CN109962915B - BQP network-based anomaly detection method - Google Patents

BQP network-based anomaly detection method Download PDF

Info

Publication number
CN109962915B
CN109962915B CN201910188286.3A CN201910188286A CN109962915B CN 109962915 B CN109962915 B CN 109962915B CN 201910188286 A CN201910188286 A CN 201910188286A CN 109962915 B CN109962915 B CN 109962915B
Authority
CN
China
Prior art keywords
network
batch
bqp
output
layer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910188286.3A
Other languages
Chinese (zh)
Other versions
CN109962915A (en
Inventor
郭春生
林翰闻
章坚武
陈华华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Dianzi University
Original Assignee
Hangzhou Dianzi University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Dianzi University filed Critical Hangzhou Dianzi University
Priority to CN201910188286.3A priority Critical patent/CN109962915B/en
Publication of CN109962915A publication Critical patent/CN109962915A/en
Application granted granted Critical
Publication of CN109962915B publication Critical patent/CN109962915B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Image Analysis (AREA)

Abstract

The invention belongs to the technical field of deep learning, and particularly relates to an BQP network-based anomaly detection method, which comprises the following steps: s1, presetting an abnormal detection image training data set; s2, building BQP network and setting parameters; s3, for each training batch fed into BQP network, extracting the features in the image by using the feature extraction network in BQP network, and outputting the extracted features as batch feature vector X with the size of B × n; s4, constructing a characteristic hyper-sphere in a QP output layer in the BQP network, wherein the QP output layer outputs an optimal dual variable; s5, calculating loss functions for the feature vector X output by the feature extraction network and the optimal dual variable of the QP output layer respectively through the classification loss function and the consistency loss function, and performing parameter optimization on the BQP network through a back propagation algorithm; and S6, comparing the module length of the feature vector output by the feature extraction network with a set threshold value during detection, and realizing abnormal detection.

Description

BQP network-based anomaly detection method
Technical Field
The invention belongs to the technical field of deep learning, and particularly relates to an BQP network-based anomaly detection method.
Background
With the recent increase of data blowout, people have higher and higher requirements on intelligent analysis of data, wherein an anomaly detection technology is used as a branch of machine learning and plays an important role in intelligent analysis of data. For example, in massive video monitoring data, the time period of the abnormal event can be accurately positioned through a computer abnormality detection technology, and the labor cost is greatly reduced.
The abnormal detection is to determine samples except for well-defined or identified normal samples, and belongs to a special detection problem. The anomaly detection relates to machine learning, data mining, mathematical statistics, information theory and other related knowledge, and is widely applied to intrusion detection (such as intrusion detection network intrusion detection and security areas, and the like), fraud detection (such as credit card fraud detection, insurance fraud detection and telephone fraud detection, and the like), medical and public health anomaly detection, network opinion anomaly detection, industrial fault detection (such as mechanical fault detection and structural defect detection), and the like.
The complexity and difficulty of anomaly detection lies in several areas: first, unlike the conventional classification problem, in the anomaly detection problem, the number of samples of normal events is much larger than that of abnormal events, and the number of normal and abnormal training data is severely unbalanced. Secondly, the number of abnormal samples in a training set is limited, but the abnormal samples may contain multiple types, and the abnormal samples in the training set still cannot exhaustively contain all abnormal situations, so that it is difficult to find a suitable model to describe the data with the above characteristics. Moreover, noise and anomalies are often difficult to identify due to noise in the data itself or noise introduced by the system, which in turn introduces a lot of uncertainty into the anomaly detection problem.
Disclosure of Invention
Based on the above-mentioned shortcomings in the prior art, the present invention provides an abnormality detection method based on BQP network.
In order to achieve the purpose, the invention adopts the following technical scheme:
an abnormality detection method based on BQP network includes the following steps:
s1, presetting an abnormal detection image training data set;
s2, building BQP network, setting parameters: network input image size C multiplied by H multiplied by W, batch size B, feature vector dimension n, penalty factor C and numerical correction factor epsilon;
s3, training batches for each batch fed into BQP network, including image samples and labels, expressed as I ═ I (I ═ I)1,y1；I2,y2；...；IB,yB) Wherein, IjFor the jth sample in the batch, yjA label indicating the jth sample, j ═ 1,2, … B; extracting features in the image by using the feature extraction network in BQP network, and outputting the features as batch featuresVector X, size B × n;
s4, extracting the batch feature vector X, constructing a spatial feature hypersphere in a QP output layer in the BQP network, and outputting an optimal dual variable a by the QP output layer*；
S5, extracting feature vector X of network output and optimal dual variable a of QP output layer for features in BQP network respectively through classification loss function and consistency loss function*Calculating a loss function, and performing parameter optimization, namely multi-objective optimization, on the BQP network through a back propagation algorithm;
s6, when detecting, using the model length of each sample feature vector output by the feature extraction networki||2With a set threshold value RThresholdAnd comparing to realize the abnormity detection.
Preferably, the step S1 specifically includes:
defining the training data with the size of B in each batch, and forming a training batch by B image samples and B labels (I)1,y1；I2,y2；...；IB,yB) (ii) a Wherein, yjWhen equal to 0, IjIs a normal sample; y isjWhen 1, IjIs an abnormal sample.
Preferably, the step S2 includes the following steps:
s21, establishing a feature extraction network, wherein the feature extraction network consists of a convolution layer, a pooling layer, an activation layer and a linear layer, and has the function of extracting the feature vector of the input image and dynamically updating the network weight through a back propagation algorithm;
s22, establishing a QP output layer, wherein the output layer solves the following problems:
a*＝argmin[aTQa-pTa]
Figure GDA0002050846840000031
the standard convex quadratic programming problem of (1); wherein, each parameter in the above formula is:
a＝[a1,a2...aB]T，
Figure GDA0002050846840000032
Figure GDA0002050846840000033
β＝1-nA·c-ε，
wherein x in Q1,x2,2xBRespectively BQP batch feature vectors output by the feature extraction network in the network
Figure GDA0002050846840000034
Medium 1,2, … B elements; c is a penalty factor, and the value of the penalty factor is between 0 and 1; n isAIs a training batch (I)1,y1；I2,y2；...；IB,yB) Middle sample label yjIs the number of 1; epsilon is a numerical correction factor, and the empirical value is 0.05; coefficient beta is passed through nAC and epsilon are calculated; the output of the QP output layer is the optimal solution of the quadratic optimization problem, i.e.
Figure GDA0002050846840000035
The S23 and BQP networks are composed of feature extraction networks and QP output layer cascades, and the functions of the networks are to extract features of each batch of images, perform data modeling on the batch of feature vectors, and use spatial feature hypersphere to depict normal samples and abnormal samples.
Preferably, the step S3 specifically includes:
for a training batch of batch length B (I)1,y1；I2,y2；...；IB,yB) Extracting n-dimensional features of B sample image data as batch feature vectors through a convolution layer, a pooling layer, an activation layer and a linear layer, and using a matrix
Figure GDA0002050846840000041
Is represented by the formula, X ═ X1,x2...,xB]TMatrix of
Figure GDA0002050846840000042
As input to the QP output layer.
Preferably, the step S4 specifically includes:
the QP output layer is designed according to the modeled spatial characteristic hypersphere, and the spatial characteristic hypersphere can contain normal samples as much as possible and exclude abnormal samples; meanwhile, a relaxation variable xi is introduced during modeling, so that the influence of noise is reduced, and the fault tolerance of the system is improved; constructing a hypersphere is equivalent to minimizing the radius of the hypersphere, adjusting a proper sphere center, and controlling the fault-tolerant capability through a relaxation variable; this problem can be expressed as an optimization problem as follows:
Figure GDA0002050846840000043
s.t.||xi-m||2-ξi≤R
ξi≥0
R2≥0
wherein R is spatial characteristic hypersphere radius, xiiAs a relaxation variable, xiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000044
I ═ 1,2, … B; m is a spatial characteristic hyper-spherical center;
the problem is a secondary objective function with a secondary constraint condition, the problem is converted into a standard convex quadratic programming problem through dual transformation, a QP output layer solves the standard convex quadratic programming problem, and the QP output layer solves an optimal dual variable
Figure GDA0002050846840000045
During training, the corresponding relation is established with the normal sample and the abnormal sample according to the following corresponding rule:
Figure GDA0002050846840000046
wherein, ai *Optimal dual variable a representing QP output layer output*The ith element in (1), and c is a penalty factor.
Preferably, the step S5 specifically includes:
according to the corresponding relation, BQP the network designs the classification loss function:
Figure GDA0002050846840000051
wherein B is the batch size, ai *Optimal dual variable a representing QP output layer output*The ith element, c is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
and while using the classification loss function, introducing a consistency loss function, and normalizing the characteristic vector modular length of each batch of data:
Figure GDA0002050846840000052
wherein B is the batch size, xiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000053
C is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
wherein, the classification loss function and the consistency loss function are propagated reversely at the same time, and the network weight is dynamically modified.
Preferably, the step S6 specifically includes:
during detection, the feature vector of each batch of data is extracted through the feature extraction network
Figure GDA0002050846840000054
Wherein X ═ X1,x2...,xB]TCalculating the modulo length X of each vector in Xi||2With a set threshold value RThresholdAnd comparing, and carrying out abnormality detection according to the following corresponding rules:
Figure GDA0002050846840000055
wherein x isiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000056
The ith feature vector of (1), RThresholdIndicating a set threshold.
Compared with the prior art, the invention has the beneficial effects that:
according to the method, an BQP network is established, and during training, the characteristic that the distribution of a training data set is extremely unbalanced can be overcome to model data; for each batch of data, a characteristic hypersphere is constructed, which contains as many normal samples as possible, and excludes abnormal samples. BQP the network is equivalent to solving a convex quadratic optimization problem, and the solving difficulty is reduced while the imbalance of data distribution is overcome. Meanwhile, the introduced relaxation variables reduce the influence of system noise and improve the fault-tolerant performance of the system.
Drawings
FIG. 1 is an exemplary diagram of BQP network training according to an embodiment of the present invention;
FIG. 2 is another BQP network training example diagram according to an embodiment of the present invention.
Detailed Description
The technical solution of the present invention is further described below by means of specific examples.
The BQP network-based anomaly detection method can be applied to anomaly detection such as convex planning clustering water pollution tracing and the like.
Specifically, the BQP network-based anomaly detection method in the embodiment of the present invention includes the following steps:
s1, preparing an abnormal detection image training data set meeting the requirements;
s2, building BQP network, wherein the BQP network is composed of a feature extraction network cascade connected with a QP output layer. The characteristic extraction network is a general deep neural network, the QP output layer is a quadratic programming output layer, the function of the characteristic extraction network is to solve a standard convex quadratic programming problem and output an optimal solution of the standard convex quadratic programming problem, and the characteristic extraction network has the functions of forward propagation and backward propagation. Setting parameters, including: network input image size C multiplied by H multiplied by W, batch size B, feature vector dimension n, penalty factor C and numerical correction factor epsilon;
s3, training batches fed BQP network for each batch, which contains image samples and labels, expressed as I ═ I (I ═ I)1,y1；I2,y2；...；IB,yB) Wherein, IjFor the jth sample in the batch, yjA label representing the jth sample; extracting the features in the image by using a feature extraction network in an BQP network, wherein the output of the feature extraction network is a batch feature vector X with the size of B multiplied by n;
s4, extracting the batch feature vector X, constructing a feature hyper-sphere in a QP output layer in the BQP network, and outputting an optimal dual variable a by the QP output layer*(ii) a Wherein, the characteristic hyper-sphere contains normal samples as much as possible, and abnormal samples are excluded;
s5, extracting the feature vector X of the network output and the optimal dual variable a of the QP output layer respectively for the features through the classification loss function and the consistency loss function*Calculating a loss function, and performing parameter optimization, namely multi-objective optimization, on the BQP network through a back propagation algorithm to improve the detection performance of the network;
s6, when detecting, using the model length of each sample feature vector output by the feature extraction networki||2With a set threshold value RThresholdAnd comparing to realize the abnormity detection.
Specifically, the step S1 is specifically:
defining a training data with batch size B, and forming a training batch by B image samples and B labels (I)1,y1；I2,y2；...；IB,yB) (ii) a Wherein, yjWhen equal to 0, IjIs a normal sample; y isjWhen 1, IjIs an abnormal sample.
The step S2 is specifically:
s21, establishing a feature extraction network, wherein the feature extraction network consists of a convolution layer, a pooling layer, an activation layer and a linear layer, and has the function of extracting the feature vector of the input image and dynamically updating the network weight through a back propagation algorithm;
s22, establishing a QP output layer, wherein the output layer solves the following problems:
Figure GDA0002050846840000071
the standard convex quadratic programming problem of (2). Wherein, each variable or constant in the formula (1) is:
Figure GDA0002050846840000072
wherein x in Q1,x2,2xBRespectively BQP batch feature vectors output by the feature extraction network in the network
Figure GDA0002050846840000081
Medium 1,2, … B elements; c is a penalty factor, and the value of the penalty factor is between 0 and 1; n isAIs a training batch (I)1,y1；I2,y2；...；IB,yB) Middle sample label yjIs the number of 1; epsilon is a numerical correction factor, and the empirical value is 0.05; coefficient beta is passed through nAC and epsilon are calculated; the output of QP output layer is the most quadratic optimization problemExcellent solution, i.e.
Figure GDA0002050846840000082
Solving equation (1) is equivalent to establishing a characteristic hypersphere, which contains normal samples as much as possible and excludes abnormal samples. Meanwhile, a relaxation variable is introduced to increase the fault tolerance of the system;
the S23 and BQP networks are composed of feature extraction networks and QP output layer cascades, and the functions of the networks are to extract features of each batch of images, perform data modeling on the batch of feature vectors, and use spatial hyper-spheres to depict normal samples and abnormal samples.
The step S3 is specifically:
for a batch of image data of batch length B (I)1,y1；I2,y2；...；IB,yB) Extracting n-dimensional features of B image data as batch feature vectors through a convolution layer, an erythronization layer, an activation layer and a linear layer, and using a matrix
Figure GDA0002050846840000083
Is represented by the formula, X ═ X1,x2...,xB]TMatrix of
Figure GDA0002050846840000084
As input to the QP output layer.
The step S4 is specifically:
the QP output layer is designed according to the modeled space hypersphere, and the space hypersphere can contain normal samples as much as possible and exclude abnormal samples. Meanwhile, a relaxation variable xi is introduced during modeling, so that the influence of noise can be reduced, and the fault tolerance of the system is improved. Constructing such a hypersphere is equivalent to minimizing the hypersphere radius, adjusting the appropriate sphere center, and controlling the fault-tolerant capability through the relaxation variables. This problem can be expressed as an optimization problem as follows:
Figure GDA0002050846840000085
wherein R is the characteristic hyper-spherical radius, xiiAs a relaxation variable, xiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000091
I ═ 1,2, … B; m is the center of the characteristic hyper-sphere;
the problem is a quadratic objective function with quadratic constraint conditions, which is difficult to solve. The problem is converted into a standard convex quadratic programming problem through dual transformation, and the method has the advantage of easy solution. The dual problem is represented by formula (1).
The QP output layer may solve the standard convex quadratic programming problem described above. Solving optimal dual variable by QP output layer
Figure GDA0002050846840000092
During training, the corresponding relation is established with the normal sample and the abnormal sample according to the following corresponding rule:
Figure GDA0002050846840000093
wherein, ai *Optimal dual variable a representing QP output layer output*The ith element in (1), and c is a penalty factor.
The step S5 is specifically:
as shown in FIG. 1, training batch (I)1,y1；I2,y2；...；IB,yB) Feeding into BQP network, wherein the feature extraction network outputs batch feature vector X, QP output layer outputs optimal dual variable a*. According to the corresponding relation (4), BQP the network designs the classification loss function according to the optimal dual variable a:
Figure GDA0002050846840000094
wherein B is the batch size, ai *Optimal dual variable a representing QP output layer output*The ith element, c is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
however, only the classification loss function is used to classify the data of each batch, and the classification standards of different batches cannot be specified. Therefore, while using the classification loss function, a consistency loss function is introduced, and the feature vector X modulo length of each batch of data is specified:
Figure GDA0002050846840000095
wherein B is the batch size, xiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000096
C is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
the classification loss function and the consistency loss function are propagated reversely at the same time, and the network weight is dynamically modified.
The step S6 is specifically:
as shown in FIG. 2, during the detection, the batch data (I) is obtained1,I2,...,IB) Sending the data to BQP network, and extracting the batch feature vector of the batch data through feature extraction network
Figure GDA0002050846840000101
Wherein X ═ X1,x2...,xB]TCalculating the modulo length X of each vector in Xi||2With a set threshold value RThresholdAnd comparing, and carrying out abnormality detection according to the following corresponding rules:
Figure GDA0002050846840000102
wherein x isiBatch feature vector representing feature extraction network output
Figure GDA0002050846840000103
The ith feature vector of (1), RThresholdIndicating a set threshold.
In BQP, B is an abbreviation for Batch, and QP output layer is an abbreviation for quadratic program output layer.
The foregoing has outlined rather broadly the preferred embodiments and principles of the present invention and it will be appreciated that those skilled in the art may devise variations of the present invention that are within the spirit and scope of the appended claims.

Claims (5)

1. An abnormality detection method based on BQP network is characterized by comprising the following steps:
s1, presetting an abnormal detection image training data set;
s2, building BQP network, setting parameters: network input image size C multiplied by H multiplied by W, batch size B, feature vector dimension n, penalty factor C and numerical correction factor epsilon;
s3, training batches for each batch fed into BQP network, including image samples and labels, expressed as I ═ I (I ═ I)1,y1；I2,y2；...；IB,yB) Wherein, IjFor the jth sample in the batch, yjA label indicating the jth sample, j ═ 1,2, … B; extracting the features in the image by using a feature extraction network in an BQP network, wherein the output of the feature extraction network is a batch feature vector X with the size of B multiplied by n;
s4, extracting the batch feature vector X, constructing a spatial feature hypersphere in a QP output layer in the BQP network, and outputting an optimal dual variable a by the QP output layer*；
S5, extracting feature vector X of network output and optimal dual variable a of QP output layer for features in BQP network respectively through classification loss function and consistency loss function*ComputingLoss function, and BQP network parameter optimization through back propagation algorithm, namely multi-objective optimization;
s6, when detecting, using the model length of each sample feature vector output by the feature extraction networki||2With a set threshold value RThresholdComparing to realize abnormal detection;
the step S1 specifically includes:
defining the training data with the size of B in each batch, and forming a training batch by B image samples and B labels (I)1,y1；I2,y2；...；IB,yB) (ii) a Wherein, yjWhen equal to 0, IjIs a normal sample; y isjWhen 1, IjAn abnormal sample is obtained;
the step S2 includes the steps of:
s21, establishing a feature extraction network, wherein the feature extraction network consists of a convolution layer, a pooling layer, an activation layer and a linear layer, and has the function of extracting the feature vector of the input image and dynamically updating the network weight through a back propagation algorithm;
s22, establishing a QP output layer, wherein the output layer solves the following problems:
a*＝argmin[aTQa-pTa]
Figure FDA0002996931690000021
the standard convex quadratic programming problem of (1); wherein, each parameter in the above formula is:
a＝[a1,a2...aB]T，
Figure FDA0002996931690000022
Figure FDA0002996931690000023
β＝1-nA·c-ε，
wherein x in Q1,x2,...xBRespectively BQP batch feature vectors output by the feature extraction network in the network
Figure FDA0002996931690000024
Medium 1,2, … B elements; c is a penalty factor, and the value of the penalty factor is between 0 and 1; n isAIs a training batch (I)1,y1；I2,y2；...；IB,yB) Middle sample label yjIs the number of 1; epsilon is a numerical correction factor, and the empirical value is 0.05; coefficient beta is passed through nAC and epsilon are calculated; the output of the QP output layer is the optimal solution of the quadratic optimization problem, i.e.
Figure FDA0002996931690000025
The S23 and BQP networks are composed of feature extraction networks and QP output layer cascades, and the functions of the networks are to extract features of each batch of images, perform data modeling on batch feature vectors, and use spatial feature hypersphere to depict normal samples and abnormal samples.
2. The method for detecting an abnormality based on BQP network according to claim 1, wherein the step S3 specifically includes:
for a training batch of batch length B (I)1,y1；I2,y2；...；IB,yB) Extracting n-dimensional features of B sample image data as batch feature vectors through a convolution layer, a pooling layer, an activation layer and a linear layer, and using a matrix
Figure FDA0002996931690000026
Is represented by the formula, X ═ X1,x2...,xB]TMatrix of
Figure FDA0002996931690000027
As QP outputs the input of the layer.
3. The method for detecting an anomaly based on BQP network as claimed in claim 2, wherein said step S4 specifically is:
the QP output layer is designed according to the modeled spatial characteristic hypersphere, and the spatial characteristic hypersphere can contain normal samples as much as possible and exclude abnormal samples; meanwhile, a relaxation variable xi is introduced during modeling, so that the influence of noise is reduced, and the fault tolerance of the system is improved; constructing a hypersphere is equivalent to minimizing the radius of the hypersphere, adjusting a proper sphere center, and controlling the fault-tolerant capability through a relaxation variable; this problem can be expressed as an optimization problem as follows:
Figure FDA0002996931690000031
s.t.||xi-m||2-ξi≤R
ξi≥0
R2≥0
wherein R is spatial characteristic hypersphere radius, xiiAs a relaxation variable, xiBatch feature vector representing feature extraction network output
Figure FDA0002996931690000032
I ═ 1,2, … B; m is a spatial characteristic hyper-spherical center;
the problem is a secondary objective function with a secondary constraint condition, the problem is converted into a standard convex quadratic programming problem through dual transformation, a QP output layer solves the standard convex quadratic programming problem, and the QP output layer solves an optimal dual variable
Figure FDA0002996931690000033
During training, the corresponding relation is established with the normal sample and the abnormal sample according to the following corresponding rule:
Figure FDA0002996931690000034
wherein, ai *Optimal dual variable a representing QP output layer output*The ith element in (1), and c is a penalty factor.
4. The method for detecting an anomaly based on BQP network as claimed in claim 3, wherein said step S5 specifically is:
according to the corresponding relation, BQP the network designs the classification loss function:
Figure FDA0002996931690000035
wherein B is the batch size, ai *Optimal dual variable a representing QP output layer output*The ith element, c is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
and while using the classification loss function, introducing a consistency loss function, and normalizing the characteristic vector modular length of each batch of data:
Figure FDA0002996931690000036
wherein B is the batch size, xiBatch feature vector representing feature extraction network output
Figure FDA0002996931690000041
C is a penalty factor, yiRepresents the training batch (I)1,y1；I2,y2；...；IB,yB) The label of the ith sample;
wherein, the classification loss function and the consistency loss function are propagated reversely at the same time, and the network weight is dynamically modified.
5. The BQP network-based anomaly detection method according to claim 4, wherein the step S6 specifically includes:
during detection, the feature vector of each batch of data is extracted through the feature extraction network
Figure FDA0002996931690000042
Wherein X ═ X1,x2...,xB]TCalculating the modulo length X of each vector in Xi||2With a set threshold value RThresholdAnd comparing, and carrying out abnormality detection according to the following corresponding rules:
Figure FDA0002996931690000043
wherein x isiBatch feature vector representing feature extraction network output
Figure FDA0002996931690000044
The ith feature vector of (1), RThresholdIndicating a set threshold.
CN201910188286.3A 2019-03-13 2019-03-13 BQP network-based anomaly detection method Active CN109962915B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910188286.3A CN109962915B (en) 2019-03-13 2019-03-13 BQP network-based anomaly detection method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910188286.3A CN109962915B (en) 2019-03-13 2019-03-13 BQP network-based anomaly detection method

Publications (2)

Publication Number Publication Date
CN109962915A CN109962915A (en) 2019-07-02
CN109962915B true CN109962915B (en) 2021-09-28

Family

ID=67024356

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910188286.3A Active CN109962915B (en) 2019-03-13 2019-03-13 BQP network-based anomaly detection method

Country Status (1)

Country Link
CN (1) CN109962915B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113778719B (en) * 2021-09-16 2024-02-02 北京中科智眼科技有限公司 Anomaly detection algorithm based on copy and paste

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8612169B2 (en) * 2011-04-26 2013-12-17 International Business Machines Corporation Method and system for detecting anomalies in a bipartite graph
CN105975443A (en) * 2016-05-04 2016-09-28 西南大学 Lasso-based anomaly detection method and system
CN109379379A (en) * 2018-12-06 2019-02-22 中国民航大学 Based on the network inbreak detection method for improving convolutional neural networks

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170134411A1 (en) * 2015-11-09 2017-05-11 Gewei Ye Methods and Automated Systems to Effectively Resist (PAMD) Cyber Attacks
US11367149B2 (en) * 2016-01-15 2022-06-21 Carnegie Mellon University Pattern identification in time-series social media data, and output-dynamics engineering for a dynamic system having one or more multi-scale time-series data sets
EP3355547B1 (en) * 2017-01-27 2020-04-15 Vectra AI, Inc. Method and system for learning representations of network flow traffic

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8612169B2 (en) * 2011-04-26 2013-12-17 International Business Machines Corporation Method and system for detecting anomalies in a bipartite graph
CN105975443A (en) * 2016-05-04 2016-09-28 西南大学 Lasso-based anomaly detection method and system
CN109379379A (en) * 2018-12-06 2019-02-22 中国民航大学 Based on the network inbreak detection method for improving convolutional neural networks

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
《基于线性稀疏模型和iHMM的群体异常事件检测》;郭春生 等;《软件导刊》;20170331;全文 *

Also Published As

Publication number Publication date
CN109962915A (en) 2019-07-02

Similar Documents

Publication Publication Date Title
Jeong et al. Wavelet-based SPC procedure for complicated functional data
Raissi et al. Statistical process optimization through multi-response surface methodology
Chien et al. A system for online detection and classification of wafer bin map defect patterns for manufacturing intelligence
Chen et al. Credit scoring and rejected instances reassigning through evolutionary computation techniques
CN112766550B (en) Random forest-based power failure sensitive user prediction method, system, storage medium and computer equipment
CN116757534A (en) Intelligent refrigerator reliability analysis method based on neural training network
Huang et al. Using artificial neural networks to establish a customer-cancellation prediction model
CN112949821B (en) Network security situation awareness method based on dual-attention mechanism
CN112418476A (en) Ultra-short-term power load prediction method
CN116821832A (en) Abnormal data identification and correction method for high-voltage industrial and commercial user power load
CN114580934A (en) Early warning method for food detection data risk based on unsupervised anomaly detection
CN116823496A (en) Intelligent insurance risk assessment and pricing system based on artificial intelligence
CN109962915B (en) BQP network-based anomaly detection method
Liu et al. Stock price trend prediction model based on deep residual network and stock price graph
CN113221442B (en) Method and device for constructing health assessment model of power plant equipment
D'Urso et al. OWA fuzzy regression
CN113128612B (en) Processing method of abnormal value in power data and terminal equipment
CN116776209A (en) Method, system, equipment and medium for identifying operation state of gateway metering device
CN109829115B (en) Search engine keyword optimization method
Wang et al. Research on feature selection method of intrusion detection based on deep belief network
CN114298413A (en) Hydroelectric generating set runout trend prediction method
CN112765148A (en) Network intrusion detection method based on improved SVM multi-classification
CN116738170B (en) Abnormality analysis method and related device for industrial equipment
Xu et al. Security monitoring data fusion method based on ARIMA and LS-SVM
Bi et al. Hybrid Network Intrusion Detection with Stacked Sparse Contractive Autoencoders and Attention-based Bidirectional LSTM

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant