CN116627773B - Abnormality analysis method and system of production and marketing difference statistics platform system - Google Patents

Abnormality analysis method and system of production and marketing difference statistics platform system Download PDF

Info

Publication number
CN116627773B
CN116627773B CN202310900005.9A CN202310900005A CN116627773B CN 116627773 B CN116627773 B CN 116627773B CN 202310900005 A CN202310900005 A CN 202310900005A CN 116627773 B CN116627773 B CN 116627773B
Authority
CN
China
Prior art keywords
abnormal state
template
network
event
system operation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202310900005.9A
Other languages
Chinese (zh)
Other versions
CN116627773A (en
Inventor
张波
廖建国
王佳
屈小东
李春林
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sichuan Development Environmental Science And Technology Research Institute Co ltd
Original Assignee
Sichuan Development Environmental Science And Technology Research Institute Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sichuan Development Environmental Science And Technology Research Institute Co ltd filed Critical Sichuan Development Environmental Science And Technology Research Institute Co ltd
Priority to CN202310900005.9A priority Critical patent/CN116627773B/en
Publication of CN116627773A publication Critical patent/CN116627773A/en
Application granted granted Critical
Publication of CN116627773B publication Critical patent/CN116627773B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3452—Performance evaluation by statistical analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/0475—Generative networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/094—Adversarial learning
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/30—Computing systems specially adapted for manufacturing

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Mathematical Physics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Molecular Biology (AREA)
  • Evolutionary Computation (AREA)
  • Data Mining & Analysis (AREA)
  • Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Probability & Statistics with Applications (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The embodiment of the application provides an anomaly analysis method and an anomaly analysis system for a production and marketing difference statistics platform system, which are characterized in that monitored system operation event data is loaded to a trained generation type countercheck network and a time circulation neural network to determine whether the system operation event can be classified as an anomaly state event or not, so that the purpose of anomaly analysis of multiple networks is realized, the system operation event is observed in an anomaly state by combining the generation type countercheck network and the time circulation neural network, a large amount of anomaly state data is generated according to the generation type countercheck network, the characteristic quantity of the anomaly state event is expanded, and the generation type countercheck network with a large characteristic span of the system operation event is optimized for time circulation memory defects according to the time circulation neural network, so that the anomaly state analysis reliability is improved.

Description

Abnormality analysis method and system of production and marketing difference statistics platform system
Technical Field
The embodiment of the application relates to the technical field of artificial intelligence, in particular to an anomaly analysis method and an anomaly analysis system of a production and marketing difference statistics platform system.
Background
With development of cloud computing technology, various statistical platform systems can be distributed in a cloud computing server, so that various system operation functions (such as a data acquisition function, a data uploading function, a data statistics function and the like) of the statistical platform systems can be distributed on a cloud for unified service, and the statistical efficiency of the statistical platform is improved. For example, for a product and sales differential statistical platform system that requires efficient operation, how to improve its stability is critical. In the related art, whether the system operation event of the production and marketing difference statistical platform system is abnormal or not can be monitored in real time through a machine learning algorithm, so that subsequent maintenance and optimization are facilitated. However, in the solution of the single machine learning network in the existing solution, when the time feature span of the system operation event is large, there is a time cycle memory defect, thereby affecting the accuracy of the abnormal state analysis.
Disclosure of Invention
In order to overcome the above-mentioned shortcomings in the prior art at least, an object of the embodiments of the present application is to provide an anomaly analysis method and system for a production and marketing difference statistics platform system, which performs anomaly state observation on a system operation event by combining a generated countermeasure network and a time-cycle neural network, generates a large amount of anomaly state data according to the generated countermeasure network, expands the feature quantity of the anomaly state event, and performs optimization on the time-cycle memory defect of the generated countermeasure network caused by a large feature span of the system operation event according to the time-cycle neural network, thereby improving the anomaly state analysis reliability.
According to an aspect of the embodiment of the application, there is provided an anomaly analysis method of a production and marketing difference statistics platform system, including:
acquiring a target system operation event monitored by the production and marketing difference statistical platform system;
loading the target system operation event into a generating type countermeasure network, generating first abnormal state analysis data determined by the generating type countermeasure network, wherein the first abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event, the generating type countermeasure network is generated by carrying out network weight information learning on a first initialization prediction network according to a first template abnormal state event sequence and a second template abnormal state event sequence, the first template abnormal state event sequence comprises template abnormal state events extracted into a task queue, and the second template abnormal state event sequence comprises abnormal state events which are derived and expanded based on the template abnormal state events in the first template abnormal state event sequence;
When the first abnormal state analysis data reflects that the target system operation event is an abnormal state event, loading the target system operation event into a target time-cycle neural network, and generating second abnormal state analysis data determined by the target time-cycle neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as the abnormal state event.
In a possible implementation manner of the first aspect, the method further includes:
and carrying out network weight information learning on the first initialization prediction network according to the first template abnormal state event sequence and the second template abnormal state event sequence to generate the generated countermeasure network.
In a possible implementation manner of the first aspect, the learning of the network weight information of the first initialized prediction network according to the first template abnormal state event sequence and the second template abnormal state event sequence, to generate the generated countermeasure network, includes:
the following operations are circularly performed until the generated countermeasure network is trained to terminate outputting:
sequentially loading K template abnormal state events in the first template abnormal state event sequence and K template or disturbance state features in the template or disturbance state feature sequence to an initialized game learning network to generate K template abnormal state events respectively output by the initialized game learning network, wherein the second template abnormal state event sequence comprises K template abnormal state events respectively output by the initialized game learning network, loading feature data loaded to a target game learning network each time comprises one template abnormal state event and one template or disturbance state feature, and the initialized game learning network is used for generating abnormal state events matched with the loaded one template abnormal state event each time based on the loaded one template or disturbance state feature;
And carrying out network weight information learning on the first initialization prediction network according to K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initialization game learning network.
In a possible implementation manner of the first aspect, the performing network weight information learning on the first initialized prediction network according to K template abnormal state events in the first sequence of template abnormal state events and K template abnormal state events respectively output by the initialized game learning network includes:
acquiring a template system operation event sequence, wherein the template system operation event sequence comprises K template abnormal state events in the first template abnormal state event sequence, K template abnormal state events respectively output by the initialized game learning network and the acquired non-abnormal system operation event sequence;
the following operations are circularly performed until the network converges:
acquiring candidate template system operation events from the template system operation event sequence;
loading the template system operation event to the first initialization prediction network, and generating reference prediction data determined by the first initialization prediction network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event;
Determining a prediction error calculation value of a first prediction error parameter layer of the first initialization prediction network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event;
when the prediction error calculated value of the first prediction error parameter layer does not accord with a first prediction error convergence condition, updating the network weight information in the first initialization prediction network and the initialization game learning network, or updating the network weight information in the first initialization prediction network;
and when the prediction error calculated value of the first prediction error parameter layer accords with the first prediction error convergence condition, updating the first initialization prediction network, wherein the generated countermeasure network is the first initialization prediction network when updating is stopped.
In a possible implementation manner of the first aspect, the loading K template abnormal state events in the first sequence of template abnormal state events and K template or potential disturbance state features in the sequence of template or potential disturbance state features into an initialized game learning network in sequence, and generating K template abnormal state events respectively output by the initialized game learning network includes:
When the first template abnormal state event sequence comprises Y first template abnormal state event subsequences and each first template abnormal state event subsequence comprises template abnormal state events of the same abnormal state label, executing the following steps aiming at each first template abnormal state event subsequence, wherein each first template abnormal state event subsequence is determined to be a real-time template abnormal state event subsequence, and the template abnormal state events in the real-time template abnormal state event subsequence belong to the real-time abnormal state label:
the K1 template abnormal state events in the first template abnormal state event subsequence and the K1 template abnormal state features in the template abnormal state feature sequence are sequentially loaded to a real-time game learning sub-network corresponding to the real-time abnormal state labels, K1 template abnormal state events which are respectively output by the real-time game learning sub-network are generated, the initialized game learning network comprises Y game learning sub-networks, the second template abnormal state event sequence comprises Y second abnormal state event subsequences, the second abnormal state event subsequences corresponding to the real-time abnormal state labels in the second template abnormal state event sequence comprise K1 template abnormal state events which are respectively output by the real-time game learning sub-network, the loaded feature data loaded to the real-time game learning sub-network comprise one template abnormal state event and one template abnormal state feature, the real-time game learning sub-network is used for generating the K state events which are matched with the loaded template abnormal state events based on the loaded template abnormal state features, the K state events are abnormal state labels, and the K1 abnormal state events are natural state labels, and the K1 abnormal state events are abnormal state labels are generated.
In a possible implementation manner of the first aspect, the performing network weight information learning on the first initialized prediction network according to K template abnormal state events in the first sequence of template abnormal state events and K template abnormal state events respectively output by the initialized game learning network includes:
acquiring Y template system operation event subsequences in a template system operation event sequence, wherein each template system operation event subsequence comprises K1 template abnormal state events in a first template abnormal state event subsequence, K1 corresponding template abnormal state events in a second template abnormal state event subsequence and acquired non-abnormal system operation event subsequences, and the template abnormal state events in the first template abnormal state event subsequence and the second template abnormal state event subsequence belong to the same abnormal state label;
for Y initialization prediction sub-networks included in the first initialization prediction network, the following operations are circularly performed until the network converges, in the process of executing the following operations, one initialization prediction sub-network is determined to be a real-time initialization prediction sub-network, a template system operation event sub-sequence for performing network weight information learning on the real-time initialization prediction sub-network in the Y template system operation event sub-sequences is determined to be a real-time template system operation event sub-sequence, the template abnormal state events in the first template abnormal state event sub-sequence and the second template abnormal state event sub-sequence in the real-time template system operation event sub-sequence belong to a real-time abnormal state tag, and the real-time initialization prediction sub-network is used for determining whether a loaded system operation event can be classified as an abnormal state event of the real-time abnormal state tag:
Acquiring candidate template system operation events from the real-time template system operation event subsequence;
loading the template system operation event into the real-time initialization prediction sub-network, and generating reference prediction data determined by the real-time initialization prediction sub-network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event of the real-time abnormal state tag;
determining a prediction error calculation value of a real-time prediction error parameter layer of the real-time initialization prediction sub-network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event of the real-time abnormal state tag;
