CN109948669A - A kind of abnormal deviation data examination method and device - Google Patents
A kind of abnormal deviation data examination method and device Download PDFInfo
- Publication number
- CN109948669A CN109948669A CN201910159780.7A CN201910159780A CN109948669A CN 109948669 A CN109948669 A CN 109948669A CN 201910159780 A CN201910159780 A CN 201910159780A CN 109948669 A CN109948669 A CN 109948669A
- Authority
- CN
- China
- Prior art keywords
- target object
- data
- binary tree
- abnormal
- training sample
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Abstract
The embodiment of the invention provides a kind of abnormal deviation data examination method and devices, it is related to technical field of data processing, this method comprises: obtaining the data to be tested of target object, data to be tested based on target object, every random binary tree in isolated forest model is traversed, determines position of the target object on every random binary tree.According to position of the target object on every random binary tree, determines the abnormal score of target object, then according to the abnormal score of target object, determine the abnormal conditions of target object.Due to the abnormal conditions using isolated forest model detected target object, reduces to artificial dependence, simplify detection process.When forest model is isolated in training, the feature of training sample includes at least the temporal aspect of target object, therefore isolated forest model can consider influence of the temporal aspect to abnormal conditions of target object in the abnormal conditions of detected target object, to improve the accuracy of abnormality detection, reduces and accidentally alert.
Description
Technical field
The present embodiments relate to technical field of data processing more particularly to a kind of abnormal deviation data examination methods and device.
Background technique
The daily operation data in internet is many kinds of, and the curve feature of the operation indicator of different scenes is different, and identical finger
The fluctuation range being marked between different business is also different.How while guaranteeing to alert accuracy, versatility is taken into account, exception is made
Detection method is suitable for the different business under several scenes, and does not rely on human factor excessively again, is that abnormality detection is faced
Major Difficulties.
Currently, method for detecting abnormality includes threshold method, i.e., analyzed, is arranged based on the fluctuation range for treating detection curve
Alarm threshold.This method relies on artificial experience, and different indexs, different business needs are separately configured, and configuration process is numerous
It is trivial.In addition often difference is bigger for different moments waving interval in the period, and the threshold test for relying solely on setting is abnormal, often deposits
It is alerted in more mistake.
Summary of the invention
Due to excessively relying on manually using threshold method detection is abnormal, not only configuration process is cumbersome, and there are more mistake announcements
Alert problem, the embodiment of the invention provides a kind of abnormal deviation data examination method and devices.
On the one hand, the embodiment of the invention provides a kind of abnormal deviation data examination methods, comprising:
Obtain the data to be tested of target object；
Based on the data to be tested of the target object, every random binary tree in isolated forest model is traversed, determines institute
Position of the target object on every random binary tree is stated, the isolated forest model is with the historical data of the target object
It is obtained for training sample training, the historical data cyclically-varying of the target object, the feature of the training sample is at least wrapped
Include the temporal aspect of the target object；
According to position of the target object on every random binary tree, the abnormal score of the target object is determined；
According to the abnormal score of the target object, the abnormal conditions of the target object are determined.
On the one hand, the embodiment of the invention provides a kind of anomaly data detection devices, comprising:
Module is obtained, for obtaining the data to be tested of target object；
Detection module, for the data to be tested based on the target object, traverse in isolated forest model every it is random
Binary tree determines position of the target object on every random binary tree, and the isolated forest model is with the target
The historical data of object is that training sample training obtains, the historical data cyclically-varying of the target object, the trained sample
This feature includes at least the temporal aspect of the target object；
Processing module determines the target pair for the position according to the target object on every random binary tree
The abnormal score of elephant；
Judgment module determines the abnormal conditions of the target object for the abnormal score according to the target object.
On the one hand, the embodiment of the invention provides a kind of abnormality detecting apparatus, including at least one processing unit, Yi Jizhi
A few storage unit, wherein the storage unit is stored with computer program, when described program is executed by the processing unit
When, so that the step of processing unit executes abnormal deviation data examination method.
On the one hand, the embodiment of the invention provides a kind of computer-readable medium, being stored with can be by abnormality detecting apparatus
The computer program of execution, when described program is run on abnormality detecting apparatus, so that abnormality detecting apparatus execution is different
The step of regular data detection method.
In the embodiment of the present invention, in advance using the historical data of target object as the isolated forest model of training sample training, adopt
With the abnormal conditions of isolated forest model detected target object, reduces to artificial dependence, simplify detection process.Training is lonely
When vertical forest model, the feature of training sample includes at least the temporal aspect of target object, therefore trained isolated forest model
In the abnormal conditions of detected target object, influence of the temporal aspect to abnormal conditions of target object can be considered, to improve
The accuracy of abnormality detection is reduced and is accidentally alerted.
Detailed description of the invention
To describe the technical solutions in the embodiments of the present invention more clearly, make required in being described below to embodiment
Attached drawing is briefly introduced, it should be apparent that, drawings in the following description are only some embodiments of the invention, for this
For the those of ordinary skill in field, without any creative labor, it can also be obtained according to these attached drawings
His attached drawing.
Fig. 1 is a kind of schematic diagram of abnormal point provided in an embodiment of the present invention；
Fig. 2 is a kind of application scenarios schematic diagram that the embodiment of the present invention is applicable in；
Fig. 3 is a kind of flow diagram for abnormal deviation data examination method that the embodiment of the present invention is applicable in；
Fig. 4 is the flow diagram for the method that forest is isolated in a kind of building that the embodiment of the present invention is applicable in；
Fig. 5 is the flow diagram for the method that forest is isolated in a kind of building that the embodiment of the present invention is applicable in；
Fig. 6 is a kind of schematic diagram for abnormal point that the embodiment of the present invention is applicable in；
Fig. 7 is a kind of flow diagram for abnormal deviation data examination method that the embodiment of the present invention is applicable in；
Fig. 8 is a kind of structural schematic diagram for anomaly data detection device that the embodiment of the present invention is applicable in；
Fig. 9 is a kind of structural schematic diagram for abnormality detecting apparatus that the embodiment of the present invention is applicable in.
Specific embodiment
In order to which the purpose of the present invention, technical solution and beneficial effect is more clearly understood, below in conjunction with attached drawing and implementation
Example, the present invention will be described in further detail.It should be appreciated that specific embodiment described herein is only used to explain this hair
It is bright, it is not intended to limit the present invention.
In order to facilitate understanding, noun involved in the embodiment of the present invention is explained below.
Isolated forest model: (Isolation Forest, abbreviation iForest) is a kind of suitable for continuous data
The unsupervised anomaly detection method of (Continuous numerical data), that is, do not need markd sample to train, but
Feature needs to be continuous.For how to search which point be easy isolated (isolated), iForest used it is a set of very
Efficient strategy.In isolated forest, recursively random division data set, until all sample points are all isolated.At this
Under the strategy of kind random division, abnormal point usually has shorter path.
Global abnormal: abnormal relative to other whole samples.For example, as shown in Figure 1, the value of global abnormal point is greater than song
The value of all the points on line.
Local anomaly: abnormal only with respect to other samples in same position in the period.For example, as shown in Figure 1, part
The value of abnormal point is not greater than the value of all the points on curve, but is greater than period inner curve in the value at the moment.
During concrete practice, it was found by the inventors of the present invention that the production and operation data of internet industry have one mostly
Fixed cycle, often difference is very big for the different moments waving interval in the period, relies on artificial experience and threshold value is arranged, based on to be measured
The fluctuation range of curve is analyzed, and alarm threshold is arranged, and this method configuration process is cumbersome, often there is more accidentally alarm.
For this purpose, the present inventor using unsupervised algorithm to abnormal it is considered that can be detected, unsupervised algorithm
Without realizing that marker samples are classified, and the case where be applicable in positive and negative imbalanced training sets.Based on algorithm accuracy rate, computation complexity, lead to
With the performance of property etc., iForest is better than other unsupervised algorithms, be adapted to more scenes, multi-service, high frequency abnormality detection field
Scape.But tradition iForest is when detecting abnormal data, does not take into account that the timing of data, therefore can only detection data it is complete
Office is abnormal, and is unable to the local anomaly of detection data.And the daily operation data of internet is generally periodically variable data,
Many local anomalies are also the part for needing to pay special attention to.For this purpose, in the embodiment of the present invention, in the isolated forest model of training,
The temporal aspect of target object is added in the feature of training sample.In the data to be tested of detected target object, it is based on mesh
The data to be tested of object are marked, every random binary tree in isolated forest model is traversed, determines target object at every random two
Position on fork tree.Then the position according to target object on every random binary tree, determines the abnormal score of target object,
Later further according to the abnormal score of target object, the abnormal conditions of target object are determined.Due in the isolated forest model of training,
The temporal aspect of target object is added in the feature of training sample, therefore uses trained isolated forest model detected target object
Abnormal conditions when, using the temporal aspect of target object as judge target object whether Yi Chang factor, thus can detect
Global abnormal can also detect local anomaly, to increase the applicable application scenarios of isolated forest, reduce the mistake of abnormality detection
Alarm rate.
Abnormal deviation data examination method in the embodiment of the present invention can be applied to application scenarios as shown in Figure 2, answer at this
With in scene include abnormality detection server 201, terminal device 202.
Abnormality detection server 201 can be the server cluster or cloud meter of a server or several servers composition
Calculation center.Terminal device 202 is the electronic equipment for having network communications capability, which can be smart phone, plate
Computer or portable personal computer etc..
Abnormality detection server 201 establishes isolated forest model for each target object, is getting target object
After data to be tested, using the abnormal conditions of the corresponding isolated forest model detected target object of target object.Abnormality detection clothes
The abnormal conditions of target object are sent to terminal device 202 by wireless network by business device 201.Terminal device 202 is with chart etc.
The abnormal conditions of target object are showed operation maintenance personnel by form.
Based on application scenario diagram shown in Fig. 2, the embodiment of the invention provides a kind of process of abnormal deviation data examination method,
The process of this method can be executed by anomaly data detection device, and anomaly data detection device can be abnormality detection shown in Fig. 2
Server 201, as shown in Figure 3, comprising the following steps:
Step S301 obtains the data to be tested of target object.
Specifically, data to be tested can be the operation data of all kinds of operation scenes, and target object can be operation data
Index.For example, by the amount of supplementing with money of game money, consumption and can be given when the game money to gaming platform is monitored
The amount of sending is used as target object.For another example, when the trading volume to transaction platform is monitored, trading volume, transaction can be blocked
Cut amount, transaction interception ratio is all used as target object.
Step S302, the data to be tested based on target object traverse every random binary tree in isolated forest model, really
Set the goal position of the object on every random binary tree.
Specifically, isolated forest model includes more random binary trees, and isolated forest model is the history with target object
Data are that training sample training obtains, for example isolates forest mould by training sample training of 30 days data before current time
Type.The historical data cyclically-varying of target object, the feature of training sample include at least the temporal aspect of target object.Timing
Feature is for current period compared to preceding several periods in variation mutually in the same time.
In a kind of possible embodiment, temporal aspect can for current period target object data and preceding several weeks
Phase the average value of data mutually in the same time ratio, i.e., when the data of target object are identical compared in preceding several periods this moment
The average level of the data at quarter increases or reduces how many.Illustratively, the data of target object are set as X (t), define target
The temporal aspect Y (t) of object meets following formula (1):
Wherein, X (t) is the data of target object, and Y (t) is the temporal aspect of target object, and T is the period of target object,
M is the amount of cycles before X (t).
In a kind of possible embodiment, temporal aspect can for current period target object data and preceding several weeks
Difference of the phase in the average value of data mutually in the same time.Illustratively, the data of target object are set as X (t), define target pair
The temporal aspect Y (t) of elephant meets following formula (2):
Wherein, X (t) is the data of target object, and Y (t) is the temporal aspect of target object, and T is the period of target object,
M is the amount of cycles before X (t).
Step S303 determines the abnormal score of target object according to position of the target object on every random binary tree.
Specifically, the abnormal score of target object is determined using following formula (3):
Wherein,For the abnormal score of target object, CFor each random y-bend in isolated forest model
The average path length of tree, h (x) are path length of the target object x in isolated forest on every random binary tree, and E is to ask
Average value.
Further, path length h (x) of the target object x in isolated forest on every random binary tree meets following
Formula (4):
Wherein, n is the sample number where target object x on leaf node, and e is target object x from root node to leaf section
The number of edges that point passes through, H (n-1) ≈ ln (n-1)+ξ, Euler's constant ξ=0.5772156649.
Step S304 determines the abnormal conditions of target object according to the abnormal score of target object.
Specifically, outlier threshold can be set in advance, for example set 0.7 for outlier threshold, when the exception of target object
When score value is greater than 0.7, target object is determined as exception, is otherwise determined as target object normally.
Due to adding the temporal aspect of target object in the feature of training sample, therefore adopting in the isolated forest model of training
When with the abnormal conditions of trained isolated forest model detected target object, using the temporal aspect of target object as judging mesh
Mark object whether Yi Chang factor, thus can detect global abnormal, can also detect local anomaly, to increase isolated forest
Applicable application scenarios reduce the false alarm rate of abnormality detection.
Optionally, in above-mentioned steps S302, the training process of isolated forest model specifically includes following steps, such as Fig. 4
It is shown:
Step S401 obtains the historical data of target object as training sample.
Such as obtain current time before 30 days target object data as training sample.
Step S402 determines the characteristic set of training sample, the temporal aspect of target object is included at least in characteristic set.
It specifically, include the feature of each dimension of target object, such as target object sheet in the characteristic set of training sample
Body can be used as feature of a dimension, such as temporal aspect etc..
Step S403 carries out n times random sampling to training sample, extracts M sample every time and construct random binary tree.
When constructing every random binary tree, using the feature randomly selected from characteristic set as boundary feature, with boundary
The value randomly selected in the value interval of feature is greater than 0, N and is greater than 0 as cut off value, M.The stopping when meeting preset condition, it is raw
At random binary tree, wherein preset condition can be that sample can not divide again or random binary tree reaches depth capacity.
Step S404 determines isolated forest model according to N of building random binary tree.
It is illustrated so that target object is the game money amount of supplementing with money as an example below, as shown in figure 5, before obtaining current time
The daily each period game money amount of supplementing with money X (t) is used as training sample, period T within 30 days.Extract the game money amount of supplementing with money X (t) when
Sequence characteristics Y (t), wherein temporal aspect Y (t) be current period the amount of supplementing with money with preceding several periods in the amount of supplementing with money mutually in the same time
Average value ratio.Feature in defined feature set includes the game money amount of supplementing with money X (t) and temporal aspect Y (t).
Randomly selected from training sample 4 training samples { a, b, c, d } for construct first random binary tree, from spy
Collection randomly selects a feature as boundary feature in closing.It is special as boundary that the game money amount of supplementing with money X (t) has been randomly selected in setting
Sign, then randomly select a value as cut off value out of the game money amount of supplementing with money X (t) value interval.If above-mentioned training sample
The game money amount of supplementing with money X (t) is less than cut off value, then is divided into left child node, is otherwise divided into right child node.Setting training sample a,
B, the game money amount of supplementing with money the X (t) of c is less than cut off value, then training sample a, b, c is divided into left child node, the trip of training sample d
The coin amount of supplementing with money X (t) is played not less than cut off value, then training sample d is divided into right child node.Whether the current random binary tree of judgement
Meet any one following preset condition:
Whether preset condition one, current random binary tree reach depth capacity.
Preset condition two, currently whether the training sample of each node of random binary tree can not be further continued for dividing.
It can continue to divide including 3 training samples in left child node in current random binary tree.In right child node only
1 training sample, it is not possible to be further continued for dividing.For left child node, a feature is randomly selected from characteristic set and is used as and is divided
Boundary's feature.Setting has randomly selected temporal aspect Y (t) as boundary feature, then out of temporal aspect Y (t) value interval with
Machine chooses a value and is used as cut off value.When the temporal aspect Y (t) of training sample is less than cut off value, it is divided into left Sun Jiedian, otherwise
It is divided into right Sun Jiedian.It sets in training sample a, b, c, the temporal aspect Y (t) of training sample a is less than cut off value, then trains sample
This is divided into left Sun Jiedian, and the temporal aspect Y (t) of training sample b, c are not less than cut off value, then training sample b, c is divided into
Right Sun Jiedian.Then judge whether current random binary tree meets preset condition again, if satisfied, then terminate to train and generate with
Machine binary tree, otherwise continues to divide training sample according to above-mentioned steps.After generating a random binary tree, then from instruction
Practice and randomly select 4 training samples in sample and construct another random binary tree, for example, randomly select training sample a, b, d,
E }, { a, b, e, f } etc..And so on, when the quantity of the random binary tree of building is equal to preset value, using the random of building
Binary tree forms isolated forest.
Due to when constructing every random binary tree of isolated forest, using the temporal aspect of target object as characteristic set
In a feature, therefore randomly selected from characteristic set feature as boundary feature when, the temporal aspect of target object can
It can be extracted and divide training sample as boundary feature, so that the random binary tree of building and the temporal aspect of target object be made to have
Standby correlation.
Optionally, when the historical data of target object updates, using the historical data of update as training sample re -training,
Obtain the isolated forest model updated.
Illustratively, as shown in fig. 6, setting target object the game money amount of supplementing with money X (t), gaming platform in order to promote,
The activity for sending game money is supplemented in daily 20 points of releases with money.During activity, daily 20 points, the game money amount of supplementing with money X (t) occurs supplementing height with money
Peak, 3 points of a, b, c as shown in FIG. 6.When not accounting for popularization activity, 3 points of a, b, c can may be remembered as global different
Chang Dian, and actually 3 points of a, b, c are peak caused by normal popularization activity.For this purpose, can be supplemented with money detecting daily game money
When whether amount X (t) is abnormal, obtained using daily 30 days in the past historical datas as training sample re -training and isolate forest mould
Type.When daily 20 points of numbers for peak occur are more and more, the isolated forest model that re -training obtains will capture this rule,
To increasingly tend to daily 20 points of peak being considered as normal point.By constantly updating isolated forest model, so that in industry
When business is promoted and data occurs and periodically uprush, can gradually identify this it is normal periodically increase sharply, reduce abnormal score, reduce and miss
Alarm.
Optionally, multiple target objects are frequently included in a business scenario, when a target object occurs abnormal simultaneously
It cannot illustrate that exception has occurred in entire business scenario, if directly alerting at this time, false alarm rate will be increased, for this purpose, the present invention is implemented
Exception Type is determined according to the abnormal conditions of multiple target objects in example, then determines whether to alert according to Exception Type.
Specifically, Exception Type includes but is not limited to that business draws receipts, game money to be brushed, strategy fails, and wherein business, which is drawn, receives
Belong to the type for not needing alarm, and game money is brushed, strategy unsuccessfully needs to alert.
When determining Exception Type according to the abnormal conditions of multiple target objects, the embodiment of the present invention at least provides two
Kind embodiment:
In a kind of possible embodiment, the abnormal conditions of multiple target objects are inputted into preset decision matrix, really
Determine Exception Type.
Specifically, decision matrix can be constructed according to expertise in advance, decision matrix illustrates each target object
Correlation between abnormal conditions and Exception Type.
In a kind of possible embodiment, the abnormal conditions of multiple target objects are inputted into disaggregated model, are determined abnormal
Type, disaggregated model are obtained by the mapping relations of the abnormal conditions and Exception Type that learn multiple target objects.
Specifically, disaggregated model can with two disaggregated models, be also possible to more disaggregated models, in specific implementation, disaggregated model
Including but not limited to decision tree, neural network model.When constructing disaggregated model, for example when constructing decision tree, acquisition includes
The data of the business scenario of multiple target objects are as training sample, then manually according to target object each in training sample
Abnormal conditions mark the Exception Type of training sample, later again using the training sample building decision tree that Exception Type is marked.
After the abnormal conditions for determining multiple target objects using isolated forest, the abnormal conditions of multiple target objects are inputted into decision tree mould
Type, output abnormality type.
Exception Type is judged by the abnormal conditions of the multiple target objects of combination, then determines whether to alert again, compared to
According to single target object abnormal conditions and for alerting, accuracy is higher, can greatly reduce due to producing spy in practice
It is accidentally alerted caused by different situation, lifting system overall accuracy.
Embodiment in order to preferably explain the present invention describes the embodiment of the present invention below with reference to specific implement scene and provides
A kind of abnormal deviation data examination method, this method can execute by anomaly data detection device, as shown in fig. 7, abnormal data is examined
Surveying device includes abnormality detection module and anomalous discrimination module.Target object is set to disappear as the game money amount of supplementing with money X (t), game money
Consumption Z (t), the game money amount of giving P (t), period are T.By the game money amount of supplementing with money X (t), game money consumption Z (t), game
The coin amount of giving P (t) inputs abnormality detection module respectively.For the game money amount of supplementing with money X (t), abnormality detection module extracts game money
The temporal aspect Y (t) of the amount of supplementing with money X (t), wherein temporal aspect Y (t) be current period the amount of supplementing with money with preceding several periods in phase
The ratio of the average value of the amount of supplementing with money in the same time.Abnormality detection module is using the corresponding isolated forest inspection of the game money amount of supplementing with money X (t)
Survey the abnormal conditions of the game money amount of supplementing with money X (t).Specifically, lonely based on the game money amount of supplementing with money X (t) and temporal aspect Y (t) traversal
Every random binary tree in vertical forest model, determines position of the game money amount of supplementing with money the X (t) on every random binary tree, then
According to position of the game money amount of supplementing with money the X (t) on every random binary tree, the abnormal score of the game money amount of supplementing with money X (t) is determined,
Later further according to the abnormal score of the game money amount of supplementing with money X (t), the abnormal conditions of the game money amount of supplementing with money X (t) are determined.For game
Coin consumption Z (t) and the game money amount of giving P (t), abnormality detection module detect the process and the game money amount of supplementing with money X of abnormal conditions
(t) identical, details are not described herein again, wherein the temporal aspect of game money consumption Z (t) is M (t), the game money amount of giving P's (t)
Temporal aspect is N (t).By the abnormal conditions of the game money amount of supplementing with money X (t), the abnormal conditions of game money consumption Z (t) and game
The abnormal conditions of the coin amount of giving P (t) input anomalous discrimination module, and the decision matrix in anomalous discrimination module is supplemented with money according to game money
Measure the abnormal conditions of X (t), the abnormal conditions of game money consumption Z (t) and the game money amount of giving P (t) abnormal conditions differentiate it is different
Normal type issues alarm if Exception Type is that game money is brushed.
Due to adding the temporal aspect of target object in the feature of training sample, therefore adopting in the isolated forest model of training
When with the abnormal conditions of trained isolated forest model detected target object, using the temporal aspect of target object as judging mesh
Mark object whether Yi Chang factor, thus can detect global abnormal, can also detect local anomaly, to increase isolated forest
Applicable application scenarios reduce the false alarm rate of abnormality detection.Abnormal conditions by combining multiple target objects judge different
Then normal type determines whether to alert again, compared to the abnormal conditions according to single target object for alerting, accuracy is more
Height accidentally alerts, lifting system overall accuracy caused by can greatly reducing as producing special circumstances in practice.
Based on the same technical idea, the embodiment of the invention provides a kind of anomaly data detection devices, as shown in figure 8,
The device 800 includes:
Module 801 is obtained, for obtaining the data to be tested of target object；
Detection module 802, for the data to be tested based on the target object, traverse in isolated forest model every with
Machine binary tree determines position of the target object on every random binary tree, and the isolated forest model is with the mesh
The historical data for marking object is that training sample training obtains, the historical data cyclically-varying of the target object, the training
The feature of sample includes at least the temporal aspect of the target object；
Processing module 803 determines the target for the position according to the target object on every random binary tree
The abnormal score of object；
Judgment module 804 determines the abnormal feelings of the target object for the abnormal score according to the target object
Condition.
Optionally, the detection module 802 is specifically used for:
The historical data of target object is obtained as training sample；
Determine the characteristic set of the training sample, the timing that the target object is included at least in the characteristic set is special
Sign；
N times random sampling is carried out to the training sample, M sample is extracted every time and constructs random binary tree, building
When the random binary tree, using the feature randomly selected from the characteristic set as boundary feature, with the boundary feature
Value interval in the value that randomly selects be greater than 0, N as cut off value, M and be greater than 0；
Isolated forest model is determined according to N of building random binary tree.
Optionally, the detection module 802 is also used to:
When the historical data of the target object updates, using the historical data of update as training sample re -training, obtain
The isolated forest model that must be updated.
It optionally, further include alarm module 805；
The alarm module 805 is specifically used for:
Exception Type is determined according to the abnormal conditions of multiple target objects；
Determine whether to alert according to the Exception Type.
Optionally, the alarm module 805 is specifically used for:
The abnormal conditions of multiple target objects are inputted into preset decision matrix, determine Exception Type.
Optionally, the alarm module 805 is specifically used for:
The abnormal conditions of multiple target objects are inputted into disaggregated model, determine that Exception Type, the disaggregated model are to pass through
What the mapping relations of the abnormal conditions and Exception Type that learn multiple target objects obtained.
Based on the same technical idea, the embodiment of the invention provides a kind of abnormality detecting apparatus, as shown in figure 9, including
At least one processor 901, and the memory 902 connecting at least one processor do not limit place in the embodiment of the present invention
The specific connection medium between device 901 and memory 902 is managed, is connected between processor 901 and memory 902 by bus in Fig. 9
It is connected in example.Bus can be divided into address bus, data/address bus, control bus etc..
In embodiments of the present invention, memory 902 is stored with the instruction that can be executed by least one processor 901, at least
The instruction that one processor 901 is stored by executing memory 902, can execute and be wrapped in abnormal deviation data examination method above-mentioned
The step of including.
Wherein, processor 901 is the control centre of abnormality detecting apparatus, can use various interfaces and connection is abnormal
The various pieces of detection device are stored in memory by running or executing the instruction being stored in memory 902 and calling
Data in 902, to detect exception.Optionally, processor 901 may include one or more processing units, and processor 901 can
Integrated application processor and modem processor, wherein the main processing operation system of application processor, user interface and application
Program etc., modem processor mainly handle wireless communication.It is understood that above-mentioned modem processor can not also
It is integrated into processor 901.In some embodiments, processor 901 and memory 902 can be realized on the same chip,
In some embodiments, they can also be realized respectively on independent chip.
Processor 901 can be general processor, such as central processing unit (CPU), digital signal processor, dedicated integrated
Circuit (Application Specific Integrated Circuit, ASIC), field programmable gate array or other can
Perhaps transistor logic, discrete hardware components may be implemented or execute present invention implementation for programmed logic device, discrete gate
Each method, step and logic diagram disclosed in example.General processor can be microprocessor or any conventional processor
Deng.The step of method in conjunction with disclosed in the embodiment of the present invention, can be embodied directly in hardware processor and execute completion, Huo Zheyong
Hardware and software module combination in processor execute completion.
Memory 902 is used as a kind of non-volatile computer readable storage medium storing program for executing, can be used for storing non-volatile software journey
Sequence, non-volatile computer executable program and module.Memory 902 may include the storage medium of at least one type,
It such as may include flash memory, hard disk, multimedia card, card-type memory, random access storage device (Random Access
Memory, RAM), static random-access memory (Static Random Access Memory, SRAM), may be programmed read-only deposit
Reservoir (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), band
Electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory,
EEPROM), magnetic storage, disk, CD etc..Memory 902 can be used for carrying or storing have instruction or data
The desired program code of structure type and can by any other medium of computer access, but not limited to this.The present invention is real
Applying the memory 902 in example can also be circuit or other devices that arbitrarily can be realized store function, for storing program
Instruction and/or data.
Based on the same inventive concept, the embodiment of the present invention also provides a kind of computer readable storage medium, the readable storage
Media storage has computer instruction, when the computer instruction is run on abnormality detecting apparatus, so that abnormality detecting apparatus is held
The step of row abnormal deviation data examination method as the aforementioned.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the present invention
Form.It is deposited moreover, the present invention can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
Although preferred embodiments of the present invention have been described, it is created once a person skilled in the art knows basic
Property concept, then additional changes and modifications may be made to these embodiments.So it includes excellent that the following claims are intended to be interpreted as
It selects embodiment and falls into all change and modification of the scope of the invention.
Obviously, various changes and modifications can be made to the invention without departing from essence of the invention by those skilled in the art
Mind and range.In this way, if these modifications and changes of the present invention belongs to the range of the claims in the present invention and its equivalent technologies
Within, then the present invention is also intended to include these modifications and variations.
Claims (10)
1. a kind of abnormal deviation data examination method characterized by comprising
Obtain the data to be tested of target object；
Based on the data to be tested of the target object, every random binary tree in isolated forest model is traversed, determines the mesh
Position of the object on every random binary tree is marked, the isolated forest model is with the historical data of the target object for instruction
Practice sample training to obtain, the historical data cyclically-varying of the target object, the feature of the training sample includes at least institute
State the temporal aspect of target object；
According to position of the target object on every random binary tree, the abnormal score of the target object is determined；
According to the abnormal score of the target object, the abnormal conditions of the target object are determined.
2. the method as described in claim 1, which is characterized in that the isolated forest model is with the history of the target object
Data are that training sample training obtains, comprising:
The historical data of target object is obtained as training sample；
It determines the characteristic set of the training sample, the temporal aspect of the target object is included at least in the characteristic set；
N times random sampling is carried out to the training sample, every time M random binary tree of sample building of extraction, described in building
When random binary tree, using the feature randomly selected from the characteristic set as boundary feature, with taking for the boundary feature
The value randomly selected in value section is greater than 0, N and is greater than 0 as cut off value, M；
Isolated forest model is determined according to N of building random binary tree.
3. the method as described in claim 1, which is characterized in that further include:
When the historical data of the target object updates, using the historical data of update as training sample re -training, obtain more
New isolated forest model.
4. the method as described in claims 1 to 3 is any, which is characterized in that further include:
Exception Type is determined according to the abnormal conditions of multiple target objects；
Determine whether to alert according to the Exception Type.
5. method as claimed in claim 4, which is characterized in that described to determine exception according to the abnormal conditions of multiple target objects
Type, comprising:
The abnormal conditions of multiple target objects are inputted into preset decision matrix, determine Exception Type.
6. method as claimed in claim 4, which is characterized in that described to determine exception according to the abnormal conditions of multiple target objects
Type, comprising:
The abnormal conditions of multiple target objects are inputted into disaggregated model, determine that Exception Type, the disaggregated model are to pass through study
What the abnormal conditions of multiple target objects and the mapping relations of Exception Type obtained.
7. a kind of anomaly data detection device characterized by comprising
Module is obtained, for obtaining the data to be tested of target object；
Detection module traverses every random y-bend in isolated forest model for the data to be tested based on the target object
Tree, determines position of the target object on every random binary tree, the isolated forest model is with the target object
Historical data be training sample training obtain, the historical data cyclically-varying of the target object, the training sample
Feature includes at least the temporal aspect of the target object；
Processing module determines the target object for the position according to the target object on every random binary tree
Abnormal score；
Judgment module determines the abnormal conditions of the target object for the abnormal score according to the target object.
8. device as claimed in claim 7, which is characterized in that the detection module is specifically used for:
The historical data of target object is obtained as training sample；
It determines the characteristic set of the training sample, the temporal aspect of the target object is included at least in the characteristic set；
N times random sampling is carried out to the training sample, every time M random binary tree of sample building of extraction, described in building
When random binary tree, using the feature randomly selected from the characteristic set as boundary feature, with taking for the boundary feature
The value randomly selected in value section is greater than 0, N and is greater than 0 as cut off value, M；
Isolated forest model is determined according to N of building random binary tree.
9. a kind of abnormality detecting apparatus, which is characterized in that including at least one processing unit and at least one storage unit,
Wherein, the storage unit is stored with computer program, when described program is executed by the processing unit, so that the processing
Unit perform claim requires the step of 1~6 any claim the method.
10. a kind of computer-readable medium, which is characterized in that it is stored with the computer journey that can be executed by abnormality detecting apparatus
Sequence, when described program is run on abnormality detecting apparatus, so that abnormality detecting apparatus perform claim requirement 1~6 is any
The step of the method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910159780.7A CN109948669B (en) | 2019-03-04 | 2019-03-04 | Abnormal data detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910159780.7A CN109948669B (en) | 2019-03-04 | 2019-03-04 | Abnormal data detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109948669A true CN109948669A (en) | 2019-06-28 |
| CN109948669B CN109948669B (en) | 2021-07-13 |
Family
ID=67007826
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910159780.7A Active CN109948669B (en) | 2019-03-04 | 2019-03-04 | Abnormal data detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109948669B (en) |
Cited By (42)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110336703A (en) * | 2019-07-12 | 2019-10-15 | 河海大学常州校区 | Industrial big data based on edge calculations monitors system |
| CN110362612A (en) * | 2019-07-19 | 2019-10-22 | 中国工商银行股份有限公司 | Abnormal deviation data examination method, device and the electronic equipment executed by electronic equipment |
| CN110413682A (en) * | 2019-08-09 | 2019-11-05 | 云南电网有限责任公司 | A kind of the classification methods of exhibiting and system of data |
| CN110430260A (en) * | 2019-08-02 | 2019-11-08 | 哈工大机器人（合肥）国际创新研究院 | Robot cloud platform based on big data cloud computing support and working method |
| CN110471822A (en) * | 2019-08-15 | 2019-11-19 | 中国工商银行股份有限公司 | Method, apparatus, computer system and medium for monitoring host computer system |
| CN110716778A (en) * | 2019-09-10 | 2020-01-21 | 阿里巴巴集团控股有限公司 | Application compatibility testing method, device and system |
| CN110781433A (en) * | 2019-10-11 | 2020-02-11 | 腾讯科技（深圳）有限公司 | Data type determination method and device, storage medium and electronic device |
| CN110825548A (en) * | 2019-10-24 | 2020-02-21 | 新华三信息安全技术有限公司 | Anomaly detection method, model training method and related device |
| CN111008662A (en) * | 2019-12-04 | 2020-04-14 | 贵州电网有限责任公司 | Online monitoring data anomaly analysis method for power transmission line |
| CN111030855A (en) * | 2019-12-05 | 2020-04-17 | 国网山西省电力公司信息通信分公司 | Intelligent baseline determination and alarm method for ubiquitous power Internet of things system data |
| CN111080054A (en) * | 2019-11-04 | 2020-04-28 | 北京科技大学 | Automatic evaluation method and system for width quality of hot-rolled strip steel |
| CN111105070A (en) * | 2019-11-20 | 2020-05-05 | 深圳市北斗智能科技有限公司 | Passenger flow early warning method and system |
| CN111159251A (en) * | 2019-12-19 | 2020-05-15 | 青岛聚好联科技有限公司 | Method and device for determining abnormal data |
| CN111160647A (en) * | 2019-12-30 | 2020-05-15 | 第四范式（北京）技术有限公司 | Money laundering behavior prediction method and device |
| CN111277459A (en) * | 2020-01-16 | 2020-06-12 | 新华三信息安全技术有限公司 | Equipment anomaly detection method and device and machine-readable storage medium |
| CN111539550A (en) * | 2020-03-13 | 2020-08-14 | 远景智能国际私人投资有限公司 | Method, device and equipment for determining working state of photovoltaic array and storage medium |
| CN111565171A (en) * | 2020-03-31 | 2020-08-21 | 北京三快在线科技有限公司 | Abnormal data detection method and device, electronic equipment and storage medium |
| CN111563111A (en) * | 2020-05-12 | 2020-08-21 | 北京思特奇信息技术股份有限公司 | Alarm method, alarm device, electronic equipment and storage medium |
| CN111669368A (en) * | 2020-05-07 | 2020-09-15 | 宜通世纪科技股份有限公司 | End-to-end network sensing abnormity detection and analysis method, system, device and medium |
| CN111740946A (en) * | 2020-05-09 | 2020-10-02 | 郑州启明星辰信息安全技术有限公司 | Webshell message detection method and device |
| CN111783904A (en) * | 2020-09-04 | 2020-10-16 | 平安国际智慧城市科技股份有限公司 | Data anomaly analysis method, device, equipment and medium based on environmental data |
| CN111798312A (en) * | 2019-08-02 | 2020-10-20 | 深圳索信达数据技术有限公司 | Financial transaction system abnormity identification method based on isolated forest algorithm |
| CN112288025A (en) * | 2020-11-03 | 2021-01-29 | 中国平安财产保险股份有限公司 | Abnormal case identification method, device and equipment based on tree structure and storage medium |
| CN112541525A (en) * | 2020-11-23 | 2021-03-23 | 歌尔股份有限公司 | Point cloud data processing method and device |
| CN112860968A (en) * | 2021-02-02 | 2021-05-28 | 北京三快在线科技有限公司 | Abnormity detection method and device |
| CN112906722A (en) * | 2019-11-19 | 2021-06-04 | 中国移动通信集团湖南有限公司 | Data anomaly detection method, device and equipment |
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN112990330A (en) * | 2021-03-26 | 2021-06-18 | 国网河北省电力有限公司营销服务中心 | User energy abnormal data detection method and device |
| CN112990314A (en) * | 2021-03-16 | 2021-06-18 | 中国科学院长春光学精密机械与物理研究所 | Hyperspectral image anomaly detection method and device based on improved isolated forest algorithm |
| CN113032774A (en) * | 2019-12-25 | 2021-06-25 | 中移动信息技术有限公司 | Training method, device and equipment of anomaly detection model and computer storage medium |
| CN113051552A (en) * | 2019-12-27 | 2021-06-29 | 北京国双科技有限公司 | Abnormal behavior detection method and device |
| WO2021139343A1 (en) * | 2020-06-29 | 2021-07-15 | 平安科技（深圳）有限公司 | Data analysis method and apparatus based on natural language processing, and computer device |
| CN113411217A (en) * | 2021-06-21 | 2021-09-17 | 广州迷听科技有限公司 | Method and device for monitoring and alarming call system |
| CN113704752A (en) * | 2021-08-31 | 2021-11-26 | 上海观安信息技术股份有限公司 | Data leakage behavior detection method and device, computer equipment and storage medium |
| CN114178326A (en) * | 2021-12-02 | 2022-03-15 | 北京首钢自动化信息技术有限公司 | Control method and device of detection equipment and computer equipment |
| CN114943309A (en) * | 2022-07-21 | 2022-08-26 | 人民法院信息技术服务中心 | Method for constructing abnormity diagnosis model of block chain and abnormity diagnosis method |
| CN115238779A (en) * | 2022-07-12 | 2022-10-25 | 中移互联网有限公司 | Anomaly detection method, device, equipment and medium for cloud disk |
| CN115984992A (en) * | 2022-12-22 | 2023-04-18 | 云控智行(上海)汽车科技有限公司 | Method, device and equipment for detecting vehicle operation data |
| CN116962272A (en) * | 2023-08-02 | 2023-10-27 | 北京优特捷信息技术有限公司 | Abnormality detection method, device, equipment and storage medium for network index |
| CN117437271A (en) * | 2023-12-20 | 2024-01-23 | 湖南中斯信息科技有限公司 | Three-dimensional target measuring method based on artificial intelligence |
| WO2024036709A1 (en) * | 2022-08-18 | 2024-02-22 | 深圳前海微众银行股份有限公司 | Anomalous data detection method and apparatus |
| CN112288025B (en) * | 2020-11-03 | 2024-04-30 | 中国平安财产保险股份有限公司 | Abnormal case identification method, device, equipment and storage medium based on tree structure |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102890803A (en) * | 2011-07-21 | 2013-01-23 | 阿里巴巴集团控股有限公司 | Method and device for determining abnormal transaction process of electronic commodity |
| CN104407268A (en) * | 2014-11-27 | 2015-03-11 | 国家电网公司 | Abnormal electricity utilization judgment method based on abnormal analysis of electric quantity, voltage and current |
| CN106645935A (en) * | 2016-12-27 | 2017-05-10 | 国网浙江象山县供电公司 | Electricity usage monitoring method and system |
| CN108090416A (en) * | 2017-11-24 | 2018-05-29 | 南京南邮信息产业技术研究院有限公司 | Intelligent finance monitoring and managing method and financial supervision system based on video analysis |
| CN109063886A (en) * | 2018-06-12 | 2018-12-21 | 阿里巴巴集团控股有限公司 | A kind of method for detecting abnormality, device and equipment |
| CN109145957A (en) * | 2018-07-26 | 2019-01-04 | 国网浙江省电力有限公司温州供电公司 | The identification and processing method and processing device of power distribution network abnormal index based on big data |
| CN109345137A (en) * | 2018-10-22 | 2019-02-15 | 广东精点数据科技股份有限公司 | A kind of rejecting outliers method based on agriculture big data |
| CN109409665A (en) * | 2018-09-21 | 2019-03-01 | 江中药业股份有限公司 | Chinese medicinal tablet unit product comprehensive energy consumption measuring method |
| CN109509082A (en) * | 2018-10-31 | 2019-03-22 | 中国银行股份有限公司 | The monitoring method and device of bank application system |
-
2019
- 2019-03-04 CN CN201910159780.7A patent/CN109948669B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102890803A (en) * | 2011-07-21 | 2013-01-23 | 阿里巴巴集团控股有限公司 | Method and device for determining abnormal transaction process of electronic commodity |
| CN104407268A (en) * | 2014-11-27 | 2015-03-11 | 国家电网公司 | Abnormal electricity utilization judgment method based on abnormal analysis of electric quantity, voltage and current |
| CN106645935A (en) * | 2016-12-27 | 2017-05-10 | 国网浙江象山县供电公司 | Electricity usage monitoring method and system |
| CN108090416A (en) * | 2017-11-24 | 2018-05-29 | 南京南邮信息产业技术研究院有限公司 | Intelligent finance monitoring and managing method and financial supervision system based on video analysis |
| CN109063886A (en) * | 2018-06-12 | 2018-12-21 | 阿里巴巴集团控股有限公司 | A kind of method for detecting abnormality, device and equipment |
| CN109145957A (en) * | 2018-07-26 | 2019-01-04 | 国网浙江省电力有限公司温州供电公司 | The identification and processing method and processing device of power distribution network abnormal index based on big data |
| CN109409665A (en) * | 2018-09-21 | 2019-03-01 | 江中药业股份有限公司 | Chinese medicinal tablet unit product comprehensive energy consumption measuring method |
| CN109345137A (en) * | 2018-10-22 | 2019-02-15 | 广东精点数据科技股份有限公司 | A kind of rejecting outliers method based on agriculture big data |
| CN109509082A (en) * | 2018-10-31 | 2019-03-22 | 中国银行股份有限公司 | The monitoring method and device of bank application system |
Non-Patent Citations (5)
| Title |
|---|
| FEI TONY LIU,AT EL.: ""Isolation Forest"", 《RESEARCHGATE》 * |
| LUCA PUGGIRI,AT EL.: ""An enhanced variable selaction and Isolation Forest based methodology for anmaly detection with OES data"", 《ENGINEERING APPLICATIONS OF ARTIFICIAL INTELLIGENCE》 * |
| 余翔等: ""基于孤立森林算法的用电数据异常检测研究"", 《信息技术》 * |
| 周长吉等: "《光伏技术在农业中的应用》", 30 September 2014, 中国农业大学出版社 * |
| 徐东等: ""基于Isolation Forest 改进的数据异常检测方法"", 《计算机科学》 * |
Cited By (57)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110336703A (en) * | 2019-07-12 | 2019-10-15 | 河海大学常州校区 | Industrial big data based on edge calculations monitors system |
| CN110362612A (en) * | 2019-07-19 | 2019-10-22 | 中国工商银行股份有限公司 | Abnormal deviation data examination method, device and the electronic equipment executed by electronic equipment |
| CN111798312B (en) * | 2019-08-02 | 2024-03-01 | 深圳索信达数据技术有限公司 | Financial transaction system anomaly identification method based on isolated forest algorithm |
| CN110430260A (en) * | 2019-08-02 | 2019-11-08 | 哈工大机器人（合肥）国际创新研究院 | Robot cloud platform based on big data cloud computing support and working method |
| CN111798312A (en) * | 2019-08-02 | 2020-10-20 | 深圳索信达数据技术有限公司 | Financial transaction system abnormity identification method based on isolated forest algorithm |
| CN110413682A (en) * | 2019-08-09 | 2019-11-05 | 云南电网有限责任公司 | A kind of the classification methods of exhibiting and system of data |
| CN110471822A (en) * | 2019-08-15 | 2019-11-19 | 中国工商银行股份有限公司 | Method, apparatus, computer system and medium for monitoring host computer system |
| CN110716778A (en) * | 2019-09-10 | 2020-01-21 | 阿里巴巴集团控股有限公司 | Application compatibility testing method, device and system |
| CN110716778B (en) * | 2019-09-10 | 2023-09-26 | 创新先进技术有限公司 | Application compatibility testing method, device and system |
| CN110781433A (en) * | 2019-10-11 | 2020-02-11 | 腾讯科技（深圳）有限公司 | Data type determination method and device, storage medium and electronic device |
| CN110781433B (en) * | 2019-10-11 | 2023-06-02 | 腾讯科技（深圳）有限公司 | Data type determining method and device, storage medium and electronic device |
| CN110825548A (en) * | 2019-10-24 | 2020-02-21 | 新华三信息安全技术有限公司 | Anomaly detection method, model training method and related device |
| CN110825548B (en) * | 2019-10-24 | 2022-11-08 | 新华三信息安全技术有限公司 | Anomaly detection method, model training method and related device |
| CN111080054A (en) * | 2019-11-04 | 2020-04-28 | 北京科技大学 | Automatic evaluation method and system for width quality of hot-rolled strip steel |
| CN112906722A (en) * | 2019-11-19 | 2021-06-04 | 中国移动通信集团湖南有限公司 | Data anomaly detection method, device and equipment |
| CN111105070B (en) * | 2019-11-20 | 2024-04-16 | 深圳市北斗智能科技有限公司 | Passenger flow early warning method and system |
| CN111105070A (en) * | 2019-11-20 | 2020-05-05 | 深圳市北斗智能科技有限公司 | Passenger flow early warning method and system |
| CN111008662A (en) * | 2019-12-04 | 2020-04-14 | 贵州电网有限责任公司 | Online monitoring data anomaly analysis method for power transmission line |
| CN111030855B (en) * | 2019-12-05 | 2022-05-17 | 国网山西省电力公司信息通信分公司 | Intelligent baseline determination and alarm method for ubiquitous power Internet of things system data |
| CN111030855A (en) * | 2019-12-05 | 2020-04-17 | 国网山西省电力公司信息通信分公司 | Intelligent baseline determination and alarm method for ubiquitous power Internet of things system data |
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN111159251A (en) * | 2019-12-19 | 2020-05-15 | 青岛聚好联科技有限公司 | Method and device for determining abnormal data |
| CN113032774A (en) * | 2019-12-25 | 2021-06-25 | 中移动信息技术有限公司 | Training method, device and equipment of anomaly detection model and computer storage medium |
| CN113051552A (en) * | 2019-12-27 | 2021-06-29 | 北京国双科技有限公司 | Abnormal behavior detection method and device |
| CN111160647B (en) * | 2019-12-30 | 2023-08-22 | 第四范式（北京）技术有限公司 | Money laundering behavior prediction method and device |
| CN111160647A (en) * | 2019-12-30 | 2020-05-15 | 第四范式（北京）技术有限公司 | Money laundering behavior prediction method and device |
| CN111277459A (en) * | 2020-01-16 | 2020-06-12 | 新华三信息安全技术有限公司 | Equipment anomaly detection method and device and machine-readable storage medium |
| CN111539550B (en) * | 2020-03-13 | 2023-08-01 | 远景智能国际私人投资有限公司 | Method, device, equipment and storage medium for determining working state of photovoltaic array |
| CN111539550A (en) * | 2020-03-13 | 2020-08-14 | 远景智能国际私人投资有限公司 | Method, device and equipment for determining working state of photovoltaic array and storage medium |
| CN111565171A (en) * | 2020-03-31 | 2020-08-21 | 北京三快在线科技有限公司 | Abnormal data detection method and device, electronic equipment and storage medium |
| CN111565171B (en) * | 2020-03-31 | 2022-09-20 | 北京三快在线科技有限公司 | Abnormal data detection method and device, electronic equipment and storage medium |
| CN111669368B (en) * | 2020-05-07 | 2022-12-06 | 宜通世纪科技股份有限公司 | End-to-end network sensing abnormity detection and analysis method, system, device and medium |
| CN111669368A (en) * | 2020-05-07 | 2020-09-15 | 宜通世纪科技股份有限公司 | End-to-end network sensing abnormity detection and analysis method, system, device and medium |
| CN111740946A (en) * | 2020-05-09 | 2020-10-02 | 郑州启明星辰信息安全技术有限公司 | Webshell message detection method and device |
| CN111563111A (en) * | 2020-05-12 | 2020-08-21 | 北京思特奇信息技术股份有限公司 | Alarm method, alarm device, electronic equipment and storage medium |
| WO2021139343A1 (en) * | 2020-06-29 | 2021-07-15 | 平安科技（深圳）有限公司 | Data analysis method and apparatus based on natural language processing, and computer device |
| CN111783904A (en) * | 2020-09-04 | 2020-10-16 | 平安国际智慧城市科技股份有限公司 | Data anomaly analysis method, device, equipment and medium based on environmental data |
| CN112288025B (en) * | 2020-11-03 | 2024-04-30 | 中国平安财产保险股份有限公司 | Abnormal case identification method, device, equipment and storage medium based on tree structure |
| CN112288025A (en) * | 2020-11-03 | 2021-01-29 | 中国平安财产保险股份有限公司 | Abnormal case identification method, device and equipment based on tree structure and storage medium |
| CN112541525A (en) * | 2020-11-23 | 2021-03-23 | 歌尔股份有限公司 | Point cloud data processing method and device |
| WO2022105502A1 (en) * | 2020-11-23 | 2022-05-27 | 歌尔股份有限公司 | Point cloud data processing method and apparatus |
| CN112860968A (en) * | 2021-02-02 | 2021-05-28 | 北京三快在线科技有限公司 | Abnormity detection method and device |
| CN112990314A (en) * | 2021-03-16 | 2021-06-18 | 中国科学院长春光学精密机械与物理研究所 | Hyperspectral image anomaly detection method and device based on improved isolated forest algorithm |
| CN112990330A (en) * | 2021-03-26 | 2021-06-18 | 国网河北省电力有限公司营销服务中心 | User energy abnormal data detection method and device |
| CN113411217A (en) * | 2021-06-21 | 2021-09-17 | 广州迷听科技有限公司 | Method and device for monitoring and alarming call system |
| CN113704752A (en) * | 2021-08-31 | 2021-11-26 | 上海观安信息技术股份有限公司 | Data leakage behavior detection method and device, computer equipment and storage medium |
| CN113704752B (en) * | 2021-08-31 | 2024-01-26 | 上海观安信息技术股份有限公司 | Method and device for detecting data leakage behavior, computer equipment and storage medium |
| CN114178326A (en) * | 2021-12-02 | 2022-03-15 | 北京首钢自动化信息技术有限公司 | Control method and device of detection equipment and computer equipment |
| CN115238779A (en) * | 2022-07-12 | 2022-10-25 | 中移互联网有限公司 | Anomaly detection method, device, equipment and medium for cloud disk |
| CN115238779B (en) * | 2022-07-12 | 2023-09-19 | 中移互联网有限公司 | Cloud disk abnormality detection method, device, equipment and medium |
| CN114943309A (en) * | 2022-07-21 | 2022-08-26 | 人民法院信息技术服务中心 | Method for constructing abnormity diagnosis model of block chain and abnormity diagnosis method |
| WO2024036709A1 (en) * | 2022-08-18 | 2024-02-22 | 深圳前海微众银行股份有限公司 | Anomalous data detection method and apparatus |
| CN115984992A (en) * | 2022-12-22 | 2023-04-18 | 云控智行(上海)汽车科技有限公司 | Method, device and equipment for detecting vehicle operation data |
| CN116962272B (en) * | 2023-08-02 | 2024-02-20 | 北京优特捷信息技术有限公司 | Abnormality detection method, device, equipment and storage medium for network index |
| CN116962272A (en) * | 2023-08-02 | 2023-10-27 | 北京优特捷信息技术有限公司 | Abnormality detection method, device, equipment and storage medium for network index |
| CN117437271B (en) * | 2023-12-20 | 2024-03-08 | 湖南中斯信息科技有限公司 | Three-dimensional target measuring method based on artificial intelligence |
| CN117437271A (en) * | 2023-12-20 | 2024-01-23 | 湖南中斯信息科技有限公司 | Three-dimensional target measuring method based on artificial intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109948669B (en) | 2021-07-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109948669A (en) | A kind of abnormal deviation data examination method and device | |
| CN108564460B (en) | Real-time fraud detection method and device in internet credit scene | |
| CN111614690B (en) | Abnormal behavior detection method and device | |
| CN109583904A (en) | Training method, impaired operation detection method and the device of abnormal operation detection model | |
| CN110309840A (en) | Risk trade recognition methods, device, server and storage medium | |
| CN108492104A (en) | A kind of resource transfer monitoring method and device | |
| CN111339436B (en) | Data identification method, device, equipment and readable storage medium | |
| CN107689008A (en) | A kind of user insures the method and device of behavior prediction | |
| CN111028016A (en) | Sales data prediction method and device and related equipment | |
| CN110378699A (en) | A kind of anti-fraud method, apparatus and system of transaction | |
| CN108334647A (en) | Data processing method, device, equipment and the server of Insurance Fraud identification | |
| CN111027743B (en) | OD optimal path searching method and device based on hierarchical road network | |
| CN103092699A (en) | Cloud computing resource pre-distribution achievement method | |
| CN109800627A (en) | The method for detecting abnormality and device of petroleum pipeline signal, equipment and readable medium | |
| CN108805174A (en) | clustering method and device | |
| CN109508879A (en) | A kind of recognition methods of risk, device and equipment | |
| CN111695019B (en) | Method and device for identifying associated account | |
| CN111174370A (en) | Fault detection method and device, storage medium and electronic device | |
| CN109039503A (en) | A kind of frequency spectrum sensing method, device, equipment and computer readable storage medium | |
| CN109842858A (en) | A kind of service exception order detection method and device | |
| CN109873790A (en) | Network security detection method, device and computer readable storage medium | |
| CN109741177A (en) | Appraisal procedure, device and the intelligent terminal of user credit | |
| CN109685255A (en) | A kind of method and apparatus for predicting customer churn | |
| CN109242165A (en) | A kind of model training and prediction technique and device based on model training | |
| CN115422788B (en) | Power distribution network line loss analysis management method, device, storage medium and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |