1. A data exception alarm processing method is characterized by comprising the following steps:

receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed;

generating prediction data corresponding to the time period to be alarmed based on a pre-trained service data prediction model;

carrying out error prediction on the prediction data to obtain a corresponding prediction error;

obtaining corresponding target prediction data according to the prediction error and the prediction data;

and carrying out exception classification on the target prediction data, and carrying out alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal.

2. The method of claim 1, wherein said error predicting said prediction data to obtain a corresponding prediction error comprises:

splitting the prediction data to generate sampling prediction data corresponding to each sampling period, wherein each sampling period is continuous;

generating a plurality of data groups corresponding to the prediction data in a time sequence of each of the sampling periods, each of the data groups including a plurality of sampled prediction data of a plurality of consecutive sampling periods;

and carrying out error prediction on each data set to obtain a corresponding prediction error.

3. The method according to claim 2, wherein the classifying the target prediction data and performing the alarm processing on the service to be alarmed when determining that the target prediction data is abnormal comprises:

determining a target data group corresponding to each data group based on the target prediction data;

performing exception classification on each target data group, and judging whether each target data group is abnormal or not;

and when at least one target data group is abnormal, performing alarm processing on the service to be alarmed.

4. The method of claim 2, wherein said generating a plurality of data sets corresponding to said prediction data in chronological order of each of said sampling periods comprises:

acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are acquired in the first sampling period, and the second sampling data are acquired in a continuous preset number of sampling periods after the first sampling period in time sequence;

taking a second sampling period after the first sampling period as a first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group;

and traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

5. The method of claim 2, wherein said error predicting each of said data sets to obtain a corresponding prediction error comprises:

acquiring corresponding time data according to each data group;

obtaining corresponding error prediction data based on the time data and the corresponding data group;

and carrying out error prediction on each error prediction data to generate a corresponding prediction error.

6. The method according to claim 1, wherein the alarm processing request carries parameter data of whether the time period to be alarmed is an active day or an inactive day;

generating prediction data corresponding to the time period to be alarmed based on a pre-trained service data prediction model, wherein the generation comprises the following steps:

according to the parameter data, activity day parameters of the pre-trained business data prediction model are adjusted to obtain a business data prediction model after the activity day parameters are adjusted;

and predicting the service data based on the service data prediction model after the activity day parameter adjustment, and generating prediction data corresponding to the time period to be alarmed.

7. A data anomaly alarm processing apparatus, the apparatus comprising:

the alarm processing request receiving module is used for receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed;

the prediction data generation module is used for generating prediction data corresponding to the time period to be warned based on a pre-trained service data prediction model;

the prediction error determining module is used for carrying out error prediction on the prediction data to obtain a corresponding prediction error;

the target prediction data determining module is used for obtaining corresponding target prediction data according to the prediction error and the prediction data;

and the alarm processing module is used for carrying out exception classification on the target prediction data and carrying out alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal.

8. The apparatus of claim 7, wherein the prediction error determination module comprises:

the splitting submodule is used for splitting the prediction data to generate sampling prediction data corresponding to each sampling period, and each sampling period is continuous;

a data group determination sub-module for generating a plurality of data groups corresponding to the prediction data in time order of each of the sampling periods, each of the data groups including a plurality of sampled prediction data of a plurality of consecutive sampling periods;

and the error prediction submodule is used for performing error prediction on each data set to obtain a corresponding prediction error.

9. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.

Background

With the rapid development of internet technology, a monitoring system plays a crucial role in ensuring the safety, high availability and high performance of an application system. For key indexes in an application system, real-time monitoring is needed, whether monitoring data meet prediction needs to be determined, and abnormal alarm is conducted on indexes deviating from the prediction.

In the traditional mode, the system abnormal alarm can only carry out linear short-term prediction through a prediction function, can only predict data in a short term, and cannot meet the prediction requirement of predicting nonlinear data of real services, so that the alarm accuracy of a service system is low.

Disclosure of Invention

Therefore, it is necessary to provide a data exception alarm processing method, an apparatus, a computer device, and a storage medium, which can improve the accuracy of alarm processing in a business system, in order to solve the above technical problems.

