CN115345279A - Multi-index abnormality detection method and device, electronic equipment and storage medium - Google Patents
Multi-index abnormality detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN115345279A CN115345279A CN202210957324.9A CN202210957324A CN115345279A CN 115345279 A CN115345279 A CN 115345279A CN 202210957324 A CN202210957324 A CN 202210957324A CN 115345279 A CN115345279 A CN 115345279A
- Authority
- CN
- China
- Prior art keywords
- index
- encoder
- data
- learning layer
- sample data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 87
- 230000005856 abnormality Effects 0.000 title claims abstract description 37
- 239000011159 matrix material Substances 0.000 claims abstract description 85
- 238000000034 method Methods 0.000 claims abstract description 40
- 230000008569 process Effects 0.000 claims abstract description 11
- 239000013598 vector Substances 0.000 claims description 37
- 238000005070 sampling Methods 0.000 claims description 26
- 239000000835 fiber Substances 0.000 claims description 7
- 230000001360 synchronised effect Effects 0.000 claims description 7
- 238000004590 computer program Methods 0.000 claims description 5
- 239000013307 optical fiber Substances 0.000 description 11
- 238000010586 diagram Methods 0.000 description 10
- 230000004044 response Effects 0.000 description 8
- 238000004891 communication Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 230000002159 abnormal effect Effects 0.000 description 4
- 230000004913 activation Effects 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 3
- 125000004122 cyclic group Chemical group 0.000 description 3
- 238000010606 normalization Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 230000006978 adaptation Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000003190 augmentative effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Molecular Biology (AREA)
- Artificial Intelligence (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Image Analysis (AREA)
Abstract
The disclosure provides a multi-index abnormality detection method and device, electronic equipment and a storage medium, and relates to the technical field of data processing. The method comprises the following steps: acquiring multi-index data to be detected; the method comprises the steps that a target self-encoder is obtained, the target self-encoder comprises a graph learning layer, the graph learning layer is used for generating an adjacent matrix corresponding to multiple indexes according to a distance matrix corresponding to the multiple indexes, and the target self-encoder processes multi-index data to be detected according to the adjacent matrix; and carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result. Meanwhile, the relevance among different indexes is considered when the multi-index data to be detected comprising a plurality of indexes is detected, so that the detection result is more accurate and effective.
Description
Technical Field
The present disclosure relates to the field of data processing technologies, and in particular, to a method and an apparatus for detecting multiple index anomalies, an electronic device, and a storage medium.
Background
In the technical field of data processing, some important index data are subjected to anomaly detection, and the anomaly condition of equipment, or a network or other information behind generating the index data can be quickly determined according to the anomaly detection result. For example, by detecting an abnormality in the index of the download speed of the optical fiber broadband user, it can be determined whether the operation of the optical fiber broadband is abnormal.
In the related art, a plurality of different self-encoders are respectively trained by using sample data of different indexes, and anomaly detection is performed on the corresponding indexes according to the trained self-encoders, that is, one self-encoder is used for anomaly detection on one index.
And different indexes are subjected to abnormal detection by using different self-codes, so that the accuracy of the detection result is low.
It is to be noted that the information disclosed in the above background section is only for enhancement of understanding of the background of the present disclosure, and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
The disclosure provides a multi-index anomaly detection method, a multi-index anomaly detection device, an electronic device and a storage medium, which overcome the problem of low accuracy of detection results in the related art at least to a certain extent.
Additional features and advantages of the disclosure will be set forth in the detailed description which follows, or in part will be obvious from the description, or may be learned by practice of the disclosure.
According to one aspect of the present disclosure, there is provided a multi-index abnormality detection method, including: acquiring multi-index data to be detected; acquiring a target self-encoder, wherein the target self-encoder comprises an image learning layer, the image learning layer is used for generating an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the data of the multiple indexes to be detected according to the adjacent matrix; and carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments of the disclosure, the acquisition target self-encoder comprises: acquiring sample data of each index in the multiple indexes at multiple moments; generating a feature vector corresponding to each index according to the sample data of each index at a plurality of moments; calculating the target distance between the characteristic vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacency matrix; constructing an initial self-encoder according to the graph learning layer; and training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the present disclosure, the generating, according to sample data of each indicator at multiple time instants, a feature vector corresponding to each indicator includes: standardizing sample data of each index at a plurality of moments to obtain standardized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments; and generating a feature vector corresponding to each index according to the average value.
In some embodiments of the present disclosure, the calculating a target distance between feature vectors corresponding to each index to obtain the distance matrix includes: and calculating cosine distances among the characteristic vectors corresponding to the indexes to obtain a cosine distance matrix.
In some embodiments of the present disclosure, the building an initial autoencoder from the graph learning layer includes: constructing a graph convolution layer according to the adjacent matrix output by the graph learning layer; constructing a cycle time-space learning layer, wherein the cycle time-space learning layer takes the output data of the graph convolution layer as input data; and constructing the initial self-encoder according to a space-time learning layer consisting of the graph convolution layer and the circulating space-time learning layer.
In some embodiments of the present disclosure, before generating a feature vector corresponding to each indicator according to sample data of each indicator at multiple times, the method further includes: detecting sample data corresponding to each index, and determining a missing segment of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; under the condition that the comparison result is that the length of the missing segment is smaller than the length threshold, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; performing synchronous data interpolation on the missing segment to obtain sample data corresponding to each interpolated index under the condition that the comparison result shows that the length of the missing segment is not smaller than the length threshold; the contemporaneous data are obtained by sampling the same index from corresponding sampling objects at the same time of different dates.
