CN111782433B

CN111782433B - Abnormality investigation method, abnormality investigation device, electronic equipment and storage medium

Info

Publication number: CN111782433B
Application number: CN202010615290.6A
Authority: CN
Inventors: 高睿; 周玮
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2020-06-30
Filing date: 2020-06-30
Publication date: 2024-06-25
Anticipated expiration: 2040-06-30
Also published as: CN111782433A

Abstract

The application discloses an anomaly investigation method, an anomaly investigation device, electronic equipment and a storage medium, and relates to the technical fields of artificial intelligence, big data and cloud computing. The specific implementation scheme is as follows: collecting reporting data of a plurality of monitored devices; determining a device of interest according to the plurality of monitored devices; according to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on a pre-configured alarm strategy; when the abnormal event occurs to the concerned equipment, the abnormal event is processed based on a pre-configured abnormal solving strategy. The abnormality investigation scheme provided by the embodiment of the application is more flexible, can reduce the operation and maintenance cost of a user and improves the user experience.

Description

Abnormality investigation method, abnormality investigation device, electronic equipment and storage medium

Technical Field

The embodiment of the application relates to artificial intelligence, big data and cloud computing technology in a data processing technology, in particular to an anomaly investigation method, an anomaly investigation device, electronic equipment and a storage medium.

Background

With the development of the internet, the application of artificial intelligence (ARTIFICIAL INTELLIGENCE, AI) devices is also becoming more and more widespread. AI devices, such as cameras, often suffer from device failure, physical angular misalignment, scene changes, etc. due to human or natural causes after installation, and therefore maintenance and management of AI devices is required.

Disclosure of Invention

The application provides an anomaly investigation method, an anomaly investigation device, electronic equipment and a storage medium.

According to a first aspect of the present application, there is provided an anomaly investigation method including:

collecting reporting data of a plurality of monitored devices;

determining a device of interest according to the plurality of monitored devices;

according to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on a pre-configured alarm strategy;

When the abnormal event occurs to the concerned equipment, the abnormal event is processed based on a pre-configured abnormal solving strategy.

According to a second aspect of the present application, there is provided an abnormality troubleshooting apparatus including:

The acquisition module is used for acquiring the reported data of the monitored devices;

a determining module, configured to determine a device of interest according to the plurality of monitored devices;

the determining module is further configured to: according to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on a pre-configured alarm strategy;

A processing module, configured to process, when the determining module determines that the device of interest has an abnormal event, the abnormal event based on a pre-configured abnormality resolution policy

According to a third aspect of the present application, there is provided an electronic device comprising:

at least one processor; and

A memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of the first aspect.

According to a fourth aspect of the present application there is provided a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of the first aspect.

According to a fifth aspect of the present application, there is provided a computer program product comprising: a computer program stored in a readable storage medium, from which it can be read by at least one processor of an electronic device, the at least one processor executing the computer program causing the electronic device to perform the method of the first aspect.

According to the scheme of the embodiment of the application, the report data of the monitored devices are collected firstly, the attention device is determined according to the monitored devices, the abnormal condition of the attention device is determined based on the pre-configured alarm strategy according to the report data of the attention device and the historical data corresponding to the report data, and finally when the abnormal event of the attention device is determined, the abnormal event is processed based on the pre-configured abnormal solution strategy. The abnormality investigation scheme provided by the embodiment of the application is more flexible, can reduce the operation and maintenance cost of a user and improves the user experience.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the application or to delineate the scope of the application. Other features of the present application will become apparent from the description that follows.

Drawings

The drawings are included to provide a better understanding of the present application and are not to be construed as limiting the application. Wherein:

FIG. 1 is a schematic view of an exemplary scenario in which the anomaly detection method provided by the embodiment of the present application is applicable;

FIG. 2 is a flow chart of an anomaly detection method according to an embodiment of the present application;

FIG. 3A is a flowchart illustrating an anomaly detection method according to an embodiment of the present application;

fig. 3B is a flowchart illustrating an anomaly detection method according to an embodiment of the present application;

fig. 4 is a block diagram of an abnormality checking apparatus according to an embodiment of the present application;

Fig. 5 is a block diagram of an electronic device for implementing the abnormality detection method of the embodiment of the present application.

Detailed Description

Exemplary embodiments of the present application will now be described with reference to the accompanying drawings, in which various details of the embodiments of the present application are included to facilitate understanding, and are to be considered merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the application. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

As described in the background, AI devices require daily management and maintenance during use. In the prior art, abnormality detection and adjustment are generally performed at the site where the AI equipment is installed by manpower. However, the application of the AI equipment is wider and wider, and the AI equipment is difficult to find and check when the problem occurs due to the increase of the number of the equipment, the scattered installation sites and the large difference of application scenes, so that the operation and maintenance cost is seriously increased. In fact, at present, the user can only find that the problem occurs in the AI device by watching the real-time video effect or finding that the snapshot is not received, which is more passive and lagging; in addition, because AI hardware parameters are numerous, non-professional staff cannot easily understand and easily allocate, when the problems are solved, engineers with abundant experience mainly go to the site to adjust, frequently go to the site to patrol and solve the problems, on one hand, the operation and maintenance cost of users can be greatly improved, and the use experience is reduced; on the other hand, because of the large number of devices, scattered installation sites and large application scene difference, the problems are difficult to find and check, and the time consumption and the cost of on-site inspection maintenance are high.

In view of the above problems, the present application provides an anomaly investigation method, an anomaly investigation device, an electronic device, and a storage medium, which are applied to artificial intelligence, big data, and cloud computing technologies in the field of computer technology to form a closed loop from the discovery of equipment problems to the solution of the equipment problems, thereby reducing the operation and maintenance costs of users and improving the user experience.

Fig. 1 is a schematic view of an exemplary scenario to which the anomaly detection method provided by the embodiment of the present application is applicable. As shown in fig. 1, the method involves a user, a terminal device used by the user, a monitoring device, and a cloud server. In the scene, a user can check the running condition of the monitoring equipment through the terminal equipment, and by adopting the scheme of the embodiment of the application, the monitoring equipment can perform data interaction with the cloud server, for example, the data reflecting the state of the user and the recorded data such as the photo are transmitted to the cloud, and the cloud server performs data processing and analysis. The cloud server analyzes whether the monitoring equipment is abnormal or not according to the data reported by the monitoring equipment, and if so, a user can carry out parameter configuration and the like on the monitoring equipment according to the prompt of the cloud server so as to solve the abnormality. The monitoring device may be a visual sensing device, such as a camera, a gate, etc. capable of performing face capture, face recognition, and behavior monitoring.

In addition, the application can be applied to security protection, park or business body control, traffic and other scenes, and can also be applied to payment scenes needing face recognition and the like. For example, in a security scene, by applying the scheme of the embodiment of the application, the fault of the monitoring equipment can be timely checked, so that the problem can be rapidly positioned and solved.

Fig. 2 is a flowchart of an anomaly detection method according to an embodiment of the present application. The execution subject of the method may be the server shown in fig. 1, and the method includes:

s201, collecting reporting data of a plurality of monitored devices.

The monitored device may be, for example, an AI device having visual perception capability, such as a camera, a gate, etc. for performing face capturing, face recognition, and behavior monitoring.

As a possible implementation manner, the monitored device can report the data by itself; as another possible implementation manner, the cloud trigger may also trigger the monitored device to report data.

For example, the type of data reported may be default, i.e., the monitored device may report a default type of data, such as the number of snapshots, quality of the snapshots, CPU usage, etc.

S202, determining the attention device according to the plurality of monitored devices.

Since there are multiple monitored devices, only a portion of the monitored devices may be of interest in a particular application. For example, when determining the attention device, a part of the monitored devices, which meets the user-defined condition, may be selected as the attention device according to the selection of the user. Of course, a part of the monitored device may be selected as the attention device according to a default setting.

It should be noted that the attention device may be more than one. In addition, the attention device may be all the monitored devices, and in this case, the attention device is determined by determining all the monitored devices as attention devices.

S203, determining the abnormal condition of the attention device based on a pre-configured alarm strategy according to the report data of the attention device and the historical data corresponding to the report data.

After the device of interest is determined, the state of the device of interest may be comprehensively evaluated based on the reported data of the device of interest and the history data corresponding to the reported data, thereby determining the abnormal situation thereof based on the alarm policy configured in advance.

Here, the history data corresponding to the report data refers to data of the same type as the report data, for example, data that can be reported by the device of interest in the same report period. For example, if the attention device reports the number of the snap shots on the third week, the historical data corresponding to the reported data may be the number of the snap shots reported on the third week by the attention device.

For example, the pre-configured alert policy may be a default alert policy in which specific conditions for determining whether an abnormality occurs in the device of interest are set. For example, the alarm policy may be that when a statistical value obtained based on the reported data and the historical data of the attention device exceeds a preset threshold, an abnormal event occurs in the attention device, and the abnormal situation is abnormal. If the statistical value of a certain item of data (or a certain monitoring item) is not beyond a preset threshold value based on the reported data and the historical data of the concerned equipment, the concerned equipment is known not to have an abnormal event according to an alarm strategy, and the abnormal condition is no abnormality; if the statistical value of a certain item of data is obtained to exceed a preset threshold value based on the reported data and the historical data of the concerned equipment, at the moment, the concerned equipment can be judged to have an abnormal event according to an alarm strategy, and the abnormal condition is abnormal. In the above-mentioned alert policy, it is also possible to configure how to notify the user of the occurrence of the abnormal event, including, for example, which users are specifically notified, in which manner notification (for example, batch notification of the attention device in which the abnormal event occurs by mail or the like) and the notification frequency (for example, the interval time of notification transmission), and the like.

Therefore, by analyzing the report data and the history data corresponding to the report data, the abnormal condition of the device of interest can be determined based on the alarm policy configured in advance.

S204, when the abnormal event of the attention device is determined, the abnormal event is processed based on a pre-configured abnormality solving strategy.

If the attention device is judged to have an abnormal event based on a preset alarm strategy, the abnormal condition needs to be solved at the moment, namely, the abnormal event is processed based on a preset abnormal solving strategy. For example, in the exception solving strategy, a processing scheme of a common exception event may be preconfigured, for example, if a statistical value of a certain item of data is greater than a preset threshold, then the item of data may be restored to be normal by adjusting certain parameters of the concerned device. For example, if the item of data is the CPU (central processing unit, CPU) usage, the exception resolution policy may specify that if the CPU usage is above a certain threshold, the CPU usage may be brought to a normal value by adjusting the number of applications running on the device of interest, etc. In addition, a pre-trained model can be introduced through a machine learning algorithm to realize a more intelligent abnormality solving strategy.

According to the scheme of the embodiment of the application, the report data of the monitored devices are collected firstly, the attention device is determined according to the monitored devices, the abnormal condition of the attention device is determined based on the pre-configured alarm strategy according to the report data of the attention device and the historical data corresponding to the report data, and finally when the abnormal event of the attention device is determined, the abnormal event is processed based on the pre-configured abnormal solution strategy. By adopting the scheme of the embodiment of the application, the report data of the attention device and the historical data corresponding to the report data are subjected to association analysis, the abnormal condition of the attention device is determined based on the pre-configured alarm strategy, and the abnormal event is solved when the abnormal event of the attention device is determined, so that a closed loop solution from the discovery of the abnormal state of the attention device to the solution of the abnormal state of the attention device is provided.

Fig. 3A is a flowchart illustrating an anomaly detection method according to an embodiment of the present application. The method may be interaction between the terminal device (monitored device), the cloud server and the terminal device used by the user shown in fig. 1, and the method includes:

s301, the monitored equipment reports data.

Alternatively, the reported data may include two types of data, device data and service data, where the device data reflects the operation of the monitored device and the service data reflects the service execution of the monitored device. For example, the device data such as whether the device is on-line, the CPU usage of the device, whether the network is unobstructed, whether the device is blocked, whether the picture is clear, etc. reflect the data of the device itself, and the service data may be service related indexes such as quality of face shots, number of regional people, sex/age/dressing distribution, etc. The diversity of the reported data is more beneficial to the reasoning analysis of the cloud, so that the abnormality can be more accurately positioned and solved.

S302, the cloud server collects reporting data of a plurality of monitored devices.

The description of step S201 in the foregoing embodiment is also applicable to this step, and will not be repeated here.

S303, the cloud server acquires management information.

After the reported data is collected, the cloud server can also obtain management information.

The management information may be obtained based on input of the terminal device through which the user uses, as shown in fig. 3A, for example.

For example, the management information may include a tag of the device of interest. The tag may be, for example, a tag actively selected by a user, so as to screen out a device of interest from the monitored devices as a device of interest. By way of example, the tag may be a type of the device of interest (e.g., the device of interest is a camera, a gate, etc.), a model number of the device of interest, an installation location of the device of interest (e.g., kindergarten, campus, etc.), a scene in which the device of interest is located (e.g., whether the device of interest is indoors or outdoors), a lighting condition of the device of interest (e.g., whether it is backlit, etc.). Taking the scene of the device of interest as an example, the lighting conditions are completely different because the scene changes indoors or outdoors, and thus, some parameter settings for the device of interest, such as brightness, wide dynamic, etc., are also completely different.

For example, the management information may include, in addition to a tag of the device of interest, a monitoring item for configuring an alarm policy, a statistical manner of the monitoring item, an alarm condition corresponding to the monitoring item, and notification information for generating an alarm notification. The monitoring item can be one or more items in the data reported by the concerned equipment; the statistical mode of the monitoring items can be such as averaging, maximum value and the like; the alarm condition corresponding to the monitoring item may be, for example, when the statistical value of the monitoring item is greater than a certain threshold value; the notification information may include, for example, an object of the alert notification, a notification frequency, a notification manner, and the like.

Illustratively, the management information may be user-defined. The cloud server may obtain the management information based on user input. For example, a user can select interesting labels, monitoring items and the like through the cloud platform so as to screen attention equipment and configure an alarm strategy, so that more flexible anomaly investigation is realized, and user experience is improved.

It should be noted that, the monitoring items that can be used by the higher frequency, such as the number of the snapshots, the quality of the snapshots, and the like, can be used as default monitoring items, and the monitored device can report the current values of the default monitoring items when reporting. On the basis, the user can also customize interested monitoring items from the default monitoring items through management information.

S304, the cloud server screens out the concerned equipment from the monitored equipment according to the management information.

After the management information is acquired, the cloud server can screen out the attention device from the monitored devices according to the management information.

For example, if the tags in the management information are kindergarten and indoor, the monitored device installed in the indoor can be selected as the attention device from the monitored devices in the kindergarten scene. By setting the management information, flexible selection of the device of interest can be realized.

Optionally, after the attention device is screened from the plurality of monitored devices, the monitoring items in the management information may be presented. Specifically, status information of the device of interest may be output according to the monitoring items in the management information and the statistical values of the monitoring items, and the status information may be used to reflect the operation status of the device of interest. The output state information can enable a user to know the running state of the current concerned equipment more clearly, and is beneficial to more efficient abnormality investigation. In addition, when the state information is output, the state information can be presented to the user in a chart form, so that the form is more friendly, and the user experience is better.

S305, the cloud server configures the alarm strategy based on the management information.

After the cloud server acquires the management information, the alert policy can be configured based on the management information besides screening out the attention device.

According to the management information, the monitoring items, the statistical mode of the monitoring items, the alarm conditions corresponding to the monitoring items and the notification information for generating the alarm notification can be configured in the alarm strategy. The configured alarm strategy defines that when the statistic value of the monitoring item meets the alarm condition corresponding to the monitoring item, the abnormal event occurs to the concerned equipment, and the abnormal event is notified to the user according to the notification information, namely, the alarm strategy defines how to determine the abnormality and how to notify the abnormality. Compared with the default setting, the configuration information such as the monitoring items in the management information is more various, so that the alarm strategy can be timely adjusted to adapt to the requirements of different users, and the flexibility and the adaptability of the whole scheme are improved.

By way of example, how to determine occurrence of an abnormal event may be configured in an alarm policy based on a monitoring item in management information, a statistical manner of the monitoring item, and an alarm condition corresponding to the monitoring item, and how to notify a user of the abnormal event when the abnormal event occurs may be configured in the alarm policy based on notification information in the management information, including, for example, which users are specifically notified, in which manner notification (e.g., batch notification of a device of interest in which the abnormal event occurs by mail or the like) and a notification frequency (e.g., an interval time of notification transmission), and the like.

It should be noted that, the statistics of the monitoring items in the management information may be used to present the status information as described in step S304, or may be used to configure the alarm policy as described in step S305, specifically select which monitoring item or monitoring items are or are processed in which statistical manner, and the two processes of presenting the status information and configuring the alarm policy are similar, where the status information is presented and compared to the index of the monitoring item or monitoring items, and the alarm policy is further determined and notified of the abnormality based on the index of the monitoring item or monitoring items.

In addition, it should be noted that the execution sequence of steps S304 and S305 may be executed synchronously without being separated from each other.

S306, the cloud server determines the abnormal condition of the attention device.

Based on the configured alarm strategy, the cloud server can further determine the abnormal condition of the concerned equipment.

Specifically, the cloud server may determine whether the statistics value of the monitoring item of the attention device meets the alarm condition corresponding to the monitoring item according to the report data of the attention device, the history data corresponding to the report data, and the statistics manner of the monitoring item; when the statistical value of the monitoring item is determined to meet the alarm condition corresponding to the monitoring item, determining that the attention device has the abnormal event; and when the abnormal event occurs to the attention device, generating the alarm notification according to the notification information, wherein the alarm notification is used for reminding a user of the abnormal event occurring to the attention device. For example, the reported data and the historical data are both the numbers of the snapshots, and the statistical manner may be to calculate an average value of a preset period of time, so that it may be checked whether the average value of the numbers of the snapshots satisfies the alarm condition, and an alarm notification may be generated when the average value of the numbers of the snapshots satisfies the alarm condition. Since the reported data and the historical data are analyzed in a statistical manner, the time correlation between the data is considered, so that the alarm strategy can be more accurately configured.

As a possible implementation manner, the statistics of the monitoring items meeting the alarm condition corresponding to the monitoring items may be that the number of times that the statistics of the monitoring items reach a preset threshold exceeds a preset number of times, that is, when a certain index triggers the threshold for multiple times, it is determined that the alarm condition is met; as another possible implementation manner, the fact that the statistics value of the monitoring item meets the alarm condition corresponding to the monitoring item may be that the ring ratio increase rate of the statistics value of the monitoring item is abnormal, that is, statistics is performed on a certain index, when the ring ratio increase rate of the statistics value is abnormal, it is determined that the alarm condition is met, for example, when the monitoring item is a number of face shots, and the average ring ratio of the number is reduced, it may be considered that an abnormal event occurs; as still another possible implementation manner, the statistics of the monitoring items meeting the alarm conditions corresponding to the monitoring items may be that the cumulative changes of the statistics of the monitoring items are abnormal. The preset threshold and the preset number of times may be determined according to actual requirements, and are not particularly limited herein. By setting the alarm condition, whether the attention device is abnormal or not can be determined more flexibly, the mode is simple, and the user experience is good. It should be noted that, the alarm condition may be a customized operation rule, which is used to limit what condition triggers an alarm, and in practical application, the alarm condition may be flexibly set according to specific requirements, and is not limited to the above three modes.

Alternatively, the alert notification may include the level, type, and event content of the abnormal event.

By way of example, the level of an abnormal event may be classified into four categories, severity, importance, warning and notification, wherein severity indicates that the device or a certain function of the device is completely unavailable; important means that the status of the monitoring item has affected the normal use of the device or function; the warning indicates that the status of the monitored item, although usable, has exceeded the recommended range; the notification indicates that the monitored item has changed from the historical value and alerts the user to view or pay attention to. For example, when a device is offline, the device is already completely unavailable, so it can be defined as a severity level exception event; CPU usage, such as greater than 95%, which has affected normal use of the device, can be defined as an abnormal event of importance level; the device memory card will be full, say will be over 90%, at which point the device is still usable but has been out of the recommended range, so it can be defined as an abnormal event at the warning level; the number of face shots reported by the device in the current reporting time period is changed relative to the historical data, for example, the average number of people in the industrial park shot by the last three weeks is 300, the average number of people in the industrial park shot by the current three weeks is 20, and the user can be reminded of the event, so that the event is defined as an abnormal event of a notification level. Of course, in practical application, the alarm notification may be defined according to a specific application scenario, which is only an example and not limiting of the present application.

By way of example, the type of the abnormal event may be, for example, a data type of the monitoring item, such as CPU usage, number of face shots, quality of shots, and the like; the event content of an abnormal event may be, for example, a qualitative or quantitative judgment of a specific event, a qualitative notification such as an excessively high CPU usage rate, or a quantitative notification such as a CPU usage rate reaching 95%.

In step S303, the notification information may include, for example, an object of alarm notification, notification frequency, notification mode, etc., so in this step, taking face snapshot as an example, the monitoring item may be, for example, the number of face snapshots, the alarm condition is that the ring ratio increase rate is abnormal, the attention device is assumed to be a monitoring camera of an industrial park, if the average value of the number of face snapshots per monday is about 300, and the average value of the number of face snapshots per monday suddenly drops to 20, at this time, it may be determined that the ring ratio increase rate of the average value of the number of face snapshots is abnormal, so that an abnormal event may be determined to occur, at this time, notification information may be generated to remind the user to view attention.

By setting the alarm notification in the above manner, a user can more clearly know the abnormal state of the current attention device, and the efficient abnormal investigation can be realized.

S307, when the abnormal event of the attention device is determined, the cloud server processes the abnormal event based on a pre-configured abnormality solving strategy.

The description of step S204 in the foregoing embodiment is also applicable to this step, and will not be repeated here.

In addition, the anomaly resolution policy is configured with an anomaly event set and a resolution policy corresponding to an anomaly event in the anomaly event set. When the abnormal event of the attention device belongs to the abnormal event set, outputting a solution strategy corresponding to the abnormal event of the attention device according to the abnormal event of the attention device and the abnormal solution strategy.

As a possible implementation manner, some parameter templates may be preset, and for an abnormal event of the attention device, a user may complete processing of the abnormal event by simply applying the templates.

The abnormal event is, for example, that the CPU utilization rate is too high, and the corresponding abnormal solution decision is slightly and automatically adjusted to the application running condition of the concerned equipment; or the abnormal event is such as the excessive quality of the face snapshot, the corresponding abnormal solution decision is slightly based on the historical configuration of the concerned equipment, and the parameters of the abnormal event are adjusted so as to improve the shooting quality and the like. In fact, the method provides a template for solving the abnormal event for the user, so that when the abnormal event happens, the abnormal condition of the concerned equipment can be solved without manually adjusting parameters and only by applying the template, the operation is simple, and the abnormal condition of the concerned equipment is processed more efficiently.

Illustratively, the exception resolution policy may be implemented in the form of a decision tree. For example, if the number of face shots drops sharply as in the above example, the anomaly resolution policy may prompt the user to check whether the device data of the attention device is normal, such as first prompting the user to observe whether the device is offline, if not, prompting the user to check the real-time monitoring video of the attention device to determine whether the number of shots drops sharply due to the change of the angle of the attention device, and prompting the user to check whether the service data of the attention device is normal, such as whether the current lighting condition of the attention device is normal, and if the lighting condition is abnormal, providing some parameter configuration templates for the user, so that the user can complete the configuration without having professional knowledge. Of course, user-defined options can be provided for the user, so that the user can configure the device according to actual use scenes and requirements, and the device is flexible and convenient.

Optionally, if the above-mentioned abnormal event is not found in the abnormal event set, an alternative solution policy may be preset, for example, please find a professional to assist in solving, etc. to help the user solve the fault, and since the user may not be a professional, for some abnormal events, the user cannot solve or solve the problem with time and effort, and providing an alternative solution decision slightly helps to achieve more efficient abnormal troubleshooting.

Optionally, when it is determined that the attention device does not have an abnormal event, a prompt message may be further output, where the prompt message is used to prompt the user that the attention device does not have an abnormal event. For example, the user can be prompted in the form of a dialog box, the current device runs well and the like, so that the user can know the state of the concerned device conveniently, and the user experience can be improved.

Fig. 3B is a flowchart illustrating an anomaly detection method according to an embodiment of the present application. As shown in fig. 3B, the AI device side may be the monitored device described above, for example, there may be a camera, a gate, etc., the AI device side performs data reporting, the cloud end completes data collection, then performs extraction and aggregation on the data, in AI reasoning, analysis on the collected data is completed through stream calculation, a visual/speech model, an inference engine, etc., and then performs anomaly detection, specifically, based on anomaly detection operators, for example, a threshold, a sudden rise and fall of a monitored item, a same-loop ratio anomaly of the monitored item, an accumulated variation anomaly of the monitored item, etc., and finally performs decision through event awareness, where the decision may be based on rules or based on models as described above. The above example is similar to the embodiment corresponding to fig. 3A, for example, the step of reporting data by the AI device side is similar to step S301, the step of collecting data by the cloud server is similar to step S302, the AI reasoning is similar to steps S303-S305, the step of anomaly detection is similar to step S306, and the decision based on event awareness is similar to step S307.

The method is aimed at AI equipment with various types and regions scattered in an access system, equipment states, equipment data, service data and the like on a cloud end are collected, a large amount of collected data is analyzed in a cloud end, and because hardware types, models, installation places, scenes and illumination conditions of all equipment are different, reports are generated by combining the conditions with management information such as groups and labels (namely, the state information is presented in the step S304), a trigger alarm strategy is set, alarm information of different levels of a plurality of equipment is notified to a user in different modes, an equipment inspection guide function is provided in the system, and passive hysteresis described in the prior art is converted into active and timely problem discovery. The device inspection guide may, for example, periodically perform inspection for the monitored device under the user name to determine whether the status is abnormal. After the problems are found, an intelligent problem-finding guide is given according to the information of alarm levels, types, contents and the like, a solution is provided in the form of a decision tree, if parameters are required to be adjusted to optimize video and snapshot effects, relevant settings are directly jumped to in a system, and parameters on a remote adjustment end are supported through an agent (agent) installed on equipment, so that a closed loop from the problem finding to the problem solving is formed. The above-mentioned intelligent troubleshooting guide may be, for example, the anomaly resolution strategy implemented in the form of decision tree as described in the previous embodiment.

In the example, through collecting a large amount of AI equipment end data, intelligent analysis is carried out on the AI equipment end data, problems are judged according to an abnormal decision operator, a problem investigation guide decision is provided, the AI equipment end data is finally applied to the equipment end, an effect optimization closed loop of the equipment end and the cloud end is formed, the operation and maintenance cost of a user can be greatly reduced, and the use experience is improved. In addition, the scheme of the embodiment of the application aims at the AI equipment, performs intelligent analysis according to the model and the rule on the basis of data of mass equipment, provides a problem investigation guide, and realizes the closed loop of the cloud collaborative lifting effect.

Fig. 4 is a block diagram of an abnormality checking apparatus according to an embodiment of the present application. The abnormality checking device 400 includes:

The acquisition module 401 is configured to acquire reported data of a plurality of monitored devices;

a determining module 402, configured to determine a device of interest according to the plurality of monitored devices;

the determining module 402 is further configured to: according to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on a pre-configured alarm strategy;

a processing module 403, configured to process, when the determining module 402 determines that the device of interest has an abnormal event, the abnormal event based on a pre-configured abnormality resolution policy.

As a possible implementation manner, the alarm policy is configured with a monitoring item, a statistical manner of the monitoring item, an alarm condition corresponding to the monitoring item, and notification information for generating an alarm notification;

the determining module 402 is specifically configured to:

Determining whether the statistic value of the monitoring item of the concerned equipment meets the alarm condition corresponding to the monitoring item according to the reported data of the concerned equipment, the historical data corresponding to the reported data and the statistic mode of the monitoring item;

When the statistical value of the monitoring item is determined to meet the alarm condition corresponding to the monitoring item, determining that the attention device has the abnormal event;

And when the abnormal event occurs to the attention device, generating the alarm notification according to the notification information, wherein the alarm notification is used for reminding a user of the abnormal event occurring to the attention device.

As a possible implementation manner, the statistical value of the monitoring item meets the alarm condition corresponding to the monitoring item includes at least one of the following: the times that the statistic value of the monitoring item reaches the preset threshold exceeds the preset times, the ring ratio increase rate of the statistic value of the monitoring item is abnormal, and the accumulated change of the statistic value of the monitoring item is abnormal.

As a possible implementation, the alert notification includes the level, the type, and the event content of the abnormal event.

As a possible implementation manner, the exception solving policy is configured with an exception event set and a solving policy corresponding to an exception event in the exception event set;

the processing module 403 is specifically configured to:

when the abnormal event of the attention device belongs to the abnormal event set, outputting a solution strategy corresponding to the abnormal event of the attention device according to the abnormal event of the attention device and the abnormal solution strategy.

As a possible implementation, the processing module 403 is further configured to:

and outputting a preset solving strategy when the abnormal event of the attention device does not belong to the abnormal event set.

And when the fact that the attention device does not have the abnormal event is determined, outputting prompt information, wherein the prompt information is used for prompting a user that the attention device does not have the abnormal event.

As a possible implementation manner, the report data includes device data and service data, the device data reflects the operation condition of the monitored device, and the service data reflects the service execution condition of the monitored device.

As an alternative embodiment, the apparatus 400 further includes an acquisition module based on the embodiment shown in fig. 4;

The acquisition module is used for acquiring management information, and the management information comprises a label of the attention device;

the determining module 402 is specifically configured to:

and screening out the attention device from the monitored devices according to the management information.

As a possible implementation manner, the management information further includes the monitoring item for configuring the alarm policy, a statistical manner of the monitoring item, an alarm condition corresponding to the monitoring item, and the notification information for generating an alarm notification;

The apparatus also includes a configuration module for configuring the alert policy based on the management information.

As an alternative embodiment, on the basis of the embodiment shown in fig. 4, the apparatus 400 further includes an output module, configured to output, according to the monitoring item and the statistic value of the monitoring item, state information of the device of interest, where the state information is used to reflect an operation state of the device of interest.

As a possible implementation manner, the output module is specifically configured to:

The status information is presented to the user in a graphical form.

According to an embodiment of the present application, there is also provided a computer program product comprising: a computer program stored in a readable storage medium, from which at least one processor of an electronic device can read, the at least one processor executing the computer program causing the electronic device to perform the solution provided by any one of the embodiments described above.

According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

As shown in fig. 5, a block diagram of an electronic device of a method of anomaly investigation according to an embodiment of the present application. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the applications described and/or claimed herein.

As shown in fig. 5, the electronic device includes: one or more processors 501, memory 502, and interfaces for connecting components, including high-speed interfaces and low-speed interfaces. The various components are interconnected using different buses and may be mounted on a common motherboard or in other manners as desired. The processor may process instructions executing within the electronic device, including instructions stored in or on memory to display graphical information of the GUI on an external input/output device, such as a display device coupled to the interface. In other embodiments, multiple processors and/or multiple buses may be used, if desired, along with multiple memories. Also, multiple electronic devices may be connected, each providing a portion of the necessary operations (e.g., as a server array, a set of blade servers, or a multiprocessor system). One processor 501 is illustrated in fig. 5.

Memory 502 is a non-transitory computer readable storage medium provided by the present application. The memory stores instructions executable by at least one processor to cause the at least one processor to perform the anomaly investigation method provided by the present application. The non-transitory computer readable storage medium of the present application stores computer instructions for causing a computer to execute the abnormality investigation method provided by the present application.

The memory 502 is used as a non-transitory computer readable storage medium for storing non-transitory software programs, non-transitory computer executable programs, and modules, such as program instructions/modules (e.g., the acquisition module 401, the determination module 402, and the processing module 403 shown in fig. 4) corresponding to the abnormality detection method in the embodiment of the present application. The processor 501 executes various functional applications of the server and data processing, that is, implements the abnormality detection method in the above-described method embodiment, by running non-transitory software programs, instructions, and modules stored in the memory 502.

Memory 502 may include a storage program area that may store an operating system, at least one application program required for functionality, and a storage data area; the storage data area may store data created according to the use of the abnormality-checking electronic device, or the like. In addition, memory 502 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 502 may optionally include memory located remotely from processor 501, which may be connected to the troubleshooting electronics via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The electronic device of the abnormality investigation method may further include: an input device 503 and an output device 504. The processor 501, memory 502, input devices 503 and output devices 504 may be connected by a bus or otherwise, for example in fig. 5.

The input device 503 may receive input numeric or character information and generate key signal inputs related to user settings and function control of the troubleshooting electronic device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, a pointer stick, one or more mouse buttons, a track ball, a joystick, and the like. The output devices 504 may include a display device, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors), among others. The display device may include, but is not limited to, a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display, and a plasma display. In some implementations, the display device may be a touch screen.

Various implementations of the systems and techniques described here can be realized in digital electronic circuitry, integrated circuitry, application specific ASIC (application specific integrated circuit), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

These computer programs (also known as programs, software applications, or code) include machine instructions for a programmable processor, and can be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and/or device (e.g., magnetic discs, optical disks, memory, programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present application may be performed in parallel, sequentially, or in a different order, provided that the desired results of the disclosed embodiments are achieved, and are not limited herein.

The above embodiments do not limit the scope of the present application. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the scope of the present application.

Claims

1. An anomaly investigation method, comprising:

collecting reporting data of a plurality of monitored devices; the monitored equipment is AI equipment with visual perception capability;

Acquiring management information input by a user through terminal equipment after collecting reported data of a plurality of monitored equipment, wherein the management information comprises a tag of the concerned equipment, monitoring items for configuring an alarm strategy, statistical modes of the monitoring items, alarm conditions corresponding to the monitoring items and notification information for generating alarm notifications; the monitoring items comprise the number of snap shots; the notification information comprises an object of alarm notification, notification frequency and notification mode;

Screening out the attention device from the monitored devices according to the labels; wherein each tag corresponds to at least one device of interest;

Configuring an alarm strategy of the attention device based on the management information, wherein a monitoring item, a statistical mode of the monitoring item, an alarm condition corresponding to the monitoring item and notification information for generating an alarm notification are configured in the alarm strategy;

According to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on the alarm strategy;

Outputting a solution strategy corresponding to the abnormal event of the attention device based on a pre-configured abnormality solution strategy when the abnormal event of the attention device is determined to belong to an abnormal event set; the abnormal solving strategy is configured with the abnormal event set and the solving strategy corresponding to the abnormal event in the abnormal event set;

2. The method of claim 1, wherein the determining an abnormal condition of the device of interest comprises:

3. The method of claim 2, wherein the statistic of the monitoring item meeting the alarm condition corresponding to the monitoring item comprises at least one of: the times that the statistic value of the monitoring item reaches the preset threshold exceeds the preset times, the ring ratio increase rate of the statistic value of the monitoring item is abnormal, and the accumulated change of the statistic value of the monitoring item is abnormal.

4. The method of claim 2, wherein the alert notification includes a level, a type, and event content of the abnormal event.

5. The method of claim 2, wherein the screening out the device of interest from the plurality of monitored devices further comprises:

and outputting the state information of the attention equipment according to the monitoring item and the statistic value of the monitoring item, wherein the state information is used for reflecting the running state of the attention equipment.

6. The method of claim 5, wherein the outputting the status information of the device of interest comprises:

The status information is presented to the user in a graphical form.

7. The method of any of claims 1-6, further comprising:

8. The method of any of claims 1-6, wherein the reporting data includes device data reflecting an operational condition of the monitored device and business data reflecting a business execution condition of the monitored device.

9. An abnormality troubleshooting device comprising:

The acquisition module is used for acquiring the reported data of the monitored devices; the monitored equipment is AI equipment with visual perception capability;

The acquisition module is used for acquiring management information input by a user through the terminal equipment after collecting the reported data of the monitored equipment, wherein the management information comprises a label of the concerned equipment, a monitoring item used for configuring an alarm strategy, a statistical mode of the monitoring item, an alarm condition corresponding to the monitoring item and notification information used for generating an alarm notification; the monitoring items comprise the number of snap shots; the notification information comprises an object of alarm notification, notification frequency and notification mode;

The determining module is used for screening out the attention device from the monitored devices according to the management information; configuring an alarm policy of the device of interest based on the management information; the alarm strategy is configured with a monitoring item, a statistical mode of the monitoring item, alarm conditions corresponding to the monitoring item and notification information for generating an alarm notification; wherein each tag corresponds to at least one device of interest;

The determining module is further configured to: according to the reported data of the concerned equipment and the historical data corresponding to the reported data, determining the abnormal condition of the concerned equipment based on the alarm strategy;

the processing module is used for outputting a solution strategy corresponding to the abnormal event of the attention device based on a pre-configured abnormal solution strategy when the determination module determines that the abnormal event of the attention device belongs to an abnormal event set; the abnormal solving strategy is configured with the abnormal event set and the solving strategy corresponding to the abnormal event in the abnormal event set; and outputting a preset solving strategy when the abnormal event of the attention device does not belong to the abnormal event set.

10. The device of claim 9, wherein a monitoring item, a statistical manner of the monitoring item, an alarm condition corresponding to the monitoring item and notification information for generating an alarm notification are configured in the alarm policy;

the determining module is specifically configured to:

11. The apparatus of claim 10, wherein the statistic of the monitoring item meeting the alarm condition corresponding to the monitoring item comprises at least one of: the times that the statistic value of the monitoring item reaches the preset threshold exceeds the preset times, the ring ratio increase rate of the statistic value of the monitoring item is abnormal, and the accumulated change of the statistic value of the monitoring item is abnormal.

12. The apparatus of claim 10, wherein the alert notification includes a level, a type, and event content of the abnormal event.

13. The apparatus of claim 10, further comprising an output module to output status information of the device of interest based on the monitored item and a statistical value of the monitored item, the status information to reflect an operational status of the device of interest.

14. The apparatus of claim 13, wherein the output module is specifically configured to:

The status information is presented to the user in a graphical form.

15. The apparatus of any of claims 9-14, wherein the processing module is further to:

16. The apparatus of any of claims 9-14, wherein the reporting data includes device data reflecting an operational condition of the monitored device and service data reflecting a service execution condition of the monitored device.

17. An electronic device, comprising:

at least one processor; and

A memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.

18. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any one of claims 1-8.