A data exception alarm processing method comprises the following steps:

receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed;

generating prediction data corresponding to a time period to be alarmed based on a pre-trained service data prediction model;

carrying out error prediction on the prediction data to obtain a corresponding prediction error;

obtaining corresponding target prediction data according to the prediction error and the prediction data;

and carrying out exception classification on the target prediction data, and carrying out alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal.

In one embodiment, performing error prediction on the prediction data to obtain a corresponding prediction error includes:

splitting the predicted data to generate sampled predicted data corresponding to each sampling period, wherein each sampling period is continuous;

generating a plurality of data groups corresponding to the prediction data according to the time sequence of each sampling period, wherein each data group comprises a plurality of sampling prediction data of a plurality of continuous sampling periods;

and carrying out error prediction on each data set to obtain a corresponding prediction error.

In one embodiment, the performing exception classification on the target prediction data, and performing alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal includes:

determining a target data group corresponding to each data group based on the target prediction data;

carrying out abnormity classification on each target data group, and judging whether each target data group is abnormal or not;

and when at least one target data group is abnormal, performing alarm processing on the service to be alarmed.

In one embodiment, generating a plurality of data sets corresponding to the prediction data in time order of each sampling period includes:

acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are acquired in the first sampling period, and the second sampling data are acquired in a continuous preset number of sampling periods after the first sampling period in time sequence;

taking a second sampling period after the first sampling period as a first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group;

and traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

In one embodiment, performing error prediction on each data set to obtain a corresponding prediction error includes:

acquiring corresponding time data according to each data group;

obtaining corresponding error prediction data based on the time data and the corresponding data group;

and carrying out error prediction on each error prediction data to generate a corresponding prediction error.

In one embodiment, the alarm processing request carries parameter data with a time period to be alarmed being an active day or an inactive day;

generating prediction data corresponding to a time period to be alarmed based on a pre-trained service data prediction model, wherein the prediction data comprises the following steps:

according to the parameter data, activity day parameters of a pre-trained business data prediction model are adjusted to obtain a business data prediction model after the activity day parameters are adjusted;

and predicting the service data based on the service data prediction model after the activity day parameter adjustment to generate prediction data corresponding to the time period to be alarmed.

A data anomaly alarm handling apparatus, the apparatus comprising:

the alarm processing request receiving module is used for receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed;

the prediction data generation module is used for generating prediction data corresponding to a time period to be warned based on a pre-trained service data prediction model;

the prediction error determining module is used for carrying out error prediction on the prediction data to obtain a corresponding prediction error;

the target prediction data determining module is used for obtaining corresponding target prediction data according to the prediction error and the prediction data;

and the alarm processing module is used for carrying out exception classification on the target prediction data and carrying out alarm processing on the service to be alarmed when the target prediction data are determined to be abnormal.

In one embodiment, the prediction error determination module comprises:

the splitting submodule is used for splitting the prediction data to generate sampling prediction data corresponding to each sampling period, and each sampling period is continuous;

a data group determination submodule for generating a plurality of data groups corresponding to the prediction data in accordance with a time sequence of each sampling period, each data group including a plurality of sampled prediction data of a plurality of consecutive sampling periods;

and the error prediction submodule is used for carrying out error prediction on each data set to obtain a corresponding prediction error.

A computer device comprising a memory storing a computer program and a processor implementing the steps of the method of any of the above embodiments when the processor executes the computer program.

A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method of any of the above embodiments.

According to the data abnormity alarm processing method, the data abnormity alarm processing device, the computer equipment and the storage medium, the alarm processing request of the service to be alarmed is received, the time period to be alarmed is carried in the alarm processing request, then the prediction data corresponding to the time period to be alarmed is generated based on a pre-trained service data prediction model, the error prediction is carried out on the prediction data to obtain the corresponding prediction error, further, the corresponding target prediction data is obtained according to the prediction error and the prediction data, the target prediction data is subjected to abnormity classification, and the alarm processing is carried out on the service to be alarmed when the target prediction data is determined to be abnormal. Therefore, when the alarm processing of the business system is carried out, the data in any time interval can be prestored based on the business data prediction model, and error processing and abnormal classification are carried out, so that the intelligent level of the alarm processing can be improved aiming at any time interval by the prediction processing. In addition, the target prediction data for abnormal classification is integrated with the prediction error, so that the obtained target prediction data is more accurate, the accuracy of abnormal classification can be improved, and the accuracy of subsequent alarm processing can be improved.

Drawings

FIG. 1 is a diagram illustrating an exemplary scenario for implementing a data anomaly alarm handling method;

FIG. 2 is a flow diagram illustrating a data anomaly alarm processing method according to an embodiment;

FIG. 3 is a block diagram of an apparatus for processing data exception alarms according to an embodiment;

FIG. 4 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

The data exception alarm processing method provided by the application can be applied to the application environment shown in fig. 1. Wherein the terminal 102 communicates with the server 104 via a network. Specifically, the terminal 102 may generate an alarm processing request based on the trigger of the user, and send the alarm processing request to the server 104, where the alarm processing request carries a time period to be alarmed. After receiving the alarm processing request of the service to be alarmed, the server 104 may generate prediction data corresponding to the time period to be alarmed based on a pre-trained service data prediction model. The post-server 104 may perform error prediction on the prediction data to obtain a corresponding prediction error, and obtain corresponding target prediction data according to the prediction error and the prediction data. Further, the server 104 may perform exception classification on the target prediction data, and perform alarm processing on the service to be alarmed when it is determined that the target prediction data is abnormal. The terminal 102 may be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented by an independent server or a server cluster formed by a plurality of servers.

In an embodiment, as shown in fig. 2, a data exception alarm processing method is provided, which is described by taking the application of the method to the server in fig. 1 as an example, and includes the following steps:

step S202, an alarm processing request of the service to be alarmed is received, and the alarm processing request carries a time period to be alarmed.

The service to be warned refers to a service which is monitored and warned by a monitoring system, and may be, for example, a login amount of a user in a certain system.

The alarm processing request refers to a request for performing alarm processing on a service to be alarmed, and the alarm processing request may carry a time period to be alarmed.

The time period to be alerted refers to a time period for performing service data prediction and alerting on the service to be alerted, and may be, for example, the next day (tomorrow) of the current time, the next week, or a certain time period in the future, which is not limited in this application.

In this embodiment, the terminal may generate an alarm processing request based on an instruction of the user, and send the alarm processing request to the server, so that the server performs subsequent processing.

And step S204, generating prediction data corresponding to the time period to be alarmed based on a pre-trained service data prediction model.

The service data prediction model refers to a pre-trained model for predicting the service data of the service to be alarmed, and may specifically be a neural network model based on deep learning and the like. For different services to be warned, the corresponding service data prediction models may be the same or different, and the application does not limit the same.

In this embodiment, the server may input the prediction time corresponding to the time period to be warned into a business data prediction model trained in advance, and perform prediction processing based on the business data prediction model to obtain corresponding prediction data.

Specifically, the server may input the time period to be alarmed according to a predefined input standard, for example, the input time period to be alarmed may be 20210716000000 to 20210716235959, or may also be 2021.07.16.000000 to 2021.07.16.235959, and the like.

In this embodiment, the server may perform training of the business data prediction model through the historical data to obtain a pre-trained business data prediction model.

Specifically, the server may classify the acquired historical data according to the characteristics of the service to be alarmed and use the classified historical data for model training, for example, the server may classify the historical data according to working days and non-working days and use the classified historical data for model training.

In this embodiment, the server may construct an initial service data prediction model, for example, the constructed initial service data prediction model may be an ARIMA model, and meanwhile, the activity parameter is introduced in combination with the service characteristic, and the model expression may be as shown in the following formula (1)

（1）

Wherein, y_tIs the current value, μ is a constant term, p and q are model orders, γ_iIs the regression coefficient of the AR model, ε_tIs a random disturbance, θ_jIs the regression coefficient of the MA model, alpha is the activity parameter, v_tThe data of the activity day, in particular to the average difference value of the data corresponding to the historical activity day relative to the normal working day.

In this embodiment, after the server obtains the processed history data, the server may perform a stationarity check on the obtained history data, for example, the server may perform detection by an authenticated digital signature-filler (ADF) method, and perform differential processing until the stationarity check is passed if the server cannot perform the stationarity check.