In some embodiments of the present disclosure, the multiple metrics include multiple ones of the metrics corresponding to the fiber bandwidth.
According to another aspect of the present disclosure, there is provided a multi-index abnormality detection apparatus including: the acquisition module is used for acquiring multi-index data to be detected; the acquisition module is further configured to acquire a target self-encoder, where the target self-encoder includes a graph learning layer, the graph learning layer is configured to generate an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple index data to be detected according to the adjacent matrix; and the detection module is used for carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments of the present disclosure, the obtaining module is configured to obtain sample data of each of the multiple indexes at multiple times; generating a feature vector corresponding to each index according to the sample data of each index at a plurality of moments; calculating the target distance between the characteristic vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacency matrix; constructing an initial self-encoder according to the graph learning layer; and training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the present disclosure, the obtaining module is configured to normalize sample data of each index at multiple times to obtain normalized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments; and generating a characteristic vector corresponding to each index according to the average value.
In some embodiments of the disclosure, the obtaining module is configured to calculate cosine distances between feature vectors corresponding to each index, so as to obtain a cosine distance matrix.
In some embodiments of the present disclosure, the obtaining module is configured to construct a graph convolutional layer according to an adjacency matrix output by the graph learning layer; constructing a cycle space-time learning layer, wherein the cycle space-time learning layer takes the output data of the graph convolution layer as input data; and constructing the initial self-encoder according to a space-time learning layer consisting of the graph convolution layer and the circulating space-time learning layer.
In some embodiments of the present disclosure, the detection module is further configured to detect sample data corresponding to each index, and determine a missing segment of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; the device further comprises: the interpolation module is used for performing linear interpolation on the missing segment under the condition that the comparison result shows that the length of the missing segment is smaller than the length threshold value, so as to obtain sample data corresponding to each index after interpolation; performing synchronous data interpolation on the missing segment to obtain sample data corresponding to each interpolated index under the condition that the comparison result shows that the length of the missing segment is not smaller than the length threshold; the contemporaneous data are data obtained by sampling the same index from corresponding sampling objects at the same time on different dates.
In some embodiments of the present disclosure, the multiple metrics include multiple ones of the fiber bandwidth corresponding metrics.
According to still another aspect of the present disclosure, there is provided an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the multi-index anomaly detection methods described above via execution of the executable instructions.
According to yet another aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the multi-index abnormality detection method of any one of the above.
According to yet another aspect of the present disclosure, there is provided a computer program product comprising a computer program or computer instructions, which is loaded and executed by a processor, to cause a computer to implement any of the above-mentioned multi-index anomaly detection methods.
The technical scheme provided by the embodiment of the disclosure at least comprises the following beneficial effects:
according to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of simultaneously detecting multiple indexes is obtained to perform anomaly detection on the multi-index data to be detected. Meanwhile, the relevance among different indexes is considered when the multi-index data to be detected comprising a plurality of indexes is detected, so that the detection result is more accurate and effective.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure. It is to be understood that the drawings in the following description are merely exemplary of the disclosure, and that other drawings may be derived from those drawings by one of ordinary skill in the art without the exercise of inventive faculty.
FIG. 1 is a schematic diagram illustrating a multi-index anomaly detection system in an embodiment of the present disclosure;
FIG. 2 illustrates a flow diagram of a multi-index anomaly detection method in one embodiment of the present disclosure;
FIG. 3 shows a flow diagram of a method of obtaining a target autoencoder in one embodiment of the present disclosure;
FIG. 4 is a schematic diagram of an initial self-encoder according to an embodiment of the present disclosure;
FIG. 5 is a schematic structural diagram of a target self-encoder according to an embodiment of the present disclosure;
FIG. 6 is a flow diagram of a method for multi-index anomaly detection in another embodiment of the present disclosure;
FIG. 7 is a schematic diagram illustrating a multi-index anomaly detection apparatus according to an embodiment of the present disclosure;
fig. 8 shows a block diagram of an electronic device in an embodiment of the present disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and a repetitive description thereof will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.
Fig. 1 illustrates a multi-index abnormality detection system in an embodiment of the present disclosure, to which a multi-index abnormality detection method or a multi-index abnormality detection apparatus in an embodiment of the present disclosure may be applied.
As shown in fig. 1, the multi-index abnormality detection system may include: index data generation device 101, abnormality detection device 102.
Among them, the index data generation device 101 may generate data corresponding to a plurality of kinds of indices, and may actively or passively transmit the generated index data to the abnormality detection device 102. The abnormality detection device 102 may receive the index data transmitted from the index data generation device 101, the abnormality detection device 102 may train a self-encoder based on the index data, and the abnormality detection device 102 may perform abnormality detection on the index data.
The index data generation device 101 and the abnormality detection device 102 may be connected in communication via a network. The network may be a wired network or a wireless network.
Optionally, the wireless or wired networks described above use standard communication techniques and/or protocols. The Network is typically the Internet, but may be any Network including, but not limited to, a Local Area Network (LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a mobile, wireline or wireless Network, a private Network, or any combination of virtual private networks. In some embodiments, data exchanged over a network is represented using techniques and/or formats including Hypertext Mark-up Language (HTML), extensible markup Language (XML), and the like. All or some of the links may also be encrypted using conventional encryption techniques such as Secure Socket Layer (SSL), transport Layer Security (TLS), virtual Private Network (VPN), internet protocol Security (IPsec), and so on. In other embodiments, custom and/or dedicated data communication techniques may also be used in place of, or in addition to, the data communication techniques described above.
The metric data generation device 101 and the abnormality detection device 102 may be various electronic devices including, but not limited to, a smartphone, a tablet, a laptop, a desktop computer, an augmented reality device, a virtual reality device, and the like.
The abnormality detection device 102 may be a server, which may be a server that provides various services. Optionally, the server may be an independent physical server, may also be a server cluster or a distributed system formed by a plurality of physical servers, and may also be a cloud server that provides basic cloud computing services such as cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a web service, cloud communication, middleware service, a domain name service, a security service, a CDN (Content Delivery Network), and a big data and artificial intelligence platform.
The present exemplary embodiment will be described in detail below with reference to the drawings and examples.
The embodiment of the present disclosure provides a multi-index abnormality detection method, where the method may be executed by any electronic device with computing processing capability, and the electronic device may be an abnormality detection device, an index data generation device, or a device executed by both the index data generation device and the abnormality detection device, which is not limited in this disclosure. In the case that the multi-index abnormality detection method is executed by the abnormality detection device and the index data generation device together, the abnormality detection device may undertake a main calculation task, the index data generation device may undertake a main calculation task, or the abnormality detection device and the index data generation device may undertake a calculation task together.
Fig. 2 shows a flowchart of a multi-index abnormality detection method in an embodiment of the present disclosure, and as shown in fig. 2, the multi-index abnormality detection method provided in the embodiment of the present disclosure includes the following steps S201 to S203.
S201, acquiring multi-index data to be detected.
The multi-index data to be detected comprises data to be detected corresponding to multiple indexes. In some embodiments, there is a correlation between multiple indexes corresponding to the multi-index data to be detected. For example, the multiple indexes corresponding to the multi-index data to be detected are multiple indexes in the indexes corresponding to the optical fiber broadband, and for example, the multiple indexes may include multiple indexes in the indexes corresponding to the optical fiber broadband user, such as a download rate, a first packet response delay, a first screen delay, and an access success rate. How to acquire the multi-index data to be detected is not limited in the embodiments of the present disclosure. For example, the multi-index data to be detected is generated by the index data generation device, and the multi-index abnormality detection method provided by the embodiment of the present disclosure is executed by the abnormality detection device, and at this time, acquiring the multi-index data to be detected may include: and the index data generation equipment actively or passively sends the multi-index data to be detected to the abnormality detection equipment.
S202, a target self-encoder is obtained, the target self-encoder comprises a graph learning layer, the graph learning layer is used for generating an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the data of the multiple indexes to be detected according to the adjacent matrix.
In some embodiments, the target self-encoder is a self-encoder that completes training, and the sample data of the target self-encoder that is trained includes the same index as the index included in the multi-index data to be detected. In some embodiments, the target self-encoder includes a graph learning layer for generating a multi-index corresponding adjacency matrix from a multi-index corresponding distance matrix. Here, the graph learning layer may be expressed using the following formula 1.
A = ReLU (tanh (E) } (equation 1)
Wherein, E is a distance matrix corresponding to multiple indexes, θ is a parameter corresponding to a graph learning layer, tanh is an activation function, reLU is an activation function, and a is an adjacent matrix corresponding to multiple indexes.
The target self-encoder comprises a graph learning layer which is a trained graph learning layer, so that the adjacency matrix output by the graph learning layer is a trained adjacency matrix. And the target self-encoder processes the multi-index data to be detected according to the adjacency matrix output by the graph learning layer.
And S203, carrying out abnormity detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments, performing anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result may include: inputting the multi-index data to be detected into a target self-encoder, reconstructing the multi-index data to be detected by the target self-encoder and outputting reconstructed data; calculating percentage errors of the multi-index data to be detected and the reconstruction data on each index data; and comparing the percentage error with a set threshold value to obtain a detection result. The threshold value is set, and the embodiment of the present disclosure is not limited and may be set empirically. For example, the threshold is set to 5%, or the threshold is set to 3%.
For example, the threshold is set to be 5%, and the multi-index data to be detected includes data obtained by sampling the download rate, the first packet response delay, the first screen delay and the access success rate of one optical fiber broadband user at three times. In reconstructed data of multi-index data to be detected after reconstruction by a target self-encoder, the percentage error between the downloading speed at the moment 1 and the downloading speed of the multi-index data to be detected at the moment 1 is 6%; the percentage error between the downloading speed at the moment 2 and the downloading speed of the multi-index data to be detected at the moment 2 is 3 percent; the percentage error between the download speed at the time 3 and the download speed of the multi-index data to be detected at the time 3 is 4%. Since the data downloading speed of the multi-index data to be detected at the time 1 is determined to be abnormal, that is, the detection result includes that the data downloading speed of the multi-index data to be detected at the time 1 is abnormal, 6% >5%,3% <5%, and 4% < 5%.
According to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of simultaneously detecting multiple indexes is obtained to perform anomaly detection on the multi-index data to be detected. Meanwhile, the relevance among different indexes is considered in the detection of the multi-index data to be detected comprising the indexes, so that the detection result is more accurate and effective, the target self-encoder is used for detecting the index data simultaneously, the self-encoders for detecting the different indexes are prevented from being trained, and the difficulty in training the self-encoders is reduced. In addition, the graph learning layer included in the target self-encoder generates the adjacent matrix by using the distance matrix corresponding to the multiple indexes, so that the training difficulty of the target self-encoder is reduced, and the target self-encoder is easier to converge during training.
In an embodiment of the present disclosure, a method of acquiring a target self-encoder is provided, and as shown in fig. 3, the method of acquiring a target self-encoder provided by an embodiment of the present disclosure includes the following steps S301 to S306.
S301, sample data of each index in the multiple indexes at multiple moments is obtained.
In some embodiments, the sample data is acquired in the same manner as that of acquiring the multi-index data to be detected in S201 in the embodiment corresponding to fig. 2. At one of the multiple times, the sample data corresponding to one of the multiple indexes includes sample data obtained by sampling the multiple sampling objects. For example, at time t, the jth index is sampled from the sampling object with number i to obtain one sample data
For example, the multi-index is a plurality of indexes among indexes corresponding to the fiber broadband. For another example, the multiple indexes include four indexes, that is, a download rate, a first packet response delay, a first screen delay, and an access success rate, corresponding to the optical fiber broadband user, where the download rate is the 1 st index, the first packet response delay is the 2 nd index, the first screen delay is the 3 rd index, and the access success rate is the 4 th index. The sampling object comprises 10 fiber broadband users, and the plurality of time instants comprises 10 time instants. In this case, the sample data of each index at a plurality of times among the plurality of indexes includes (X) 1 ,X 2 ,…X 10 )，X t And the sample data obtained by sampling 4 indexes of 10 fiber broadband users at t time is shown. X t Included
Wherein i is an integer of 1 to 10, j is an integer of 1 to 4,
and the sample data obtained by sampling the first packet response time delay of the second optical fiber broadband user at the moment t is shown.
And S302, generating a feature vector corresponding to each index according to the sample data of each index at a plurality of moments.
How to process the sample data to obtain the feature vector of each index is not limited in the embodiments of the present disclosure. For example, a convolutional neural network processing method may be used to extract a feature vector of each index from sample data of each index at multiple times. The feature vectors of the respective indexes may be generated by performing mathematical processing. In some embodiments, generating a feature vector corresponding to each index according to sample data of each index at multiple time instants may include: standardizing sample data of each index at multiple moments to obtain standardized sample data; calculating the average value of the index data corresponding to each index in the standardized sample data at each moment in a plurality of moments; and generating a feature vector corresponding to each index according to the average value.
Normalization refers to scaling data of different orders of magnitude to the same order of magnitude, and regarding which normalization manner is adopted, the embodiment of the present disclosure is not limited, for example, the maximum value and the minimum value of each sample may be determined in sample data; and then standardizing the sample data of each index at a plurality of moments according to the following formula 2 to obtain standardized sample data.
Wherein, the first and the second end of the pipe are connected with each other,
for the data obtained by sampling the jth index of the ith sampling object at t time, x jMAX Is the maximum value, x, in the sample data corresponding to the jth index jMIN The minimum value in the sample data corresponding to the jth index,
is composed of
The normalized data, a is a set coefficient, and regarding a specific value of a, the embodiment of the present disclosure is not limited, for example, the value of a is 1.
In some embodiments, the plurality of time instants includes T time instants, that is, T is an integer of 1-T; the multiple indexes comprise W indexes, namely j takes an integer of 1-W; the plurality of sample objects comprises N sample objects, that is, i takes on an integer of 1 to N. At this time, by calculating an average value of each index in the normalized sample data at each time, the obtained feature vector corresponding to each index can be expressed by the following formula 3.
Wherein, the first and the second end of the pipe are connected with each other,
indicating that the jth index of the ith sampling object corresponds to the normalized sample data at the 1 st time; v j And representing the feature vector corresponding to the j index.
In another embodiment, the sample data of each acquired index at multiple time instants has a defect of partial sample data. For example, the jth index continuously lacks t at the ith sample object 1 、t 2 And t 3 Sample data at three moments in total. In this case, the missing data needs to be interpolated. In another embodiment, before generating a feature vector corresponding to each index according to sample data of each index at multiple times, the method further includes: detecting sample data corresponding to each index, and determining a missing segment of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; under the condition that the length of the missing segment is smaller than the length threshold value according to the comparison result, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; in the case that the length of the missing segment is not less than the length threshold value as a result of the comparisonPerforming synchronous data interpolation on the missing segments to obtain sample data corresponding to each index after interpolation; the contemporaneous data is data obtained by sampling the same index from the corresponding sampling object at the same time on different dates.
The length threshold is a set value, and the specific value of the length threshold is not limited in the embodiments of the present disclosure, for example, the length threshold is 3. In one embodiment, the linear interpolation is to calculate a straight line where sample data at two ends of a missing segment are located, bring a time corresponding to the missing segment into the straight line to obtain data at the missing time, and interpolate the data at the missing time into the missing segment. In one embodiment, the synchronous data interpolation is to interpolate synchronous data corresponding to a missing segment as data corresponding to the missing segment.
By interpolating the sample data of each index at a plurality of moments, the influence on the detection caused by the missing segment of the sample data can be avoided.
And S303, calculating the target distance between the characteristic vectors corresponding to the indexes to obtain a distance matrix.
As to what distance the target distance between the feature vectors corresponding to each index is, the embodiments of the present disclosure are not limited, for example, the target distance is a cosine distance. In some embodiments, calculating the target distance between the feature vectors of the respective indexes to obtain the distance matrix may include: and calculating cosine distances among the characteristic vectors corresponding to the indexes to obtain a cosine distance matrix. The cosine distance between the feature vectors corresponding to each index can be calculated according to the following formula 4.
Wherein k and j are integers from 1 to W, W is the number of indexes included in the multiple indexes, V j Is a feature vector corresponding to the jth index, V k Feature vector corresponding to the k-th index, E kj Is a V j And V k The cosine distance between.
The distance matrix is expressed as shown in equation 5 below.
E＝{E kj K is more than or equal to 1, and W is less than or equal to j (formula 5)
Wherein k and j are integers, and E is a distance matrix. In one embodiment, at E kj In the case of cosine distances, E is the cosine distance matrix
S304, constructing a graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix.
In one embodiment, the representation of the image learning layer constructed from the distance matrix is shown in equation 1. In formula 1, θ is a parameter adjusted when training the graph learning layer. The relevance among all indexes is learned in a self-adaptive mode on the basis of the distance matrix, a better initialization parameter can be provided, and the difficulty of self-encoder training can be reduced.
S305, constructing an initial self-encoder according to the graph learning layer.
In one embodiment, building an initial autoencoder from the graph learning layer may include: constructing a graph convolution layer according to the adjacent matrix output by the graph learning layer; constructing a cycle space-time learning layer, wherein the cycle space-time learning layer takes the output data of the graph convolution layer as input data; an initial auto-encoder is constructed from a spatiotemporal learning layer consisting of a graph convolution layer and a cyclic spatiotemporal learning layer.
In one embodiment, a graph convolutional layer constructed from an adjacency matrix output by a graph learning layer can be expressed as the following equation 6.
Wherein H (l) For the output of the first graph convolution layer, P (l) S output for l-1 cycle spatiotemporal learning layer t-1 Data X of the first graph convolution layer t The splicing of (2) is carried out,
is a matrix obtained by adding the adjacency matrix a and the identity matrix I,
a degree matrix, W, corresponding to the adjacency matrix A (l) The parameters of the l-th map convolution layer adjusted during training. The 1 st graph convolution layer does not have the output of the last cycle space-time learning layer, therefore, the first graph convolution layer H (1) Corresponding P (1) From the set initial feature matrix S 0 Data X of the first graph convolution layer 1 And (4) splicing to obtain the product.
In one embodiment, the loop spatio-temporal learning layer may be expressed as equation 7 below, or equation 7 and equation 8.
S t ＝sigmoid(W l *H (l) +b l ) (equation 7)
O t ＝sigmoid(W lO *S t +b lO ) (formula 8)
Wherein, W l And b l Parameters of the space-time learning layer on the input side for the l cycle; w is a group of lO And b lO Parameters of the space-time learning layer on the output side for the l cycle; sigmoid is an activation function; s t The output of the space-time learning layer at the input side for the first cycle is used for influencing the next graph convolution layer; o is t The output of the space-time learning layer at the output side for the l cycle; h (l) Is the output of the first graph convolution layer.
In one embodiment, the initial self-encoder is constructed according to a space-time learning layer composed of a graph convolution layer and a circulating space-time learning layer, the initial encoder and the initial decoder comprise the same number of space-time learning layers, the first space-time learning layer of the initial decoder is directly copied from the last space-time learning layer of the initial encoder, and the copying of the last space-time learning layer of the initial encoder comprises copying the internal state and the output result of the space-time learning layer. For example, the initial self-encoder includes 6 spatio-temporal learning layers, wherein the 1 st to 3 rd spatio-temporal learning layers constitute the initial encoder, the 4 th to 6 th spatio-temporal learning layers constitute the decoder, and the 4 th spatio-temporal learning layer is directly copied from the 3 rd spatio-temporal learning layer, that is, the 4 th spatio-temporal learning layer is copied from the content state and output result of the 3 rd spatio-temporal learning layer. In some embodiments, the spatio-temporal learning layer corresponding to the initial encoder includes a graph convolution layer and a loop spatio-temporal learning layer, and the loop spatio-temporal learning layer can be expressed as formula 7, and it should be noted that the loop spatio-temporal learning layer included in the last spatio-temporal learning layer of the initial encoder can be expressed as formula 7 and formula 8; the spatio-temporal learning layer corresponding to the initial decoder includes a graph convolution layer and a loop spatio-temporal learning layer, and the loop spatio-temporal learning layer may be expressed as formula 7 and formula 8.
It should be noted that the spatio-temporal learning layers in the initial decoder and the initial encoder share the same adjacency matrix, that is, different spatio-temporal learning layers share the adjacency matrix of one map convolution layer output. The graph convolution layer included in the last space-time learning layer is connected with the cyclic space-time learning layer included in the last space-time learning layer.
Taking the example that the self-encoder includes 2N spatio-temporal learning layers, the corresponding initial encoder and initial decoder each include N spatio-temporal learning layers, and accordingly, the structure of the initial self-encoder is shown in fig. 4. In fig. 4, reference 401 indicates a primary encoder, 402 indicates N spatio-temporal learning layers included for the primary encoder, 403 indicates a primary decoder, and 404 indicates N spatio-temporal learning layers included for the primary decoder.
And S306, training the initial self-encoder to obtain a target self-encoder.
In some embodiments, training the initial self-encoder to obtain the target self-encoder may include: acquiring sample data for training an initial self-encoder; and training the initial self-encoder by using the sample data to obtain a target self-encoder. When the initial self-encoder is trained, the input sample data should include sample data at multiple times, and the number of times corresponding to the multiple times should be 1/2 of the spatio-temporal learning layer corresponding to the initial self-encoder.
According to the technical scheme, the distance matrix is used as the graph learning layer to generate the initial matrix of the adjacent matrix, so that the self-encoder constructed according to the graph learning layer is more easily converged, and the complexity of training the self-encoder is reduced. In addition, the output of the graph convolution layer is directly input into the cycle space-time learning layer, so that the space-time characteristics of data can be better extracted, the space-time learning layer formed by the graph convolution layer and the cycle space-time learning layer can comprehensively capture the space-time characteristics among multiple indexes, and the self-encoder constructed according to the space-time learning layer can more accurately detect the abnormity existing in the multiple index data.
To facilitate understanding of the multi-index anomaly detection method provided by the embodiment of the present disclosure, a detection process of multi-index data to be detected will be described below with reference to a target self-encoder corresponding to fig. 5, taking an example that the multi-index includes a download rate and a first packet response delay corresponding to an optical fiber broadband, where as shown in fig. 6, the process includes S601 to S604.
S601, acquiring multi-index data to be detected, which is already described in S201 of the embodiment corresponding to fig. 2 and is not described herein again. The multi-index data to be detected comprises data obtained by sampling two indexes of download rate and first packet response time delay of an optical fiber broadband user at N moments, namely, the multi-index data to be detected comprises X 1 To X N And N groups of data are provided, wherein each group of data corresponds to one downloading speed and one first packet response time delay.
S602, acquiring the target self-encoder, where the acquisition of the target self-encoder is already described in the embodiment corresponding to fig. 3 and is not described herein again.
And S603, inputting the multi-index data to be detected into a target self-encoder, and generating reconstruction data by the target self-encoder according to the multi-index data to be detected. As shown in fig. 5, X included in the multi-index data to be detected 1 The first spatio-temporal learning layer 502 input to the encoder 501 is processed by equations 6 and 7 to generate S 1 . Will S 1 And X included in the multi-index data to be detected 2 Inputting into the second spatio-temporal learning layer 503, and generating S after being processed by the formula 6 and the formula 7 2 . Iterative to N-1 spatiotemporal learningAfter the layer, the N-1 st space-time learning layer outputs S N-1 Will S N-1 And X included in the multi-index data to be detected N Inputting Nth space-time learning layer 504, and generating S after being processed by formula 6, formula 7 and formula 8 N And O N Wherein O is N ＝M N 。
The last spatiotemporal learning layer of the encoder is copied to the first spatiotemporal learning layer of the decoder 505, i.e. the (N + 1) th spatiotemporal learning layer 506 is copied from the nth spatiotemporal learning layer 504. The output of the N +1 th spatiotemporal learning layer 506 is S N And M N Then, S is added N And M N Inputting the N +2 th space-time learning layer 507, and converting S N And M N After splicing, the parameters are used as parameters P in formula 6, and then S is generated after processing by formula 6, formula 7 and formula 8 N+1 And O N+1 Wherein O is N+1 ＝M N-1 . After iteration to the 2N-1 time-space learning layer, the 2N-1 time-space learning layer outputs M 2 And S 2N-2 Wherein, M is 2 ＝O 2N-2 After that, M is added 2 And S 2N-2 Inputting the 2N space-time learning layer 508 to generate O 2N-1 ，M 1 ＝O 2N-1 . Wherein M is 1 To M N Is X 1 To X N The reconstructed data of (3).
And S604, comparing the reconstructed data with the multi-index data to be detected to obtain a detection result. The implementation manner of comparing the reconstructed data with the multi-index data to be detected to obtain the detection result is already described in S203 of the embodiment corresponding to fig. 2, and is not described herein again.
According to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of simultaneously detecting multiple indexes is obtained to perform anomaly detection on the multi-index data to be detected. Meanwhile, the relevance among different indexes is considered in the detection of the multi-index data to be detected comprising the indexes, so that the detection result is more accurate and effective, the target self-encoder is used for detecting the index data simultaneously, the self-encoders for detecting the different indexes are prevented from being trained, and the difficulty in training the self-encoders is reduced.
Based on the same inventive concept, the embodiment of the present disclosure further provides a multi-index abnormality detection apparatus, such as the following embodiments. Because the principle of the embodiment of the apparatus for solving the problem is similar to that of the embodiment of the method, the embodiment of the apparatus can be implemented by referring to the implementation of the embodiment of the method, and repeated details are not described again.
Fig. 7 is a schematic diagram illustrating a multi-index abnormality detection apparatus according to an embodiment of the present disclosure, as shown in fig. 7, the apparatus includes: an obtaining module 701, configured to obtain multi-index data to be detected; the obtaining module 701 is further configured to obtain a target self-encoder, where the target self-encoder includes a graph learning layer, the graph learning layer is configured to generate an adjacency matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple-index data to be detected according to the adjacency matrix; the detecting module 702 is configured to perform anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments of the present disclosure, the obtaining module 701 is configured to obtain sample data of each index in the multiple indexes at multiple times; generating a feature vector of each index according to the sample data of each index at a plurality of moments; calculating the target distance between the characteristic vectors of all indexes to obtain a distance matrix; constructing a graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix of a learning adjacent matrix; constructing an initial self-encoder according to the graph learning layer; and training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the present disclosure, the obtaining module 701 is configured to normalize sample data of each index at multiple times to obtain normalized sample data; calculating the average value of the index data corresponding to each index in the standardized sample data at each moment in a plurality of moments; and generating a feature vector corresponding to each index according to the average value.
In some embodiments of the present disclosure, the obtaining module 701 is configured to calculate cosine distances between feature vectors corresponding to each index, so as to obtain a cosine distance matrix.
In some embodiments of the present disclosure, the obtaining module 701 is configured to construct a graph convolution layer according to an adjacency matrix output by a graph learning layer; constructing a circulating space-time learning layer, wherein the circulating space-time learning layer takes output data of the graph convolution layer as input data; an initial auto-encoder is constructed from a spatiotemporal learning layer consisting of a graph convolution layer and a cyclic spatiotemporal learning layer.
In some embodiments of the present disclosure, the detecting module 702 is further configured to detect sample data corresponding to each index, and determine a missing segment of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; the device still includes: the interpolation module 703 is configured to perform linear interpolation on the missing segment to obtain sample data corresponding to each interpolated indicator when the comparison result is that the length of the missing segment is smaller than the length threshold; performing synchronous data interpolation on the missing segment under the condition that the length of the missing segment is not less than the length threshold value as a comparison result to obtain sample data corresponding to each index after interpolation; the contemporaneous data is data obtained by sampling the same index from the corresponding sampling object at the same time on different dates.
In some embodiments of the present disclosure, the multiple metrics include multiple ones of the metrics corresponding to the fiber bandwidth.
As will be appreciated by one skilled in the art, aspects of the present disclosure may be embodied as a system, method or program product. Accordingly, various aspects of the present disclosure may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.
An electronic device 800 according to this embodiment of the disclosure is described below with reference to fig. 8. The electronic device 800 shown in fig. 8 is only an example and should not bring any limitations to the functionality and scope of use of the embodiments of the present disclosure.
As shown in fig. 8, electronic device 800 is in the form of a general purpose computing device. The components of the electronic device 800 may include, but are not limited to: the at least one processing unit 810, the at least one memory unit 820, and a bus 830 that couples the various system components including the memory unit 820 and the processing unit 810.
Where the storage unit stores program code, the program code may be executed by the processing unit 810 to cause the processing unit 810 to perform the steps according to various exemplary embodiments of the present disclosure as described in the above-mentioned "detailed description" section of this specification.
The storage unit 820 may include readable media in the form of volatile memory units such as a random access memory unit (RAM) 8201 and/or a cache memory unit 8202, and may further include a read only memory unit (ROM) 8203.
The electronic device 800 may also communicate with one or more external devices 840 (e.g., a keyboard, a pointing device, a bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 800, and/or with any device (e.g., a router, a modem, etc.) that enables the electronic device 800 to communicate with one or more other computing devices. Such communication may occur over input/output (I/O) interfaces 850. Also, the electronic device 800 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network such as the internet) via the network adapter 860. As shown in fig. 8, the network adapter 860 communicates with the other modules of the electronic device 800 via the bus 830. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, to name a few.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium, which may be a readable signal medium or a readable storage medium. On which a program product capable of implementing the above-described method of the present disclosure is stored. In some possible embodiments, various aspects of the disclosure may also be implemented in the form of a program product comprising program code for causing a terminal device to perform the steps according to various exemplary embodiments of the disclosure described in the above-mentioned "detailed description" section of this specification, when the program product is run on the terminal device.
More specific examples of the computer-readable storage medium in the present disclosure may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
In the present disclosure, a computer readable storage medium may include a propagated data signal with readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Alternatively, program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
In particular implementations, program code for carrying out operations of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + +, or the like, as well as conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In situations involving remote computing devices, the remote computing devices may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to external computing devices (e.g., through the internet using an internet service provider).
It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.
Moreover, although the steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that the steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope of the disclosure being indicated by the following claims.
Claims (10)
1. A multi-index abnormality detection method is characterized by comprising the following steps:
acquiring multi-index data to be detected;
acquiring a target self-encoder, wherein the target self-encoder comprises an image learning layer, the image learning layer is used for generating an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the data of the multiple indexes to be detected according to the adjacent matrix;
and carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
2. The method of claim 1, wherein the obtaining the target is from an encoder comprising:
acquiring sample data of each index in the multiple indexes at multiple moments;
generating a feature vector corresponding to each index according to the sample data of each index at a plurality of moments;
calculating the target distance between the characteristic vectors corresponding to the indexes to obtain the distance matrix;
constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacency matrix;
constructing an initial self-encoder according to the graph learning layer;
and training the initial self-encoder to obtain the target self-encoder.
3. The method according to claim 2, wherein the generating a feature vector corresponding to each index according to the sample data of each index at a plurality of time instants comprises:
standardizing sample data of each index at multiple moments to obtain standardized sample data;
calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments;
and generating a characteristic vector corresponding to each index according to the average value.
4. The method according to claim 2, wherein the calculating a target distance between the eigenvectors corresponding to each index to obtain the distance matrix comprises:
and calculating cosine distances among the characteristic vectors corresponding to the indexes to obtain a cosine distance matrix.
5. The method of claim 2, wherein constructing an initial self-encoder from the graph learning layer comprises:
constructing a graph convolution layer according to the adjacent matrix output by the graph learning layer;
constructing a cycle space-time learning layer, wherein the cycle space-time learning layer takes the output data of the graph convolution layer as input data;
and constructing the initial self-encoder according to a space-time learning layer consisting of the graph convolution layer and the circulating space-time learning layer.
6. The method according to any one of claims 2 to 5, wherein before generating the feature vector corresponding to each index according to the sample data of each index at a plurality of time points, the method further comprises:
detecting sample data corresponding to each index, and determining a missing segment of the sample data corresponding to each index at each sampling object;
comparing the length of the missing segment with a length threshold value to obtain a comparison result;
under the condition that the comparison result is that the length of the missing segment is smaller than the length threshold, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation;
performing synchronous data interpolation on the missing segment to obtain sample data corresponding to each interpolated index under the condition that the comparison result shows that the length of the missing segment is not smaller than the length threshold; the contemporaneous data are data obtained by sampling the same index from corresponding sampling objects at the same time on different dates.
7. The method of any of claims 1-5, wherein the multiple metrics comprise multiple ones of the metrics corresponding to a fiber bandwidth.
8. A multi-index abnormality detection device, characterized by comprising:
the acquisition module is used for acquiring multi-index data to be detected;
the acquisition module is further configured to acquire a target self-encoder, where the target self-encoder includes a graph learning layer, the graph learning layer is configured to generate an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple index data to be detected according to the adjacent matrix;
and the detection module is used for carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
9. An electronic device, comprising:
a processor; and
a memory for storing executable instructions of the processor;
wherein the processor is configured to perform the multi-index anomaly detection method of any one of claims 1-7 via execution of the executable instructions.
10. A computer-readable storage medium on which a computer program is stored, the computer program, when being executed by a processor, implementing the multi-index abnormality detection method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210957324.9A CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210957324.9A CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115345279A true CN115345279A (en) | 2022-11-15 |
| CN115345279B CN115345279B (en) | 2024-03-29 |
Family
ID=83952497
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210957324.9A Active CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115345279B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117074627A (en) * | 2023-10-16 | 2023-11-17 | 三科智能(山东)集团有限公司 | Medical laboratory air quality monitoring system based on artificial intelligence |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| CN112364939A (en) * | 2020-12-04 | 2021-02-12 | 中信银行股份有限公司 | Abnormal value detection method, device, equipment and storage medium |
| CN113569972A (en) * | 2021-08-03 | 2021-10-29 | 中国科学院地理科学与资源研究所 | Meteorological data interpolation method, meteorological data interpolation device, electronic equipment and storage medium |
| CN113988268A (en) * | 2021-11-03 | 2022-01-28 | 西安交通大学 | Heterogeneous multi-source time sequence anomaly detection method based on unsupervised full-attribute graph |
| US20220083039A1 (en) * | 2019-01-18 | 2022-03-17 | Nec Corporation | Abnormality detection apparatus, abnormality detection system, and learning apparatus, and methods for the same and nontemporary computer-readable medium storing the same |
-
2022
- 2022-08-10 CN CN202210957324.9A patent/CN115345279B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20220083039A1 (en) * | 2019-01-18 | 2022-03-17 | Nec Corporation | Abnormality detection apparatus, abnormality detection system, and learning apparatus, and methods for the same and nontemporary computer-readable medium storing the same |
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| CN112364939A (en) * | 2020-12-04 | 2021-02-12 | 中信银行股份有限公司 | Abnormal value detection method, device, equipment and storage medium |
| CN113569972A (en) * | 2021-08-03 | 2021-10-29 | 中国科学院地理科学与资源研究所 | Meteorological data interpolation method, meteorological data interpolation device, electronic equipment and storage medium |
| CN113988268A (en) * | 2021-11-03 | 2022-01-28 | 西安交通大学 | Heterogeneous multi-source time sequence anomaly detection method based on unsupervised full-attribute graph |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117074627A (en) * | 2023-10-16 | 2023-11-17 | 三科智能(山东)集团有限公司 | Medical laboratory air quality monitoring system based on artificial intelligence |
| CN117074627B (en) * | 2023-10-16 | 2024-01-09 | 三科智能(山东)集团有限公司 | Medical laboratory air quality monitoring system based on artificial intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115345279B (en) | 2024-03-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11689223B2 (en) | Device-tailored model-free error correction in quantum processors | |
| WO2021204010A1 (en) | Time series anomaly detection method and apparatus, and computer device and storage medium | |
| WO2022116322A1 (en) | Method and apparatus for generating anomaly detection model, and anomaly event detection method and apparatus | |
| US10599975B2 (en) | Scalable parameter encoding of artificial neural networks obtained via an evolutionary process | |
| KR20200145641A (en) | Method and apparatus for generating information | |
| US10725751B2 (en) | Generating a predictive data structure | |
| CN112149706B (en) | Model training method, device, equipment and medium | |
| CN115345279B (en) | Multi-index anomaly detection method and device, electronic equipment and storage medium | |
| CN116186769A (en) | Vertical federal XGBoost feature derivation method based on privacy calculation and related equipment | |
| US10824794B2 (en) | Process for creating a fixed length representation of a variable length input | |
| US8881112B2 (en) | Quality measure tool for a composite application | |
| US20220229721A1 (en) | Selection of outlier-detection programs specific to dataset meta-features | |
| US10970234B2 (en) | Optimizing time-dependent simulations of quantum computing architectures | |
| JPWO2021059349A5 (en) | ||
| CN114595474A (en) | Federal learning modeling optimization method, electronic device, medium, and program product | |
| CN113961962A (en) | Model training method and system based on privacy protection and computer equipment | |
| KR20220016682A (en) | Data label correction for speech recognition system and method thereof | |
| CN115564056B (en) | Node selection method, node selection device, electronic equipment and computer readable storage medium | |
| CN114399355B (en) | Information pushing method and device based on user conversion rate and electronic equipment | |
| CN111338318B (en) | Method and apparatus for detecting anomalies | |
| CN116562396A (en) | Federal learning participant screening method and device, electronic equipment and storage medium | |
| CN115063536B (en) | Image generation method, device, electronic equipment and computer readable storage medium | |
| CN114237962B (en) | Alarm root cause judging method, model training method, device, equipment and medium | |
| CN116107426A (en) | Gesture recognition method, gesture recognition device, electronic equipment and computer readable storage medium | |
| CN117688559A (en) | Virus program detection method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |