CN116049757A - Flow abnormal behavior detection method based on concept drift - Google Patents
Flow abnormal behavior detection method based on concept drift Download PDFInfo
- Publication number
- CN116049757A CN116049757A CN202310342490.2A CN202310342490A CN116049757A CN 116049757 A CN116049757 A CN 116049757A CN 202310342490 A CN202310342490 A CN 202310342490A CN 116049757 A CN116049757 A CN 116049757A
- Authority
- CN
- China
- Prior art keywords
- data
- business process
- flow
- time window
- concept drift
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 32
- 206010000117 Abnormal behaviour Diseases 0.000 title claims abstract description 21
- 238000000034 method Methods 0.000 claims abstract description 119
- 230000008569 process Effects 0.000 claims abstract description 100
- 230000006399 behavior Effects 0.000 claims abstract description 51
- 238000009826 distribution Methods 0.000 claims abstract description 21
- 230000015654 memory Effects 0.000 claims abstract description 7
- 238000007781 pre-processing Methods 0.000 claims abstract description 7
- 230000009977 dual effect Effects 0.000 claims abstract description 6
- 238000004140 cleaning Methods 0.000 claims abstract description 4
- 238000012545 processing Methods 0.000 claims description 13
- 238000005065 mining Methods 0.000 claims description 9
- 238000012360 testing method Methods 0.000 claims description 7
- 238000004458 analytical method Methods 0.000 claims description 6
- 238000012549 training Methods 0.000 claims description 5
- 238000001276 Kolmogorov–Smirnov test Methods 0.000 claims description 4
- 230000002159 abnormal effect Effects 0.000 claims description 4
- 230000006870 function Effects 0.000 claims description 4
- 238000003062 neural network model Methods 0.000 claims description 3
- 238000005457 optimization Methods 0.000 claims description 3
- 230000005856 abnormality Effects 0.000 abstract 1
- 238000013528 artificial neural network Methods 0.000 description 6
- 238000013507 mapping Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000007787 long-term memory Effects 0.000 description 4
- 230000008859 change Effects 0.000 description 3
- 238000000605 extraction Methods 0.000 description 3
- 230000007547 defect Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 239000013598 vector Substances 0.000 description 2
- 206010033799 Paralysis Diseases 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 238000011031 large-scale manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006403 short-term memory Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a flow abnormal behavior detection method based on concept drift, which relates to the technical field of industrial Internet and comprises the following steps: acquiring historical data of a business process; acquiring industrial Internet port data, and cleaning and preprocessing the acquired port data to obtain a historical target data set; according to the acquired business process history data, a dual sliding time window is adopted to construct a business process prediction model; based on the constructed business process prediction model, a two-way long-short-term memory network is used for obtaining a business process behavior prediction value at the next moment of the sliding time window; capturing original data input during prediction based on the business process prediction model, and judging whether the input data based on the new sliding time window and the original data in the input base window belong to the same distribution; concept drift detection in the business process prediction process is realized; the accuracy and the rationality of the process abnormality prediction in the industrial Internet are improved.
Description
Technical Field
The invention relates to the technical field of industrial Internet, in particular to a flow abnormal behavior detection method based on concept drift.
Background
Industrial internet is a very complex system, which covers all entities, tools, data, methods and processes related to the industrial field, and also involves various key technologies and tools such as software and hardware data protocols, distributed technologies, etc. Based on the method, once the process behaviors in the industrial Internet are abnormal or attacked, large-scale production paralysis can be caused, the loss amount reaches hundreds of millions, and the method has the characteristics of wide range, large influence and serious loss.
However, most industrial internet process behavior anomaly detection systems only stay in the establishment of an offline model for process anomalies that have occurred in the past, i.e., a fixed model is used for matching detection, and neither an unknown process anomaly nor a changed process anomaly can be detected. In fact, in a real industrial internet system, resources and devices related to flow behaviors are updated and even replaced continuously, a constant anomaly detection model cannot meet the requirement of the change, the situation that the model is not applicable any more due to the change with time is called concept drift, and the occurrence of the concept drift leads to low detection rate of flow behavior anomalies in the whole industrial internet system. Therefore, the invention provides a business process abnormal behavior detection method based on concept drift.
Disclosure of Invention
The present invention aims to solve at least one of the technical problems existing in the prior art. Therefore, the invention provides a flow abnormal behavior detection method based on concept drift, which supports real-time online acquisition of log data of business flow behaviors, and realizes early warning and warning functions for various abnormal behaviors by constructing a business flow prediction model based on concept drift, so that the prediction result of the business flow prediction model is more accurate and reasonable.
To achieve the above object, an embodiment according to a first aspect of the present invention proposes a method for detecting flow abnormal behavior based on concept drift, including the steps of:
step one: acquiring historical data of a business process; acquiring industrial Internet port data, and cleaning and preprocessing the acquired port data to obtain a historical target data set;
step two: according to the acquired business process history data, a dual sliding time window is adopted to construct a business process prediction model;
step three: based on the constructed business process prediction model, a two-way long-short-term memory network is used for obtaining a business process behavior prediction value at the next moment of the sliding time window;
step four: capturing original data input during prediction based on the business process prediction model, and comparing the original data with the business process behavior prediction value to realize concept drift detection in the business process prediction process;
in the process of concept drift detection, judging whether input data based on a new sliding time window and original data in an input base window belong to the same distribution;
if yes, concept drift does not occur in the process of business process prediction, and the constructed business process prediction model is continuously used for predicting the business process;
if not, the concept drift occurs in the process of business process prediction, and a business process prediction model needs to be reconstructed to predict the business process.
Further, a flow behavior historical data set is obtained based on the acquired business flow historical data; a double sliding time window method is adopted on a flow behavior historical data set, flow behavior data at the current moment and the historical moment in a time window are used as an input sequence of a flow behavior historical model, and a flow historical model is built; and taking flow behavior log data of the moment next to the moment of the sliding time window as a prediction object, inputting the prediction object into a flow behavior history model, and continuously performing iterative optimization on the business flow prediction model by comparing whether the two belong to the same distribution, thereby completing the training of the business flow prediction model.
Further, the business process prediction model adopts a two-way long-short-term memory network; and predicting a test set in the historical data set of the flow behavior by using the trained Bi-LSTM neural network model to obtain a flow behavior predicted value of the next moment of the sliding time window.
Further, the double sliding time windows are a base window and a new window respectively, data are input from the new window, and data constructed by the business process prediction model are derived from the base window;
further, the preprocessing comprises log template mining processing, log analysis processing based on the longest public subsequence and matching search processing; the log template mining processing is to keep constants of the program printing statement, which store more key information, and delete variables;
the log analysis processing based on the longest public subsequence is used for dynamically maintaining the mining of the log template, and is characterized in that a data structure LCSLMap for storing log keys and other information is maintained;
the matching lookup process is to match the longest common subsequence with the stored log template when a new log arrives.
Further, judging whether the input data based on the new sliding time window and the original data in the input base window belong to the same distribution, specifically comprising the following steps: test statistic D using K-S test n Is that
Wherein, sup is the upper bound of the function value, x is the current time of the sliding time window, F n (x) For a new input data sequence of the sliding time window, F (x) is the original data sequence in the input base window.
Further, suppose F n (x) Calculating an absolute difference of an integrated frequency between input data and input original data based on a new sliding time window, and setting the maximum absolute difference to be D n The method comprises the steps of carrying out a first treatment on the surface of the Based on sample size n and significance levelα obtains a critical value D (n, α);
if D n > 0.5 xD (n, alpha), then giving out early warning of concept drift; if D n If D (n, alpha), if the input data based on the new sliding time window and the input original data do not belong to the same distribution, a concept drift alarm is sent; the determined concept drift node is displayed in a data list in a highlighted form.
Further, when the early warning of concept drift is received, a temporary sliding time window is started, data for sending early warning information and data for the future are received, and a temporary business process abnormal behavior detection model is trained by using the temporary sliding time window; when a concept drift alarm is received, replacing the original business process history prediction model with the temporary business process prediction model, clearing a temporary sliding time window, and moving the base window to the next moment of the concept drift point.
Compared with the prior art, the invention has the beneficial effects that:
1. according to the method, the Bi-LSTM neural network is introduced, so that the long-term memory of the Bi-LSTM neural network to the flow behavior data is fully utilized, the contribution of the current prediction of the historical information can be automatically adjusted according to the current state, the defect of poor long-term memory of the business flow behavior log data in the prior art is avoided, and the accuracy of flow behavior anomaly detection is improved;
2. by introducing a concept drift detection mechanism, original data used for prediction by capturing Bi-LSTM neural network are captured, whether the original data and the old data of a new entry window belong to the same distribution is judged, if the original data and the old data belong to the same distribution, the fact that the mapping relation between the current data and influence factors of the current data is not changed is indicated, a current business process prediction model is still effective, if the current data and the influence factors of the current data do not belong to the same distribution, the fact that the mapping relation between the data and the influence factors of the current business process prediction model is changed is indicated, the original business process prediction model is not established any more, at the moment, an alarm is sent to enable the system to retrain the business process prediction model under the new mapping relation to replace the original model to perform a prediction task, the business process prediction model is adapted to the changed new data in time, and accuracy and rationality of process behavior prediction are improved.
Drawings
In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic block diagram of a flow abnormal behavior detection method based on conceptual drift according to the present invention.
FIG. 2 is a diagram of a dual time window according to the present invention.
FIG. 3 is a flow chart of the detection of conceptual drift during abnormal behavior of the business process of the present invention.
FIG. 4 is a block diagram of detecting concept drift during abnormal behavior of the process of the present invention.
FIG. 5 is a schematic diagram of a Bi-LSTM model constructed in accordance with the present invention.
Detailed Description
Detection of concept drift in abnormal behavior process of business process
The technical solutions of the present invention will be clearly and completely described in connection with the embodiments, and it is obvious that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
As shown in fig. 1 to 5, the method for detecting flow abnormal behavior based on concept drift includes:
step one: acquiring historical data of a business process; acquiring industrial Internet port data, and cleaning and preprocessing the acquired port data to obtain a historical target data set; the preprocessing comprises log template mining processing, log analysis processing based on the longest public subsequence and matching searching processing;
the log template mining processing is to keep constants of the program printing statement, which store more key information, and delete variables;
the log analysis processing based on the longest public subsequence is used for dynamically maintaining the mining of the log template, and is characterized in that a data structure LCSLMap for storing log keys and other information is maintained;
and the matching search processing is to search matched log keys in the LCS map according to the log sequence when a new log sequence of the parsed new log record arrives. Using a loop through the set of log keys in the entire lcs map, for each log key in the set, one pointer to the log key header and another pointer to the new log record sequence header are maintained. If the elements pointed by the two pointers are matched, both pointers are moved in; otherwise, only the pointer of the new log record sequence can be advanced, and when the end of the log record sequence is reached, it is checked whether the log key pointer also reaches the end.
Step two: according to the acquired business process history data, a dual sliding time window is adopted to construct a business process prediction model;
step three: based on the constructed business process prediction model, a two-way long-short-term memory network is used for obtaining a business process behavior prediction value at the next moment of the sliding time window;
step four: capturing original data input during prediction based on a business process prediction model, and comparing the original data with a business process behavior prediction value to realize concept drift detection in a business process prediction process;
in the process of concept drift detection, judging whether input data based on a new sliding time window and original data in an input base window belong to the same distribution;
if yes, concept drift does not occur in the process of business process prediction, and the constructed business process prediction model is continuously used for predicting the business process;
if not, concept drift occurs in the process of business process prediction, and a business process prediction model is required to be reconstructed to predict the business process;
as shown in fig. 2, the dual time window method detects a conceptual drift diagram: the double windows are a base window and a new window respectively, data are input from the new window, a business process prediction model constructs a data source base window, and when concept drift early warning occurs at a certain moment in the new window, a temporary window is built from the moment to store business process log data at the next moment. If concept drift does occur at this time, a temporary window substituent window is used for establishing a new business process prediction model; if no concept drift occurs, the new window is moved backward by one time and the temporary window is emptied.
In this embodiment, the sliding time Window length window_size is selected: setting the length Window_Size of a time Window for sliding interception of business process behavior data, and ensuring that the Window_Size is smaller than the lengths of a training set and a testing set; the sliding time Window length Window_Size has a value of 100 to 300;
as a further technical definition, obtaining a flow behavior history dataset based on the obtained business flow history data; a double sliding time window method is adopted on a flow behavior historical data set, flow behavior data at the current moment and the historical moment in a time window are used as an input sequence of a flow behavior historical model, and a flow historical model is built;
taking flow behavior log data of the moment next to the moment of the sliding time window as a prediction object, inputting the prediction object into a flow behavior history model, and continuously performing iterative optimization on the business flow prediction model by comparing whether the two belong to the same distribution, thereby completing training of the business flow prediction model;
as a further technical limitation, a business process prediction model adopts a Bi-directional long-short-Term Memory network (Bi-directional Long Short-Term Memory, bi-LSTM for short); predicting a test set in a historical data set of the flow behavior by using the trained Bi-LSTM neural network model to obtain a flow behavior predicted value of the next moment of the sliding time window;
as shown in fig. 3; the detection of concept drift in the abnormal behavior process of the business process comprises the following specific processes:
s1: connecting the new sliding time window with the base window, sliding on the data set, and starting to perform concept drift detection after the base window and the new window are full of data, as shown in fig. 4;
s2: adopting K-S test to judge whether the input data based on the new sliding time window and the original data in the input base window belong to the same distribution; test statistic D using K-S test n Is that
Wherein, sup is the upper bound of the function value, x is the current time of the sliding time window, F n (x) For a new sliding time window input data sequence, F (x) is the original data sequence in the input base window;
suppose F n (x) Calculating an absolute difference of an integrated frequency between input data and input original data based on a new sliding time window, and setting the maximum absolute difference to be D n The method comprises the steps of carrying out a first treatment on the surface of the Deriving a threshold value D (n, α) based on the sample size n and the significance level α;
if D n > 0.5 xD (n, alpha), then giving out early warning of concept drift; if D n If D (n, alpha), if the input data based on the new sliding time window and the input original data do not belong to the same distribution, a concept drift alarm is sent; the determined concept drift node is displayed in a data list in a highlighted form; the concept drift node may be alerted by highlighting it.
S3: when receiving the early warning of concept drift, starting a temporary sliding time window, receiving data for sending early warning information and data for the future, and training a temporary business process abnormal behavior detection model by using the temporary sliding time window; when a concept drift alarm is received, replacing the original business process history prediction model with the temporary business process prediction model, clearing a temporary sliding time window, and moving the base window to the next moment of the concept drift point.
As shown in fig. 5; the constructed Bi-LSTM model firstly carries out template extraction and analysis on historical flow log data to obtain word embedding vectors, after character expression, the word embedding vectors are used as input of a Bi-LSTM prediction model framework, forward information and backward information are respectively obtained by utilizing the Bi-LSTM model, feature extraction is carried out through forward and backward angles, then the bidirectional extraction results are combined according to connection operation, a CRF layer is added on the basis, information in a Bi-LSTM neural network is reused, a globally optimal output sequence is obtained, key information is obtained, a final flow behavior predicted value is obtained, and detection of flow abnormal behaviors is realized.
According to the embodiment, the Bi-LSTM neural network is introduced, so that the long-term memory of the LSTM network on the flow behavior data is fully utilized, the contribution of the current prediction of the historical information can be automatically adjusted according to the current state, the defect that the long-term memory of the business flow behavior data is poor in the prior art is avoided, and the accuracy of the flow behavior prediction is improved; the existence of the concept drift phenomenon gradually causes the data distribution to be changed through the form of data value change, the data is not in the same distribution with the old data, the original data used for prediction through capturing the Bi-LSTM neural network is judged whether the original data which enters the window newly belongs to the same distribution or not through introducing the concept drift detection mechanism, if the original data belongs to the same distribution through detection, the fact that the mapping relation between the current data and the influence factors of the current data is not changed is indicated, the current prediction model is still effective, if the current prediction model does not belong to the same distribution, the fact that the mapping relation between the data and the influence factors of the data is changed is indicated, the original prediction model is not established any more, and an alarm is sent out at the moment; the system retrains the prediction model under the new mapping relation to replace the original model to perform the prediction task, so that the prediction model is adapted to the changed new data in time, and the accuracy and the rationality of flow behavior prediction are improved.
The above formulas are all formulas with dimensions removed and numerical values calculated, the formulas are formulas which are obtained by acquiring a large amount of data and performing software simulation to obtain the closest actual situation, and preset parameters and preset thresholds in the formulas are set by a person skilled in the art according to the actual situation or are obtained by simulating a large amount of data.
In the description of the present specification, the descriptions of the terms "one embodiment," "example," "specific example," and the like, mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
The preferred embodiments of the invention disclosed above are intended only to assist in the explanation of the invention. The preferred embodiments are not intended to be exhaustive or to limit the invention to the precise form disclosed. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, to thereby enable others skilled in the art to best understand and utilize the invention. The invention is limited only by the claims and the full scope and equivalents thereof.
Claims (8)
1. The flow abnormal behavior detection method based on concept drift is characterized by comprising the following steps:
step one: acquiring historical data of a business process; acquiring industrial Internet port data, and cleaning and preprocessing the acquired port data to obtain a historical target data set;
step two: according to the acquired business process history data, a dual sliding time window is adopted to construct a business process prediction model;
step three: based on the constructed business process prediction model, a two-way long-short-term memory network is used for obtaining a business process behavior prediction value at the next moment of the sliding time window;
step four: capturing original data input during prediction based on the business process prediction model, and comparing the original data with the business process behavior prediction value to realize concept drift detection in the business process prediction process;
in the process of concept drift detection, judging whether input data based on a new sliding time window and original data in an input base window belong to the same distribution;
if yes, concept drift does not occur in the process of business process prediction, and the constructed business process prediction model is continuously used for predicting the business process;
if not, the concept drift occurs in the process of business process prediction, and a business process prediction model needs to be reconstructed to predict the business process.
2. The concept drift based flow anomaly behavior detection method of claim 1, wherein a flow behavior history data set is obtained based on the acquired business flow history data; a double sliding time window method is adopted on a flow behavior historical data set, flow behavior data at the current moment and the historical moment in a time window are used as an input sequence of a flow behavior historical model, and a flow historical model is built; and taking flow behavior log data of the moment next to the moment of the sliding time window as a prediction object, inputting the prediction object into a flow behavior history model, and continuously performing iterative optimization on the business flow prediction model by comparing whether the two belong to the same distribution, thereby completing the training of the business flow prediction model.
3. The method for detecting flow abnormal behavior based on concept drift according to claim 2, wherein the business flow prediction model adopts a two-way long-short-term memory network; and predicting a test set in the historical data set of the flow behavior by using the trained Bi-LSTM neural network model to obtain a flow behavior predicted value of the next moment of the sliding time window.
4. The method for detecting abnormal flow behavior based on concept drift as set forth in claim 1, wherein said double sliding time window is a base window and a new window, respectively, data is input from the new window, and data constructed by the business flow prediction model is derived from the base window.
5. The method for detecting flow abnormal behavior based on concept drift according to claim 1, wherein the data preprocessing includes mining a flow log template, log parsing based on a longest common subsequence, and matching search; the process log template mining processing is to keep constants storing more key information in program printing sentences and delete variables;
the log analysis processing based on the longest public subsequence is used for dynamically maintaining the mining of the log template, and is characterized in that a data structure LCSLMap for storing log keys and other information is maintained;
the matching lookup process is to match the longest common subsequence with the stored log template when a new log arrives.
6. The method for detecting flow abnormal behavior based on concept drift according to claim 2, wherein the step of determining whether the input data based on the new sliding time window and the input raw data in the base window belong to the same distribution comprises the following specific steps: test statistic D using K-S test n is 
Wherein, sup is the upper bound of the function value, x is the current time of the sliding time window, F n (x) For a new input data sequence of the sliding time window, F (x) is the original data sequence in the input base window.
7. The method for detecting flow anomaly behavior based on concept drift of claim 6, wherein F is assumed n (x) Calculating an absolute difference of an integrated frequency between input data and input original data based on a new sliding time window, and setting the maximum absolute difference to be D n The method comprises the steps of carrying out a first treatment on the surface of the Deriving a threshold value D (n, α) based on the sample size n and the significance level α;
if D n > 0.5 xD (n, alpha), then giving out early warning of concept drift; if D n > D (n, α), then the assumption is not true, based on the input data of the new sliding time window and the original inputIf the data do not belong to the same distribution, giving out a conceptual drift alarm; the determined concept drift node is displayed in a data list in a highlighted form.
8. The method for detecting abnormal flow behavior based on concept drift as set forth in claim 7, wherein when receiving the early warning of concept drift, a temporary sliding time window is enabled, data for sending out early warning information and data for the future are received, and a temporary abnormal flow behavior detection model is trained using the temporary sliding time window; when a concept drift alarm is received, replacing the original business process history prediction model with the temporary business process prediction model, clearing a temporary sliding time window, and moving the base window to the next moment of the concept drift point.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310342490.2A CN116049757A (en) | 2023-04-03 | 2023-04-03 | Flow abnormal behavior detection method based on concept drift |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310342490.2A CN116049757A (en) | 2023-04-03 | 2023-04-03 | Flow abnormal behavior detection method based on concept drift |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116049757A true CN116049757A (en) | 2023-05-02 |
Family
ID=86125981
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310342490.2A Pending CN116049757A (en) | 2023-04-03 | 2023-04-03 | Flow abnormal behavior detection method based on concept drift |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116049757A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117493220A (en) * | 2024-01-03 | 2024-02-02 | 安徽思高智能科技有限公司 | RPA flow operation abnormity detection method, device and storage device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112508265A (en) * | 2020-12-02 | 2021-03-16 | 中国极地研究中心 | Time and activity multi-task prediction method and system for business process management |
| CN114968633A (en) * | 2022-04-14 | 2022-08-30 | 阿里巴巴（中国）有限公司 | Abnormal log detection method and device |
| CN115513951A (en) * | 2022-11-17 | 2022-12-23 | 山东建筑大学 | Power load prediction method and system based on concept drift detection |
-
2023
- 2023-04-03 CN CN202310342490.2A patent/CN116049757A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112508265A (en) * | 2020-12-02 | 2021-03-16 | 中国极地研究中心 | Time and activity multi-task prediction method and system for business process management |
| CN114968633A (en) * | 2022-04-14 | 2022-08-30 | 阿里巴巴（中国）有限公司 | Abnormal log detection method and device |
| CN115513951A (en) * | 2022-11-17 | 2022-12-23 | 山东建筑大学 | Power load prediction method and system based on concept drift detection |
Non-Patent Citations (1)
| Title |
|---|
| 陈燕等: "数据挖掘与聚类分析", 大连海事大学出版社, pages: 314 - 317 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117493220A (en) * | 2024-01-03 | 2024-02-02 | 安徽思高智能科技有限公司 | RPA flow operation abnormity detection method, device and storage device |
| CN117493220B (en) * | 2024-01-03 | 2024-03-26 | 安徽思高智能科技有限公司 | RPA flow operation abnormity detection method, device and storage device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111210024B (en) | Model training method, device, computer equipment and storage medium | |
| CN110148285B (en) | Intelligent oil well parameter early warning system based on big data technology and early warning method thereof | |
| CN112436968B (en) | Network traffic monitoring method, device, equipment and storage medium | |
| CN111639430A (en) | Digital twin driven natural gas pipeline leakage identification system | |
| CN110895526A (en) | Method for correcting data abnormity in atmosphere monitoring system | |
| CN112528519A (en) | Method, system, readable medium and electronic device for engine quality early warning service | |
| CN111966076A (en) | Fault positioning method based on finite-state machine and graph neural network | |
| CN116049757A (en) | Flow abnormal behavior detection method based on concept drift | |
| CN111444677A (en) | Reading model optimization method, device, equipment and medium based on big data | |
| WO2024046086A1 (en) | Automatic history matching method and apparatus based on ru-net and lstm neural network models | |
| CN112396250A (en) | Diesel engine fault prediction method, device, equipment and storage medium | |
| CN115513951A (en) | Power load prediction method and system based on concept drift detection | |
| CN116000131A (en) | Intelligent operation and maintenance method and system for extruder equipment based on data driving | |
| CN117313844A (en) | Intelligent control method and system of Internet of things based on knowledge graph | |
| CN117494555A (en) | Training method and device for pipeline stress prediction model and computing equipment | |
| CN117408519A (en) | Chemical reaction process risk early warning method and device based on deep learning algorithm | |
| CN116861214A (en) | Health state identification method and system based on convolution long short-time memory network | |
| CN115081485B (en) | AI-based magnetic flux leakage internal detection data automatic analysis method | |
| CN115829160A (en) | Time sequence abnormity prediction method, device, equipment and storage medium | |
| CN113535458B (en) | Abnormal false alarm processing method and device, storage medium and terminal | |
| CN116244596A (en) | Industrial time sequence data anomaly detection method based on TCN and attention mechanism | |
| CN115426161A (en) | Abnormal device identification method, apparatus, device, medium, and program product | |
| CN114897047A (en) | Multi-sensor data drift detection method based on depth dictionary | |
| CN113836539A (en) | Power engineering control system leak full-flow disposal system and method based on precise test | |
| Hong et al. | Drainage network flow anomaly classification based on XGBoost |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20230502 |