1、 The current status of data detection in monitoring and alarm systems Most of the existing monitoring and alarm systems use manual setting of rules or thresholds to achieve this. In some cases, these methods are indeed simple and effective, but in medium to large business systems, we often face a larger number of KPIs, more complex correlations between KPIs, and more diverse KPI types (as shown in the following figure: constant value type, periodic type, continuous fluctuation type, etc.). Facing such a scenario, if we continue to use manual rule or threshold setting methods for detection, it will not only consume a large amount of time cost, but also easily lead to false alarms and missed alarms. Before introducing a specific detection plan, let's first understand indicator anomaly detection Secondly, single indicator detection and multi indicator detection. In the field of operation and maintenance, indicator anomaly detection can be divided into single indicator anomaly detection and multi indicator anomaly detection according to different scenarios and application requirements. 1. Single indicator anomaly detection ● Detection principle: focuses on whether the value of a certain KPI is abnormal. For example, KPI mutations, jitters, etc. Abnormal scenario: Single indicator anomalies are mainly caused by sudden significant changes in KPI values. For example, sudden increase in CPU usage, sudden decrease in memory, etc. Detection methods: In the industry, there are two main methods for single indicator anomaly detection: statistical and predictive