Further, the server may draw an Autocorrelation coefficient map and a partial Autocorrelation coefficient map of stationary data through an Autocorrelation Function (ACF) and a partial Autocorrelation Function (PACF), respectively, so as to determine a selection range of the parameter p and the parameter q in the ARIMA model based on the Autocorrelation coefficient map and the partial Autocorrelation coefficient map.

Further, the server may select optimal parameter values of the parameter p and the parameter q from the determined selection range through a Bayesian Information Criterion (BIC).

Further, the server may use the determined values of the parameter p, the parameter d, and the parameter q as values of the parameter p, the parameter d, and the parameter q in the model, and perform training of the model.

Specifically, after the server completes configuration of the parameter p, the parameter d, and the parameter q in the model, the server may train the model according to the historical data, thereby determining the constant term μ and the regression coefficient γ in the model_iAnd theta_j。

In this embodiment, the server may divide the acquired historical data into training data and test data, perform model training by pre-storing the data, and then perform a test based on the test data.

Specifically, the server may group and label each historical data in advance based on the instruction of the user to obtain labels and grouped training data and test data. Training is carried out based on the labeled training data after detection, and testing is carried out based on the labeled testing data.

In this embodiment, the server may preset parameters of training and testing, such as iteration times, loss function, pass rate, and the like, and then perform training and testing of the model based on the set parameters of training and testing, so as to ensure the accuracy of model training.

In this embodiment, the server may screen the data of the activity day and the data of the non-activity day from the history data, and perform the data of the activity day v_tAnd (4) calculating.

In one embodiment, the server may obtain the data of the activity day of the last year and the data of the inactive working day of the last week, and calculate the average difference value of the data corresponding to the activity day with respect to the normal working day. The specific calculation formula can be seen in the following formula (2).

（2）

Wherein, H is the set of activity days of the last year, and n is the number of elements (total number of activity days) corresponding to the set H; w is the set of inactive workdays corresponding to the week before each active day, and m is the number of elements (total number of inactive days) corresponding to set W.

And step S206, carrying out error prediction on the prediction data to obtain a corresponding prediction error.

In this embodiment, after obtaining the prediction data, the server may perform error prediction based on the prediction data to obtain a prediction error corresponding to the prediction data predicted by the service data prediction model.

Specifically, the server may perform error prediction on the obtained prediction data through an error prediction model.

In this embodiment, the error prediction model may be an XGBOOST model, and the server may train the constructed initial error prediction model in advance through training data to obtain a prediction error of the prediction data.

Specifically, when the server trains the service data prediction model through the historical data, the training prediction data output based on the historical data and the service data prediction model based on the historical data may be used as error training data of the error prediction model and used for training the error prediction model.

In this embodiment, the server may obtain the error value according to the historical data and the training prediction data output by the service data prediction model based on the historical data. Then, the training prediction data is input into the error prediction model as error training data, and corresponding training errors are output. Further, based on the training error and the corresponding error value, calculating a loss value of the error prediction model, and performing iterative updating of the error prediction model to obtain the trained error prediction model.

In one embodiment, after acquiring the historical data and the training prediction data output by the service data prediction model based on the historical data, the server may perform preprocessing on the acquired historical data and the training prediction data output by the service data prediction model based on the historical data, extract time and data features from the historical data and the training prediction data, so as to obtain the training data including the time features, for example, the time is divided into six time types of morning, afternoon, evening and rest in a day period, and the specific corresponding time division is shown in the following table one.

Watch 1

Further, the server may input training data including the temporal features into the XGBOOST model, and perform training to obtain a trained error prediction model.

And step S208, obtaining corresponding target prediction data according to the prediction error and the prediction data.

In this embodiment, the server may superimpose the prediction data obtained from the prediction and the obtained error data to obtain corresponding target prediction data. That is, the server may determine the target prediction data by the following equation (3).

（3）

Wherein, Y_tPredicting data for the target, y_tFor the prediction data, Δ_tIs the prediction error.

And step S210, performing exception classification on the prediction data, and performing alarm processing on the service to be alarmed when the prediction data is determined to be abnormal.

In this embodiment, after obtaining the prediction data, the server may perform abnormality determination processing based on the obtained prediction data, that is, perform abnormality classification on the prediction data, and determine whether the service to be warned is abnormal.

In this embodiment, as an example of the login volume service of the system user, the server may determine that the data is abnormal when determining that the login volume is increased suddenly or decreased obviously within the time period to be predicted based on the predicted data, and then the server may perform pre-warning processing, for example, warning may be performed in a manner of mail, short message, or the like.

Alternatively, in another embodiment, the server may also perform data anomaly detection according to a login amount fluctuation situation of the user, and perform alarm processing when determining that the data anomaly is present.

According to the data abnormity alarm processing method, an alarm processing request of a service to be alarmed is received, the alarm processing request carries a time period to be alarmed, then prediction data corresponding to the time period to be alarmed is generated based on a pre-trained service data prediction model, error prediction is carried out on the prediction data to obtain a corresponding prediction error, further, corresponding target prediction data is obtained according to the prediction error and the prediction data, abnormity classification is carried out on the target prediction data, and alarm processing is carried out on the service to be alarmed when the abnormity of the target prediction data is determined. Therefore, when the alarm processing of the business system is carried out, the data in any time interval can be prestored based on the business data prediction model, and error processing and abnormal classification are carried out, so that the intelligent level of the alarm processing can be improved aiming at any time interval by the prediction processing. In addition, the target prediction data for abnormal classification is integrated with the prediction error, so that the obtained target prediction data is more accurate, the accuracy of abnormal classification can be improved, and the accuracy of subsequent alarm processing can be improved.

In one embodiment, performing error prediction on the prediction data to obtain a corresponding prediction error may include: splitting the predicted data to generate sampled predicted data corresponding to each sampling period, wherein each sampling period is continuous; generating a plurality of data groups corresponding to the prediction data according to the time sequence of each sampling period, wherein each data group comprises a plurality of sampling prediction data of a plurality of continuous sampling periods; and carrying out error prediction on each data set to obtain a corresponding prediction error.

Specifically, after the server acquires the corresponding prediction data, the server may split the acquired prediction data according to a sampling period, for example, the sampling period is 5 minutes, and the server may split the acquired prediction data according to 5 minutes as one sampling period to acquire the corresponding sampling prediction data.

In this embodiment, the server may traverse the prediction data of the time period to be warned to obtain a plurality of corresponding sampling prediction data.

Further, the server may perform grouping processing on the obtained sampled prediction data in time order to obtain a plurality of data groups corresponding to the prediction data.

In this embodiment, the number of the sampling prediction data in each data group may be determined based on the traffic data prediction model, for example, 2p sampling prediction data may be determined to form one data group according to the model parameter p of the traffic data prediction model.

Further, the server may perform error prediction processing on each data set through the error prediction model described above to obtain error data corresponding to the predicted data.

In this embodiment, the server may obtain the error data corresponding to each sampling prediction data, so as to obtain the error data corresponding to the prediction data.

In one embodiment, generating a plurality of data sets corresponding to the prediction data in time order of each sampling period may include: acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are acquired in the first sampling period, and the second sampling data are acquired in a continuous preset number of sampling periods after the first sampling period in time sequence; taking a second sampling period after the first sampling period as a first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group; and traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

The first sampling period may refer to a first sampling period in a time period to be alarmed, that is, a first sampling period in a time sequence. For example, 24 hours a day, every five minutes is a sampling period, and with 8 points as a time starting point, the first sampling period refers to a sampling period corresponding to five points from eight points to eight points, and so on, and the second sampling period refers to a sampling period corresponding to ten points from eight points to five points. In each sampling period, the server collects only one data.

In this embodiment, the server may obtain first sample data of a first sample period and second sample data of a preset number of consecutive sample periods that are chronologically after the first sample period, to obtain a first data group. For example, the first sampling data acquired by the server may be data corresponding to eight points, the data amount in the data group is determined based on the model order p, that is, 2p data, and the preset number is 2p-1, that is, the server may acquire the first sampling data of the first sampling period and the second sampling data of 2p-1 sampling periods that are consecutive after the first sampling period, so as to obtain the first data group.

In one embodiment, p is 5, and the first data group may include 10 sampled data from eight points to eighty points.

Further, the server may use a second sampling period, which is located after the first sampling period in time sequence, as the first sampling period, and continue to obtain the corresponding first sampling data and second sampling data, so as to obtain the second data group. That is, the server may obtain the first sampling data corresponding to the second sampling period, and obtain the second sampling data of 2p-1 sampling periods that are consecutive after the second sampling period, so as to obtain the second data group.

In this embodiment, the server may traverse each data of each sampling period corresponding to the split predicted data to obtain a plurality of data sets corresponding to the predicted data.

In one embodiment, performing error prediction on each data set to obtain a corresponding prediction error may include: acquiring corresponding time data according to each data group; obtaining corresponding error prediction data based on the time data and the corresponding data group; and carrying out error prediction on each error prediction data to generate a corresponding prediction error.

In this embodiment, the server may determine the corresponding time data based on each data set when performing the error prediction, for example, the server may determine the time data corresponding to each data set according to the aforementioned table one, such as early, morning, noon, afternoon, late, rest, and the like.

In this embodiment, the server may combine each data set with the corresponding time data to obtain the corresponding error prediction data.

Further, the server may input the error prediction data into a pre-constructed and trained XGBOOST model to perform error prediction to generate a corresponding prediction error.

In one embodiment, when performing error prediction, the server may also perform prediction on the sample data of each sampling period to obtain error data corresponding to each sample data, and perform subsequent processing, for example, perform prediction on sample data of eight points to eight points in five minutes to obtain corresponding error data, perform prediction on sample data of eight points in five minutes to eight points in ten minutes to obtain corresponding error data, and the like.

In one embodiment, the performing exception classification on the target prediction data, and performing alarm processing on the service to be alarmed when it is determined that the target prediction data is abnormal may include: determining a target data group corresponding to each data group based on the target prediction data; carrying out abnormity classification on each target data group, and judging whether each target data group is abnormal or not; and when at least one target data group is abnormal, performing alarm processing on the service to be alarmed.

Specifically, after obtaining the corresponding target predicted data based on the error data and the predicted data, the server may split the target predicted data in the same splitting manner as the sampled data, and perform grouping processing to obtain the target data group of each corresponding data group.

In one embodiment, the server may also obtain corresponding target data sets directly based on the data sets and the error data corresponding to the data sets, which is not limited in this application.

In this embodiment, after obtaining each target data group, the server may perform exception classification processing on each target data group, respectively, to determine whether each target data group is abnormal.

In this embodiment, when the server determines that at least one target data set is abnormal, the server may perform alarm processing.

In one embodiment, when the server performs the abnormal classification on the predicted data, the intelligent alarm can be performed by combining the predicted data and the historical data through an alarm model, for example, the XGBOOST algorithm.

Specifically, the server firstly performs feature extraction on the obtained target pre-stored data to obtain corresponding feature data. And inputting the obtained characteristic data into an alarm model, and performing alarm pre-judgment based on the alarm model.

In one embodiment, the alarm processing request carries parameter data of which the time period to be alarmed is an active day or an inactive day.

Wherein, the activity day can be the date of anniversary, holiday, etc.

In this embodiment, the alarm data request acquired by the server may carry parameter data with a time period to be alarmed being an active day or an inactive day, for example, the inactive day may be 0, and the active day may be 1.

In this embodiment, generating the prediction data corresponding to the time period to be warned based on the pre-trained service data prediction model may include: according to the parameter data, activity day parameters of a pre-trained business data prediction model are adjusted to obtain a business data prediction model after the activity day parameters are adjusted; and predicting the service data based on the service data prediction model after the activity day parameter adjustment to generate prediction data corresponding to the time period to be alarmed.

As described above, the expression of the traffic data prediction model is shown in formula (1). The server may adjust the activity day parameter of the business data prediction model trained in advance according to the parameter data, that is, adjust the activity day parameter α in the formula (1), that is, when the time period to be warned is an activity day, the activity day parameter α of the business data prediction model is set to 1, and when the time period to be warned is an inactive day, the activity day parameter α of the business data prediction model is set to 0.

Further, the server can predict the service data based on the service data prediction model after the activity day parameter adjustment, and generate prediction data corresponding to the time period to be alarmed.

It should be understood that, although the steps in the flowchart of fig. 2 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 2 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

In one embodiment, as shown in fig. 3, there is provided a data exception alarm processing apparatus, including: an alert processing request receiving module 100, a prediction data generating module 200, a prediction error determining module 300, a target prediction data determining module 400, and an alert processing module 500, wherein:

the alarm processing request receiving module 100 is configured to receive an alarm processing request of a service to be alarmed, where the alarm processing request carries a time period to be alarmed.

And the prediction data generation module 200 is configured to generate prediction data corresponding to a time period to be warned based on a pre-trained service data prediction model.

And a prediction error determining module 300, configured to perform error prediction on the prediction data to obtain a corresponding prediction error.

And a target prediction data determining module 400, configured to obtain corresponding target prediction data according to the prediction error and the prediction data.

And the alarm processing module 500 is configured to perform exception classification on the target prediction data, and perform alarm processing on the service to be alarmed when it is determined that the target prediction data is abnormal.

In one embodiment, the prediction error determination module 300 may include:

and the splitting submodule is used for splitting the prediction data to generate sampling prediction data corresponding to each sampling period, and each sampling period is continuous.

And the data group determination submodule is used for generating a plurality of data groups corresponding to the prediction data according to the time sequence of each sampling period, and each data group comprises a plurality of sampling prediction data of a plurality of continuous sampling periods.

And the error prediction submodule is used for carrying out error prediction on each data set to obtain a corresponding prediction error.

In one embodiment, the alarm processing module 500 may include:

and the target data group determining submodule is used for determining a target data group corresponding to each data group based on the target prediction data.

And the judgment submodule is used for carrying out abnormity classification on each target data group and judging whether each target data group is abnormal or not.

And the alarm processing submodule is used for carrying out alarm processing on the service to be alarmed when at least one target data group is abnormal.

In one embodiment, the data set determining sub-module may include:

the first data group determining unit is used for acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are data acquired in the first sampling period, and the second sampling data are data acquired in a continuous preset number of sampling periods after the first sampling period in time sequence.

And the second data group determining unit is used for taking a second sampling period after the first sampling period in time sequence as the first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group.

And the circulating unit is used for traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

In one embodiment, the error prediction sub-module may include:

and the time data acquisition unit is used for acquiring corresponding time data according to each data group.

And an error prediction data generation unit for obtaining each corresponding error prediction data based on each time data and the corresponding data group.

And a prediction error generation unit for performing error prediction on each error prediction data to generate a corresponding prediction error.

In one embodiment, the alarm processing request may carry parameter data of the alarm waiting time period being an active day or an inactive day.

In this embodiment, the prediction data generating module 200 may include:

and the model adjusting submodule is used for adjusting the activity day parameters of the pre-trained business data prediction model according to the parameter data to obtain the business data prediction model after the activity day parameters are adjusted.

And the prediction data generation submodule is used for predicting the service data based on the service data prediction model after the activity day parameter adjustment and generating prediction data corresponding to the time period to be alarmed.

For specific limitations of the data abnormality alarm processing apparatus, reference may be made to the above limitations on the data abnormality alarm processing method, which is not described herein again. All or part of the modules in the data abnormality alarm processing device can be realized by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in fig. 4. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing data such as alarm processing requests, prediction data, prediction errors, target prediction data and the like. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a data exception alert handling method.

Those skilled in the art will appreciate that the architecture shown in fig. 4 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, there is provided a computer device comprising a memory storing a computer program and a processor implementing the following steps when the processor executes the computer program: receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed; generating prediction data corresponding to a time period to be alarmed based on a pre-trained service data prediction model; carrying out error prediction on the prediction data to obtain a corresponding prediction error; obtaining corresponding target prediction data according to the prediction error and the prediction data; and carrying out exception classification on the target prediction data, and carrying out alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal.

In one embodiment, when the processor executes the computer program, the performing error prediction on the prediction data to obtain a corresponding prediction error may include: splitting the predicted data to generate sampled predicted data corresponding to each sampling period, wherein each sampling period is continuous; generating a plurality of data groups corresponding to the prediction data according to the time sequence of each sampling period, wherein each data group comprises a plurality of sampling prediction data of a plurality of continuous sampling periods; and carrying out error prediction on each data set to obtain a corresponding prediction error.

In one embodiment, the implementing, when the processor executes the computer program, the exception classification of the target prediction data, and performing the alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal may include: determining a target data group corresponding to each data group based on the target prediction data; carrying out abnormity classification on each target data group, and judging whether each target data group is abnormal or not; and when at least one target data group is abnormal, performing alarm processing on the service to be alarmed.

In one embodiment, the processor, when executing the computer program, is configured to generate a plurality of data sets corresponding to the prediction data in time order of each sampling period, and may include: acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are acquired in the first sampling period, and the second sampling data are acquired in a continuous preset number of sampling periods after the first sampling period in time sequence; taking a second sampling period after the first sampling period as a first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group; and traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

In one embodiment, when the processor executes the computer program, the error prediction of each data set is implemented to obtain a corresponding prediction error, which may include: acquiring corresponding time data according to each data group; obtaining corresponding error prediction data based on the time data and the corresponding data group; and carrying out error prediction on each error prediction data to generate a corresponding prediction error.

In one embodiment, the alarm processing request carries parameter data of which the time period to be alarmed is an active day or an inactive day.

In this embodiment, when the processor executes the computer program, the generating of the prediction data corresponding to the time period to be warned based on the pre-trained service data prediction model may include: according to the parameter data, activity day parameters of a pre-trained business data prediction model are adjusted to obtain a business data prediction model after the activity day parameters are adjusted; and predicting the service data based on the service data prediction model after the activity day parameter adjustment to generate prediction data corresponding to the time period to be alarmed.

In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of: receiving an alarm processing request of a service to be alarmed, wherein the alarm processing request carries a time period to be alarmed; generating prediction data corresponding to a time period to be alarmed based on a pre-trained service data prediction model; carrying out error prediction on the prediction data to obtain a corresponding prediction error; obtaining corresponding target prediction data according to the prediction error and the prediction data; and carrying out exception classification on the target prediction data, and carrying out alarm processing on the service to be alarmed when the target prediction data is determined to be abnormal.

In one embodiment, the computer program when executed by the processor performs error prediction on the prediction data to obtain a corresponding prediction error, and may include: splitting the predicted data to generate sampled predicted data corresponding to each sampling period, wherein each sampling period is continuous; generating a plurality of data groups corresponding to the prediction data according to the time sequence of each sampling period, wherein each data group comprises a plurality of sampling prediction data of a plurality of continuous sampling periods; and carrying out error prediction on each data set to obtain a corresponding prediction error.

In one embodiment, the executing of the computer program by the processor, when executed by the processor, implements exception classification on the target prediction data, and performs an alarm process on the service to be alarmed when it is determined that the target prediction data is abnormal, may include: determining a target data group corresponding to each data group based on the target prediction data; carrying out abnormity classification on each target data group, and judging whether each target data group is abnormal or not; and when at least one target data group is abnormal, performing alarm processing on the service to be alarmed.

In one embodiment, the computer program when executed by the processor for implementing the generating of the plurality of data sets corresponding to the prediction data in time order of the sampling periods may include: acquiring first sampling data and second sampling data corresponding to a first sampling period, and obtaining a first data group based on the first sampling data and the second sampling data, wherein the first sampling data are acquired in the first sampling period, and the second sampling data are acquired in a continuous preset number of sampling periods after the first sampling period in time sequence; taking a second sampling period after the first sampling period as a first sampling period, and continuously acquiring corresponding first sampling data and second sampling data to obtain a second data group; and traversing each sampling period corresponding to the split predicted data to obtain a plurality of data groups corresponding to the predicted data.

In one embodiment, the computer program, when executed by the processor, performs error prediction on each data set to obtain a corresponding prediction error, and may include: acquiring corresponding time data according to each data group; obtaining corresponding error prediction data based on the time data and the corresponding data group; and carrying out error prediction on each error prediction data to generate a corresponding prediction error.

In one embodiment, the alarm processing request carries parameter data of which the time period to be alarmed is an active day or an inactive day.

In this embodiment, when being executed by a processor, the computer program implements a prediction model based on pre-trained service data to generate prediction data corresponding to a time period to be warned, and may include: according to the parameter data, activity day parameters of a pre-trained business data prediction model are adjusted to obtain a business data prediction model after the activity day parameters are adjusted; and predicting the service data based on the service data prediction model after the activity day parameter adjustment to generate prediction data corresponding to the time period to be alarmed.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.