CN110945484B

CN110945484B - System and method for anomaly detection in data storage

Info

Publication number: CN110945484B
Application number: CN201880001318.8A
Authority: CN
Inventors: 甘祖毓; 叶舟; 王瑜
Original assignee: Beijing Didi Infinity Technology and Development Co Ltd
Current assignee: Beijing Didi Infinity Technology and Development Co Ltd
Priority date: 2018-06-08
Filing date: 2018-06-08
Publication date: 2024-01-19
Anticipated expiration: 2038-06-08
Also published as: CN110945484A; WO2019232773A1

Abstract

A system includes a storage device storing a set of instructions and at least one processor in communication with the storage device. The at least one processor, when executing the instructions, is configured to cause the system to obtain at least two historical data values and determine a category associated with the at least two historical data values. The at least one processor is further configured to cause the system to determine at least two predicted values based on the category and to obtain at least two actual values associated with the service that correspond to the at least two predicted values. The at least one processor further causes the system to compare the at least two real values with the at least two predicted values using at least one filter to produce a comparison result, and determine that at least a portion of the at least two real values are outliers based on the comparison result.

Description

System and method for anomaly detection in data storage

Technical Field

The present invention relates to a system and method for data storage management, and in particular, to a method and system for detecting anomalies in data storage.

Background

With the explosive growth of various service lines from online to offline service systems, the amount of service data may increase explosively. The data warehouse may be used to store service data. Anomaly detection is directed to finding data from service data that is different from expected data.

Since service data can reflect business conditions within a certain time, authenticity of the service data in a data warehouse must be ensured, and abnormal fluctuation of the service data needs to be timely reminded. Current techniques typically rely on database management or continuous iterative modification of the experience of the database management system, resulting in response delays to abnormal fluctuations. There is a need for a method and system to improve anomaly detection.

Disclosure of Invention

According to one aspect of the application, a system may include a storage device storing a set of instructions; and one or more processors in communication with the storage device. The one or more processors are configured, when executing the set of instructions, to cause the system to obtain, over a network, at least two historical data values associated with a service and a category associated with the at least two historical data values. The one or more processors may cause the system to determine at least two predicted values associated with the service based on a predictive model associated with the category and obtain at least two real values associated with the service over a network that correspond to the at least two predicted values. In some embodiments, each predictor corresponds to a point in time. Further, the one or more processors may cause the system to compare the at least two true values to the at least two predicted values using at least one filter to produce a comparison result; and determining that at least a portion of the at least two real values are outliers based on the comparison result.

In some embodiments, the at least two historical data values form a time series.

In some embodiments, the one or more processors are further configured to cause the system to determine at least two characteristic values associated with the at least two historical data values and determine the category associated with the at least two historical data values based on the at least two characteristic values.

In some embodiments, the class represents a characteristic associated with the service, the class comprising a growth period having periodicity, a stationary period having periodicity, a decay period having periodicity, a growth period having non-periodicity, a stationary period having non-periodicity, or a decay period having non-periodicity.

In some embodiments, the one or more processors are further configured to cause the system to determine that the category indicative of the characteristic related to the service is related to periodicity, and determine a residual function, a trend function, and a seasonal function related to the at least two historical data values based on the category related to periodicity. The one or more processors are further configured to cause the system to generate the predictive model based on the residual function, the trend function, and the seasonal function; and determining the at least two predicted values based on the predictive model.

In some embodiments, the one or more processors are further configured to cause the system to obtain a point in time associated with at least a portion of the at least two predicted values and to obtain the at least two real values based on the point in time associated with at least a portion of the at least two predicted values.

In some embodiments, the at least one filter comprises a discrete filter. The one or more processors are further configured to cause the system to determine a statistical value based on the at least two predicted values and the at least two actual values using the discrete filter and compare the statistical value to a first threshold. In some embodiments, the statistical value is related to a degree of discretization of the at least two predicted values and the at least two actual values. The one or more processors are further configured to cause the system to determine that the at least a portion of the at least two real values are outliers in response to a comparison of the statistical value being greater than the first threshold.

In some embodiments, the at least one filter comprises a threshold filter. The one or more processors are further configured to cause the system to determine at least two differences between the at least two predicted values and the at least two actual values using the threshold filter and to determine at least two second thresholds based on a function of time. The one or more processors are further configured to cause the system to compare each of the at least two differences with its corresponding second threshold. The one or more processors are further configured to determine that the at least a portion of the at least two real values are outliers in response to a comparison that each of the at least two differences is greater than a second threshold corresponding thereto. In some embodiments, each of the at least two differences and the second threshold corresponding thereto are associated with the same point in time.

In some embodiments, the at least one filter comprises a false alarm filter. The one or more processors are further configured to cause the system to determine a false alarm model based on a pre-labeled data set associated with service data, and determine that the at least a portion of the at least two real values are anomalous based on the false alarm model. In some embodiments, the pre-labeled data set includes at least two false alarm results generated by the system.

In some embodiments, the one or more processors are further configured to cause the system to compare the at least two real values to the at least two predicted values using a discrete filter, a threshold filter, and a false alarm filter to produce a first comparison result, a second comparison result, and a third comparison result, respectively. The one or more processors are further configured to cause the system to determine that at least a portion of the at least two real values are outliers based on the first comparison result, the second comparison result, and the third comparison result.

According to another aspect of the application, a method implemented on a computing device may include one or more of the following operations performed by one or more processors. The method includes obtaining at least two historical data values associated with a service over a network and determining a category associated with the at least two historical data values. The method includes determining at least two predicted values associated with the service based on a predictive model associated with the category and obtaining at least two real values associated with the service over a network that correspond to the at least two predicted values. In some embodiments, each predictor corresponds to a point in time. The method includes comparing the at least two real values with the at least two predicted values using at least one filter to produce a comparison result and determining that at least a portion of the at least two real values are outliers based on the comparison result.

In some embodiments, the method may further include determining at least two eigenvalues related to the at least two historical data values and determining a category related to the at least two historical data values based on the at least two eigenvalues.

In some embodiments, the method may further comprise determining that the category indicative of the characteristic associated with the service is associated with periodicity, and determining a residual function, a trend function, and a seasonal function associated with the at least two historical data values based on the category associated with periodicity. The method further includes generating the predictive model based on the residual function, the trend function, and the seasonal function; and determining the at least two predicted values based on the predictive model.

In some embodiments, the method may further comprise obtaining a point in time associated with at least a portion of the at least two predicted values, and obtaining the at least two real values based on the point in time associated with at least a portion of the at least two predicted values.

In some embodiments, the at least one filter comprises a discrete filter. The method may further include determining a statistical value based on the at least two predicted values and the at least two actual values using the discrete filter, and comparing the statistical value to a first threshold. In some embodiments, the statistical value is related to a degree of discretization of the at least two predicted values and the at least two actual values. The method may further include determining that the at least a portion of the at least two true values are outliers in response to a comparison that the statistical value is greater than the first threshold.

In some embodiments, the at least one filter comprises a threshold filter. The method may further include determining at least two differences between the at least two predicted values and the at least two actual values using the threshold filter and determining at least two second thresholds based on a function of time. The method further includes comparing each of the at least two differences with its corresponding second threshold and determining that the at least a portion of the at least two real values are outliers in response to a comparison that each of the at least two differences is greater than its corresponding second threshold. In some embodiments, each of the at least two differences and the second threshold corresponding thereto are associated with the same point in time.

In some embodiments, the at least one filter comprises a false alarm filter. The method may further include determining a false alarm model based on a pre-labeled data set associated with the service data, and determining that the at least a portion of the at least two true values are anomalous based on the false alarm model. In some embodiments, the pre-labeled data set includes at least two false alarm results generated by the system.

In some embodiments, the method includes comparing the at least two real values to the at least two predicted values to produce a first comparison result, a second comparison result, and a third comparison result, respectively, also using a discrete filter, a threshold filter, and a false alarm filter. The method further includes determining that at least a portion of the at least two true values are outliers based on the first comparison result, the second comparison result, and the third comparison result.

According to yet another aspect of the present application, a non-transitory computer readable medium may store a set of instructions. The set of instructions, when executed by one or more processors of a system, may cause the system to obtain at least two historical data values associated with a service over a network and determine a category associated with the at least two historical data values. The set of instructions may cause the system to determine at least two predicted values associated with the service based on a predictive model associated with the category, and obtain at least two real values associated with the service corresponding to the at least two predicted values over a network. In some embodiments, each predictor corresponds to a point in time. The set of instructions may further cause the system to use at least one filter to compare the at least two real values with the at least two predicted values to produce a comparison result, and determine that at least a portion of the at least two real values are outliers based on the comparison result

Additional features of the present application will be set forth in part in the description which follows. Additional features will be set forth in part in the description which follows and in the accompanying drawings, or in part will be apparent to those skilled in the art from the description, or may be learned by the production or operation of the embodiments. The features of the present disclosure may be implemented and realized in the practice or use of the methods, instrumentalities and combinations of various aspects of the specific embodiments described below.

Drawings

The present application will be further described in connection with exemplary embodiments. These exemplary embodiments will be described in detail with reference to the drawings. These embodiments are non-limiting exemplary embodiments, like numbers denote like structures in the embodiments illustrating the various views, and wherein:

FIG. 1 is a schematic diagram of an exemplary online-to-offline service system shown in accordance with some embodiments of the present application;

FIG. 2 is a schematic diagram of exemplary hardware and software components of a computing device shown in accordance with some embodiments of the application;

FIG. 3 is a schematic diagram of exemplary hardware and software components of a mobile device shown in accordance with some embodiments of the application;

FIG. 4 is a block diagram of an exemplary processing engine shown in accordance with some embodiments of the present application;

FIG. 5 is a flow chart of an exemplary process for determining that at least a portion of at least two real values are outliers based on a comparison result, according to some embodiments of the present application;

FIG. 6 is a flow chart illustrating an exemplary process for determining at least two predicted values according to some embodiments of the present application;

FIG. 7 is a flow chart of an exemplary process for determining that the at least a portion of the at least two real values are outliers shown in accordance with some embodiments of the present application;

FIG. 8 is a flow chart of an exemplary process for determining that the at least a portion of the at least two real values are outliers shown in accordance with some embodiments of the present application; and

fig. 9 is a table associated with at least two business lines, shown in accordance with some embodiments of the present application.

Detailed Description

The following description is presented to enable one of ordinary skill in the art to make and use the application and is provided in the context of a particular application and its requirements. Various modifications to the embodiments disclosed herein will be readily apparent to those skilled in the art, and the generic terms defined herein may be applied to other embodiments and applications without departing from the spirit or scope of the application. Thus, the present application is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the scope of the present application. As used in this application and in the claims, the terms "a," "an," "the," and/or "the" are not specific to a singular, but may include a plurality, unless the context clearly dictates otherwise. It will be understood that the terms "comprises" and "comprising," when used in this application, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

The functions and economical constructions of the features, methods of operation, related components described herein and others will be apparent from the description of the drawings that follows, all of which form a part of this specification. It is to be understood, however, that the drawings are designed solely for the purposes of illustration and description and are not intended to limit the scope of the application. It should be understood that the figures are not to scale.

Flowcharts are used in this application to describe the operations performed by systems according to embodiments of the present application. It should be expressly understood that the operations in the flowcharts may be performed out of order. Rather, the various steps may be processed in reverse order or simultaneously. Also, one or more other operations may be added to the flow chart. One or more operations may also be deleted from the flowchart.

Furthermore, while the system and method of the present application have been described primarily with respect to distributing transportation service requests, it should be understood that this is but one exemplary embodiment. The system or method of the present application may also be applied to other types of online-to-offline services. For example, the systems and methods of the present application may also be applied to systems including land, marine, aerospace, and the like, or any combination thereof. The vehicles used in the transportation system may include taxis, private cars, windmills, buses, trains, bullet trains, high speed railways, subways, watercraft, aircraft, spacecraft, hot air balloons, unmanned vehicles, and the like, or any combination thereof. The transport system may also include any transport system for administration and/or distribution, such as a system for transmitting and/or receiving courier. The application scene of the different embodiments of the application can comprise one or a combination of a plurality of web pages, browser plug-ins, clients, customization systems, enterprise internal analysis systems, artificial intelligent robots and the like.

In this application, the terms "passenger," "requestor," "service requestor," and "customer" may be used interchangeably to refer to an individual, entity, or tool that may request or subscribe to a service. In this application, the terms "driver," "provider," and "service provider" are also used interchangeably to refer to an individual, entity, or tool that may provide or facilitate the provision of a service.

In this application, the terms "service request" and "order" may be used interchangeably to refer to a request initiated by a passenger, requester, service requester, customer, driver, provider, service provider, etc., or any combination of the foregoing examples. The service request may be accepted by any one of a passenger, a service requester, a customer, a driver, a provider, and a service provider. The service request may be either fee-based or free.

The terms "service provider terminal" and "driver terminal" in this application may be used interchangeably to refer to a mobile terminal used by a service provider for providing a service or facilitating the provision of a service. The terms "service requester terminal" and "passenger terminal" in this application may be used interchangeably to refer to a mobile terminal used by a service requester for requesting or subscribing to a service.

The positioning techniques used in this application may be based on the Global Positioning System (GPS), the global navigation satellite system (GLONASS), the COMPASS navigation system (COMPASS), the galileo positioning system, the Quasi Zenith Satellite System (QZSS), the wireless fidelity (WiFi) positioning techniques, or the like, or any combination thereof. One or more of the above positioning techniques may be used interchangeably in this application.

One aspect of the present application relates to an online system and method of data storage management. At least two historical data values associated with a service may be obtained. A category associated with the at least two historical data values may be determined. A predictive model associated with the category may be determined. At least two predictive values associated with the service may be determined based on a predictive model. At least two true values corresponding to the at least two predicted values may be obtained. The at least two real values and the at least two predicted values may be compared based on at least one filter and a comparison result may be generated. At least a portion of the at least two true values is determined to be abnormal based on the comparison result. The present application generates an anomaly alarm system based on the functions of the classifier, predictor, and comparator, and a machine learning algorithm. Based on the category of the service data, the system may obtain one or more parameters based on the offline historical service data values. Further, the one or more parameters may be applied to an online predictor and comparator for detecting anomalies in real-time service data. The method and the device improve the abnormality alarming capability in data storage management.

Fig. 1 is a block diagram of an exemplary online-to-offline service system 100, shown in accordance with some embodiments. For example, the online-to-offline service system 100 may be an online transportation service platform that provides transportation services. The online-to-offline service system 100 may include a server 110, a network 120, a service requester terminal 130, a service provider terminal 140, a vehicle 150, a storage device 160, and a navigation system 170.

The online-to-offline service system 100 may provide a variety of services. Exemplary services may include taxi calling services, ride-on services, courier services, carpooling services, bus services, driver recruitment services, and pickup services. In some embodiments, the online-to-offline service may be any online service, such as ordering, shopping, etc., or any combination thereof.

In some embodiments, the server 110 may be a single server or a group of servers. The server farm may be centralized or distributed (e.g., server 110 may be a distributed system). In some embodiments, server 110 may be regional or remote. For example, server 110 may access information and/or data stored in service requester terminal 130, service provider terminal 140, and/or storage device 160 via network 120. As another example, server 110 may be directly connected to service requester terminal 130, service provider terminal 140, and/or storage device 160 to access stored information and/or data. In some embodiments, server 110 may be implemented on a cloud platform. For example only, the cloud platform may include a private cloud, public cloud, hybrid cloud, cell cloud, distributed cloud, cross-cloud, multi-cloud, and the like, or any combination of the above. In some embodiments, the server 110 may be implemented on a computing device 1000 having one or more of the components shown in FIG. 10 in the present invention.

In some embodiments, server 110 may include a processing engine 112. The processing engine 112 may process information and/or data related to the service request to perform one or more functions described herein. For example, the processing engine 112 may determine that at least a portion of the at least two real values are outliers. In some embodiments, processing engine 112 may include one or at least two processing engines (e.g., a single chip processing engine or a multi-chip processing engine). By way of example only, the processing engine 112 may include a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), an application specific instruction set processor (ASIP), an image processor (GPU), a physical arithmetic processing unit (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), a controller, a microcontroller unit, a Reduced Instruction Set Computer (RISC), a microprocessor, or the like, or any combination thereof.

The network 120 may facilitate the exchange of information and/or data. In some embodiments, one or more components in the online-to-offline service system 100 (e.g., the server 110, the service requester terminal 130, the service provider terminal 140, the vehicle 150, the storage device 160, and the navigation system 170) may send information and/or data over the network 120 to other components in the online-to-offline service system 100. For example, the server 110 may receive a service request from the service requester terminal 130 through the network 120. In some embodiments, network 120 may be any form of wired or wireless network, or any combination thereof. By way of example only, the network 120 may be a cable network, an optical network, a telecommunications network, an intranet, the Internet, a Local Area Network (LAN), a Wide Area Network (WAN), a Wireless Local Area Network (WLAN), a Metropolitan Area Network (MAN), a Public Switched Telephone Network (PSTN), a Bluetooth network, a ZigBee network, near Field Communication (NFC), and the like, or any combination thereof. In some embodiments, network 120 may include one or more network switching points. For example, the network 120 may include wired or wireless network switching points, such as base station and/or Internet switching points 120-1, 120-2, …, through which one or more components of the online-to-offline service system 100 may connect to the network 120 to exchange data and/or information.

In some embodiments, the passenger may be the owner of the service requester terminal 130. In some embodiments, the owner of the service requester terminal 130 may be a person other than a passenger. For example, the owner a of the service requester terminal 130 may use the service requester terminal 130 to send a service request to the passenger B or to receive services and/or information or instructions from the server 110. In some embodiments, the service provider may be a user of the service provider terminal 140. In some embodiments, the user of the service provider terminal 140 may be a person other than the service provider. For example, user C of service provider terminal 140 may use service provider terminal 140 to receive service requests for user D and/or to receive information or instructions from server 110. In some embodiments, "passenger" and "passenger terminal" may be used interchangeably, and "service provider" and "service provider terminal" may be used interchangeably. In some embodiments, the service provider terminal may be associated with one or more service providers (e.g., a night shift service provider or a white shift service provider).

In some embodiments, the requesting terminal 130 may include a mobile device 130-1, a tablet computer 130-2, a notebook computer 130-3, a vehicle-mounted device 130-4, or the like, or any combination of the above examples. In some embodiments, the mobile device 130-1 may include a smart home device, a wearable device, a smart mobile device, a virtual reality device, an augmented reality device, or the like, or any combination thereof. In some embodiments, the smart home devices may include smart lighting devices, control devices for smart appliances, smart monitoring devices, smart televisions, smart cameras, interphones, and the like, or any combination thereof. In some embodiments, the wearable device may include a smart wristband, smart footwear, smart glasses, smart helmets, smart watches, smart clothing, smart back bags, smart accessories, and the like, or any combination of the above examples. In some embodiments, the smart mobile device may include a smart phone, a Personal Digital Assistant (PDA), a gaming device, a navigation device, a point-of-sale (POS) device, or the like, or any combination thereof. In some embodiments, the virtual reality device and/or the augmented virtual reality device may include a virtual reality helmet, virtual reality glasses, virtual reality patches, augmented virtual reality helmet, augmented virtual reality glasses, augmented virtual reality patches, and the like, or any combination thereof. For example, the virtual reality device and/or the augmented reality device may include Google (TM) Glass, eye Lift, holoLens, gear VR, and the like. In some embodiments, the in-vehicle device 130-4 may include an in-vehicle computer, an in-vehicle television, or the like. In some embodiments, service requester terminal 130 may be a device having location technology for locating the position of the passenger and/or service requester terminal 130.

The service provider terminal 140 may include at least two service provider terminals 140-1, 140-2, … …, 140-n. In some embodiments, service provider terminal 140 may be a similar or identical device as service requester terminal 130. In some embodiments, the service provider terminal 140 may be customized to enable the online-to-offline transport service. In some embodiments, the service providing terminal 140 may be a device with positioning technology that may be used to locate the location of the service provider, the service provider terminal 140, and/or the vehicle 150 associated with the service provider terminal. In some embodiments, service requester terminal 130 and/or service provider terminal 140 may communicate with other positioning devices to determine the location of the passenger, service requester terminal 130, service provider, and/or service provider terminal 140. In some embodiments, the service requester terminal 130 and/or the service provider terminal 140 may periodically send the positioning information to the server 110. In some embodiments, the service provider terminal 140 may also periodically send the available status to the server 110. The availability status may indicate whether the vehicle 150 associated with the service provider terminal 140 may pick up a passenger. For example, the service requester terminal 130 and/or the service provider terminal 140 may transmit the location information and the available status to the server 110 every 30 minutes. As another example, the service requester terminal 130 and/or the service provider terminal 140 may send the location information and the availability status to the server 110 each time the user logs in to a mobile application associated with an online-to-offline transportation service system.

In some embodiments, the service providing terminal 140 may correspond to one or more vehicles 150. The vehicle 150 may pick up passengers and send to a destination. The vehicle 150 may include at least two vehicles 150-1, 150-2, … …, 150-n. One vehicle may correspond to one type of service (e.g., a taxi calling service, a ride service, an express service, a carpool service, a bus service, a driver recruitment service, and a pickup service).

Storage device 160 may store data and/or instructions. In some embodiments, the storage device 160 may store data obtained from the service requester terminal 130 and/or the service provider terminal 140. In some embodiments, storage device 160 may store data and/or instructions used by server 110 to perform or use the exemplary methods described herein. In some embodiments, storage device 160 may comprise mass storage, removable storage, volatile read-write memory, read-only memory (ROM), and the like, or any combination thereof. Exemplary mass storage devices may include magnetic disks, optical disks, floppy disks, solid state drives, and the like. Exemplary removable memory can include flash drives, floppy disks, optical disks, memory cards, compact disks, magnetic tape, and the like. Exemplary random access memories may include Dynamic Random Access Memory (DRAM), double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), static Random Access Memory (SRAM), silicon controlled random access memory (T-RAM), zero capacitance memory (Z-RAM), and the like. Exemplary read-only memory may include masked read-only memory (MROM), programmable read-only memory (PROM), erasable programmable read-only memory (perpom), electrically erasable programmable read-only memory (EEPROM), compact hard disk read-only memory (CD-ROM), digital versatile disk read-only memory, and the like, in some embodiments, storage device 160 may be implemented on a cloud platform. For example only, the cloud platform may include one or a similar or any combination of private cloud, public cloud, hybrid cloud, cell cloud, dispersed cloud, internal cloud, multiple cloud, and the like.

In some embodiments, storage 160 may be connected with network 120 to communicate with one or more components of online-to-offline service system 100 (e.g., server 110, service requester terminal 130, service provider terminal 140, etc.). One or more components of the online-to-offline service system 100 may access data or instructions stored in the storage device 160 through the network 120. In some embodiments, the storage device 160 may be directly connected or in communication with one or more components of the online-to-offline service system 100 (e.g., the server 110, the service requester terminal 130, the service provider terminal 140, etc.). In some embodiments, storage device 160 may be part of server 110.

The navigation system 170 may determine information related to the object, such as one or more service requester terminals 130, service provider terminals 140, vehicles 150, etc. In some embodiments, the navigation system 170 may be a Global Positioning System (GPS), a Global navigation satellite System (GLONASS), a COMPASS navigation system (COMPASS), a Beidou navigation satellite system, a Galileo positioning system, a quasi-zenith satellite system (QZSS), or the like. The information may include a position, altitude, speed, acceleration, or current time of the object. The navigation system 170 may include one or more satellites, such as satellite 170-1, satellite 170-2, and satellite 170-3. Satellites 170-1 through 170-3 may independently or collectively determine the information described above. The satellite navigation system 170 may transmit the above information to the network 120, the service requester terminal 130, the service provider terminal 140, or the vehicle 150 through a wireless connection.

In some embodiments, one or more components of the online-to-offline service system 100 (e.g., the server 110, the service requester terminal 130, the service provider terminal 140, etc.) may have access to the storage device 160. In some embodiments, one or more components of the online-to-offline service system 100 may read and/or modify information related to passengers, service providers, and/or the public when one or more conditions are met. For example, after a service is completed, server 110 may read and/or modify information of one or more passengers. For another example, after a service is completed, server 110 may read and/or modify information for one or more service providers.

In some embodiments, the exchange of information of one or more components of the online-to-offline service system 100 may be accomplished by requesting a service. The object of the service request may be any product. In some embodiments, the product may include food, medicine, merchandise, chemical products, appliances, clothing, cars, houses, luxury goods, etc., or any combination of the foregoing examples. In some embodiments, the product may include a service product, a financial product, a knowledge product, an internet product, or the like, or any combination of the above examples. The internet product may include a personal host product, a web site product, a mobile internet product, a business host product, an embedded product, or the like, or any combination of the above examples. The mobile internet product may be used in software, programs, systems, etc. of a mobile terminal or the like or any combination thereof. The mobile terminal may include a tablet computer, notebook computer, mobile phone, personal Digital Assistant (PDA), smart watch, point of sale device (POS), car computer, car television, wearable device, etc., or any combination thereof. For example, the product may be any software and/or application used on a computer or mobile phone. The software and/or applications may relate to social, shopping, transportation, entertainment, learning, investment, etc., or any combination thereof. In some embodiments, the traffic related software and/or applications may include travel software and/or applications, vehicle scheduling software and/or applications, map software and/or applications, and the like. In the vehicle scheduling software and/or applications, the vehicle may include any combination thereof, horses, dollies, rickshaw (e.g., wheelbarrows, bicycles, tricycles, etc.), automobiles (e.g., taxis, buses, private cars, etc.), trains, subways, ships, aircraft (e.g., airplanes, helicopters, space shuttles, rockets, hot air balloons, etc.).

Fig. 2 is a schematic diagram of exemplary hardware and software of a computing device 200, shown in accordance with some embodiments of the present application. Server 110, service requester terminal 130, and/or service provider terminal 140 may be implemented on computing device 200. For example, the processing engine 112 may be implemented on the computing device 200 and perform the functions of the processing engine 112 disclosed herein.

The computing device 200 may be a general purpose computer or a special purpose computer, both of which may be used to implement the online-to-offline service system disclosed herein. The computing device 200 may be used to implement any of the components of the online-to-offline services described herein. For example, the processing engine 112 may be implemented on the computing device 200 by hardware, software programs, firmware, or a combination thereof. Although only one such computer is shown, for convenience, the computer functions associated with the online-to-offline service described herein may be implemented in a distributed manner on at least two similar platforms to distribute the processing load.

For example, computing device 200 may include a communication port 250 for connection to a network to enable data communication. Computing device 200 may include a processor (e.g., processor 220) and program instructions may be executed in the form of one or more processors. An exemplary computing device can include an internal communication bus 210, various forms of program memory, and data storage including, for example, a hard disk 270 and Read Only Memory (ROM) 230 or Random Access Memory (RAM) 240 for storing a variety of data files for processing and/or transmission by the computing device. An exemplary computing device may also include program instructions stored in read-only memory 230, random access memory 240, and/or other types of non-transitory storage media that are executed by processor 220. The methods and/or processes disclosed herein may be implemented as program instructions. Computing device 200 also includes input/output components 260 for supporting input/output between the computer and other components herein. The computing device 200 may also receive programs and data via network communications.

For illustration only, only one CPU and/or processor is shown in FIG. 2. May also include at least two central processors and/or processors; the operations and/or methods described herein as being implemented by one CPU and/or processor may also be implemented by at least two CPUs and/or processors, either together or independently. For example, in this application, if the central processing unit and/or processor of computing device 200 performs steps a and B, it should be understood that steps a and B may be performed jointly or separately by two different central processing units and/or processors of computing device 200 (e.g., a first processor performing step a, a second processor performing step B, or both the first and second processors performing steps a and B).

Fig. 3 is a schematic diagram of exemplary software and/or hardware of an exemplary mobile device 300 shown in accordance with some embodiments of the present application. As shown in fig. 3, the mobile device 300 may include a communication module 310, a display 320, a Graphics Processing Unit (GPU) 330, a processor 340, an input/output interface 350, a memory 360, and a storage 390, in some embodiments, any other suitable components including, but not limited to A system bus or controller (not shown) may also be included in the mobile device 300. In some embodiments, mobile operating system 370 (e.g., iOS ^TM 、Android ^TM 、Windows Phone ^TM ) And one or more application programs 380 may be loaded from the storage 390 into the memory 360 for execution by the processor 340. The application 380 may include a browser or any other suitable application for transmitting, receiving and presenting information related to the status of the vehicle 140 (e.g., the location of the vehicle 140) or other information in the server 110. The user interaction information stream may be obtained via input/output 350 and provided to server 110 and/or other components of online-to-offline service system 100 via network 120.

FIG. 4 is a block diagram of an exemplary processing engine 112 shown in accordance with some embodiments of the present application. The processing engine 112 may include an acquisition module 402, a classification module 404, a prediction module 406, a comparison module 408, and a determination module 410. At least a portion of the processing engine 112 may be implemented on a computing device as shown in fig. 2, or a mobile device as shown in fig. 3.

The obtaining module 402 may be configured to obtain, via the network 120, at least two historical data values and at least two actual values associated with a service. The service may be associated with a traffic line of the online-to-offline service system 100. The business line may be any service provided by the online-to-offline service system 100, including but not limited to one or a combination of several of online taxi service, online car rental, advertising, internet finance, and the like. The obtaining module 402 may be further configured to obtain, via the network 120, at least two real values associated with a service and corresponding to the at least two predicted values. The at least two predicted values may be determined by the prediction module 406.

The classification module 404 may be configured to determine a category associated with the at least two historical data values. The classification module 404 may extract at least two features from the at least two historical data values. The classification module 404 may classify the at least two historical data values into the categories based on the values of the at least two features.

The prediction module 406 may be configured to determine at least two predicted values associated with the service. The prediction module 406 may determine at least two predicted values based on a prediction model associated with the category determined by the classification module 404. The at least two predicted values may be correlated in real time with at least two points in time.

The comparison module 408 may be configured to compare the at least two real values to the at least two predicted values using at least one filter to generate a comparison result. The at least one filter may include a discrete filter, a threshold filter, and a false alarm filter. In some embodiments, the comparison module 408 may compare the at least two real values to the at least two predicted values using each of the discrete filter, the threshold filter, and the false alarm filter to produce the comparison result. The comparison result may include at least one of a first comparison result, a second comparison result, and a third comparison result. The comparison module 408 may determine the first comparison result, the second comparison result, and the third comparison result using the discrete filter, the threshold filter, and the false alarm filter, respectively.

The determining module 410 may be configured to determine that at least a portion of the at least two real values are outliers based on the comparison result. Each of the first comparison result, the second comparison result, and the third comparison result may include determining that the at least a portion of the at least two true values are outliers. The determining module 410 may determine that the at least a portion of the at least two real values are outliers or one of a combination of the first comparison result, the second comparison result, and the third comparison result.

It should be noted that the above description of the processing engine 112 is for descriptive convenience only and is not intended to limit the application to the scope of the illustrated embodiments. Many variations and modifications will be apparent to those of ordinary skill in the art in light of the teachings of this disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. For example, the prediction module 406 and the determination module 410 may be integrated into a single module to perform their functions.

FIG. 5 is a flow chart of an exemplary process 500 for determining that at least a portion of the at least two real values are outliers based on a comparison result, according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the process 500 to determine that the at least a portion of the at least two real values are outliers. One or more operations of the flow 500 for determining that the at least a portion of the at least two real values are outliers shown in fig. 5 may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the flow 500 shown in fig. 5 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, such as the central processor 340 of the mobile device 300 shown in fig. 3).

In 502, the processing engine 112 (e.g., the acquisition module 402) may acquire at least two historical data values associated with a service over the network 120. The service may be associated with a traffic line of the online-to-offline service system 100. The business line may be any service provided by the online-to-offline service system 100, including but not limited to one or a combination of several of online taxi service, online car rental, advertising, internet finance, and the like.

In current applications, the service may be described in the form of an online taxi service, but should not be construed as limiting the service to only the form of an online taxi service. In some embodiments, the online taxi service may be associated with a service requester, a service provider, and a service request. The service request may include a real-time request and/or a reservation request. As used herein, a real-time request may be a request that the requestor wish to use a transport service at or reasonably near the current time of day for a specified time of day for one of ordinary skill in the art. For example, if the defined time is shorter than a threshold, such as 1 minute, 5 minutes, 10 minutes, or 20 minutes, the request may be a real-time request. The reservation request may indicate that the requestor wishes to use the transportation service at a defined time that is quite distant from the current time for one of ordinary skill in the art. For example, if the defined time is longer than a threshold, such as 20 minutes, 2 hours, or 1 day, the request may be a reservation request. In some embodiments, the processing engine 112 may define the real-time request or the reservation request based on a time threshold. The time threshold may be a default setting for the system 100 or may be adjusted according to different circumstances. For example, during a traffic spike, the time threshold may be relatively small (e.g., 10 minutes). During idle periods (e.g., 10 am to 12 am), the time threshold may be relatively large (e.g., 1 hour).

The service request may include a start point, an end point, a start time, a duration, and the like. The origin may refer to the location where the service provider takes the passenger. The endpoint may refer to the location where the service provider drops the passenger. The start time may refer to the time that the passenger was picked up, or the time that the service provider (e.g., driver) receives or acknowledges the service request. The duration may be a time for the service provider to carry the passenger from the origin to the destination associated with the service request.

The at least two historical data values may be associated with the service. In some embodiments, the at least two historical data values may include one or a combination of several of at least two service requests, at least two durations of service requests, at least two origins of service requests, and the like. The at least two historical data values may be associated with at least two points in time (e.g., start times of service requests). In current applications, the historical data value may be described in terms of at least two service requests, but should not be construed as limiting the historical data value to a form in which only the at least two service requests are present.

The at least two historical data The values may form a time series (hereinafter also referred to as a "sequence"). For example, the sequence may be (p ₁ ,p ₂ ,p ₃ ,…,p _i-1 ,p _i ,…p _n ). In this sequence, each value may be associated with a point in time (e.g., a start time of a service request). And value p _i-1 And p _i The relevant time points may be t respectively _i-1 And t _i . The time point t _i-1 Can be earlier than the time point t _i . In some embodiments, the value p _i May be the time point t _i Number of service requests at.

At 504, the processing engine 112 (e.g., the classification module 404) may determine a category associated with the at least two historical data values. The processing engine 112 may analyze the sequence associated with the at least two historical data values. The processing engine 112 may then extract at least two features from the sequence. Further description of the at least two features may be found elsewhere in this application, for example, in fig. 9 and its description.

In some embodiments, the at least two features may be related to the service (e.g., an online taxi service) that corresponds to the at least two historical data values. The at least two features may include one or a combination of years of development, traffic volume, traffic flows, profits, and the like. The processing engine 112 may determine values of the at least two features based on the at least two historical data values.

The processing engine 112 may categorize the at least two historical data values into categories based on the at least two characteristic values. The category may represent characteristics associated with the service. The class may be constructed based on two sets of Cartesian products. The first set may include periodic, aperiodic, etc. elements. The second set may include elements of growth phase, stationary phase, declining phase, and the like. In some embodiments, the categories may include a period of growing having periodicity, a period of stationary having periodicity, a period of decaying having periodicity, a period of growing having non-periodicity, a period of stationary having non-periodicity, a period of decaying having non-periodicity, and the like. In another embodiment, the category may include one element of the first set or the second set. Further description about this category may be found elsewhere in this application, for example, in fig. 9 and its description.

The processing engine 112 may determine a classifier for classifying the at least two historical data values. The processing engine 112 may determine the category associated with the at least two historical data values by a third party. The processing engine 112 may determine a training set based on the characteristic values associated with the at least two historical data values and the class. The processing engine 112 may determine a classifier using a model, such as a gradient-lifted decision tree model (GBDT) model, based on the training set. The classifier may classify other historical data values (e.g., at least two sequences). The classification result may be added to the training set. The classifier may be updated over time by using a new training set. The processing engine 112 may classify the at least two historical data values into categories based on the most current classifier. In some embodiments, the processing engine 112 may classify the at least two historical data values into more than one category based on the most recent classifier.

At 506, the processing engine 112 (e.g., the prediction module 406) may determine at least two predicted values associated with the service based on a prediction model associated with the category. The at least two predicted values may be associated with at least two first points in time in real time. For example, the at least two first points in time may comprise (t ₁ ,t ₂ ,t ₃ ,…,t _j-1 ,t _j ,…t _m ). Like the at least two historical data values, the at least two predicted values may also form a sequence.

If the category is associated with periodicity, the processing engine 112 may use an algorithm (e.g., an exponential smoothing algorithm) to determine the at least two predicted values. The processing engine 112 may use the algorithm to determine statistical parameters related to the at least two historical data values. The statistical parameter may be represented by a residual function, a trend function, and/or a seasonal function.

In some embodiments, the processing engine 112 may determine a predictive model based on the statistical parameters. The processing engine 112 may determine the at least two predicted values based on the predictive model. Further description of the determination of the at least two predictors can be found in this application, for example, fig. 6 and its description.

If the category is not periodically related, the processing engine 112 may periodically collect the historical data values at a point in time. In some embodiments, if the processing engine 112 determines a predicted value (e.g., the number of service requests) at a point in time on the next monday, at least two service requests at that point in time on every monday over the past several weeks may be collected. The processing engine 112 may determine a predicted value for a next point in time based on the number of collected service requests.

At 508, the processing engine 112 (e.g., the acquisition module 402) may acquire at least two real values associated with the service corresponding to the at least two predicted values over the network 120. The at least two actual values may be associated with at least two second points in time. The at least two second time points and the at least two first time points may be in one-to-one correspondence. Alternatively or additionally, the at least two second points in time and a part of the at least two first points in time may be in a one-to-one correspondence.

For each of the at least two second time points there may be a true value corresponding to the second time point. The at least two actual values may refer to values (e.g., the number of service requests) associated with a service (e.g., service requests) after the service is completed. The at least two real values may be stored in the storage device 160. Like the at least two historical data values, the at least two actual values may also form a sequence. In some embodiments, the at least two true values and the at least two predicted values may be paired. For each of the at least two predicted values, the processing engine 112 may obtain a true value corresponding to each of the at least two predicted values. Each of the at least two predicted values and the corresponding actual value may be associated with the same point in time.

At 510, the processing engine 112 may compare the at least two real values to the at least two predicted values using at least one filter to generate a comparison result. The at least one filter may include a discrete filter, a threshold filter, and a false alarm filter. In some embodiments, the comparison module 408 may compare the at least two real values to the at least two predicted values using each of the discrete filter, the threshold filter, and the false alarm filter to produce the comparison result.

The comparison result may include at least one of a first comparison result, a second comparison result, and a third comparison result. The processing engine 112 may compare the at least two real values to the at least two predicted values to generate the first comparison result based on the discrete filter. Further description about the first comparison result may be found elsewhere in the present application, e.g. 7 in the figure and its description.

The processing engine 112 may compare the at least two real values to the at least two predicted values based on the threshold filter to generate the second comparison result. Further description of the second comparison result may be found elsewhere in the present application, for example, fig. 8 and its description.

The processing engine 112 may compare the at least two real values to the at least two predicted values based on the false alarm filter to generate the third comparison result. The processing engine 112 may obtain a pre-labeled data set associated with the service data. The pre-labeled data set may contain the results of at least two false alarms. The at least two false alarm results may refer to a true value determined by the online-to-offline service system 100 to be anomalous and later corrected to be normal by the third party. The at least two false alarm results may also refer to a true value that is determined to be normal by the online-to-offline service system 100 and later corrected to be anomalous by the third party.

In some embodiments, the processing engine 112 (e.g., the comparison module 408) may determine a model based on the pre-labeled data set. The processing engine 112 may determine the model by training a classification model based on the pre-labeled dataset. The classification model may include a GBDT model, a random forest model, or the like. The processing engine 112 may use the at least two real values and/or the at least two predicted values as inputs to the model. The processing engine 112 may then obtain the third comparison result based on the model.

At 512, the processing engine 112 may determine that at least a portion of the at least two real values are outliers based on the comparison. The comparison result may include at least one of the first comparison result, the second comparison result, and the third comparison result. Each of the first comparison result, the second comparison result, and the third comparison result may include determining that the at least a portion of the at least two true values are outliers.

The processing engine 112 may determine that the at least a portion of the at least two real values are outliers based on the comparison. For example, if one of the first comparison result, the second comparison result, and the third comparison result includes determining that the at least a portion of the at least two real values are outliers, the processing engine 112 may determine that the at least a portion of the at least two real values are outliers. For another example, if two of the first comparison result, the second comparison result, and the third comparison result include determining that the at least a portion of the at least two real values are outliers, the processing engine 112 may determine that the at least a portion of the at least two real values are outliers. For another example, if each of the first comparison result, the second comparison result, and the third comparison result includes determining that the at least a portion of the at least two real values are anomalous, the processing engine 112 may determine that the at least a portion of the at least two real values are anomalous. The processing engine 112 may ignore the at least a portion of the at least two real values from the at least two real values.

It should be noted that the above description of the flow of determining that the at least a portion of the at least two real values is anomalous is provided for illustration purposes and should not be taken as the only embodiment. It will be apparent to those skilled in the art that after understanding the general principles of the flow of determining that the at least a portion of the at least two actual values are abnormal, the form or details and steps of a particular practical manner may be modified or changed, and further simple deductions or substitutions may be made, or modifications or combinations of certain steps may be made, without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps. In some embodiments, 506 and 508 may be combined into one operation.

FIG. 6 is a flow chart illustrating an exemplary process 600 for determining at least two predicted values according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the process 600 to determine the at least two predicted values. One or more operations of the flow 600 for determining the at least two predicted values shown in fig. 6 may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the flow 600 shown in fig. 6 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, such as the central processor 340 of the mobile device 300 shown in fig. 3).

At 602, the processing engine 112 (e.g., the prediction module 406) may determine that the category is associated with periodicity. For example, the category may be one of a periodic growth period, a periodic settling period, and a periodic decay period. The category associated with a period may indicate that the at least two historical data values are periodic.

At 604, the processing engine 112 (e.g., the prediction module 406) may determine statistical parameters related to the at least two historical data values based on the categories. The processing engine 112 may analyze the at least two historical data values using a time-series method. The time series method can comprise one or a combination of a plurality of moving average models, autoregressive moving average models, exponential smoothing models and the like. The exponential smoothing model may include one or a combination of several of a basic exponential smoothing model, a double exponential smoothing model, a three exponential smoothing model, and the like.

In some embodiments, the processing engine 112 may determine the statistical parameters based on the exponential smoothing model (e.g., a triple exponential smoothing model). The statistical parameters may include a residual function, a trend function, and a seasonal function. The residual function, the trend function, and the seasonal function may all be time functions.

At 606, the processing engine 112 (e.g., the prediction module 406) may generate a prediction model based on the statistical parameters. In some embodiments, the processing engine 112 may determine the predictive model based on the residual function, the trend function, and the seasonal function. For example, the predictive model may be represented by equation (1):

p _t+h ＝a(t)+h·b(t)+s[t-k+1+(h-1)modk] (1)

wherein a (t) may represent the residual function, b (t) may represent the trend function, s (t) may represent the seasonal function, p _t+h Can represent the predicted value, t can represent the current time point, and h can represent the time point from the current time point t to the predicted value p _t+h The time interval of the associated time point, k, may represent the time interval associated with the at leastThe period in which two historical data values are related, "mod" may represent a modulo operation.

At 608, the processing engine 112 (e.g., the prediction module 406) may determine the at least two predicted values based on the prediction model. The processing engine 112 may obtain a point in time associated with the at least two predicted values. The processing engine 112 may determine at least two predicted values using equation (1) based on points in time associated with the at least two predicted values.

It should be noted that the above procedure for determining the at least two predicted values is provided for illustrative purposes and should not be taken as the only embodiment. It will be apparent to those skilled in the art that the general principles of the flow of determining the at least two predicted values may be modified or varied in form or detail, and further simple deductions or substitutions of specific practical forms, or modifications or combinations of steps may be made without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps.

FIG. 7 is a flow chart of an exemplary process 700 for determining that the at least a portion of the at least two real values are outliers, according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the flow 700 to determine that the at least a portion of the at least two real values are outliers. The processing engine 112 may determine the first comparison result based on the discrete filter by executing the flow 700. One or more operations of the flow 700 for determining that the at least a portion of the at least two real values is anomalous, shown in fig. 7, may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the flow 700 shown in fig. 7 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, such as the central processor 340 of the mobile device 300 shown in fig. 3).

In 702, the processing engine 112 (e.g., the comparison module 408) may determine a statistical value from the at least two predicted values and the at least two actual values. The processing engine 112 may determine the at least two predicted values and the at least two actual values, respectively, as a sequence of samples. The processing engine 112 may perform a paired t test on the two sample sequences. The processing engine 112 may then determine the statistics from the paired t-tests. The statistical value may be related to the at least two predicted values and the degree of dispersion of the at least two actual values.

At 704, the processing engine 112 (e.g., the comparison module 408) may compare the statistics to a first threshold to generate the first comparison result. The first threshold may be a predetermined value set in the system. The first threshold may be adjusted according to real-time conditions. In some embodiments, the first threshold may be any value, including 0.5, 0.7, 1, etc. The processing engine 112 may compare the statistics to the first threshold. The processing engine 112 may then determine whether the statistic is greater than a first threshold.

In response to the first comparison result, i.e., the statistical value being greater than a first threshold, the processing engine 112 (e.g., the comparison module 408) may determine that the at least a portion of the at least two real values are outliers at 706. If the processing engine 112 determines that the statistical value is less than the first threshold, the processing engine 112 may determine that the at least two real values are normal. If the processing engine 112 determines that the statistical value is greater than the first threshold, the processing engine 112 may determine that the at least a portion of the at least two real values are outliers. The first comparison result may indicate that the at least a portion of the at least two real values are outliers. The processing engine 112 may omit the at least a portion of the at least two real values from the at least two real values.

FIG. 8 is a flow chart of an exemplary process 800 for determining that the at least a portion of the at least two real values are outliers, according to some embodiments of the present application. In some embodiments, the processing engine 112 may execute the process 800 to determine that the at least a portion of the at least two real values are outliers. The processing engine 112 may determine the second comparison result by executing the process 800. One or more operations of the flow 800 for determining that the at least a portion of the at least two real values are anomalous, shown in fig. 8, may be implemented in the online-to-offline service system 100 shown in fig. 1. For example, the process 800 shown in fig. 8 may be stored in the storage device 160 in the form of instructions and invoked and/or executed by the processing engine 112 (e.g., the processor 210 of the computing device 200 shown in fig. 2, such as the central processor 340 of the mobile device 300 shown in fig. 3).

In 802, the processing engine 112 (e.g., the comparison module 408) may use the threshold filter to determine the at least two predicted values and at least two differences between the at least two actual values. For each difference value, the predicted value and the corresponding actual value may be associated with the same point in time. For each of at least a portion of the at least two predicted values, the processing engine 112 may determine a difference value based on the predicted value and the corresponding actual value.

In 804, the processing engine 112 (e.g., the comparison module 408) may determine at least two second thresholds based on a function of time. The processing engine 112 may determine the time function from the categories into which the at least two historical data values are classified as a sequence. The processing engine 112 may determine the at least two second thresholds based on the time function. For each of the at least two first points in time and/or the at least a portion of the at least two second points in time, the processing engine 112 may determine a second threshold based on the points in time and the time function. Accordingly, the processing engine 112 may determine the at least two second thresholds.

At 806, the processing engine 112 (e.g., the comparison module 408) may compare each of the at least two differences to a corresponding second threshold. For a point in time, the processing engine 112 may determine a difference value and a corresponding second threshold value. For each of the first point in time and/or at least a portion of the second point in time, the processing engine 112 may determine whether the difference associated with the point in time is greater than a corresponding second threshold.

In 808, in response to the comparison result being that each of the at least two differences is greater than a corresponding second threshold, the processing engine 112 (e.g., the comparison module 408) may determine that the at least a portion of the at least two true values are outliers. If the processing engine 112 determines that a portion of the at least two differences, respectively, are less than the corresponding second threshold, the processing engine 112 may determine that the at least two true values are normal. If the processing engine 112 determines that each of the at least two differences is greater than a corresponding second threshold, the processing engine 112 may determine that the at least a portion of the at least two true values are outliers. The second comparison result may indicate that the at least a portion of the at least two real values are outliers. The processing engine 112 may omit the at least a portion of the at least two real values from the at least two real values.

It should be noted that the above description of the flow of determining that the at least a portion of the at least two real values is anomalous is provided for illustration purposes and should not be taken as the only embodiment. It will be apparent to those skilled in the art that after understanding the general principles of the flow of determining that the at least a portion of the at least two actual values are abnormal, the form or details and steps of a particular practical manner may be modified or changed, and further simple deductions or substitutions may be made, or modifications or combinations of certain steps may be made, without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. Additionally or alternatively, one or more steps may be omitted. In some embodiments, two or more steps may be integrated into one step, or one step may be divided into two steps.

Fig. 9 is a table 900 associated with at least two business lines, shown in accordance with some embodiments of the present application. Four line of business IDs 902 may be shown in table 900. For the line of business ID 902, the processing engine 112 may obtain at least two historical data values. The processing engine 112 may analyze the at least two historical data values and extract four features from the at least two historical data values. The four features may include a first feature 904 (e.g., age of development), a second feature 906 (e.g., volume of traffic), a third feature 908 (e.g., business flow), and a fourth feature 910 (e.g., profit). The processing engine 112 may also determine values for the first feature 904, the second feature 906, the third feature 908, and the fourth feature 910.

For each line of business ID 902, the processing engine 112 may use the values of the line of business ID 902 and the four features as inputs to a classifier. The processing engine 112 may determine the category into which the line of business ID is classified based on the classifier. Thus, the at least two historical data values associated with the service ID are classified into the class. Four categories (first category 912, second category 914, third category 916, and fourth category 918) are shown in table 910. Each of the four categories may be associated with two sets of cartesian products described in step 504.

In some embodiments, the value of the class to which the traffic line ID is assigned may be set to 1 and the values of other classes to which the traffic line ID is not assigned may be set to 0. As shown in table 900, the service line ID 1 is classified into a first class. The service line ID 2 is divided into a second class. The service line ID 3 is classified into a third class. The service line ID 4 is classified into a fourth class.

For each line of business ID, the processing engine 112 may update the training set associated with the classifier using the values of the four features and the class into which the line of business ID is classified. The classifier may be updated based on the updated training set associated with the classifier.

It should be noted that the above description of the table is provided for illustrative purposes and should not be taken as the only embodiment. It will be apparent to those skilled in the art that after understanding the general principles of the flow of determining that the at least a portion of the at least two actual values are abnormal, the form or details and steps of a particular practical manner may be modified or changed, and further simple deductions or substitutions may be made, or modifications or combinations of certain steps may be made, without inventive effort, without departing from the principles. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. For example, the feature number of each service line ID may be any other value than 4. The value of the class of the traffic line ID classification may be any other value than 0. The number of categories displayed in the table 900 may be any other value other than 4.

While the basic concepts have been described above, it will be apparent to those of ordinary skill in the art after reading this application that the above disclosure is by way of example only and is not limiting of the present application. Although not explicitly described herein, various modifications, improvements, and adaptations of the present application may occur to one skilled in the art. Such modifications, improvements, and modifications are intended to be suggested within this application, and therefore, such modifications, improvements, and modifications are intended to be included within the spirit and scope of the exemplary embodiments of the present application.

Meanwhile, the present application uses specific terminology to describe embodiments of the present application. Reference to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic is associated with at least one embodiment of the present application. Thus, it is emphasized and should be appreciated that two or more references to "an embodiment," "one embodiment," or "an alternative embodiment" in various positions in this specification are not necessarily referring to the same embodiment. Furthermore, certain features, structures, or characteristics of one or more embodiments of the present application may be combined as suitable.

Moreover, those of ordinary skill in the art will appreciate that the various aspects of the invention are illustrated and described in terms of several patentable categories or cases, including any novel and useful processes, machines, products, or combinations of materials, or any novel and useful improvements thereto. Thus, embodiments of the present application may be implemented in pure hardware or pure software, where software includes, but is not limited to, an operating system, resident software or microcode, etc.; it may also be implemented in a "system", "module", "sub-module", "unit", etc., comprising both hardware and software. Furthermore, aspects of the present application may be represented as a computer product in one or more computer-readable media, the product comprising computer-readable program code.

The computer readable signal medium may comprise a propagated data signal with computer program code embodied therein, for example, on a baseband or as part of a carrier wave. The propagated signal may take any of a variety of forms, including electro-magnetic, optical, etc., or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code located on a computer readable signal medium may be propagated through any suitable medium including radio, cable, fiber optic cable, RF, or the like, or a combination of any of the foregoing.

Computer program code required for operation of aspects of the present application may be written in any combination of one or more programming languages, including an object oriented programming such as Java, scala, smalltalk, eiffel, JADE, emerald, C ++, c#, vb net, python or similar conventional programming languages such as the "C" programming language, visual Basic, fortran 1703,Perl,COBOL 1702,PHP,ABAP, dynamic programming languages such as Python, ruby and Groovy or other programming languages. The program code may execute entirely on the user's computer or as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any form of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or the use of services such as software as a service (SaaS) in a cloud computing environment.

Furthermore, the order in which the elements and sequences are presented, the use of numerical letters, or other designations are used in the application and are not intended to limit the order in which the processes and methods of the application are performed unless explicitly recited in the claims. While certain presently useful inventive embodiments have been discussed in the foregoing disclosure, by way of various examples, it is to be understood that such details are merely illustrative and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements included within the spirit and scope of the embodiments of the present application. For example, while the system components described above may be implemented by hardware devices, they may also be implemented solely by software solutions, such as installing the described system on an existing server or mobile device.

Likewise, it should be noted that in order to simplify the presentation disclosed herein and thereby aid in understanding one or more inventive embodiments, various features are sometimes grouped together in a single embodiment, figure, or description thereof. This method of disclosure, however, is not intended to imply that more features than are presented in the claims are required for the object of the present application. Indeed, the claimed subject matter may include less than all of the features of a single foregoing disclosed embodiment.

Claims

1. A data storage anomaly detection system, comprising:

a storage device storing a set of instructions; and

one or more processors in communication with the storage device, wherein the one or more processors, when executing the set of instructions, are configured to cause the system to:

acquiring at least two historical data values related to the service through a network;

determining at least two characteristic values associated with the at least two historical data values;

determining a category associated with the at least two historical data values based on the at least two characteristic values; the category represents a characteristic associated with the service, the category including a period of growing having periodicity, a period of settling having periodicity, a period of decaying having periodicity, a period of growing having non-periodicity, a period of settling having non-periodicity, or a period of decaying having non-periodicity;

determining at least two predicted values associated with the service based on a predicted model associated with the category, each predicted value corresponding to a point in time;

acquiring at least two true values associated with the service and corresponding to the at least two predicted values through a network;

determining, using a discrete filter, a statistical value based on the at least two predicted values and the at least two actual values, the statistical value being related to a degree of dispersion of the at least two predicted values and the at least two actual values;

Comparing the statistical value with a first threshold value to determine a first comparison result;

determining at least two differences between the at least two predicted values and the at least two actual values using a threshold filter;

determining at least two second thresholds based on the time function;

comparing each of the at least two differences with a second threshold corresponding thereto, determining a second comparison result, each of the at least two differences and the second threshold corresponding thereto being associated with the same point in time;

determining a false alarm model based on a pre-labeled dataset related to service data, the pre-labeled dataset comprising at least two false alarm results generated by the system;

comparing the at least two false alarm results with the at least two true values based on the false alarm model to determine a third comparison result;

based on at least one of the first comparison result, the second comparison result, and the third comparison result, it is determined that at least a portion of the at least two real values are outliers.

2. The system of claim 1, wherein the at least two historical data values form a time series.

3. The system of claim 1, wherein to determine the at least two predicted values related to the service based on the predictive model related to the category; the one or more processors are further configured to cause the system to:

Determining that the category indicative of the characteristic associated with the service is associated with periodicity;

determining a residual function, a trend function, and a seasonal function associated with the at least two historical data values based on the periodically-related categories;

generating the predictive model based on the residual function, the trend function, and the seasonal function; and

the at least two predicted values are determined based on the predictive model.

4. The system of claim 1, wherein to obtain the at least two true values associated with the service that correspond to the at least two predicted values, the one or more processors are further configured to cause the system to:

acquiring a point in time associated with at least a portion of the at least two predicted values; and

the at least two true values are obtained based on the point in time associated with at least a portion of the at least two predicted values.

5. A method implemented on a computing device for anomaly detection in a data store, the computing device comprising at least one processor, memory, and a communication platform connected to a network, the method comprising:

Determining at least two second thresholds based on the time function;

determining a false alarm model based on a pre-labeled dataset related to service data, the pre-labeled dataset comprising at least two false alarm results;

6. The method of claim 5, wherein the at least two historical data values form a time series.

7. The method of claim 5, wherein determining the at least two predictors relating to the service based on the predictive model relating to the category comprises:

the at least two predicted values are determined based on the predictive model.

8. The method of claim 5, wherein obtaining the at least two true values associated with the service corresponding to the at least two predicted values comprises:

9. A non-transitory computer readable medium comprising at least one set of instructions for data storage anomaly detection, wherein the at least one set of instructions, when executed by at least one processor, instructs the at least one processor to:

determining at least two second thresholds based on the time function;