CN112860968A - Abnormity detection method and device - Google Patents
Abnormity detection method and device Download PDFInfo
- Publication number
- CN112860968A CN112860968A CN202110144471.XA CN202110144471A CN112860968A CN 112860968 A CN112860968 A CN 112860968A CN 202110144471 A CN202110144471 A CN 202110144471A CN 112860968 A CN112860968 A CN 112860968A
- Authority
- CN
- China
- Prior art keywords
- detection model
- anomaly detection
- node
- service data
- tree structure
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/906—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/24323—Tree-organised classifiers
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Databases & Information Systems (AREA)
- Debugging And Monitoring (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The specification discloses a method and a device for detecting an anomaly, which are used for acquiring service data of a user in a current service period, classifying the service data according to data intervals corresponding to nodes contained in each pre-trained anomaly detection model so as to determine the nodes corresponding to the data intervals in which the service data fall, and using the nodes as target nodes. And then, determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model. And finally, performing anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model. The method can detect the abnormality of the service data in real time, quickly determine whether the service data is abnormal or not, improve the speed of detecting the abnormality of the service data of the user in the current service period and improve the efficiency of service processing.
Description
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method and an apparatus for anomaly detection.
Background
With the rapid development of internet technology, the growth of internet services leads to a great increase in the amount of service data, and therefore, more and more abnormal data are generated.
At present, a system usually adopts modes of manual discovery, timing detection of historical data and the like for generated abnormal data. When the real-time requirement on the processing result is high, the problem that the abnormal data is found for a long time is often caused, and when the abnormal data cannot be found in time, the benefit of the user may be damaged, which brings inconvenience to the service processing of the user.
Therefore, how to detect abnormal data in real time is an urgent problem to be solved.
Disclosure of Invention
The present specification provides a method, an apparatus, a storage medium, and an electronic device for anomaly detection, which partially solve the above problems in the prior art.
The technical scheme adopted by the specification is as follows:
the present specification provides a method of anomaly detection, comprising:
acquiring service data of a user in a current service period;
classifying the service data according to data intervals corresponding to all nodes contained in each pre-trained anomaly detection model to determine nodes corresponding to the data intervals in which the service data fall as target nodes, wherein the anomaly detection model comprises a root node and a plurality of leaf nodes, and the root node and the leaf nodes contained in the anomaly detection model form a tree structure corresponding to the anomaly detection model;
determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model;
and carrying out anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model.
Optionally, performing anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model, specifically including:
for each anomaly detection model, determining an anomaly characterization value corresponding to the service data in the anomaly detection model according to the position information corresponding to the service data in the anomaly detection model, wherein if the target node is closer to a root node contained in a tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is higher, and if the target node is farther from the root node contained in the tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is lower;
and carrying out anomaly detection on the service data according to the corresponding anomaly characterization value of the service data in each anomaly detection model.
Optionally, training each anomaly detection model in advance specifically includes:
acquiring a training sample set and a verification set, wherein the training sample set is constructed by acquiring service data of each user in each historical service period;
aiming at each abnormal detection model, dividing at least part of training samples contained in the training sample set to construct a tree structure corresponding to the abnormal detection model, wherein the tree structure corresponding to the constructed abnormal detection model comprises a plurality of constructed nodes and a data interval corresponding to each node;
classifying the verification samples by the aid of the tree structure corresponding to each constructed abnormal detection model aiming at each verification sample contained in the verification set to obtain abnormal detection results corresponding to the verification samples;
and adjusting the tree structure corresponding to each abnormal detection model according to the abnormal detection result corresponding to each verification sample contained in the verification set and the abnormal sample contained in the verification set so as to train each abnormal detection model.
Optionally, the method further comprises:
obtaining service data of each user in the current service period as supplementary service data;
adjusting the training sample set corresponding to each abnormal detection model according to the supplementary service data to obtain an adjusted training sample set;
adjusting each abnormal detection model through the adjusted training sample set to obtain each adjusted abnormal detection model;
and performing anomaly detection on the acquired service data of the user in the next service period through each adjusted anomaly detection model.
Optionally, according to the supplementary service data, adjusting the training sample set corresponding to each anomaly detection model to obtain an adjusted training sample set, which specifically includes:
determining a historical service period which is farthest away from the time length of the current service period from the training sample set as a target historical service period;
and adjusting the training sample set by deleting the service data corresponding to the target historical service period from the training sample set and adding the supplementary service data into the training sample set.
Optionally, adjusting each abnormal detection model through the adjusted training sample set to obtain each adjusted abnormal detection model, which specifically includes:
for each abnormal detection model, determining a node constructed by the service data corresponding to the target historical service period in the process of training the abnormal detection model from the tree structure corresponding to the abnormal detection model as a node to be deleted;
deleting the node to be deleted from the tree structure corresponding to the anomaly detection model, and taking another child node of the parent node corresponding to the node to be deleted as the parent node corresponding to the node to be deleted to obtain the tree structure to be adjusted corresponding to the anomaly detection model;
and adjusting the tree structure to be adjusted corresponding to the anomaly detection model through the adjusted training sample set to obtain an adjusted anomaly detection model corresponding to the anomaly detection model.
Optionally, the adjusting the to-be-adjusted tree structure corresponding to the anomaly detection model through the adjusted training sample set to obtain an adjusted anomaly detection model corresponding to the anomaly detection model, and specifically includes:
for each node contained in the tree structure to be adjusted, if the node is not connected with a child node, and at least two service data contained in the supplementary service data are determined to fall into a data interval corresponding to the node, dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node, so as to obtain a new child node corresponding to the node;
and adjusting the tree structure to be adjusted corresponding to the anomaly detection model according to the new-added sub-node corresponding to each node contained in the tree structure to be adjusted to obtain an adjusted anomaly detection model corresponding to the anomaly detection model.
Optionally, dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node, so as to obtain a new-added child node corresponding to the node, specifically including:
judging whether the position of the node in the tree structure to be adjusted meets a preset condition or not;
if so, dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node to obtain a new-added child node corresponding to the node, otherwise, not dividing the data interval corresponding to the node.
The present specification provides an apparatus for anomaly detection, comprising:
the acquisition module is used for acquiring the service data of the user in the current service period;
the classification module is used for classifying the service data according to data intervals corresponding to all nodes contained in each pre-trained anomaly detection model so as to determine the nodes corresponding to the data intervals in which the service data fall, wherein the anomaly detection model contains one root node and a plurality of leaf nodes, and the root node and the plurality of leaf nodes contained in the anomaly detection model form a tree structure corresponding to the anomaly detection model;
a determining module, configured to determine location information of the target node in a tree structure corresponding to the anomaly detection model, as the location information corresponding to the service data in the anomaly detection model;
and the detection module is used for carrying out abnormity detection on the service data according to the position information corresponding to the service data in each abnormity detection model.
The present specification provides a computer-readable storage medium storing a computer program which, when executed by a processor, implements the above-described method of anomaly detection.
The present specification provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the above-mentioned method of anomaly detection when executing the program.
The technical scheme adopted by the specification can achieve the following beneficial effects:
in the method for detecting an anomaly provided in this specification, service data of a user in a current service period is acquired, and for each anomaly detection model trained in advance, the service data is classified according to a data interval corresponding to each node included in the anomaly detection model to determine a node corresponding to the data interval in which the service data falls, as a target node, wherein the anomaly detection model includes a root node and a plurality of leaf nodes, and the root node and the plurality of leaf nodes included in the anomaly detection model form a tree structure corresponding to the anomaly detection model. And then, determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model. And finally, performing anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model.
The method can be seen in that the method can perform anomaly detection on the service data in real time based on the service data of the user in the current service period, and quickly determine whether the service data is abnormal according to the position information of the target node corresponding to the service data in the tree structure corresponding to the anomaly detection model.
Drawings
The accompanying drawings, which are included to provide a further understanding of the specification and are incorporated in and constitute a part of this specification, illustrate embodiments of the specification and together with the description serve to explain the specification and not to limit the specification in a non-limiting sense. In the drawings:
FIG. 1 is a schematic flow chart of a method for anomaly detection provided by an embodiment of the present disclosure;
fig. 2A is a schematic diagram of deleting nodes in a tree structure according to an embodiment of the present disclosure;
fig. 2B is a schematic diagram of adding nodes in a tree structure according to an embodiment of the present disclosure;
fig. 3 is a schematic structural diagram of an abnormality detection apparatus provided in an embodiment of the present disclosure;
fig. 4 is a schematic structural diagram of an electronic device provided in an embodiment of this specification.
Detailed Description
In order to make the objects, technical solutions and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below with reference to the specific embodiments of the present disclosure and the accompanying drawings. It is to be understood that the embodiments described are only a few embodiments of the present disclosure, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present specification without any creative effort belong to the protection scope of the present specification.
The technical solutions provided by the embodiments of the present description are described in detail below with reference to the accompanying drawings.
In the prior art, it is often necessary to receive service data first to generate a data set, and then to detect abnormal data of the service data in the data set, which is limited by the time for generating the data set at regular time, and the abnormal data cannot be detected in real time, which may result in that the abnormal data cannot be found in time, thereby causing the benefit of the user to be damaged and bringing inconvenience to the service processing of the user.
In order to solve the above problems, the present specification provides an anomaly detection method, in which a server acquires service data of a user in a current service cycle, and classifies the service data according to a data interval corresponding to each node included in each pre-trained anomaly detection model, so as to determine a node corresponding to a data interval in which the service data falls, as a target node. And then, determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model. And finally, performing anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model.
Compared with the prior art, the method and the device can acquire the service data of the user in the current service period, determine whether the service data is abnormal in real time, and improve the speed of abnormal detection of the abnormal detection model, so that the service processing efficiency of the user is ensured, and certain convenience is brought to the real-time service processing of the user.
Fig. 1 is a schematic flow chart of a method for detecting an abnormality provided in an embodiment of the present specification, which specifically includes the following steps:
s100: and acquiring the service data of the user in the current service period.
The main body of the abnormality detection provided in this specification may be a terminal device such as a server or a device cluster composed of a plurality of computers. For convenience of description, the method for detecting an abnormality provided in the present specification will be described below with only a server as an execution subject.
In this embodiment of the present specification, the server may obtain service data of the user in the current service period, where the service data of the current service period referred to herein may refer to service data generated when the user performs a service operation in the current time period. The time length corresponding to the current service period may be set according to actual requirements of the service, for example, for a service with a high real-time requirement, the current service period may refer to the current day, and for a service with a low real-time requirement, the current service period may refer to the current week, the current month, and the like.
The service data may refer to data involved in a service performed by a user, and for example, in a payment service, the service data may refer to an order amount paid by the user. Of course, the service data may also refer to some related data generated by the user during the service execution process, such as the number of times the user repeatedly executes the same service in a period of time, and the like. The specific form of the service data may be determined according to actual service requirements, and the specific form of the service data is not limited in this specification.
S102: and classifying the service data according to data intervals corresponding to all nodes contained in each pre-trained anomaly detection model to determine the nodes corresponding to the data intervals in which the service data fall as target nodes, wherein the anomaly detection model comprises a root node and a plurality of leaf nodes, and the root node and the leaf nodes contained in the anomaly detection model form a tree structure corresponding to the anomaly detection model.
In this embodiment, the server may use a plurality of pre-trained anomaly detection models to detect the received service data, that is, the server may classify the service data through each anomaly detection model to obtain a corresponding classification result, and then subsequently determine whether the service data is anomalous data by summarizing the classification results of the anomaly detection models.
For each anomaly detection model, the anomaly detection model may correspond to a tree structure, the tree structure includes a root node and a plurality of leaf nodes, and each node corresponds to a data interval. When the server detects the service data, a node corresponding to a data interval in which the service data falls in the tree structure, that is, a target node, may be determined, and then in a subsequent process, abnormality detection is performed on the service data based on position information of the target node in the tree structure.
In most cases, the service data of one service is more normal data, and the abnormal data is relatively less. In addition, the data range in which the abnormal data falls is obviously different from the data range in which the normal data falls. Therefore, for many normal data, it is necessary to classify many times to separate the normal data one by one, but for abnormal data, it is often necessary to perform classification a few times to separate the abnormal data from many normal data.
Therefore, for the case that the service data is abnormal data, the tree structure corresponding to the abnormal detection model is used to classify the service data, and the probability only needs a small number of times to complete the classification, so that the service data is most likely to fall into the data interval corresponding to the leaf node closer to the root node, and for the case that the service data is normal data, the tree structure corresponding to the abnormal detection model is used to classify the service data, and the probability needs to be classified many times to determine the data interval into which the service data finally falls, and accordingly, the service data is also most likely to fall into the data interval corresponding to the leaf node farther from the root node. Therefore, in the subsequent process, the server can judge whether the service data is abnormal data according to the position information of the target node in the tree structure corresponding to the data interval in which the service data falls.
In the embodiment of the present specification, after receiving a piece of service data, the server may perform anomaly detection on the service data according to each anomaly detection model trained in advance. Of course, if the data size of the service data is too large, the server may perform sampling detection from the obtained service data according to a certain proportion in order to ensure that the operation load of the server is not too large and ensure normal execution of the service. The server may sample the service data of the user in various ways, for example, a pool sampling algorithm, random undersampling and oversampling, and the description does not limit the specific way used.
For the above-mentioned anomaly detection model, pre-training is required, specifically, the server acquires a training sample set and a verification set, the training sample set is constructed by the acquired service data of each user in each historical service period, and the verification set may be a training sample set used in the training process of the anomaly detection model or a preset verification set specially used for verification.
In practical applications, since each user has a lot of service data in each historical service period, when each anomaly detection model is trained, it is impossible to train the anomaly detection models by using all the service data of each user in each historical service period as training samples. Therefore, it is necessary to select a part of the traffic data from the traffic data of each historical traffic cycle as a training sample for model training. The method for selecting part of the service data can be a sampling method with various types and no return, namely, a part of the service data is extracted from all the service data of each historical service period to be used as a training sample of an abnormality detection model, then a part of the service data is extracted from the rest service data to be used as a training sample of the next abnormality detection model, and the like. Of course, a sampling method with a pull-back function may also be used, that is, a part of service data is randomly extracted from all service data of each historical service period to serve as a training sample of an anomaly detection model, then the extracted service data is put back to all service data, and a part of service data is randomly extracted to serve as a training sample of a next anomaly detection model, and so on, and the description does not limit a specific manner.
In this embodiment, the server divides at least part of the training samples included in the training sample set for each anomaly detection model to construct a tree structure corresponding to the anomaly detection model, where the tree structure corresponding to the anomaly detection model includes a plurality of constructed nodes and a data interval corresponding to each node.
Specifically, for each anomaly detection model, the server needs to determine an overall data interval corresponding to the training samples according to the training samples included in the training sample set corresponding to the anomaly detection model, and a node corresponding to the overall data interval is a root node. And further, aiming at each sub data interval, the server can select a random value again to segment the sub data interval, so as to obtain the data interval corresponding to the two sub nodes under the condition that the node corresponding to the sub data interval is taken as a father node, and so on. The server can finally obtain a tree structure formed by a plurality of leaf nodes and a root node, wherein each node in the tree structure corresponds to a data interval.
When the server constructs the tree structure corresponding to the anomaly detection model, all training samples can be completely separated to be used as targets, and the tree structure is constructed. It should be noted that, because too many training samples are included in the training sample set, if a tree structure corresponding to the anomaly detection model is constructed by completely separating all the training samples as targets, the number of nodes included in the finally obtained tree structure is too many, that is, the depth of the tree structure is too large, which may affect the anomaly detection efficiency in the subsequent practical application. Moreover, as can be seen from the above, what has effectively detected the abnormal data is the leaf node closer to the root node in the tree structure. Therefore, it is also required that the depth of the tree structure is not necessarily too large, and it is only necessary to ensure that the tree structure can distinguish the abnormal data.
Therefore, in the embodiment of the present specification, the depth of the tree structure may be limited in advance, that is, one set tree structure depth may be set, and therefore, when constructing the tree structure corresponding to the abnormality detection model by using the training samples in the training sample set, if it is determined that the depth of the tree structure has reached the set tree structure depth, it may be stopped to continue dividing the data section corresponding to the leaf node farthest from the root node (that is, the leaf node reaching the set tree structure depth).
In this embodiment of the present specification, after the server constructs the tree structure corresponding to each anomaly detection model in the above manner, the server may use the verification set to check each anomaly detection model. Specifically, the server may classify each verification sample included in the verification set according to the tree structure corresponding to each constructed anomaly detection model, to obtain an anomaly detection result corresponding to the verification sample, where the anomaly detection result is position information of a node corresponding to a data interval in which the verification sample finally falls in the tree structure, that is, a depth of the node in the tree structure. Then, the server can adjust the tree structure corresponding to each anomaly detection model according to the anomaly detection result corresponding to each verification sample contained in the verification set and the anomaly sample contained in the verification set, so as to train each anomaly detection model.
The server can adjust the tree structure corresponding to each abnormal detection model according to whether the abnormal detection result corresponding to each verification sample meets the actual result corresponding to the verification sample. Of course, the server may also adjust the tree structure corresponding to each anomaly detection model according to whether the proportion of the anomaly samples in the verification samples detected in the verification set conforms to the actual proportion occupied by the anomaly samples in the verification set, until the trained anomaly detection model meets the actual requirement.
It can be seen from the above training process that the so-called training actually includes two parts, one is to construct a tree structure corresponding to each anomaly detection model by using the sample training set, and the other is to adjust the tree structure by using the verification set. The adjustment of the tree structure mainly relates to the adjustment of the distribution condition of each node in the tree structure and the adjustment of the data interval corresponding to each node. The adjustment process of the tree structure may also be regarded as a process of reconstructing the tree structure, that is, if it is determined through the verification set that the tree structure currently constructed for each abnormal detection model does not conform to the detection target corresponding to the verification set, the training sample set corresponding to each abnormal detection model may be constructed through the acquired service data of each user in each historical service period, and then the tree structure corresponding to each abnormal detection model is reconstructed through the constructed training sample set until the tree structure corresponding to each reconstructed abnormal detection model can conform to the detection target corresponding to the verification set.
S104: and determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model.
S106: and carrying out anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model.
In this embodiment of the present specification, the server determines location information of the target node in the tree structure corresponding to the anomaly detection model as location information corresponding to the service data in the anomaly detection model, and performs anomaly detection on the service data according to the location information corresponding to the service data in each anomaly detection model, where the location information may refer to a depth of the target node in the tree structure corresponding to the anomaly detection model.
Further, for each anomaly detection model, the server may determine an anomaly characterization value corresponding to the service data in the anomaly detection model according to the position information corresponding to the service data in the anomaly detection model. If the target node is closer to the root node included in the tree structure corresponding to the anomaly detection model, the higher the anomaly characterization value corresponding to the service data in the anomaly detection model, and correspondingly, the higher the possibility that the service data is the anomaly data, and if the target node is farther from the root node included in the tree structure corresponding to the anomaly detection model, the lower the anomaly characterization value corresponding to the service data in the anomaly detection model, and correspondingly, the lower the possibility that the service data is the anomaly data.
It should be noted that, in the tree structure corresponding to each anomaly detection model, the data interval corresponding to each divided node has a certain randomness, so for an anomaly data, the node of the anomaly data in the tree structure corresponding to some anomaly detection models may be closer to the root node, and the node of the anomaly data in the tree structure corresponding to other anomaly detection models may be farther from the root node. However, compared to the normal data, in the tree structure corresponding to all the anomaly detection models, the nodes where the anomaly data is located are relatively close to the root node as a whole.
Therefore, after determining that the service data corresponds to the abnormal characteristic value in each abnormal detection model, the server may determine an average abnormal characteristic value corresponding to the service data in each abnormal detection model, and detect the service data through the average abnormal characteristic value. If the average abnormal characteristic value is determined to be not lower than the set threshold, the service data can be determined to be abnormal data, and if the average abnormal characteristic value is determined to be lower than the set threshold, the service data can be determined to be normal data.
Of course, the server may also detect the service data in other manners. For example, after determining that the service data corresponds to the abnormal characteristic values in each abnormal detection model, the server may determine the number of the abnormal characteristic values higher than a set threshold, and if the number exceeds the set number, may determine that the service data is abnormal data, otherwise, determine that the service data is normal data. Other ways are not necessarily illustrated here.
It should be noted that, in order to ensure accuracy of the anomaly detection, in the embodiment of the present specification, the server may use the acquired service data of each user in the current service period as supplementary service data, and add the supplementary service data into the training sample set. That is, the server continuously obtains new real-time service data, takes the service data as supplementary service data, adds the supplementary service data in the training sample set, adjusts the training sample set corresponding to each anomaly detection model, and obtains the adjusted training sample set.
In practical application, a service may be continuously updated iteratively, correspondingly, service data corresponding to the service may also be changed to some extent, and in order to ensure that each anomaly detection model can adapt to the continuous change of the service, the supplementary service data may be added to a training sample set, and at the same time, a historical service period having a longest time length from a current service period is determined from the training sample set as a target historical service period, and then the service data corresponding to the target historical service period is deleted from the training sample set, so as to adjust the training sample set.
The service data corresponding to the target historical service period may be considered as service data with a relatively low degree of conformity with the current service. The adjustment training sample set obtained in the way is used for adjusting each abnormal detection model, so that the abnormal detection model after adjustment can be ensured to be matched with the current service, and the adaptation range of the tree structure corresponding to the abnormal detection model after adjustment to abnormal data can be ensured not to be increased to a certain extent, thereby effectively ensuring the accuracy of abnormal detection.
And deleting or adding the nodes in the tree structure corresponding to each abnormal detection model by the server through the adjusted training sample set. As shown in fig. 2A.
Fig. 2A is a schematic diagram of deleting nodes in a tree structure according to an embodiment of the present disclosure.
In this embodiment, for each anomaly detection model, the server determines, from the tree structure corresponding to the anomaly detection model, a node constructed by the service data corresponding to the target historical service period when the anomaly detection model is trained, as a node to be deleted, such as the X node in fig. 2A. The server may then delete node X and replace node B with node C.
It should be noted that a node located at the maximum depth in the tree structure may correspond to one data interval, and the service data corresponding to the target historical service period may be only one of the data intervals, for this case, the server may not delete the node corresponding to the service data, that is, the tree structure is not changed.
In an embodiment of the present specification, the server adjusts the tree structure to be adjusted corresponding to the anomaly detection model through the adjusted training sample set, so as to obtain an adjusted anomaly detection model corresponding to the anomaly detection model. Wherein the addition of nodes in the tree structure may be involved in adapting the anomaly detection model, as shown in fig. 2B.
Fig. 2B is a schematic diagram of adding nodes in a tree structure according to an embodiment of the present disclosure.
In this embodiment, in terms of each node included in the tree structure to be adjusted, if the node is not connected with a child node (node B in the drawing), and it is determined that at least two pieces of service data included in the supplementary service data fall into the data interval corresponding to the node, the data interval corresponding to the node is divided according to the service data falling into the data interval corresponding to the node, so as to obtain a new-added child node (node C in the drawing and node X in the drawing) corresponding to the node, and further, according to the new-added child node corresponding to each node included in the tree structure to be adjusted, the tree structure to be adjusted corresponding to the anomaly detection model is adjusted, so as to obtain an adjusted anomaly detection model corresponding to the anomaly detection model. Correspondingly, the server can perform anomaly detection on the acquired service data of the user in the next service period through each adjusted anomaly detection model.
It should be noted that, in practical applications, the server may delete all nodes in the tree structure during the process of deleting the training samples, and in this case, the server may reconstruct the tree structure according to the adjusted training sample set.
The server judges whether the position of the node in the tree structure to be adjusted meets a preset condition, the preset condition refers to whether the position of the node in the tree structure to be adjusted does not reach a set tree structure depth, if yes, the data interval corresponding to the node is divided according to the service data falling into the data interval corresponding to the node so as to obtain a new sub-node corresponding to the node, and otherwise, the data interval corresponding to the node is not divided.
It can be seen from the above process that the server can perform anomaly detection on the service data in real time based on the service data of the user in the current service period, can add the supplementary service data into the training sample set, delete the service data corresponding to the target historical service period with relatively low degree of conformity with the current service, adjust each anomaly detection model through the obtained adjusted training sample set, firstly, can ensure that each adjusted anomaly detection model can be conformed with the current service, secondly, can ensure that the adaptation range of the tree structure corresponding to each adjusted anomaly detection model to the anomaly data is not increased to a certain extent, thereby effectively ensuring the accuracy of anomaly detection, the server can set a set tree structure depth, if it is determined that the depth of the tree structure has reached the set tree structure depth, the data interval corresponding to the leaf node reaching the set tree structure depth can be stopped from being continuously divided, so that the calculation efficiency of the anomaly detection model is accelerated, the service processing efficiency of the user is ensured, and certain convenience is brought to the real-time service processing of the user.
Based on the same idea, the foregoing method for detecting an abnormality provided for one or more embodiments of the present specification further provides a corresponding apparatus for detecting an abnormality, as shown in fig. 3.
Fig. 3 is a schematic structural diagram of an abnormality detection apparatus provided in an embodiment of the present specification, which specifically includes:
an obtaining module 300, configured to obtain service data of a user in a current service period;
a classification module 302, configured to classify, for each pre-trained anomaly detection model, the service data according to a data interval corresponding to each node included in the anomaly detection model, so as to determine a node corresponding to the data interval in which the service data falls, where the node is used as a target node, where the anomaly detection model includes one root node and multiple leaf nodes, and the root node and the multiple leaf nodes included in the anomaly detection model form a tree structure corresponding to the anomaly detection model;
a determining module 304, configured to determine location information of the target node in a tree structure corresponding to the anomaly detection model, as the location information corresponding to the service data in the anomaly detection model;
the detection module 306 is configured to perform anomaly detection on the service data according to the position information corresponding to the service data in each anomaly detection model.
Optionally, the detecting module 306 is specifically configured to, for each anomaly detection model, determine an anomaly characterization value corresponding to the service data in the anomaly detection model according to the position information corresponding to the service data in the anomaly detection model, where if the target node is closer to a root node included in a tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is higher, and if the target node is farther from the root node included in the tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is lower, and perform anomaly detection on the service data according to the anomaly characterization value corresponding to the service data in each anomaly detection model.
Optionally, the classification module 302 is specifically configured to obtain a training sample set and a verification set, where the training sample set is constructed by obtaining service data of each user in each historical service cycle, divide at least part of training samples included in the training sample set for each anomaly detection model to construct a tree structure corresponding to the anomaly detection model, the constructed tree structure corresponding to the anomaly detection model includes a plurality of constructed nodes and a data interval corresponding to each node, and for each verification sample included in the verification set, classify the verification sample by the constructed tree structure corresponding to each anomaly detection model to obtain an anomaly detection result corresponding to the verification sample, and according to the anomaly detection result corresponding to each verification sample included in the verification set, and adjusting the tree structure corresponding to each abnormal detection model by the abnormal samples contained in the verification set so as to train each abnormal detection model.
Optionally, the detecting module 306 is specifically configured to, use the obtained service data of each user in the current service period as supplementary service data, adjust the training sample set corresponding to each anomaly detection model according to the supplementary service data to obtain an adjusted training sample set, adjust each anomaly detection model through the adjusted training sample set to obtain each adjusted anomaly detection model, and perform anomaly detection on the obtained service data of the user in the next service period through each adjusted anomaly detection model.
Optionally, the detecting module 306 is specifically configured to determine, from the training sample set, a historical service period farthest from the time length of the current service period, as a target historical service period, delete service data corresponding to the target historical service period from the training sample set, and add the supplementary service data to the training sample set, so as to adjust the training sample set.
Optionally, the detecting module 306 is specifically configured to, for each anomaly detection model, determine, from a tree structure corresponding to the anomaly detection model, a node constructed through service data corresponding to the target historical service period when the anomaly detection model is trained, as a node to be deleted, delete the node to be deleted from the tree structure corresponding to the anomaly detection model, use another child node of a parent node corresponding to the node to be deleted as the parent node corresponding to the node to be deleted, obtain a tree structure to be adjusted corresponding to the anomaly detection model, and adjust the tree structure to be adjusted corresponding to the anomaly detection model through the adjusted training sample set, so as to obtain an adjusted anomaly detection model corresponding to the anomaly detection model.
Optionally, the detecting module 306 is specifically configured to, for each node included in the tree structure to be adjusted, if the node is not connected with a child node, and it is determined that at least two pieces of service data included in the supplementary service data fall into a data interval corresponding to the node, divide the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node to obtain a new augmented child node corresponding to the node, and adjust the tree structure to be adjusted corresponding to the abnormal detection model according to the new augmented child node corresponding to each node included in the tree structure to be adjusted, to obtain an adjusted abnormal detection model corresponding to the abnormal detection model.
Optionally, the detecting module 306 is specifically configured to determine whether a position of the node in the tree structure to be adjusted meets a preset condition, if so, divide the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node to obtain a new incremental node corresponding to the node, and otherwise, not divide the data interval corresponding to the node.
The present specification also provides a computer readable storage medium having stored thereon a computer program operable to perform the method of anomaly detection provided in fig. 1 above.
The present specification also provides a schematic structural diagram of the electronic device shown in fig. 4. As shown in fig. 4, at the hardware level, the apparatus of the method for detecting an exception includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, but may also include hardware required by other services. The processor reads a corresponding computer program from the non-volatile memory into the memory and then runs the computer program to implement the method for detecting an abnormality described in fig. 1. Of course, besides the software implementation, the present specification does not exclude other implementations, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, and may be hardware or logic devices.
In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Hardware Description Language), traffic, pl (core universal Programming Language), HDCal (jhdware Description Language), lang, Lola, HDL, laspam, hardward Description Language (vhr Description Language), vhal (Hardware Description Language), and vhigh-Language, which are currently used in most common. It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.
The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic for the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may thus be considered a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functions of the various elements may be implemented in the same one or more software and/or hardware implementations of the present description.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
As will be appreciated by one skilled in the art, embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
This description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present specification, and is not intended to limit the present specification. Various modifications and alterations to this description will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification.
Claims (11)
1. A method of anomaly detection, comprising:
acquiring service data of a user in a current service period;
classifying the service data according to data intervals corresponding to all nodes contained in each pre-trained anomaly detection model to determine nodes corresponding to the data intervals in which the service data fall as target nodes, wherein the anomaly detection model comprises a root node and a plurality of leaf nodes, and the root node and the leaf nodes contained in the anomaly detection model form a tree structure corresponding to the anomaly detection model;
determining the position information of the target node in the tree structure corresponding to the anomaly detection model as the position information corresponding to the service data in the anomaly detection model;
and carrying out anomaly detection on the service data according to the corresponding position information of the service data in each anomaly detection model.
2. The method according to claim 1, wherein performing anomaly detection on the service data according to the corresponding location information of the service data in each anomaly detection model specifically includes:
for each anomaly detection model, determining an anomaly characterization value corresponding to the service data in the anomaly detection model according to the position information corresponding to the service data in the anomaly detection model, wherein if the target node is closer to a root node contained in a tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is higher, and if the target node is farther from the root node contained in the tree structure corresponding to the anomaly detection model, the anomaly characterization value corresponding to the service data in the anomaly detection model is lower;
and carrying out anomaly detection on the service data according to the corresponding anomaly characterization value of the service data in each anomaly detection model.
3. The method of claim 1, wherein pre-training each anomaly detection model specifically comprises:
acquiring a training sample set and a verification set, wherein the training sample set is constructed by acquiring service data of each user in each historical service period;
aiming at each abnormal detection model, dividing at least part of training samples contained in the training sample set to construct a tree structure corresponding to the abnormal detection model, wherein the tree structure corresponding to the constructed abnormal detection model comprises a plurality of constructed nodes and a data interval corresponding to each node;
classifying the verification samples by the aid of the tree structure corresponding to each constructed abnormal detection model aiming at each verification sample contained in the verification set to obtain abnormal detection results corresponding to the verification samples;
and adjusting the tree structure corresponding to each abnormal detection model according to the abnormal detection result corresponding to each verification sample contained in the verification set and the abnormal sample contained in the verification set so as to train each abnormal detection model.
4. The method of claim 1, wherein the method further comprises:
obtaining service data of each user in the current service period as supplementary service data;
adjusting the training sample set corresponding to each abnormal detection model according to the supplementary service data to obtain an adjusted training sample set;
adjusting each abnormal detection model through the adjusted training sample set to obtain each adjusted abnormal detection model;
and performing anomaly detection on the acquired service data of the user in the next service period through each adjusted anomaly detection model.
5. The method according to claim 4, wherein the adjusting the training sample set corresponding to each anomaly detection model according to the supplementary service data to obtain an adjusted training sample set specifically comprises:
determining a historical service period which is farthest away from the time length of the current service period from the training sample set as a target historical service period;
and adjusting the training sample set by deleting the service data corresponding to the target historical service period from the training sample set and adding the supplementary service data into the training sample set.
6. The method of claim 5, wherein the adjusting each anomaly detection model through the adjusted training sample set to obtain each adjusted anomaly detection model specifically comprises:
for each abnormal detection model, determining a node constructed by the service data corresponding to the target historical service period in the process of training the abnormal detection model from the tree structure corresponding to the abnormal detection model as a node to be deleted;
deleting the node to be deleted from the tree structure corresponding to the anomaly detection model, and taking another child node of the parent node corresponding to the node to be deleted as the parent node corresponding to the node to be deleted to obtain the tree structure to be adjusted corresponding to the anomaly detection model;
and adjusting the tree structure to be adjusted corresponding to the anomaly detection model through the adjusted training sample set to obtain an adjusted anomaly detection model corresponding to the anomaly detection model.
7. The method according to claim 6, wherein the adjusting the tree structure to be adjusted corresponding to the anomaly detection model through the adjusted training sample set to obtain the adjusted anomaly detection model corresponding to the anomaly detection model specifically includes:
for each node contained in the tree structure to be adjusted, if the node is not connected with a child node, and at least two service data contained in the supplementary service data are determined to fall into a data interval corresponding to the node, dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node, so as to obtain a new child node corresponding to the node;
and adjusting the tree structure to be adjusted corresponding to the anomaly detection model according to the new-added sub-node corresponding to each node contained in the tree structure to be adjusted to obtain an adjusted anomaly detection model corresponding to the anomaly detection model.
8. The method of claim 7, wherein dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node to obtain a new child node corresponding to the node specifically comprises:
judging whether the position of the node in the tree structure to be adjusted meets a preset condition or not;
if so, dividing the data interval corresponding to the node according to the service data falling into the data interval corresponding to the node to obtain a new-added child node corresponding to the node, otherwise, not dividing the data interval corresponding to the node.
9. An apparatus for anomaly detection, comprising:
the acquisition module is used for acquiring the service data of the user in the current service period;
the classification module is used for classifying the service data according to data intervals corresponding to all nodes contained in each pre-trained anomaly detection model so as to determine the nodes corresponding to the data intervals in which the service data fall, wherein the anomaly detection model contains one root node and a plurality of leaf nodes, and the root node and the plurality of leaf nodes contained in the anomaly detection model form a tree structure corresponding to the anomaly detection model;
a determining module, configured to determine location information of the target node in a tree structure corresponding to the anomaly detection model, as the location information corresponding to the service data in the anomaly detection model;
and the detection module is used for carrying out abnormity detection on the service data according to the position information corresponding to the service data in each abnormity detection model.
10. A computer-readable storage medium, characterized in that the storage medium stores a computer program which, when executed by a processor, implements the method of any of the preceding claims 1 to 8.
11. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any of claims 1 to 8 when executing the program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110144471.XA CN112860968A (en) | 2021-02-02 | 2021-02-02 | Abnormity detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110144471.XA CN112860968A (en) | 2021-02-02 | 2021-02-02 | Abnormity detection method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112860968A true CN112860968A (en) | 2021-05-28 |
Family
ID=75987701
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110144471.XA Pending CN112860968A (en) | 2021-02-02 | 2021-02-02 | Abnormity detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112860968A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113093985A (en) * | 2021-06-09 | 2021-07-09 | 中国南方电网有限责任公司超高压输电公司广州局 | Sensor data link abnormity detection method and device and computer equipment |
| CN113611329A (en) * | 2021-07-02 | 2021-11-05 | 北京三快在线科技有限公司 | Method and device for detecting abnormal voice |
| CN113705684A (en) * | 2021-08-30 | 2021-11-26 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic device and medium |
| CN114650186A (en) * | 2022-04-22 | 2022-06-21 | 北京三快在线科技有限公司 | Anomaly detection method and detection device thereof |
| CN115118631A (en) * | 2022-06-27 | 2022-09-27 | 平安银行股份有限公司 | Link exception handling method and device, electronic equipment and storage medium |
| CN115567371A (en) * | 2022-11-16 | 2023-01-03 | 支付宝(杭州)信息技术有限公司 | Abnormity detection method, device, equipment and readable storage medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109597744A (en) * | 2018-11-16 | 2019-04-09 | 北京奇虎科技有限公司 | Data unusual fluctuation analysis method and device |
| CN109948669A (en) * | 2019-03-04 | 2019-06-28 | 腾讯科技（深圳）有限公司 | A kind of abnormal deviation data examination method and device |
| US20190215232A1 (en) * | 2016-09-30 | 2019-07-11 | Huawei Technologies Co., Ltd. | Method and Apparatus For Determining Fault Type |
| CN110020858A (en) * | 2019-03-13 | 2019-07-16 | 北京三快在线科技有限公司 | Pay method for detecting abnormality, device, storage medium and electronic equipment |
| CN110322349A (en) * | 2019-06-25 | 2019-10-11 | 阿里巴巴集团控股有限公司 | A kind of processing method of data, device and equipment |
| CN110442341A (en) * | 2019-07-23 | 2019-11-12 | 平安国际智慧城市科技股份有限公司 | Interface configuration method, device and the terminal device of application program |
| CN111340075A (en) * | 2020-02-14 | 2020-06-26 | 北京邮电大学 | Network data detection method and device for ICS |
| CN111859945A (en) * | 2019-04-17 | 2020-10-30 | 深圳市茁壮网络股份有限公司 | Word vector training method and device |
| CN112102049A (en) * | 2020-09-23 | 2020-12-18 | 中国建设银行股份有限公司 | Model training method, business processing method, device and equipment |
| CN112182508A (en) * | 2020-09-16 | 2021-01-05 | 支付宝(杭州)信息技术有限公司 | Abnormity monitoring method and device for compliance business indexes |
-
2021
- 2021-02-02 CN CN202110144471.XA patent/CN112860968A/en active Pending
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190215232A1 (en) * | 2016-09-30 | 2019-07-11 | Huawei Technologies Co., Ltd. | Method and Apparatus For Determining Fault Type |
| CN109597744A (en) * | 2018-11-16 | 2019-04-09 | 北京奇虎科技有限公司 | Data unusual fluctuation analysis method and device |
| CN109948669A (en) * | 2019-03-04 | 2019-06-28 | 腾讯科技（深圳）有限公司 | A kind of abnormal deviation data examination method and device |
| CN110020858A (en) * | 2019-03-13 | 2019-07-16 | 北京三快在线科技有限公司 | Pay method for detecting abnormality, device, storage medium and electronic equipment |
| CN111859945A (en) * | 2019-04-17 | 2020-10-30 | 深圳市茁壮网络股份有限公司 | Word vector training method and device |
| CN110322349A (en) * | 2019-06-25 | 2019-10-11 | 阿里巴巴集团控股有限公司 | A kind of processing method of data, device and equipment |
| CN110442341A (en) * | 2019-07-23 | 2019-11-12 | 平安国际智慧城市科技股份有限公司 | Interface configuration method, device and the terminal device of application program |
| CN111340075A (en) * | 2020-02-14 | 2020-06-26 | 北京邮电大学 | Network data detection method and device for ICS |
| CN112182508A (en) * | 2020-09-16 | 2021-01-05 | 支付宝(杭州)信息技术有限公司 | Abnormity monitoring method and device for compliance business indexes |
| CN112102049A (en) * | 2020-09-23 | 2020-12-18 | 中国建设银行股份有限公司 | Model training method, business processing method, device and equipment |
Non-Patent Citations (1)
| Title |
|---|
| 张群洪等: ""一种改进的动态二叉树的自组织神经网络算法"", 《计算机应用》 * |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113093985A (en) * | 2021-06-09 | 2021-07-09 | 中国南方电网有限责任公司超高压输电公司广州局 | Sensor data link abnormity detection method and device and computer equipment |
| CN113093985B (en) * | 2021-06-09 | 2021-09-10 | 中国南方电网有限责任公司超高压输电公司广州局 | Sensor data link abnormity detection method and device and computer equipment |
| CN113611329A (en) * | 2021-07-02 | 2021-11-05 | 北京三快在线科技有限公司 | Method and device for detecting abnormal voice |
| CN113611329B (en) * | 2021-07-02 | 2023-10-24 | 北京三快在线科技有限公司 | Voice abnormality detection method and device |
| CN113705684A (en) * | 2021-08-30 | 2021-11-26 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic device and medium |
| CN113705684B (en) * | 2021-08-30 | 2023-11-24 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic equipment and medium |
| CN114650186A (en) * | 2022-04-22 | 2022-06-21 | 北京三快在线科技有限公司 | Anomaly detection method and detection device thereof |
| CN115118631A (en) * | 2022-06-27 | 2022-09-27 | 平安银行股份有限公司 | Link exception handling method and device, electronic equipment and storage medium |
| CN115118631B (en) * | 2022-06-27 | 2023-09-01 | 平安银行股份有限公司 | Link exception handling method and device, electronic equipment and storage medium |
| CN115567371A (en) * | 2022-11-16 | 2023-01-03 | 支付宝(杭州)信息技术有限公司 | Abnormity detection method, device, equipment and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112860968A (en) | Abnormity detection method and device | |
| CN108460523B (en) | Wind control rule generation method and device | |
| CN108596410B (en) | Automatic wind control event processing method and device | |
| CN110163417B (en) | Traffic prediction method, device and equipment | |
| CN108346107B (en) | Social content risk identification method, device and equipment | |
| CN110826894A (en) | Hyper-parameter determination method and device and electronic equipment | |
| CN114943307A (en) | Model training method and device, storage medium and electronic equipment | |
| CN112966113A (en) | Data risk prevention and control method, device and equipment | |
| CN110532755B (en) | Computer-implemented risk identification method and device | |
| CN110134852B (en) | Document duplicate removal method and device and readable medium | |
| CN110516915B (en) | Service node training and evaluating method and device and electronic equipment | |
| CN114115016A (en) | Data processing method, device, equipment and medium | |
| CN112597255A (en) | Method and device for determining abnormal data | |
| CN116630480B (en) | Interactive text-driven image editing method and device and electronic equipment | |
| CN107562703B (en) | Dictionary tree reconstruction method and system | |
| CN115954048B (en) | Screening method and device for CRISPR-Cas system | |
| CN115545572B (en) | Method, device, equipment and storage medium for business wind control | |
| CN115618748B (en) | Model optimization method, device, equipment and storage medium | |
| CN109039695B (en) | Service fault processing method, device and equipment | |
| CN111242195B (en) | Model, insurance wind control model training method and device and electronic equipment | |
| CN107368281B (en) | Data processing method and device | |
| CN113010562B (en) | Information recommendation method and device | |
| CN111753328B (en) | Private data leakage risk detection method and system | |
| CN114926687A (en) | Training method and device for classification model | |
| CN110738562B (en) | Method, device and equipment for generating risk reminding information |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210528 |