CN110945484A

CN110945484A - System and method for anomaly detection in data storage

Info

Publication number: CN110945484A
Application number: CN201880001318.8A
Authority: CN
Inventors: 甘祖毓; 叶舟; 王瑜
Original assignee: Beijing Didi Infinity Technology and Development Co Ltd
Current assignee: Beijing Didi Infinity Technology and Development Co Ltd
Priority date: 2018-06-08
Filing date: 2018-06-08
Publication date: 2020-03-31
Anticipated expiration: 2038-06-08
Also published as: CN110945484B; WO2019232773A1

Abstract

A system includes a storage device storing a set of instructions, and at least one processor in communication with the storage device. The at least one processor, when executing the instructions, is configured to cause the system to obtain at least two historical data values and determine a category associated with the at least two historical data values. The at least one processor is further configured to cause the system to determine at least two predicted values based on the category and obtain at least two real values corresponding to the at least two predicted values related to the service. The at least one processor further causes the system to compare the at least two real values to the at least two predicted values using at least one filter to produce a comparison result, and determine that at least a portion of the at least two real values are anomalous based on the comparison result.

Description

System and method for anomaly detection in data storage

Technical Field

The present invention relates to a system and a method for data storage management, and more particularly, to a method and a system for detecting an anomaly in data storage.

Background

With the explosion of the various service lines of an online-to-offline service system, there may be an explosive growth in the amount of service data. A data warehouse may be used to store service data. Anomaly detection is directed to finding data from service data that is different from expected data.

Since the service data can reflect the service condition within a certain time, the authenticity of the service data in the data warehouse must be ensured, and the abnormal fluctuation of the service data needs to be reminded in time. Current techniques typically rely on database management or experience with continuous iterative modifications of database management systems, resulting in response delays to anomalous fluctuations. A method and system are needed to improve anomaly detection.

Disclosure of Invention

According to one aspect of the present application, a system may include a storage device storing a set of instructions; and one or more processors in communication with the memory device. When executing the set of instructions, the one or more processors are configured to cause the system to obtain, over a network, at least two historical data values related to a service and a category related to the at least two historical data values. The one or more processors may cause the system to determine at least two predicted values associated with the service based on a predictive model associated with the category and obtain at least two real values associated with the service over a network corresponding to the at least two predicted values. In some embodiments, each predictor corresponds to a point in time. Further, the one or more processors may cause the system to compare the at least two real values to the at least two predicted values using at least one filter to produce a comparison result; and determining that at least a portion of the at least two real values are anomalous based on the comparison.

In some embodiments, the at least two historical data values form a time series.

In some embodiments, the one or more processors are further configured to cause the system to determine at least two feature values related to the at least two historical data values and determine the category related to the at least two historical data values based on the at least two feature values.

In some embodiments, the categories represent characteristics related to the service, the categories including a growing period with periodicity, a stationary period with periodicity, a decaying period with periodicity, a growing period with non-periodicity, a stationary period with non-periodicity, or a decaying period with non-periodicity.

In some embodiments, the one or more processors are further configured to cause the system to determine that the category indicative of the characteristic related to the service is related to periodicity, and determine a residual function, a trend function, and a seasonal function related to the at least two historical data values based on the category related to periodicity. The one or more processors are further configured to cause the system to generate the predictive model based on the residual function, the trend function, and the seasonal function; and determining the at least two predicted values based on the prediction model.

In some embodiments, the one or more processors are further configured to cause the system to obtain a point in time associated with at least a portion of the at least two predicted values, and obtain the at least two real values based on the point in time associated with at least a portion of the at least two predicted values.

In some embodiments, the at least one filter comprises a discrete filter. The one or more processors are further configured to cause the system to determine a statistical value based on the at least two predicted values and the at least two true values using the discrete filter, and compare the statistical value to a first threshold. In some embodiments, the statistical value is related to a degree of dispersion of the at least two predicted values and the at least two actual values. The one or more processors are further configured to cause the system to determine that the at least a portion of the at least two real values are anomalous in response to a comparison result that the statistical value is greater than the first threshold value.

In some embodiments, the at least one filter comprises a threshold filter. The one or more processors are further configured to cause the system to determine at least two differences between the at least two predicted values and the at least two true values and at least two second thresholds based on a time function using the threshold filter. The one or more processors are further configured to cause the system to compare each of the at least two difference values to its corresponding second threshold. The one or more processors are further configured to determine that the at least a portion of the at least two real values are abnormal in response to a comparison of each of the at least two difference values being greater than a second threshold value corresponding thereto. In some embodiments, each of the at least two difference values and the second threshold value corresponding thereto are associated with the same point in time.

In some embodiments, the at least one filter comprises a false alarm filter. The one or more processors are further configured to cause the system to determine a false alarm model based on a pre-tagged dataset associated with service data, and determine that the at least a portion of the at least two real values are anomalous based on the false alarm model. In some embodiments, the pre-marked dataset comprises at least two false alarm results produced by the system.

In some embodiments, the one or more processors are further configured to cause the system to compare the at least two real values to the at least two predicted values using a discrete filter, a threshold filter, and a false alarm filter to produce a first comparison result, a second comparison result, and a third comparison result, respectively. The one or more processors are further configured to cause the system to determine that at least a portion of the at least two real values are anomalous based on the first comparison result, the second comparison result, and the third comparison result.

According to another aspect of the disclosure, a method implemented on a computing device may include one or more of the following operations performed by one or more processors. The method includes obtaining, over a network, at least two historical data values associated with a service and determining a category associated with the at least two historical data values. The method includes determining at least two predicted values associated with the service based on a predictive model associated with the category and obtaining at least two real values associated with the service over a network corresponding to the at least two predicted values. In some embodiments, each predictor corresponds to a point in time. The method includes comparing, using at least one filter, the at least two real values to the at least two predicted values to produce a comparison result and determining, based on the comparison result, that at least a portion of the at least two real values are anomalous.

In some embodiments, the method may further include determining at least two feature values associated with the at least two historical data values, and determining a category associated with the at least two historical data values based on the at least two feature values.

In some embodiments, the method may further comprise determining that the category indicative of the characteristic related to the service is related to periodicity, and determining a residual function, a trend function, and a seasonal function related to the at least two historical data values based on the category related to periodicity. The method further includes generating the predictive model based on the residual function, the trend function, and the seasonal function; and determining the at least two predicted values based on the prediction model.

In some embodiments, the method may further include obtaining a point in time associated with at least a portion of the at least two predicted values, and obtaining the at least two real values based on the point in time associated with at least a portion of the at least two predicted values.

In some embodiments, the at least one filter comprises a discrete filter. The method may further include determining a statistical value based on the at least two predicted values and the at least two true values using the discrete filter, and comparing the statistical value to a first threshold. In some embodiments, the statistical value is related to a degree of dispersion of the at least two predicted values and the at least two actual values. The method may further include determining that the at least a portion of the at least two true values are anomalous in response to the comparison of the statistical value being greater than the first threshold.

In some embodiments, the at least one filter comprises a threshold filter. The method may further comprise determining at least two differences between the at least two predicted values and the at least two true values and determining at least two second thresholds based on a time function, using the threshold filter. The method further includes comparing each of the at least two difference values to its corresponding second threshold value and determining that the at least a portion of the at least two true values are abnormal in response to the comparison of each of the at least two difference values being greater than its corresponding second threshold value. In some embodiments, each of the at least two difference values and the second threshold value corresponding thereto are associated with the same point in time.

In some embodiments, the at least one filter comprises a false alarm filter. The method may further include determining a false alarm model based on a pre-tagged data set associated with the service data, and determining that the at least a portion of the at least two real values are anomalous based on the false alarm model. In some embodiments, the pre-marked dataset comprises at least two false alarm results produced by the system.

In some embodiments, the method includes comparing the at least two real values to the at least two predicted values to produce a first comparison result, a second comparison result, and a third comparison result, respectively, also using a discrete filter, a threshold filter, and a false alarm filter. The method further includes determining that at least a portion of the at least two real values are abnormal based on the first comparison result, the second comparison result, and the third comparison result.

According to yet another aspect of the present application, a non-transitory computer-readable medium may store a set of instructions. The set of instructions, when executed by one or more processors of a system, may cause the system to obtain at least two historical data values related to a service over a network and determine a category related to the at least two historical data values. The set of instructions may cause the system to determine at least two predictive values associated with the service based on a predictive model associated with the category, and obtain at least two real values associated with the service over a network corresponding to the at least two predictive values. In some embodiments, each predictor corresponds to a point in time. The set of instructions may further cause the system to compare the at least two real values to the at least two predicted values using at least one filter to produce a comparison result, and determine that at least a portion of the at least two real values are anomalous based on the comparison result

Additional features of the present application will be set forth in part in the description which follows. Additional features of some aspects of the present application will be apparent to those of ordinary skill in the art in view of the following description and accompanying drawings, or in view of the production or operation of the embodiments. The features of the present disclosure may be realized and attained by practice or use of the methods, instrumentalities and combinations of the various aspects of the particular embodiments described below.

Drawings

The present application will be further described in conjunction with the exemplary embodiments. These exemplary embodiments will be described in detail with reference to the drawings. These embodiments are non-limiting exemplary embodiments, in which like numerals represent like structures throughout the several views, and in which:

FIG. 1 is a schematic diagram of an exemplary online-to-offline service system, shown in accordance with some embodiments of the present application;

FIG. 2 is a schematic diagram of exemplary hardware and software components of a computing device according to some embodiments of the application;

FIG. 3 is a diagram of exemplary hardware and software components of a mobile device according to some embodiments of the application;

FIG. 4 is a block diagram of an exemplary processing engine shown in accordance with some embodiments of the present application;

FIG. 5 is a flow diagram illustrating an exemplary process for determining that at least a portion of at least two real values are anomalous based on a comparison result, according to some embodiments of the present application;

FIG. 6 is a flow diagram illustrating an exemplary process for determining at least two predicted values according to some embodiments of the present application;

FIG. 7 is a flow diagram illustrating an exemplary process for determining that the at least a portion of the at least two real values are anomalous according to some embodiments of the present application;

FIG. 8 is a flow diagram illustrating an exemplary process for determining that the at least a portion of the at least two real values are anomalous according to some embodiments of the present application; and

fig. 9 is a table relating to at least two service lines, shown in accordance with some embodiments of the present application.

Detailed Description

The following description is presented to enable one of ordinary skill in the art to make and use the application and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present application. Thus, the present application is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to limit the scope of the present application. As used in this application and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural unless the context clearly dictates otherwise. It will be understood that the terms "comprises" and/or "comprising," when used in this application, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

The foregoing and other features, aspects of the operation, and functions of the related elements of the present application, as well as the related elements of the present application, will become more apparent from the following description of the drawings, which are to be read in connection with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for the purposes of illustration and description and are not intended as a definition of the limits of the application. It should be understood that the drawings are not to scale.

Flow charts are used herein to illustrate operations performed by systems according to embodiments of the present application. It should be expressly understood that the operations in the flowcharts may be performed out of order. Rather, various steps may be processed in reverse order or simultaneously. Also, one or more other operations may be added to the flowcharts. One or more operations may also be deleted from the flowchart.

Further, while the system and method of the present application are described primarily with respect to distributing transportation service requests, it should be understood that this is merely one exemplary embodiment. The system or method of the present application is also applicable to other types of online-to-offline services. For example, the systems and methods of the present application may also be applied to systems including terrestrial, marine, aerospace, and the like, or any combination thereof. Vehicles used in the transportation system may include taxis, private cars, tailplanes, buses, trains, bullet trains, high speed railways, subways, ships, airplanes, space vehicles, hot air balloons, unmanned vehicles, and the like, or any combination thereof. The transport system may also include any transport system for operation and/or distribution, such as a system for transmitting and/or receiving courier. The application scenarios of the different embodiments of the present application may include one or a combination of several of a web page, a browser plug-in, a client, a customization system, an enterprise internal analysis system, an artificial intelligence robot, and the like.

In this application, the terms "passenger," "requestor," "service requestor," and "customer" are used interchangeably to refer to an individual, entity, or tool that can request or subscribe to a service. In this application, the terms "driver," "provider," and "service provider" are also used interchangeably to refer to an individual, entity, or tool that can provide a service or facilitate the provision of the service.

In this application, the terms "service request" and "order" may be used interchangeably to refer to a request initiated by a passenger, requester, service requester, customer, driver, provider, service provider, etc., or any combination of the above examples. The service request may be accepted by any of a passenger, a service requester, a customer, a driver, a provider, and a service provider. The service request may be charged or free.

The terms "service provider terminal" and "driver terminal" are used interchangeably in this application to refer to a mobile terminal used by a service provider for providing services or facilitating the provision of services. The terms "service requester terminal" and "passenger terminal" are used interchangeably in this application and refer to a mobile terminal used by a service requester for requesting or subscribing to a service.

The positioning techniques used in the present application may be based on the Global Positioning System (GPS), the global navigation satellite system (GLONASS), the COMPASS navigation system (COMPASS), the galileo positioning system, the quasi-zenith satellite system (QZSS), wireless fidelity (WiFi) positioning techniques, etc., or any combination thereof. One or more of the above-described positioning techniques may be used interchangeably in this application.

One aspect of the present application relates to an online system and method of data storage management. At least two historical data values associated with the service may be obtained. A category associated with the at least two historical data values may be determined. A predictive model associated with the category may be determined. At least two predicted values related to the service may be determined based on a prediction model. At least two real values corresponding to the at least two predicted values may be obtained. The at least two real values and the at least two predicted values may be compared based on at least one filter and a comparison result may be generated. And judging at least one part of the at least two real values to be abnormal according to the comparison result. The anomaly alarm system is generated based on functions of a classifier, a predictor and a comparator and a machine learning algorithm. According to the category of the service data, the system may obtain one or more parameters based on the offline historical service data value. Further, the one or more parameters may be applied to an online predictor and a comparator for detecting anomalies in the real-time service data. The application improves the abnormal alarming capability in data storage management.

Fig. 1 is a block diagram of an exemplary online-to-offline service system 100, shown in accordance with some embodiments. For example, the online-to-offline service system 100 may be an online transportation service platform that provides transportation services. The online-to-offline service system 100 may include a server 110, a network 120, a service requester terminal 130, a service provider terminal 140, a vehicle 150, a storage device 160, and a navigation system 170.

The online-to-offline service system 100 may provide a variety of services. Exemplary services may include taxi calling services, designated driving services, express delivery services, carpooling services, bus services, driver recruitment services, and pickup services. In some embodiments, the online-to-offline service may be any online service, such as ordering, shopping, or the like, or any combination thereof.

In some embodiments, the server 110 may be a single server or a group of servers. The server farm can be centralized or distributed (e.g., the servers 110 can be distributed systems). In some embodiments, the server 110 may be regional or remote. For example, server 110 may access information and/or data stored in service requester terminal 130, service provider terminal 140, and/or storage device 160 through network 120. As another example, the server 110 may be directly connected to the service requester terminal 130, the service provider terminal 140, and/or the storage device 160 to access stored information and/or data. In some embodiments, the server 110 may be implemented on a cloud platform. By way of example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a cell cloud, a distributed cloud, across clouds, multiple clouds, the like, or any combination of the above. In some embodiments, the server 110 may be implemented on a computing device 1000 having one or more of the components shown in FIG. 10 in the present invention.

In some embodiments, the server 110 may include a processing engine 112. Processing engine 112 may process information and/or data related to the service request to perform one or more functions described herein. For example, the processing engine 112 may determine that at least a portion of the at least two real values are anomalous. In some embodiments, processing engine 112 may include one or at least two processing engines (e.g., a single chip processing engine or a multi-chip processing engine). Merely by way of example, the processing engine 112 may include a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), an application specific instruction set processor (ASIP), an image processor (GPU), a physical arithmetic processing unit (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), a controller, a microcontroller unit, a Reduced Instruction Set Computer (RISC), a microprocessor, or the like, or any combination thereof.

Network 120 may facilitate the exchange of information and/or data. In some embodiments, one or more components in the online-to-offline service system 100 (e.g., the server 110, the service requester terminal 130, the service provider terminal 140, the vehicle 150, the storage device 160, and the navigation system 170) may send information and/or data to other components in the online-to-offline service system 100 over the network 120. For example, the server 110 may receive a service request from the service requester terminal 130 through the network 120. In some embodiments, the network 120 may be any form of wired or wireless network, or any combination thereof. Merely by way of example, the network 120 may be a cable network, a fiber optic network, a telecommunications network, an intranet, the internet, a Local Area Network (LAN), a Wide Area Network (WAN), a Wireless Local Area Network (WLAN), a Metropolitan Area Network (MAN), a Public Switched Telephone Network (PSTN), a bluetooth network, a ZigBee network, Near Field Communication (NFC), the like, or any combination thereof. In some embodiments, network 120 may include one or more network switching points. For example, network 120 may include wired or wireless network switching points, such as base stations and/or Internet switching points 120-1, 120-2, …, through which one or more components of online-to-offline service system 100 may connect to network 120 to exchange data and/or information.

In some embodiments, the passenger may be the owner of the service requester terminal 130. In some embodiments, the owner of the service requester terminal 130 may be someone other than the passenger. For example, the owner a of the service requester terminal 130 may use the service requester terminal 130 to send a service request for the passenger B or to receive service and/or information or instructions from the server 110. In some embodiments, the service provider may be a user of the service provider terminal 140. In some embodiments, the user of the service provider terminal 140 may be someone other than the service provider. For example, user C of service provider terminal 140 may receive a service request for user D and/or information or instructions from server 110 using service provider terminal 140. In some embodiments, "passenger" and "passenger terminal" may be used interchangeably, and "service provider" and "service provider terminal" may be used interchangeably. In some embodiments, the service provider terminal may be associated with one or more service providers (e.g., a night shift service provider or a white shift service provider).

In some embodiments, the requestor terminal 130 may include a mobile device 130-1, a tablet computer 130-2, a laptop computer 130-3, a vehicle built-in device 130-4, the like, or any combination of the above. In some embodiments, the mobile device 130-1 may include a smart home device, a wearable device, a smart mobile device, a virtual reality device, an augmented reality device, or the like, or any combination thereof. In some embodiments, the smart home devices may include smart lighting devices, control devices for smart appliances, smart monitoring devices, smart televisions, smart cameras, interphones, and the like, or any combination thereof. In some embodiments, the wearable device may include a smart bracelet, smart footwear, smart glasses, smart helmet, smart watch, smart clothing, smart backpack, smart accessory, or the like, or any combination thereof. In some embodiments, the smart mobile device may include a smart phone, a Personal Digital Assistant (PDA), a gaming device, a navigation device, a point of sale (POS) device, and the like, or any combination thereof. In some embodiments, the virtual reality device and/or the enhanced virtual reality device may include a virtual reality helmet, virtual reality glasses, a virtual reality patch, an enhanced virtual reality helmet, enhanced virtual reality glasses, an enhanced virtual reality patch, or the like, or any combination thereof. For example, virtual reality devices and/or augmented reality devices may include Google Glass, Oculus Rift, Hololens, Gear VR, and the like. In some embodiments, the in-vehicle device 130-4 may include an in-vehicle computer, an in-vehicle television, or the like. In some embodiments, the service requester terminal 130 may be a device having a location technology for locating the position of the passenger and/or the service requester terminal 130.

The service provider terminal 140 may include at least two service provider terminals 140-1, 140-2, … …, 140-n. In some embodiments, the service provider terminal 140 may be a similar or identical device as the service requestor terminal 130. In some embodiments, the service provider terminal 140 may be customized to enable the online-to-offline transportation service. In some embodiments, the service provider terminal 140 may be a device with location technology that may be used to locate the location of the service provider, the service provider terminal 140, and/or the vehicle 150 associated with the service provider terminal. In some embodiments, the service requester terminal 130 and/or the service provider terminal 140 may communicate with other location means to determine the location of the passenger, the service requester terminal 130, the service provider, and/or the service provider terminal 140. In some embodiments, the service requester terminal 130 and/or the service provider terminal 140 may periodically send the location information to the server 110. In some embodiments, the service provider terminal 140 may also periodically send the availability status to the server 110. The availability status may indicate whether a vehicle 150 associated with the service provider terminal 140 may pick up a passenger. For example, the service requester terminal 130 and/or the service provider terminal 140 may send the location information and the availability status to the server 110 every 30 minutes. As another example, the service requester terminal 130 and/or the service provider terminal 140 may send location information and availability status to the server 110 each time a user logs into a mobile application associated with an online-to-offline transportation service system.

In some embodiments, the service provider terminal 140 may correspond to one or more vehicles 150. Vehicle 150 may pick up passengers and deliver them to a destination. The vehicle 150 may include at least two vehicles 150-1, 150-2, … …, 150-n. A vehicle may correspond to a type of service (e.g., taxi calling service, designated driving service, courier service, carpool service, bus service, driver recruitment service, and pickup service).

Storage device 160 may store data and/or instructions. In some embodiments, the storage device 160 may store data obtained from the service requester terminal 130 and/or the service provider terminal 140. In some embodiments, storage device 160 may store data and/or instructions that server 110 uses to perform or use to perform the exemplary methods described in this application. In some embodiments, storage device 160 may include mass storage, removable storage, volatile read-write memory, read-only memory (ROM), or the like, or any combination thereof. Exemplary mass storage devices may include magnetic disks, optical disks, floppy disks, solid state drives, and the like. Exemplary removable memory may include flash drives, floppy disks, optical disks, memory cards, compact disks, magnetic tape, and the like. Exemplary random access memories may include Dynamic Random Access Memory (DRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Static Random Access Memory (SRAM), silicon controlled random access memory (T-RAM), zero capacitance memory (Z-RAM), and the like. Exemplary read-only memories may include mask read-only memory (MROM), programmable read-only memory (PROM), erasable programmable read-only memory (perrom), electrically erasable programmable read-only memory (EEPROM), compact disk read-only memory (CD-ROM), digital versatile disk read-only memory (dfrom), etc. in some embodiments, storage device 160 may be implemented on a cloud platform. For example only, the cloud platform may include one or a similar or any combination of private cloud, public cloud, hybrid cloud, cell cloud, dispersed cloud, interior cloud, multiple clouds, and the like.

In some embodiments, a storage device 160 may be connected with the network 120 to communicate with one or more components of the online-to-offline service system 100 (e.g., the server 110, the service requestor terminal 130, the service provider terminal 140, etc.). One or more components of the online-to-offline service system 100 may access data or instructions stored in the storage device 160 through the network 120. In some embodiments, the storage device 160 may be directly connected to or in communication with one or more components of the online-to-offline service system 100 (e.g., the server 110, the service requestor terminal 130, the service provider terminal 140, etc.). In some embodiments, storage device 160 may be part of server 110.

The navigation system 170 may determine information related to an object, such as one or more of the service requester terminal 130, the service provider terminal 140, the vehicle 150, etc. In some embodiments, the navigation system 170 may be a Global Positioning System (GPS), a global navigation satellite system (GLONASS), a COMPASS navigation system (COMPASS), a beidou navigation satellite system, a galileo positioning system, a quasi-zenith satellite system (QZSS), or the like. The information may include a position, altitude, velocity, acceleration, or current time of the object. The navigation system 170 may include one or more satellites, such as satellite 170-1, satellite 170-2, and satellite 170-3. The satellites 170-1 to 170-3 may independently or collectively determine the above information. Satellite navigation system 170 may transmit the information to network 120, service requester terminal 130, service provider terminal 140, or vehicle 150 via a wireless connection.

In some embodiments, one or more components of the online-to-offline service system 100 (e.g., the server 110, the service requestor terminal 130, the service provider terminal 140, etc.) may possess rights to access the storage device 160. In some embodiments, one or more components of the online-to-offline service system 100 may read and/or modify information related to passengers, service providers, and/or the public when one or more conditions are satisfied. For example, after a service is completed, the server 110 may read and/or modify information for one or more passengers. As another example, after a service is complete, server 110 may read and/or modify information for one or more service providers.

In some embodiments, the exchange of information for one or more components of the online-to-offline service system 100 may be accomplished by requesting a service. The object of the service request may be any product. In some embodiments, the product may include food, medicine, merchandise, chemical products, appliances, clothing, cars, houses, luxury goods, and the like, or any combination of the above. In some embodiments, the products may include service products, financial products, knowledge products, internet products, and the like, or any combination of the above. The internet products may include personal host products, website products, mobile internet products, commercial host products, embedded products, and the like, or any combination of the above. The mobile internet product may be used for software, programs, systems, etc. or the like of the mobile terminal or any combination thereof. The mobile terminal may include a tablet computer, a laptop computer, a mobile phone, a Personal Digital Assistant (PDA), a smart watch, a point of sale device (POS), a vehicle computer, a vehicle television, a wearable device, and the like, or any combination thereof. The product may be, for example, any software and/or application used on a computer or mobile phone. The software and/or applications may relate to social interaction, shopping, transportation, entertainment, learning, investment, etc., or any combination thereof. In some embodiments, the traffic-related software and/or applications may include travel software and/or applications, vehicle scheduling software and/or applications, mapping software and/or applications, and/or the like. In the vehicle scheduling software and/or application, the vehicle may include horses, human powered vehicles (e.g., wheelbarrows, bicycles, tricycles, etc.), automobiles (e.g., taxis, buses, private cars, etc.), trains, subways, ships, aircraft (e.g., airplanes, helicopters, space shuttles, rockets, hot air balloons, etc.), and any combination thereof.

FIG. 2 is a schematic diagram of exemplary hardware and software of a computing device 200, shown according to some embodiments of the present application. The server 110, the service requester terminal 130 and/or the service provider terminal 140 may be implemented on a computing device 200. For example, the processing engine 112 may be implemented on the computing device 200 and perform the functions of the processing engine 112 disclosed herein.

The computing device 200 may be a general purpose computer or a special purpose computer, both of which may be used to implement the online-to-offline service system disclosed herein. Computing device 200 may be used to implement any of the components of the online-to-offline services described herein. For example, the processing engine 112 may be implemented on the computing device 200 by its hardware, software programs, firmware, or a combination thereof. Although only one such computer is shown, for convenience, computer functionality associated with the online-to-offline services described herein may be implemented in a distributed manner across at least two similar platforms to spread the processing load.

For example, the computing device 200 may include a communication port 250 for connecting to a network to enable data communication. Computing device 200 may include a processor (e.g., the processor 220) that may execute program instructions in the form of one or more processors. Exemplary computing devices may include an internal communication bus 210, various forms of program memory and data storage including, for example, a hard disk 270 and Read Only Memory (ROM)230 or Random Access Memory (RAM)240 for storing various data files processed and/or transmitted by the computing device. The exemplary computing device may also include program instructions stored in read-only memory 230, random access memory 240, and/or other types of non-transitory storage media that are executed by processor 220. The methods and/or processes disclosed herein may be implemented as program instructions. Computing device 200 also includes input/output component 260 for supporting input/output between the computer and other components herein. Computing device 200 may also receive programs and data via network communications.

For illustration only, only one CPU and/or processor is shown in FIG. 2. Or may include at least two central processing units and/or processors; thus, operations and/or methods described herein as being implemented by one CPU and/or processor may also be implemented by at least two CPUs and/or processors, collectively or independently. For example, in the present application, if a central processing unit and/or a processor of computing device 200 performs steps a and B, it should be understood that steps a and B may be performed jointly or separately by two different central processing units and/or processors of computing device 200 (e.g., a first processor performs step a, a second processor performs step B, or a first processor and a second processor perform steps a and B jointly).

Fig. 3 is a schematic diagram of exemplary software and/or hardware of an exemplary mobile device 300 shown in accordance with some embodiments of the present application. As shown in FIG. 3, the mobile device 300 may include a communication module 310, a display 320, a Graphics Processing Unit (GPU)330, a processor 340, an input/output interface 350, a memory 360, and a storage 390. in some embodiments, any other suitable component, including but not limited to a system bus or controller (not shown), may also be included in the mobile device 300. In some embodiments, the operating system 370 is mobile (e.g., iOS)^TM、Android^TM、Windows Phone^TM) And one or more application programs 380 may be loaded from storage 390 into memory 360 for execution by processor 340. The applications 380 may include a browser or any other suitable application for transmitting, receiving, and presenting information related to the status of the vehicle 140 (e.g., the location of the vehicle 140) or other information in the server 110. The user interaction information flow may be obtained via input/output 350 and provided to server 110 and/or other components of online-to-offline service system 100 via network 120.

FIG. 4 is a block diagram of an exemplary processing engine 112 shown in accordance with some embodiments of the present application. The processing engine 112 may include an acquisition module 402, a classification module 404, a prediction module 406, a comparison module 408, and a determination module 410. At least a portion of the processing engine 112 may be implemented on a computing device as shown in FIG. 2, or a mobile device as shown in FIG. 3.

The obtaining module 402 may be configured to obtain at least two historical data values and at least two real values associated with a service via the network 120. The service may be associated with a line of business of the online-to-offline service system 100. The line of business may be any service provided through the online-to-offline service system 100, including, but not limited to, one or a combination of online taxi service, online car rental, advertising, internet finance, and the like. The obtaining module 402 may be further configured to obtain, through the network 120, at least two real values corresponding to the at least two predicted values, which are related to the service. The at least two predicted values may be determined by the prediction module 406.

The classification module 404 may be configured to determine a category associated with the at least two historical data values. The classification module 404 may extract at least two features from the at least two historical data values. The classification module 404 may classify the at least two historical data values into the categories based on the values of the at least two features.

The prediction module 406 may be configured to determine at least two predicted values associated with the service. The prediction module 406 may determine at least two predicted values based on a prediction model associated with the category determined by the classification module 404. The at least two predicted values may be correlated in real time with at least two points in time.

The comparison module 408 may be configured to compare the at least two real values with the at least two predicted values using at least one filter to generate a comparison result. The at least one filter may include a discrete filter, a threshold filter, and a false alarm filter. In some embodiments, the comparison module 408 may compare the at least two real values to the at least two predicted values using each of the discrete filter, the threshold filter, and the false alarm filter to produce the comparison result. The comparison result may include at least one of a first comparison result, a second comparison result, and a third comparison result. The comparison module 408 may determine the first comparison result, the second comparison result, and the third comparison result using the discrete filter, the threshold filter, and the false alarm filter, respectively.

The determination module 410 may be configured to determine that at least a portion of the at least two real values are anomalous based on the comparison. Each of the first comparison result, the second comparison result, and the third comparison result may include determining that the at least a portion of the at least two real values is abnormal. The determining module 410 may determine that the at least a portion of the at least two real values is abnormal or one of a combination of the first comparison result, the second comparison result, and the third comparison result.

It should be noted that the above description of the processing engine 112 is merely for convenience of description and is not intended to limit the present application to the scope of the illustrated embodiments. Many variations and modifications may be made to the teachings of the present disclosure by those of ordinary skill in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. For example, the prediction module 406 and the determination module 410 may be integrated into a single module to perform their functions.

FIG. 5 is a flow diagram illustrating an exemplary process 500 for determining that at least a portion of the at least two true values are anomalous based on the comparison result, according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the flow 500 to determine that the at least a portion of the at least two real values are anomalous. One or more operations of the flow 500 for determining that the at least a portion of the at least two real values is anomalous, shown in fig. 5, may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the process 500 shown in fig. 5 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

At 502, the processing engine 112 (e.g., the obtaining module 402) may obtain at least two historical data values related to a service via the network 120. The service may be associated with a line of business of the online-to-offline service system 100. The line of business may be any service provided through the online-to-offline service system 100, including, but not limited to, one or a combination of online taxi service, online car rental, advertising, internet finance, and the like.

In current applications, the service may be described in the form of an online taxi service, but should not be construed as limiting the service to only the form of an online taxi service. In some embodiments, the online taxi service may be associated with a service requester, a service provider, and a service request. The service request may include a real-time request and/or a reservation request. As used herein, a real-time request may be a request that the requestor wishes to use a transportation service within a specified time that is, or reasonably close to, the current time of day as would be apparent to one of ordinary skill in the art. For example, the request may be a real-time request if the defined time is shorter than a threshold, such as 1 minute, 5 minutes, 10 minutes, or 20 minutes. The reservation request may indicate that the requestor wishes to use the transportation service at a defined time that is considerably distant from the current time by one of ordinary skill in the art. For example, if the defined time is longer than a threshold, such as 20 minutes, 2 hours, or 1 day, the request may be a reservation request. In some embodiments, the processing engine 112 may define the real-time request or the reservation request based on a time threshold. The time threshold may be a default setting for the system 100 or may be adjusted according to different circumstances. For example, during a traffic rush hour, the time threshold may be relatively small (e.g., 10 minutes). During idle periods (e.g., 10 am to 12 am), the time threshold may be relatively large (e.g., 1 hour).

The service request may include a start point, an end point, a start time, a duration, and the like. The origin may refer to a location where the service provider picked up the passenger. The endpoint may refer to a location where the service provider drops the passenger. The start time may refer to the time that the passenger is picked up, or the time that the service provider (e.g., driver) receives or acknowledges the service request. The duration may be the time for the service provider to carry the passenger from the origin to the destination associated with the service request.

The at least two historical data values may be related to the service. In some embodiments, the at least two historical data values may include one or a combination of at least two service requests, at least two durations of service requests, at least two origins of service requests, and the like. The at least two historical data values may be associated with at least two points in time (e.g., start times of service requests). In current applications, the historical data value may be described in the form of at least two service requests, but should not be construed as limiting the historical data value to only the form of the at least two service requests.

The at least two historical data values may form a time series (hereinafter also referred to as "series"). For example, the sequence may be (p)₁,p₂,p₃,…,p_i-1,p_i,…p_n). In the sequence, each value may be associated with a point in time (e.g., a start time of a service request). And value p_i-1And p_iThe relevant points in time may be t respectively_i-1And t_i. The time point t_i-1May be earlier than the time point t_i. In some embodiments, the value p_iMay be the point in time t_iNumber of service requests.

At 504, the processing engine 112 (e.g., the classification module 404) may determine a category associated with the at least two historical data values. The processing engine 112 may analyze the sequence associated with the at least two historical data values. The processing engine 112 may then extract at least two features from the sequence. Further description of the at least two features may be found elsewhere in this application, for example, fig. 9 and its description.

In some embodiments, the at least two characteristics may be related to the service (e.g., an online taxi hiring service) corresponding to the at least two historical data values. The at least two characteristics may include one or a combination of several of age, traffic volume, traffic flow, profit, etc. The processing engine 112 may determine values for the at least two features based on the at least two historical data values.

The processing engine 112 may classify the at least two historical data values into categories based on the at least two feature values. The category may represent a characteristic related to the service. The classes may be constructed based on two sets of Cartesian products. The first set may include periodic, aperiodic, etc. elements. The second set may include elements of the anagen phase, the stationary phase, the catagen phase, etc. In some embodiments, the categories may include growth periods with periodicity, stationary periods with periodicity, decline periods with periodicity, growth periods with non-periodicity, stationary periods with non-periodicity, decline periods with non-periodicity, and so forth. In another embodiment, the category may include an element of the first set or the second set. More description about this category can be found elsewhere in this application, for example, fig. 9 and its description.

The processing engine 112 may determine a classifier for classifying the at least two historical data values. The processing engine 112 may determine, by a third party, a category associated with at least two historical data values. The processing engine 112 may determine a training set based on the feature values associated with the at least two historical data values and the category. The processing engine 112 may determine a classifier using a model (e.g., a gradient boosting decision tree model (GBDT) model) based on the training set. The classifier may classify other historical data values (e.g., at least two sequences). The classification result may be added to the training set. The classifier can be updated over time by using a new training set. The processing engine 112 may classify the at least two historical data values into categories based on the most recent classifier. In some embodiments, the processing engine 112 may classify the at least two historical data values into more than one category based on the most recent classifier.

At 506, the processing engine 112 (e.g., the prediction module 406) may determine at least two predicted values related to the service based on a prediction model related to the category. The at least two predicted values may correspond to at least two first points in time in real time. For example, the at least two first time points may include (t)₁,t₂,t₃,…,t_j-1,t_j,…t_m). Similar to the at least two historical data values, the at least two predicted values may also constitute a sequence.

If the category is related to periodicity, the processing engine 112 may use an algorithm (e.g., an exponential smoothing algorithm) to determine the at least two predictors. The processing engine 112 may use the algorithm to determine statistical parameters related to the at least two historical data values. The statistical parameters may be represented by a residual function, a trend function, and/or a seasonal function.

In some embodiments, the processing engine 112 may determine a predictive model based on the statistical parameters. The processing engine 112 may determine the at least two predicted values based on the predictive model. Further description regarding the determination of the at least two predictors can be found in the present application, e.g., fig. 6 and its description.

If the category is related to aperiodic, the processing engine 112 can periodically collect the historical data values at a point in time. In some embodiments, if the processing engine 112 determines a predicted value (e.g., the number of service requests) at a point in time on the next Monday, at least two service requests at that point in time on each Monday over the past several weeks may be collected. The processing engine 112 may determine a predicted value for the next Monday time point based on the collected number of service requests.

At 508, the processing engine 112 (e.g., the obtaining module 402) may obtain at least two real values associated with the service corresponding to the at least two predicted values via the network 120. The at least two real values may be associated with at least two second points in time. The at least two second time points and the at least two first time points may be in a one-to-one correspondence relationship. Alternatively or additionally, the at least two second points in time and a part of the at least two first points in time may be in a one-to-one correspondence.

For each of the at least two second points in time there may be an actual value corresponding to the second point in time. The at least two real values may refer to values (e.g., number of service requests) associated with a service (e.g., service request) after completion of the service. The at least two real values may be stored in the storage device 160. Similar to the at least two historical data values, the at least two real values may also constitute a sequence. In some embodiments, the at least two real values and the at least two predicted values may be paired. For each of the at least two predictors, the processing engine 112 can obtain an actual value corresponding to each of the at least two predictors. Each of the at least two predicted values and the corresponding real value may be associated with the same point in time.

At 510, the processing engine 112 may compare the at least two real values to the at least two predicted values using at least one filter to generate a comparison result. The at least one filter may include a discrete filter, a threshold filter, and a false alarm filter. In some embodiments, the comparison module 408 may compare the at least two real values to the at least two predicted values using each of the discrete filter, the threshold filter, and the false alarm filter to produce the comparison result.

The comparison result may include at least one of a first comparison result, a second comparison result, and a third comparison result. The processing engine 112 may compare the at least two real values to the at least two predicted values to generate the first comparison result based on the discrete filter. More description of the first comparison result can be found elsewhere in the application, for example, in fig. 7 and its description.

The processing engine 112 may compare the at least two real values to the at least two predicted values based on the threshold filter to generate the second comparison result. More description of the second comparison result may be found elsewhere in this application, for example, fig. 8 and its description.

The processing engine 112 may compare the at least two real values to the at least two predicted values based on the false alarm filter to generate the third comparison result. The processing engine 112 may retrieve a pre-tagged data set associated with the service data. The pre-labeled data set may contain the results of at least two false alarms. The at least two false alarm results may refer to real values that are determined to be abnormal by the online-to-offline service system 100 and later corrected to be normal by the third party. The at least two false alarm results may also refer to real values determined to be normal by the online-to-offline service system 100 and later corrected to be abnormal by the third party.

In some embodiments, the processing engine 112 (e.g., the comparison module 408) may determine a model based on the pre-labeled data set. The processing engine 112 may determine the model by training a classification model based on the pre-labeled data set. The classification model may include a GBDT model, a random forest model, and the like. The processing engine 112 may use the at least two real values and/or the at least two predicted values as inputs to the model. The processing engine 112 may then obtain the third comparison result based on the model.

At 512, the processing engine 112 may determine that at least a portion of the at least two real values are anomalous based on the comparison. The comparison result may include at least one of the first comparison result, the second comparison result, and the third comparison result. Each of the first comparison result, the second comparison result, and the third comparison result may include determining that the at least a portion of the at least two real values is abnormal.

The processing engine 112 may determine that the at least a portion of the at least two real values are anomalous based on the comparison. For example, if one of the first comparison result, the second comparison result, and the third comparison result includes a determination that the at least a portion of the at least two real values is anomalous, the processing engine 112 may determine that the at least a portion of the at least two real values is anomalous. For another example, if two of the first comparison result, the second comparison result, and the third comparison result include a determination that the at least a portion of the at least two real values are anomalous, the processing engine 112 may determine that the at least a portion of the at least two real values are anomalous. For another example, if each of the first comparison result, the second comparison result, and the third comparison result includes a determination that the at least a portion of the at least two real values is anomalous, the processing engine 112 may determine that the at least a portion of the at least two real values is anomalous. The processing engine 112 may ignore the at least a portion of the at least two real values from the at least two real values.

It should be noted that the above flow regarding determining the at least part of the at least two real values to be anomalous is provided for illustrative purposes and should not be taken as the only embodiment. It will be clear to a person skilled in the art, after understanding the general principles of a procedure for determining that at least part of said at least two real values are anomalous, that the forms or details and the steps of the specific practical modes may be modified or changed and further simple deductions or substitutions may be made without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps. In some embodiments, 506 and 508 may be combined into one operation.

Fig. 6 is a flow diagram illustrating an exemplary flow 600 for determining at least two predicted values according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the flow 600 to determine the at least two predictors. One or more operations of the flow 600 for determining the at least two predicted values shown in fig. 6 may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the process 600 shown in fig. 6 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

In 602, the processing engine 112 (e.g., the prediction module 406) may determine that the category is related to periodicity. For example, the category may be one of a periodic growth period, a periodic settling period, and a periodic fading period. The category associated with periodicity may indicate that the at least two historical data values are periodic.

At 604, the processing engine 112 (e.g., the prediction module 406) may determine statistical parameters related to the at least two historical data values based on the category. The processing engine 112 may analyze the at least two historical data values using a time series method. The time series method may include one or a combination of several of a moving average model, an autoregressive moving average model, and an exponential smoothing model. The exponential smoothing model can comprise one or more of a basic exponential smoothing model, a double-exponential smoothing model, a three-exponential smoothing model and the like.

In some embodiments, the processing engine 112 may determine the statistical parameter based on the exponential smoothing model (e.g., a triple exponential smoothing model). The statistical parameters may include a residual function, a trend function, and a seasonal function. The residual function, the trend function, and the seasonal function may all be functions of time.

At 606, the processing engine 112 (e.g., the prediction module 406) may generate a prediction model based on the statistical parameters. In some embodiments, the processing engine 112 may determine the predictive model based on the residual function, the trend function, and the seasonal function. For example, the predictive model may be represented by equation (1):

p_t+h＝a(t)+h·b(t)+s[t-k+1+(h-1)modk](1)

where a (t) may represent the residual function, b (t) may represent the trend function, s (t) may represent the seasonal function, p_t+hThe predicted value may be represented, t may represent a current time point, and h may represent a time from the current time point t to the predicted value p_t+hThe time interval of the associated time points, k, may represent the period associated with the at least two historical data values, and "mod" may represent a modulo operation.

In 608, the processing engine 112 (e.g., the prediction module 406) may determine the at least two predicted values based on the predictive model. The processing engine 112 may obtain a point in time associated with the at least two predictors. The processing engine 112 may determine the at least two predictors using equation (1) based on a point in time associated with the at least two predictors.

It should be noted that the above flow regarding determining the at least two predicted values is provided for illustrative purposes and should not be taken as the only embodiment. It will be clear to a person skilled in the art, after understanding the general principles of the procedure for determining the at least two predictors, that the forms or details and the steps of the specific practical implementation may be modified or changed, and further that simple deductions or substitutions may be made, or that modifications or combinations of certain steps may be made without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps.

FIG. 7 is a flow diagram illustrating an exemplary process 700 for determining that the at least a portion of the at least two real values are anomalous according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the flow 700 to determine that the at least a portion of the at least two real values are anomalous. The processing engine 112 may determine the first comparison result based on the discrete filter by executing the flow 700. One or more operations of the flow 700 shown in fig. 7 for determining that the at least a portion of the at least two real values is anomalous may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the process 700 shown in fig. 7 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

At 702, the processing engine 112 (e.g., the comparison module 408) may determine a statistical value based on the at least two predicted values and the at least two true values. The processing engine 112 may determine the at least two predicted values and the at least two real values as a sequence of samples, respectively. The processing engine 112 may perform a pair t test on the two sample sequences. The processing engine 112 may then determine the statistical value from the paired t-tests. The statistical value may be related to a degree of dispersion of the at least two predicted values and the at least two actual values.

In 704, the processing engine 112 (e.g., the comparison module 408) may compare the statistical value to a first threshold to generate the first comparison result. The first threshold may be a predetermined value set in the system. The first threshold may be adjusted based on real-time conditions. In some embodiments, the first threshold may be any value, including 0.5, 0.7, 1, and so forth. The processing engine 112 may compare the statistical value to the first threshold. The processing engine 112 may then determine whether the statistic is greater than a first threshold.

At 706, in response to the first comparison result, i.e., the statistical value is greater than a first threshold value, the processing engine 112 (e.g., the comparison module 408) may determine that the at least a portion of the at least two real values is abnormal. If the processing engine 112 determines that the statistical value is less than the first threshold, the processing engine 112 may determine that the at least two true values are normal. If the processing engine 112 determines that the statistical value is greater than the first threshold value, the processing engine 112 may determine that the at least a portion of the at least two real values are anomalous. The first comparison result may indicate that the at least a portion of the at least two real values are abnormal. The processing engine 112 may omit the at least a portion of the at least two real values from the at least two real values.

FIG. 8 is a flow diagram illustrating an exemplary process 800 for determining that the at least a portion of the at least two real values are anomalous according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the flow 800 to determine that the at least a portion of the at least two real values are anomalous. The processing engine 112 may determine the second comparison result by executing the process 800. One or more operations of the flow 800 for determining that the at least a portion of the at least two real values is anomalous, shown in FIG. 8, may be implemented in the online-to-offline service system 100 shown in FIG. 1. For example, the process 800 shown in fig. 8 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

In 802, the processing engine 112 (e.g., the comparison module 408) may use the threshold filter to determine at least two differences between the at least two predicted values and the at least two true values. For each difference value, the predicted value and the corresponding true value may be associated with the same point in time. For each of at least a portion of the at least two predicted values, the processing engine 112 may determine a difference value based on the predicted value and the corresponding true value.

In 804, the processing engine 112 (e.g., the comparison module 408) may determine at least two second thresholds based on a function of time. The processing engine 112 may determine the function of time from the category into which the at least two historical data values are classified as a sequence. The processing engine 112 may determine the at least two second thresholds based on the function of time. For each of the at least a portion of the at least two first points in time and/or the at least two second points in time, the processing engine 112 may determine a second threshold based on the point in time and the function of time. Accordingly, the processing engine 112 may determine the at least two second thresholds.

At 806, the processing engine 112 (e.g., the comparison module 408) may compare each of the at least two difference values to a corresponding second threshold. For a point in time, the processing engine 112 may determine a difference value and a corresponding second threshold. For each of at least a portion of the first and/or second points in time, the processing engine 112 may determine whether the difference associated with that point in time is greater than a corresponding second threshold.

At 808, in response to the comparison result being that each of the at least two difference values is greater than the corresponding second threshold, the processing engine 112 (e.g., the comparison module 408) may determine that the at least a portion of the at least two real values is abnormal. If the processing engine 112 determines that a portion of the at least two difference values are less than the corresponding second threshold values, respectively, the processing engine 112 may determine that the at least two true values are normal. If the processing engine 112 determines that each of the at least two difference values is greater than the corresponding second threshold, the processing engine 112 may determine that the at least a portion of the at least two real values are anomalous. The second comparison result may indicate that the at least a portion of the at least two real values are abnormal. The processing engine 112 may omit the at least a portion of the at least two real values from the at least two real values.

It should be noted that the above flow regarding determining the at least part of the at least two real values to be anomalous is provided for illustrative purposes and should not be taken as the only embodiment. It will be clear to a person skilled in the art, after understanding the general principles of a procedure for determining that at least part of said at least two real values are anomalous, that the forms or details and the steps of the specific practical modes may be modified or changed and further simple deductions or substitutions may be made without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps.

Fig. 9 is a table 900 shown relating to at least two service lines according to some embodiments of the present application. Four service line IDs 902 may be shown in table 900. For the line of service ID 902, the processing engine 112 may retrieve at least two historical data values. The processing engine 112 may analyze the at least two historical data values and extract four features from the at least two historical data values. The four features may include a first feature 904 (e.g., age of development), a second feature 906 (e.g., volume of traffic), a third feature 908 (e.g., running water of traffic), and a fourth feature 910 (e.g., profit). The processing engine 112 may also determine values for the first feature 904, the second feature 906, the third feature 908, and the fourth feature 910.

For each service line ID 902, the processing engine 112 may use the service line ID 902 and the values of the four features as inputs to a classifier. The processing engine 112 may determine the class to which the line of service ID is assigned based on the classifier. Thus, the at least two historical data values associated with the service ID are classified into the category. Four categories (a first category 912, a second category 914, a third category 916, and a fourth category 918) are shown in table 910. Each of the four categories may be associated with two sets of cartesian products as described in step 504.

In some embodiments, the value of the category to which the service line ID is classified may be set to 1, and the value of the other categories to which the service line ID is not classified may be set to 0. As shown in table 900, the service line ID 1 is classified into a first class. The service line ID 2 is classified into a second class. The service line ID 3 is classified into a third class. The service line ID 4 is classified into a fourth class.

For each line of business ID, the processing engine 112 may update the training set associated with the classifier using the values of the four features and the class to which the line of business ID is assigned. The classifier may be updated based on the updated training set associated with the classifier.

It should be noted that the above description of tables is provided for illustrative purposes and should not be taken as the only embodiment. It will be clear to a person skilled in the art, after understanding the general principles of a procedure for determining that at least part of said at least two real values are anomalous, that the forms or details and the steps of the specific practical modes may be modified or changed and further simple deductions or substitutions may be made without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. For example, the characteristic number of each service line ID may be any other value than 4. The value of the class of the service line ID classification may be any other value than 0. The number of categories displayed in the table 900 may be any other value than 4.

Having thus described the basic concepts, it will be apparent to those of ordinary skill in the art having read this application that the foregoing disclosure is to be construed as illustrative only and is not limiting of the application. Various modifications, improvements and adaptations to the present application may occur to those skilled in the art, although not explicitly described herein. Such alterations, modifications, and improvements are intended to be suggested herein and are intended to be within the spirit and scope of the exemplary embodiments of the present application.

Also, this application uses specific terminology to describe embodiments of the application. Reference throughout this specification to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the present application is included in at least one embodiment of the present application. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment," "one embodiment," or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, certain features, structures, or characteristics of one or more embodiments of the application may be combined as appropriate.

Further, those skilled in the art will recognize that aspects of the present application may be illustrated and described in terms of several patentable species or contexts, including any new and useful process, machine, product, or material combination, or any new and useful improvement thereon. Accordingly, embodiments of the present application may be embodied in pure hardware or in pure software, including but not limited to operating systems, resident software, microcode, etc.; but may also be embodied in "systems," "modules," "sub-modules," "units," etc., which may contain both hardware and software. Furthermore, aspects of the present application may be embodied as a computer product comprising computer readable program code embodied in one or more computer readable media.

A computer readable signal medium may comprise a propagated data signal with computer program code embodied therein, for example, on baseband or as part of a carrier wave. The propagated signal may take any of a variety of forms, including electromagnetic, optical, etc., or any suitable combination. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code on a computer readable signal medium may be propagated over any suitable medium, including radio, electrical cable, fiber optic cable, RF, or the like, or any combination of the preceding.

Computer program code required for operation of aspects of the present application may be written in any combination of one or more programming languages, including object oriented programming, such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C + +, C #, VB.NET, Python, or similar conventional programming languages, such as the "C" programming language, Visual Basic, Fortran1703, Perl, COBOL 1702, PHP, ABAP, dynamic programming languages, such as Python, Ruby, and Groovy, or other programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any network format, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or in a cloud computing environment, or as a service, such as a software as a service (SaaS).

Additionally, the order in which elements and sequences of the processes described herein are processed, the use of alphanumeric characters, or the use of other designations, is not intended to limit the order of the processes and methods described herein, unless explicitly claimed. While various presently contemplated embodiments of the invention have been discussed in the foregoing disclosure by way of example, it is to be understood that such detail is solely for that purpose and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements that are within the spirit and scope of the embodiments herein. For example, although the system components described above may be implemented by hardware means, they may also be implemented by software-only solutions, such as installing the described system on an existing server or mobile device.

Similarly, it should be noted that in the preceding description of embodiments of the present application, various features are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the embodiments. This method of disclosure, however, is not intended to imply that more features are required than are expressly recited in the claims. Indeed, claimed subject matter may lie in less than all features of a single foregoing disclosed embodiment.

Claims

1. A data storage anomaly detection system comprising:

a storage device storing a set of instructions; and

one or more processors in communication with the storage device, wherein the one or more processors are configured to, when executing the set of instructions, cause the system to:

obtaining at least two historical data values related to a service over a network;

determining a category associated with the at least two historical data values;

determining at least two predicted values related to the service based on a prediction model related to the category, each predicted value corresponding to a point in time;

obtaining, over a network, at least two real values corresponding to the at least two predicted values associated with the service;

comparing, using at least one filter, the at least two real values with the at least two predicted values to produce a comparison result; and

determining, based on the comparison, that at least a portion of the at least two real values are anomalous.

2. The system of claim 1, wherein the at least two historical data values form a time series.

3. The system of any of claims 1 or 2, wherein, to determine the category associated with the at least two historical data values, the one or more processors are further configured to cause the system to:

determining at least two feature values related to the at least two historical data values; and

determining the category associated with the at least two historical data values based on the at least two feature values.

4. The system of any of claims 1-3, wherein the categories represent characteristics related to the service, the categories including a growth period with periodicity, a stationary period with periodicity, a decay period with periodicity, a growth period with non-periodicity, a stationary period with non-periodicity, or a decay period with non-periodicity.

5. The system of claim 4, wherein, based on the predictive model associated with the category, to determine the at least two predictive values associated with the service; the one or more processors are further configured to cause the system to:

determining that the category indicative of the characteristic related to the service is related to periodicity;

determining a residual function, a trend function, and a seasonal function associated with the at least two historical data values based on the periodicity-related category;

generating the predictive model based on the residual function, the trend function, and the seasonal function; and

determining the at least two predicted values based on the prediction model.

6. The system of any of claims 1-5, wherein to obtain the at least two real values associated with the service that correspond to the at least two predicted values, the one or more processors are further configured to cause the system to:

obtaining a point in time associated with at least a portion of the at least two predictors; and

obtaining the at least two real values based on the time point associated with at least a portion of the at least two predicted values.

7. The system of any of claims 1 to 6, wherein the at least one filter comprises a discrete filter, based on the comparison, to determine that the at least a portion of the at least two real values are anomalous, the one or more processors are further configured to cause the system to:

determining, using the dispersion filter, a statistical value based on the at least two predicted values and the at least two true values, the statistical value being related to a degree of dispersion of the at least two predicted values and the at least two true values;

comparing the statistical value with a first threshold value; and

determining that the at least a portion of the at least two real values are anomalous in response to a comparison result that the statistical value is greater than the first threshold.

8. The system of any of claims 1 to 7, wherein the at least one filter comprises a threshold filter, and based on the comparison, to determine that the at least a portion of the at least two real values are anomalous, the one or more processors are further configured to cause the system to:

determining, using the threshold filter, at least two differences between the at least two predicted values and the at least two true values;

determining at least two second thresholds based on a time function;

comparing each of the at least two difference values with its corresponding second threshold value, each of the at least two difference values and the corresponding second threshold value being associated with a same point in time; and

determining that the at least a portion of the at least two real values are anomalous in response to a comparison of each of the at least two difference values being greater than a second threshold value corresponding thereto.

9. The system of any of claims 1-8, wherein the at least one filter comprises a false alarm filter, based on the comparison result, to determine that the at least a portion of the at least two real values are anomalous, the one or more processors are further configured to cause the system to:

determining a false alarm model based on a pre-tagged data set associated with service data, the pre-tagged data set including at least two false alarm results generated by the system; and

determining, based on the false alarm model, that the at least a portion of the at least two real values are anomalous.

10. The system of any one of claims 1-9, wherein the one or more processors are further configured to cause the system to:

comparing the at least two real values with the at least two predicted values using a discrete filter, a threshold filter, and a false alarm filter to produce a first comparison result, a second comparison result, and a third comparison result, respectively; and

determining that at least a portion of the at least two real values are abnormal based on the first comparison result, the second comparison result, and the third comparison result.

11. A method implemented on a computing device for anomaly detection in a data store, the computing device including at least one processor, a memory, and a communication platform connected to a network, the method comprising:

determining a category associated with the at least two historical data values;

12. The method of claim 11, wherein the at least two historical data values form a time series.

13. The method of any of claims 11 or 12, wherein determining the category associated with the at least two historical data values comprises:

14. The method according to any of claims 11-13, wherein the categories represent characteristics related to the service, the categories comprising a growth period with periodicity, a stationary period with periodicity, a decay period with periodicity, a growth period with non-periodicity, a stationary period with non-periodicity, or a decay period with non-periodicity.

15. The method of claim 14, wherein determining the at least two predictive values related to the service based on the predictive model related to the category comprises:

determining the at least two predicted values based on the prediction model.

16. The method according to any of claims 11-15, wherein obtaining the at least two real values corresponding to the at least two predicted values related to the service comprises: obtaining a point in time associated with at least a portion of the at least two predictors; and obtaining the at least two real values based on the time point related to at least one part of the at least two predicted values.

17. The method of any of claims 11 to 16, wherein the at least one filter comprises a discrete filter, and determining that the at least a portion of the at least two real values are anomalous based on the comparison comprises:

comparing the statistical value with a first threshold value; and

18. The method of any of claims 11-17, wherein the at least one filter comprises a threshold filter, and determining that the at least a portion of the at least two real values are anomalous based on the comparison comprises:

determining at least two second thresholds based on a time function;

19. The method of any of claims 11-18, wherein the at least one filter comprises a false alarm filter, and determining that the at least a portion of the at least two real values are anomalous based on the comparison comprises:

20. The method according to any one of claims 11-19, further comprising:

21. A non-transitory computer readable medium comprising at least one set of instructions for data storage anomaly detection, wherein the at least one set of instructions, when executed by at least one processor, instructs the at least one processor to:

determining a category associated with the at least two historical data values;