CN115345279B - Multi-index anomaly detection method and device, electronic equipment and storage medium - Google Patents
Multi-index anomaly detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN115345279B CN115345279B CN202210957324.9A CN202210957324A CN115345279B CN 115345279 B CN115345279 B CN 115345279B CN 202210957324 A CN202210957324 A CN 202210957324A CN 115345279 B CN115345279 B CN 115345279B
- Authority
- CN
- China
- Prior art keywords
- index
- encoder
- data
- indexes
- learning layer
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 83
- 239000011159 matrix material Substances 0.000 claims abstract description 90
- 238000000034 method Methods 0.000 claims abstract description 42
- 230000008569 process Effects 0.000 claims abstract description 11
- 239000013598 vector Substances 0.000 claims description 40
- 238000005070 sampling Methods 0.000 claims description 27
- 238000003475 lamination Methods 0.000 claims description 8
- 238000004590 computer program Methods 0.000 claims description 5
- 239000000835 fiber Substances 0.000 claims description 5
- 239000012634 fragment Substances 0.000 claims description 3
- 230000005856 abnormality Effects 0.000 description 23
- 125000004122 cyclic group Chemical group 0.000 description 14
- 239000013307 optical fiber Substances 0.000 description 13
- 230000004044 response Effects 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 238000004891 communication Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 4
- 230000004913 activation Effects 0.000 description 3
- 230000006978 adaptation Effects 0.000 description 2
- 238000010606 normalization Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000003190 augmentative effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Molecular Biology (AREA)
- Artificial Intelligence (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Image Analysis (AREA)
Abstract
The disclosure provides a multi-index anomaly detection method, a multi-index anomaly detection device, electronic equipment and a storage medium, and relates to the technical field of data processing. The method comprises the following steps: acquiring multi-index data to be detected; the method comprises the steps that a target self-encoder is obtained, the target self-encoder comprises a graph learning layer, the graph learning layer is used for generating an adjacent matrix corresponding to multiple indexes according to a distance matrix corresponding to the multiple indexes, and the target self-encoder processes multi-index data to be detected according to the adjacent matrix; and performing anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result. Meanwhile, the correlation among different indexes is considered in detecting the multi-index data to be detected, which comprises a plurality of indexes, so that the detection result is more accurate and effective.
Description
Technical Field
The disclosure relates to the technical field of data processing, and in particular relates to a multi-index anomaly detection method, a multi-index anomaly detection device, electronic equipment and a storage medium.
Background
In the technical field of data processing, anomaly detection is performed on some important index data, and according to the result of anomaly detection, the anomaly condition of equipment, network or other information behind the index data can be rapidly determined. For example, by detecting abnormality in an index of the download speed of the optical fiber broadband user, it is possible to determine whether or not there is abnormality in the operation of the optical fiber broadband.
In the related art, a plurality of different self-encoders are trained by using sample data of different indexes, and anomaly detection is performed on corresponding indexes according to the trained self-encoders, that is, one self-encoding is used for anomaly detection on one index.
The method for detecting the abnormality of different indexes by using different self-codes ensures that the accuracy of the detection result is low.
It should be noted that the information disclosed in the above background section is only for enhancing understanding of the background of the present disclosure and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
The disclosure provides a multi-index anomaly detection method, a multi-index anomaly detection device, electronic equipment and a storage medium, which at least overcome the problem of low accuracy of detection results in related technologies to a certain extent.
Other features and advantages of the present disclosure will be apparent from the following detailed description, or may be learned in part by the practice of the disclosure.
According to one aspect of the present disclosure, there is provided a multi-index anomaly detection method including: acquiring multi-index data to be detected; the target self-encoder comprises a graph learning layer, wherein the graph learning layer is used for generating an adjacent matrix corresponding to the multi-index according to the distance matrix corresponding to the multi-index, and the target self-encoder processes the multi-index data to be detected according to the adjacent matrix; and carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments of the present disclosure, the acquisition target is a self-encoder comprising: acquiring sample data of each index in the multiple indexes at multiple moments; generating feature vectors corresponding to the indexes according to sample data of the indexes at a plurality of moments; calculating target distances among feature vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix; constructing an initial self-encoder according to the graph learning layer; training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the present disclosure, the generating, according to sample data of each index at a plurality of moments, a feature vector corresponding to each index includes: the method comprises the steps of normalizing sample data of each index at a plurality of moments to obtain normalized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments; and generating feature vectors corresponding to the indexes according to the average value.
In some embodiments of the present disclosure, the calculating the target distance between feature vectors corresponding to each index to obtain the distance matrix includes: and calculating cosine distances among the feature vectors corresponding to the indexes to obtain a cosine distance matrix.
In some embodiments of the disclosure, the constructing an initial self-encoder according to the graph learning layer includes: constructing a graph convolution layer according to the adjacency matrix output by the graph learning layer; constructing a circulating space-time learning layer, wherein the circulating space-time learning layer takes output data of the graph roll lamination layer as input data; and constructing the initial self-encoder according to a space-time learning layer consisting of the picture scroll layer and the circulating space-time learning layer.
In some embodiments of the present disclosure, before the generating, according to the sample data of each index at a plurality of moments, a feature vector corresponding to each index, the method further includes: detecting sample data corresponding to each index, and determining missing fragments of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; when the comparison result shows that the length of the missing segment is smaller than the length threshold value, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; if the comparison result is that the length of the missing segment is not smaller than the length threshold value, performing contemporaneous data interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; the contemporaneous data are data obtained by sampling the same index from the corresponding sampling object at the same moment of different dates.
In some embodiments of the present disclosure, the multiple metrics include a plurality of metrics of the fiber broadband correspondence metrics.
According to another aspect of the present disclosure, there is provided a multi-index abnormality detection apparatus including: the acquisition module is used for acquiring multi-index data to be detected; the acquisition module is further configured to acquire a target self-encoder, where the target self-encoder includes a graph learning layer, the graph learning layer is configured to generate an adjacency matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple-index data to be detected according to the adjacency matrix; and the detection module is used for carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments of the disclosure, the obtaining module is configured to obtain sample data of each index of the multiple indexes at multiple moments; generating feature vectors corresponding to the indexes according to sample data of the indexes at a plurality of moments; calculating target distances among feature vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix; constructing an initial self-encoder according to the graph learning layer; training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the disclosure, the obtaining module is configured to normalize sample data of each index at a plurality of moments to obtain normalized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments; and generating feature vectors corresponding to the indexes according to the average value.
In some embodiments of the present disclosure, the obtaining module is configured to calculate a cosine distance between feature vectors corresponding to each index, to obtain a cosine distance matrix.
In some embodiments of the disclosure, the obtaining module is configured to construct a graph convolution layer according to an adjacency matrix output by the graph learning layer; constructing a circulating space-time learning layer, wherein the circulating space-time learning layer takes output data of the graph roll lamination layer as input data; and constructing the initial self-encoder according to a space-time learning layer consisting of the picture scroll layer and the circulating space-time learning layer.
In some embodiments of the present disclosure, the detection module is further configured to detect sample data corresponding to each index, and determine a missing segment of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; the apparatus further comprises: the interpolation module is used for performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation when the comparison result is that the length of the missing segment is smaller than the length threshold; if the comparison result is that the length of the missing segment is not smaller than the length threshold value, performing contemporaneous data interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; the contemporaneous data are data obtained by sampling the same index from the corresponding sampling object at the same moment of different dates.
In some embodiments of the present disclosure, the multiple metrics include a plurality of metrics of the fiber broadband correspondence metrics.
According to still another aspect of the present disclosure, there is provided an electronic apparatus including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the multi-index anomaly detection methods described above via execution of the executable instructions.
According to yet another aspect of the present disclosure, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements any of the above-described multi-index anomaly detection methods.
According to yet another aspect of the present disclosure, there is provided a computer program product comprising a computer program or computer instructions loaded and executed by a processor to cause a computer to implement any of the multi-index anomaly detection methods described above.
The technical scheme provided by the embodiment of the disclosure at least comprises the following beneficial effects:
according to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of detecting a plurality of indexes simultaneously is obtained to perform abnormality detection on multi-index data to be detected. Meanwhile, the correlation among different indexes is considered in detecting the multi-index data to be detected, which comprises a plurality of indexes, so that the detection result is more accurate and effective.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description, serve to explain the principles of the disclosure. It will be apparent to those of ordinary skill in the art that the drawings in the following description are merely examples of the disclosure and that other drawings may be derived from them without undue effort.
FIG. 1 is a schematic diagram of a multi-index anomaly detection system in an embodiment of the present disclosure;
FIG. 2 illustrates a flow chart of a multi-index anomaly detection method in one embodiment of the present disclosure;
FIG. 3 illustrates a flow chart of a method of acquiring a target self-encoder in one embodiment of the present disclosure;
FIG. 4 illustrates a schematic diagram of an initial self-encoder in one embodiment of the present disclosure;
FIG. 5 illustrates a schematic diagram of a target self-encoder in one embodiment of the present disclosure;
FIG. 6 illustrates a flowchart of a method of multi-index anomaly detection in another embodiment of the present disclosure;
FIG. 7 is a schematic diagram of a multi-index anomaly detection device according to an embodiment of the present disclosure;
Fig. 8 shows a block diagram of an electronic device in an embodiment of the disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments may be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software or in one or more hardware modules or integrated circuits or in different networks and/or processor devices and/or microcontroller devices.
Fig. 1 illustrates a multi-index abnormality detection system to which the multi-index abnormality detection method or the multi-index abnormality detection apparatus of the embodiment of the present disclosure may be applied in the embodiment of the present disclosure.
As shown in fig. 1, the multi-index anomaly detection system may include: an index data generating device 101, and an abnormality detecting device 102.
The index data generating device 101 may generate data corresponding to a plurality of indexes, and may actively or passively transmit the generated index data to the abnormality detecting device 102. The abnormality detection device 102 may receive the index data transmitted from the index data generation device 101, the abnormality detection device 102 may train the self-encoder based on the index data, and the abnormality detection device 102 may perform abnormality detection on the index data.
The index data generating device 101 and the abnormality detecting device 102 may be connected to each other through a network. The network may be a wired network or a wireless network.
Alternatively, the wireless network or wired network described above uses standard communication techniques and/or protocols. The network is typically the Internet, but may be any network including, but not limited to, a local area network (Local Area Network, LAN), metropolitan area network (Metropolitan Area Network, MAN), wide area network (Wide Area Network, WAN), mobile, wired or wireless network, private network, or any combination of virtual private networks. In some embodiments, data exchanged over a network is represented using techniques and/or formats including HyperText Mark-up Language (HTML), extensible markup Language (Extensible MarkupLanguage, XML), and the like. All or some of the links may also be encrypted using conventional encryption techniques such as secure sockets layer (Secure Socket Layer, SSL), transport layer security (Transport Layer Security, TLS), virtual private network (Virtual Private Network, VPN), internet protocol security (Internet ProtocolSecurity, IPsec), etc. In other embodiments, custom and/or dedicated data communication techniques may also be used in place of or in addition to the data communication techniques described above.
The index data generating device 101 and the abnormality detecting device 102 may be various electronic devices including, but not limited to, a smart phone, a tablet computer, a laptop portable computer, a desktop computer, an augmented reality device, a virtual reality device, and the like.
The abnormality detection device 102 may be a server, which may be a server that provides various services. Optionally, the server may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs (Content Delivery Network, content delivery networks), basic cloud computing services such as big data and artificial intelligence platforms, and the like.
The present exemplary embodiment will be described in detail below with reference to the accompanying drawings and examples.
The embodiment of the disclosure provides a multi-index anomaly detection method, which can be executed by any electronic device with calculation processing capability, wherein the electronic device can be an anomaly detection device, an index data generation device or both the index data generation device and the anomaly detection device, and the embodiment of the disclosure does not limit the method. In the multi-index anomaly detection method, when the anomaly detection device and the index data generation device execute the same, the anomaly detection device may be used to carry out a main calculation task, the index data generation device may be used to carry out a main calculation task, and the anomaly detection device and the index data generation device may be used to carry out a calculation task.
Fig. 2 shows a flowchart of a multi-index anomaly detection method according to an embodiment of the present disclosure, and as shown in fig. 2, the multi-index anomaly detection method provided in the embodiment of the present disclosure includes the following steps S201 to S203.
S201, multi-index data to be detected are obtained.
The multi-index data to be detected comprises data to be detected corresponding to a plurality of indexes. In some embodiments, there is a correlation between multiple metrics corresponding to the multi-metric data to be detected. For example, the multiple indexes corresponding to the multi-index data to be detected are multiple indexes in the indexes corresponding to the optical fiber broadband, and for example, the multiple indexes can include multiple indexes such as downloading rate, first packet response time delay, first screen time delay, access success rate and the like corresponding to the optical fiber broadband user. The embodiments of the present disclosure are not limited with respect to how the multi-index data to be detected is obtained. For example, multi-index data to be detected is generated by an index data generating device, and the multi-index anomaly detection method provided by the embodiment of the disclosure is executed by an anomaly detection device, at this time, acquiring the multi-index data to be detected may include: the index data generating device actively or passively transmits the multi-index data to be detected to the abnormality detecting device.
S202, a target self-encoder is obtained, the target self-encoder comprises a graph learning layer, the graph learning layer is used for generating an adjacent matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multi-index data to be detected according to the adjacent matrix.
In some embodiments, the target self-encoder is a self-encoder that completes training, and the index included in the sample data of the target self-encoder is the same as the index included in the multi-index data to be detected. In some embodiments, the target self-encoder includes a graph learning layer for generating a multi-index corresponding adjacency matrix from the multi-index corresponding distance matrix. Wherein the graph learning layer can be expressed using the following formula 1.
A=relu (tanh (e×θ)) (formula 1)
Wherein E is a distance matrix corresponding to multiple indexes, θ is a parameter corresponding to a drawing layer, tanh is an activation function, reLU is an activation function, and A is an adjacent matrix corresponding to multiple indexes.
The target self-encoder includes a graph learning layer that is a trained graph learning layer, so the adjacency matrix output by the graph learning layer is a trained adjacency matrix. And the target self-encoder processes the multi-index data to be detected according to the adjacency matrix output by the graph learning layer.
S203, performing anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result.
In some embodiments, performing anomaly detection on multi-index data to be detected according to the target self-encoder to obtain a detection result may include: inputting the multi-index data to be detected into a target self-encoder, reconstructing the multi-index data to be detected by the target self-encoder, and outputting reconstructed data; calculating the percentage error of the multi-index data to be detected and the reconstruction data on each index data; and comparing the percentage error with a set threshold value to obtain a detection result. The threshold value is not limited, and may be set empirically. For example, the threshold is set to 5%, or the threshold is set to 3%.
For example, the threshold value is set to be 5%, and the multi-index data to be detected includes data obtained by sampling the downloading rate, the first packet response time delay, the first screen time delay and the access success rate of one optical fiber broadband user at three moments. In the reconstructed data of the multi-index data to be detected after the reconstruction of the target self-encoder, the percentage error between the downloading speed at the moment 1 and the downloading speed of the multi-index data to be detected at the moment 1 is 6%; the percentage error between the download speed at the moment 2 and the download speed of the multi-index data to be detected at the moment 2 is 3%; the percentage error between the download speed at time 3 and the download speed of the multi-index data to be detected at time 3 is 4%. Since 6% >5%,3% <5%,4% <5%, it is determined that there is an abnormality in the download speed of the multi-index data to be detected at time 1, that is, that there is an abnormality in the download speed of the multi-index data to be detected at time 1 included in the detection result.
According to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of simultaneously detecting a plurality of indexes is obtained to perform abnormality detection on multi-index data to be detected. Meanwhile, the correlation among different indexes is considered in detecting the multi-index data to be detected, which comprises a plurality of indexes, so that the detection result is more accurate and effective, and the target self-encoder is utilized to detect the plurality of index data simultaneously, so that the need of training a plurality of self-encoders for detecting the different indexes is avoided, and the difficulty of training the self-encoder is reduced. In addition, the pattern learning layer included in the target self-encoder utilizes the distance matrix corresponding to the multiple indexes to generate the adjacent matrix, so that the training difficulty of the target self-encoder is reduced, and the target self-encoder is easier to converge during training.
In one embodiment of the present disclosure, a method for acquiring a target self-encoder is provided, as shown in fig. 3, and the method for acquiring a target self-encoder provided in the embodiment of the present disclosure includes the following steps S301 to S306.
S301, sample data of each index in the multiple indexes at multiple moments is acquired.
In some embodiments, the sample data is obtained in the same manner as the multi-index data to be detected is obtained in S201 of the embodiment corresponding to fig. 2. Wherein at one of the plurality of times, sampling data corresponding to one of the plurality of indicators includes sampling the plurality of sampling objects Sample data obtained. For example, at time t, sample the j-th index from the sample object numbered i to obtain a sample dataFor example, the multiple index is one of indexes corresponding to the optical fiber broadband. For another example, the multiple indexes include four indexes of downloading rate, first packet response time delay, first screen time delay and access success rate corresponding to the optical fiber broadband user, wherein the downloading rate is the 1 st index, the first packet response time delay is the 2 nd index, the first screen time delay is the 3 rd index, and the access success rate is the 4 th index. The sampling object comprises 10 fiber optic broadband subscribers and the plurality of time instants comprises 10 time instants. At this time, sample data of each index of the plurality of indexes at a plurality of times includes (X) 1 ,X 2 ,…X 10 )，X t And representing sample data obtained by sampling 4 indexes of 10 optical fiber broadband users at t time. X is X t Comprises->Wherein i is an integer from 1 to 10, j is an integer from 1 to 4, ">And representing sample data obtained by sampling the first packet response time delay of the second optical fiber broadband user at the time t.
S302, generating feature vectors corresponding to the indexes according to sample data of the indexes at a plurality of moments.
The embodiments of the present disclosure are not limited in terms of how the sample data is processed to obtain feature vectors for each index. For example, the processing method of the convolutional neural network may be used to extract feature vectors of the respective indices from sample data of the respective indices at a plurality of times. The feature vectors of the respective indices may also be generated by means of a sampling mathematical process. In some embodiments, generating the feature vector corresponding to each index according to the sample data of each index at a plurality of moments may include: the method comprises the steps of normalizing sample data of each index at a plurality of moments to obtain normalized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of a plurality of moments; and generating feature vectors corresponding to the indexes according to the average value.
Normalization refers to scaling data of different orders of magnitude to the same order of magnitude, and is not limited as to the manner of normalization used, for example, the maximum and minimum values of each sample may be determined from the sample data; and then the sample data of each index at a plurality of moments is normalized according to the following formula 2 to obtain normalized sample data.
Wherein,data obtained by sampling the j index of the i sampling object at the t moment, and x jMAX For the maximum value, x, in the sample data corresponding to the jth index jMIN Minimum value in sample data corresponding to jth index,/th index>Is thatThe normalized data, a, is a set coefficient, and the specific value of a is not limited in this disclosure, for example, the value of a is 1.
In some embodiments, the plurality of time instants includes T time instants, that is, T is an integer from 1 to T; the multiple indexes comprise W indexes, namely the value of j is an integer from 1 to W; the plurality of sample objects includes N sample objects, that is, i has a value of an integer from 1 to N. At this time, by calculating the average value of each index in the normalized sample data at each time, the feature vector corresponding to each index obtained can be expressed by the following formula 3.
Wherein,the sample data after the j index of the i sampling object is correspondingly aligned at the 1 st time; v (V) j And the characteristic vector corresponding to the j-th index is represented.
In another embodiment, the acquired sample data of each index at a plurality of times has a missing portion of the sample data. For example, the jth index continuously misses t at the ith sample object 1 、t 2 And t 3 Sample data for a total of three moments. In this case, interpolation is required for the missing data. In another embodiment, before generating the feature vector corresponding to each index according to the sample data of each index at a plurality of moments, the method further includes: detecting sample data corresponding to each index, and determining missing fragments of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; under the condition that the length of the missing segment is smaller than the length threshold value as a comparison result, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; under the condition that the length of the missing segment is not smaller than the length threshold value as a comparison result, the missing segment is subjected to contemporaneous data interpolation to obtain sample data corresponding to each index after interpolation; the contemporaneous data is data obtained by sampling the same index from the corresponding sampling object at the same moment of different dates.
The length threshold is a set value, and the embodiment of the disclosure is not limited with respect to a specific value of the length threshold, for example, the length threshold is 3. In one embodiment, linear interpolation refers to calculating a straight line where sample data at two ends of a missing segment is located, taking a moment corresponding to the missing segment into the straight line, obtaining data at the missing moment, and interpolating the data at the missing moment into the missing segment. In one embodiment, the contemporaneous data interpolation refers to that contemporaneous data corresponding to a missing segment is used as data corresponding to the missing segment for interpolation.
By interpolating sample data of each index at a plurality of times, it is possible to avoid the influence on detection due to the presence of missing pieces of sample data.
S303, calculating target distances among feature vectors corresponding to the indexes to obtain a distance matrix.
Regarding what the target distance between feature vectors corresponding to the respective indexes is, the embodiments of the present disclosure are not limited, and the target distance is, for example, a cosine distance. In some embodiments, calculating the target distance between feature vectors of the respective indicators to obtain a distance matrix may include: and calculating cosine distances among the feature vectors corresponding to the indexes to obtain a cosine distance matrix. The cosine distance between the feature vectors corresponding to the respective indices can be calculated according to the following equation 4.
Wherein k and j are integers from 1 to W, W is the number of indexes included by multiple indexes, V j Is the feature vector corresponding to the jth index, V k Is the characteristic vector corresponding to the kth index, E kj Is V (V) j And V k Cosine distance between them.
The representation of the distance matrix is shown in equation 5 below.
E＝{E kj 1.ltoreq.k.ltoreq.j.ltoreq.W } (equation 5)
Where k and j are integers and E is a distance matrix. In one embodiment, at E kj When the distance is cosine, E is cosine distance matrix
S304, constructing a graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix.
In one embodiment, the representation of the graph learning layer constructed from the distance matrix is shown in equation 1. In formula 1, θ is a parameter adjusted when the training chart learns the layer. The correlation among the indexes is self-adaptively learned on the basis of the distance matrix, so that a better initialization parameter can be provided, and the training difficulty of the self-encoder can be reduced.
S305, constructing an initial self-encoder according to the graph learning layer.
In one embodiment, constructing an initial self-encoder from a graph learning layer may include: constructing a graph convolution layer according to the adjacency matrix output by the graph learning layer; constructing a cyclic space-time learning layer, wherein the cyclic space-time learning layer takes output data of the graph convolution layer as input data; an initial self-encoder is constructed from a spatio-temporal learning layer consisting of a picture-volume lamination layer and a cyclic spatio-temporal learning layer.
In one embodiment, a graph roll stack constructed from the adjacency matrix output by the graph learning layer may be represented as the following equation 6.
Wherein H is (l) For the output of the first picture volume layer, P (l) S output for first-1 cycle space-time learning layer t-1 Data X convolved with input first figure t Is arranged in the splicing way of the (c),matrix obtained by adding adjacent matrix A and identity matrix I,/and the like>For the degree matrix corresponding to the adjacency matrix A, W (l) Parameters adjusted during training for the first graph convolutional layer. The 1 st layer of convolution does not have the output of the previous loop space-time learning layer, and therefore the first layer of convolution H (1) Corresponding P (1) From a set initial feature matrix S 0 Data X convolved with input first figure 1 And (5) splicing to obtain the product.
In one embodiment, the cyclic spatiotemporal learning layer may be expressed as the following equation 7, or equation 7 and equation 8.
S t ＝sigmoid(W l *H (l) +b l ) (equation 7)
O t ＝sigmoid(W lO *S t +b lO ) (equation 8)
Wherein W is l And b l Parameters of the first cycle space-time learning layer on the input side; w (W) lO And b lO Parameters of the first cycle space-time learning layer on the output side; sigmoid is an activation function; s is S t The output of the first cycle space-time learning layer on the input side is used for influencing the next graph roll lamination layer; o (O) t The output of the first cycle space-time learning layer on the output side; h (l) The output of the layer is the first picture volume.
In one embodiment, an initial self-encoder is constructed from spatiotemporal learning layers consisting of a picture scroll layer and a cyclic spatiotemporal learning layer, the initial encoder and the initial decoder comprising the same number of spatiotemporal learning layers, and the first spatiotemporal learning layer of the initial decoder is directly copied from the last spatiotemporal learning layer of the initial encoder, and the copying of the last spatiotemporal learning layer of the initial encoder, including copying the internal state and output results of the spatiotemporal learning layer. For example, the initial self-encoder includes 6 space-time learning layers, wherein 1 st to 3 rd space-time learning layers constitute the initial encoder, 4 th to 6 th space-time learning layers constitute the decoder, and 4 th space-time learning layer is directly copied from 3 rd space-time learning layer, that is, 4 th space-time learning layer is obtained by copying the content state and output result of 3 rd space-time learning layer. In some embodiments, the spatiotemporal learning layer corresponding to the initial encoder includes a graph convolution layer and a cyclic spatiotemporal learning layer, and the cyclic spatiotemporal learning layer may be represented as formula 7, it should be noted that the cyclic spatiotemporal learning layer included in the last spatiotemporal learning layer of the initial encoder may be represented as formula 7 and formula 8; the spatiotemporal learning layer corresponding to the initial decoder includes a graph convolution layer and a cyclic spatiotemporal learning layer, and the cyclic spatiotemporal learning layer can be expressed as formula 7 and formula 8.
The space-time learning layers in the initial decoder and the initial encoder share the same adjacency matrix, that is, the adjacency matrix outputted by one graph convolution layer is shared between different space-time learning layers. The picture scroll layer included in the latter space-time learning layer is connected with the cyclic space-time learning layer included in the last space-time learning layer.
Taking the example that the self-encoder includes 2N space-time learning layers in total, the corresponding initial encoder and initial decoder each include N space-time learning layers, and accordingly, the structure of the initial self-encoder is shown in fig. 4. In fig. 4, an initial encoder is indicated by 401, N spatiotemporal learning layers included in the initial encoder are indicated by 402, and N spatiotemporal learning layers included in the initial decoder are indicated by 403 and 404.
S306, training the initial self-encoder to obtain the target self-encoder.
In some embodiments, training the initial self-encoder to obtain the target self-encoder may include: acquiring sample data for training an initial self-encoder; training the initial self-encoder by using the sample data to obtain the target self-encoder. It should be noted that, when training the initial self-encoder, the input sample data should include sample data at a plurality of moments, and the number of moments corresponding to the plurality of moments should be 1/2 of the spatio-temporal learning layer corresponding to the initial self-encoder.
According to the technical scheme provided by the embodiment of the disclosure, the distance matrix is used as the graph learning layer to generate the initial matrix of the adjacent matrix, so that the self-encoder constructed according to the graph learning layer is easier to converge, and the complexity of training the self-encoder is reduced. In addition, the output of the picture scroll lamination is directly input into the circulating space-time learning layer, so that the space-time characteristics of data can be better extracted, the space-time learning layer formed by the picture scroll lamination and the circulating space-time learning layer can comprehensively capture the space-time characteristics among multiple indexes, and the self-encoder constructed according to the space-time learning layer can more accurately detect the abnormality existing in the multiple index data.
In order to facilitate understanding of the multi-index anomaly detection method provided by the embodiments of the present disclosure, a process of detecting multi-index data to be detected will be described below with reference to a target self-encoder corresponding to fig. 5, by taking a multi-index including a download rate and a first packet response delay corresponding to an optical fiber broadband as an example, and the process includes S601 to S604 as shown in fig. 6.
S601, the acquisition of the multi-index data to be detected is described in S201 of the corresponding embodiment of fig. 2, and is not described herein. Wherein the multi-index data to be detected comprises data obtained by sampling two indexes of the downloading rate and the first packet response time delay of one optical fiber broadband user at N time instants, namely the multi-index data to be detected comprises X 1 To X N And N groups of data, wherein each group of data corresponds to a downloading speed and a first packet response time delay.
S602, the acquisition of the target self-encoder is described in the embodiment corresponding to fig. 3, and will not be described herein.
S603, inputting the multi-index data to be detected into a target self-encoder, and generating reconstruction data by the target self-encoder according to the multi-index data to be detected. As shown in FIG. 5, the multi-index data to be detected includes X 1 The first spatio-temporal learning layer 502 of the input encoder 501 generates S after being processed by equation 6 and equation 7 1 . Will S 1 And X included in the multi-index data to be detected 2 Input into the second space-time learning layer 503, and after being processed by the formulas 6 and 7, S is generated 2 . After iterating to the N-1 time-space learning layer, outputting S by the N-1 time-space learning layer N-1 Will S N-1 And X included in the multi-index data to be detected N Input into the N-th space-time learning layer 504, and processed by equation 6, equation 7 and equation 8 to generate S N And O N Wherein O is N ＝M N 。
The last spatiotemporal learning layer of the encoder is copied to the first spatiotemporal learning layer of the decoder 505, i.e., the n+1th spatiotemporal learning layer 506 is copied from the nth spatiotemporal learning layer 504. The output of the (n+1) th spatiotemporal learning layer 506 is S N And M N After that, S N And M N Inputting the (n+2) th space-timeLearning layer 507, will S N And M N The parameters P in the formula 6 are obtained after the splicing, and then the parameters P are processed by the formulas 6, 7 and 8 to generate S N+1 And O N+1 Wherein O is N+1 ＝M N-1 . After iterating to the 2N-1 time-space learning layer, outputting M by the 2N-1 time-space learning layer 2 And S is 2N-2 Wherein M is 2 ＝O 2N-2 Thereafter, M 2 And S is 2N-2 Input to the 2N-th spatiotemporal learning layer 508 to generate O 2N-1 ，M 1 ＝O 2N-1 . Wherein M is 1 To M N Is X 1 To X N Is provided for the reconstruction data of (a).
S604, comparing the reconstruction data with the multi-index data to be detected to obtain a detection result. The implementation manner of comparing the reconstructed data with the multi-index data to be detected to obtain the detection result is already described in S203 of the corresponding embodiment of fig. 2, and will not be repeated here.
According to the technical scheme provided by the embodiment of the disclosure, the target self-encoder capable of simultaneously detecting a plurality of indexes is obtained to perform abnormality detection on multi-index data to be detected. Meanwhile, the correlation among different indexes is considered in detecting the multi-index data to be detected, which comprises a plurality of indexes, so that the detection result is more accurate and effective, and the target self-encoder is utilized to detect the plurality of index data simultaneously, so that the need of training a plurality of self-encoders for detecting the different indexes is avoided, and the difficulty of training the self-encoder is reduced.
Based on the same inventive concept, the embodiments of the present disclosure also provide a multi-index anomaly detection device, such as the following embodiments. Since the principle of solving the problem of the embodiment of the device is similar to that of the embodiment of the method, the implementation of the embodiment of the device can be referred to the implementation of the embodiment of the method, and the repetition is omitted.
Fig. 7 is a schematic diagram of a multi-index anomaly detection device according to an embodiment of the disclosure, as shown in fig. 7, the device includes: an acquisition module 701, configured to acquire multi-index data to be detected; the acquisition module 701 is further configured to acquire a target self-encoder, where the target self-encoder includes a graph learning layer, and the graph learning layer is configured to generate an adjacency matrix corresponding to multiple indexes according to a distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple-index data to be detected according to the adjacency matrix; the detection module 702 is configured to perform anomaly detection on multi-index data to be detected according to the target self-encoder, so as to obtain a detection result.
In some embodiments of the present disclosure, an obtaining module 701 is configured to obtain sample data of each index of the multiple indexes at multiple moments; generating feature vectors of the indexes according to sample data of the indexes at a plurality of moments; calculating target distances among feature vectors of all indexes to obtain a distance matrix; constructing a graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix of a learning adjacent matrix; constructing an initial self-encoder according to the graph learning layer; training the initial self-encoder to obtain the target self-encoder.
In some embodiments of the present disclosure, an obtaining module 701 is configured to normalize sample data of each index at a plurality of moments to obtain normalized sample data; calculating an average value of index data corresponding to each index in the standardized sample data at each of a plurality of moments; and generating feature vectors corresponding to the indexes according to the average value.
In some embodiments of the present disclosure, the obtaining module 701 is configured to calculate cosine distances between feature vectors corresponding to respective indexes, to obtain a cosine distance matrix.
In some embodiments of the present disclosure, an obtaining module 701 is configured to construct a graph convolutional layer according to an adjacency matrix output by the graph learning layer; constructing a cyclic space-time learning layer, wherein the cyclic space-time learning layer takes output data of the graph convolution layer as input data; an initial self-encoder is constructed from a spatio-temporal learning layer consisting of a picture-volume lamination layer and a cyclic spatio-temporal learning layer.
In some embodiments of the present disclosure, the detection module 702 is further configured to detect sample data corresponding to each index, and determine missing segments of the sample data corresponding to each index at each sampling object; comparing the length of the missing segment with a length threshold value to obtain a comparison result; the apparatus further comprises: an interpolation module 703, configured to perform linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation if the comparison result indicates that the length of the missing segment is less than the length threshold; under the condition that the length of the missing segment is not smaller than the length threshold value as a comparison result, the missing segment is subjected to contemporaneous data interpolation to obtain sample data corresponding to each index after interpolation; the contemporaneous data is data obtained by sampling the same index from the corresponding sampling object at the same moment of different dates.
In some embodiments of the present disclosure, the multiple metrics include multiple ones of the metrics corresponding to the fiber broadband.
Those skilled in the art will appreciate that the various aspects of the present disclosure may be implemented as a system, method, or program product. Accordingly, various aspects of the disclosure may be embodied in the following forms, namely: an entirely hardware embodiment, an entirely software embodiment (including firmware, micro-code, etc.) or an embodiment combining hardware and software aspects may be referred to herein as a "circuit," module "or" system.
An electronic device 800 according to such an embodiment of the present disclosure is described below with reference to fig. 8. The electronic device 800 shown in fig. 8 is merely an example and should not be construed to limit the functionality and scope of use of embodiments of the present disclosure in any way.
As shown in fig. 8, the electronic device 800 is embodied in the form of a general purpose computing device. Components of electronic device 800 may include, but are not limited to: the at least one processing unit 810, the at least one memory unit 820, and a bus 830 connecting the various system components, including the memory unit 820 and the processing unit 810.
Wherein the storage unit stores program code that is executable by the processing unit 810 such that the processing unit 810 performs steps according to various exemplary embodiments of the present disclosure described in the section "detailed description" above of the present specification.
The storage unit 820 may include readable media in the form of volatile storage units, such as Random Access Memory (RAM) 8201 and/or cache memory 8202, and may further include Read Only Memory (ROM) 8203.
Storage unit 820 may also include a program/utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.
Bus 830 may be one or more of several types of bus structures including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.
The electronic device 800 may also communicate with one or more external devices 840 (e.g., keyboard, pointing device, bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 800, and/or any device (e.g., router, modem, etc.) that enables the electronic device 800 to communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 850. Also, electronic device 800 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the Internet, through network adapter 860. As shown in fig. 8, network adapter 860 communicates with other modules of electronic device 800 over bus 830. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 800, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.
From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (may be a personal computer, a server, a terminal device, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, a computer-readable storage medium, which may be a readable signal medium or a readable storage medium, is also provided. On which a program product is stored which enables the implementation of the method described above of the present disclosure. In some possible implementations, various aspects of the disclosure may also be implemented in the form of a program product comprising program code for causing a terminal device to carry out the steps according to the various exemplary embodiments of the disclosure as described in the detailed description section above, when the program product is run on the terminal device.
More specific examples of the computer readable storage medium in the present disclosure may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
In this disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Alternatively, the program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
In particular implementations, the program code for carrying out operations of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).
It should be noted that although in the above detailed description several modules or units of a device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit in accordance with embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into a plurality of modules or units to be embodied.
Furthermore, although the steps of the methods in the present disclosure are depicted in a particular order in the drawings, this does not require or imply that the steps must be performed in that particular order or that all illustrated steps be performed in order to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step to perform, and/or one step decomposed into multiple steps to perform, etc.
From the description of the above embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (may be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This disclosure is intended to cover any adaptations, uses, or adaptations of the disclosure following the general principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope of the disclosure being indicated by the following claims.
Claims (9)
1. A multi-index anomaly detection method, comprising:
acquiring multi-index data to be detected;
the target self-encoder comprises a graph learning layer, wherein the graph learning layer is used for generating an adjacent matrix corresponding to the multi-index according to the distance matrix corresponding to the multi-index, and the target self-encoder processes the multi-index data to be detected according to the adjacent matrix;
performing anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result;
wherein the acquisition target is from the encoder, including: acquiring sample data of each index in the multiple indexes at multiple moments; generating feature vectors corresponding to the indexes according to sample data of the indexes at a plurality of moments; calculating target distances among feature vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix; constructing an initial self-encoder according to the graph learning layer; training the initial self-encoder to obtain the target self-encoder.
2. The method according to claim 1, wherein generating the feature vector corresponding to each index according to the sample data of each index at a plurality of moments comprises:
the method comprises the steps of normalizing sample data of each index at a plurality of moments to obtain normalized sample data;
calculating an average value of index data corresponding to each index in the standardized sample data at each of the plurality of moments;
and generating feature vectors corresponding to the indexes according to the average value.
3. The method according to claim 1, wherein calculating the target distance between feature vectors corresponding to the respective indexes to obtain the distance matrix includes:
and calculating cosine distances among the feature vectors corresponding to the indexes to obtain a cosine distance matrix.
4. The method of claim 1, wherein said constructing an initial self-encoder from said graph learning layer comprises:
constructing a graph convolution layer according to the adjacency matrix output by the graph learning layer;
constructing a circulating space-time learning layer, wherein the circulating space-time learning layer takes output data of the graph roll lamination layer as input data;
and constructing the initial self-encoder according to a space-time learning layer consisting of the picture scroll layer and the circulating space-time learning layer.
5. The method according to any one of claims 1-4, wherein before generating the feature vector corresponding to each index according to the sample data of each index at a plurality of time instants, the method further comprises:
detecting sample data corresponding to each index, and determining missing fragments of the sample data corresponding to each index at each sampling object;
comparing the length of the missing segment with a length threshold value to obtain a comparison result;
when the comparison result shows that the length of the missing segment is smaller than the length threshold value, performing linear interpolation on the missing segment to obtain sample data corresponding to each index after interpolation;
if the comparison result is that the length of the missing segment is not smaller than the length threshold value, performing contemporaneous data interpolation on the missing segment to obtain sample data corresponding to each index after interpolation; the contemporaneous data are data obtained by sampling the same index from the corresponding sampling object at the same moment of different dates.
6. The method of any of claims 1-4, wherein the multiple metrics comprise multiple metrics of a fiber broadband correspondence metric.
7. A multi-index anomaly detection device, comprising:
the acquisition module is used for acquiring multi-index data to be detected;
the acquisition module is further configured to acquire a target self-encoder, where the target self-encoder includes a graph learning layer, the graph learning layer is configured to generate an adjacency matrix corresponding to the multiple indexes according to the distance matrix corresponding to the multiple indexes, and the target self-encoder processes the multiple-index data to be detected according to the adjacency matrix;
the detection module is used for carrying out anomaly detection on the multi-index data to be detected according to the target self-encoder to obtain a detection result;
the acquisition module is used for acquiring sample data of each index in the multiple indexes at multiple moments; generating feature vectors corresponding to the indexes according to sample data of the indexes at a plurality of moments; calculating target distances among feature vectors corresponding to the indexes to obtain the distance matrix; constructing the graph learning layer according to the distance matrix, wherein the graph learning layer takes the distance matrix as an initial matrix for learning the adjacent matrix; constructing an initial self-encoder according to the graph learning layer; training the initial self-encoder to obtain the target self-encoder.
8. An electronic device, comprising:
a processor; and
a memory for storing executable instructions of the processor;
wherein the processor is configured to perform the multi-index anomaly detection method of any one of claims 1-6 via execution of the executable instructions.
9. A computer-readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the multi-index anomaly detection method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210957324.9A CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210957324.9A CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115345279A CN115345279A (en) | 2022-11-15 |
| CN115345279B true CN115345279B (en) | 2024-03-29 |
Family
ID=83952497
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210957324.9A Active CN115345279B (en) | 2022-08-10 | 2022-08-10 | Multi-index anomaly detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115345279B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117074627B (en) * | 2023-10-16 | 2024-01-09 | 三科智能(山东)集团有限公司 | Medical laboratory air quality monitoring system based on artificial intelligence |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| CN112364939A (en) * | 2020-12-04 | 2021-02-12 | 中信银行股份有限公司 | Abnormal value detection method, device, equipment and storage medium |
| CN113569972A (en) * | 2021-08-03 | 2021-10-29 | 中国科学院地理科学与资源研究所 | Meteorological data interpolation method, meteorological data interpolation device, electronic equipment and storage medium |
| CN113988268A (en) * | 2021-11-03 | 2022-01-28 | 西安交通大学 | Heterogeneous multi-source time sequence anomaly detection method based on unsupervised full-attribute graph |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11989013B2 (en) * | 2019-01-18 | 2024-05-21 | Nec Corporation | Abnormality detection apparatus, abnormality detection system, and learning apparatus, and methods for the same and non-temporary computer-readable medium storing the same |
-
2022
- 2022-08-10 CN CN202210957324.9A patent/CN115345279B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109978379A (en) * | 2019-03-28 | 2019-07-05 | 北京百度网讯科技有限公司 | Time series data method for detecting abnormality, device, computer equipment and storage medium |
| CN112364939A (en) * | 2020-12-04 | 2021-02-12 | 中信银行股份有限公司 | Abnormal value detection method, device, equipment and storage medium |
| CN113569972A (en) * | 2021-08-03 | 2021-10-29 | 中国科学院地理科学与资源研究所 | Meteorological data interpolation method, meteorological data interpolation device, electronic equipment and storage medium |
| CN113988268A (en) * | 2021-11-03 | 2022-01-28 | 西安交通大学 | Heterogeneous multi-source time sequence anomaly detection method based on unsupervised full-attribute graph |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115345279A (en) | 2022-11-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108427939B (en) | Model generation method and device | |
| CN115345279B (en) | Multi-index anomaly detection method and device, electronic equipment and storage medium | |
| CN112149706B (en) | Model training method, device, equipment and medium | |
| WO2019116352A1 (en) | Scalable parameter encoding of artificial neural networks obtained via an evolutionary process | |
| CN112347500A (en) | Machine learning method, device, system, equipment and storage medium of distributed system | |
| CN116166271A (en) | Code generation method and device, storage medium and electronic equipment | |
| CN111585770A (en) | Method, device, medium and system for distributed acquisition of zero-knowledge proof | |
| CN116578684A (en) | Knowledge graph-based question and answer method and device and related equipment | |
| CN116629379A (en) | Federal learning aggregation method and device, storage medium and electronic equipment | |
| CN115102779B (en) | Prediction model training and access request decision method, device and medium | |
| US20230129576A1 (en) | System and method for smart contract decoding and encoding | |
| CN114237962B (en) | Alarm root cause judging method, model training method, device, equipment and medium | |
| CN116109537A (en) | Distorted image reconstruction method and related device based on deep learning | |
| CN114595474A (en) | Federal learning modeling optimization method, electronic device, medium, and program product | |
| CN113961962A (en) | Model training method and system based on privacy protection and computer equipment | |
| CN115063536B (en) | Image generation method, device, electronic equipment and computer readable storage medium | |
| CN113658076B (en) | Image restoration method, device, equipment and medium based on feature entanglement modulation | |
| CN113537361B (en) | Cross-sample feature selection method in federal learning system and federal learning system | |
| CN114785605B (en) | Determination method, device, equipment and storage medium of network anomaly detection model | |
| CN117688559A (en) | Virus program detection method and device, electronic equipment and storage medium | |
| CN116562396A (en) | Federal learning participant screening method and device, electronic equipment and storage medium | |
| CN115600216B (en) | Detection method, detection device, detection equipment and storage medium | |
| CN118052274A (en) | Federal learning method, federal learning device, electronic apparatus, and computer-readable storage medium | |
| CN115062673B (en) | Image processing method, image processing device, electronic equipment and storage medium | |
| CN115374418B (en) | Emotion authentication method, emotion authentication device, storage medium and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |