CN113743607A

CN113743607A - Training method of anomaly detection model, anomaly detection method and device

Info

Publication number: CN113743607A
Application number: CN202111083531.8A
Authority: CN
Inventors: 张静; 李泽州; 张宪波
Original assignee: Jingdong Technology Information Technology Co Ltd
Current assignee: Jingdong Technology Information Technology Co Ltd
Priority date: 2021-09-15
Filing date: 2021-09-15
Publication date: 2021-12-03
Anticipated expiration: 2041-09-15
Also published as: CN113743607B

Abstract

The present disclosure provides a training method of an anomaly detection model, the method including: acquiring a multi-frame time sequence image, wherein the multi-frame time sequence image comprises a target image and a historical image, the target image comprises a data point to be detected, the historical image comprises a historical data point before the data point to be detected, the data point to be detected has label information, and the label information represents an abnormal value of the data point to be detected; inputting a plurality of frames of time sequence images into an anomaly detection model to be trained so that the anomaly detection model to be trained can carry out anomaly detection on a data point to be detected in a target image according to a historical image and output a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and iteratively adjusting network parameters of the abnormal detection model to be trained according to the prediction result and the label information to generate the trained abnormal detection model. The disclosure also provides an anomaly detection method, an anomaly detection device, a computer system and a computer-readable storage medium.

Description

Training method of anomaly detection model, anomaly detection method and device

Technical Field

The present disclosure relates to the field of artificial intelligence technologies, and in particular, to a training method, an anomaly detection apparatus, a computer system, and a computer-readable storage medium for an anomaly detection model.

Background

The abnormal segment type of the time sequence monitoring index not only comprises amplitude abnormality, but also comprises several modes such as context abnormality, interval abnormality and the like. Therefore, when analyzing the time-series indicator, the time attribute and the space attribute thereof need to be analyzed simultaneously to obtain a comprehensive detection result.

In the process of realizing the concept of the present disclosure, the inventor finds that the method for detecting the abnormal time sequence monitoring index, which simultaneously analyzes the time attribute and the space attribute in the related art, has the technical problems of high computation amount and complexity and low accuracy of the detection result.

Disclosure of Invention

In view of the above, the present disclosure provides a training method, an anomaly detection apparatus, a computer system, and a computer-readable storage medium for an anomaly detection model for improving detection accuracy.

One aspect of the present disclosure provides a training method of an anomaly detection model, including:

acquiring a plurality of frames of time sequence images, wherein the plurality of frames of time sequence images are generated by capturing a time sequence data display interface according to a preset frequency, the plurality of frames of time sequence images comprise a target image and a historical image, the target image comprises a data point to be detected, the historical image comprises a historical data point before the data point to be detected, the data point to be detected is provided with label information, and the label information represents an abnormal value of the data point to be detected;

inputting a plurality of frames of the time sequence images into an anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in the target image according to the historical image, and outputting a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and

and iteratively adjusting the network parameters of the abnormal detection model to be trained according to the prediction result and the label information to generate a trained abnormal detection model.

According to an embodiment of the present disclosure, the anomaly detection model to be trained includes a first feature extraction network, an attention network, and a second feature extraction network;

the inputting of multiple frames of the time-series images into an anomaly detection model to be trained so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in the target image according to the historical image, and outputting a prediction result includes:

inputting a plurality of frames of the time-series images into the first feature extraction network, and outputting a plurality of frames of first image data, wherein the plurality of frames of first image data include first target image data corresponding to the target image and first history image data corresponding to the history image;

inputting a plurality of frames of the first image data into the attention network so that the attention network configures a weight parameter for the first historical image data according to the correlation between the first historical image data and the first target image data, and outputs the first target image data and second historical image data;

and inputting the first target image data and the second history image data into the second feature extraction network, and outputting the prediction result.

According to an embodiment of the present disclosure, the inputting a plurality of frames of the first image data into the attention network so that the attention network configures a weight parameter for the first history image data according to a correlation between the first history image data and the first target image data, and outputting the first target image data and the second history image data includes:

calculating the similarity of the first historical image data and the first target image data to generate a similarity result;

generating a first weight parameter according to the similarity result;

the second history image data is generated based on the first weight parameter and the first history image data.

According to an embodiment of the present disclosure, the iteratively adjusting and training network parameters of the anomaly detection model to be trained according to the prediction result and the label information, and generating the trained anomaly detection model includes:

inputting the prediction result and the label information into a loss function, and outputting a loss result;

and iteratively adjusting the network parameters of the abnormal detection model to be trained according to the loss result to generate the trained abnormal detection model.

According to an embodiment of the present disclosure, the time-series data display interface is generated by:

acquiring an initial time series data display interface, wherein the initial time series data display interface comprises a target time point and a historical time point before the target data point;

and dynamically normalizing the data displayed on the initial time sequence data display interface according to the data value of the target time point and the maximum value and the minimum value of the data point to be detected in a preset time period to generate the time sequence data display interface.

According to an embodiment of the present disclosure, the preset time period is associated with the preset frequency.

According to the embodiment of the disclosure, the multi-frame time sequence image generated by screenshot of the time sequence data display interface according to the preset frequency comprises each data point of the time sequence data display interface.

Another aspect of the present disclosure provides an abnormality detection method including:

acquiring an image to be detected, wherein the image to be detected comprises time sequence data;

inputting the image to be detected into an anomaly detection model, and outputting a detection result, wherein the detection result represents an abnormal value of a time point to be detected in the image to be detected, and the anomaly detection model is obtained by training the anomaly detection model through a training method.

Another aspect of the present disclosure provides a training apparatus for an anomaly detection model, including:

the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring a plurality of frames of time sequence images, the plurality of frames of time sequence images are generated by screenshot of a time sequence data display interface according to preset frequency, the plurality of frames of time sequence images comprise a target image and a historical image, the target image comprises a data point to be detected, the historical image comprises a historical data point before the data point to be detected, the data point to be detected is provided with label information, and the label information represents an abnormal value of the data point to be detected;

the prediction module is used for inputting a plurality of frames of the time sequence images into an abnormal detection model to be trained so that the abnormal detection model to be trained can carry out abnormal detection on a data point to be detected in the target image according to the historical image and output a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and

and the training module is used for iteratively adjusting the network parameters of the abnormal detection model to be trained according to the prediction result and the label information to generate the trained abnormal detection model.

Another aspect of the present disclosure provides an abnormality detection apparatus including:

the second acquisition module is used for acquiring an image to be detected, wherein the image to be detected comprises time sequence data;

and the detection module is used for inputting the image to be detected into an abnormal detection model and outputting a detection result, wherein the detection result represents an abnormal value of a time point to be detected in the image to be detected, and the abnormal detection model is obtained by training the abnormal detection model by using a training method of the abnormal detection model.

Another aspect of the present disclosure provides a computer system comprising: one or more processors; a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the methods of the embodiments of the present disclosure.

Another aspect of the present disclosure provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to implement the method of the embodiments of the present disclosure described above.

Another aspect of the disclosure provides a computer program product comprising computer executable instructions for implementing the method as described above when executed.

In the embodiment of the disclosure, a multi-frame time sequence image is generated by capturing a time sequence data display interface at a preset frequency, and the multi-frame time sequence image includes a data point to be detected and a historical data point before the data point to be detected, so that the multi-frame time sequence image includes a spatial attribute and a time attribute of time sequence data, the multi-frame time sequence image is processed by using an anomaly detection model, a detection result generated based on the spatial characteristic and the time characteristic of the time sequence data can be obtained, and the detection result can represent an abnormal value of the time sequence data. Therefore, the technical problem that the time attribute and the space attribute of the time sequence index cannot be simultaneously analyzed in the related technology is at least solved, and the detection accuracy of the abnormal detection is improved. Meanwhile, due to the fact that the preprocessing process of the time sequence image is omitted, the technical problems of high computation amount and high complexity of an abnormality detection method in the related technology can be at least partially solved, and the detection efficiency of time sequence data abnormality detection is improved.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an exemplary system architecture to which a training method of an abnormality detection model, a training apparatus of an abnormality detection model, an abnormality detection method, an abnormality detection apparatus may be applied, according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a flow chart of a method of training an anomaly detection model according to an embodiment of the present disclosure;

FIG. 3 schematically illustrates a flow chart for generating a time series data display interface according to an embodiment of the disclosure;

fig. 4 schematically illustrates a flowchart of inputting multiple frames of time-series images into an anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in the target image according to the historical image, and outputs a prediction result according to an embodiment of the present disclosure;

FIG. 5 schematically illustrates a model structure diagram of a first feature extraction network according to an embodiment of the disclosure;

fig. 6 schematically illustrates that multiple frames of the time-series images are input into an anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in the target image according to the historical image, and outputs a prediction result according to the embodiment of the disclosure;

fig. 7 schematically illustrates a flowchart of iteratively adjusting network parameters of the anomaly detection model to be trained according to the prediction result and the label information to generate a trained anomaly detection model according to an embodiment of the present disclosure;

FIG. 8 schematically illustrates a flow chart of an anomaly detection method according to an embodiment of the present disclosure;

FIG. 9 schematically illustrates a block diagram of a training apparatus for an anomaly detection model, in accordance with an embodiment of the present disclosure;

FIG. 10 schematically illustrates a block diagram of an anomaly detection apparatus according to an embodiment of the present disclosure; and

FIG. 11 schematically illustrates a block diagram of a computer system suitable for implementing the above-described method, according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

To at least partially solve the above technical problems, the present disclosure provides a training method of an abnormality detection model, an abnormality detection method, an abnormality detection apparatus, a computer system, and a computer-readable storage medium. The training method of the anomaly detection model comprises the following steps: acquiring a multi-frame time sequence image, wherein the multi-frame time sequence image is generated by screenshot of a time sequence data display interface according to a preset frequency, the multi-frame time sequence image comprises a target image and a historical image, the target image comprises a data point to be detected, the historical image comprises a historical data point before the data point to be detected, the data point to be detected has label information, and the label information represents an abnormal value of the data point to be detected; inputting a plurality of frames of time sequence images into an anomaly detection model to be trained so that the anomaly detection model to be trained can carry out anomaly detection on a data point to be detected in a target image according to a historical image and output a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and iteratively adjusting network parameters of the abnormal detection model to be trained according to the prediction result and the label information to generate the trained abnormal detection model. The abnormality detection method includes: acquiring an image to be detected, wherein the image to be detected comprises time sequence data; and inputting the image to be detected into an anomaly detection model, and outputting a detection result, wherein the detection result represents an abnormal value of a time point to be detected in the image to be detected, and the anomaly detection model is obtained by training the training method of the anomaly detection model provided by the embodiment of the disclosure.

The time series data display interface is subjected to screenshot through preset frequency, a multi-frame time series image is generated, the multi-frame time series image comprises a data point to be detected and historical data points before the data point to be detected, the multi-frame time series image comprises spatial attributes and time attributes of time series data, an anomaly detection model is used for processing the multi-frame time series image, a detection result can be generated based on the spatial features and the time series features of the time series data, and the detection result can represent an abnormal value of the time series data. Therefore, the technical problem that the time attribute and the space attribute of the time sequence index cannot be simultaneously analyzed in the related technology is at least solved, and the detection accuracy of the abnormal detection is improved. Meanwhile, due to the fact that the preprocessing process of the time sequence image is omitted, the technical problems of high computation amount and high complexity of an abnormality detection method in the related technology can be at least partially solved, and the detection efficiency of time sequence data abnormality detection is improved.

Fig. 1 schematically illustrates an exemplary system architecture 100 to which a training method of an abnormality detection model, a training apparatus of an abnormality detection model, an abnormality detection method, an abnormality detection apparatus may be applied, according to an embodiment of the present disclosure. It should be noted that fig. 1 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

As shown in fig. 1, the system architecture 100 according to this embodiment may include

terminal devices

101, 102, 103, a network 104 and a server 105. The network 104 serves as a medium for providing communication links between the

terminal devices

101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired and/or wireless communication links, and so forth.

The user may use the

terminal devices

101, 102, 103 to interact with the server 105 via the network 104 to receive or send messages or the like. The

terminal devices

101, 102, 103 may have installed thereon various communication client applications, such as a shopping-like application, a web browser application, a search-like application, an instant messaging tool, a mailbox client, and/or social platform software, etc. (by way of example only).

The

terminal devices

101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (for example only) providing support for websites browsed by users using the

terminal devices

101, 102, 103. The background management server may analyze and perform other processing on the received data such as the user request, and feed back a processing result (e.g., a webpage, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that the training method of the anomaly detection model and the anomaly detection method provided by the embodiments of the present disclosure may be generally executed by the server 105. Accordingly, the training device of the anomaly detection model provided by the embodiment of the present disclosure, the anomaly detection device, may be generally disposed in the server 105. The training method and the abnormality detection method of the abnormality detection model provided by the embodiment of the present disclosure may also be executed by a server or a server cluster that is different from the server 105 and can communicate with the

terminal devices

101, 102, 103 and/or the server 105. Accordingly, the training device of the anomaly detection model and the anomaly detection device provided by the embodiment of the present disclosure may also be disposed in a server or a server cluster different from the server 105 and capable of communicating with the

terminal devices

101, 102, 103 and/or the server 105. Alternatively, the training method and the abnormality detection method of the abnormality detection model provided in the embodiment of the present disclosure may also be executed by the

terminal device

101, 102, or 103, or may also be executed by another terminal device different from the

terminal device

101, 102, or 103. Accordingly, the training apparatus of the anomaly detection model and the anomaly detection apparatus provided in the embodiments of the present disclosure may also be disposed in the

terminal device

101, 102, or 103, or disposed in another terminal device different from the

terminal device

101, 102, or 103.

It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

Fig. 2 schematically shows a flow chart of a training method of an anomaly detection model according to an embodiment of the present disclosure.

As shown in fig. 2, the method includes operations S210 to S230.

In operation S210, a multi-frame time series image is obtained, where the multi-frame time series image is generated by capturing a time series data display interface according to a preset frequency, the multi-frame time series image includes a target image and a historical image, the target image includes a data point to be detected, the historical image includes a historical data point before the data point to be detected, the data point to be detected has tag information, and the tag information represents an abnormal value of the data point to be detected.

According to the embodiment of the disclosure, the screen capture of the time series data and the capture of the high-quality pictures with rich information have important significance for the subsequent training of the anomaly detection model. Therefore, the window length and the screen capture frequency of the time series image are two key parameters.

The window length of the time sequence image is long, and abundant information can be obtained in one time sequence image captured at one time. However, if the window length of the time-series image is too long, it means that more time information is compressed within a limited length, and thus some key information is displayed insufficiently, finely and specifically, thereby causing a certain influence on subsequent feature extraction.

The time sequence image has shorter window length, which means that less data information is displayed in an equal length range, so that the data information can be displayed clearly in the time sequence image, and subsequent feature extraction is facilitated. However, if the screen capture window is too short, only a small amount of information can be contained in each frame of time sequence image, so that the information reaction is incomplete, and the data relationship between the previous time period and the next time period cannot be effectively established.

In addition, the window length of the time sequence image is too short, so that more screen shots are needed for completing the sampling of all data for the same time sequence data, and the number of the time sequence images is increased, thereby increasing the training amount.

Therefore, the appropriate window length is determined based on the expression characteristics and the trend of change of the time-series data. In one screen capture, complete historical data are ensured, data change within a certain length of time range can be reflected, change details of a key part can be displayed more finely, and subsequent feature extraction is facilitated.

At a certain length of the screen capture window, the screen capture frequency should be satisfied, and each data point in the time series data is captured at least once. That is, it is ensured that each data is utilized at least once for feature extraction and analysis without missing relevant information. In order to utilize each of the time series data as much as possible, the screen capture frequency may be appropriately increased, that is, the number of times of use of each data is greater than 1. In addition, when considering the utilization of each data for a plurality of times, the processing capability of the hardware should be combined to obtain the amount of time-series image processing matched with the existing hardware equipment.

In operation S220, a plurality of frames of time-series images are input into the anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on the data point to be detected in the target image according to the historical image, and outputs a prediction result, where the prediction result represents a predicted anomaly value of the data point to be detected.

According to the embodiment of the disclosure, the anomaly detection model to be trained can be a neural network model constructed based on deep learning, so that the anomaly detection model to be trained can perform anomaly detection on the data point to be detected in the target image according to the time information and the spatial information contained in the historical image.

According to the embodiment of the disclosure, the time sequence image is generated by directly performing screenshot on the time sequence data display interface, and data processing is not performed on the data in the time sequence data display interface, so that the time sequence image contains time sequence information in a certain fixed time period. The input data in the picture format can not only reflect the historical information of the time series data, but also intuitively reflect the distribution expression of the time series data in the angle observed by human eyes. In addition, by directly using the screen shot image of the input data for abnormality detection, steps of digital conversion, preprocessing, and the like for digital format data analysis can be omitted.

According to the embodiment of the disclosure, the screenshot image of the time sequence data is directly input as the anomaly detection model to be trained, so that the time characteristic and the space characteristic of the time sequence data can be well reserved, the feature extraction of the anomaly detection model on the time sequence data is facilitated, and effective information is provided for the subsequent time sequence analysis.

According to the embodiment of the present disclosure, the Neural Network model may include, for example, a combination of any one or more of a Convolutional Neural Network (CNN), a Recurrent Neural Network (RNN), and a Long Short-Term Memory Network (LSTM), but is not limited thereto, and may also be other Network models, such as a fully-connected Neural Network (DNN), and a person skilled in the art may design a Network structure of the anomaly detection model according to actual requirements.

In operation S230, network parameters of the anomaly detection model to be trained are iteratively adjusted according to the prediction result and the label information, and a trained anomaly detection model is generated.

In the embodiment of the disclosure, a multi-frame time sequence image is generated by capturing a time sequence data display interface at a preset frequency, and the multi-frame time sequence image includes a data point to be detected and a historical data point before the data point to be detected, so that the multi-frame time sequence image includes a spatial attribute and a time attribute of time sequence data, and the multi-frame time sequence image is processed by using an anomaly detection model, so that a detection result generated based on the spatial characteristic and the time sequence characteristic of the time sequence data can represent an abnormal value of the time sequence data. Therefore, the technical problem that the time attribute and the space attribute of the time sequence index cannot be simultaneously analyzed in the related technology is at least solved, and the detection accuracy of the abnormal detection is improved. Meanwhile, due to the fact that the preprocessing process of the time sequence image is omitted, the technical problems of high computation amount and high complexity of an abnormality detection method in the related technology can be at least partially solved, and the detection efficiency of time sequence data abnormality detection is improved.

According to the embodiment of the disclosure, the multi-frame time-series image generated by screenshot of the time-series data display interface according to the preset frequency comprises each data point of the time-series data display interface.

According to the embodiment of the disclosure, the multi-frame time sequence image comprises each data point of the time sequence data display interface, so that the abnormality detection model can detect each data point of the time sequence data display interface at least once, and the problem that the time sequence characteristics in the time sequence data display interface cannot be extracted due to missing data points can be avoided.

For example, the time-series image of each frame may be set to have a time-series image length of 30 minutes, and the preset frequency may be set to 10 minutes/time, that is, the time-series image with a frame time-series image length of 30 minutes is cut every 10 minutes. Thus, each data point can be acquired 3 times, except for the data points of the start frame time series image and the end frame time series image.

It should be understood that the above examples are only illustrative of the setting method of the preset frequency, and a person skilled in the art can set the preset frequency and the time segment length of the time sequence image in the multi-frame time sequence image according to actual requirements.

The method shown in fig. 2 is further described with reference to fig. 3-7 in conjunction with specific embodiments.

Fig. 3 schematically illustrates a flow diagram for generating a time series data display interface according to an embodiment of the disclosure.

As shown in fig. 3, the time-series data display interface is generated through operations S310 to S320.

In operation S310, an initial time-series data display interface is acquired, wherein the initial time-series data display interface includes a target time point and a historical time point before the target data point.

In operation S320, the data displayed on the initial time sequence data display interface is dynamically normalized according to the data value of the target time point and the maximum value and the minimum value of the data to be measured in the preset time period, so as to generate a time sequence data display interface.

According to an embodiment of the present disclosure, the preset time period is associated with a preset frequency.

According to the embodiment of the disclosure, the preset frequency of screenshot on the time series data display interface can be determined according to the preset time period. For example, the window length of each time-series image generated by screenshot of the time-series data display interface at a preset frequency may be equal to the preset time period.

According to the embodiment of the disclosure, before the screen capture of the time series data display interface, corresponding processing work can be performed on the data displayed in the initial time series data display interface to ensure that the current coordinates are adapted to the data in the current window, so that the main features can be expressed in detail in the captured picture, and the expression of some non-important details can be omitted.

In particular, the data is dynamically changing. The data peaks are different in different phases due to fluctuations in the data. If a fixed coordinatometer is used to represent data from the beginning to the end of a certain time series of data, the problem that the new data value is too large to be displayed completely due to the coordinatometer range may occur, and the detail cannot be displayed in detail due to the fact that the data dimension is far smaller than the coordinatometer in a certain time period may also occur. Therefore, a dynamic coordinate scale is required to meet the dynamic change characteristics of the data, and the data in different stages can be displayed in a detailed and proper manner.

The normalization operation on the data can not only avoid the scale problem mentioned above, but also reduce the influence of the data dimension on the result. Therefore, the dynamic normalization processing can be firstly performed on the initial time series data display interface to generate the time series data display interface, and then the screenshot can be performed on the time series data display interface.

In the embodiment of the disclosure, the data displayed on the initial time series data display interface can be dynamically normalized, that is, the data { x in the past n historical images can be utilized_t-n，...，x_t-2，x_t-1}(x_iWindow data representing the time i), and data x at the current time, and performing normalization processing on the data, the process of dynamic normalization in the embodiment of the disclosure may be represented by the following formula (1).

According to the embodiment of the disclosure, too large value of n may increase the resource demand of data storage and data calculation, and too small value of n may cause the problem of undesirable normalization effect.

According to an embodiment of the present disclosure, the value of n may depend on the window length and the screen capture frequency, for example, if the time series data is collected in the second level, the screen capture window length is 30 minutes, and the screen capture frequency is 10 minutes/time, then n may take a value of 10. Namely, 10 windows of data of past history are taken for normalization calculation.

Fig. 4 schematically shows a flowchart of inputting multiple frames of time-series images into an anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in a target image according to a historical image, and outputs a prediction result according to an embodiment of the present disclosure.

According to an embodiment of the present disclosure, an anomaly detection model to be trained includes a first feature extraction network, an attention network, and a second feature extraction network.

As shown in fig. 4, the method includes operations S410 to S430.

In operation S410, a plurality of frames of time-series images are input to a first feature extraction network, and a plurality of frames of first image data are output, wherein the plurality of frames of first image data include first target image data corresponding to a target image and first history image data corresponding to a history image.

In operation S420, a plurality of frames of first image data are input to the attention network, so that the attention network configures a weight parameter for the first history image data according to a correlation of the first history image data and the first target image data, and outputs the first target image data and the second history image data.

In operation S430, the first target image data and the second history image data are input to the second feature extraction network, and a prediction result is output.

Fig. 5 schematically shows a model structure diagram of a first feature extraction network according to an embodiment of the present disclosure.

As shown in fig. 5, the first feature extraction network 510 includes a first feature extraction layer 502, a second feature extraction layer 503, a third feature extraction 504, a fourth feature extraction 505, a flat layer (Flatten)506, and a Full Connection layer (Full Connection)507, which are sequentially cascaded. The first feature extraction layer 502 may include a first Convolution layer (contribution) and a first Batch Normalization layer (BN); the second feature extraction layer may include a first Pooling layer (Pooling) and a first discard layer (Dropout-DP); the third feature extraction layer 504 may include a second Convolution layer (contribution) and a second Batch Normalization layer (BN); the fourth feature extraction layer 504 may include a first Pooling layer (Pooling) and a first discard layer (Dropout-DP).

As shown in fig. 5, after the time-series image 501 is input into the first feature extraction network 510, the first feature extraction network 510 performs feature extraction on the time-series image 501 by using a first feature extraction layer 502, a second feature extraction layer 503, a third feature extraction layer 504, a fourth feature extraction layer 505, a flattening layer (scatter) 506, and a Full Connection layer (Full Connection)507, and may output first image data.

Fig. 6 schematically illustrates a schematic diagram of inputting multiple frames of time-series images into an anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in a target image according to a historical image, and outputs a prediction result according to an embodiment of the present disclosure.

In fig. 6, the time-series image 602, the time-series image 603, and the time-series image 604 may be time-series images generated by screenshot the time-series data display interface 601, wherein the time-series image 604 may be a target image, and the time-series image 602 and the time-series image 603 may be history images.

It should be noted that the number of time-series images shown in fig. 6 can be flexibly set by those skilled in the art according to actual needs, and is not limited to the number shown in fig. 6.

As shown in fig. 6, the time-series image 602, the time-series image 603, and the time-series image 604 may be input to a first feature extraction network, the first feature extraction network outputs a plurality of frames of first image data, and then the plurality of frames of first image data may be input to an attention network 605, and the attention network 605 may configure a weight parameter for the first history image data according to a correlation of the first history image data with the first target image data, and output the first target image data and the second history image data. Finally, the first target image data and the second historical image data may be input to a second feature extraction network, outputting the prediction result.

According to the embodiment of the present disclosure, by introducing an attention network between a first feature extraction network and a second feature extraction network, a plurality of first historical image data within a certain time period output by the first feature extraction network are assigned with weights, so that the first historical image data which has a larger contribution to the input at the next time is given a larger weight, and the first historical image data which has a weaker correlation with the input at the next time and has a smaller contribution to the anomaly detection is assigned with a smaller weight. By means of the attention mechanism, effective information can be extracted, data with poor importance are ignored, and efficiency is improved.

According to an embodiment of the present disclosure, inputting a plurality of frames of first image data into an attention network so that the attention network configures a weight parameter for the first history image data according to a correlation of the first history image data with the first target image data, outputting the first target image data and the second history image data includes the following operations:

similarity calculation is carried out on the first historical image data and the first target image data, and a similarity result is generated;

generating a first weight parameter according to the similarity result;

and generating second historical image data according to the first weight parameter and the first historical image data.

For n first image data F ═ (F1, F2.., fn) output by the first feature extraction network, correlations Ci with the data features of the first target image data may be calculated, respectively. The correlation calculation may be performed by selecting an euclidean distance and manhattan distance equidistant calculation method, such as C1 ═ C (f1, fn), C2 ═ C (f2, fn), where C may represent a correlation calculation function, such as the above-mentioned euclidean distance or manhattan distance. According to the result of the correlation, namely the importance degree of the data judgment of the current time, the n characteristics are respectively weighted correspondingly. The weight assignment method may be a linear assignment method or a softmax method. For example, the assignment may be done in a linear fashion, with the weight parameters calculated as follows:

and the corresponding product of the original feature data F and the weight parameter W is the input of the second feature extraction network under the action of the attention machine.

Due to the particularity of the time series data abnormity judgment, the abnormity judgment at the current time has an inseparable relation with the historical data. Meanwhile, the contribution values of the historical data to the current time abnormity discrimination are greatly different. And the attention can be well focused on the core input through an attention mechanism, and more effective information is extracted.

Fig. 7 schematically shows a flowchart for iteratively adjusting network parameters of an anomaly detection model to be trained according to a prediction result and label information to generate a trained anomaly detection model according to an embodiment of the present disclosure.

As shown in fig. 7, the method includes operations S710 to S720.

In operation S710, the prediction result and the tag information are input to a loss function, and a loss result is output.

In operation S720, network parameters of the anomaly detection model to be trained are iteratively adjusted according to the loss result, and a trained anomaly detection model is generated.

According to an embodiment of the present disclosure, a training process of the abnormality detection model may be represented by the following table (1).

Watch (1)

According to an embodiment of the present disclosure, the first feature extraction network may be constructed based on a convolutional neural network. The convolutional neural network CNN can perform feature extraction on format data such as pictures. Therefore, through the CNN network, the effective spatial features in the time-series image can be extracted and analyzed, which is beneficial to the subsequent analysis processing.

Specifically, the shared convolution kernel in the CNN network performs nonlinear operations such as convolution with pixel information in a picture in a point-by-point scanning manner, so that spatial morphological characteristics of data in an original time sequence can be effectively extracted. The parameters of the convolution kernel can be updated by back propagation.

According to an embodiment of the present disclosure, the second feature extraction network may be constructed based on a long-short term memory network. The LSTM network can effectively analyze and process time series data and has better performance on historical dependency data analysis with larger front-back correlation. In the abnormality classification of the time-series data, the context abnormality and the section abnormality are determined based on the characteristics of the history data, that is, the abnormality determination at the next time depends on the expression of the history data. Therefore, by means of the LSTM extraction of the history information, the history data expression can be effectively combined to determine whether the data to be detected is abnormal or not.

The information obtained through the CNN network and the attention network represents the feature extraction of historical data which is relatively related to the data point to be detected. The input information of a plurality of numbers is combined with the data point to be detected, and the output result is obtained through the selective input and forgetting of the LSTM. The output represents a feature extraction of the data point to be measured based on the historical information analysis.

The abnormity discrimination of the time series data has strong relevance with the historical data, namely the time dependence is obvious. By utilizing the processes of extraction, screening, memorizing and transmitting of the LSTM on the historical information and the selection function of the attention network on the image data, the information which is useful for the data abnormity detection at the current moment can be well extracted. The parameters of each logic gate in the LSTM network can be updated by back-propagating the gradient that minimizes the objective function.

Fig. 8 schematically shows a flow chart of an anomaly detection method according to an embodiment of the present disclosure.

As shown in fig. 8. The abnormality detection method includes operations S810 to S820.

In operation S810, an image to be measured is acquired, wherein the image to be measured includes time-series data.

In operation S820, the image to be detected is input into the anomaly detection model, and a detection result is output, where the detection result represents an anomaly value of the time point to be detected in the image to be detected, and the anomaly detection model is obtained by training the anomaly detection model provided in the embodiment of the present disclosure.

Fig. 9 schematically shows a block diagram of a training apparatus of an anomaly detection model according to an embodiment of the present disclosure.

As shown in fig. 9, the training apparatus 900 of the anomaly detection model may include a first obtaining module 910, a predicting module 920, and a training module 930.

The first obtaining module 910 is configured to obtain a multi-frame time sequence image, where the multi-frame time sequence image is generated by capturing a time sequence data display interface according to a preset frequency, the multi-frame time sequence image includes a target image and a historical image, the target image includes a data point to be detected, the historical image includes a historical data point before the data point to be detected, the data point to be detected has tag information, and the tag information represents an abnormal value of the data point to be detected.

The prediction module 920 is configured to input the multi-frame time sequence image into the anomaly detection model to be trained, so that the anomaly detection model to be trained performs anomaly detection on a data point to be detected in the target image according to the historical image, and outputs a prediction result, where the prediction result represents a predicted anomaly value of the data point to be detected.

And the training module 930 is configured to iteratively adjust network parameters of the anomaly detection model to be trained according to the prediction result and the label information, and generate a trained anomaly detection model.

According to an embodiment of the present disclosure, wherein the anomaly detection model to be trained includes a first feature extraction network, an attention network, and a second feature extraction network.

According to an embodiment of the present disclosure, the training module 930 includes a first input submodule, a second input submodule, and a third input submodule.

And the first input submodule is used for inputting a plurality of frames of time sequence images into the first feature extraction network and outputting a plurality of frames of first image data, wherein the plurality of frames of first image data comprise first target image data corresponding to the target images and first historical image data corresponding to the historical images.

And the second input submodule is used for inputting the first image data of multiple frames into the attention network, so that the attention network configures weight parameters for the first historical image data according to the correlation between the first historical image data and the first target image data, and outputs the first target image data and the second historical image data.

And the third input submodule is used for inputting the first target image data and the second historical image data into a second feature extraction network and outputting a prediction result.

According to an embodiment of the present disclosure, the second input submodule includes a similarity calculation unit, a first generation unit, and a second generation unit.

And the similarity calculation unit is used for calculating the similarity of the first historical image data and the first target image data and generating a similarity result.

And the first generating unit is used for generating a first weight parameter according to the similarity result.

And the second generating unit is used for generating second historical image data according to the first weight parameter and the first historical image data.

According to an embodiment of the present disclosure, the training module 930 includes a first input module and a first generation module.

And the first input module is used for inputting the prediction result and the label information into a loss function and outputting a loss result.

And the first generation module is used for iteratively adjusting the network parameters of the abnormal detection model to be trained according to the loss result and generating the trained abnormal detection model.

According to the embodiment of the disclosure, the time series data display interface is generated through the second acquisition module and the dynamic normalization module.

And the second acquisition module is used for acquiring an initial time series data display interface, wherein the initial time series data display interface comprises a target time point and a historical time point before the target data point.

And the dynamic normalization module is used for dynamically normalizing the data displayed on the initial time sequence data display interface according to the data value of the target time point and the maximum value and the minimum value of the data to be detected in the preset time period to generate the time sequence data display interface.

Fig. 10 schematically shows a block diagram of an abnormality detection apparatus according to an embodiment of the present disclosure.

As shown in fig. 10, the abnormality detection apparatus 1000 may include a second acquisition module 1010 and a detection module 1020.

The second obtaining module 1010 is configured to obtain an image to be detected, where the image to be detected includes time-series data.

The detection module 1020 is configured to input the image to be detected into the anomaly detection model, and output a detection result, where the detection result represents an anomaly value of a time point to be detected in the image to be detected, and the anomaly detection model is obtained by training the anomaly detection model provided in the embodiment of the present disclosure.

It should be noted that, the embodiments of the apparatus portion of the present disclosure correspond to the same or similar embodiments of the method portion of the present disclosure, and the detailed description of the present disclosure is omitted here.

Any number of modules, sub-modules, units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units according to the embodiments of the present disclosure may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging the circuit, or in any one of three implementations of software, hardware, and firmware, or in any suitable combination of any of them. Alternatively, one or more of the modules, sub-modules, units according to embodiments of the disclosure may be implemented at least partly as computer program modules, which, when executed, may perform corresponding functions.

For example, any plurality of the first obtaining module 910, the predicting module 920, the training module 930, the second obtaining module 1010 and the detecting module 1020 may be combined and implemented in one module/unit/sub-unit, or any one of the modules/units/sub-units may be split into a plurality of modules/units/sub-units. Alternatively, at least part of the functionality of one or more of these modules/units/sub-units may be combined with at least part of the functionality of other modules/units/sub-units and implemented in one module/unit/sub-unit. According to an embodiment of the present disclosure, at least one of the first obtaining module 910, the predicting module 920, the training module 930, the second obtaining module 1010, and the detecting module 1020 may be at least partially implemented as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented by hardware or firmware in any other reasonable manner of integrating or packaging a circuit, or implemented by any one of three implementations of software, hardware, and firmware, or an appropriate combination of any several of them. Alternatively, at least one of the first obtaining module 910, the predicting module 920, the training module 930, the second obtaining module 1010 and the detecting module 1020 may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

FIG. 11 schematically illustrates a block diagram of a computer system suitable for implementing the above-described method, according to an embodiment of the present disclosure. The computer system illustrated in FIG. 11 is only one example and should not impose any limitations on the scope of use or functionality of embodiments of the disclosure.

As shown in fig. 11, a computer system 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1102 or a program loaded from a storage section 1108 into a Random Access Memory (RAM) 1103. The processor 1101 may comprise, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 1101 may also include on-board memory for caching purposes. The processor 1101 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to the embodiments of the present disclosure.

In the RAM 1103, various programs and data necessary for the operation of the computer system 1100 are stored. The processor 1101, the ROM 1102, and the RAM 1103 are connected to each other by a bus 1104. The processor 1101 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 1102 and/or the RAM 1103. It is to be noted that the programs may also be stored in one or more memories other than the ROM 1102 and the RAM 1103. The processor 1101 may also perform various operations of the method flows according to the embodiments of the present disclosure by executing programs stored in the one or more memories.

Computer system 1100 may also include an input/output (I/O) interface 1105, also connected to bus 1104, according to an embodiment of the disclosure. The system 1100 may also include one or more of the following components connected to the I/O interface 1105: an input portion 1106 including a keyboard, mouse, and the like; an output portion 1107 including a signal output unit such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 1108 including a hard disk and the like; and a communication section 1109 including a network interface card such as a LAN card, a modem, or the like. The communication section 1109 performs communication processing via a network such as the internet. A driver 1110 is also connected to the I/O interface 1105 as necessary. A removable medium 1111 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1110 as necessary, so that a computer program read out therefrom is mounted into the storage section 1108 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 1109 and/or installed from the removable medium 1111. The computer program, when executed by the processor 1101, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples may include, but are not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 1102 and/or the RAM 1103 and/or one or more memories other than the ROM 1102 and the RAM 1103 described above.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A training method of an anomaly detection model comprises the following steps:

inputting a plurality of frames of time sequence images into an anomaly detection model to be trained so that the anomaly detection model to be trained can perform anomaly detection on a data point to be detected in the target image according to the historical image and output a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and

and iteratively adjusting the network parameters of the abnormal detection model to be trained according to the prediction result and the label information to generate the trained abnormal detection model.

2. The method of claim 1, wherein the anomaly detection model to be trained comprises a first feature extraction network, an attention network, and a second feature extraction network;

inputting a plurality of frames of the time sequence images into an anomaly detection model to be trained so that the anomaly detection model to be trained can perform anomaly detection on a data point to be detected in the target image according to the historical image, and outputting a prediction result comprises:

inputting a plurality of frames of the time-series images into the first feature extraction network, and outputting a plurality of frames of first image data, wherein the plurality of frames of first image data comprise first target image data corresponding to the target image and first historical image data corresponding to the historical image;

inputting a plurality of frames of the first image data into the attention network, so that the attention network configures a weight parameter for first historical image data according to the correlation between the first historical image data and the first target image data, and outputs the first target image data and second historical image data;

and inputting the first target image data and the second historical image data into the second feature extraction network, and outputting the prediction result.

3. The method of claim 2, wherein the inputting a plurality of frames of the first image data into the attention network so that the attention network configures a weight parameter for the first historical image data according to a correlation of the first historical image data and the first target image data, the outputting the first target image data and the second historical image data comprises:

generating a first weight parameter according to the similarity result;

and generating the second historical image data according to the first weight parameter and the first historical image data.

4. The method of claim 1, wherein,

iteratively adjusting and training network parameters of the abnormal detection model to be trained according to the prediction result and the label information, and generating the trained abnormal detection model comprises:

5. The method of claim 1, the time series data display interface generated by:

acquiring an initial time-series data display interface, wherein the initial time-series data display interface comprises a target time point and a historical time point before the target data point;

and dynamically normalizing the data displayed on the initial time sequence data display interface according to the data value of the target time point and the maximum value and the minimum value of the data to be detected in a preset time period to generate the time sequence data display interface.

6. The method of claim 5, wherein the preset time period is associated with the preset frequency.

7. The method of claim 1, wherein the multi-frame time-series image generated by screenshot of the time-series data display interface according to a preset frequency comprises each data point of the time-series data display interface.

8. An anomaly detection method comprising:

inputting the image to be detected into an anomaly detection model and outputting a detection result, wherein the detection result represents an anomaly value of a time point to be detected in the image to be detected, and the anomaly detection model is obtained by training the method for training the anomaly detection model according to any one of claims 1 to 7.

9. An abnormality detection model training apparatus, comprising:

the device comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring a plurality of frames of time sequence images, the plurality of frames of time sequence images are generated by capturing a time sequence data display interface according to a preset frequency, the plurality of frames of time sequence images comprise a target image and a historical image, the target image comprises a data point to be detected, the historical image comprises a historical data point before the data point to be detected, the data point to be detected has label information, and the label information represents an abnormal value of the data point to be detected;

the prediction module is used for inputting a plurality of frames of time sequence images into an abnormal detection model to be trained so that the abnormal detection model to be trained can carry out abnormal detection on a data point to be detected in the target image according to the historical image and output a prediction result, wherein the prediction result represents a prediction abnormal value of the data point to be detected; and

10. An abnormality detection device comprising:

a detection module, configured to input the image to be detected into an anomaly detection model, and output a detection result, where the detection result represents an abnormal value at a time point to be detected in the image to be detected, and the anomaly detection model is trained by the training method of the anomaly detection model according to any one of claims 1 to 7.

11. A computer system, comprising:

one or more processors;

a memory for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-7 or the method of claim 8.

12. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to carry out the method of any one of claims 1 to 7, or carry out the method of claim 8.