CN115729796B

CN115729796B - Abnormal operation analysis method based on artificial intelligence and big data application system

Info

Publication number: CN115729796B
Application number: CN202211659837.8A
Authority: CN
Inventors: 许伟; 陆广富
Original assignee: China Soft International Technology Service Co ltd
Current assignee: China Soft International Technology Service Co ltd
Priority date: 2022-12-23
Filing date: 2022-12-23
Publication date: 2023-10-10
Anticipated expiration: 2042-12-23
Also published as: CN115729796A

Abstract

The embodiment of the application provides an abnormal operation analysis method and a big data application system based on artificial intelligence, which are used for responding to an abnormal operation analysis instruction aiming at a target big data application system, calling system request response big data of the target big data application system, carrying out abnormal operation analysis on the system request response big data, determining corresponding abnormal operation activities meeting characteristic attention weights and historical priori abnormal root cause information corresponding to the abnormal operation activities, and carrying out abnormal information prompt on corresponding user terminals based on the abnormal operation activities and the historical priori abnormal root cause information corresponding to the abnormal operation activities, thereby combining the characteristic attention weights during the abnormal operation analysis, improving the accuracy and efficiency of the abnormal operation analysis, and simultaneously being convenient for related users to timely learn possible abnormal risks by carrying out corresponding abnormal root cause information prompt on the user terminals.

Description

Abnormal operation analysis method based on artificial intelligence and big data application system

Technical Field

The embodiment of the application relates to the technical field of artificial intelligence, in particular to an abnormal operation analysis method and a big data application system based on artificial intelligence.

Background

Along with the increasing remarkable effect of various big data application systems in the aspects of information decision and product maintenance of internet online service providers and the like, the carried application is also increasingly abundant, the processed data volume and the request response volume are exponentially increased, accordingly, the abnormal condition of data processing is also increased, and how to improve the accuracy and the efficiency of abnormal operation analysis, so that related users can know possible abnormal risks in time is a technical problem to be solved currently urgently.

Disclosure of Invention

In order to at least overcome the above-mentioned shortcomings in the prior art, an object of an embodiment of the present application is to provide an abnormal operation analysis method and a big data application system based on artificial intelligence.

In a first aspect, an embodiment of the present application provides an abnormal operation analysis method based on artificial intelligence, which is applied to a big data application system, and the method includes:

responding to an abnormal operation analysis instruction aiming at a target big data application system, and calling a system request response big data of the target big data application system;

performing abnormal operation analysis on the system request response big data, and determining corresponding abnormal operation activities meeting characteristic attention weights and historical priori abnormal root cause information corresponding to the abnormal operation activities;

And prompting the abnormal information of the corresponding user terminal based on the abnormal operation activity and the historical priori abnormal root cause information corresponding to the abnormal operation activity.

In a possible implementation manner of the first aspect, the step of performing an abnormal operation analysis on the system request response big data to determine a corresponding abnormal operation activity meeting a feature attention weight and historical prior abnormal root cause information corresponding to the abnormal operation activity includes:

responding to an abnormal operation analysis instruction aiming at a target big data application system, and calling a system request response big data of the target big data application system; combining system request response big data, and determining a first number of first request response events corresponding to the system request response big data and response operation track characteristics corresponding to each first request response event;

for each first request response event, determining a feature attention weight corresponding to the first request response event by combining response operation track features of the first request response event;

combining the feature attention weight corresponding to each first request response event, carrying out feature update on the response operation track features corresponding to the first number of first request response events respectively, and generating a second number of second request response events and response operation track features corresponding to each second request response event, wherein the second number is smaller than the first number;

Determining abnormal operation activities of the system request response big data according to response operation track characteristics corresponding to the second request response events;

and combining a historical prior abnormal root cause knowledge base to determine historical prior abnormal root cause information corresponding to the abnormal operation activity.

In this exemplary embodiment, by acquiring the feature attention weight that can reflect the attention weight of each first request response event on the obtained abnormal operation activity, and performing feature update on the response operation track features corresponding to the first number of first request response events, the response operation track features in the noise state may be subjected to noise rejection. For example, eliminating the response operation track characteristics which have no attention weight or have the attention weight smaller than a set threshold value for the obtained abnormal operation activity; based on this, response operation track features corresponding to a second number of second request response events affecting the obtained abnormal operation activity are obtained. And then determining abnormal operation activities of the system request response big data through response operation track characteristics corresponding to a second number of second request response events, thereby improving the accuracy of the decision of the abnormal operation activities, reducing the data calculation amount and improving the decision speed of the abnormal operation activities by the second number being smaller than the first number.

In a design concept, the determining, for each first request response event, a feature attention weight corresponding to the first request response event in combination with a response operation track feature of the first request response event includes:

for each first request response event, performing punishment-based feature selection on response operation track features corresponding to the first request response event, and generating target selection features corresponding to the first request response event;

and combining target selection features corresponding to the first request response events to determine feature attention weights corresponding to the first request response events.

In the present exemplary embodiment, by selecting the feature based on punishment, the feature of the response operation track may be reduced in dimension, and the capacity of the feature may be reduced for subsequent processing, so as to more accurately obtain the feature attention weight corresponding to the first request response event.

In a design concept, the determining the feature attention weight of the first request response event by combining the target selection features corresponding to the first request response events includes:

performing regularization conversion on target selection features corresponding to the first request response events to generate regularized target selection features;

Performing iterative cluster analysis on the regularized and converted target selection features to generate first iterative cluster analysis features, wherein the number of feature dimensions corresponding to the first iterative cluster analysis features is smaller than that of feature dimensions corresponding to the target selection features;

and combining the first iterative cluster analysis features corresponding to the first request response events to determine feature attention weights corresponding to the first request response events.

In a design idea, the regularized conversion is performed on the target selection feature corresponding to each first request response event, and the generating of the regularized converted target selection feature includes:

combining target selection characteristics corresponding to the first request response events to determine convertible knowledge points corresponding to the first request response events;

and combining the convertible knowledge points corresponding to the first request response events, carrying out regularization conversion on the target selection features corresponding to the first request response events, and generating regularized target selection features.

In the design thought, the performing iterative cluster analysis on the regularized and transformed target selection feature to generate a first iterative cluster analysis feature includes:

Combining the regularized and converted target selection characteristics to determine feature tag propagation vectors corresponding to the regularized and converted target selection characteristics;

and performing iterative cluster analysis on the regularized and converted target selection features through the feature tag propagation vector to generate the first iterative cluster analysis features.

In a design concept, the determining, by combining first iterative cluster analysis features corresponding to each first request response event, a feature attention weight corresponding to each first request response event includes:

performing feature derivation based on a set feature derivation rule on each first iterative cluster analysis feature, performing iterative cluster analysis on the first iterative cluster analysis features subjected to feature derivation, and generating second iterative cluster analysis features corresponding to each first iterative cluster analysis feature;

and combining the second iterative cluster analysis features to determine feature attention weights corresponding to the first request response events.

In a design idea, the feature updating is performed on the response operation track features corresponding to the first number of first request response events by combining feature attention weights corresponding to the first request response events, so as to generate a second number of second request response events and response operation track features corresponding to the second request response events, where the feature updating includes:

Combining first associated feature arrangement structures corresponding to feature attention weights meeting preset conditions and corresponding to the first request response events, wherein arrangement parameters of the first associated feature arrangement structures are a first number multiplied by a second number;

performing feature switching on the first associated feature arrangement structure to generate a second associated feature arrangement structure with arrangement parameters of which the second number is multiplied by the first number;

and combining the second association feature arrangement structure and a request response event node matrix corresponding to the response operation track features of the first request response events, performing feature update on the response operation track features corresponding to the first number of first request response events respectively, and generating the second number of second request response events and response operation track features corresponding to the second request response events.

In a design concept, the determining, in combination with response operation track features corresponding to the second request response events, abnormal operation activities of the system request to respond to big data includes:

the second request response events are covered on first request response events, the numerical parameter parameters corresponding to the first quantity are adjusted to the numerical parameters corresponding to the first request response events, the steps of determining feature attention weights corresponding to the first request response events by combining response operation track features of the first request response events are circularly executed, and when the set circulation times are reached, abnormal operation activity prediction probability distribution corresponding to the system request response big data is determined by combining response operation track features corresponding to the second request response events generated last time;

And determining the abnormal operation activity of the system request response big data according to the abnormal operation activity prediction probability distribution.

In the present exemplary embodiment, the process of deleting the response operation track feature of the noise state may be repeated for the response operation track feature corresponding to the system request response big data, the response operation track feature of the noise state may be precisely removed, the response operation track feature affecting the obtained abnormal operation activity may be generated, and based on this, the obtained abnormal operation activity prediction probability distribution corresponding to the different abnormal operation activities may be combined with the obtained system request response big data, so that the accurate abnormal operation activity may be obtained.

In the design thought, the steps are realized through an abnormal operation analysis model, and the abnormal operation analysis model is obtained through training the following steps; acquiring system request response template data; loading the system request response template data to initialize an abnormal operation analysis model, wherein the abnormal operation analysis model comprises a plurality of feature updating networks;

generating first prediction response operation track characteristics through a characteristic update network of the initialization abnormal operation analysis model, and determining first prediction abnormal operation activity information corresponding to the system request response template data;

The feature updating network is used for combining response operation track features of first template request response events corresponding to system request response template data, determining feature attention weights of the first template request response events, combining the feature attention weights corresponding to the first template request response events, and performing feature updating on response operation track features corresponding to a third number of first template request response events respectively to generate a fourth number of target template request response events and first prediction response operation track features corresponding to the target template request response events;

loading the system request response template data into a template neural network model, generating second prediction response operation track characteristics through each characteristic update network of the template neural network model, and determining second prediction abnormal operation activity information corresponding to the system request response template data;

and determining a target training convergence evaluation index of the initialization abnormal operation analysis model by combining the first prediction response operation track feature, the second prediction response operation track feature, the first prediction abnormal operation activity information and the second prediction abnormal operation activity information, and performing model convergence optimization on the initialization abnormal operation analysis model through the target training convergence evaluation index.

In the present exemplary embodiment, the second predicted response operation track feature, the second predicted abnormal operation activity information, and the first predicted response operation track feature and the first predicted abnormal operation activity information generated by the initialized abnormal operation analysis model are generated by combining the template neural network model, so that the abnormal operation analysis model completes high-quality knowledge refinement, generates an accurate target training convergence evaluation index, and performs weight parameter optimization on the initialized abnormal operation analysis model through the target training convergence evaluation index, thereby improving the reasoning accuracy of the initialized abnormal operation analysis model.

In a design concept, the determining the target training convergence evaluation index of the initialized abnormal operation analysis model by combining the first predicted response operation track feature, the second predicted response operation track feature, the first predicted abnormal operation activity information and the second predicted abnormal operation activity information includes:

for each feature updating network in the initialization abnormal operation analysis model, determining a first training convergence evaluation index corresponding to the feature updating network by combining a first prediction response operation track feature and a second prediction response operation track feature corresponding to the feature updating network;

Determining a second training convergence evaluation index of the initialized abnormal operation analysis model by combining the first predicted abnormal operation activity information and the second predicted abnormal operation activity information;

and combining the first training convergence evaluation index and the second training convergence evaluation index corresponding to each characteristic updating network to determine the target training convergence evaluation index.

In a design concept, the determining a first training convergence evaluation index corresponding to the feature update network by combining the first prediction response operation track feature and the second prediction response operation track feature corresponding to the feature update network includes:

combining the first prediction response operation track features to determine a third number of regression prediction response operation track features;

the third number is the number of first template request response events corresponding to the system request response template data;

and combining the third number of regression prediction response operation locus features and the second prediction response operation locus features to determine a first training convergence evaluation index corresponding to the feature updating network.

In the present exemplary embodiment, since the first predicted response operation trajectory feature generated by the initialization abnormal operation analysis model is the predicted response operation trajectory feature of the response operation trajectory feature from which the noise state is removed, the number of the first predicted response operation trajectory features is smaller than the number of the first template request response events. The number of the second prediction response operation track features generated by the template neural network model is the same as the number of the first template request response events, so that the third number of regression prediction response operation track features obtained by combination can be used for carrying out regression on the feature numbers corresponding to the first prediction response operation track features generated by the initialization abnormal operation analysis model, the feature numbers correspond to the second prediction response operation track features, the gradual comparison between the regression prediction response operation track features and the second prediction response operation track features is completed, training convergence evaluation indexes between the regression prediction response operation track features and the second prediction response operation track features are generated, knowledge distillation of the initialization abnormal operation analysis model is completed, and then the reliable and accurate first training convergence evaluation indexes are obtained through the training convergence evaluation indexes between the regression prediction response operation track features and the second prediction response operation track features.

In a design concept, the determining a third number of regression-predicted-response operation trajectory features in combination with each of the first-predicted-response operation trajectory features includes:

performing regularization conversion on a second associated feature arrangement structure corresponding to the first prediction response operation track feature to generate a regularized first prediction target selection feature, and performing feature switching on the associated feature arrangement structure corresponding to the first prediction target selection feature to generate a third associated feature arrangement structure;

performing iterative cluster analysis on the third associated feature arrangement structure to generate a second predicted target selection feature, and performing feature derivation on the second predicted target selection feature based on a set feature derivation rule to generate a third predicted target selection feature;

performing iterative cluster analysis on the associated feature arrangement structure corresponding to the third prediction target selection feature, performing feature switching on the associated feature arrangement structure subjected to the iterative cluster analysis to generate a fourth associated feature arrangement structure, and determining the third number of regression prediction response operation track features by combining the fourth associated feature arrangement structure, wherein the arrangement parameters of the fourth associated feature arrangement structure comprise a third number of fields, and the number of feature dimensions in the arrangement parameters of the fourth associated feature arrangement structure is the number of feature dimensions corresponding to the response operation track features of the first template request response event.

In the design thought, the determining the third number of regression prediction response operation trajectory features in combination with the fourth associated feature arrangement structure includes:

performing regularization conversion on the fourth associated feature arrangement structure, and performing repeated iterative cluster analysis on the fourth associated feature arrangement structure subjected to the regularization conversion to generate a fifth associated feature arrangement structure;

and combining the fifth associated feature arrangement structure and the fourth associated feature arrangement structure to determine the third number of regression prediction response operation track features.

In a design concept, the determining, by combining the third number of regression prediction response operation trajectory features and the second prediction response operation trajectory features, a first training convergence evaluation index corresponding to the feature update network includes:

determining a first member training convergence evaluation index by combining the third number of regression prediction response operation locus features and the second prediction response operation locus features;

carrying out regression processing on the regression prediction response operation track characteristics to generate first target prediction response operation track characteristics associated with the regression prediction response operation track characteristics, and obtaining third prediction abnormal operation activity information corresponding to the first target prediction response operation track characteristics;

Regression processing is carried out on the second predicted response operation track characteristics, second target predicted response operation track characteristics associated with the second predicted response operation track characteristics are generated, and fourth predicted abnormal operation activity information corresponding to the second target predicted response operation track characteristics is obtained;

determining a second member training convergence evaluation index by combining the third predicted abnormal operation activity information and the fourth predicted abnormal operation activity information;

and combining the first member training convergence evaluation index and the second member training convergence evaluation index to determine the first training convergence evaluation index.

In the present exemplary embodiment, the third number of regression-predicted-response operation trajectory features and the second predicted-response operation trajectory features are combined to obtain the first member training convergence evaluation index of the feature update network when predicting the response operation trajectory features. The regression prediction response operation track characteristics are combined to carry out regression processing, the regression prediction response operation track characteristics can be analyzed, a second member training convergence evaluation index can be obtained when the regression prediction response operation track characteristics are generated, the weight parameter optimization is carried out on the abnormal operation analysis model by combining the second member training convergence evaluation index and a first member training convergence evaluation index, and the reliability of the characteristic update network for generating the regression prediction response operation track characteristics can be increased.

In one design concept, the determining the second member training convergence evaluation index by combining the third predicted abnormal operation activity information and the fourth predicted abnormal operation activity information includes:

combining the third predicted abnormal operation activity information and the first marked abnormal operation activity information corresponding to the third predicted abnormal operation activity information to determine a third member training convergence evaluation index;

combining the fourth predicted abnormal operation activity information and second marked abnormal operation activity information corresponding to the fourth predicted abnormal operation activity information to determine a fourth member training convergence evaluation index;

and combining the third member training convergence evaluation index and the fourth member training convergence evaluation index to determine the second member training convergence evaluation index.

In this exemplary embodiment, the template neural network model and the initialization abnormal operation analysis model correspond to different labeling abnormal operation activity information, so that the generated targets for predicting abnormal operation activity information are different, and the training convergence evaluation index is obtained through different labeling abnormal operation activity information, so that the reliability of obtaining the third member training convergence evaluation index and the fourth member training convergence evaluation index can be increased, so as to further accurately obtain the second member training convergence evaluation index.

In a design concept, the determining the target training convergence evaluation index by combining the first training convergence evaluation index and the second training convergence evaluation index corresponding to each feature updating network includes:

combining the first predicted abnormal operation activity information and the marked abnormal operation activity information corresponding to the system request response template data to determine a probability prediction training convergence evaluation index corresponding to the initialized abnormal operation analysis model;

and combining the first training convergence evaluation index, the second training convergence evaluation index and the probability prediction training convergence evaluation index corresponding to each feature updating network to determine the target training convergence evaluation index.

In the present exemplary embodiment, in combination with the first abnormal operation activity prediction information and the abnormal operation activity labeling information corresponding to the system request response template data, a cost, that is, a probability prediction training convergence evaluation index, between the first abnormal operation activity prediction information generated by the abnormal operation analysis model and the actual abnormal operation activity labeling information may be obtained, and the reliability of the abnormal operation activity prediction information generated by the abnormal operation analysis model may be increased by performing weight parameter optimization on the abnormal operation analysis model through the cost.

performing abnormal operation analysis on the system request response template data through a test neural network model, and determining fifth predicted abnormal operation activity information corresponding to the system request response template data;

determining a third training convergence evaluation index of the initialized abnormal operation analysis model by combining the fifth predicted abnormal operation activity information and the first predicted abnormal operation activity information;

and determining the target training convergence evaluation index by combining the first training convergence evaluation index, the second training convergence evaluation index and the third training convergence evaluation index.

In a second aspect, an embodiment of the present application further provides an abnormal operation analysis system based on artificial intelligence, where the abnormal operation analysis system based on artificial intelligence includes a big data application system and a plurality of user terminals communicatively connected to the big data application system;

the big data application system is used for:

In any aspect of the foregoing, in response to an abnormal operation analysis instruction for a target big data application system, invoking system request response big data of the target big data application system, performing abnormal operation analysis on the system request response big data, determining corresponding abnormal operation activities meeting characteristic attention weights and historical priori abnormal root cause information corresponding to the abnormal operation activities, and prompting corresponding user terminals for abnormal information based on the abnormal operation activities and the historical priori abnormal root cause information corresponding to the abnormal operation activities, thereby combining the characteristic attention weights in the process of performing the abnormal operation analysis, improving accuracy and efficiency of the abnormal operation analysis, and simultaneously, by performing corresponding abnormal root cause information prompting on the user terminals, a related user can be facilitated to learn possible abnormal risks in time.

Drawings

FIG. 1 is a schematic flow chart of an abnormal operation analysis method based on artificial intelligence according to an embodiment of the present application;

fig. 2 is a schematic component structure of a big data application system for implementing the artificial intelligence based abnormal operation analysis method according to an embodiment of the present application. .

Detailed Description

The architecture of the abnormal operation analysis system 10 based on artificial intelligence according to an embodiment of the present application is described below, and the abnormal operation analysis system 10 based on artificial intelligence may include a big data application system 100 and a user terminal 200 communicatively connected to the big data application system 100. The big data application system 100 and the user terminal 200 in the abnormal operation analysis system 10 based on artificial intelligence may be used to cooperatively execute the abnormal operation analysis method based on artificial intelligence described in the following method embodiments, and the detailed description of the method embodiments may be referred to for the execution steps of the big data application system 100 and the user terminal 200.

The abnormal operation analysis method based on artificial intelligence provided in this embodiment may be executed by the big data application system 100, and is described in detail below with reference to fig. 1.

And the Process11 is used for responding to an abnormal operation analysis instruction aiming at the target big data application system and calling a system request response big data of the target big data application system.

The target big data application system may be a cloud software system in which big data applications (such as a network security big data application, an e-commerce big data application, a medical big data application, etc.) are laid out, and the abnormal operation analysis instruction may be generated by any user operation or may be generated automatically based on a timing analysis task, which is not particularly limited. And when an abnormal operation analysis instruction aiming at the target big data application system is received, the system request response big data of the target big data application system can be called.

In some exemplary design considerations, the system request response big data is a collection of response event data that the target big data application system generates in response to a related request instruction (e.g., a video interaction request instruction). These response event data may be merchandise transaction behavior data in an e-commerce application scenario, etc.

On the basis, abnormal operation analysis can be carried out on the system request response big data, corresponding abnormal operation activities meeting characteristic attention weights and historical priori abnormal root cause information corresponding to the abnormal operation activities are determined, and abnormal information prompt is carried out on the corresponding user terminals based on the abnormal operation activities and the historical priori abnormal root cause information corresponding to the abnormal operation activities. Therefore, the feature attention weight is combined when the abnormal operation analysis is carried out, the accuracy and the efficiency of the abnormal operation analysis are improved, and meanwhile, through carrying out corresponding abnormal root cause information prompt on the user terminal, the related user can conveniently and timely learn possible abnormal risks.

For example, performing abnormal operation analysis on the system request response big data, determining corresponding abnormal operation activities meeting characteristic attention weights and historical prior abnormal root cause information corresponding to the abnormal operation activities, and performing the abnormal operation activities according to the following steps.

And the Process12 is used for combining the system request response big data and determining a first number of first request response events corresponding to the system request response big data and response operation track characteristics corresponding to each first request response event.

The first request response event may be a plurality of response event data obtained by classifying the system request response big data according to event types, where each request response event corresponds to one event type in the system request response big data, for example, in an e-commerce application scenario, the request response event 1 corresponds to commodity transaction behavior data of the system request response big data, the request response event 2 corresponds to attention behavior data of the system request response big data, which is specific to a target live broadcast page, and the request response event 3 corresponds to interaction behavior data of the system request response big data, which is specific to a target commodity browsing plate. The response operation track feature corresponding to each first request response event may be used to represent a flow action of the response operation, for example, the response operation track feature of the commodity transaction behavior data may be used to represent a transaction triggering feature, a transaction executing feature, a transaction ending feature, and the like in the commodity transaction flow.

The first number of first request response events corresponding to the system request response big data and the response operation track characteristics corresponding to the first request response events are determined to be extracted through a pre-trained abnormal operation analysis model. The abnormal operation analysis model may be, for example, any AI network model, which includes a plurality of feature update networks for performing feature update processing on the response operation track features, and obtains response operation track features corresponding to the second request response event after update, and further includes a fully connected network for determining abnormal operation activity prediction probability distribution corresponding to the system request response big data. After the system request response big data is obtained, the system request response big data is loaded to an abnormal operation analysis model, the system request response big data is processed through the abnormal operation analysis model, and a first number of first request response events corresponding to the system request response big data and response operation track characteristics corresponding to the first request response events are generated.

And the Process13 is used for determining the feature attention weight corresponding to the first request response event according to the first request response event and combining the response operation track feature of the first request response event.

The feature attention weight may represent the attention weight of each first request response event on the obtained abnormal operation activity, where a first request response event corresponds to a feature attention weight, and the higher the feature attention weight, the higher the feature concentration of the first request response event is indicated, for example, the first request response event is an e-commerce live broadcast response event, and the larger the feature duty ratio related to e-commerce live broadcast is, the larger the feature attention weight is.

And the Process14 is used for carrying out feature updating on the response operation track features corresponding to the first request response events respectively by combining the feature attention weights corresponding to the first request response events to generate a second number of second request response events and response operation track features corresponding to the second request response events, wherein the second number is smaller than the first number. The second number is the number of the obtained second request response event and the response operation track characteristics corresponding to the second request response event. The second request response event is a request response event obtained by removing the response operation track feature of the noise state from the response operation track feature corresponding to the first request response event in combination with the feature attention weight corresponding to each first request response event. The second number may be associated with the first number, e.g. second number = first number/2.

The response operation track characteristics corresponding to each second request response event are response operation track characteristics after eliminating the response operation track characteristics of the noise state. For example, after the feature attention weight corresponding to each first request response event is generated, the response operation track features of the noise states in the response operation track features corresponding to each first request response event are determined in combination with the feature attention weight corresponding to each first request response event, then the response operation track features corresponding to each first request response event are updated in combination with the determined response operation track features of the noise states, and a second number of second request response events and the response operation track features corresponding to each second request response event are generated, for example, by aggregating the response operation track features. If the system request response big data is processed through the abnormal operation analysis model, after the abnormal operation analysis model obtains the feature attention weights corresponding to the first request response events, feature updating is carried out on the response operation track features corresponding to the first number of first request response events respectively by combining the feature attention weights corresponding to the first request response events, so that the second number of second request response events and the response operation track features corresponding to the second request response events are obtained. In addition, when the system request response big data is processed through the abnormal operation analysis model, each feature updating network executes the steps, for example, after the first feature updating network performs feature updating on the response operation track feature corresponding to the first request response event, a second number of second request response events and response operation track features corresponding to the second request response events are generated, the second request response events are covered on the first request response event, the numerical parameter parameters corresponding to the first number are adjusted to the numerical parameter corresponding to the first request response event, then the second feature updating network performs feature updating again on the response operation track feature corresponding to the second request response event generated by the first feature updating network, and in a traversing state, the response operation track feature corresponding to the second request response event generated by the second feature updating network can also be subjected to feature updating again through the third feature updating network, so that new second request response events and new response operation track features corresponding to the second request response events are obtained. The magnitude of the second request response event generated by the feature updating network and the magnitude of the response operation track feature corresponding to the generated second request response event are smaller than the number of the second request response event generated by the previous feature updating network and the number of the response operation track feature corresponding to the generated second request response event.

In this way, the operation of the network is updated by combining the multiple characteristics, the response operation track characteristics of the noise state in the system request response big data are filtered, and the response operation track characteristics of the abnormal operation activity obtained by the attention weight are generated.

And the Process15 is used for determining abnormal operation activities of the system request response big data by combining response operation track characteristics corresponding to the second request response events.

The abnormal operation activity represents a software operation activity with abnormal characteristics in the target big data application system, for example, in an e-commerce application scene, the abnormal operation activity matched with the big data in response to the system request is A, and A represents a payment embezzlement operation activity or any other preset type, such as a sensitive access operation activity and the like.

And the Process16 is used for determining historical priori abnormal root cause information corresponding to the abnormal operation activity by combining the historical priori abnormal root cause knowledge base.

For example, the association relationship between the abnormal operation activity and the historical prior abnormal root cause information may be stored in the abnormal operation knowledge base in advance, and after the abnormal operation activity is obtained, the corresponding historical prior abnormal root cause information may be determined, for example, the historical prior abnormal root cause information corresponding to the payment embezzlement operation activity is of a financial access security type.

Therefore, the feature attention weight capable of reflecting the attention weight of each first request response event on the obtained abnormal operation activity is obtained, and feature updating is carried out on the response operation track features corresponding to the first number of first request response events respectively, so that feature denoising can be carried out on the response operation track features in the noise state. For example, removing the response operation trajectory feature having no attention weight or an attention weight smaller than a threshold value for the obtained abnormal operation activity; based on this, response operation track features corresponding to a second number of second request response events affecting the obtained abnormal operation activity are obtained. And then determining abnormal operation activities of the system request response big data through response operation track characteristics corresponding to a second number of second request response events, thereby improving the accuracy of the decision of the abnormal operation activities, reducing the data calculation amount and improving the decision speed of the abnormal operation activities by the second number being smaller than the first number.

In the present exemplary embodiment, for the Process13, which may be performed by the abnormal operation analysis model, the following is performed by updating the network by one feature thereof, may include the steps of:

The Process131 performs punishment-based feature selection on response operation track features corresponding to the first request response events aiming at each first request response event, and generates target selection features corresponding to the first request response events.

For each first request response event, punishment-based feature selection can be performed on response operation track features corresponding to the first request response event through a feature update network in the abnormal operation analysis model, and target selection features corresponding to the first request response event are generated, so that target selection features corresponding to each first request response event are obtained. Wherein the penalty-based feature selection may be performed by a feature selection unit arranged in the feature update network. The system request response big data is processed by an abnormal operation analysis model, and the obtained response operation track characteristics corresponding to each first request response event can be displayed in an associated characteristic arrangement structure (the associated characteristic arrangement structure can be understood as a data structure in a matrix format), wherein one associated characteristic in the associated characteristic arrangement structure corresponds to the response operation track characteristic of one first request response event. The arrangement parameters of the associated feature arrangement structure corresponding to the first request response event can be a first quantity multiplied by a second quantity, the first quantity is the quantity of response operation track features, the first quantity is smaller than D, and D is the feature dimension quantity corresponding to the response operation track features obtained by processing the system request response big data through the abnormal operation analysis model. And performing punishment-based feature selection on each response operation track feature in the associated feature arrangement structure with the arrangement parameter of the first quantity multiplied by D by a feature selection unit of the feature update network, and generating target selection features corresponding to each first request response event. The corresponding number of the target selection features corresponds to the number of the response operation track features corresponding to the first request response event.

And the Process132 is used for determining the feature attention weight corresponding to the first request response event by combining the target selection features corresponding to the first request response events.

After the target selection features corresponding to the first request response events are obtained, the target selection features corresponding to the first request response events are processed again through a feature update network, and feature attention weights corresponding to the first request response events are generated. The specific process may include:

the Process1321 performs regularization conversion on the target selection feature corresponding to each first request response event, and generates a regularized target selection feature.

After the feature updating network generates the target selection features corresponding to the first request response events, regularized conversion is carried out on the target selection features corresponding to the first request response events, and the regularized converted target selection features corresponding to the target selection features are generated. The number of the obtained regularized transformed target selection features corresponds to the number of the target selection features corresponding to the first request response event. Regularization conversion is a normalization conversion of the target selection feature.

The Process1321 may include:

the Process13211 determines, in combination with the target selection feature corresponding to each first request response event, a switchable knowledge point corresponding to each first request response event.

The Process13212 performs regularized conversion on the target selection feature corresponding to each first request response event in combination with the switchable knowledge point corresponding to each first request response event, and generates a regularized converted target selection feature.

And processing 1322, performing iterative cluster analysis on the regularized and converted target selection features to generate first iterative cluster analysis features.

The feature dimension number corresponding to the first iterative cluster analysis feature is smaller than the feature dimension number corresponding to the target selection feature. The first iterative cluster analysis feature is an analysis feature after iterative cluster analysis. The number of the obtained first iterative cluster analysis features corresponds to the number of the target selection features after regularized conversion, and the number of feature dimensions corresponding to each first iterative cluster analysis feature is smaller than the number of feature dimensions of the response operation track features corresponding to the first iterative cluster analysis feature, for example, the number of feature dimensions corresponding to the first iterative cluster analysis feature is half of the number of feature dimensions of the response operation track features corresponding to the first iterative cluster analysis feature. In some exemplary design considerations, process1322 may include the steps of:

The Process13221 combines the regularized and converted target selection features to determine feature tag propagation vectors corresponding to the regularized and converted target selection features.

For example, noise analysis is performed on each target selection feature after regularization, the target selection feature of the noise state in each target selection feature after regularization is determined, and then the feature tag propagation vector corresponding to each target selection feature after regularization is determined based on the target selection feature of the noise state in each target selection feature after regularization.

And the Process13222 performs iterative cluster analysis on the regularized and converted target selection features through the feature tag propagation vector to generate first iterative cluster analysis features.

The Process1323 determines a feature attention weight corresponding to each first request response event in combination with the first iterative cluster analysis feature corresponding to each first request response event.

The Process1323 may include:

and processing 13231, performing feature derivation on each first iterative cluster analysis feature based on a set feature derivation rule, performing iterative cluster analysis on the first iterative cluster analysis features after feature derivation, and generating second iterative cluster analysis features corresponding to each first iterative cluster analysis feature.

The number of feature dimensions corresponding to the second iterative cluster analysis feature obtained here is smaller than the number of feature dimensions corresponding to the first iterative cluster analysis feature corresponding to the second iterative cluster analysis feature, for example, the number of feature dimensions corresponding to the second iterative cluster analysis feature is the first number/2. If the arrangement parameter of the associated feature arrangement structure corresponding to the first request response event is a first number multiplied by D, and the arrangement parameter of the associated feature arrangement structure corresponding to each first iterative cluster analysis feature may be a first number multiplied by D/2, then the arrangement parameter of the associated feature arrangement structure corresponding to each second iterative cluster analysis feature obtained is a first number multiplied by a first number/2.

The Process13232, in combination with each second iterative cluster analysis feature, determines a feature attention weight corresponding to each first request response event.

For example, the associated feature duty ratio of the event category related to the first request response event in each second iterative cluster analysis feature may be counted and used as the feature attention weight corresponding to each first request response event.

The Process14 may include the following steps:

and the Process141 combines the feature attention weights corresponding to the first request response events to determine a first associated feature arrangement structure corresponding to the feature attention weights.

The arrangement parameter of the first association feature arrangement structure is the first quantity multiplied by the second quantity. The first associated feature arrangement structure comprises feature attention weights corresponding to the first request response events, and arrangement parameters of the associated feature arrangement structure corresponding to the obtained feature attention weights are the first quantity multiplied by the first quantity/2, and the associated feature arrangement structure is the first associated feature arrangement structure.

And (4) performing feature switching on the first associated feature arrangement structure by the Process142 to generate a second associated feature arrangement structure with arrangement parameters of which the first number is multiplied by the second number.

The feature switching is to transpose the associated feature positions corresponding to the feature attention weights in the associated feature arrangement structure.

And the Process143 is used for carrying out feature updating on the response operation track features corresponding to the first number of first request response events respectively by combining the second association feature arrangement structure and the request response event node matrix corresponding to the response operation track features of the first request response events, so as to generate a second number of second request response events and response operation track features corresponding to the second request response events.

The request response event node matrix corresponding to the response operation track feature of the first request response event may be an associated feature arrangement structure corresponding to the target selection feature after feature selection based on punishment. For example, the second association feature arrangement structure may be fused with the request response event node matrix corresponding to the response operation track features of the first request response event, so as to perform feature update aggregation on the response operation track features corresponding to each of the first number of first request response events, and generate a second number of second request response events and response operation track features corresponding to each of the second request response events. For example, if the request response event node matrix corresponding to the response operation track feature of the first request response event is a first number multiplied by D of associated feature arrangements, the second associated feature arrangement is a second number multiplied by the first number of associated feature arrangements, where the second number is the first number/2, then the second associated feature arrangements and the request response event node matrix are fused, so that an associated feature arrangement structure with an arrangement parameter of the second number multiplied by D can be obtained, and features of the associated feature arrangement structure with the second number multiplied by D are used as the response operation track feature corresponding to the second request response event.

In this exemplary embodiment, for the Process15, since the abnormal operation analysis model includes a plurality of feature update networks, after performing feature update processing on a first number of first request response events corresponding to the system request response big data and response operation track features corresponding to each first request response event through the first feature update network, generating a second number of second request response events and response operation track features corresponding to each second request response event, the second request response events generated by the first feature update network may be overlaid on the first request response events, overlaying the new number of first request response events on the first number of first request response events, and then, for each first request response event, determining the feature attention weight corresponding to the first request response event by combining the response operation track features of the first request response event. When the cycle traversal phase exceeds the set number of phases, it is terminated. For example, a first feature updating network is used for carrying out feature updating processing on a first number of first request response events corresponding to the system request response big data and response operation track features corresponding to the first request response events to generate a first generation, then the generation is used as loading of a second feature updating network, the second feature updating network is used for carrying out feature updating processing on the loading to generate a second generation, the second feature updating network is used as loading of a third feature updating network, the third feature updating network is used for carrying out feature updating processing on the loading to generate a third generation, and the third feature updating network is used as response operation track features corresponding to the second request response events generated last time. Finally, by combining the response operation track characteristics corresponding to each second request response event generated last time, determining the corresponding abnormal operation activity prediction probability distribution of the system request response big data, and combining the abnormal operation activity prediction probability distribution, determining the target response operation track characteristics corresponding to the system request response big data when determining the corresponding abnormal operation activity prediction probability distribution of the system request response big data by combining the response operation track characteristics of each second request response event generated last time. In the above scheme, the response operation track feature of each second request response event generated last time, namely the third feature updates the response operation track feature of each second request response event generated by the network. The target response operation track features are response operation track features obtained after punishment-based feature selection is carried out on the response operation track features of the second request response events generated last time, and the target response operation track features comprise the response operation track features of the second request response events. In combination with the target response operation trajectory feature, a corresponding abnormal operation activity prediction probability distribution of the system request response big data can be determined. The abnormal operation activity prediction probability distribution indicates probability classification values corresponding to the respective abnormal operation activities in response to the large data request by the system. For example, the target response operation trajectory features may be loaded into an abnormal operation analysis model, categorized through the fully connected network therein, to generate a corresponding abnormal operation activity prediction probability distribution for the system request response big data. In combination with the abnormal operation activity prediction probability distribution, abnormal operation activity of the system request response big data is determined. Wherein the abnormal operation activity predicts a maximum value of the probability distribution, or a candidate abnormal operation activity larger than the set probability value, that is, an abnormal operation activity for which the system requests to respond to big data.

The following provides an abnormal operation analysis model training method based on artificial intelligence, which comprises the following steps:

process1100, obtaining system request response template data.

The system request response template data, namely training samples, can be any system request response big data corresponding to abnormal operation analysis.

The Process1200 loads the system request response template data to an initialization abnormal operation analysis model, processes the system request response template data through the initialization abnormal operation analysis model, determines first prediction response operation track characteristics generated by each characteristic update network, and determines first prediction abnormal operation activity information corresponding to the system request response template data.

The feature updating network is used for combining response operation track features of first template request response events corresponding to system request response template data, determining feature attention weights of the first template request response events, combining the feature attention weights corresponding to the first template request response events, performing feature updating on response operation track features corresponding to a third number of first template request response events respectively, and generating a fourth number of target template request response events and first prediction response operation track features corresponding to the target template request response events. The first prediction abnormal operation activity information indicates that the system request response template data corresponds to probability values of each abnormal operation activity, the first prediction response operation track features are generated by the feature updating network, the target template request response event corresponds to the prediction response operation track features, and one feature updating network generates one first prediction response operation track feature. After loading the system request response template data into an initialized abnormal operation analysis model, the initialized abnormal operation analysis model firstly segments the system request response template data, generates a third number of first template request response events corresponding to the system request response template data, and determines response operation track characteristics corresponding to the first template request response events. And then processing the response operation track characteristics corresponding to the response events of the request of each first template by each characteristic updating network in the initialized abnormal operation analysis model, generating first prediction response operation track characteristics generated by each characteristic updating network, and then combining the first prediction response operation track characteristics generated by the last characteristic updating network to determine first prediction abnormal operation activity information corresponding to the request response template data of the system.

The Process1300 loads the system request response template data into the template neural network model, processes the system request response template data through the template neural network model, determines second prediction response operation track characteristics generated by each characteristic update network in the template neural network model, and determines second prediction abnormal operation activity information corresponding to the system request response template data.

The template neural network model may be a neural network model derived based on an abnormal operation analysis model, such as a deep learning model in the form of knowledge distillation, which is initialized as the student model therein. The method comprises the steps of determining the number of feature updating networks in a template neural network model and the correspondence of the feature updating networks in an abnormal operation analysis model, wherein the template neural network model comprises a first training convergence evaluation index, a second training convergence evaluation index, a third training convergence evaluation index, a second member training convergence evaluation index, a third member training convergence evaluation index and a fourth member training convergence evaluation index, and a deep learning inheritance unit for determining third prediction abnormal operation activity information corresponding to regression prediction response operation track characteristics and determining fourth prediction abnormal operation activity information corresponding to the second prediction response operation track characteristics. The second predicted response operation track feature is a predicted response operation track feature generated by a feature updating network in the template neural network model, one feature updating network in the template neural network model also corresponds to the second predicted response operation track feature, and the second predicted abnormal operation activity information is a probability value which is obtained by the template neural network model and can reflect that the system requests to respond to the template data and corresponds to each abnormal operation activity. After loading the system request response template data into the template neural network model, the template neural network model may partition the system request response template data first, generate a third number of first template request response events corresponding to the system request response template data, and determine response operation track features corresponding to the first template request response events. And then, each feature updating network in the template neural network model performs punishment-based feature selection on response operation track features corresponding to each first template request response event in a third number of first template request response events one by one, determines second prediction response operation track features generated by each feature updating network, and determines second prediction abnormal operation activity information corresponding to system request response template data by combining with the second prediction response operation track features generated by the last feature updating network. The feature updating network obtains a third number of second predicted response operation track features.

And the Process1400 is used for determining a target training convergence evaluation index of the initialized abnormal operation analysis model by combining the first predicted response operation track feature, the second predicted response operation track feature, the first predicted abnormal operation activity information and the second predicted abnormal operation activity information, and performing model convergence optimization on the initialized abnormal operation analysis model through the target training convergence evaluation index.

The condition of convergence may be training reaching a preset number of times or inference accuracy reaching a preset accuracy. And determining a training convergence evaluation index corresponding to the predicted response operation track characteristics by combining the first predicted response operation track characteristics and the second predicted response operation track characteristics. A training convergence evaluation index between the two pieces of predicted abnormal operation activity information may also be determined based on the first piece of predicted abnormal operation activity information and the second piece of predicted abnormal operation activity information. And then determining a target training convergence evaluation index of the initialized abnormal operation analysis model by combining training convergence evaluation indexes corresponding to the predicted response operation track characteristics and training convergence evaluation indexes between the two predicted abnormal operation activity information, and carrying out model convergence optimization on the initialized abnormal operation analysis model through the target training convergence evaluation index.

The Process1400 may include:

and processing 1401, for each feature updating network in the initialization abnormal operation analysis model, determining a first training convergence evaluation index corresponding to the feature updating network by combining the first prediction response operation track feature and the second prediction response operation track feature corresponding to the feature updating network.

For each feature updating network in the initialized abnormal operation analysis model, the feature updating network can be determined, the corresponding feature updating network in the template neural network model, and then the training convergence evaluation index between the first prediction response operation track feature and the second prediction response operation track feature is determined by combining the first prediction response operation track feature corresponding to the feature updating network and the second prediction response operation track feature corresponding to the corresponding feature updating network, and the training convergence evaluation index is used as the first training convergence evaluation index corresponding to the feature updating network.

Process1402 determines a second training convergence evaluation index that initializes the abnormal operation analysis model in combination with the first predicted abnormal operation activity information and the second predicted abnormal operation activity information.

The training convergence evaluation index between the two pieces of predicted abnormal operation activity information can be determined by combining the first piece of predicted abnormal operation activity information and the second piece of predicted abnormal operation activity information, and the training convergence evaluation index is used as a second training convergence evaluation index for initializing an abnormal operation analysis model.

And a Process1403, wherein the first training convergence evaluation index and the second training convergence evaluation index corresponding to the network are updated by combining the features, and the target training convergence evaluation index is determined.

The first training convergence evaluation index and the second training convergence evaluation index corresponding to each feature updating network can be used as target training convergence evaluation indexes.

In the Process1401, specifically, it may include:

and the Process14011 is used for combining the first prediction response operation track features to determine a third number of regression prediction response operation track features, wherein the third number is the number of first template request response events corresponding to the system request response template data.

The regression prediction response operation track features are prediction response operation track features obtained after the number-level regression is carried out on the first prediction response operation track features, and the number corresponding to the regression prediction response operation track features is larger than the number corresponding to the first prediction response operation track features. Because the number of first predicted responsive operation trajectory features generated by each feature updating network is less than the number of responsive operation trajectory features of the first template request response event, the number of second predicted responsive operation trajectory features generated by each feature updating network in the template neural network model is equal to the number of responsive operation trajectory features of the first template request response event. Then, after obtaining each first predicted response operation track feature, carrying out quantity regression on each first predicted response operation track feature, and generating a third quantity of regression predicted response operation track features corresponding to each first predicted response operation track feature. Such that the number of regression-predicted-response operation trajectory features corresponds to the number of second-predicted-response operation trajectory features.

And the Process14012 is used for determining a first training convergence evaluation index corresponding to the feature updating network by combining the third number of regression prediction response operation track features and the second prediction response operation track features.

For a third number of each regression prediction response operation trajectory feature, a second prediction response operation trajectory feature corresponding to the regression prediction response operation trajectory feature may be obtained first, then a training convergence evaluation index between the regression prediction response operation trajectory feature and the second prediction response operation trajectory feature is determined, then a first training convergence evaluation index is determined by combining training convergence evaluation indexes between every two prediction response operation trajectory features (the regression prediction response operation trajectory feature and the corresponding second prediction response operation trajectory feature), and the first training convergence evaluation index is used as a first training convergence evaluation index of a feature update network in the regression prediction response operation trajectory feature corresponding to the initialization abnormal operation analysis model. And combining the two steps, and respectively determining a first training convergence evaluation index corresponding to each feature update network in the initialization abnormal operation analysis model.

Wherein the Process14011 may include:

And the Process140111 performs regularization conversion on the second associated feature arrangement structure corresponding to the first predicted response operation track feature, generates a first predicted target selection feature after regularization conversion, performs feature switching on the associated feature arrangement structure corresponding to the first predicted target selection feature, and generates a third associated feature arrangement structure.

And processing 140112, performing iterative cluster analysis on the third associated feature arrangement structure to generate a second predicted target selection feature, and performing feature derivation on the second predicted target selection feature based on a set feature derivation rule to generate a third predicted target selection feature.

And processing 140113, performing iterative cluster analysis on the associated feature arrangement structure corresponding to the third prediction target selection feature, performing feature switching on the associated feature arrangement structure subjected to the iterative cluster analysis to generate a fourth associated feature arrangement structure, and determining a third number of regression prediction response operation track features by combining the fourth associated feature arrangement structure.

The arrangement parameters of the fourth associated feature arrangement structure comprise a third number of fields, and the number of feature dimensions in the arrangement parameters of the fourth associated feature arrangement structure is the number of feature dimensions corresponding to the response operation track features of the first template request response event. The process of regressing the first predicted-response operation trajectory feature generated by the second feature-updating network and the first predicted-response operation trajectory feature generated by the third feature-updating network in the initialized abnormal operation analysis model may refer to the above process of regressing the first predicted-response operation trajectory feature generated by the first feature-updating network.

In some exemplary design considerations, for the fourth associated feature permutation structure in Process140113, determining the third number of regression prediction response operation trajectory features may include: performing regularization conversion on the fourth associated feature arrangement structure, and performing repeated iterative cluster analysis on the fourth associated feature arrangement structure subjected to the regularization conversion to generate a fifth associated feature arrangement structure; and combining the fifth associated feature arrangement structure and the fourth associated feature arrangement structure to determine a third number of regression prediction response operation track features.

Wherein, for the first training convergence evaluation index corresponding to the feature update network combined with the third number of regression prediction response operation trajectory features and the second prediction response operation trajectory features, determining the first training convergence evaluation index corresponding to the feature update network may further include:

a: and determining a first member training convergence evaluation index according to the predicted response operation track characteristic and the second predicted response operation track characteristic.

B: and carrying out regression processing on the regression prediction response operation track characteristics, generating first target prediction response operation track characteristics associated with the regression prediction response operation track characteristics, and determining third prediction abnormal operation activity information corresponding to the first target prediction response operation track characteristics.

The first member training convergence evaluation index may be a training convergence evaluation index introduced in Process14011 and Process 14012.

The embodiment of the application also provides a deep learning inheritance unit which analyzes the regression prediction response operation track characteristics and the second prediction response operation track characteristics, determines the probability value of the regression prediction response operation track characteristics corresponding to the prediction response operation track characteristics generated for the template neural network model, and determines the probability value of the second prediction response operation track characteristics corresponding to the prediction response operation track characteristics generated for the template neural network model. The first target prediction response operation track feature is a prediction response operation track feature obtained by compressing the feature dimension number corresponding to the regression prediction response operation track feature. After each feature updating network in the abnormal operation analysis model generates each regression prediction response operation track feature, the regression prediction response operation track feature can be loaded to the deep learning inheritance unit, the abnormal operation analysis is carried out on each regression prediction response operation track feature through the deep learning inheritance unit, for example, the feature dimension number corresponding to each regression prediction response operation track feature is compressed, the feature dimension number corresponding to each regression prediction response operation track feature is reduced, and the first target prediction response operation track feature associated with each regression prediction response operation track feature is obtained. And classifying the first target prediction response operation track features through the deep learning inheritance unit, and determining probability values of the first target prediction response operation track features corresponding to the prediction response operation track features generated for the template neural network model as third prediction abnormal operation activity information corresponding to the first target prediction response operation track features.

C: and carrying out regression processing on the second predicted response operation track characteristics, generating second target predicted response operation track characteristics associated with the second predicted response operation track characteristics, and determining fourth predicted abnormal operation activity information corresponding to the second target predicted response operation track characteristics.

The second target prediction response operation track feature is obtained by compressing the feature dimension number corresponding to the second prediction response operation track feature. The fourth predicted abnormal operation activity information indicates a probability value that each of the second target predicted response operation trajectory characteristics corresponds to a predicted response operation trajectory characteristic generated for the template neural network model. After each feature in the obtained template neural network model updates each second prediction response operation track feature generated by the network, loading the second prediction response operation track feature into a deep learning inheritance unit, and respectively carrying out regression processing on each second prediction response operation track feature through the deep learning inheritance unit, for example, compressing the feature dimension number corresponding to each second prediction response operation track feature, reducing the feature dimension number corresponding to each second prediction response operation track feature, and obtaining a second target prediction response operation track feature related to each second prediction response operation track feature. In addition, the deep learning inheritance unit can be used for classifying each second target prediction response operation track feature, so that a probability value of each second target prediction response operation track feature corresponding to the prediction response operation track feature generated for the template neural network model is generated and used as fourth prediction abnormal operation activity information corresponding to the second target prediction response operation track feature.

D: determining a second member training convergence evaluation index in combination with the third predicted abnormal operation activity information and the fourth predicted abnormal operation activity information, and determining a first training convergence evaluation index in combination with the first member training convergence evaluation index and the second member training convergence evaluation index.

Wherein, in combination with the third predicted abnormal operation activity information and the fourth predicted abnormal operation activity information, determining the second member training convergence evaluation index may include:

d1: and determining a third member training convergence evaluation index by combining the third predicted abnormal operation activity information and the first marked abnormal operation activity information corresponding to the third predicted abnormal operation activity information.

The third prediction abnormal operation activity information indicates that each first target prediction response operation track characteristic corresponds to a probability value of a prediction response operation track characteristic generated for the template neural network model, each first target prediction response operation track characteristic is obtained by combining the first prediction response operation track characteristic generated by the characteristic updating network in the initialization abnormal operation analysis model, so that the probability value of the first target prediction response operation track characteristic corresponding to the prediction response operation track characteristic generated for the template neural network model is extremely low, weight parameter optimization convergence evaluation index calculation is carried out on the first target prediction response operation track characteristic and the third prediction abnormal operation activity information, a first training convergence evaluation index is determined by combining the obtained training convergence evaluation index, weight parameter optimization is carried out on the characteristic updating network in the initialization abnormal operation analysis model through the first training convergence evaluation index, and the accuracy of the first prediction response operation track characteristic generated by the characteristic updating network is improved.

D2: and determining a fourth member training convergence evaluation index by combining the fourth predicted abnormal operation activity information and the second marked abnormal operation activity information corresponding to the fourth predicted abnormal operation activity information.

The fourth prediction abnormal operation activity information indicates that each second target prediction response operation track feature corresponds to a probability value of a prediction response operation track feature generated for the template neural network model, and each second target prediction response operation track feature is obtained by combining the second prediction response operation track feature generated by the feature update network in the template neural network model, so that the probability value of the second target prediction response operation track feature corresponds to the prediction response operation track feature generated for the template neural network model is extremely large, a training convergence evaluation index is calculated with the fourth prediction abnormal operation activity information, a first training convergence evaluation index is determined by combining the obtained training convergence evaluation index, and then the feature update network in the initialization abnormal operation analysis model is subjected to weight parameter optimization through the first training convergence evaluation index, thereby realizing supervised learning on the generation of the feature update network in the initialization abnormal operation analysis model, and increasing the reliability of the first prediction response operation track feature generated by the feature update network.

D3: and determining a second member training convergence evaluation index by combining the third member training convergence evaluation index and the fourth member training convergence evaluation index.

The third member training convergence evaluation index and the fourth member training convergence evaluation index may be weighted, and the weighted result may be used as the second member training convergence evaluation index. In addition, after the second member training convergence evaluation index and the first member training convergence evaluation index are obtained, the second member training convergence evaluation index and the first member training convergence evaluation index may be used as the first training convergence evaluation index, or the second member training convergence evaluation index and the first member training convergence evaluation index may be summed up as the first training convergence evaluation index. Further, the steps can be combined to determine the first training convergence evaluation indexes corresponding to the feature updating networks in the initialization abnormal operation analysis model, and the weight parameter optimization can be performed on the feature updating networks through the first training convergence evaluation indexes corresponding to the feature updating networks.

In addition, for updating the first training convergence evaluation index and the second training convergence evaluation index corresponding to the network by combining each feature, the step of determining the target training convergence evaluation index may include:

The Process1501 combines the first predicted abnormal operation activity information and the marked abnormal operation activity information corresponding to the system request response template data to determine the probability prediction training convergence evaluation index corresponding to the initialized abnormal operation analysis model. The target training convergence evaluation index comprises probability prediction training convergence evaluation indexes between first prediction abnormal operation activity information and annotation abnormal operation activity information corresponding to system request response template data. The probabilistic predictive training convergence assessment indicator may be indicative of a training convergence assessment indicator between first predicted abnormal operation activity information generated by initializing the abnormal operation analysis model and labeled abnormal operation activity information corresponding to the system request response template data. The system request response template data corresponds to the marked abnormal operation activity information, and the marked abnormal operation activity information corresponds to the system request response template data. And carrying out loss function calculation through the first predicted abnormal operation activity information and the marked abnormal operation activity information corresponding to the system request response template data, and determining a probability prediction training convergence evaluation index corresponding to the initialized abnormal operation analysis model.

The Process1502 combines the first training convergence evaluation index, the second training convergence evaluation index and the probability prediction training convergence evaluation index corresponding to each feature update network to determine a target training convergence evaluation index.

And the first training convergence evaluation index, the determined second training convergence evaluation index and the determined probability prediction training convergence evaluation index corresponding to each feature update network in the initialized abnormal operation analysis model can be used as target training convergence evaluation indexes.

In some exemplary design ideas, for updating the first training convergence evaluation index and the second training convergence evaluation index corresponding to the network in combination with each feature, determining the target training convergence evaluation index may include:

and the Process1601 is used for carrying out abnormal operation analysis on the system request response template data by testing the neural network model, and determining fifth predicted abnormal operation activity information corresponding to the system request response template data.

The test neural network model may be a neural network model obtained through a general training manner, and the feature data may be classified. The fifth predicted abnormal operation activity information may indicate a probability value corresponding to each abnormal operation activity of the system request response template data. And carrying out abnormal operation analysis on the system request response template data through the test neural network model, and determining fifth predicted abnormal operation activity information corresponding to the system request response template data generated by the test neural network model.

The Process1602, in combination with the fifth predicted abnormal operation activity information and the first predicted abnormal operation activity information, determines a third training convergence evaluation index that initializes the abnormal operation analysis model.

A training convergence evaluation index can be calculated through the fifth predicted abnormal operation activity information and the first predicted abnormal operation activity information, and the training convergence evaluation index is used as a third training convergence evaluation index for initializing an abnormal operation analysis model.

And the Process1603, combining the first training convergence evaluation index, the second training convergence evaluation index and the third training convergence evaluation index to determine a target training convergence evaluation index.

The first training convergence evaluation index, the second training convergence evaluation index, and the third training convergence evaluation index may be used as target training convergence evaluation indexes, or the first training convergence evaluation index, the second training convergence evaluation index, the third training convergence evaluation index, and the probability prediction training convergence evaluation indexes in the above embodiments may be used together as target training convergence evaluation indexes, or the first training convergence evaluation index, the second training convergence evaluation index, the third training convergence evaluation index, and the probability prediction training convergence evaluation indexes may be combined to be used as target training convergence evaluation indexes. In addition, in some exemplary design ideas, the weight parameter optimization may be performed on the initialized abnormal operation analysis model by using one or more of the various training convergence evaluation indexes in the above embodiments, such as the first training convergence evaluation index, the second training convergence evaluation index, the third training convergence evaluation index, and the probability prediction training convergence evaluation index, as the target training convergence evaluation index.

For one embodiment, FIG. 2 shows a big data application system 100, the big data application system 100 having one or more processors 102, a control module (chipset) 104 coupled to at least one of the processor(s) 102, a memory 106 coupled to the control module 104, a non-volatile memory (NVM)/storage device 108 coupled to the control module 104, one or more input/output devices 110 coupled to the control module 104, and a network interface 112 coupled to the control module 106.

The processor 102 may include one or more single-core or multi-core processors, and the processor 102 may include any combination of general-purpose or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, big data application 100 can be a server device such as a gateway as described in some exemplary design considerations.

In some embodiments, big data application 100 may include one or more computer-readable media (e.g., memory 106 or NVM/storage 108) having instructions 114 and one or more processors 102 combined with the one or more computer-readable media for executing instructions 114 to implement modules to perform actions described in this disclosure.

For one embodiment, the control module 104 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 102 and/or any suitable device or component in communication with the control module 104.

The control module 104 may include a memory controller module to provide an interface to the memory 106. The memory controller modules may be hardware modules, software modules, and/or firmware modules.

Memory 106 may be used to load and store data and/or instructions 114 for big data application 100, for example. For one embodiment, memory 106 may comprise any suitable volatile memory, such as, for example, a suitable DRAM. In some embodiments, memory 106 may comprise double data rate type four synchronous dynamic random access memory (DDR 4 SDRAM).

For one embodiment, control module 104 may include one or more input/output controllers to provide interfaces to NVM/storage 108 and input/output device(s) 110.

For example, NVM/storage 108 may be used to store data and/or instructions 114. NVM/storage 108 may include any suitable nonvolatile memory (e.g., flash memory) and/or may include any suitable nonvolatile storage(s) (e.g., one or more Hard Disk Drives (HDDs), one or more Compact Disc (CD) drives, and/or one or more Digital Versatile Disc (DVD) drives).

NVM/storage 108 may include storage resources that are physically part of the device on which big data application 100 is installed or may be accessible by the device without necessarily being part of the device. For example, NVM/storage 108 may be accessed via input/output device(s) 110 according to a network.

Input/output device(s) 110 may provide an interface for big data application system 100 to communicate with any other suitable device, input/output device 110 may include a communication component, pinyin component, sensor component, and the like. The network interface 112 may provide an interface for the big data application system 100 to communicate in accordance with one or more networks, and the big data application system 100 may communicate wirelessly with one or more components of a wireless network in accordance with any of one or more wireless network standards and/or protocols, such as accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof.

For one embodiment, at least one of the processor(s) 102 may be packaged together with logic of one or more controllers (e.g., memory controller modules) of the control module 104. For one embodiment, at least one of the processor(s) 102 may be packaged together with logic of one or more controllers of the control module 104 to form a System In Package (SiP). For one embodiment, at least one of the processor(s) 102 may be integrated on the same mold as logic of one or more controllers of the control module 104. For one embodiment, at least one of the processor(s) 102 may be integrated on the same die with logic of one or more controllers of the control module 104 to form a system on chip (SoC).

Still another embodiment of the present application provides a computer readable storage medium having stored therein computer-executable instructions which, when executed by a processor, are configured to implement the method for analyzing abnormal operations based on artificial intelligence as described in any one of the above embodiments.

Yet another embodiment of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the artificial intelligence based abnormal operation analysis method as described in any one of the above embodiments.

The foregoing is merely an optional implementation manner of some of the implementation scenarios of the present application, and it should be noted that, for those skilled in the art, it is also within the scope of protection of the embodiments of the present application to combine other similar implementation manners based on the technical ideas of the present application without departing from the technical idea of the scheme of the present application.

Claims

1. An abnormal operation analysis method based on artificial intelligence, which is applied to a big data application system, wherein the big data application system is in communication connection with a plurality of user terminals, the method comprises the following steps:

based on the abnormal operation activity and the historical priori abnormal root cause information corresponding to the abnormal operation activity, carrying out abnormal information prompt on the corresponding user terminal;

the step of performing abnormal operation analysis on the big data of the system request response to determine the corresponding abnormal operation activities meeting the characteristic attention weight and the historical priori abnormal root cause information corresponding to the abnormal operation activities comprises the following steps:

combining the system request response big data, and determining a first number of first request response events corresponding to the system request response big data and response operation track characteristics corresponding to each first request response event;

for each first request response event, determining a feature attention weight corresponding to the first request response event by combining response operation track features of the first request response event; combining the feature attention weight corresponding to each first request response event, carrying out feature update on the response operation track features corresponding to the first number of first request response events respectively, and generating a second number of second request response events and response operation track features corresponding to each second request response event, wherein the second number is smaller than the first number;

Determining abnormal operation activities of the system request response big data according to response operation track characteristics corresponding to the second request response events; combining a historical prior abnormal root cause knowledge base to determine historical prior abnormal root cause information corresponding to the abnormal operation activity;

the determining, for each first request response event, a feature attention weight corresponding to the first request response event in combination with a response operation track feature of the first request response event includes:

combining target selection features corresponding to the first request response events, and determining feature attention weights corresponding to the first request response events;

the determining the feature attention weight corresponding to the first request response event by combining the target selection features corresponding to the first request response event comprises the following steps:

Performing iterative cluster analysis on the regularized and converted target selection features to generate first iterative cluster analysis features; the feature dimension number corresponding to the first iterative cluster analysis feature is smaller than the feature dimension number corresponding to the target selection feature;

combining the first iterative cluster analysis features corresponding to the first request response events to determine feature attention weights corresponding to the first request response events;

the step of performing regularization conversion on the target selection features corresponding to the first request response events to generate regularized target selection features comprises the following steps:

combining the convertible knowledge points corresponding to the first request response events, carrying out regularization conversion on the target selection features corresponding to the first request response events, and generating regularized target selection features;

performing iterative cluster analysis on the regularized transformed target selection feature to generate a first iterative cluster analysis feature, including:

Performing iterative cluster analysis on the regularized and converted target selection features through the feature tag propagation vector to generate first iterative cluster analysis features;

combining the first iterative cluster analysis features corresponding to the first request response events to determine feature attention weights corresponding to the first request response events, including:

combining the second iterative cluster analysis features to determine feature attention weights corresponding to the first request response events;

the feature updating is performed on the response operation track features corresponding to the first number of first request response events by combining the feature attention weights corresponding to the first request response events, and a second number of second request response events and response operation track features corresponding to the second request response events are generated, including:

Performing feature switching on the first associated feature arrangement structure to generate a second associated feature arrangement structure, wherein the arrangement parameters of the second associated feature arrangement structure are the second number multiplied by the first number;

combining the second association feature arrangement structure and a request response event node matrix corresponding to response operation track features of the first request response events, performing feature update on the response operation track features corresponding to the first number of first request response events respectively, and generating a second number of second request response events and response operation track features corresponding to the second request response events;

combining response operation track characteristics corresponding to the second request response events to determine abnormal operation activities of the system request response big data, wherein the abnormal operation activities comprise:

covering a first request response event by the second request response event, and adjusting the numerical parameters corresponding to the first quantity to the numerical parameters corresponding to the first request response event;

circularly executing the steps of aiming at each first request response event and determining the feature attention weight corresponding to the first request response event by combining the response operation track features of the first request response event;

When the set cycle times are reached, determining abnormal operation activity prediction probability distribution corresponding to the system request response big data by combining response operation track characteristics corresponding to each second request response event generated last time;

2. The abnormal operation analysis method based on artificial intelligence according to claim 1, wherein the method is implemented by an abnormal operation analysis model, which is trained by the following steps:

acquiring system request response template data;

loading the system request response template data to initialize an abnormal operation analysis model, wherein the abnormal operation analysis model comprises a plurality of feature updating networks;

3. The abnormal operation analysis method based on artificial intelligence according to claim 2, wherein the determining the target training convergence evaluation index of the initialized abnormal operation analysis model by combining the first predicted response operation trajectory feature, the second predicted response operation trajectory feature, the first predicted abnormal operation activity information, and the second predicted abnormal operation activity information comprises:

combining the first training convergence evaluation index and the second training convergence evaluation index corresponding to each feature updating network to determine the target training convergence evaluation index;

the determining, by combining the first predicted response operation track feature and the second predicted response operation track feature corresponding to the feature update network, a first training convergence evaluation index corresponding to the feature update network includes:

performing regularization conversion on a second template associated feature arrangement structure corresponding to the first prediction response operation track feature to generate a regularized first prediction target selection feature, and performing feature switching on the template associated feature arrangement structure corresponding to the first prediction target selection feature to generate a third template associated feature arrangement structure;

Performing iterative cluster analysis on the third template associated feature arrangement structure to generate a second predicted target selection feature, and performing feature derivation on the second predicted target selection feature based on a set feature derivation rule to generate a third predicted target selection feature;

performing iterative cluster analysis on a template associated feature arrangement structure corresponding to the third prediction target selection feature, performing feature switching on the template associated feature arrangement structure subjected to the iterative cluster analysis to generate a fourth template associated feature arrangement structure, and determining the third number of regression prediction response operation track features by combining the fourth template associated feature arrangement structure, wherein the arrangement parameters of the fourth template associated feature arrangement structure comprise a third number of fields, the number of feature dimensions in the arrangement parameters of the fourth template associated feature arrangement structure is the number of feature dimensions corresponding to the response operation track features of the first template request response event, and the third number is the number of first template request response events corresponding to the system request response template data;

combining the third number of regression prediction response operation track features and the second prediction response operation track features to determine a first training convergence evaluation index corresponding to the feature update network;

Wherein, the determining the third number of regression prediction response operation trajectory features in combination with the fourth template associated feature arrangement structure includes:

performing regularization conversion on the fourth template associated feature arrangement structure, and performing repeated iterative cluster analysis on the fourth template associated feature arrangement structure subjected to regularization conversion to generate a fifth template associated feature arrangement structure;

combining the fifth template associated feature arrangement structure and the fourth template associated feature arrangement structure to determine the third number of regression prediction response operation track features;

wherein the determining, by combining the third number of regression prediction response operation trajectory features and the second prediction response operation trajectory features, a first training convergence evaluation index corresponding to the feature update network includes:

4. The abnormal operation analysis method based on artificial intelligence according to claim 3, wherein the determining a second member training convergence evaluation index by combining the third predicted abnormal operation activity information and the fourth predicted abnormal operation activity information comprises:

Combining the third member training convergence evaluation index and the fourth member training convergence evaluation index to determine the second member training convergence evaluation index;

wherein the determining the target training convergence evaluation index by combining the first training convergence evaluation index and the second training convergence evaluation index corresponding to each feature updating network includes:

combining the first training convergence evaluation index, the second training convergence evaluation index and the probability prediction training convergence evaluation index corresponding to each feature updating network to determine the target training convergence evaluation index;

or, through testing the neural network model, carrying out abnormal operation analysis on the system request response template data, and determining fifth predicted abnormal operation activity information corresponding to the system request response template data;

5. A big data application system, characterized in that the big data application system comprises a processor and a memory for storing a computer program capable of running on the processor, the processor being adapted to execute the artificial intelligence based abnormal operation analysis method according to any of claims 1-4 when the computer program is run.