CN112148577A - Data anomaly detection method and device, electronic equipment and storage medium - Google Patents
Data anomaly detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN112148577A CN112148577A CN202011074730.8A CN202011074730A CN112148577A CN 112148577 A CN112148577 A CN 112148577A CN 202011074730 A CN202011074730 A CN 202011074730A CN 112148577 A CN112148577 A CN 112148577A
- Authority
- CN
- China
- Prior art keywords
- data
- data set
- anomaly detection
- detection model
- detected
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 177
- 238000012549 training Methods 0.000 claims abstract description 148
- 230000002159 abnormal effect Effects 0.000 claims abstract description 88
- 238000000034 method Methods 0.000 claims abstract description 27
- 238000012545 processing Methods 0.000 claims abstract description 11
- 230000006870 function Effects 0.000 claims description 83
- 238000004364 calculation method Methods 0.000 claims description 14
- 238000005457 optimization Methods 0.000 claims description 13
- 230000005856 abnormality Effects 0.000 claims description 12
- 238000010606 normalization Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 5
- 239000000126 substance Substances 0.000 claims description 5
- 238000005070 sampling Methods 0.000 claims description 4
- 238000005516 engineering process Methods 0.000 abstract description 3
- 230000008569 process Effects 0.000 description 6
- 238000012423 maintenance Methods 0.000 description 5
- 238000007726 management method Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000012544 monitoring process Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- 239000011159 matrix material Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002547 anomalous effect Effects 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000013024 troubleshooting Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
Abstract
The invention relates to a data processing technology, and discloses a data anomaly detection method, which comprises the following steps: acquiring a standard training data set containing missing data and an anomaly detection model framework containing a variation lower limit function; adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function; training an anomaly detection model framework by using the standard training data set to obtain an anomaly detection model; detecting the data set to be detected by using the anomaly detection model and obtaining the reconstruction probability of the data to be detected; and if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists, determining that the target data to be detected is abnormal data. The invention also provides a data anomaly detection device, electronic equipment and a computer readable storage medium. Furthermore, the invention relates to blockchain techniques, the standard training data set being obtainable from nodes of a blockchain. The invention can improve the efficiency and accuracy of KPI anomaly detection.
Description
Technical Field
The present invention relates to artificial intelligence technologies, and in particular, to a method and an apparatus for detecting data anomalies, an electronic device, and a computer-readable storage medium.
Background
KPI (Key Performance indicator) anomaly detection is a very important part in the field of intelligent operation and maintenance. In order to ensure uninterrupted service, it is usually necessary to detect whether various KPIs (such as KPIs of an application program, KPIs of an operating system, etc.) are abnormal, so as to determine whether software or hardware of a system has a fault, and perform troubleshooting in time.
In the KPI anomaly detection method in the prior art, the robustness of an anomaly detection model after training is low, and the stability of the model is low, so that the detection result is inaccurate; meanwhile, a large number of labels are generated in the detection method in the prior art, and the detection efficiency is reduced while computer resources are occupied.
Disclosure of Invention
The invention provides a data anomaly detection method, a data anomaly detection device and a computer readable storage medium, and mainly aims to improve the efficiency and accuracy of KPI anomaly detection.
In order to achieve the above object, the present invention provides a data anomaly detection method, including:
acquiring a standard training data set, wherein the standard training data set comprises abnormal detection data and missing data;
acquiring a pre-constructed anomaly detection model frame, wherein the anomaly detection model frame comprises a variation lower limit function;
adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function;
training the abnormal detection model framework containing the optimized variation lower limit function by using the standard training data set to obtain an abnormal detection model;
acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected;
and if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists, determining that the target data to be detected is abnormal data.
Optionally, the acquiring a standard training data set includes:
acquiring an original training data set;
setting data with a preset proportion in the original training data set as missing data;
normalizing the original training data set comprising the missing data through a preset normalization formula to obtain a normalized data set;
and inputting the normalized data set into a preset sliding window to obtain the standard training data set.
Optionally, the adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function includes:
calculating an optimized value based on the missing data;
and adding the optimized value to the variation lower limit function to obtain the optimized variation lower limit function.
Optionally, the optimization variation lower limit function is:
wherein W is the number of data in the standard training data set, xwFor the w-th data in the standard training data set, the awIs the missing coefficient of the w-th data when xwIn case of missing data, awWhen x is 1wWhen not missing data, aw0, beta is an optimum number, and is present
The z represents a hidden variable z in the standard training dataset.
Wherein the content of the first and second substances,
indicating the calculation expectation of the distribution of the hidden variable z corresponding to x, logpθ(xz) denotes taking the logarithm of p (xz; theta), pθ(x | z) means that the hidden variable z is restored to x, corresponding to the decoder, pθ(z) represents the distribution of the latent variable z under the standard training data set, logpθ(z) represents a group represented by the formulaθ(z) logarithmic, logqφ(z | x) represents the sum of qφ(z | x) is logarithmic, qφ(z | x) means that the distribution of the variable z is hidden under the sample x, corresponding to the encoder part.
Optionally, the training the anomaly detection model framework including the optimized variation lower limit function by using the standard training data set to obtain an anomaly detection model, including:
step A: inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result;
and B: calculating the loss value of the optimization variation lower limit function according to the output result;
and C: and if the loss value is greater than a preset loss threshold value, adjusting parameters in the abnormal detection model frame, returning to the step A, and stopping adjusting the parameters in the abnormal detection model frame until the loss value is less than or equal to the loss threshold value to obtain the abnormal detection model.
Optionally, the inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result includes:
calculating hidden variable distribution parameters of the data in the standard training data set by utilizing an encoder in the anomaly detection model framework;
sampling the hidden variable distribution parameters to obtain hidden variables;
and calculating by utilizing a decoder in an anomaly detection model framework and the hidden variable to obtain the output result.
Optionally, before the detecting the data set to be detected by using the anomaly detection model, the method further includes:
judging whether a missing value exists in the data set to be detected or not;
and if the missing value exists in the data set to be detected, filling the missing value existing in the data set to be detected by a Monte Carlo interpolation method.
In order to solve the above problem, the present invention also provides a data abnormality detection apparatus, including:
the data processing module is used for acquiring a standard training data set, and the standard training data set comprises abnormal detection data and missing data;
the model acquisition module is used for acquiring a pre-constructed anomaly detection model frame, and the anomaly detection model frame comprises a variation lower limit function;
the function adjusting module is used for adjusting the variation lower limit function by utilizing the missing data to obtain an optimized variation lower limit function;
the model training module is used for training the abnormal detection model framework containing the optimization variational lower limit function by using the standard training data set to obtain an abnormal detection model;
the reconstruction probability acquisition module is used for acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected;
and the anomaly detection module is used for determining the target data to be detected as the abnormal data if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists.
In order to solve the above problem, the present invention also provides an electronic device, including:
a memory storing at least one instruction; and
and the processor executes the instructions stored in the memory to realize the data anomaly detection method.
In order to solve the above problem, the present invention further provides a computer-readable storage medium, in which at least one instruction is stored, and the at least one instruction is executed by a processor in an electronic device to implement the data anomaly detection method described above.
According to the embodiment of the invention, the variation lower limit function in the abnormal detection model frame is adjusted according to the missing data in the standard training data set, the variation lower limit function can be optimized, and then the optimized variation lower limit function is used for training the model, so that the abnormal detection model with higher robustness can be obtained, the stability of the abnormal detection model is favorably improved, the problem of inaccurate detection is avoided, and the accuracy rate of KPI abnormal detection is favorably improved; meanwhile, according to the embodiment of the invention, the detection is carried out according to the abnormal detection model obtained by optimizing the variation lower limit function, and no label is generated in the process, so that the dependency on the label is reduced, the occupation of excessive computer resources is avoided, and the detection efficiency is improved. Therefore, the data anomaly detection method provided by the invention can improve the KPI anomaly detection efficiency and accuracy.
Drawings
Fig. 1 is a schematic flow chart of a data anomaly detection method according to an embodiment of the present invention;
FIG. 2 is a functional block diagram of a data anomaly detection apparatus according to an embodiment of the present invention;
fig. 3 is a schematic structural diagram of an electronic device for implementing the data anomaly detection method according to an embodiment of the present invention.
The implementation, functional features and advantages of the objects of the present invention will be further explained with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The execution subject of the data anomaly detection method provided by the embodiment of the present application includes, but is not limited to, at least one of electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiment of the present application. In other words, the data anomaly detection method may be performed by software or hardware installed in the terminal device or the server device, and the software may be a block chain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like.
Fig. 1 is a schematic flow chart of a data anomaly detection method according to an embodiment of the present invention. In this embodiment, the data anomaly detection method includes:
and S1, acquiring a standard training data set, wherein the standard training data set comprises abnormal detection data and missing data.
In the embodiment of the present invention, the standard training data set may include values of various KPIs (Key Performance Indicators).
The KPIs refer to monitoring indicators (such as delay, throughput, and the like) of operation and maintenance objects such as services and systems, and specifically, the standard training data set includes a numerical sequence formed by arranging the same or different KPIs according to a monitored time sequence.
In the embodiment of the present invention, the missing data is data with a numerical value of 0, and the abnormality detection data is KPI abnormality data.
For example, the standard training data set has CPU utilization collected at different times, where the CPU utilization at a part of time is 0 or the CPU utilization at a part of time is abnormal; or the standard training data set has hardware resource consumption collected at different time, wherein the hardware resource consumption at partial time is 0 or the hardware resource consumption at partial time is abnormal; or the number of online users is collected at different times in the standard training data set, wherein the number of online users in partial time is 0 or the number of online users in partial time is abnormal; or the number of the concurrent users is acquired in different time in the standard training data set, wherein the number of the concurrent users in partial time is 0 or the number of the concurrent users in partial time is abnormal.
Preferably, the standard training data set may be stored in a blockchain, and in implementation, the standard training data set is directly obtained from a node of the blockchain.
Through storing the standard training data set in the block chain, the privacy and the safety of KPI data can be improved.
Further, in an optional embodiment of the present invention, the acquiring the standard training data set includes:
acquiring an original training data set;
setting data with a preset proportion in the original training data set as missing data;
normalizing the original training data set comprising the missing data through a preset normalization formula to obtain a normalized data set;
and inputting the normalized data set into a preset sliding window to obtain the standard training data set.
In detail, the embodiment of the present invention performs normalization processing on the original training data set by using the following formula:
wherein n is the number of data in the original training data set, xiFor the ith data, y in the original training data setiFor the ith data in the normalized data set, and the yi∈[0,1]。
In the embodiment of the invention, the normal data (namely the KPI data which is not 0) of the lambda ratio is randomly set to be 0 and is regarded as missing data, so that the effect of model training is enhanced.
In the embodiment of the invention, the original training data set is time sequence data, and the normalized data set is input into the sliding window, so that the sequence of the original training data set can be ensured, and the availability and consistency of data are improved.
Specifically, if the size of the sliding window is W, the number of data in the standard training data set is W, that is, the data in the standard training data set is: x is the number ofW,…,x1。
In the embodiment of the invention, the original training data set is normalized, data in a standard training data set can be standardized, and the time sequence of the data in the standard training data set is ensured by using the sliding window.
S2, obtaining a pre-constructed abnormity detection model frame, wherein the abnormity detection model frame comprises a variation lower limit function.
In the embodiment of the present invention, the pre-constructed anomaly detection model framework may be a VAE (variant auto-encoders) anomaly detection model framework.
Specifically, the VAE includes an encoder, a decoder, and a variation lower-limit function, the encoder calculates the hidden variable distribution parameters (mean and variance) in the standard training data set, and samples to obtain hidden variables, the decoder recovers the hidden variables to obtain output results, the output results and the variation lower-limit function are used to calculate the reconstruction probability of the input KPI data, and whether the KPI data is abnormal or not is determined according to the reconstruction probability.
And S3, adjusting the variation lower limit function by utilizing the missing data to obtain an optimized variation lower limit function.
Specifically, the adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function includes:
calculating an optimized value based on the missing data;
and adding the optimized value to the variation lower limit function to obtain the optimized variation lower limit function.
Further, an optimized value may be calculated based on the missing data by:
an optimized value beta is calculated according to the missing coefficient obtained from the missing data, specifically,
wherein, the xwThe w-th data in the standard training data set.
Further, the optimization variation lower limit function is:
wherein W is the number of data in the standard training data set, xwFor the w-th data in the standard training data set, the awIs the missing coefficient of the w-th data when xwIn case of missing data, awWhen x is 1wWhen not missing data, aw0, beta is an optimum number, and is present
The z represents a hidden variable z in the standard training dataset.
Wherein the content of the first and second substances,
indicating the calculation expectation of the distribution of the hidden variable z corresponding to x, logpθ(xz) denotes taking the logarithm of p (xz; theta), pθ(x | z) means that the hidden variable z is restored to x, corresponding to the decoder, pθ(z) represents the distribution of the latent variable z under the standard training data set, logpθ(z) represents a group represented by the formulaθ(z) logarithmic, logqφ(z | x) represents the sum of qφ(z | x) is logarithmic, qφ(z | x) means that the distribution of the variable z is hidden under the sample x, corresponding to the encoder part.
Further, in the embodiment of the present invention, the optimization variational lower limit function is adjusted according to the missing data, so that the abnormal detection model frame can be trained by using the missing data, and the stability of the abnormal detection model frame on abnormal data is enhanced, thereby improving the robustness of the model.
And S4, training the abnormal detection model frame containing the optimization variation lower limit function by using the standard training data set to obtain an abnormal detection model.
Preferably, the S4 includes:
step A: inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result;
and B: calculating the loss value of the optimization variation lower limit function according to the output result;
and C: and if the loss value is greater than a preset loss threshold value, adjusting parameters in the abnormal detection model frame, returning to the step A, and stopping adjusting the parameters in the abnormal detection model frame until the loss value is less than or equal to the loss threshold value to obtain the abnormal detection model.
Further, the inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result includes:
calculating hidden variable distribution parameters of the data in the standard training data set by utilizing an encoder in the anomaly detection model framework;
sampling the hidden variable distribution parameters to obtain hidden variables;
and calculating by utilizing a decoder in an anomaly detection model framework and the hidden variable to obtain the output result.
Specifically, the hidden variable distribution parameter is a hidden variable of all data in the standard training data set.
In the embodiment of the invention, the hidden variable is calculated by using the following formula:
z is the hidden variable, and z is the hidden variable,
μ (X), Σ (X) is the mean and variance in the hidden variable distribution parameters, μ (X) is the mean of the standard training data set.
In the embodiment of the invention, the output result is obtained by calculating by using the following formula:
p(x)＝∫p(x,z|θ)＝∫p(x|z；θ)p(z)dz
wherein p (x) is the output result, Z is a point in the implicit variable space Z, p (Z) is the probability of obtaining the implicit variable Z, θ is a point in the parameter space Θ, and the range of the parameter space is a preset range.
p(x|z；θ)＝N(x|f(z；θ),σ2*I)
Wherein, I represents an identity matrix, and sigma is a hyper-parameter. f is a function that maps z, θ to X, i.e., f: X θ → X.
In the embodiment of the invention, the missing data is randomly selected before each training, so that the standard training data set can be repeatedly used for training the abnormal detection model framework, and the data utilization rate is improved.
S5, acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected.
In the embodiment of the present invention, when the anomaly detection model is specifically used to detect the data set to be detected, for each data to be detected in the data set to be detected, a decoder in the anomaly detection model outputs a mean value and a variance parameter. An encoder in the anomaly detection model calculates an average probability which is close to data to be detected and generated from the implicit variable distribution z by using the mean and variance parameters output by a decoder, wherein the average probability is used as an anomaly score and is called a reconstruction probability, and the reconstruction probability is used for evaluating the possibility of the data to be detected that is abnormal.
Preferably, in an embodiment of the present invention, before the detecting the data set to be detected by using the anomaly detection model, the method further includes:
judging whether a missing value exists in the data set to be detected or not;
and if the missing value exists in the data set to be detected, filling the missing value existing in the data set to be detected by a Monte Carlo interpolation method.
Specifically, the monte carlo interpolation method can be obtained from the prior art, and is not described herein again. In the embodiment of the invention, the missing values in the data set to be detected can cause deviation in the encoding process of the encoder in the anomaly detection model, so that the result of data anomaly detection is influenced.
And S6, if the target data to be detected with the reconstruction probability larger than or equal to the reconstruction threshold exists, determining that the target data to be detected is abnormal data.
Specifically, the reconstruction threshold is preset.
In the embodiment of the invention, the data with high reconstruction probability is determined as abnormal data.
Optionally, in the embodiment of the present invention, when it is determined that there is abnormal data in the data set to be detected, a warning message prompt is sent, where the warning message prompt includes an operation time corresponding to the abnormal data point. The operation time corresponding to the abnormal data point is contained in the warning message prompt, so that the operation and maintenance efficiency is improved.
In the embodiment of the invention, the data to be detected with the reconstruction probability smaller than the reconstruction threshold value is determined to be normal data.
Optionally, in the embodiment of the present invention, when it is determined that there is no abnormal data in the data set to be detected, the monitoring is continued, and the current abnormal detection result and the current detection time are recorded.
According to the embodiment of the invention, the variation lower limit function in the abnormal detection model frame is adjusted according to the missing data in the standard training data set, the variation lower limit function can be optimized, and then the optimized variation lower limit function is used for training the model, so that the abnormal detection model with higher robustness can be obtained, the stability of the abnormal detection model is favorably improved, the problem of inaccurate detection is avoided, and the accuracy rate of KPI abnormal detection is favorably improved; meanwhile, according to the embodiment of the invention, the detection is carried out according to the abnormal detection model obtained by optimizing the variation lower limit function, and no label is generated in the process, so that the dependency on the label is reduced, the occupation of excessive computer resources is avoided, and the detection efficiency is improved. Therefore, the data anomaly detection method provided by the invention can improve the KPI anomaly detection efficiency and accuracy.
Fig. 2 is a functional block diagram of a data anomaly detection apparatus according to an embodiment of the present invention.
The data abnormality detection apparatus 100 according to the present invention may be installed in an electronic device. According to the implemented functions, the data anomaly detection apparatus 100 may include a data processing module 101, a model obtaining module 102, a function adjusting module 103, a model training module 104, a reconstruction probability obtaining module 105, and an anomaly detection module 106. The module of the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.
In the present embodiment, the functions regarding the respective modules/units are as follows:
the data processing module 101 is configured to obtain a standard training data set, where the standard training data set includes anomaly detection data and missing data.
In the embodiment of the present invention, the standard training data set may include values of various KPIs (Key Performance Indicators).
The KPIs refer to monitoring indicators (such as delay, throughput, and the like) of operation and maintenance objects such as services and systems, and specifically, the standard training data set includes a numerical sequence formed by arranging the same or different KPIs according to a monitored time sequence.
In the embodiment of the present invention, the missing data is data with a numerical value of 0, and the abnormality detection data is KPI abnormality data.
For example, the standard training data set has CPU utilization collected at different times, where the CPU utilization at a part of time is 0 or the CPU utilization at a part of time is abnormal; or the standard training data set has hardware resource consumption collected at different time, wherein the hardware resource consumption at partial time is 0 or the hardware resource consumption at partial time is abnormal; or the number of online users is collected at different times in the standard training data set, wherein the number of online users in partial time is 0 or the number of online users in partial time is abnormal; or the number of the concurrent users is acquired in different time in the standard training data set, wherein the number of the concurrent users in partial time is 0 or the number of the concurrent users in partial time is abnormal.
Preferably, the standard training data set may be stored in a blockchain, and in implementation, the standard training data set is directly obtained from a node of the blockchain.
Through storing the standard training data set in the block chain, the privacy and the safety of KPI data can be improved.
Further, the data processing module 101 is specifically configured to:
acquiring an original training data set;
setting data with a preset proportion in the original training data set as missing data;
normalizing the original training data set comprising the missing data through a preset normalization formula to obtain a normalized data set;
and inputting the normalized data set into a preset sliding window to obtain the standard training data set.
In detail, the embodiment of the present invention performs normalization processing on the original training data set by using the following formula:
wherein n is the number of data in the original training data set, xiFor the ith data, y in the original training data setiFor the ith data in the normalized data set, and the yi∈[0,1]。
In the embodiment of the invention, the normal data (namely the KPI data which is not 0) of the lambda ratio is randomly set to be 0 and is regarded as missing data, so that the effect of model training is enhanced.
In the embodiment of the invention, the original training data set is time sequence data, and the normalized data set is input into the sliding window, so that the sequence of the original training data set can be ensured, and the availability and consistency of data are improved.
Specifically, if the size of the sliding window is W, the number of data in the standard training data set is W, that is, the data in the standard training data set is: x is the number ofW,…,x1。
In the embodiment of the invention, the original training data set is normalized, data in a standard training data set can be standardized, and the time sequence of the data in the standard training data set is ensured by using the sliding window.
The model obtaining module 102 is configured to obtain a pre-constructed anomaly detection model framework, where the anomaly detection model framework includes a variation lower limit function.
In the embodiment of the present invention, the pre-constructed anomaly detection model framework may be a VAE (variant auto-encoders) anomaly detection model framework.
Specifically, the VAE includes an encoder, a decoder, and a variation lower-limit function, the encoder calculates the hidden variable distribution parameters (mean and variance) in the standard training data set, and samples to obtain hidden variables, the decoder recovers the hidden variables to obtain output results, the output results and the variation lower-limit function are used to calculate the reconstruction probability of the input KPI data, and whether the KPI data is abnormal or not is determined according to the reconstruction probability.
The function adjusting module 103 is configured to adjust the variation lower limit function by using the missing data to obtain an optimized variation lower limit function.
Specifically, the function adjusting module 103 is specifically configured to:
calculating an optimized value based on the missing data;
and adding the optimized value to the variation lower limit function to obtain the optimized variation lower limit function.
Further, an optimized value may be calculated based on the missing data by:
an optimized value beta is calculated according to the missing coefficient obtained from the missing data, specifically,
wherein, the xwThe w-th data in the standard training data set.
Further, the optimization variation lower limit function is:
wherein W is the number of data in the standard training data set, xwFor the w-th data in the standard training data set, the awIs the missing coefficient of the w-th data when xwIn case of missing data, awWhen x is 1wWhen not missing data, aw0, beta is an optimum number, and is present
The z represents a hidden variable z in the standard training dataset.
Wherein the content of the first and second substances,
indicating the calculation expectation of the distribution of the hidden variable z corresponding to x, logpθ(xz) denotes taking the logarithm of p (xz; theta), pθ(x | z) means that the hidden variable z is restored to x, corresponding to the decoder, pθ(z) represents the distribution of the latent variable z under the standard training data set, logpθ(z) represents a group represented by the formulaθ(z) logarithmic, logqφ(z | x) represents the sum of qφ(z | x) is logarithmic, qφ(z | x) means that the distribution of the variable z is hidden under the sample x, corresponding to the encoder part.
Further, in the embodiment of the present invention, the optimization variational lower limit function is adjusted according to the missing data, so that the abnormal detection model frame can be trained by using the missing data, and the stability of the abnormal detection model frame on abnormal data is enhanced, thereby improving the robustness of the model.
The model training module 104 is configured to train the anomaly detection model framework including the optimized variation lower limit function by using the standard training data set to obtain an anomaly detection model.
Preferably, the model training module 104 comprises:
the first calculation unit is used for inputting the standard training data set into the abnormal detection model framework for calculation to obtain an output result;
the second calculation unit is used for calculating the loss value of the optimization variation lower limit function according to the output result;
and the model acquisition adjusting unit is used for adjusting parameters in the abnormal detection model frame if the loss value is greater than a preset loss threshold value, starting the first calculating unit to input the standard training data set into the abnormal detection model frame for calculation to obtain an output result, and stopping adjusting the parameters in the abnormal detection model frame until the loss value is less than or equal to the loss threshold value to obtain the abnormal detection model.
Further, the first computing unit is specifically configured to:
calculating hidden variable distribution parameters of the data in the standard training data set by utilizing an encoder in the anomaly detection model framework;
sampling the hidden variable distribution parameters to obtain hidden variables;
and calculating by utilizing a decoder in an anomaly detection model framework and the hidden variable to obtain the output result.
Specifically, the hidden variable distribution parameter is a hidden variable of all data in the standard training data set.
In the embodiment of the invention, the hidden variable is calculated by using the following formula:
z is the hidden variable, and z is the hidden variable,
μ (X), Σ (X) is the mean and variance in the hidden variable distribution parameters, μ (X) is the mean of the standard training data set.
In the embodiment of the invention, the output result is obtained by calculating by using the following formula:
p(x)＝∫p(x,z|θ)＝∫p(x|z；θ)p(z)dz
wherein p (x) is the output result, Z is a point in the implicit variable space Z, p (Z) is the probability of obtaining the implicit variable Z, θ is a point in the parameter space Θ, and the range of the parameter space is a preset range.
p(x|z；θ)＝N(x|f(z；θ),σ2*I)
Wherein, I represents an identity matrix, and sigma is a hyper-parameter. f is a function that maps z, θ to X, i.e., f: X θ → X.
In the embodiment of the invention, the missing data is randomly selected before each training, so that the standard training data set can be repeatedly used for training the abnormal detection model framework, and the data utilization rate is improved.
The reconstruction probability obtaining module 105 is configured to obtain a data set to be detected, and detect the data set to be detected by using the anomaly detection model to obtain a reconstruction probability of data to be detected in the data set to be detected.
In the embodiment of the present invention, when the anomaly detection model is specifically used to detect the data set to be detected, for each data to be detected in the data set to be detected, a decoder in the anomaly detection model outputs a mean value and a variance parameter. An encoder in the anomaly detection model calculates an average probability which is close to data to be detected and generated from the implicit variable distribution z by using the mean and variance parameters output by a decoder, wherein the average probability is used as an anomaly score and is called a reconstruction probability, and the reconstruction probability is used for evaluating the possibility of the data to be detected that is abnormal.
Preferably, in an embodiment of the present invention, the apparatus further includes a determining module, where the determining module is configured to:
before the abnormal detection model is used for detecting the data set to be detected, judging whether a missing value exists in the data set to be detected or not;
and if the missing value exists in the data set to be detected, filling the missing value existing in the data set to be detected by a Monte Carlo interpolation method.
Specifically, the monte carlo interpolation method can be obtained from the prior art, and is not described herein again.
In the embodiment of the invention, the missing values in the data set to be detected can cause deviation in the coding process of the coder in the anomaly detection model, so that the result of data anomaly detection is influenced.
The anomaly detection module 106 is configured to determine that the target data to be detected is anomalous data if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists.
Specifically, the reconstruction threshold is preset.
In the embodiment of the invention, the data with high reconstruction probability is determined as abnormal data.
Optionally, in the embodiment of the present invention, when it is determined that there is abnormal data in the data set to be detected, a warning message prompt is sent, where the warning message prompt includes an operation time corresponding to the abnormal data point. The operation time corresponding to the abnormal data point is contained in the warning message prompt, so that the operation and maintenance efficiency is improved.
In the embodiment of the invention, the data to be detected with the reconstruction probability smaller than the reconstruction threshold value is determined to be normal data.
Optionally, in the embodiment of the present invention, when it is determined that there is no abnormal data in the data set to be detected, the monitoring is continued, and the current abnormal detection result and the current detection time are recorded.
According to the embodiment of the invention, the variation lower limit function in the abnormal detection model frame is adjusted according to the missing data in the standard training data set, so that the variation lower limit function can be optimized, and then the optimized variation lower limit function is used for training the model, so that an abnormal detection model with higher robustness can be obtained, the stability of the abnormal detection model is favorably improved, the problem of inaccurate detection is avoided, and the accuracy rate of KPI abnormal detection is favorably improved; meanwhile, according to the embodiment of the invention, the detection is carried out according to the abnormal detection model obtained by optimizing the variation lower limit function, and no label is generated in the process, so that the dependency on the label is reduced, the occupation of excessive computer resources is avoided, and the detection efficiency is improved. Therefore, the data anomaly detection device provided by the invention can improve the efficiency and accuracy of KPI anomaly detection.
Fig. 3 is a schematic structural diagram of an electronic device implementing a data anomaly detection method according to an embodiment of the present invention.
The electronic device 1 may include a processor 10, a memory 11 and a bus, and may further include a computer program, such as a data anomaly detection program 12, stored in the memory 11 and operable on the processor 10.
The memory 11 includes at least one type of readable storage medium, which includes flash memory, removable hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. The memory 11 may in some embodiments be an internal storage unit of the electronic device 1, such as a removable hard disk of the electronic device 1. The memory 11 may also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device 1. Further, the memory 11 may also include both an internal storage unit and an external storage device of the electronic device 1. The memory 11 may be used not only to store application software installed in the electronic device 1 and various types of data, such as codes of the data abnormality detection program 12, but also to temporarily store data that has been output or is to be output.
The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or may be composed of a plurality of integrated circuits packaged with the same or different functions, including one or more Central Processing Units (CPUs), microprocessors, digital Processing chips, graphics processors, and combinations of various control chips. The processor 10 is a Control Unit (Control Unit) of the electronic device, connects various components of the electronic device by using various interfaces and lines, and executes various functions and processes data of the electronic device 1 by running or executing programs or modules (e.g., data abnormality detection programs, etc.) stored in the memory 11 and calling data stored in the memory 11.
The bus may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is arranged to enable connection communication between the memory 11 and at least one processor 10 or the like.
Fig. 3 shows only an electronic device with components, and it will be understood by those skilled in the art that the structure shown in fig. 3 does not constitute a limitation of the electronic device 1, and may comprise fewer or more components than those shown, or some components may be combined, or a different arrangement of components.
For example, although not shown, the electronic device 1 may further include a power supply (such as a battery) for supplying power to each component, and preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so as to implement functions of charge management, discharge management, power consumption management, and the like through the power management device. The power supply may also include any component of one or more dc or ac power sources, recharging devices, power failure detection circuitry, power converters or inverters, power status indicators, and the like. The electronic device 1 may further include various sensors, a bluetooth module, a Wi-Fi module, and the like, which are not described herein again.
Further, the electronic device 1 may further include a network interface, and optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a bluetooth interface, etc.), which are generally used for establishing a communication connection between the electronic device 1 and other electronic devices.
Optionally, the electronic device 1 may further comprise a user interface, which may be a Display (Display), an input unit (such as a Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, or the like. The display, which may also be referred to as a display screen or display unit, is suitable for displaying information processed in the electronic device 1 and for displaying a visualized user interface, among other things.
It is to be understood that the described embodiments are for purposes of illustration only and that the scope of the appended claims is not limited to such structures.
The data anomaly detection program 12 stored in the memory 11 of the electronic device 1 is a combination of instructions that, when executed in the processor 10, can implement:
acquiring a standard training data set, wherein the standard training data set comprises abnormal detection data and missing data;
acquiring a pre-constructed anomaly detection model frame, wherein the anomaly detection model frame comprises a variation lower limit function;
adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function;
training the abnormal detection model framework containing the optimized variation lower limit function by using the standard training data set to obtain an abnormal detection model;
acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected;
and if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists, determining that the target data to be detected is abnormal data.
Specifically, the specific implementation method of the processor 10 for the instruction may refer to the description of the relevant steps in the embodiment corresponding to fig. 1, which is not described herein again.
Further, the integrated modules/units of the electronic device 1, if implemented in the form of software functional units and sold or used as separate products, may be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying said computer program code, recording medium, U-disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM).
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus, device and method can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.
The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof.
The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned.
The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the system claims may also be implemented by one unit or means in software or hardware. The terms second, etc. are used to denote names, but not any particular order.
Finally, it should be noted that the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions may be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims (10)
1. A method for detecting data anomalies, the method comprising:
acquiring a standard training data set, wherein the standard training data set comprises abnormal detection data and missing data;
acquiring a pre-constructed anomaly detection model frame, wherein the anomaly detection model frame comprises a variation lower limit function;
adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function;
training the abnormal detection model framework containing the optimized variation lower limit function by using the standard training data set to obtain an abnormal detection model;
acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected;
and if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists, determining that the target data to be detected is abnormal data.
2. The data anomaly detection method as claimed in claim 1, wherein said obtaining a standard training data set comprises:
acquiring an original training data set;
setting data with a preset proportion in the original training data set as missing data;
normalizing the original training data set comprising the missing data through a preset normalization formula to obtain a normalized data set;
and inputting the normalized data set into a preset sliding window to obtain the standard training data set.
3. The method for detecting data abnormality according to claim 1, wherein the adjusting the variation lower limit function by using the missing data to obtain an optimized variation lower limit function includes:
calculating an optimized value based on the missing data;
and adding the optimized value to the variation lower limit function to obtain the optimized variation lower limit function.
4. The data anomaly detection method according to any one of claims 1 to 3, characterized in that said optimization variational lower limit function is:
wherein W is the number of data in the standard training data set, xwFor the w-th data in the standard training data set, the awIs the missing coefficient of the w-th data when xwIn case of missing data, awWhen x is 1wWhen not missing data, aw0, beta is an optimum number, and is present
The z represents a hidden variable z in the standard training dataset.
Wherein the content of the first and second substances,
indicating the calculation expectation of the distribution of the hidden variable z corresponding to x, logpθ(xz) denotes taking the logarithm of p (xz; theta), pθ(x | z) means that the hidden variable z is restored to x, corresponding to the decoder, pθ(z) represents the distribution of the latent variable z under the standard training data set, logpθ(z) represents a group represented by the formulaθ(z) logarithmic, logqφ(z | x) represents the sum of qφ(z | x) is logarithmic, qφ(z | x) means that the distribution of the variable z is hidden under the sample x, corresponding to the encoder part.
5. The method according to claim 1, wherein the training the anomaly detection model framework including the optimized variation lower limit function using the standard training data set to obtain an anomaly detection model comprises:
step A: inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result;
and B: calculating the loss value of the optimization variation lower limit function according to the output result;
and C: and if the loss value is greater than a preset loss threshold value, adjusting parameters in the abnormal detection model frame, returning to the step A, and stopping adjusting the parameters in the abnormal detection model frame until the loss value is less than or equal to the loss threshold value to obtain the abnormal detection model.
6. The method of claim 5, wherein the inputting the standard training data set into the anomaly detection model framework for calculation to obtain an output result comprises:
calculating hidden variable distribution parameters of the data in the standard training data set by utilizing an encoder in the anomaly detection model framework;
sampling the hidden variable distribution parameters to obtain hidden variables;
and calculating by utilizing a decoder in an anomaly detection model framework and the hidden variable to obtain the output result.
7. The method for detecting data abnormality according to claim 1, wherein before the detecting the data set to be detected by using the abnormality detection model, the method further comprises:
judging whether a missing value exists in the data set to be detected or not;
and if the missing value exists in the data set to be detected, filling the missing value existing in the data set to be detected by a Monte Carlo interpolation method.
8. An apparatus for detecting data abnormality, the apparatus comprising:
the data processing module is used for acquiring a standard training data set, and the standard training data set comprises abnormal detection data and missing data;
the model acquisition module is used for acquiring a pre-constructed anomaly detection model frame, and the anomaly detection model frame comprises a variation lower limit function;
the function adjusting module is used for adjusting the variation lower limit function by utilizing the missing data to obtain an optimized variation lower limit function;
the model training module is used for training the abnormal detection model framework containing the optimization variational lower limit function by using the standard training data set to obtain an abnormal detection model;
the reconstruction probability acquisition module is used for acquiring a data set to be detected, and detecting the data set to be detected by using the anomaly detection model to obtain the reconstruction probability of the data to be detected in the data set to be detected;
and the anomaly detection module is used for determining the target data to be detected as the abnormal data if the target data to be detected with the reconstruction probability greater than or equal to the reconstruction threshold exists.
9. An electronic device, characterized in that the electronic device comprises:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform a data anomaly detection method as claimed in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements a data anomaly detection method according to any one of claims 1 to 7.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011074730.8A CN112148577B (en) | 2020-10-09 | 2020-10-09 | Data anomaly detection method and device, electronic equipment and storage medium |
| PCT/CN2020/131984 WO2021189904A1 (en) | 2020-10-09 | 2020-11-27 | Data anomaly detection method and apparatus, and electronic device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011074730.8A CN112148577B (en) | 2020-10-09 | 2020-10-09 | Data anomaly detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112148577A true CN112148577A (en) | 2020-12-29 |
| CN112148577B CN112148577B (en) | 2024-05-07 |
Family
ID=73952717
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011074730.8A Active CN112148577B (en) | 2020-10-09 | 2020-10-09 | Data anomaly detection method and device, electronic equipment and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN112148577B (en) |
| WO (1) | WO2021189904A1 (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112463646A (en) * | 2021-01-25 | 2021-03-09 | 北京工业大数据创新中心有限公司 | Sensor abnormity detection method and device |
| CN113114529A (en) * | 2021-03-25 | 2021-07-13 | 清华大学 | KPI (Key Performance indicator) abnormity detection method and device based on condition variation automatic encoder |
| CN113204569A (en) * | 2021-03-30 | 2021-08-03 | 联想(北京)有限公司 | Information processing method and device |
| CN113592019A (en) * | 2021-08-10 | 2021-11-02 | 平安银行股份有限公司 | Fault detection method, device, equipment and medium based on multi-model fusion |
| CN113705684A (en) * | 2021-08-30 | 2021-11-26 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic device and medium |
| CN114190897A (en) * | 2021-12-15 | 2022-03-18 | 中国科学院空天信息创新研究院 | Training method of sleep staging model, sleep staging method and device |
| CN114722061A (en) * | 2022-04-08 | 2022-07-08 | 中国电信股份有限公司 | Data processing method and device, equipment and computer readable storage medium |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11909482B2 (en) * | 2020-08-18 | 2024-02-20 | Qualcomm Incorporated | Federated learning for client-specific neural network parameter generation for wireless communication |
| CN113971513A (en) * | 2021-10-22 | 2022-01-25 | 河南鑫安利安全科技股份有限公司 | Data storage and optimization method of enterprise security risk management platform |
| CN114493291B (en) * | 2022-01-28 | 2022-11-01 | 中铁北京工程局集团有限公司 | Intelligent detection method and system for high fill quality |
| CN115034286A (en) * | 2022-04-24 | 2022-09-09 | 国家计算机网络与信息安全管理中心 | Abnormal user identification method and device based on adaptive loss function |
| CN114881157A (en) * | 2022-05-17 | 2022-08-09 | 中国南方电网有限责任公司超高压输电公司广州局 | Method, device and equipment for detecting working state of converter valve and storage medium |
| CN114880384B (en) * | 2022-07-11 | 2022-09-23 | 杭州宇谷科技有限公司 | Unsupervised two-wheeled electric vehicle charging time sequence abnormity detection method and system |
| CN116049157B (en) * | 2023-01-04 | 2024-05-07 | 北京京航计算通讯研究所 | Quality data analysis method and system |
| CN116956637B (en) * | 2023-09-06 | 2024-03-05 | 湖南光华防务科技集团有限公司 | Method for detecting robustness of coverage surface of fire extinguishing bomb |
| CN117041018B (en) * | 2023-10-09 | 2024-01-02 | 中电科大数据研究院有限公司 | Remote intelligent operation and maintenance management method for data center and related equipment |
| CN117849700A (en) * | 2024-03-07 | 2024-04-09 | 南京国网电瑞电力科技有限责任公司 | Modular electric energy metering system capable of controlling measurement |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| CN110581834A (en) * | 2018-06-11 | 2019-12-17 | 中国移动通信集团浙江有限公司 | communication capability opening abnormity detection method and device |
| CN110851338A (en) * | 2019-09-23 | 2020-02-28 | 平安科技（深圳）有限公司 | Abnormality detection method, electronic device, and storage medium |
| US20200387782A1 (en) * | 2019-06-07 | 2020-12-10 | Tata Consultancy Services Limited | Sparsity constraints and knowledge distillation based learning of sparser and compressed neural networks |
| CN115903741A (en) * | 2022-11-18 | 2023-04-04 | 南京信息工程大学 | Data anomaly detection method for industrial control system |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10999247B2 (en) * | 2017-10-24 | 2021-05-04 | Nec Corporation | Density estimation network for unsupervised anomaly detection |
| CN111562996B (en) * | 2020-04-11 | 2021-11-23 | 北京交通大学 | Method and system for detecting time sequence abnormality of key performance index data |
| CN111652278B (en) * | 2020-04-30 | 2024-04-30 | 中国平安财产保险股份有限公司 | User behavior detection method, device, electronic equipment and medium |
| CN111598881B (en) * | 2020-05-19 | 2022-07-12 | 西安电子科技大学 | Image anomaly detection method based on variational self-encoder |
-
2020
- 2020-10-09 CN CN202011074730.8A patent/CN112148577B/en active Active
- 2020-11-27 WO PCT/CN2020/131984 patent/WO2021189904A1/en active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110581834A (en) * | 2018-06-11 | 2019-12-17 | 中国移动通信集团浙江有限公司 | communication capability opening abnormity detection method and device |
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| US20200387782A1 (en) * | 2019-06-07 | 2020-12-10 | Tata Consultancy Services Limited | Sparsity constraints and knowledge distillation based learning of sparser and compressed neural networks |
| CN110851338A (en) * | 2019-09-23 | 2020-02-28 | 平安科技（深圳）有限公司 | Abnormality detection method, electronic device, and storage medium |
| CN115903741A (en) * | 2022-11-18 | 2023-04-04 | 南京信息工程大学 | Data anomaly detection method for industrial control system |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112463646B (en) * | 2021-01-25 | 2021-05-11 | 北京工业大数据创新中心有限公司 | Sensor abnormity detection method and device |
| CN112463646A (en) * | 2021-01-25 | 2021-03-09 | 北京工业大数据创新中心有限公司 | Sensor abnormity detection method and device |
| CN113114529B (en) * | 2021-03-25 | 2022-05-24 | 清华大学 | KPI (Key Performance indicator) anomaly detection method and device based on condition variation automatic encoder and computer storage medium |
| CN113114529A (en) * | 2021-03-25 | 2021-07-13 | 清华大学 | KPI (Key Performance indicator) abnormity detection method and device based on condition variation automatic encoder |
| CN113204569A (en) * | 2021-03-30 | 2021-08-03 | 联想(北京)有限公司 | Information processing method and device |
| CN113592019B (en) * | 2021-08-10 | 2023-09-15 | 平安银行股份有限公司 | Fault detection method, device, equipment and medium based on multi-model fusion |
| CN113592019A (en) * | 2021-08-10 | 2021-11-02 | 平安银行股份有限公司 | Fault detection method, device, equipment and medium based on multi-model fusion |
| CN113705684A (en) * | 2021-08-30 | 2021-11-26 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic device and medium |
| CN113705684B (en) * | 2021-08-30 | 2023-11-24 | 平安科技（深圳）有限公司 | Reverse iteration anomaly detection method and device, electronic equipment and medium |
| CN114190897A (en) * | 2021-12-15 | 2022-03-18 | 中国科学院空天信息创新研究院 | Training method of sleep staging model, sleep staging method and device |
| CN114190897B (en) * | 2021-12-15 | 2024-04-05 | 中国科学院空天信息创新研究院 | Training method of sleep stage model, sleep stage method and device |
| CN114722061A (en) * | 2022-04-08 | 2022-07-08 | 中国电信股份有限公司 | Data processing method and device, equipment and computer readable storage medium |
| CN114722061B (en) * | 2022-04-08 | 2023-11-14 | 中国电信股份有限公司 | Data processing method and device, equipment and computer readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112148577B (en) | 2024-05-07 |
| WO2021189904A1 (en) | 2021-09-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112148577B (en) | Data anomaly detection method and device, electronic equipment and storage medium | |
| CN113592019B (en) | Fault detection method, device, equipment and medium based on multi-model fusion | |
| CN111783982A (en) | Attack sample acquisition method, device, equipment and medium | |
| CN113918361A (en) | Terminal control method, device, equipment and medium based on Internet of things rule engine | |
| CN111652279A (en) | Behavior evaluation method and device based on time sequence data and readable storage medium | |
| CN112463530A (en) | Anomaly detection method and device for micro-service system, electronic equipment and storage medium | |
| CN112579621A (en) | Data display method and device, electronic equipment and computer storage medium | |
| CN111694844A (en) | Enterprise operation data analysis method and device based on configuration algorithm and electronic equipment | |
| CN113504935A (en) | Software development quality evaluation method and device, electronic equipment and readable storage medium | |
| CN112115145A (en) | Data acquisition method and device, electronic equipment and storage medium | |
| CN113434674A (en) | Data analysis method and device, electronic equipment and readable storage medium | |
| CN113327136A (en) | Attribution analysis method and device, electronic equipment and storage medium | |
| CN114881616A (en) | Business process execution method and device, electronic equipment and storage medium | |
| CN112148566B (en) | Method and device for monitoring computing engine, electronic equipment and storage medium | |
| CN112990374A (en) | Image classification method, device, electronic equipment and medium | |
| CN112486957A (en) | Database migration detection method, device, equipment and storage medium | |
| CN111814106A (en) | Time series data hysteresis processing method and device, electronic equipment and storage medium | |
| CN111460293A (en) | Information pushing method and device and computer readable storage medium | |
| CN114417998A (en) | Data feature mapping method, device, equipment and storage medium | |
| CN112667244A (en) | Data verification method and device, electronic equipment and computer readable storage medium | |
| CN115828977B (en) | Industrial Internet label coding method, device, medium and electronic equipment | |
| CN114240459A (en) | Service speed-based provider selection method, device, equipment and storage medium | |
| CN113312409A (en) | Task monitoring method and device, electronic equipment and computer readable storage medium | |
| CN113657546A (en) | Information classification method and device, electronic equipment and readable storage medium | |
| CN113608931A (en) | Fault-tolerant processing method, device and equipment for updating application resources and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40040153 Country of ref document: HK |
|
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |