; the output device 706 outputs the output information to the outside of the abnormality alarm device 700 for use by the user.

In one embodiment, the abnormality alarm device 700 shown in Figure 7 includes: a memory 704 for storing programs; a processor 703 for running the programs stored in the memory to implement the abnormality alarm provided by the embodiment of the present invention. method.

Embodiments of the present invention also provide a computer-readable storage medium. Computer program instructions are stored on the computer-readable storage medium; when the computer program instructions are executed by a processor, the abnormality alarm method provided by the embodiment of the present invention is implemented.

It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. For the sake of brevity, they will not be described again. The present invention is not limited to the specific arrangements and processes described above and illustrated in the drawings. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications and additions, or change the order between steps after understanding the spirit of the present invention.

The functional blocks shown in the above structural block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), appropriate firmware, a plug-in program, a function card, or the like. When implemented in software, elements of the invention are programs or program code fragments that are used to perform the required tasks. The program or program code fragments may be stored in a machine-readable medium, or transmitted over a transmission medium or communications link via a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable ROM (Erasable Read Only Memory, EROM), floppy disks, and optical disks Read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical disc, hard disk, optical fiber media, radio frequency (Radio Frequency, RF) link, etc. Code snippets can be sent via e.g. the Internet, inline The computer network such as the Internet is downloaded.

It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps. That is to say, the steps may be performed in the order mentioned in the embodiments, or may be different from the order in the embodiments, or several steps may be performed simultaneously.

Aspects of the present disclosure are described above with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device cause Ability to implement the functions/actions specified in one or more blocks of flowcharts and/or block diagrams. Such a processor may be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It will also be understood that each block in the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration, can also be implemented by special purpose hardware that performs the specified functions or actions, or can be implemented by Achieved by a combination of specialized hardware and computer instructions.

The above are only specific implementation modes of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can be implemented with reference to the aforementioned methods. The corresponding process in the example will not be described again here. It should be understood that the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed in the present invention. These modifications or substitutions should be covered by within the protection scope of the present invention.

S210, S220, S230: steps

Claims (18)

An anomaly alarm method, characterized in that the method includes: using at least two anomaly detection models to detect different data characteristics of the indicator data to be detected, wherein each anomaly detection model corresponds to a type of data characteristics; when the detection results satisfy In the case of the first preset abnormal condition, determine that the indicator data to be detected is abnormal data; generate an abnormality identifier for the abnormal data, insert the abnormality identifier into the data identification queue, and generate Abnormal alarm information; wherein, the detection results include detection results of the at least two anomaly detection models; and when the detection results meet the first preset abnormal condition, it is determined that the indicator data to be detected is abnormal data, The method includes: using a voting algorithm to analyze the detection results of the at least two anomaly detection models; when the analysis results meet the second preset abnormal condition, determining that the index data to be detected is abnormal data. The method of claim 1, wherein generating abnormal alarm information according to the data identification queue includes: when the number of abnormal identifications in the data identification queue is greater than or equal to a preset abnormal identification threshold , generate abnormal alarm information. The method of claim 1, wherein the data characteristics of the index data to be detected include at least two of the following: statistical characteristics, trend characteristics and regression characteristics. The method of claim 1, wherein determining that the index data to be detected is abnormal data when the analysis result satisfies a second preset abnormality condition includes: when the analysis result satisfies the second preset abnormality condition In the case of , determine the data type of the index data to be detected; calculate the similarity between the index data to be detected and the reference index data according to the data type of the index data to be detected; when the similarity meets the predetermined Under the condition of similarity, determine the index information to be detected. The data is abnormal. The method of claim 4, wherein the data type includes a quantity type or a rate type. The method according to claim 2, wherein when the number of abnormal identifications in the data identification queue is greater than or equal to the preset abnormal identification threshold, after generating the abnormal alarm information, the method further includes: When the detection result does not meet the first preset abnormal condition, determine that the index data to be detected is normal data; generate a normal identifier for the normal data; insert the normal identifier into the data identifier queue; When the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold, abnormal recovery information is generated. The method of claim 2, wherein when the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, after generating the abnormal alarm information, the method further includes: responding to the Describe the abnormal alarm information, adjust the first preset abnormal condition; when the detection result does not meet the adjusted first preset abnormal condition, determine that the indicator data to be detected is normal data; it is the normal data. Generate normal identifiers from the data; insert the normal identifiers into the data identifier queue; and generate abnormal recovery information when the number of normal identifiers in the data identifier queue is greater than or equal to a preset normal identifier threshold. The method according to claim 6 or 7, wherein the preset abnormal identification threshold is the same as the preset normal identification threshold. An anomaly alarm device, characterized in that the device includes: a detection module for using at least two anomaly detection models to detect different data characteristics of the index data to be detected, wherein each anomaly detection model is associated with a data feature type Correspondence; The determination module is used to determine that the indicator data to be detected is abnormal data when the detection result satisfies the first preset abnormality condition; the generation module is used to generate an abnormality identification for the abnormal data and generate the abnormality identification. The abnormal identification is inserted into the data identification queue, and abnormal alarm information is generated according to the data identification queue; wherein the detection results include the detection results of the at least two anomaly detection models; the determination module includes: an analysis unit, A voting algorithm is used to analyze the detection results of the at least two anomaly detection models; a determination unit is configured to determine that the index data to be detected is abnormal data when the analysis results meet the second preset abnormal condition. The device according to claim 9, wherein the generating module includes: a generating unit configured to generate an abnormality alarm when the number of abnormal identifications in the data identification queue is greater than or equal to a preset abnormal identification threshold. information. For the device according to claim 9, the data characteristics of the index data to be detected include at least two of the following: statistical characteristics, trend characteristics and regression characteristics. The device according to claim 9, wherein the determination unit is specifically configured to: determine the data type of the index data to be detected when the analysis result satisfies the second preset abnormal condition; according to the index to be detected According to the data type of the data, the similarity between the index data to be detected and the reference index data is calculated; when the similarity meets the preset similarity conditions, the index data to be detected is determined to be abnormal data. The device of claim 12, wherein the data type includes a quantity value type or a rate value type. The device according to claim 10, wherein when the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, after generating the abnormal alarm information, the determination module is also used to When the detection result does not meet the first preset abnormal condition, In the case of software, it is determined that the index data to be detected is normal data; the generating unit is also used to generate a normal identification for the normal data, and insert the normal identification into the data identification queue, in the When the number of normal identifiers in the data identifier queue is greater than or equal to the preset normal identifier threshold, abnormal recovery information is generated. The device of claim 10, wherein when the number of abnormal identifiers in the data identifier queue is greater than or equal to the preset abnormal identifier threshold, after generating the abnormal alarm information, the device further includes: an adjustment module , used to adjust the first preset abnormal condition in response to the abnormal alarm information; the determination module is also used to adjust the first preset abnormal condition when the detection result does not meet the adjusted first preset abnormal condition. Determine that the index data to be detected is normal data; the generating unit is also used to generate a normal identification for the normal data, and insert the normal identification into the data identification queue, in the data identification queue When the number of normal identifiers is greater than or equal to the preset normal identifier threshold, abnormal recovery information is generated. The device according to claim 14 or 15, wherein the preset abnormal identification threshold is the same as the preset normal identification threshold. An abnormality alarm device, characterized in that the device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the steps described in any one of claims 1-8 Abnormal alarm method. A computer-readable storage medium, characterized in that computer program instructions are stored on the computer-readable storage medium. When the computer program instructions are executed by a processor, the abnormality alarm as described in any one of claims 1-8 is realized. method.

Images