CN110298407A - A kind of method of anomaly data detection, system and equipment - Google Patents

Abstract

This application discloses a kind of methods of anomaly data detection, comprising: utilizes the field parameter of krill group's algorithm optimization DBSCAN clustering algorithm；Obtain pending data；Pending data is marked based on the DBSCAN clustering algorithm after optimization, obtains clustering cluster data set and noise data collection；Determine that the data that noise data is concentrated are abnormal data.Technical solution provided herein, greatly enhance the Clustering Effect to traffic data, when facing freeway traffic flow data complicated and changeable and strong stochastic volatility, it can accurately detect abnormal traffic data, improve the efficiency and accuracy of abnormal traffic Data Detection.The application additionally provides the system, equipment and computer readable storage medium of a kind of anomaly data detection simultaneously, has above-mentioned beneficial effect.

Description

A method, system and device for abnormal data detection

technical field

The present application relates to the field of abnormal data detection, and in particular, to a method, system, device and computer-readable storage medium for abnormal data detection.

Background technique

In the highway intelligent transportation system, abnormal data is an important factor affecting the data quality, so the search and cleaning of abnormal traffic data is an important step in the optimization of highway traffic data quality. Abnormal traffic data is a small part of traffic big data, and its numerical value, development trend, and data curve shape are all different from the normal traffic data that accounts for a large proportion.

Due to the complexity and variability of highway traffic flow data and strong random fluctuations, it is difficult for traditional abnormal data identification methods to accurately detect abnormal traffic flow data.

Therefore, how to accurately detect abnormal traffic flow data is a technical problem that needs to be solved by those skilled in the art.

SUMMARY OF THE INVENTION

The purpose of the present application is to provide a method, system, device and computer-readable storage medium for abnormal data detection, which are used to accurately detect abnormal traffic flow data.

In order to solve the above-mentioned technical problems, the present application provides a method for abnormal data detection, the method comprising:

Using krill swarm algorithm to optimize the domain parameters of DBSCAN clustering algorithm;

Get data to be processed;

Marking the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set;

It is determined that the data in the noise data set is abnormal data.

Optionally, the optimization of the field parameters of the DBSCAN clustering algorithm using the krill swarm algorithm includes:

Taking the field parameters of the DBSCAN clustering algorithm as the krill group individual position vector;

Calculate the fitness value of the krill group individual according to the position vector of the krill group individual;

Determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual;

performing locomotion, foraging activity, and random dispersal locomotion induced by the krill colony excluding the worst krill individual and the optimal krill individual;

updating the individual position vectors of each of the krill groups;

judging whether the maximum number of iterations of the krill swarm algorithm is reached;

If not, returning to the step of calculating the fitness value of the krill group individual according to the position vector of the krill group individual;

If so, use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm.

Optionally, calculating the fitness value of the krill group individual according to the position vector of the krill group individual includes:

According to the formula

calculating the fitness value of the krill group individuals;

Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x, x') is the Euclidean distance between x and x', and ε is a constant.

Optionally, updating the individual position vectors of the krill groups, including:

According to the formula updating the individual position vectors of each of the krill groups;

Among them, Δt is the update step size.

optional, in accordance with the formula

Before updating the individual position vector of each of the krill groups, it also includes:

According to the formula performing a crossover operation on the individual position vector elements of each of the krill groups;

According to the formula performing mutation operation on the individual position vector elements of each of the krill groups;

Among them, x _i,m is the m-th group of position vector elements in the i-th krill individual, Cr is the threshold of the crossover probability, and R _i,m is the m-th group of position vector elements in the i-th krill individual for crossover operation Or the probability of mutation operation, Mu is the mutation probability, x _gbes,m is the optimal position vector element for the current iteration, x _p,m , x _q,m are randomly selected position vector elements, and μ is a constant.

The present application also provides a system for detecting abnormal data, the system comprising:

The optimization module is used to optimize the domain parameters of the DBSCAN clustering algorithm using the krill swarm algorithm;

The acquisition module is used to acquire the data to be processed;

a labeling module for labeling the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set;

A determination module, configured to determine that the data in the noise data set is abnormal data.

Optionally, the optimization module includes:

a position vector determination submodule, used for taking the field parameter of the DBSCAN clustering algorithm as the krill group individual position vector;

a calculation submodule, configured to calculate the fitness value of the krill group individual according to the position vector of the krill group individual;

a first determination submodule, configured to determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual;

an execution sub-module for executing movement, foraging activity and random diffusion movement induced by the krill swarm excluding the worst krill individual and the optimal krill individual;

an update submodule for updating the individual position vectors of the krill groups;

a judging submodule for judging whether the maximum number of iterations of the krill swarm algorithm is reached;

A return sub-module, configured to return to the calculation sub-module to perform the step of calculating the fitness value of the krill group individual according to the position vector of the krill group individual when the maximum number of iterations of the krill group algorithm has not been reached ;

The second determination sub-module is configured to use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm when the maximum number of iterations of the krill group algorithm is reached.

Optionally, the calculation submodule includes:

Calculation unit, used for formulas

calculating the fitness value of the krill group individuals;

Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x, x') is the Euclidean distance between x and x', and ε is a constant.

The application also provides an abnormal data detection device, the abnormal data detection device includes:

memory for storing computer programs;

The processor is configured to implement the steps of the method for detecting abnormal data according to any one of the above when executing the computer program.

The present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, implements the steps of the method for detecting abnormal data according to any one of the above.

The method for detecting abnormal data provided by the present application includes: using the krill swarm algorithm to optimize the field parameters of the DBSCAN clustering algorithm; obtaining data to be processed; marking the data to be processed based on the optimized DBSCAN clustering algorithm to obtain cluster data set and noise data set; determine the data in the noise data set as abnormal data.

The technical solution provided in this application, by marking the data to be processed based on the optimized DBSCAN clustering algorithm, obtains a cluster data set and a noise data set, and finally determines that the data in the noise data set is abnormal data, which greatly enhances the The clustering effect of traffic data can accurately detect abnormal traffic data in the face of complex, changeable and highly random fluctuation of expressway traffic flow data, and improve the efficiency and accuracy of abnormal traffic data detection. The present application also provides a system, device, and computer-readable storage medium for abnormal data detection, which have the above beneficial effects, and are not repeated here.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

1 is a flowchart of a method for detecting abnormal data provided by an embodiment of the present application;

FIG. 2 is a flowchart of an actual representation of S101 in the method for detecting abnormal data provided in FIG. 1;

3 is a structural diagram of a system for detecting abnormal data provided by an embodiment of the present application;

4 is a structural diagram of another abnormal data detection system provided by an embodiment of the present application;

FIG. 5 is a structural diagram of an abnormal data detection device provided by an embodiment of the present application.

Detailed ways

The core of the present application is to provide a method, system, device and computer-readable storage medium for detecting abnormal data, which are used to accurately detect abnormal traffic flow data.

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Please refer to FIG. 1 , which is a flowchart of a method for detecting abnormal data provided by an embodiment of the present application.

It specifically includes the following steps:

S101: Use the krill swarm algorithm to optimize the domain parameters of the DBSCAN clustering algorithm;

Based on the complexity and variability of highway traffic flow data and strong random fluctuations, it is difficult for traditional abnormal data identification methods to accurately detect abnormal traffic flow data. This application provides a method for abnormal data detection, which is used to solve the problem of the above questions;

This application marks the data to be processed through the DBSCAN clustering algorithm. DBSCAN is a clustering algorithm that divides classes based on data density. The clustering algorithm can effectively and accurately classify the highway traffic data and separate the abnormal samples, so as to detect the abnormal traffic data.

However, the DBSCAN clustering algorithm is very sensitive to the setting of the domain parameters (E, MinPts). If it is not specified properly, the algorithm will cause the degradation of the clustering quality. Therefore, this application uses the krill swarm algorithm to optimize the DBSCAN clustering algorithm. Domain parameters, krill swarm algorithm is a new swarm intelligence algorithm that imitates the survival activities of Antarctic krill swarms. It can effectively solve a wide range of benchmark optimization problems, optimize the domain parameters of the DBSCAN clustering algorithm, and improve the clustering of the DBSCAN clustering algorithm. Class quality, thereby improving the efficiency and accuracy of abnormal traffic data detection.

S102: obtain data to be processed;

The data to be processed mentioned here is the input highway traffic sample set. The input method of the highway traffic sample set can be manually input by the user, or it can be downloaded by connecting to a preset server. There is no specific limitation.

S103: Mark the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set;

Optionally, the optimized DBSCAN clustering algorithm mentioned here marks the data to be processed to obtain a cluster data set and a noise data set, which can be specifically:

S1031: Receive the input highway traffic sample set D=(x ₁ , x ₂ , . . . , x _m ), and determine the neighborhood parameters (E, MinPts);

S1032: Set the core object set A, divide it into the number k of clusters, the data set B and the cluster division C that have not been traversed, and initialize, that is,

S1033: Find out all the core objects in the expressway traffic sample set D, set j=1, 2... _j ), if |NE(x _j )|≥MinPts is satisfied, then put x _j into the core object set A, that is, A=A∪{x _j };

S1034: Determine whether the core object set A is empty;

like Then the algorithm ends, and step S1038 is executed at this time, if Then execute step S1035;

S1035: arbitrarily select a∈A, and set the core object queue Acur={a}, k=k+1 at the same time, at this moment the cluster data set Ck={a}, update B=B-{a};

S1036: Determine whether the core object queue is empty;

like Then update C={C ₁ , C ₂ ,...,C _k }, and A=A-Ck, and return to step S1034; if Then execute step S1037;

S1037: Select a'∈Acur arbitrarily, update N _E (a') according to the definition of _E -neighborhood, set Δ=NE (a')∩B, and update Ck=Ck∪ _Δ , B=B-Δ, And Acur=Acur∪(Δ∩A)-a', then return to step S1036;

S1038: Output the clusters C={C ₁ , C ₂ , . . . , C _k } and the abnormal data clusters DC.

The embodiment of the present application uses the DBSCAN density clustering algorithm to accurately classify the highway traffic data to separate abnormal samples, has strong operating speed, accuracy and recall rate, and shows good performance in detecting abnormal traffic data. Stability and effectiveness.

S104: Determine that the data in the noise data set is abnormal data.

Based on the above technical solution, in a method for detecting abnormal data provided by the present application, by marking the data to be processed based on the optimized DBSCAN clustering algorithm, a cluster data set and a noise data set are obtained, and finally the data set in the noise data set is determined. The data is abnormal data, which greatly enhances the clustering effect of traffic data. In the face of complex and changeable highway traffic flow data with strong random fluctuation, it can accurately detect abnormal traffic data and improve abnormal traffic flow. Efficiency and accuracy of data detection.

For step S101 of the previous embodiment, the described use of the krill swarm algorithm to optimize the domain parameters of the DBSCAN clustering algorithm may also be the steps shown in FIG. 2 , which will be described below with reference to FIG. 2 .

Please refer to FIG. 2 . FIG. 2 is a flowchart of an actual representation of S103 in the abnormal data detection method provided in FIG. 1 .

It specifically includes the following steps:

S201: take the domain parameters of the DBSCAN clustering algorithm as the krill group individual position vector;

For example, the position x _i =(x _i1 ,x _i2 ) of krill individual i, where x _i1 represents E, and x _i1 ∈ [R _Edown ,R _Eup ], x _i2 represents MinPts, and x _i2 ∈ [R _Mdown , R _Mup ],

S202: Calculate the fitness value of the krill group individual according to the position vector of the krill group individual;

Optionally, the calculation of the fitness value of the krill group individual according to the position vector of the krill group individual mentioned here may specifically be:

According to the formula

Calculate the fitness value of krill group individuals;

Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x,x') is the Euclidean distance between x and x', and ε is a constant.

S203: Determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual;

Optionally, the krill group individual with the largest fitness value may be regarded as the optimal krill individual, and the krill group individual with the smallest fitness value may be regarded as the worst krill individual.

S204: Execute the movement, foraging activity and random diffusion movement induced by the krill group excluding the worst krill individual and the optimal krill individual;

Optionally, the execution of the movement, foraging activity and random diffusion movement induced by the krill group that removes the worst krill individual and the optimal krill individual mentioned here may specifically include the following steps:

S2041: According to the formula

performing the movement induced by the krill swarm excluding the worst krill individuals and the best krill individuals;

Among them, N ^max is the maximum induced velocity, _wn is the inertia weight of the position movement caused in the range of [0,1], N _i ^old is the induced movement direction position of the previous changing movement, Food orientation induction for the best individual in the krill swarm, X _i is the fitness or objective function value of the current iteration of the ith individual in the krill swarm, X _j is the jth (j=1, 2, .. ., N) the fitness of neighbors, ε is infinitesimal.

S2042: Perform foraging activities according to the formula F _i =V _f β _i +w _f F _i ^old ;

Among them, V _f is the foraging speed, w _f is the inertia weight of the foraging movement and takes a value in the range of [0, 1], F _i ^old is the last foraging action, β _i is the foraging direction, and β _i is calculated according to the formula β _i =β _i ^food +β _i ^best , where refers to the attractiveness of a food, according to the formula and to calculate, and It is the case with the best fitness of the i-th individual in the krill group so far, according to the formula Calculation.

S2042: According to the formula conduct random diffusion;

Among them, D _max is the maximum diffusion speed, δ is a random direction vector, and I and I _max are the current krill swarm change times and the preset global maximum change times constant of the krill swarm, respectively.

S205: Update the individual position vectors of each krill group;

Optionally, the updating of the individual position vectors of each krill group mentioned here may specifically be:

According to the formula Update the individual position vector of each krill group;

Among them, Δt is the update step size, which can be calculated according to the formula The calculation is performed, where C _t is the limiting step factor, which is a constant between [0, 2], and a low value of C _t allows krill individuals to carefully search the space.

optional, in accordance with the formula

Before updating the individual position vector of each krill group, the following steps may also be included:

According to the formula Perform a crossover operation on the individual position vector elements of each krill group;

According to the formula Perform mutation operation on individual position vector elements of each krill group;

Among them, x _i,m is the m-th group of position vector elements in the i-th krill individual, Cr is the threshold of the crossover probability, and R _i,m is the m-th group of position vector elements in the i-th krill individual for crossover operation Or the probability of mutation operation, Mu is the mutation probability, x _gbes,m is the optimal position vector element for the current iteration, x _p,m , x _q,m are randomly selected position vector elements, and μ is a constant.

S206: Determine whether the maximum number of iterations of the krill swarm algorithm is reached;

If yes, go to step S207; if no, go back to step S202;

S207: Use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm.

Please refer to FIG. 3 , which is a structural diagram of a system for detecting abnormal data provided by an embodiment of the present application.

The system can include:

The optimization module 100 is used for optimizing the domain parameters of the DBSCAN clustering algorithm by using the krill swarm algorithm;

an acquisition module 200 for acquiring data to be processed;

The labeling module 300 is used for labeling the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set;

The determining module 400 is configured to determine that the data in the noise data set is abnormal data.

Please refer to FIG. 4 , which is a structural diagram of another abnormal data detection system provided by an embodiment of the present application.

The optimization module 100 may include:

The position vector determination sub-module is used to use the field parameters of the DBSCAN clustering algorithm as the position vector of the krill group individual;

The calculation submodule is used to calculate the fitness value of the krill group individual according to the position vector of the krill group individual;

The first determination submodule is used to determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual;

an execution sub-module for executing movements, foraging activities, and random diffusion movements induced by krill swarms that remove the worst krill individuals and the best krill individuals;

The update submodule is used to update the individual position vector of each krill group;

The judgment sub-module is used to judge whether the maximum number of iterations of the krill swarm algorithm is reached;

The return sub-module is used for returning the calculation sub-module to perform the step of calculating the fitness value of the krill swarm individual according to the krill swarm individual position vector when the maximum number of iterations of the krill swarm algorithm is not reached;

The second determination submodule is used to use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm when the maximum number of iterations of the krill group algorithm is reached.

Further, the calculation submodule may include:

Calculation unit, used for formulas

Calculate the fitness value of krill group individuals;

Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x,x') is the Euclidean distance between x and x', and ε is a constant.

The update submodule can include:

Update cell, used to according to the formula Update the individual position vector of each krill group;

Among them, Δt is the update step size.

The update submodule may also include:

Crossover unit, used for formulas Perform a crossover operation on the individual position vector elements of each krill group;

Mutation operation unit, used for formula Perform mutation operation on individual position vector elements of each krill group;

Among them, x _i,m is the m-th group of position vector elements in the i-th krill individual, Cr is the threshold of the crossover probability, and R _i,m is the m-th group of position vector elements in the i-th krill individual for crossover operation Or the probability of mutation operation, Mu is the mutation probability, x _gbes,m is the optimal position vector element for the current iteration, x _p,m , x _q,m are randomly selected position vector elements, and μ is a constant.

Since the embodiments of the system part correspond to the embodiments of the method part, for the embodiments of the system part, please refer to the description of the embodiments of the method part, which will not be repeated here.

Please refer to FIG. 5 , which is a structural diagram of an abnormal data detection device provided by an embodiment of the present application.

The abnormal data detection apparatus 500 may vary greatly due to different configurations or performances, and may include one or more central processing units (CPU) 522 (eg, one or more processors) and a memory 532, a or one or more storage media 530 (eg, one or more mass storage devices) storing applications 542 or data 544. Among them, the memory 532 and the storage medium 530 may be short-term storage or persistent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instructions to operate on the apparatus. Furthermore, the central processing unit 522 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the abnormal data detection device 500 .

Anomaly data detection device 500 may also include one or more power supplies 525, one or more wired or wireless network interfaces 550, one or more input and output interfaces 558, and/or, one or more operating systems 541, such as Windows Server™ , Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and so on.

The steps in the abnormal data detection method described above in FIGS. 1 to 2 are implemented by the abnormal data detection device based on the structure shown in FIG. 5 .

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and module described above can refer to the corresponding process in the foregoing method embodiments, which is not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed apparatuses, devices and methods may be implemented in other manners. For example, the device embodiments described above are only illustrative. For example, the division of modules is only a logical function division. In actual implementation, there may be other division methods, for example, multiple modules or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or modules, and may be in electrical, mechanical or other forms.

Modules described as separate components may or may not be physically separated, and components shown as modules may or may not be physical modules, that is, they may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically alone, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules.

The integrated modules, if implemented in the form of software functional modules and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , which includes several instructions to cause a computer device (which may be a personal computer, a function invocation device, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

A method, system, device, and computer-readable storage medium for abnormal data detection provided by the present application have been described in detail above. Specific examples are used herein to illustrate the principles and implementations of the present application, and the descriptions of the above embodiments are only used to help understand the methods and core ideas of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of the present application, several improvements and modifications can also be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

It should also be noted that, in this specification, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is no such actual relationship or sequence between operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion such that a process, method, article or device comprising a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article, or device that includes the element.

Claims (10)

1. a method for abnormal data detection, characterized in that, comprising: Using krill swarm algorithm to optimize the domain parameters of DBSCAN clustering algorithm; Get data to be processed; Marking the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set; It is determined that the data in the noise data set is abnormal data. 2. method according to claim 1, is characterized in that, described utilizing krill swarm algorithm to optimize the domain parameter of DBSCAN clustering algorithm, comprising: Taking the field parameters of the DBSCAN clustering algorithm as the krill group individual position vector; Calculate the fitness value of the krill group individual according to the position vector of the krill group individual; Determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual; performing locomotion, foraging activity, and random dispersal locomotion induced by the krill colony excluding the worst krill individual and the optimal krill individual; updating the individual position vectors of each of the krill groups; judging whether the maximum number of iterations of the krill swarm algorithm is reached; If not, returning to the step of calculating the fitness value of the krill group individual according to the position vector of the krill group individual; If so, use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm. 3. The method according to claim 2, wherein calculating the fitness value of the krill group individual according to the position vector of the krill group individual comprises: According to the formula calculating the fitness value of the krill group individuals; Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x, x') is the Euclidean distance between x and x', and ε is a constant. 4. The method according to claim 2, wherein updating the individual position vectors of each of the krill groups comprises: According to the formula updating the individual position vectors of each of the krill groups; Among them, Δt is the update step size. 5. The method according to claim 4, characterized in that, according to the formula Before updating the individual position vector of each of the krill groups, it also includes: According to the formula performing a crossover operation on the individual position vector elements of each of the krill groups; According to the formula performing mutation operation on the individual position vector elements of each of the krill groups; Among them, x _i,m is the m-th group of position vector elements in the i-th krill individual, Cr is the threshold of the crossover probability, and R _i,m is the m-th group of position vector elements in the i-th krill individual for crossover operation Or the probability of mutation operation, Mu is the mutation probability, x _gbes,m is the optimal position vector element for the current iteration, x _p,m , x _q,m are randomly selected position vector elements, and μ is a constant. 6. A system for abnormal data detection, comprising: The optimization module is used to optimize the domain parameters of the DBSCAN clustering algorithm using the krill swarm algorithm; The acquisition module is used to acquire the data to be processed; a labeling module for labeling the data to be processed based on the optimized DBSCAN clustering algorithm to obtain a cluster data set and a noise data set; A determination module, configured to determine that the data in the noise data set is abnormal data. 7. The system according to claim 6, wherein the optimization module comprises: a position vector determination submodule, used for taking the field parameter of the DBSCAN clustering algorithm as the krill group individual position vector; a calculation submodule, configured to calculate the fitness value of the krill group individual according to the position vector of the krill group individual; a first determination submodule, configured to determine the worst krill individual and the optimal krill individual according to the fitness value of the krill group individual; an execution sub-module for executing movement, foraging activity and random diffusion movement induced by the krill swarm excluding the worst krill individual and the optimal krill individual; an update submodule for updating the individual position vectors of the krill groups; a judging submodule for judging whether the maximum number of iterations of the krill swarm algorithm is reached; A return sub-module is used for returning to the calculation sub-module to perform the step of calculating the fitness value of the krill group individual according to the position vector of the krill group individual when the maximum number of iterations of the krill group algorithm has not been reached ; The second determination submodule is configured to use the updated individual position vector of each krill group as the domain parameter of the optimized DBSCAN clustering algorithm when the maximum number of iterations of the krill group algorithm is reached. 8. The system according to claim 7, wherein the calculation submodule comprises: Calculation unit, used for formulas calculating the fitness value of the krill group individuals; Among them, f(x) is the krill individual fitness function, D ₁ , D ₂ ,..., D _k is the k clusters after the DBSCAN density clustering with the krill individual current position vector as the domain parameter , x and x' are the position vectors of individuals in the krill group, dist(x, x') is the Euclidean distance between x and x', and ε is a constant. 9. A device for detecting abnormal data, comprising: memory for storing computer programs; The processor is configured to implement the steps of the abnormal data detection method according to any one of claims 1 to 5 when executing the computer program. 10. A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the abnormal data according to any one of claims 1 to 5 is realized The steps of the method of detection.