when the prediction error calculated value of the real-time prediction error parameter layer does not meet the real-time prediction error convergence requirement, updating the network weight information in the real-time initialization prediction sub-network and the initialization game learning network, or updating the network weight information in the real-time initialization prediction sub-network;
and when the prediction error calculated value of the real-time prediction error parameter layer meets the real-time prediction error convergence requirement, terminating updating of the real-time initialization prediction sub-network, wherein a corresponding one of the generated countermeasure network prediction sub-networks is the real-time initialization prediction sub-network when updating is terminated, and the corresponding one of the anomaly event prediction sub-networks is used for determining whether a loaded system operation event can be classified as an anomaly state event of the real-time anomaly state tag.
In a possible implementation manner of the first aspect, the method further includes:
performing network weight information learning on a second initialization prediction network according to a template abnormal state event sub-sequence in the first template abnormal state event sequence to generate a third initialization prediction network, wherein the third initialization prediction network is used for determining whether a system operation event loaded into the third initialization prediction network can be classified as an abnormal state event;
initializing the first initialization prediction network to the third initialization prediction network.
In a possible implementation manner of the first aspect, the method further includes:
the method comprises the steps that network weight information learning is conducted on an initialized time circulation neural network according to a first template abnormal state event sequence and a third template abnormal state event sequence, the target time circulation neural network is generated, the third template abnormal state event sequence comprises abnormal state events which are derived and expanded by a target game learning network based on template abnormal state events in the first template abnormal state event sequence, the target game learning network is a neural network obtained by conducting network weight information learning on the initialized game learning network, and the second template abnormal state event sequence comprises abnormal state events which are derived and expanded by the initialized game learning network based on the template abnormal state events in the first template abnormal state event sequence.
In a possible implementation manner of the first aspect, the performing network weight information learning on the initialized time-loop neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, to generate the target time-loop neural network includes:
when the first template abnormal state event sequence comprises X first template abnormal state event subsequences and the third template abnormal state event sequence comprises X third template abnormal state event subsequences, unique mapping relations exist between the X first template abnormal state event subsequences and the X third template abnormal state event subsequences, one first template abnormal state event subsequence with the unique mapping relations and one template abnormal state event in the third template abnormal state event subsequence belong to the same abnormal state label, network weight information learning is carried out on an initialized time cyclic neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, and a target time cyclic neural network is generated, wherein the target time cyclic neural network is used for respectively determining the confidence degree of each abnormal state label in which a loaded system operation event belongs to the X abnormal state labels, and the X abnormal state labels are unique mapping relations between the X abnormal state labels and the X first template abnormal state event subsequences and the X third template abnormal state event subsequences;
The step of performing network weight information learning on the initialized time-loop neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence to generate the target time-loop neural network comprises the following steps:
the following operations are circularly performed until the network converges:
acquiring candidate template system operation events from the first template abnormal state event sequence and the third template abnormal state event sequence;
loading the template system operation event to the initialization time cyclic neural network, and generating reference prediction data determined by the initialization time cyclic neural network, wherein the reference prediction data reflects the confidence coefficient of each abnormal state label in Y abnormal state labels of the template system operation event;
determining a prediction error calculation value of a second prediction error parameter layer of the initialization time cyclic neural network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be classified as an abnormal state event or not and also represents an abnormal state tag to which the template system operation event belongs when the template system operation event is the abnormal state event;
Updating the network weight information in the initialization time cyclic neural network when the prediction error calculated value of the second prediction error parameter layer does not meet the preset second prediction error convergence requirement;
when the prediction error calculated value of the second prediction error parameter layer meets the second prediction error convergence requirement, terminating updating of the initialization time cyclic neural network, wherein the target time cyclic neural network is the initialization time cyclic neural network when updating is terminated;
the loading the target system operation event to a target time-loop neural network, and generating second abnormal state analysis data determined by the target time-loop neural network, including:
loading the target system operation event to the target time cycle neural network, and generating second abnormal state analysis data determined by the target time cycle neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event or not and also reflects an abnormal state label to which the target system operation event belongs when the target system operation event is the abnormal state event;
The target time circulation neural network is a network generated by carrying out network weight information learning on the initialization time circulation neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, wherein the first template abnormal state event sequence comprises Y first template abnormal state event subsequences, the third template abnormal state event sequence comprises Y third template abnormal state event subsequences, the Y first template abnormal state event subsequences, the Y third template abnormal state event subsequences and Y abnormal state tags have unique mapping relations, one first template abnormal state event subsequence and one third template abnormal state event subsequence with unique mapping relations belong to the same abnormal state tag, and Y is a natural number larger than 1.
According to one aspect of the embodiment of the present application, there is provided an abnormality analysis system of a birth and expense statistics platform system, including a processor and a machine-readable storage medium having stored therein machine-executable instructions loaded and executed by the processor to implement the abnormality analysis method of the birth and expense statistics platform system in any one of the foregoing possible embodiments.
According to an aspect of embodiments of the present application, there is provided a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The computer instructions are read from a computer-readable storage medium by a processor of a computer device, which executes the computer instructions, causing the computer device to perform the methods provided in the various alternative implementations of the three aspects described above.
In the technical scheme provided by some embodiments of the application, the first abnormal state analysis data determined by the generating type countermeasure network is generated by loading the target system operation event into the generating type countermeasure network, the first abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event, the generating type countermeasure network is a network generated by carrying out network weight information learning on the first initializing prediction network according to a first template abnormal state event sequence and a second template abnormal state event sequence, the first template abnormal state event sequence comprises template abnormal state events extracted to one task queue, the second template abnormal state event sequence comprises abnormal state events which are derived and expanded based on template abnormal state events in the first template abnormal state event sequence, when the first abnormal state analysis data reflects the target system operation event as an abnormal state event, the target system operation event is loaded into a target time cyclic neural network, the second abnormal state analysis data is determined by the generating type countermeasure network and the time cyclic neural network, whether the system operation event can be classified as a state is realized by loading the monitored system operation event data into the generating type countermeasure network and the time cyclic neural network, the characteristic of the generating type countermeasure network is realized by combining the abnormal state analysis event of the generating type of the abnormal state with the observed state event in the first template abnormal state event sequence, the characteristic of the large-cycle state is carried out by the generating type countermeasure network, the abnormal state data is generated by the abnormal state of the generated by the generating type countermeasure network, the abnormal state of the large-state circulation network is based on the abnormal state of the observed state of the generated state of the correlation state of the generated state of the countermeasure network, and the generated state of the target time cyclic state circulation network is determined by the second abnormal state operation time of the target operation time of the system operation event, thereby improving the reliability of the abnormal state analysis.
Drawings
For a clearer description of the technical solutions of the embodiments of the present application, reference will be made to the accompanying drawings, which are needed to be activated in the embodiments, and it should be understood that the following drawings only illustrate some embodiments of the present application, and therefore should not be considered as limiting the scope, and other related drawings can be extracted by those skilled in the art without the inventive effort.
FIG. 1 is a schematic flow chart of an anomaly analysis method of a production and marketing difference statistics platform system provided by an embodiment of the application;
fig. 2 is a schematic block diagram of an anomaly analysis system of the product and sales difference statistics platform system for implementing the anomaly analysis method of the product and sales difference statistics platform system according to an embodiment of the present application.
Detailed Description
The following description is presented to enable one of ordinary skill in the art to make and use the application and is provided in the context of a particular application and its requirements. It will be apparent to those having ordinary skill in the art that various changes can be made to the disclosed embodiments and that the general principles defined herein may be applied to other embodiments and applications without departing from the principles and scope of the application. Therefore, the present application is not limited to the described embodiments, but is to be accorded the widest scope consistent with the claims.
Fig. 1 is a flowchart of an abnormality analysis method of a production and marketing difference statistics platform system according to an embodiment of the present application, and the abnormality analysis method of the production and marketing difference statistics platform system is described in detail below.
And step S100, acquiring a target system operation event monitored by the production and marketing difference statistical platform system.
In this embodiment, the production and marketing difference statistics platform system may perform data collection, data uploading and production and marketing difference statistics based on various configured system software programs, that is, many system operation events may be generated during the operation of the system software programs, and at this time, the operation data of these system operation events may be monitored in real time and used for further processing in the following steps.
Step S200, loading the target system operation event to the generated countermeasure network, and generating first abnormal state analysis data determined by the generated countermeasure network.
In this embodiment, the generated countermeasure network is a deep learning model, which can be implemented by (at least) two modules in the framework: the mutual game learning of the Generative Model and the discriminant Model Discriminative Model produces a fairly good output.
In this embodiment, the first abnormal state analysis data may be used to reflect whether the target system operation event can be classified as an abnormal state event, and the generated countermeasure network is a network generated by learning the network weight information of the first initialization prediction network according to a first template abnormal state event sequence and a second template abnormal state event sequence, where the first template abnormal state event sequence includes a template abnormal state event extracted into one task queue, and the second template abnormal state event sequence includes an abnormal state event derived and extended based on a template abnormal state event in the first template abnormal state event sequence.
And step S300, loading the target system operation event to the target time cyclic neural network when the first abnormal state analysis data reflects that the target system operation event is the abnormal state event, and generating second abnormal state analysis data determined by the target time cyclic neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as the abnormal state event.
Therefore, the monitored system operation event data is loaded to the trained generation type countercheck network and the time circulation neural network to determine whether the system operation event can be classified as an abnormal state event, the purpose of multi-network abnormal state analysis is achieved, the system operation event is observed in an abnormal state by combining the generation type countercheck network and the time circulation neural network, a large amount of abnormal state data is generated according to the generation type countercheck network, the characteristic quantity of the abnormal state event is expanded, and the time circulation memory defect of the generation type countercheck network caused by the large characteristic span of the system operation event is optimized according to the time circulation neural network, so that the reliability of the abnormal state analysis is improved.
In some exemplary design considerations, the first sequence of template abnormal state events includes template abnormal state events of a task queue of the monitored training sequence, and the second sequence of template abnormal state events includes abnormal state events that are derived and extended based on the template abnormal state events in the first sequence of template abnormal state events, e.g., abnormal state events generated by adding probabilistic disturbance state features to the template abnormal state events.
In some exemplary design ideas, the target time-loop neural network may be used to process and predict operation data of a time node with a larger span in the operation event of the target system, for example, may include, but not limited to, performing network weight information learning on the initialized time-loop neural network according to the first template abnormal state event and the second template abnormal state event that is difficult to accurately distinguish by the target generation type countermeasure network.
In some exemplary design concepts, the second abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event, that is, the target system operation event can be expressed in the form of a classification value, for example, a may be used to indicate that the target system operation event is not an abnormal state event, and B may be used to indicate that the target system operation event is an abnormal state event.
In some exemplary design considerations, the method further comprises: and carrying out network weight information learning on the first initialization prediction network according to the first template abnormal state event sequence and the second template abnormal state event sequence to generate the generated countermeasure network.
Some exemplary design considerations may include, but are not limited to, performing network weight information learning on the first initialized prediction network according to the first template abnormal state event sequence, the second template abnormal state event sequence, and the non-abnormal state event for which training label calibration has been completed, to generate a generated countermeasure network.
In some exemplary design ideas, the generating the generated type countermeasure network may specifically be that the network weight information of the first initialization prediction network is learned according to the first template abnormal state event sequence and the second template abnormal state event sequence: and randomly loading the first template abnormal state event, the second template abnormal state event generated after adding the probability disturbance state characteristic (random noise characteristic) according to the first template abnormal state event and the non-abnormal system operation event to the first initialization prediction network after scrambling so as to update the network weight information in the first initialization prediction network, and thus, iteratively updating the first initialization prediction network to generate the generated countermeasure network.
In some exemplary design ideas, the performing network weight information learning on the first initialized prediction network according to the first template abnormal state event sequence and the second template abnormal state event sequence to generate the generated countermeasure network includes:
the following operations are circularly performed until the generated countermeasure network is trained to terminate outputting:
s101, sequentially loading K template abnormal state events in the first template abnormal state event sequence and K template or potential disturbance state features in the template or potential disturbance state feature sequence to an initialized game learning network to generate K template abnormal state events respectively output by the initialized game learning network, wherein the second template abnormal state event sequence comprises K template abnormal state events respectively output by the initialized game learning network, loading feature data loaded to a target game learning network each time comprises one template abnormal state event and one template or potential disturbance state feature, the initialized game learning network is used for generating abnormal state events matched with the loaded template abnormal state events each time based on the loaded template or potential disturbance state features, and K is a natural number;
S102, carrying out network weight information learning on the first initialization prediction network according to K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initialization game learning network.
In some exemplary design considerations, loading K template abnormal state events in the first sequence of template abnormal state events and K template probabilistic disturbance state features in the sequence of template probabilistic disturbance state features into the initializing gaming learning network in sequence may include, but is not limited to, loading one template abnormal state event and one template probabilistic disturbance state feature into the initializing gaming learning network to obtain one template abnormal state event.
In some exemplary design considerations, generating an abnormal state event that matches one template abnormal state event loaded based on one template or probabilistic disturbance state feature loaded at a time may include, but is not limited to, causing a unique mapping relationship between the one template abnormal state event and the abnormal state event generated based on the template or probabilistic disturbance state feature.
In some exemplary design considerations, the generating the generated countermeasure network may include, but is not limited to, an abnormal state event generated based on a loaded template or probabilistic disturbance state feature being indistinguishable from a template abnormal state event by the initializing the predicted network, i.e., may be determined to complete training for the initializing the predicted network, thereby generating the generated countermeasure network.
In some exemplary design considerations, the following may be performed in a loop until a generated countermeasure network is obtained: the method comprises the steps of sequentially loading K template abnormal state events in a first template abnormal state event sequence and K template or disturbance state features in a template or disturbance state feature sequence to an initialized game learning network to generate K template abnormal state events which are respectively output by the initialized game learning network, and carrying out network weight information learning on a first initialized prediction network according to the K template abnormal state events in the first template abnormal state event sequence and the K template abnormal state events which are respectively output by the initialized game learning network so as to realize network weight information learning on the initialized prediction network, generating the generated type countermeasure network, and finally obtaining first abnormal state analysis data according to the generated type countermeasure network so as to complete abnormal state analysis, thereby improving reliability of abnormal state analysis.
In some exemplary design ideas, the performing network weight information learning on the first initialized prediction network according to K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initialized game learning network includes:
A, acquiring a template system operation event sequence, wherein the template system operation event sequence comprises K template abnormal state events in the first template abnormal state event sequence, K template abnormal state events respectively output by the initialized game learning network and the acquired non-abnormal system operation event sequence;
the following operations are circularly performed until the network converges:
b, acquiring candidate template system operation events from the template system operation event sequence;
loading the template system operation event to the first initialization prediction network, and generating reference prediction data determined by the first initialization prediction network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event;
determining a prediction error calculation value of a first prediction error parameter layer of the first initialization prediction network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event;
e, when the prediction error calculated value of the first prediction error parameter layer does not accord with a first prediction error convergence condition, updating the network weight information in the first initialization prediction network and the initialization game learning network, or updating the network weight information in the first initialization prediction network;
And F, when the prediction error calculated value of the first prediction error parameter layer accords with the first prediction error convergence condition, terminating the update of the first initialization prediction network, wherein the generated countermeasure network is the first initialization prediction network when the update is terminated.
In some exemplary design ideas, the non-abnormal system operation event may include, but is not limited to, a system operation feature vector in a normal system operation event, and is loaded to the first initialization prediction network after being combined with the first template abnormal state event and the second template abnormal state event, where the system operation event in the non-abnormal system operation event sequence is a non-abnormal state event that has completed the calibration of the training tag, and feature quantities of training data may be enriched by acquiring the non-abnormal system operation event sequence.
In some exemplary design ideas, the reference prediction data is a prediction result of the first initializing prediction network, and the training tag data is the training tag data generated based on K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initializing game learning network and acquired data to be learned of a non-abnormal system operation event sequence.
In some exemplary design considerations, the obtaining the sequence of template system operation events includes:
and randomly sequencing K template abnormal state events in the first template abnormal state event sequence, K template abnormal state events respectively output by the initialized game learning network and the non-abnormal system operation event sequence to generate the template system operation event sequence.
In some exemplary design ideas, the loading K template abnormal state events in the first template abnormal state event sequence and K template or potential disturbance state features in the template or potential disturbance state feature sequence into an initialized game learning network in turn, and generating K template abnormal state events output by the initialized game learning network respectively includes:
when the first template abnormal state event sequence comprises Y first template abnormal state event subsequences and each first template abnormal state event subsequence comprises template abnormal state events of the same abnormal state label, executing the following steps aiming at each first template abnormal state event subsequence, wherein Y is a natural number larger than 1, each first template abnormal state event subsequence is determined to be a real-time template abnormal state event subsequence, and the template abnormal state events in the real-time template abnormal state event subsequence belong to the real-time abnormal state label:
The K1 template abnormal state events in the first template abnormal state event subsequence and the K1 template abnormal state features in the template abnormal state feature sequence are sequentially loaded to a real-time game learning sub-network corresponding to the real-time abnormal state labels, K1 template abnormal state events which are respectively output by the real-time game learning sub-network are generated, the initialized game learning network comprises Y game learning sub-networks, the second template abnormal state event sequence comprises Y second abnormal state event subsequences, the second abnormal state event subsequences corresponding to the real-time abnormal state labels in the second template abnormal state event sequence comprise K1 template abnormal state events which are respectively output by the real-time game learning sub-network, the loaded feature data loaded to the real-time game learning sub-network comprise one template abnormal state event and one template abnormal state feature, the real-time game learning sub-network is used for generating the K state events which are matched with the loaded template abnormal state events based on the loaded template abnormal state features, the K state events are abnormal state labels, and the K1 abnormal state events are natural state labels, and the K1 abnormal state events are abnormal state labels are generated.
In some exemplary design considerations, each first template abnormal state event sub-sequence corresponds to a template abnormal state event of an abnormal state tag, which may include, but is not limited to, an abnormal state tag of a crash state, a pause state, a loop state, etc.
In some exemplary design ideas, the K1 template abnormal state events in the first template abnormal state event subsequence and the K1 template abnormal state events obtained by inputting the K1 template or the likely disturbance state features into the real-time game learning sub-network all contain corresponding data to be learned, whether the system operation event can be classified as an abnormal state event is calibrated in the data to be learned, and when the system operation event is the abnormal state event, an abnormal state label of the abnormal state event is included.
That is, the template abnormal state event input of each abnormal state label corresponds to a game learning sub-network to obtain a second template abnormal state event with the same abnormal state label.
Therefore, the first template abnormal state event with different abnormal state labels generates the second template abnormal state event corresponding to the abnormal state label through the initialized game learning network corresponding to the abnormal state label, and the abnormal state label of the abnormal state event can be further analyzed on the premise that whether the system operation event of the target generation type countermeasure network prediction loading is the abnormal state event or not.
In some exemplary design ideas, the performing network weight information learning on the first initialized prediction network according to K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initialized game learning network includes:
a, acquiring Y template system operation event subsequences in a template system operation event sequence, wherein each template system operation event subsequence comprises K1 template abnormal state events in a first template abnormal state event subsequence, K1 corresponding template abnormal state events in a second template abnormal state event subsequence and acquired non-abnormal system operation event subsequences, and the template abnormal state events in the first template abnormal state event subsequence and the second template abnormal state event subsequence belong to the same abnormal state label;
b, circularly performing the following operations on Y initialization prediction sub-networks included in the first initialization prediction network until the network converges, wherein in the process of executing the following operations, one initialization prediction sub-network is determined to be a real-time initialization prediction sub-network, a template system operation event sub-sequence used for carrying out network weight information learning on the real-time initialization prediction sub-network in the Y template system operation event sub-sequences is determined to be a real-time template system operation event sub-sequence, the template abnormal state events in the first template abnormal state event sub-sequence and the second template abnormal state event sub-sequence in the real-time template system operation event sub-sequence belong to a real-time abnormal state tag, and the real-time initialization prediction sub-network is used for determining whether a loaded system operation event can be classified as the abnormal state event of the real-time abnormal state tag:
C, acquiring candidate template system operation events from the real-time template system operation event subsequence;
loading the template system operation event into the real-time initialization prediction sub-network, and generating reference prediction data determined by the real-time initialization prediction sub-network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event of the real-time abnormal state tag;
e, determining a prediction error calculation value of a real-time prediction error parameter layer of the real-time initialization prediction sub-network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event of the real-time abnormal state tag;
f, when the prediction error calculated value of the real-time prediction error parameter layer does not meet the real-time prediction error convergence requirement, updating the network weight information in the real-time initialization prediction sub-network and the initialization game learning network, or updating the network weight information in the real-time initialization prediction sub-network;
And G, when the prediction error calculated value of the real-time prediction error parameter layer meets the real-time prediction error convergence requirement, terminating updating of the real-time initialization prediction sub-network, wherein a corresponding one of the generated countermeasure network abnormal event prediction sub-networks is the real-time initialization prediction sub-network when updating is terminated, and the corresponding one of the abnormal event prediction sub-networks is used for determining whether a loaded system operation event can be classified as an abnormal state event of the real-time abnormal state label.
In some exemplary design considerations, the system operational events in the sequence of non-abnormal system operational events are non-abnormal state events for which training tag calibration has been completed.
In some exemplary design ideas, the reference prediction data is a prediction result of a real-time initialization prediction sub-network, and the training tag data is generated based on K1 template abnormal state events in the real-time template abnormal state event sequence, K1 template abnormal state events respectively output by a real-time initialization game learning network, and acquired data to be learned of a non-abnormal system operation event sequence.
In some exemplary design considerations, the method further comprises:
Performing network weight information learning on a second initialization prediction network according to a template abnormal state event sub-sequence in the first template abnormal state event sequence to generate a third initialization prediction network, wherein the third initialization prediction network is used for determining whether a system operation event loaded into the third initialization prediction network can be classified as an abnormal state event; then, the first initializing predictive network is initialized to the third initializing predictive network.
In some exemplary design ideas, the third initializing prediction network may specifically be an initializing prediction network generated by performing initializing network weight information learning on the second initializing prediction network, and updating the initializing prediction network according to a small number of template abnormal state events to obtain the third initializing prediction network with preliminary prediction performance, so that the network weight information learning efficiency of the subsequent generating type countermeasure network can be improved conveniently.
In some exemplary design considerations, the method further comprises:
the method comprises the steps that network weight information learning is conducted on an initialized time circulation neural network according to a first template abnormal state event sequence and a third template abnormal state event sequence, the target time circulation neural network is generated, the third template abnormal state event sequence comprises abnormal state events which are derived and expanded by a target game learning network based on template abnormal state events in the first template abnormal state event sequence, the target game learning network is a neural network obtained by conducting network weight information learning on the initialized game learning network, and the second template abnormal state event sequence comprises abnormal state events which are derived and expanded by the initialized game learning network based on the template abnormal state events in the first template abnormal state event sequence.
In some exemplary design considerations, the time-cycled neural network may be a long-short term memory network.
In some exemplary design ideas, the inputs of the time-cycled neural network are template abnormal state events in the first template abnormal state event subsequence and template abnormal state events in the third template abnormal state event subsequence, and the outputs are prediction data for determining whether a loaded system operation event can be classified as an abnormal state event or not and for determining an abnormal state event to which the abnormal state event belongs when the loaded system operation event is determined to be the abnormal state event.
In some exemplary design considerations, the third template abnormal state event may include, but is not limited to, a template abnormal state event that the target gaming learning network derives an extension from the first template abnormal state event, for example, a template abnormal state event generated after adding or otherwise perturbing a state feature from the first template abnormal state event.
In some exemplary design ideas, when the determined first abnormal state analysis data of the objective generation type countermeasure network reflects that the first template abnormal state event or the third template abnormal state event is an abnormal state event, the first template abnormal state event or the third template abnormal state event is input into the initialization time loop neural network, so as to train the initialization time loop neural network into the objective time loop neural network.
In some exemplary design ideas, the learning the network weight information of the initialized time-loop neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, and generating the target time-loop neural network includes:
when the first template abnormal state event sequence comprises X first template abnormal state event subsequences and the third template abnormal state event sequence comprises X third template abnormal state event subsequences, unique mapping relations exist between the X first template abnormal state event subsequences and the X third template abnormal state event subsequences, one first template abnormal state event subsequence with the unique mapping relations and one template abnormal state event in the third template abnormal state event subsequence belong to the same abnormal state label, network weight information learning is conducted on an initialized time cyclic neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, the target time cyclic neural network is generated, the target time cyclic neural network is used for respectively determining the confidence degree of each abnormal state label in X abnormal state labels of a loaded system operation event, and the X unique mapping relations exist between the X abnormal state labels and the X first template abnormal state event subsequences and the X third template abnormal state event subsequences, and X is a natural number.
In some exemplary design ideas, the performing network weight information learning on the initialized time-loop neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence to generate the target time-loop neural network includes:
the following operations are circularly performed until the network converges:
a, acquiring candidate template system operation events from the first template abnormal state event sequence and the third template abnormal state event sequence;
b, loading the template system operation event to the initialization time cyclic neural network, and generating reference prediction data determined by the initialization time cyclic neural network, wherein the reference prediction data reflects the confidence coefficient of each abnormal state label in Y abnormal state labels of the template system operation event;
c, determining a prediction error calculation value of a second prediction error parameter layer of the initialization time cyclic neural network based on the reference prediction data and training label data of the template system operation event, wherein the training label data reflects whether the template system operation event can be classified as an abnormal state event or not and also represents an abnormal state label to which the template system operation event belongs when the template system operation event is the abnormal state event;
D, when the prediction error calculated value of the second prediction error parameter layer does not meet the preset second prediction error convergence requirement, updating the network weight information in the initialization time cyclic neural network;
and E, terminating updating the initialization time cyclic neural network when the prediction error calculated value of the second prediction error parameter layer meets the second prediction error convergence requirement, wherein the target time cyclic neural network is the initialization time cyclic neural network when updating is terminated.
In some exemplary design considerations, the prediction error parameter layers may include, but are not limited to, a 0-1 prediction error parameter layer, an absolute value prediction error parameter layer, a log-log prediction error parameter layer, a square prediction error parameter layer, an exponential prediction error parameter layer, a range prediction error parameter layer, a cross entropy prediction error parameter layer, and the like.
In some exemplary design ideas, the reference prediction data reflects a confidence that the template system operation event belongs to each of the Y abnormal state tags, the training tag data reflects whether the template system operation event can be categorized as an abnormal state event, and when the template system operation event is an abnormal state event, the training tag data also represents an abnormal state tag to which the template system operation event belongs.
In some exemplary design considerations, the loading the target system operation event into a target time-cycled neural network, generating second abnormal state analysis data determined by the target time-cycled neural network, includes:
loading the target system operation event to the target time cycle neural network, and generating second abnormal state analysis data determined by the target time cycle neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event or not, and also represents an abnormal state label to which the target system operation event belongs when the target system operation event is the abnormal state event;
the target time circulation neural network is a network generated by carrying out network weight information learning on the initialization time circulation neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, wherein the first template abnormal state event sequence comprises Y first template abnormal state event subsequences, the third template abnormal state event sequence comprises Y third template abnormal state event subsequences, the Y first template abnormal state event subsequences, the Y third template abnormal state event subsequences and Y abnormal state tags have unique mapping relations, one first template abnormal state event subsequence and one third template abnormal state event subsequence with unique mapping relations belong to the same abnormal state tag, and Y is a natural number larger than 1.
In some exemplary design considerations, further embodiments are provided below, which may include, but are not limited to, the following steps:
step S202, obtaining Y first template abnormal state event subsequences and Y third template abnormal state event subsequences;
step S204, randomly inputting the first template abnormal state event and the third template abnormal state event which are in one-to-one correspondence into an initialization time cyclic neural network;
step S206, generating a prediction result, wherein the prediction result comprises the confidence degree of whether the loaded template abnormal state event can be classified as an abnormal state event and a corresponding abnormal state label;
step S208, determining a prediction error calculation value of a second prediction error parameter layer based on the confidence coefficient, and adjusting network weight information of the initialization time cyclic neural network when the prediction error calculation value of the second prediction error parameter layer does not meet a preset second prediction error convergence requirement;
step S210, when the prediction error calculated value of the second prediction error parameter layer meets the preset second prediction error convergence requirement, the update of the initialization time cyclic neural network is terminated.
Fig. 2 illustrates a hardware structural intent of an anomaly analysis system 100 of a sales outlet statistics platform system for implementing the anomaly analysis method of the sales outlet statistics platform system according to an embodiment of the present application, as shown in fig. 2, the anomaly analysis system 100 of the sales outlet statistics platform system may include a processor 110, a machine-readable storage medium 120, a bus 130, and a communication unit 140.
In some alternative embodiments, the anomaly analysis system 100 of the differential production and marketing statistics platform system may be an anomaly analysis system of a single differential production and marketing statistics platform system or may be a group of anomaly analysis systems of differential production and marketing statistics platform systems. The set of anomaly analysis systems of the differential production and marketing statistics platform system may be centralized or distributed (e.g., the anomaly analysis system 100 of the differential production and marketing statistics platform system may be a distributed system). In some alternative embodiments, the anomaly analysis system 100 of the birth and sales statistics platform system may be local or remote. For example, the anomaly analysis system 100 of the birth and sales statistics platform system may access information and/or data stored in the machine-readable storage medium 120 via a network. As another example, the anomaly analysis system 100 of the differential production and marketing statistics platform system may be directly connected to the machine-readable storage medium 120 to access stored information and/or data. In some alternative embodiments, the anomaly analysis system 100 of the birth and sales statistics platform system may be implemented on a cloud platform. For example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-layer cloud, or the like, or any combination thereof.
The machine-readable storage medium 120 may store data and/or instructions. In some alternative implementations, the machine-readable storage medium 120 may store data acquired from an external terminal. In some alternative embodiments, the machine-readable storage medium 120 may store data and/or instructions that are used by the anomaly analysis system 100 of the differential production statistics platform system to perform or use to complete the exemplary methods described herein. In some alternative implementations, the machine-readable storage medium 120 may include mass storage, removable storage, volatile read-write memory, read-only memory (ROM), and the like, or any combination thereof. Exemplary mass storage devices may include magnetic disks, optical disks, solid state disks, and the like. Exemplary removable memory may include flash drives, floppy disks, optical disks, memory cards, compact disks, tape, and the like. Exemplary volatile read-write memory can include Random Access Memory (RAM). Exemplary RAM may include active random access memory (DRAM), double data rate synchronous active random access memory (DDR SDRAM), passive random access memory (SRAM), thyristor random access memory (T-RAM), zero capacitance random access memory (Z-RAM), and the like. Exemplary read-only memory may include mask read-only memory (MROM), programmable read-only memory (PROM), erasable programmable read-only memory (PEROM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), digital versatile disk read-only memory, and the like. In some alternative implementations, the machine-readable storage medium 120 may be implemented on a cloud platform. For example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-layer cloud, etc., or any combination thereof.
In a specific implementation, at least one processor 110 executes computer-executable instructions stored by the machine-readable storage medium 120, so that the processor 110 may execute the anomaly analysis method of the production and marketing error statistics platform system according to the above method embodiment, where the processor 110, the machine-readable storage medium 120, and the communication unit 140 are connected through the bus 130, and the processor 110 may be used to control the transceiving actions of the communication unit 140.
The specific implementation process of the processor 110 may refer to the above-mentioned embodiments of the method executed by the anomaly analysis system 100 of the production and marketing difference statistics platform system, and the implementation principle and technical effects are similar, and are not repeated here.
In addition, the embodiment of the application also provides a readable storage medium, wherein computer executable instructions are preset in the readable storage medium, and when a processor executes the computer executable instructions, the abnormality analysis method of the production and marketing error statistics platform system is realized.
Similarly, it should be noted that in order to simplify the description of the present disclosure and thereby aid in understanding one or more embodiments of the application, various features are sometimes grouped together in a single embodiment, figure, or description thereof. Similarly, it should be noted that in order to simplify the description of the present disclosure and thereby aid in understanding one or more embodiments of the application, various features are sometimes grouped together in a single embodiment, figure, or description thereof.

Claims (6)

1. An anomaly analysis method for a production and marketing difference statistics platform system, which is realized by an anomaly analysis system of the production and marketing difference statistics platform system, the method comprising:
acquiring a target system operation event monitored by the production and marketing difference statistics platform system, wherein the production and marketing difference statistics platform system performs data acquisition, data uploading and production and marketing difference statistics based on various configured system software programs, generates a system operation event in the operation process of the system software programs, and monitors operation data of the system operation event in real time;
loading the target system operation event into a generating type countermeasure network, generating first abnormal state analysis data determined by the generating type countermeasure network, wherein the first abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event, the generating type countermeasure network is generated by carrying out network weight information learning on a first initialization prediction network according to a first template abnormal state event sequence and a second template abnormal state event sequence, the first template abnormal state event sequence comprises template abnormal state events extracted into a task queue, and the second template abnormal state event sequence comprises abnormal state events which are derived and expanded based on the template abnormal state events in the first template abnormal state event sequence;
When the first abnormal state analysis data reflects that the target system operation event is an abnormal state event, loading the target system operation event into a target time-cycle neural network, and generating second abnormal state analysis data determined by the target time-cycle neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as the abnormal state event;
the method further comprises the steps of:
according to the first template abnormal state event sequence and the second template abnormal state event sequence, carrying out network weight information learning on the first initialization prediction network to generate the generated countermeasure network;
the step of performing network weight information learning on the first initialization prediction network according to the first template abnormal state event sequence and the second template abnormal state event sequence to generate the generated countermeasure network comprises the following steps:
the following operations are circularly performed until the generated countermeasure network is trained to terminate outputting:
sequentially loading K template abnormal state events in the first template abnormal state event sequence and K template or disturbance state features in the template or disturbance state feature sequence to an initialized game learning network to generate K template abnormal state events respectively output by the initialized game learning network, wherein the second template abnormal state event sequence comprises K template abnormal state events respectively output by the initialized game learning network, loading feature data loaded to a target game learning network each time comprises one template abnormal state event and one template or disturbance state feature, and the initialized game learning network is used for generating abnormal state events matched with the loaded one template abnormal state event each time based on the loaded one template or disturbance state feature;
According to K template abnormal state events in the first template abnormal state event sequence and K template abnormal state events respectively output by the initialized game learning network, carrying out network weight information learning on the first initialized prediction network;
the learning of the network weight information of the first initialization prediction network according to the K template abnormal state events in the first template abnormal state event sequence and the K template abnormal state events respectively output by the initialization game learning network comprises the following steps:
acquiring a template system operation event sequence, wherein the template system operation event sequence comprises K template abnormal state events in the first template abnormal state event sequence, K template abnormal state events respectively output by the initialized game learning network and the acquired non-abnormal system operation event sequence;
the following operations are circularly performed until the network converges:
acquiring candidate template system operation events from the template system operation event sequence;
loading the template system operation event to the first initialization prediction network, and generating reference prediction data determined by the first initialization prediction network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event;
Determining a prediction error calculation value of a first prediction error parameter layer of the first initialization prediction network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event;
when the prediction error calculated value of the first prediction error parameter layer does not accord with a first prediction error convergence condition, updating the network weight information in the first initialization prediction network and the initialization game learning network, or updating the network weight information in the first initialization prediction network;
terminating the update of the first initialization prediction network when the prediction error calculated value of the first prediction error parameter layer accords with the first prediction error convergence condition, wherein the generated countermeasure network is the first initialization prediction network when the update is terminated;
the step of loading the K template abnormal state events in the first template abnormal state event sequence and the K template or disturbance state features in the template or disturbance state feature sequence to an initialized game learning network in sequence to generate K template abnormal state events respectively output by the initialized game learning network, comprising the following steps:
When the first template abnormal state event sequence comprises Y first template abnormal state event subsequences and each first template abnormal state event subsequence comprises template abnormal state events of the same abnormal state label, executing the following steps aiming at each first template abnormal state event subsequence, wherein each first template abnormal state event subsequence is determined to be a real-time template abnormal state event subsequence, the template abnormal state events in the real-time template abnormal state event subsequence belong to real-time abnormal state labels, and the abnormal state labels comprise a crash state, a pause state and a circulation state abnormal state label:
the K1 template abnormal state events in the first template abnormal state event subsequence and the K1 template abnormal state features in the template abnormal state feature sequence are sequentially loaded to a real-time game learning sub-network corresponding to the real-time abnormal state labels, K1 template abnormal state events which are respectively output by the real-time game learning sub-network are generated, the initialized game learning network comprises Y game learning sub-networks, the second template abnormal state event sequence comprises Y second abnormal state event subsequences, the second abnormal state event subsequences corresponding to the real-time abnormal state labels in the second template abnormal state event sequence comprise K1 template abnormal state events which are respectively output by the real-time game learning sub-network, the loaded feature data loaded to the real-time game learning sub-network comprise one template abnormal state event and one template abnormal state feature, the real-time game learning sub-network is used for generating the K state events which are matched with the loaded template abnormal state events based on the loaded template abnormal state features, the K state events are abnormal state labels, and the K1 abnormal state events are natural state labels, and the K1 abnormal state events are abnormal state labels are generated.
2. The anomaly analysis method of the birth and sales difference statistics platform system according to claim 1, wherein the performing network weight information learning on the first initialized prediction network according to K template anomaly state events in the first template anomaly state event sequence and K template anomaly state events respectively output by the initialized game learning network comprises:
acquiring Y template system operation event subsequences in a template system operation event sequence, wherein each template system operation event subsequence comprises K1 template abnormal state events in a first template abnormal state event subsequence, K1 corresponding template abnormal state events in a second template abnormal state event subsequence and acquired non-abnormal system operation event subsequences, and the template abnormal state events in the first template abnormal state event subsequence and the second template abnormal state event subsequence belong to the same abnormal state label;
for Y initialization prediction sub-networks included in the first initialization prediction network, the following operations are circularly performed until the network converges, in the process of executing the following operations, one initialization prediction sub-network is determined to be a real-time initialization prediction sub-network, a template system operation event sub-sequence for performing network weight information learning on the real-time initialization prediction sub-network in the Y template system operation event sub-sequences is determined to be a real-time template system operation event sub-sequence, the template abnormal state events in the first template abnormal state event sub-sequence and the second template abnormal state event sub-sequence in the real-time template system operation event sub-sequence belong to a real-time abnormal state tag, and the real-time initialization prediction sub-network is used for determining whether a loaded system operation event can be classified as an abnormal state event of the real-time abnormal state tag:
Acquiring candidate template system operation events from the real-time template system operation event subsequence;
loading the template system operation event into the real-time initialization prediction sub-network, and generating reference prediction data determined by the real-time initialization prediction sub-network, wherein the reference prediction data reflects whether the template system operation event can be classified as an abnormal state event of the real-time abnormal state tag;
determining a prediction error calculation value of a real-time prediction error parameter layer of the real-time initialization prediction sub-network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be practically classified as an abnormal state event of the real-time abnormal state tag;
when the prediction error calculated value of the real-time prediction error parameter layer does not meet the real-time prediction error convergence requirement, updating the network weight information in the real-time initialization prediction sub-network and the initialization game learning network, or updating the network weight information in the real-time initialization prediction sub-network;
and when the prediction error calculated value of the real-time prediction error parameter layer meets the real-time prediction error convergence requirement, terminating updating of the real-time initialization prediction sub-network, wherein a corresponding one of the generated countermeasure network prediction sub-networks is the real-time initialization prediction sub-network when updating is terminated, and the corresponding one of the anomaly event prediction sub-networks is used for determining whether a loaded system operation event can be classified as an anomaly state event of the real-time anomaly state tag.
3. The method of anomaly analysis of a birth and sales statistics platform system according to claim 1, further comprising:
performing network weight information learning on a second initialization prediction network according to a template abnormal state event sub-sequence in the first template abnormal state event sequence to generate a third initialization prediction network, wherein the third initialization prediction network is used for determining whether a system operation event loaded into the third initialization prediction network can be classified as an abnormal state event;
initializing the first initialization prediction network to the third initialization prediction network.
4. A method of anomaly analysis of a differential production and marketing statistics platform system according to any one of claims 1-3, wherein the method further comprises:
the method comprises the steps that network weight information learning is conducted on an initialized time circulation neural network according to a first template abnormal state event sequence and a third template abnormal state event sequence, the target time circulation neural network is generated, the third template abnormal state event sequence comprises abnormal state events which are derived and expanded by a target game learning network based on template abnormal state events in the first template abnormal state event sequence, the target game learning network is a neural network obtained by conducting network weight information learning on the initialized game learning network, and the second template abnormal state event sequence comprises abnormal state events which are derived and expanded by the initialized game learning network based on the template abnormal state events in the first template abnormal state event sequence.
5. The method for anomaly analysis of a birth and sales error statistics platform system according to claim 4, wherein the performing network weight information learning on the initialized time-loop neural network according to the first template anomaly state event sequence and the third template anomaly state event sequence to generate the target time-loop neural network comprises:
when the first template abnormal state event sequence comprises X first template abnormal state event subsequences and the third template abnormal state event sequence comprises X third template abnormal state event subsequences, unique mapping relations exist between the X first template abnormal state event subsequences and the X third template abnormal state event subsequences, one first template abnormal state event subsequence with the unique mapping relations and one template abnormal state event in the third template abnormal state event subsequence belong to the same abnormal state label, network weight information learning is carried out on an initialized time cyclic neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, and a target time cyclic neural network is generated, wherein the target time cyclic neural network is used for respectively determining the confidence degree of each abnormal state label in which a loaded system operation event belongs to the X abnormal state labels, and the X abnormal state labels are unique mapping relations between the X abnormal state labels and the X first template abnormal state event subsequences and the X third template abnormal state event subsequences;
The step of performing network weight information learning on the initialized time-loop neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence to generate the target time-loop neural network comprises the following steps:
the following operations are circularly performed until the network converges:
acquiring candidate template system operation events from the first template abnormal state event sequence and the third template abnormal state event sequence;
loading the template system operation event to the initialization time cyclic neural network, and generating reference prediction data determined by the initialization time cyclic neural network, wherein the reference prediction data reflects the confidence coefficient of each abnormal state label in Y abnormal state labels of the template system operation event;
determining a prediction error calculation value of a second prediction error parameter layer of the initialization time cyclic neural network based on the reference prediction data and training tag data of the template system operation event, wherein the training tag data reflects whether the template system operation event can be classified as an abnormal state event or not and also represents an abnormal state tag to which the template system operation event belongs when the template system operation event is the abnormal state event;
Updating the network weight information in the initialization time cyclic neural network when the prediction error calculated value of the second prediction error parameter layer does not meet the preset second prediction error convergence requirement;
when the prediction error calculated value of the second prediction error parameter layer meets the second prediction error convergence requirement, terminating updating of the initialization time cyclic neural network, wherein the target time cyclic neural network is the initialization time cyclic neural network when updating is terminated;
the loading the target system operation event to a target time-loop neural network, and generating second abnormal state analysis data determined by the target time-loop neural network, including:
loading the target system operation event to the target time cycle neural network, and generating second abnormal state analysis data determined by the target time cycle neural network, wherein the second abnormal state analysis data reflects whether the target system operation event can be classified as an abnormal state event or not and also reflects an abnormal state label to which the target system operation event belongs when the target system operation event is the abnormal state event;
The target time circulation neural network is a network generated by carrying out network weight information learning on the initialization time circulation neural network according to the first template abnormal state event sequence and the third template abnormal state event sequence, wherein the first template abnormal state event sequence comprises Y first template abnormal state event subsequences, the third template abnormal state event sequence comprises Y third template abnormal state event subsequences, the Y first template abnormal state event subsequences, the Y third template abnormal state event subsequences and Y abnormal state tags have unique mapping relations, and one first template abnormal state event subsequence and one template abnormal state event in the third template abnormal state event subsequence with unique mapping relations belong to the same abnormal state tag.
6. An anomaly analysis system for a differential production and marketing statistics platform system, comprising a processor and a machine-readable storage medium having stored therein machine-executable instructions loaded and executed by the processor to implement the anomaly analysis method for a differential production and marketing statistics platform system of any one of claims 1-5.
CN202310900005.9A 2023-07-21 2023-07-21 Abnormality analysis method and system of production and marketing difference statistics platform system Active CN116627773B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310900005.9A CN116627773B (en) 2023-07-21 2023-07-21 Abnormality analysis method and system of production and marketing difference statistics platform system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310900005.9A CN116627773B (en) 2023-07-21 2023-07-21 Abnormality analysis method and system of production and marketing difference statistics platform system

Publications (2)

Publication Number Publication Date
CN116627773A CN116627773A (en) 2023-08-22
CN116627773B true CN116627773B (en) 2023-09-22

Family

ID=87636882

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310900005.9A Active CN116627773B (en) 2023-07-21 2023-07-21 Abnormality analysis method and system of production and marketing difference statistics platform system

Country Status (1)

Country Link
CN (1) CN116627773B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117171576B (en) * 2023-11-01 2024-02-27 博纯材料股份有限公司 Abnormality monitoring method and system applied to material purification system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111552609A (en) * 2020-04-12 2020-08-18 西安电子科技大学 Abnormal state detection method, system, storage medium, program and server
KR20220071843A (en) * 2020-11-24 2022-05-31 고려대학교 산학협력단 Generative adversarial network model and training method to generate message id sequence on unmanned moving objects
CN115659189A (en) * 2022-09-27 2023-01-31 南京邮电大学 Anomaly detection method of large-scale software system based on generation countermeasure network
CN115705322A (en) * 2021-08-13 2023-02-17 华为技术有限公司 Database management system, data processing method and equipment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111552609A (en) * 2020-04-12 2020-08-18 西安电子科技大学 Abnormal state detection method, system, storage medium, program and server
KR20220071843A (en) * 2020-11-24 2022-05-31 고려대학교 산학협력단 Generative adversarial network model and training method to generate message id sequence on unmanned moving objects
CN115705322A (en) * 2021-08-13 2023-02-17 华为技术有限公司 Database management system, data processing method and equipment
CN115659189A (en) * 2022-09-27 2023-01-31 南京邮电大学 Anomaly detection method of large-scale software system based on generation countermeasure network

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
基于GAN-LSTM的APT攻击检测;刘海波;武天博;沈晶;史长亭;;计算机科学;第47卷(第01期);287-292287-292 *

Also Published As

Publication number Publication date
CN116627773A (en) 2023-08-22

Similar Documents

Publication Publication Date Title
US20220391771A1 (en) Method, apparatus, and computer device and storage medium for distributed training of machine learning model
Li et al. A light gradient boosting machine for remainning useful life estimation of aircraft engines
CN108564326B (en) Order prediction method and device, computer readable medium and logistics system
CN116627773B (en) Abnormality analysis method and system of production and marketing difference statistics platform system
US11380301B2 (en) Learning apparatus, speech recognition rank estimating apparatus, methods thereof, and program
CN116451594B (en) Training method and device of icing prediction model, prediction method and device and electronic equipment
CN115729796A (en) Abnormal operation analysis method based on artificial intelligence and big data application system
CN116047934A (en) Real-time simulation method and system for unmanned aerial vehicle cluster and electronic equipment
JP2023183577A (en) Driving support device, driving support method and program
CN113537614A (en) Construction method, system, equipment and medium of power grid engineering cost prediction model
Wudarski et al. Hybrid quantum-classical reservoir computing for simulating chaotic systems
CN116484016B (en) Time sequence knowledge graph reasoning method and system based on automatic maintenance of time sequence path
Shaik et al. Integrating Random Forest and Support Vector Regression Models for Optimized Energy Consumption Evaluation in Cloud Computing Data Centers
CN116702839A (en) Model training method and application system based on convolutional neural network
CN117154680A (en) Wind power prediction method based on non-stationary transducer model
CN114564523B (en) Big data vulnerability analysis method and cloud AI system for intelligent virtual scene
Bouache et al. Smart Anomaly Detection: Deep Learning modeling Approach and System Utilization Analysis
CN112698977B (en) Method, device, equipment and medium for positioning server fault
Sun et al. Aledar: An attentions-based encoder-decoder and autoregressive model for workload forecasting of cloud data center
KR102289396B1 (en) Application of reinforcement learning for the advancement of forecasting item demand of repair parts of military equipment
CN114360641A (en) Variational Bayes-based gene regulation network structure identification method
CN112183814A (en) Short-term wind speed prediction method
Xiao et al. Enhanced-xgb: An online service resource demand forecasting method for colocation data centers
Ye et al. Learning fuzzy cognitive maps using decomposed parallel ant colony algorithm and gradient descent
CN117349129B (en) Abnormal optimization method and system for vehicle sales process service system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant