CN112488238B - Hybrid anomaly detection method based on countermeasure self-encoder - Google Patents
Hybrid anomaly detection method based on countermeasure self-encoder Download PDFInfo
- Publication number
- CN112488238B CN112488238B CN202011469743.5A CN202011469743A CN112488238B CN 112488238 B CN112488238 B CN 112488238B CN 202011469743 A CN202011469743 A CN 202011469743A CN 112488238 B CN112488238 B CN 112488238B
- Authority
- CN
- China
- Prior art keywords
- encoder
- classifier
- self
- training
- feature vectors
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 74
- 238000012549 training Methods 0.000 claims abstract description 72
- 239000013598 vector Substances 0.000 claims abstract description 71
- 230000004927 fusion Effects 0.000 claims abstract description 24
- 238000000034 method Methods 0.000 claims abstract description 24
- 230000002159 abnormal effect Effects 0.000 claims abstract description 18
- 238000012360 testing method Methods 0.000 claims abstract description 17
- 230000006870 function Effects 0.000 claims description 26
- 230000003042 antagnostic effect Effects 0.000 claims description 11
- 230000004913 activation Effects 0.000 claims description 9
- 238000000605 extraction Methods 0.000 claims description 6
- 238000012545 processing Methods 0.000 claims description 4
- 238000013507 mapping Methods 0.000 claims description 3
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 claims description 2
- 238000007499 fusion processing Methods 0.000 abstract description 4
- 238000005516 engineering process Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 4
- 230000005856 abnormality Effects 0.000 description 3
- 238000002790 cross-validation Methods 0.000 description 3
- 238000013135 deep learning Methods 0.000 description 3
- 230000009467 reduction Effects 0.000 description 3
- 238000005315 distribution function Methods 0.000 description 2
- 238000010606 normalization Methods 0.000 description 2
- 238000013450 outlier detection Methods 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 238000013473 artificial intelligence Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000005065 mining Methods 0.000 description 1
- 238000010998 test method Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
- G06N20/20—Ensemble learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/048—Activation functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Software Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Biomedical Technology (AREA)
- Evolutionary Biology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Health & Medical Sciences (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Medical Informatics (AREA)
- Image Analysis (AREA)
Abstract
The invention discloses a hybrid anomaly detection method based on a countermeasure self-encoder, which comprises the steps of firstly, improving a countermeasure self-encoder model, and extracting noise-added input data characteristics by utilizing the improved countermeasure self-encoder model; then, carrying out weighted fusion processing on the two extracted features; then, taking the fused feature vector obtained by fusion as training data, and integrally training an ifoest classifier, an LOF classifier and a K-means classifier by utilizing an integrated learning mode to obtain a detection classifier; and finally, extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result. Compared with the prior art, the method has the advantages that the countermeasure autoencoder is combined with the traditional anomaly detection method, so that the anomaly detection can be more accurately carried out on the data set, and the accuracy of the anomaly detection is improved.
Description
Technical Field
The invention relates to the technical field of anomaly detection, in particular to a hybrid anomaly detection method based on a confrontation self-encoder.
Background
The abnormal point is defined as a data object which is obviously different from other data distribution, and abnormal information can be mined from mass data, interest patterns can be extracted and the like by analyzing the data distribution characteristics of the abnormal point. Therefore, outlier detection (outlier detection) becomes one of the research hotspots in the data mining field. The traditional abnormal point detection methods are numerous and mainly consider the time performance and the accuracy performance in the detection process. However, with the development of cloud computing and big data technologies, the traditional method for mining abnormal node information through a single node computing mode cannot meet the increasing data computing requirements. An artificial intelligence technology represented by a deep learning technology provides a new research direction for detecting the abnormal point.
At present, a method of constructing a hybrid model by combining a deep learning method is continuously applied to an actual scene in recent years. The method has the characteristic of no need of training the model in advance, so the method belongs to a method with high cost performance. However, for complex and high-dimensional data, the method is difficult to capture the inherent attributes of the data, and in addition, when the AE is used for dimension reduction, the degree of dimension reduction greatly affects the final result, repeated parameter adjustment is needed, and the accuracy of anomaly detection is reduced.
Disclosure of Invention
The invention aims to provide a hybrid anomaly detection method based on a countercheck self-encoder, which improves the accuracy of anomaly detection.
In order to achieve the above object, the present invention provides a mixed anomaly detection method based on a countering self-encoder, which comprises the following steps:
improving a countermeasure self-encoder model, and extracting noise-added input data characteristics by using the improved countermeasure self-encoder model;
performing weighted fusion on the two groups of extracted characteristic vectors to obtain fusion characteristic vectors;
taking the fusion feature vector as training data, and integrally training an error classifier, an LOF classifier and a K-means classifier by utilizing an integrated learning mode to obtain a detection classifier;
and extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result.
Wherein, improving the antagonistic self-encoder model and extracting the characteristics of the noise-added input data by using the improved antagonistic self-encoder model comprises the following steps:
taking an LeakyReLU function and a Tanh function as activation functions of a first convolution layer, a third convolution layer, a fourth convolution layer and a generator and a first encoder in two encoders in a self-encoder model, forming a self-encoder by the generator and the first encoder, and improving the activation function and the mapping function of a discriminator;
normalizing the acquired data set, and performing noise-adding processing on the divided training set;
and training the improved confrontation self-encoder model, and extracting two groups of characteristics of the training set.
Training the improved confrontation self-encoder model, and extracting two groups of characteristics of the training set, wherein the training comprises:
inputting the noisy training set into the improved confrontation self-encoder model, performing feature extraction by using a first encoder, and reconstructing the training set by using the generator to take the extracted first group of feature vectors as input;
and performing feature extraction on the reconstructed training set by using a second encoder to obtain a second group of feature vectors.
Wherein, carry out the weight fusion to two sets of characteristic vectors of drawing out, obtain and fuse the characteristic vector, include:
and multiplying the first group of feature vectors by a weighting coefficient, multiplying the second group of feature vectors by subtracting the weighting coefficient from 1, adding the two products, and combining the corresponding labels to obtain corresponding fusion feature vectors.
The fusion feature vector is used as training data, and the ifroest classifier, the LOF classifier and the K-means classifier are integrally trained in an integrated learning mode to obtain a detection classifier, and the method comprises the following steps:
serializing three classifiers by using an AdaBoost algorithm, inputting the fusion feature vector as a training set into an ifoest classifier for training, adjusting weight distribution to obtain a weight coefficient, inputting the training set into a next classifier until the ifoest classifier, an LOF classifier and a K-means classifier are trained, and integrating all the weight coefficients to obtain a detection classifier.
Wherein, the improved confrontation self-encoder model is used for extracting two groups of characteristic vectors in a test set, and the two groups of characteristic vectors are fused and then input into the detection classifier to obtain an abnormal detection result, which comprises the following steps:
denoising the divided test set, and extracting two groups of feature vectors by using a first encoder and a second encoder in the improved confrontation self-encoder model;
and performing weighted fusion on the two groups of feature vectors, and inputting the feature vectors into a search detection classifier to obtain an abnormal detection result of each test sample.
The invention relates to a hybrid anomaly detection method based on a countermeasure self-encoder, which comprises the steps of firstly, improving a countermeasure self-encoder model, and extracting noise-added input data characteristics by utilizing the improved countermeasure self-encoder model; then, carrying out weighted fusion processing on the two extracted features; then, taking the fused feature vector obtained by fusion as training data, and integrally training an ifoest classifier, an LOF classifier and a K-means classifier by utilizing an integrated learning mode to obtain a detection classifier; and finally, extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result. Compared with the prior art, the method has the advantages that the countermeasure autoencoder is combined with the traditional anomaly detection method, so that the anomaly detection can be more accurately carried out on the data set, and the accuracy of the anomaly detection is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a schematic diagram illustrating the steps of a hybrid anomaly detection method based on a countering self-encoder according to the present invention.
Fig. 2 is a schematic flow chart of a hybrid anomaly detection method based on a countering self-encoder according to the present invention.
FIG. 3 is a framework of a hybrid anomaly detection model based on an improved robust self-encoder provided by the present invention.
Fig. 4 is an encoder model structure for an improved robust autoencoder provided by the present invention.
Fig. 5 is a view of the improved discriminator model structure against the self-encoder provided by the present invention.
Fig. 6 is a generator model structure for an improved robust autoencoder provided by the present invention.
FIG. 7 is a model structure for ensemble learning provided by the present invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the accompanying drawings are illustrative and intended to explain the present invention and should not be construed as limiting the present invention.
In the description of the present invention, "a plurality" means two or more unless specifically defined otherwise.
Referring to fig. 1 to 3, the present invention provides a hybrid anomaly detection method based on a countering self-encoder, which includes the following steps:
s101, improving a countermeasure self-encoder model, and extracting the characteristics of the noise-added input data by using the improved countermeasure self-encoder model.
Specifically, an improved antagonistic self-encoder model is constructed, and features of input data are extracted. The model improves the DCGAN, and comprises two encoders E1 and E2, a generator G and a discriminator D, wherein the two encoders E1 and E2 adopt the same structure: the four convolution layers are used for dimension reduction, the second layer and the third layer adopt BatchNormalization technology, the activation function of the first three layers is LeakyReLU function, and the activation function of the last layer is Tanh. The generator G and the first encoder E1 form a self-encoder which is provided with four layers of inverse convolution neural networks, the first three layers use the Batch Normalization technology, the activation function is a LeakyReLU function, and the last layer uses Tanh as the activation function. The discriminator D has a network structure similar to that of the first encoder E1, and uses a four-layer convolutional neural network, the second layer and the third layer use a Batch Normalization technique, the activation functions of the first three layers are LeakyReLU functions, and the last layer uses Sigmoid as an output mapping function, as shown in fig. 4 to 6.
And normalizing the data set into a single-channel or three-channel picture with the same specification size. The data set is split into a training set and a test set according to 4:1, and the improved antagonistic self-encoder model is trained on the training set. The noise adding processing is carried out on the training set before training, so that the characteristics representing the input data can be better extracted. The network adopts Adam algorithm to update the parameters of each layer of the network, and the iteration times are 200 generations. The generator G and the discriminator D are trained firstly, and the encoders E1 and E2 are trained by noisy data after the training is finished. Three loss functions are included:
L enc ＝||z 1 -z 2 || 2
L con ＝||x-x′|| 1
L adv ＝||f(x)-f(x')|| 2
the specific training process comprises the following steps: inputting a single-channel noisy grayscale image or an RGB three-channel noisy image of m Zhang Xiangtong pixel size into a confrontation self-encoder model, wherein a noisy training set is represented as S = { (x) 1 ,y 1 ),...,(x m ,y m ) In which x i Representing noisy n-dimensional data, y i Is a data tag. After convolutional layer feature extraction by the first encoder E1, each picture is represented as a first set of feature vectors Z 1 ＝{(z 11 ,y 1 ),...,(z 1m ,y m ) Output and store in the form of. The generator G takes the feature vectors as input to reconstruct a training set, and outputs reconstructed data S' = { (x) 1 ',y 1 ),...,(x m ',y m ) }. The discriminator D is responsible for ensuring that the reconstructed data is as similar as possible to the original data. After re-extracting the features, the second encoder E2 represents a second set of feature vectors Z 2 ＝{(z 21 ,y 1 ),...,(z 2m ,y m ) And storing.
And S102, carrying out weighted fusion on the two groups of extracted characteristic vectors to obtain fusion characteristic vectors.
In particular, for the two sets of eigenvectors Z obtained in S1 1 ＝{(z 11 ,y 1 ),...,(z 1m ,y m ) Z and 2 ＝{(z 21 ,y 1 ),...,(z 2m ,y m ) And performing weighted fusion processing on the feature data of every two data respectively:
wherein, the lambda is a weighting coefficient and is selected from 0 to 1 according to the actual situation.
For the obtained Z 31 ～Z 3m Add their original tag y 1 ～y m Form a new set of eigenvectors Z 3 ＝{(z 31 ,y 1 ),...,(z 3m ,y m )}。
S103, taking the fusion feature vector as training data, and performing integrated training on an ifoest classifier, an LOF classifier and a K-means classifier in an integrated learning mode to obtain a detection classifier.
Specifically, serializing three classifiers by using an AdaBoost algorithm, inputting the fused feature vector as a training set into an ifoest classifier for training, adjusting weight distribution to obtain a weight coefficient, inputting the training set into a next classifier until the training of the ifoest classifier, the LOF classifier and the K-means classifier is completed, and integrating all the weight coefficients to obtain a detection classifier, as shown in fig. 7, S31: data Z after model training 3 In the process of importing the AdaBoost detection model, firstly, weight distribution W of training data is initialized 1 ＝(w 11 ,...,w 1m ),w 1i =1/m, where i =1,2. Namely, each training sample is endowed with the same weight, and the fusion feature vector is taken as a training set.
S32: training iforcest by using training set, i.e. classifier h 1 (z) adjusting the iTree number through cross validation, and setting an abnormal ratio according to the sample label to enable a loss function e 1 And is minimal. Calculate h 1 Error of (z)
If get e 1 And if the number is more than 0.5, the training of the next classifier is directly skipped. Calculating a weight coefficient
Updating the weight distribution W 2 ＝(w 21 ,...,w 2m )，
Where i =1,2,.. M, F (z) is the distribution function of the raw data.
S33: enter next classifier LOF, train LOF using training set, i.e. classifier h 2 (z). Minimizing the loss function e by adjusting the K value in the LOF algorithm through cross-validation 2 Threshold t of training LOF 1 :(t 1 ',k)＝argmin t1',k e 2 Even the loss function e 2 Minimum t 1 ' is noted as t 1 Comparing the abnormality score with a threshold t 1 Determine the abnormal value of (c), and calculate h 2 Error of (z)
If get e 2 And if the number is more than 0.5, the training of the next classifier is directly skipped. Calculating a weight coefficient
Updating the weight distribution W 3 ＝(w 31 ,...,w 3m )，
Where i =1,2,.. M, F (z) is the distribution function of the raw data.
S34: go to the next classifier K-means, i.e. classifier h 3 (z). Adjusting the number K of clustering clusters in a K-means algorithm through cross validation, selecting the relative distance D of each clustering center as an abnormal score to minimize an error e 3 Training K-means to obtain a threshold value t 2 ：(D,k)＝arg min D,k e 2 Even if the loss function e 3 Minimum sizeD is denoted as t 2 Comparing the relative distance D with a threshold value t 2 To determine an outlier; and calculate h 3 Error of (z)
If get e 3 And if the number is more than 0.5, the training of the next classifier is skipped directly. Calculating a weight coefficient
Linearly combining the 3 classifiers to obtain a final detection classifier or a final strong classifier
And S104, extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result.
Specifically, firstly, the test data set is subjected to noise adding, then the noise is sent into a trained improved confrontation self-encoder model, and two groups of characteristic vectors Z of the test set are extracted through encoders E1 and E2 1 ' and Z 2 'and weighted fusion in the step S102 is performed to obtain a fused feature vector Z'.
The fused feature vector Z' is taken as input data and sent to the detection classifier H (Z) obtained in step S103, and the strong classifier outputs the abnormality score of each test sample, thereby obtaining an abnormality detection result.
In order to verify the effectiveness of the hybrid anomaly detection model based on the anti-self encoder, the method of the invention is compared with the anomaly detection effects of three traditional anomaly detection algorithms in an MNIST data set, and the comparison result is shown in Table 1. Compared with three traditional anomaly detection methods, the accuracy value and the AUC value of the method provided by the invention are greatly improved, and the method is proved to have higher reliability.
TABLE 1 comparison of the four test methods
| Iforest | LOF | OCSVM | Text algorithm | |
| Rate of accuracy | 89.81 | 84.57 | 70.82 | 92.38 |
| AUC value | 0.79 | 0.83 | 0.80 | 0.95 |
Compared with the prior art, the invention has the remarkable advantages that:
1. compared with the characteristics extracted by the traditional machine learning method, the characteristics extracted by the method are more abstract and representative, and the accuracy rate of anomaly detection can be effectively improved.
2. The method introduces the integrated learning in the deep learning, integrates three traditional anomaly detection algorithms of iforest, LOF and K-means through the AdaBoost algorithm respectively, is more accurate compared with the traditional anomaly detection algorithm, can process data with high dimensionality, and does not need to make feature selection.
3. By resisting two groups of feature vectors decoded by the self-encoder model and performing weighted fusion on the two groups of feature vectors, the features of the extracted input data are more representative, and compared with a method for extracting the features of the self-encoder alone, the method is more reliable and has higher accuracy rate of anomaly detection.
The invention relates to a mixed anomaly detection method based on a countermeasure self-encoder, which comprises the steps of firstly, improving a countermeasure self-encoder model, and extracting noise-added input data characteristics by utilizing the improved countermeasure self-encoder model; then, carrying out weighted fusion processing on the two extracted features; then, taking the fused feature vector obtained by fusion as training data, and integrally training an ifoest classifier, an LOF classifier and a K-means classifier by utilizing an integrated learning mode to obtain a detection classifier; and finally, extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result. Compared with the prior art, the method has the advantages that the countermeasure self-encoder is combined with the traditional anomaly detection method, so that the anomaly detection can be more accurately carried out on the data set, and the accuracy of the anomaly detection is improved.
While the invention has been described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (5)
1. A hybrid anomaly detection method based on a countering self-encoder is characterized by comprising the following steps:
improving a countermeasure self-encoder model, and extracting characteristics of noise-added input data by using the improved countermeasure self-encoder model;
performing weighted fusion on the two groups of extracted characteristic vectors to obtain fusion characteristic vectors;
taking the fusion feature vector as training data, and integrally training an error classifier, an LOF classifier and a K-means classifier by utilizing an integrated learning mode to obtain a detection classifier;
extracting two groups of feature vectors in a test set by using the improved confrontation self-encoder model, fusing the two groups of feature vectors, and inputting the fused feature vectors into the detection classifier to obtain an abnormal detection result;
improving a countering self-encoder model, and extracting noisy input data features by using the improved countering self-encoder model, wherein the steps comprise:
taking a LeakyReLU function and a Tanh function as activation functions of a first convolutional layer, a third convolutional layer and a fourth convolutional layer in two encoders in a self-encoder model, forming a self-encoder by a generator and the first encoder, and improving the activation function and the mapping function of a discriminator;
normalizing the acquired data set, and performing noise adding processing on the divided training set;
training the improved confrontation self-encoder model, and extracting two groups of characteristics of the training set;
specifically, the antagonistic self-encoder model comprises a first encoder E1, a second encoder E2, a generator G and a discriminator D;
normalizing the data set into a single-channel or three-channel picture with the same specification and size; splitting the data set into a training set and a testing set according to 4:1, and training an improved confrontation self-encoder model on the training set; before training, noise adding processing is carried out on a training set, so that the characteristics representing input data can be better extracted; the network adopts an Adam algorithm to update parameters of each layer of the network, and the iteration times are 200 generations; firstly training a generator G and a discriminator D, and then training encoders E1 and E2 by using noisy data after training is finished; three loss functions are included:
L enc ＝||z 1 -z 2 || 2
L con ＝||x-x'|| 1
L adv ＝||f(x)-f(x')|| 2
inputting a single-channel noisy grayscale image or an RGB three-channel noisy image of m Zhang Xiangtong pixel size into a confrontation self-encoder model, wherein a noisy training set is represented as S = { (x) 1 ,y 1 ),...,(x m ,y m ) In which x i Representing noisy n-dimensional data, y i Is a data tag; after convolutional layer feature extraction by the first encoder E1, each picture is represented as a first set of feature vectors Z 1 ＝{(z 11 ,y 1 ),...,(z 1m ,y m ) Outputting and storing the form of the Chinese character'; the generator G reconstructs a training set using these feature vectors as input, and outputs reconstructed data S' = { (x) 1 ',y 1 ),...,(x m ',y m ) }; the discriminator D is responsible for ensuring that the reconstructed data is similar to the initial data as much as possible; after re-extracting the features, the second encoder E2 represents a second set of feature vectors Z 2 ＝{(z 21 ,y 1 ),...,(z 2m ,y m ) And storing.
2. The hybrid anomaly detection method based on the antagonistic self-encoder as claimed in claim 1, wherein the training of the improved antagonistic self-encoder model to extract two sets of features of the training set comprises:
inputting the noisy training set into the improved confrontation self-encoder model, performing feature extraction by using a first encoder, and reconstructing the training set by using the generator to take the extracted first group of feature vectors as input;
and performing feature extraction on the reconstructed training set by using a second encoder to obtain a second group of feature vectors.
3. The hybrid anomaly detection method based on the antagonistic self-encoder as claimed in claim 2, wherein the weighted fusion of the two groups of extracted feature vectors to obtain a fused feature vector comprises:
and multiplying the first group of feature vectors by a weighting coefficient, multiplying the second group of feature vectors by subtracting the weighting coefficient from 1, adding the two products, and combining the corresponding labels to obtain corresponding fusion feature vectors.
4. The hybrid anomaly detection method based on the antagonistic self-encoder as claimed in claim 1, wherein the fused feature vector is used as training data, and an error classifier, an LOF classifier and a K-means classifier are integrally trained in an ensemble learning manner to obtain a detection classifier, and the method comprises the following steps:
serializing three classifiers by using an AdaBoost algorithm, inputting the fusion feature vector as a training set into an ifoest classifier for training, adjusting weight distribution to obtain a weight coefficient, inputting the training set into a next classifier until the ifoest classifier, an LOF classifier and a K-means classifier are trained, and integrating all the weight coefficients to obtain a detection classifier.
5. The hybrid anomaly detection method based on the antagonistic self-encoder as claimed in claim 1, wherein the improved antagonistic self-encoder model is used to extract two groups of feature vectors in a test set, and the two groups of feature vectors are fused and input into the detection classifier to obtain an anomaly detection result, comprising:
denoising the divided test set, and extracting two groups of feature vectors by using a first encoder and a second encoder in the improved confrontation self-encoder model;
and performing weighted fusion on the two groups of feature vectors, and inputting the feature vectors into a search detection classifier to obtain an abnormal detection result of each test sample.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011469743.5A CN112488238B (en) | 2020-12-14 | 2020-12-14 | Hybrid anomaly detection method based on countermeasure self-encoder |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011469743.5A CN112488238B (en) | 2020-12-14 | 2020-12-14 | Hybrid anomaly detection method based on countermeasure self-encoder |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112488238A CN112488238A (en) | 2021-03-12 |
| CN112488238B true CN112488238B (en) | 2022-11-15 |
Family
ID=74916383
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011469743.5A Active CN112488238B (en) | 2020-12-14 | 2020-12-14 | Hybrid anomaly detection method based on countermeasure self-encoder |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112488238B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113033817B (en) * | 2021-03-19 | 2023-04-28 | 南方科技大学 | OOD detection method and device based on hidden space, server and storage medium |
Family Cites Families (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP6547275B2 (en) * | 2014-10-29 | 2019-07-24 | 株式会社リコー | INFORMATION PROCESSING SYSTEM, INFORMATION PROCESSING DEVICE, INFORMATION PROCESSING METHOD, AND PROGRAM |
| EP3616198A4 (en) * | 2017-04-24 | 2021-01-06 | Virginia Tech Intellectual Properties, Inc. | Radio signal identification, identification system learning, and identifier deployment |
| EP3477553B1 (en) * | 2017-10-27 | 2023-08-30 | Robert Bosch GmbH | Method for detecting an anomalous image among a first dataset of images using an adversarial autoencoder |
| CN108182452B (en) * | 2017-12-29 | 2018-11-20 | 哈尔滨工业大学（威海） | Aero-engine fault detection method and system based on grouping convolution self-encoding encoder |
| US11082438B2 (en) * | 2018-09-05 | 2021-08-03 | Oracle International Corporation | Malicious activity detection by cross-trace analysis and deep learning |
| KR102285987B1 (en) * | 2018-10-10 | 2021-08-04 | 주식회사 케이티 | Method, system and computer program for detecting error of facilities in building |
| AU2019375200A1 (en) * | 2018-11-09 | 2021-06-17 | Augury Systems Ltd. | Automated analysis of non-stationary machine performance |
| CN109919032B (en) * | 2019-01-31 | 2021-03-30 | 华南理工大学 | Video abnormal behavior detection method based on motion prediction |
| US20200364303A1 (en) * | 2019-05-15 | 2020-11-19 | Nvidia Corporation | Grammar transfer using one or more neural networks |
| CN111598881B (en) * | 2020-05-19 | 2022-07-12 | 西安电子科技大学 | Image anomaly detection method based on variational self-encoder |
-
2020
- 2020-12-14 CN CN202011469743.5A patent/CN112488238B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN112488238A (en) | 2021-03-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109727246B (en) | Comparative learning image quality evaluation method based on twin network | |
| CN108564129B (en) | Trajectory data classification method based on generation countermeasure network | |
| US20190228268A1 (en) | Method and system for cell image segmentation using multi-stage convolutional neural networks | |
| CN109063724B (en) | Enhanced generation type countermeasure network and target sample identification method | |
| CN112990097B (en) | Face expression recognition method based on countermeasure elimination | |
| CN107578007A (en) | A kind of deep learning face identification method based on multi-feature fusion | |
| CN112784929B (en) | Small sample image classification method and device based on double-element group expansion | |
| CN112464004A (en) | Multi-view depth generation image clustering method | |
| CN107358172B (en) | Human face feature point initialization method based on human face orientation classification | |
| CN108595558B (en) | Image annotation method based on data equalization strategy and multi-feature fusion | |
| CN110263855B (en) | Method for classifying images by utilizing common-basis capsule projection | |
| CN110717423B (en) | Training method and device for emotion recognition model of facial expression of old people | |
| CN112766355A (en) | Electroencephalogram signal emotion recognition method under label noise | |
| CN109711411B (en) | Image segmentation and identification method based on capsule neurons | |
| CN112232395B (en) | Semi-supervised image classification method for generating countermeasure network based on joint training | |
| CN113987236B (en) | Unsupervised training method and unsupervised training device for visual retrieval model based on graph convolution network | |
| CN112488238B (en) | Hybrid anomaly detection method based on countermeasure self-encoder | |
| Zhou et al. | Personalized and occupational-aware age progression by generative adversarial networks | |
| CN111144500A (en) | Differential privacy deep learning classification method based on analytic Gaussian mechanism | |
| CN109165576B (en) | Motion state identification method and device | |
| CN113222808A (en) | Face mask removing method based on generative confrontation network | |
| CN111160161B (en) | Self-learning face age estimation method based on noise elimination | |
| CN117056763A (en) | Community discovery method based on variogram embedding | |
| CN109165587B (en) | Intelligent image information extraction method | |
| CN114049675B (en) | Facial expression recognition method based on light-weight two-channel neural network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20210312 Assignee: Guilin Qinghong Technology Co.,Ltd. Assignor: GUILIN University OF ELECTRONIC TECHNOLOGY Contract record no.: X2023980045229 Denomination of invention: A hybrid anomaly detection method based on adversarial autoencoder Granted publication date: 20221115 License type: Common License Record date: 20231102 |
|
| EE01 | Entry into force of recordation of patent licensing contract |