CN110147323B - Intelligent change checking method and device based on generation countermeasure network - Google Patents
Intelligent change checking method and device based on generation countermeasure network Download PDFInfo
- Publication number
- CN110147323B CN110147323B CN201910332628.4A CN201910332628A CN110147323B CN 110147323 B CN110147323 B CN 110147323B CN 201910332628 A CN201910332628 A CN 201910332628A CN 110147323 B CN110147323 B CN 110147323B
- Authority
- CN
- China
- Prior art keywords
- data
- index data
- change
- countermeasure network
- training
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3604—Software analysis for verifying properties of programs
- G06F11/3608—Software analysis for verifying properties of programs using formal methods, e.g. model checking, abstract interpretation
Abstract
The invention relates to the field of automatic operation and maintenance, in particular to a change intelligent checking method based on a generation countermeasure network, which comprises the following steps: acquiring index data, wherein the index data comprises data before modification and data after modification; preprocessing the index data; inputting the preprocessed index data into a pre-trained generation countermeasure network; and judging whether the change is abnormal according to the abnormal score of the generated countermeasure network output. The embodiment of the invention is suitable for automatic inspection before and after the change, can automatically adapt to the parameter change of the actual change scene, reduces the labor investment and improves the recall rate of the change inspection.
Description
Technical Field
The invention relates to the field of automatic operation and maintenance, in particular to an intelligent change checking method based on a generated countermeasure network and an intelligent change checking device based on the generated countermeasure network.
Background
When a product issues a new version, repairs a Bug, or improves system performance, online is needed, namely, change issue is undoubtedly the necessary path for product iteration. However, the change always accompanies the risk, and some users of the internet company feel and lose significant faults, and the faults are often related to the change. Although the quality of development and test is improved and the number of on-line faults can be reduced to a certain extent, the faults caused by changing cannot be completely avoided due to different production environments and test environments and complex calling relations of services.
In order to reduce the influence of abnormal change on the on-line service stability, the change is divided into a plurality of stages, each stage carries out service deployment change on a designated machine, the state of the service is checked after each stage of change is completed, the next stage of change is continued when the service is normal, otherwise, the change is considered to possibly influence the service stability, and the change is terminated.
Currently, there are two main approaches to the inspection of changes: 1. the scheme of the threshold is mainly formulated by manpower. The maintainer selects some core indexes for the module and configures an abnormality detection threshold for the selected indexes in advance. When the module is changed, whether the associated index is within the manually configured threshold range is checked. If the existence index is not within the manual configuration range, the change is considered abnormal, and the change is terminated. 2. A statistical-based scheme. The change of the mean value and the variance of the associated index before and after the change of the module is mainly inspected, and when the change is more remarkable, the change is considered abnormal, and the change is terminated.
However, the above schemes have the disadvantages: for a scheme of manually setting a threshold, the checking effect of the scheme is completely dependent on manually selected indexes and the threshold configured for the indexes, and because the manually selected indexes are usually a small set, abnormal changes are not found in time due to the fact that the indexes are not covered, and large-scale faults are caused. In addition, it is difficult to manually select a proper threshold value for each index, so that abnormal changes are not found due to too loose threshold values, and misjudgment occurs frequently due to too severe threshold values, and the change efficiency is affected. Moreover, the scheme needs manual participation, and has low efficiency.
For a statistical-based scheme, the mean and variance of the index change is insufficient to reflect the change before and after the change, as the mean and variance are only two aspects of the measure change. Therefore, this approach can reduce the labor cost, but the recall rate for the change check is not very high, resulting in some abnormal changes to the fish that is missing.
Disclosure of Invention
The invention aims to provide an intelligent inspection method for changing based on a generated countermeasure network, which is used for at least solving the problems of high labor cost and low inspection efficiency in the existing manual inspection by means of whether the change of an artificial intelligent inspection module is normal.
To achieve the above object, a first aspect of the present invention provides a method for intelligently checking changes based on generation of an countermeasure network, the method comprising:
acquiring index data, wherein the index data comprises data before modification and data after modification;
preprocessing the index data;
inputting the preprocessed index data into a pre-trained generation countermeasure network;
and judging whether the change is abnormal according to the abnormal score of the generated countermeasure network output.
Optionally, the acquiring the index data includes: the acquisition module splices the data of the previous period of current change and the data of the next period of current change to form index data.
Optionally, the pre-training is offline training.
Optionally, the pre-training generating the countermeasure network includes: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For encoding input index data x into a vector z, the decoder G D (z) for decoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly score s (x) = ||g E (x)-E(G(x))‖ 1 。
Optionally, the pre-training includes:
acquiring training samples from the history change data;
preprocessing the training sample;
inputting the preprocessed training samples into the generated countermeasure network;
updating thetag, which is a parameter of the generator part G and of the encoder E (x'), by minimizing a loss function L;
the parameters thetad of said arbiter portion D are updated by maximizing the cost function V.
Optionally, the loss function L is a reconstruction error loss L rec Hidden variable error loss L enc And optimizing a generatorLoss L gan Is a weighted sum of (c).
Optionally, preprocessing the index data includes: data normalization of the index data using z-score normalization;
preprocessing the training sample, including: the training samples were data normalized using z-score normalization.
Optionally, the method further comprises the step of modeling the anomaly score during the pre-training phase:
and (3) inputting a plurality of training samples into the generated countermeasure network, correspondingly obtaining a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using the kernel density estimation to obtain a probability distribution model p (s').
Optionally, the determining whether the change is abnormal according to the abnormal score of the generated countermeasure network output includes:
substituting an anomaly score s (x) into the probability distribution model p (s');
judging whether p { s' > s (x) } is smaller than a set threshold value;
when p { s' > s (x) } is smaller than a set threshold value, determining that the change has abnormality.
In a second aspect of the present invention, there is also provided an intelligent change checking apparatus based on generating an countermeasure network, including:
the index acquisition module is used for acquiring index data, wherein the index data comprises data before modification and data after modification;
the pretreatment module is used for carrying out pretreatment on the index data to obtain pretreated index data;
the generation countermeasure network module is trained in advance and used for processing the preprocessed index data and outputting corresponding anomaly scores;
and the abnormality judging module is used for judging whether the change is abnormal according to the abnormality score of the generated countermeasure network output.
Optionally, the acquiring the index data includes: the acquisition module splices the data of the previous period of current change and the data of the next period of current change to form index data.
Optionally, the pre-training is offline training.
Optionally, the generating the countermeasure network module includes: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For encoding input index data x into a vector z, the decoder G D (z) for decoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly score s (x) = ||g E (x)-E(G(x))‖ 1 。
Optionally, the pre-training includes:
acquiring training samples from the history change data;
preprocessing the training sample, and inputting the preprocessed training sample into the generated countermeasure network;
updating θ by minimizing the loss function L g The θ is g Parameters for the generator part G and the encoder E (x');
updating the parameters θ of the arbiter portion D by maximizing the cost function V d 。
Optionally, the loss function L is a reconstruction error loss L rec Hidden variable error loss L enc And optimizing the loss L of the generator gan Is a weighted sum of (c).
Optionally, preprocessing the index data includes: data normalization of the index data using z-score normalization;
preprocessing the training sample, including: the training samples were data normalized using z-score normalization.
Optionally, the apparatus further comprises an anomaly score modeling module configured to:
and (3) inputting a plurality of training samples into the generated countermeasure network, correspondingly obtaining a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using the kernel density estimation to obtain a probability distribution model p (s').
Optionally, the anomaly determination module is further configured to:
substituting an anomaly score s (x) into the probability distribution model p (s');
judging whether p { s' > s (x) } is smaller than a set threshold value;
when p { s' > s (x) } is smaller than a set threshold value, determining that the change has abnormality.
Optionally, the device is a server.
In a third aspect of the present invention, there is also provided a storage medium having stored therein instructions that, when executed on a computer, cause the computer to perform the aforementioned method of generating a modified intelligent check based on an antagonism network.
Through the technical scheme, the invention provides a change intelligent checking method and device based on a generated countermeasure network, and the method and device have the following advantages:
1) Compared with a scheme based on statistics, the definition of index change before and after change is expanded from the mean value and the variance, so that the model learns the normal mode and the abnormal mode of the change by itself;
2) The operation and maintenance personnel are liberated, and the input of human resources for operation and maintenance is reduced;
3) The recall rate of change inspection is improved, the loss caused by abnormal change is reduced, and a solid foundation is laid for automation and intelligent operation and maintenance.
Drawings
FIG. 1 is a flow chart of a method for intelligent inspection of changes provided by an embodiment of the present invention;
FIG. 2 is a schematic diagram of a model structure for generating an countermeasure network according to an embodiment of the present invention;
fig. 3 is a schematic diagram of a usage flow of a method for intelligent inspection of a change according to an embodiment of the present invention.
Detailed Description
The following describes specific embodiments of the present invention in detail with reference to the drawings. It should be understood that the detailed description and specific examples, while indicating and illustrating the invention, are not intended to limit the invention.
Fig. 1 is a flow chart of a method for intelligently checking changes according to an embodiment of the present invention. As shown in fig. 1, the method comprises the steps of:
acquiring index data, wherein the index data comprises data before modification and data after modification;
preprocessing the index data;
inputting the preprocessed index data into a pre-trained generation countermeasure network;
and judging whether the change is abnormal according to the abnormal score of the generated countermeasure network output.
Therefore, when the module is changed, the index acquired by the module can be automatically and intelligently checked, and whether the change causes risk to on-line stability or not can be rapidly analyzed. Compared with the manual inspection and change scheme, the invention basically does not need to input manpower, liberates operation and maintenance personnel, can cover the full index inspection, and greatly improves the recall rate. Compared with a scheme based on statistics, the definition of index change before and after change is expanded from the mean value and the variance, so that the model learns the normal mode and the abnormal mode of the change, thereby greatly improving recall rate, reducing loss caused by abnormal change and laying a solid foundation for automation and intelligent operation and maintenance.
Specifically, the embodiment of the invention uses the VAE-GAN network in deep learning, and uses the index data before and after the normal change of the module history or the normal sample of the artificial structure when the module is not changed to train the module, so that the VAE-GAN network learns the mode of the index in the module under the normal condition. By training the parameter values of the VAE-GAN network, the trained VAE-GAN network will result in: the difference between the hidden variable z after the input index is coded and the hidden variable z' obtained after the index is reconstructed and then coded is smaller. This gap is in essence a score for the index check, referred to herein as the anomaly score. When the model receives abnormal index data caused by abnormal change of the module in the online checking stage, the VAE-GAN network is not suitable for the index, and a larger difference value, namely a larger abnormal score, is generated between the hidden variable z after encoding the abnormal index and the hidden variable z' obtained after re-encoding the abnormal index after reconstruction. And reflecting the difference degree between the index and the normal index during training according to the magnitude of the abnormal score, so as to judge the probability of abnormality in the change, and judge whether the change is abnormal or not.
In an optional embodiment of the present invention, the obtaining the index data includes: the acquisition module splices the data of the previous period of current change and the data of the next period of current change to form index data. Specifically, the data x of 20 minutes is formed by acquiring the data of the index in the window (for example, 10 minutes) before the current change of the module and the data of the window (for example, 10 minutes) after the current change of the module and splicing the two. The duration of the window here is adjustable.
In an alternative embodiment provided by the present invention, the pre-training is offline training. In an embodiment of the present invention, the training section is actually divided into two sections, wherein the pre-training section is an off-line training section, and the section for acquiring the index data for inspection is on-line. The generated countermeasure network is put into online inspection after offline training, which is beneficial to reducing the system risk caused by online training.
Fig. 2 is a schematic diagram of a model structure for generating an countermeasure network according to an embodiment of the present invention, as shown in fig. 2: generating an antagonism network is a key element of an embodiment of the present invention, which includes the following structure: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For inputting inputIs encoded into a vector z, said decoder G D (z) for decoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly score s (x) = ||g E (x)-E(G(x))‖ 1 。
The whole model has a clear structure and consists of three parts: g E (x) And G D (z) constructing a generator G, which is regarded as a first part of the model structure, and passing the index data x through an encoder G E (x) To obtain hidden vector z, which is passed through decoder G D (z) obtaining reconstructed data x' of x. The arbiter D (x, x ') forms the second part of the model structure, with the original input x being judged true, the reconstructed input x' being judged false, and with the effort of letting x 'be judged true by the arbiter at the time of training the generator, the difference between x' and x is constantly optimized. The third part of the model is the encoder E (x ') that re-encodes the reconstructed input x' to obtain the latent variable z 'after encoding x'.
In the training stage, the training samples of the model are all index data before and after the normal change of the module history or are artificially constructed normal samples when the module is not changed, namely G E (x)，G D Both (z) and E (x') learn the normal pattern of the metrics in the module. When the model receives abnormal index data x caused by abnormal change of the module in the on-line inspection stage, G of the model is generated E (x)，G D (z) and E (x ') will not be applicable to x, where the difference between the resulting hidden variable z after encoding x and the resulting hidden variable z ' after encoding the reconstructed input x ' is large. This gap is in fact a score of the index check, and how the index check score is used to determine whether an abnormality exists in the index will be described later.
Further, how the generated countermeasure network is trained will be described below. The pre-training comprises:
altering data from historyAcquiring a training sample; preprocessing the training sample; inputting the preprocessed training samples into the generated countermeasure network; updating θ by minimizing the loss function L g The θ is g Parameters for the generator part G and the encoder E (x'); updating the parameters θ of the arbiter portion D by maximizing the cost function V d 。
Wherein, training sample comprises following two parts: the first part, several historical changes of the module. That is, the index changes the previous window (for example, 10 minutes) in a certain history, and changes the data of the next window (for example, 10 minutes) to splice the data of 20 minutes. A history of changes may result in a training sample of the index. In the second part, a historical data (e.g., 20 days) of the module index. The time period of the change in the historical data is removed, and then the historical data is repeatedly sampled (randomly manufacturing the change and splicing two pieces of data of a window (such as 10 minutes) before and after the change) according to the duration of the historical change of the module to form a plurality of training samples. Both samples are normal index data samples.
The training samples are pre-processed, where the pre-processing is described in more detail below. Inputting the preprocessed training sample into the generating countermeasure network, wherein the training of the generating countermeasure network is a necessary step for the network to normally operate, and belongs to the prior art. Training parameter theta g And parameter theta d Reference is made to the prior art for both the method and the procedure for optimizing the values of (c) and is not described in detail here.
The algorithmic pseudocode used by the present invention to generate an countermeasure network is disclosed herein as follows for understanding and implementation by those skilled in the art.
The loss function in the deep learning can guide the model learning, and a good loss function can enable the deep learning model to be more accurate and robust, and meanwhile training complexity is reduced.
Loss at this pointThe function is divided into reconstruction error loss L rec Hidden variable error loss L enc And loss L of optimization generator in GAN gan Sum of three parts:
reconstruction error loss L rec For reducing the difference in original values between x' and x:
L rec ＝E x～p(X) ||x-x'|| 1
hidden variable error loss L enc For reducing the gap in the information obtained after encoding between x' and x:
L enc ＝E x～p(X) ||z-z'|| 1
loss L of optimization generator in GAN gan For reducing the gap between x' and x in data patterns and features:
L gan ＝E x～p(X) log(1-D(G(x)))
the overall loss can be expressed as a weighted sum of the three-part losses, w rec 、w enc And w gan The weight can be set:
L＝w rec L rec +w enc L enc +w gan L gan
further, preprocessing the index data includes: data normalization of the index data using z-score normalization; preprocessing the training sample, including: the training samples were data normalized using z-score normalization. The pretreatment methods for the index data and training samples are the same here.
Normalization (normalization) is the scaling of data to fall within a small specified interval. It is often used in some comparison and evaluation index processes to remove unit limitations of data and convert it to dimensionless pure values, so that indexes of different units or magnitudes can be compared and weighted.
The data normalization methods at present are various and can be classified into linear methods (such as extremum method and z-score normalization), broken line methods (such as three broken line method) and curve methods (such as semi-normal distribution). Different standardized methods have different effects on the evaluation results of the system. The most common are min-max normalization and z-score normalization.
The z-score normalization, also called standard deviation normalization, was chosen here, and this method gives the mean (mean) and standard deviation (standard deviation) of the raw data to normalize the data. The data normalization method in hundred degrees encyclopedia is exemplified herein for reference by those skilled in the art:
calculating arithmetic mean (mathematical expectation) xi and standard deviation si of each variable (index); and then carrying out standardization treatment: z ij ＝(x ij －xi)/si
Wherein: z ij Is a normalized variable value; x is x ij Is the actual variable value.
In an alternative embodiment provided by the present invention, the method further includes: in the pre-training phase, modeling the anomaly score: and inputting a plurality of training samples into the generated countermeasure network, correspondingly obtaining a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using the kernel density estimation to obtain a probability distribution model p (s').
The kernel density estimation (kernel density estimation) is a density function used in probability theory to estimate unknowns, and is one of the non-parametric inspection methods. Since the kernel density estimation method does not use a priori knowledge about data distribution, no assumption is added to the data distribution, and the method is a method for researching the data distribution characteristics from the data sample itself. Common kernel function models include a uniform kernel function, a triangular kernel function, a gamma kernel function, a gaussian kernel function, and the like. Those skilled in the art can choose according to the actual data distribution.
Further, the determining whether the change is abnormal according to the abnormal score of the generated countermeasure network output includes:
substituting an anomaly score s (x) into the probability distribution model p (s'); judging whether p { s' > s (x) } is smaller than a set threshold value; when p { s' > s (x) } is smaller than a set threshold value, determining that the change has abnormality.
From generation ofAs a function of the countermeasure network, z=g E (x) Z' =e (G (x)), so the output value s (x) = ||g E (x)-E(G(x))|| 1 Equal to the degree of difference between z and z'. When x is more abnormal, s (x) is larger.
When the index is checked online, the corresponding anomaly score s (x) is needed to be obtained and substituted into a probability distribution model p (s ') obtained in an offline training stage, and when p { s' > s (x) } < a, the index is judged to be abnormal, the change can cause risk to online stability, and the change is needed to be stopped. Where a is a settable constant, for example optionally 0.001.
An embodiment of the present invention also provides an intelligent change checking apparatus based on generation of an countermeasure network, the apparatus including:
the index acquisition module is used for acquiring index data, wherein the index data comprises data before modification and data after modification;
the preprocessing module is used for preprocessing the index data;
the method comprises the steps of generating an countermeasure network module, wherein the generated countermeasure network module is trained in advance and used for processing the preprocessed index data and outputting corresponding anomaly scores;
and the abnormality judging module is used for judging whether the change is abnormal according to the abnormality score of the generated countermeasure network output.
The index data acquired by the index acquisition module comprises: the acquisition module splices the data of the previous period of current change and the data of the next period of current change to form index data.
The pre-training of the generation countermeasure network module is offline training.
The generating an countermeasure network module includes: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For encoding input index data x into a vector z, the decoder G D (z) for decoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly score s (x) = ||g E (x)-E(G(x))‖ 1 。
The generating an countermeasure network module is pre-trained, comprising:
acquiring training samples from the history change data;
preprocessing the training samples and inputting the preprocessed training samples into the generated countermeasure network;
updating θ by minimizing the loss function L g The θ is g Parameters for the generator part G and the encoder E (x');
updating the parameters θ of the arbiter portion D by maximizing the cost function V d 。
The loss function L is a reconstruction error loss L rec Hidden variable error loss L enc And optimizing the loss L of the generator gan Is a weighted sum of (c).
The preprocessing module comprises: the index data or training samples are data normalized using z-score normalization.
The apparatus further includes an anomaly score modeling module configured to:
and inputting a plurality of training samples into the generated countermeasure network, correspondingly obtaining a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using the kernel density estimation to obtain a probability distribution model p (s').
The anomaly determination module is further configured to:
substituting an anomaly score s (x) into the probability distribution model p (s');
judging whether p { s' > s (x) } is smaller than a set threshold value;
when p { s' > s (x) } is smaller than a set threshold value, determining that the change has abnormality.
The technical details of the device are referred to herein as the technical details of the method described above, and are not repeated here.
Further, the common hardware form of the above device is a computer, and in an actual working environment, the device is a server from the viewpoint of stability of operation.
Fig. 3 is a schematic diagram of a usage flow of a method for intelligent inspection of a change according to an embodiment of the present invention, and a complete embodiment of the present invention is described below with reference to fig. 3.
In the pre-training phase, namely the off-line training phase, the method comprises the following steps:
1) Training data is constructed.
2) And (5) pretreatment. That is, the foregoing data normalization is performed on training data (training samples);
3) And training a model. I.e., a process of maximizing V and minimizing L;
4) And modeling the index anomaly score probability. The anomaly score is modeled using the kernel density estimate.
In the actual inspection phase, i.e. in terms of on-line operation, the following steps are included:
1) The acquisition module changes data, namely, acquires index data to be distinguished;
2) And (5) pretreatment. The index data is subjected to the data standardization;
3) An anomaly score is calculated. Namely, obtaining an anomaly score by generating an countermeasure network;
4) And (5) judging a threshold value. And substituting the abnormal score into the probability distribution model to judge whether the change is abnormal or not.
Embodiments of the present invention also provide a storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform a method of intelligent inspection of changes based on generating a countermeasure network as described above.
Therefore, the embodiment of the invention can effectively improve the on-line inspection efficiency and effectively reduce the investment of maintenance labor. The method is applied to actual automatic operation and maintenance, and lays a solid foundation for automatic and intelligent operation and maintenance.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, etc., such as Read Only Memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises an element.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The foregoing is merely exemplary of the present application and is not intended to limit the present application. Various modifications and changes may be made to the present application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. which are within the spirit and principles of the present application are intended to be included within the scope of the claims of the present application.
Claims (16)
1. A method for intelligently checking changes based on generating an antagonism network, the method comprising:
acquiring index data, wherein the index data comprises data before modification and data after modification; the index data is related to stability;
preprocessing the index data;
inputting the preprocessed index data into a pre-trained generation countermeasure network;
judging whether the change is abnormal according to the abnormal score of the generated countermeasure network output;
the obtaining the index data includes: the method comprises the steps that the acquisition module splices data of a previous period of current change and data of a next period of current change to form index data; the pre-training is offline training.
2. The method of claim 1, wherein the pre-trained generation of the challenge network comprises: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For encoding input index data x into a vector z, the decoder G D (z) for applying theDecoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly scores(x)=‖G E (x)-E(G(x))‖ 1 。
3. The method of claim 2, wherein the pre-training comprises:
acquiring training samples from the history change data;
preprocessing the training sample;
inputting the preprocessed training samples into the generated countermeasure network;
updating by minimizing the loss function L
Said->
Parameters for the generator part G and the encoder E (x');
updating parameters of the arbiter portion D by maximizing the cost function V
。
4. A method according to claim 3, characterized in that the loss function L is a reconstruction error loss
Hidden variable error loss->
And loss of optimization generator->
Is a weighted sum of (c).
5. The method of claim 4, wherein preprocessing the index data comprises: data normalization of the index data using z-score normalization;
preprocessing the training sample, including: the training samples were data normalized using z-score normalization.
6. The method of claim 5, further comprising the step of modeling the anomaly score during the pre-training phase:
inputting a plurality of training samples into the generating countermeasure network to correspondingly obtain a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using kernel density estimation to obtain a probability distribution modelp(s’)。
7. The method of claim 6, wherein said determining whether the change is abnormal based on the anomaly score of the generated countermeasure network output comprises:
score of abnormalitys(x) Substitution into probability distribution modelp(s’)；
Judgingp{s’＞ s(x) Whether or not the value is smaller than the set threshold;
when (when)p{s’＞ s(x) And when the value is smaller than the set threshold value, determining and judging that the change is abnormal.
8. An intelligent change checking device based on generation of an countermeasure network, comprising:
the index acquisition module is used for acquiring index data, wherein the index data comprises data before modification and data after modification; the index data is related to stability; the obtaining the index data includes: the method comprises the steps that the acquisition module splices data of a previous period of current change and data of a next period of current change to form index data;
the pretreatment module is used for carrying out pretreatment on the index data to obtain pretreated index data;
the generation countermeasure network module is trained in advance and used for processing the preprocessed index data and outputting corresponding anomaly scores; the pre-training is offline training;
and the abnormality judging module is used for judging whether the change is abnormal according to the abnormality score of the generated countermeasure network output.
9. The apparatus of claim 8, wherein the generating an countermeasure network module comprises: a generator section G, a discriminator section D and an encoder E (x');
the generator part G comprises an encoder G E (x) And decoder G D (z); the encoder G E (x) For encoding input index data x into a vector z, the decoder G D (z) for decoding the vector z into a reconstructed x';
the discriminator part D is used for evaluating the similarity between the reconstructed x' generated by the generator part G and the original input index data x;
the encoder E (x ') is configured to encode the reconstructed x ' into z ';
anomaly scores(x)=‖G E (x)-E(G(x))‖ 1 。
10. The apparatus of claim 9, wherein the pre-training comprises:
acquiring training samples from the history change data;
preprocessing the training sample, and inputting the preprocessed training sample into the generated countermeasure network;
updating by minimizing the loss function L
Said->
Parameters for the generator part G and the encoder E (x');
updating parameters of the arbiter portion D by maximizing the cost function V
。
11. The apparatus of claim 10, wherein the loss function L is a reconstruction error loss
Hidden variable error loss->
And loss of optimization generator->
Is a weighted sum of (c).
12. The apparatus of claim 11, wherein preprocessing the index data comprises: data normalization of the index data using z-score normalization;
preprocessing the training sample, including: the training samples were data normalized using z-score normalization.
13. The apparatus of claim 12, further comprising an anomaly score modeling module configured to:
inputting a plurality of training samples into the generating countermeasure network to correspondingly obtain a plurality of anomaly scores, and modeling a set formed by the anomaly scores by using kernel density estimation to obtain a probability distribution modelp(s’)。
14. The apparatus of claim 13, wherein the anomaly determination module is further configured to:
score of abnormalitys(x) Substitution into probability distribution modelp(s’)；
Judgingp{s’＞ s(x) Whether or not the value is smaller than the set threshold;
when (when)p{s’＞ s(x) And when the value is smaller than the set threshold value, determining and judging that the change is abnormal.
15. The apparatus according to any one of claims 8-14, wherein the apparatus is a server.
16. A storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the intelligent checking method for changes based on generating an countermeasure network of any of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910332628.4A CN110147323B (en) | 2019-04-24 | 2019-04-24 | Intelligent change checking method and device based on generation countermeasure network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910332628.4A CN110147323B (en) | 2019-04-24 | 2019-04-24 | Intelligent change checking method and device based on generation countermeasure network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110147323A CN110147323A (en) | 2019-08-20 |
| CN110147323B true CN110147323B (en) | 2023-05-23 |
Family
ID=67594383
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910332628.4A Active CN110147323B (en) | 2019-04-24 | 2019-04-24 | Intelligent change checking method and device based on generation countermeasure network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110147323B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111008643B (en) * | 2019-10-29 | 2024-03-19 | 平安科技（深圳）有限公司 | Picture classification method and device based on semi-supervised learning and computer equipment |
| CN111598805A (en) * | 2020-05-13 | 2020-08-28 | 华中科技大学 | Confrontation sample defense method and system based on VAE-GAN |
| CN112581719B (en) * | 2020-11-05 | 2021-09-03 | 清华大学 | Semiconductor packaging process early warning method and device based on time sequence generation countermeasure network |
| CN113052203B (en) * | 2021-02-09 | 2022-01-18 | 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) | Anomaly detection method and device for multiple types of data |
| CN112597831A (en) * | 2021-02-22 | 2021-04-02 | 杭州安脉盛智能技术有限公司 | Signal abnormity detection method based on variational self-encoder and countermeasure network |
| CN113255738A (en) * | 2021-05-06 | 2021-08-13 | 武汉象点科技有限公司 | Abnormal image detection method based on self-attention generation countermeasure network |
| CN113537616A (en) * | 2021-07-28 | 2021-10-22 | 北京达佳互联信息技术有限公司 | Account prediction model training method and device, electronic equipment and storage medium |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107358195A (en) * | 2017-07-11 | 2017-11-17 | 成都考拉悠然科技有限公司 | Nonspecific accident detection and localization method, computer based on reconstruction error |
| CN109584221A (en) * | 2018-11-16 | 2019-04-05 | 聚时科技(上海)有限公司 | A kind of abnormal image detection method generating confrontation network based on supervised |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6661773B1 (en) * | 1999-06-07 | 2003-12-09 | Intel Corporation | Method for detection of stale cells following route changes in a data communication |
| US20130325679A1 (en) * | 2012-06-01 | 2013-12-05 | Bank Of America Corporation | Production and maintenance feature for account related triggers |
| US11003988B2 (en) * | 2016-11-23 | 2021-05-11 | General Electric Company | Hardware system design improvement using deep learning algorithms |
| US20180314932A1 (en) * | 2017-04-28 | 2018-11-01 | Intel Corporation | Graphics processing unit generative adversarial network |
| CN108876780B (en) * | 2018-06-26 | 2020-11-10 | 陕西师范大学 | Bridge crack image crack detection method under complex background |
| CN109191402B (en) * | 2018-09-03 | 2020-11-03 | 武汉大学 | Image restoration method and system based on confrontation generation neural network |
| CN109447263B (en) * | 2018-11-07 | 2021-07-30 | 任元 | Space abnormal event detection method based on generation of countermeasure network |
-
2019
- 2019-04-24 CN CN201910332628.4A patent/CN110147323B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107358195A (en) * | 2017-07-11 | 2017-11-17 | 成都考拉悠然科技有限公司 | Nonspecific accident detection and localization method, computer based on reconstruction error |
| CN109584221A (en) * | 2018-11-16 | 2019-04-05 | 聚时科技(上海)有限公司 | A kind of abnormal image detection method generating confrontation network based on supervised |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110147323A (en) | 2019-08-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110147323B (en) | Intelligent change checking method and device based on generation countermeasure network | |
| CN111967571A (en) | MHMA-based anomaly detection method and equipment | |
| CN110969194B (en) | Cable early fault positioning method based on improved convolutional neural network | |
| CN112508243B (en) | Training method and device for multi-fault prediction network model of power information system | |
| CN112633421A (en) | Method and device for detecting abnormal electricity utilization behavior of user | |
| CN115035913B (en) | Sound abnormity detection method | |
| CN114239377A (en) | Method and system for evaluating health state of urban rail electromechanical equipment and storage medium | |
| CN114152825A (en) | Fault diagnosis method and device of transformer and fault diagnosis system of transformer | |
| Fan et al. | A Bayesian predictive analysis of step‐Stress accelerated tests in Gamma degradation‐based processes | |
| CN110334478A (en) | Machinery equipment abnormality detection model building method, detection method and model | |
| CN112949201B (en) | Wind speed prediction method and device, electronic equipment and storage medium | |
| CN113988398A (en) | Wind turbine generator power prediction method and device, electronic equipment and storage medium | |
| CN116611184A (en) | Fault detection method, device and medium for gear box | |
| CN115904916A (en) | Hard disk failure prediction method and device, electronic equipment and storage medium | |
| CN113238908B (en) | Server performance test data analysis method and related device | |
| CN113139332A (en) | Automatic model construction method, device and equipment | |
| CN109325287B (en) | Method for estimating reliability parameters of mechanical part | |
| Kim et al. | SIGNAL FAULT IDENTIFICATION IN NUCLEAR POWER PLANTS BASED ON DEEP NEURAL NETWORKS. | |
| CN114881344A (en) | Training method, device and medium for building energy consumption prediction model | |
| CN112862096A (en) | Model training and data processing method, device, equipment and medium | |
| CN110796371A (en) | Intelligent substation safety measure checking method | |
| CN109344472B (en) | Method for estimating reliability parameters of mechanical and electrical components | |
| CN116910559A (en) | Index anomaly detection method for intelligent operation and maintenance application of power grid supercomputer center | |
| CN117154680A (en) | Wind power prediction method based on non-stationary transducer model | |
| CN115495729A (en) | Intrusion detection method and system based on hVAE generation model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |