CN117009903A

CN117009903A - Data anomaly detection method, device, equipment and storage medium

Info

Publication number: CN117009903A
Application number: CN202310970690.2A
Authority: CN
Inventors: 秦树鑫; 陶高峰
Original assignee: Network Communication and Security Zijinshan Laboratory
Current assignee: Network Communication and Security Zijinshan Laboratory
Priority date: 2023-08-02
Filing date: 2023-08-02
Publication date: 2023-11-07

Abstract

The invention discloses a data anomaly detection method, a device, equipment and a storage medium. The method comprises the following steps: inputting the time sequence signal sample data into an initial data abnormality detection model; feature extraction is carried out on time sequence signal sample data through a feature extraction network in an initial data anomaly detection model, and a feature extraction result is obtained; performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network; feature extraction is carried out on time sequence signal sample data through a feature extraction disturbance network, and a feature extraction disturbance result is obtained; sequentially inputting the feature extraction result into a feature fusion network and a reconstruction network to obtain a data reconstruction result; and carrying out network parameter adjustment on the initial data anomaly detection model according to the feature extraction result, the feature extraction disturbance result, the data reconstruction result and the total loss function value obtained by calculation of the time sequence signal sample data to obtain a target data anomaly detection model, thereby improving the feature representation and feature learning capability and the generalization and adaptation capability of the model.

Description

Data anomaly detection method, device, equipment and storage medium

Technical Field

The present invention relates to the field of data detection technologies, and in particular, to a method, an apparatus, a device, and a storage medium for detecting data anomalies.

Background

The cloud network state data are data which are acquired and can represent the use and running state of cloud network resources at a certain moment, such as indexes of network traffic, such as uplink and downlink, CPU (central processing unit) use rate, memory occupancy rate, packet loss rate, network delay and the like. Anomaly detection for cloud network data is a typical timing data anomaly detection (Anomaly Detection). Time series data anomaly detection is the process of identifying abnormal events or behaviors from a normal time series.

The traditional machine learning-based method, such as a statistical model, a multi-element normal distribution model, an independent forest and the like, can detect obvious abnormal points to a certain extent, is sensitive to data noise, and is only used for independently modeling each time sequence data, so that the abnormality generated by the mutual correlation in the multi-dimensional time sequence data is difficult to solve. The time sequence data in the actual scene has the characteristics of large noise, large fluctuation, large environmental influence and the like, and the traditional machine learning method is difficult to meet the requirements of complex scenes.

The method based on deep learning is gradually applied to time sequence data anomaly detection. Existing methods are based on data anomaly detection of Recurrent Neural Networks (RNNs), convolutional Neural Networks (CNNs), and Attention networks (Attention Net). Although the method can solve the problem of abnormal detection of time series data to a certain extent, there is still a large room for improvement, for example, the problem of over fitting is easy to generate due to the limited scale and lack of diversity of training data, the model adaptability is poor, and the detection accuracy is not high.

Disclosure of Invention

The invention provides a data anomaly detection method, a device, equipment and a storage medium, which are used for solving the problems that the existing time sequence data anomaly detection model based on deep learning is easy to generate over fitting and has poor model adaptability, so that the accuracy of anomaly data detection is low.

According to an aspect of the present invention, there is provided a training method of a data anomaly detection model, including:

inputting the time sequence signal sample data into an initial data abnormality detection model; wherein the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network;

performing feature extraction on the time sequence signal sample data through the feature extraction network to obtain a plurality of feature extraction results;

performing parameter disturbance on the characteristic extraction network to obtain a characteristic extraction disturbance network based on a graph neural network; performing feature extraction on the time sequence signal sample data through the feature extraction disturbance network to obtain a plurality of feature extraction disturbance results;

inputting the plurality of feature extraction results into the feature fusion network to obtain a feature fusion result; inputting the feature fusion result into the reconstruction network to obtain a data reconstruction result;

Calculating a total loss function value according to the total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results and the reconstruction loss function value between the data reconstruction result and the time sequence signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain a target data anomaly detection model.

According to another aspect of the present invention, there is provided a data anomaly detection method including:

acquiring cloud network data to be detected;

inputting the cloud network state data to be detected into a target data anomaly detection model obtained by training a training method of the data anomaly detection model, and obtaining a cloud network state data reconstruction result;

and determining a data detection result of the cloud network state data to be detected according to the reconstruction error between the cloud network state data to be detected and the cloud network state data reconstruction result.

According to another aspect of the present invention, there is provided a training apparatus of a data anomaly detection model, including:

the input module is used for inputting the time sequence signal sample data into the initial data abnormality detection model; wherein the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network;

The feature extraction module is used for carrying out feature extraction on the time sequence signal sample data through the feature extraction network to obtain a plurality of feature extraction results;

the feature extraction disturbance module is used for carrying out parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on the graph neural network; performing feature extraction on the time sequence signal sample data through the feature extraction disturbance network to obtain a plurality of feature extraction disturbance results;

the feature fusion module is used for inputting the feature extraction results into the feature fusion network to obtain a feature fusion result; inputting the feature fusion result into the reconstruction network to obtain a data reconstruction result;

a parameter adjustment module, configured to calculate a total loss function value according to a total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results, and a reconstruction loss function value between the data reconstruction result and the time-series signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain a target data anomaly detection model.

According to another aspect of the present invention, there is provided a data anomaly detection apparatus including:

the data acquisition module is used for acquiring cloud network data to be detected;

the data detection module is used for inputting the cloud network state data to be detected into a target data abnormality detection model obtained by training by using the training method of the data abnormality detection model, and obtaining a cloud network state data reconstruction result;

the detection result determining module is used for determining a data detection result of the cloud network state data to be detected according to the reconstruction error between the cloud network state data to be detected and the cloud network state data reconstruction result.

According to another aspect of the present invention, there is provided an electronic apparatus including:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform the training method or the data anomaly detection method of the data anomaly detection model of any one of the embodiments of the present invention.

According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement the training method or the data anomaly detection method of the data anomaly detection model according to any one of the embodiments of the present invention when executed.

According to the training method of the data anomaly detection model, time sequence signal sample data are input into an initial data anomaly detection model; the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network; performing feature extraction on the time sequence signal sample data through a feature extraction network to obtain a plurality of feature extraction results; performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on a graph neural network; feature extraction is carried out on time sequence signal sample data through a feature extraction disturbance network, and a plurality of feature extraction disturbance results are obtained; inputting a plurality of feature extraction results into a feature fusion network to obtain a feature fusion result; inputting the feature fusion result into a reconstruction network to obtain a data reconstruction result; calculating a total loss function value according to the total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results and the reconstruction loss function value between the data reconstruction result and the time sequence signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain the target data anomaly detection model. By adopting the contrast learning method based on parameter disturbance, the problems that the existing time sequence data abnormality detection model based on deep learning is easy to generate overfitting and has poor model adaptability, so that the accuracy of abnormal data detection is low are solved, the damage to the internal associated features of the data caused by the change of the data characteristics generated by data enhancement is avoided, the feature representation capability, the feature learning capability and the generalization and adaptation capability of the model are improved, and the accuracy of abnormal data detection by the abnormal data detection model is improved.

The data abnormality detection method, the training device for the data abnormality detection model, the data abnormality detection device, the electronic device and the computer-readable storage medium of the present invention have the same technical effects as described above.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a flowchart of a training method of a data anomaly detection model provided in an embodiment of the present invention;

fig. 2 is a schematic diagram of a training method of a data anomaly detection model according to an embodiment of the present invention.

FIG. 3 is a flowchart of another training method of a data anomaly detection model according to an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a feature extraction module in an initial data anomaly detection model according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a feature extraction perturbation module in an initial data anomaly detection model according to an embodiment of the present invention;

FIG. 6 is a flowchart of a method for detecting data anomalies according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a target data anomaly detection model according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a training device for a data anomaly detection model according to an embodiment of the present invention;

fig. 9 is a schematic structural diagram of a data anomaly detection device according to an embodiment of the present invention;

fig. 10 is a schematic structural diagram of an electronic device implementing a training method of a data anomaly detection model according to an embodiment of the present invention.

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

The learning method based on deep learning is gradually applied to time sequence data anomaly detection. A common approach is to code sequences based on Recurrent Neural Networks (RNNs) and then locate outliers in combination with methods based on prediction, reconstruction or data distribution distance, etc. The cyclic neural network has natural advantages for processing the time sequence, but has obvious disadvantages that the cyclic neural network can only process sequentially and cannot calculate in parallel, so that the training and reasoning speed is low.

The method based on the cyclic neural network and the sequence reconstruction adopts an LSTM in the cyclic neural network as the encoding and decoding of the characteristic, and adopts a variational self-encoder (VAE) as the architecture of the characteristic encoding and decoding. The method is based on a cyclic neural network method, and adopts reconstruction errors to measure abnormality. The main reasoning process is: 1) data preprocessing, 2) inputting an image into a trained Encoder network (Encoder) for feature extraction and encoding, 3) inputting the encoded features into a Decoder (Decoder) for decoding, reconstructing a signal at a certain moment, and 4) judging whether the signal is an abnormal point or not by a threshold judgment mode.

The cyclic neural network has natural advantages for processing time sequence, but the disadvantages are also obvious, and the method is specifically expressed as follows:

(1) Model training and reasoning is slow due to the serial computational nature of the recurrent neural network.

(2) Overfitting problems are easily created.

The overfitting not only includes the problem of poor generalization capability due to lack of training data size and diversity, but also includes the problem of being able to fit abnormal samples due to the presence of abnormal noise in normal samples. This problem will directly lead to false identifications occurring during anomaly detection, such as: a) Normal samples may be distinguished as abnormal due to poor generalization ability, b) abnormal samples may not be detected due to small reconstruction errors caused by a good fit.

(3) The model adaptation ability is poor.

Since the generation of the abnormality has uncertainty, and the types of the abnormality are many, such as a single point abnormality, a context-associated abnormality, a periodic variation abnormality, a trend variation abnormality, and the like. The requirements of different anomaly types on characteristics and the requirements of anomaly definition are different, and the method does not model the association relation between signals, so that all anomaly types are difficult to use simultaneously, and the model adaptability and generalization capability are poor.

(4) Poor model accuracy

The method does not consider the noise problem in the training data, and can interfere with the reconstruction error, thereby affecting the detection effect. Secondly, due to the limitation of training data, the generalization capability of the model is affected, and meanwhile, the accuracy of the model is also affected. Thirdly, the existing deep learning method is insufficient in excavation of the association relation between the data, and accuracy of the model is further affected. In addition, this method also does not cope well with the occurrence of concept drift.

The Convolution Neural Network (CNN) and Attention network (Attention Net) based method has the advantage of parallel calculation, and can be used for solving the problem of abnormal detection of time sequence data through optimization and improvement of characteristics. Although these methods can solve the problem of anomaly detection of time series data to some extent, there are three problems: (1) The problem of association relation modeling among signals of the multidimensional time sequence data is solved, and partial abnormality is represented by the combination characteristics of a series of signals, so that the relationship among the signals needs to be modeled, and the stability and the adaptability of an algorithm are improved; (2) Because the training data has noise (namely, abnormal data without marks), the model can fit the abnormal data to a certain extent, so that the reconstruction error is poor in discrimination; (3) The problem of overfitting is still prone to occur due to limited training data size and lack of diversity.

Aiming at the problems, the invention provides a model training method based on the combination of graph neural network and graph contrast learning, which carries out feature learning through a multi-dimensional graph neural network, generates disturbance branches through disturbance of network parameters extracted by features, carries out contrast learning on the extracted features of the disturbance branches and normal branches, compensates for negative effects caused by lack of training data, reduces the risk that the data enhancement method possibly causes damage to internal features of the data, and further improves the feature representation capability, feature learning capability, generalization capability and adaptability of the model.

Example 1

Fig. 1 is a flowchart of a training method for a data anomaly detection model according to an embodiment of the present invention, where the method is applicable to an anomaly detection model for training time series data by using a deep learning method, and is used for anomaly detection of time series data, the method may be performed by a training device for the data anomaly detection model, the training device for the data anomaly detection model may be implemented in hardware and/or software, and the training device for the data anomaly detection model may be configured in an electronic device. As shown in fig. 1, the method includes:

S110, inputting time sequence signal sample data into an initial data anomaly detection model; the initial data anomaly detection model comprises: the method comprises a feature extraction network, a feature fusion network and a reconstruction network based on a graph neural network.

The initial anomaly detection model may be understood as an untrained or untrained complete data anomaly detection model. The time-series signal sample data refers to a time-series signal as training samples. In an embodiment of the present invention, the time-series signal may include data of multiple signals at multiple times. Optionally, the manner of acquiring the time-series signal sample data may be: and acquiring a time sequence signal in a preset time period, and preprocessing the time sequence signal to obtain time sequence signal sample data. Wherein, the preprocessing may include: filtering, cleaning, normalizing and the like. Illustratively, the size of the timing signal sample data is x=n×w, n is the number of signals, and w is the time window size.

In this embodiment, the initial data anomaly detection model sequentially includes: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network. A feature extraction network (GNN Module) based on the graph neural network is used for extracting features of time sequence signal sample data to obtain feature extraction results; wherein, the Graph Neural Network (GNN) is a network representing data based on a graph structure composed of nodes and edges. The feature fusion network is used for carrying out feature fusion on the feature extraction result to obtain a feature fusion result. The reconstruction network is used for reconstructing according to the feature fusion result to obtain a data reconstruction result.

And S120, performing feature extraction on the time sequence signal sample data through a feature extraction network to obtain a plurality of feature extraction results.

The feature extraction result refers to a result output after feature extraction by the feature extraction network. The plurality of feature extraction results may all be represented by a matrix of the same dimension.

In the embodiment of the invention, after time sequence signal sample data is input into an initial data anomaly detection model, feature extraction is performed on the time sequence signal sample data through a feature extraction network in the initial data anomaly detection model, and a plurality of feature extraction results output by the feature extraction network are obtained.

In an optional implementation manner of this embodiment, the feature extraction network based on the graph neural network includes N feature extraction modules based on the graph neural network connected in series, and the ith feature extraction module outputs an ith feature extraction result; wherein i is an integer which sequentially takes values from [1, N ].

Wherein i is an integer sequentially taking values from [1, N ], i.e., i=1, 2,3, … …, N.

In the embodiment of the invention, the feature extraction network comprises N feature extraction modules connected in series, the time sequence signal sample data is input into the feature extraction network, and the feature extraction is sequentially carried out through the N feature extraction modules connected in series in the feature extraction network, so that N feature extraction results are obtained. The feature extraction result output by the ith feature extraction module is an ith level feature extraction result.

S130, performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on a graph neural network; and carrying out feature extraction on the time sequence signal sample data through a feature extraction disturbance network to obtain a plurality of feature extraction disturbance results.

The feature extraction disturbance network (GNN Disturbed Module) is a network based on a graph neural network obtained by adding disturbance on the basis of the feature extraction network (GNN Module) based on the graph neural network. The feature extraction disturbance network is used for carrying out feature extraction on the time sequence signal sample data to obtain feature extraction disturbance results which are compared with the feature extraction results. The feature extraction disturbance result is a result obtained by feature extraction through a feature extraction disturbance network with disturbance. The feature extraction disturbance results can be represented by a matrix with the same dimension as the feature extraction results.

In the embodiment of the invention, the network parameters of the feature extraction network are randomly disturbed, and the feature extraction disturbance network corresponding to the feature extraction network is obtained. Inputting the time sequence signal sample data into a feature extraction disturbance network, and carrying out feature extraction on the time sequence signal sample data through the feature extraction disturbance network to obtain a feature extraction disturbance result output by the feature extraction disturbance network. It is understood that the plurality of feature extraction perturbation results are in one-to-one correspondence with the plurality of feature extraction results.

In an optional implementation manner of this embodiment, the feature extraction perturbation network based on the graph neural network includes N feature extraction perturbation modules based on the graph neural network connected in series, and the plurality of feature extraction perturbation results include: the ith feature extraction disturbance module outputs an ith level feature extraction disturbance result; wherein i is an integer which sequentially takes values from [1, N ].

In the embodiment of the present invention, parameter perturbation is performed on N feature extraction modules connected in series in a feature extraction network to obtain a feature extraction perturbation network, so the feature extraction perturbation network includes: and N feature extraction disturbance modules based on the graph neural network, which are connected in series and correspond to the N feature extraction modules based on the graph neural network in series. Inputting the time sequence signal sample data into a feature extraction disturbance network, and sequentially carrying out feature extraction through N feature extraction disturbance modules connected in series in the feature extraction disturbance network to obtain N feature extraction disturbance results. Wherein the plurality of feature extraction perturbation results comprises: the feature extraction disturbance result output by the ith feature extraction disturbance module is an ith level feature extraction disturbance result.

S140, inputting a plurality of feature extraction results into a feature fusion network to obtain a feature fusion result; and inputting the feature fusion result into a reconstruction network to obtain a data reconstruction result.

The feature fusion result is obtained after the feature extraction result is fused. The data reconstruction result is obtained by carrying out data reconstruction according to the feature fusion result. Alternatively, the feature fusion network may perform feature fusion by means of feature matrix addition or feature channel superposition, and the feature fusion network may, for example, use a fusion network structure of an Encoder-Decoder. The reconstruction network can adopt a transducer network structure, a full-connection network structure or a cyclic neural network structure, etc. The embodiment of the invention does not limit the network structure of the feature fusion network and the reconstruction network.

In the embodiment of the invention, a plurality of feature extraction results output by a feature extraction network are respectively input into a feature fusion network; and carrying out feature fusion on the plurality of feature extraction results through a feature fusion network to obtain a feature fusion result. Inputting the feature fusion result output by the feature fusion network into a reconstruction network; and carrying out data reconstruction on the feature fusion result through a reconstruction network to obtain a data reconstruction result.

In an alternative embodiment, since the plurality of feature extraction results may all be represented by a matrix with the same dimension, inputting the feature extraction results into the feature fusion network may obtain the feature fusion result as follows: in the feature fusion network, matrix addition is carried out on the feature extraction results with the same dimensions to obtain a feature fusion result.

S150, calculating a total loss function value according to the total contrast learning loss function value between the feature extraction results and the feature extraction disturbance results and the reconstruction loss function value between the data reconstruction result and the time sequence signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain the target data anomaly detection model.

The total contrast learning loss function value is the sum of loss values obtained through contrast learning between each feature extraction result and the corresponding feature extraction disturbance result. The reconstruction loss function value is a loss value obtained by reconstruction error calculation between a data reconstruction result and time sequence signal sample data; the total loss function value is a loss function value calculated from the total contrast learning loss function value and the reconstruction loss function value. Alternatively, the contrast learning loss function used in contrast learning may use a standard InfoNCE loss; the reconstruction error loss function employed in the reconstruction error calculation may employ a standard mean square error loss function Mean Squared Loss.

In the embodiment, in order to solve the problems of limited training data, poor model generalization capability and the like, a multistage comparison learning method based on network parameter disturbance is provided. And performing multistage contrast learning on a plurality of feature extraction results output by the feature extraction network and a plurality of feature extraction disturbance results output by the feature extraction disturbance network based on parameter disturbance to obtain a total contrast learning loss function value. The method is different from the traditional contrast learning method adopting data enhancement, a new contrast view angle is not required to be generated through data enhancement, damage to the internal associated features of the data caused by the change of the data characteristics generated by the data enhancement can be avoided, and the feature representation capability, the feature learning capability and the model generalization capability are further improved.

It should be further noted that, in this embodiment, the comparison learning loss function value may be calculated by using a graph-level (graph-level), that is, the graph level may further preserve internal correlation characteristics of data compared to a conventional node-level graph comparison loss calculation method, in which the positive and negative samples are determined as a whole based on the feature extraction result output by each feature extraction module in the graph neural network.

In an optional implementation of the present embodiment, calculating the total loss function value from the total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results, and the reconstruction loss function value between the data reconstruction result and the time-series signal sample data includes: carrying out weighted summation on the total contrast learning loss function value and the reconstruction loss function value to obtain a total loss function value; wherein the sum of the weight corresponding to the total contrast learning loss function value and the weight of the reconstruction loss function value is 1.

In another optional implementation manner of this embodiment, adjusting the network parameters in the initial data anomaly detection model according to the total loss function value, to obtain the target data anomaly detection model includes: updating the network parameter weight by back propagation according to the total loss function value; methods that may be used for network parameter weight updating include, but are not limited to SGD, RMSProp, adam, nesterov Accelerated Gradient or combinations of any two or more of the foregoing. If the network parameter weight reaches the termination condition, terminating the parameter training of the branch; and saving the trained and updated network parameter weight to obtain the target data anomaly detection model. The termination condition may be: the adjustment times of the network parameters reach the set total optimization times, or the total loss function value is smaller than the preset value. The whole training process of the initial data anomaly detection model can adopt an end-to-end unsupervised training mode, and different stages and different branches of the model are synchronously trained, synchronously updated and simultaneously ended.

Fig. 2 is a schematic diagram of a training method of a data anomaly detection model according to an embodiment of the present invention. As shown in fig. 2, according to the technical scheme of the embodiment of the invention, time sequence signal sample data is input into an initial data anomaly detection model; the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network; performing feature extraction on the time sequence signal sample data through a feature extraction network to obtain a plurality of feature extraction results; performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on a graph neural network; feature extraction is carried out on time sequence signal sample data through a feature extraction disturbance network, and a plurality of feature extraction disturbance results are obtained; inputting a plurality of feature extraction results into a feature fusion network to obtain a feature fusion result; inputting the feature fusion result into a reconstruction network to obtain a data reconstruction result; calculating a total loss function value according to the total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results and the reconstruction loss function value between the data reconstruction result and the time sequence signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain the target data anomaly detection model. The contrast learning method based on parameter disturbance is adopted, so that damage to the internal associated features of the data caused by the change of the data characteristics generated by data enhancement is avoided, the feature representation capability, the feature learning capability and the generalization and adaptation capability of the model are improved, and the accuracy of abnormal data detection of the abnormal data detection model is improved.

Fig. 3 is a flowchart of a training method of a data anomaly detection model according to an embodiment of the present invention, where a parameter disturbance process and a total loss function value calculation process in an initial data anomaly detection model according to the above embodiment and a structure of a feature extraction network are further specified. As shown in fig. 3, the method includes:

s210, inputting time sequence signal sample data into an initial data anomaly detection model; the initial data anomaly detection model comprises: the method comprises a feature extraction network, a feature fusion network and a reconstruction network based on a graph neural network.

S220, carrying out feature extraction on time-series signal sample data through N feature extraction modules based on a graph neural network connected in series in a feature extraction network to obtain N feature extraction results; the N feature extraction results comprise: the ith feature extraction module outputs an ith level feature extraction result; i is an integer which is sequentially valued from [1, N ].

In this embodiment, feature extraction is performed on time-series signal sample data by N feature extraction modules based on a graph neural network connected in series in a feature extraction network, so as to obtain N feature extraction results, including: inputting the time sequence sample data into a first feature extraction module in the feature extraction network to obtain a first-stage feature extraction result output by the first feature extraction module; outputting the ith feature extraction module in the feature extraction network Inputting the ith level of feature extraction result into an (i+1) th feature extraction module in the feature extraction network to obtain the (i+1) th level of feature extraction result output by the (i+1) th feature extraction module, thereby obtaining N feature extraction results output by the feature extraction network

In an alternative embodiment of the present embodiment, fig. 4 is a schematic structural diagram of a feature extraction module in an initial data anomaly detection model according to an embodiment of the present invention, and as shown in fig. 4, an ith feature extraction module based on a graph neural network includes: a signal dimension graph neural network layer and a time dimension graph neural network layer connected in series; the signal dimension graph neural network layer based on the graph neural network feature extraction module is used for performing graph neural network feature calculation of signal dimension on input data to obtain the feature of the signal dimension; wherein, when i=1, the input data is the time sequence signal sample data; when i is more than or equal to 2 and less than or equal to N, the input data is i-1 th level feature extraction result output by i-1 th feature extraction module based on the graph neural network; the time dimension graph neural network layer of the feature extraction module is used for performing time dimension graph neural network feature calculation on the features of the signal dimension to obtain an ith level feature extraction result

The signal dimension graph neural network layer (Inter-signal GNN layer) is a graph neural network based on signal dimension, and is used for taking each signal in data as a node, taking the data of the signal in a period of time as a node characteristic, and forming a graph with n nodes; the signal dimension graph neural network layer (Temporal GNN layer) is a time dimension based graph neural network for forming a graph having w nodes with data at each time point in each signal as one node (node) of the graph neural network and all signal data at that time point as features of the node.

Since the multi-dimensional time series signal data contains the data of the multi-path signal at a plurality of times, the data contains two-dimensional information. The first dimension is a time dimension, each path of signal is a time sequence data sequence, and the data at different time points in the sequence have time sequence relativity; the second dimension is a signal dimension, and due to the multidimensional signal, a plurality of data are generated at each moment, each data corresponds to one signal, and the different signals have an interrelated and interdependent relationship. Therefore, the embodiment of the invention provides a multi-dimensional graph neural network alternating characteristic representation method. The concrete steps are as follows: (1) In the time dimension, a graph neural network layer is adopted to learn time sequence association characteristics of data; (2) In the signal dimension, a graph neural network layer is also adopted to learn the correlation characteristics among signals; (3) The image neural network layers with the signal dimension and the time dimension are alternately cascaded, the image neural network layer with the signal dimension and the image neural network layer with the time dimension are connected in series to form a characteristic extraction module based on the image neural network, and then a plurality of the modules can be connected in series; (4) And fusing the extracted sign extraction results of each feature extraction module based on the graph neural network to form a final feature extraction result, so that the training stability of the model is improved. By the method, the data deep mode is mined to the maximum extent, and the characteristic representation capability is improved.

In this embodiment, inputting the time-series sample data into a first feature extraction module in the feature extraction network, and obtaining a first-stage feature extraction result output by the first feature extraction module may include: inputting the time sequence sample data into a signal dimension graph neural network layer of the first feature extraction module, and obtaining first-stage signal dimension graph neural network features obtained by performing graph neural network feature calculation of signal dimensions by the signal dimension graph neural network layer; inputting the first-stage signal dimension graph neural network characteristics into a time dimension graph neural network layer of the first characteristic extraction module to obtain a first-stage characteristic extraction result obtained by performing time dimension graph neural network characteristic calculation on the time dimension graph neural network layer

Similarly, the ith level of feature extraction result output by the ith feature extraction module in the feature extraction network is processedInputting the (i+1) th feature extraction module in the feature extraction network, and obtaining the (i+1) th level feature extraction result output by the (i+1) th feature extraction module may include: inputting the i-th level feature extraction result into a signal dimension graph neural network layer of an i+1th feature extraction module, and obtaining i+1th level signal dimension graph neural network features obtained by performing graph neural network feature calculation of a signal dimension by the signal dimension graph neural network layer; inputting the characteristics of the i+1th-level signal dimension graph neural network into a time dimension graph neural network layer of the i+1th characteristic extraction module to obtain an i+1th-level characteristic extraction result (i+1th-level characteristic extraction result) obtained by performing time dimension graph neural network characteristic calculation on the time dimension graph neural network layer >

S230, carrying out parameter disturbance on an ith feature extraction module in the feature extraction disturbance network by adopting a normal distributed random disturbance sequence to obtain the ith feature extraction disturbance module in the feature extraction disturbance network.

In this embodiment, the ith feature extraction perturbation module is obtained by performing parameter perturbation on the ith feature extraction module by a random perturbation sequence with normal distribution.

S240, performing feature extraction on time sequence signal sample data through N feature extraction disturbance modules based on the graph neural network connected in series in a feature extraction disturbance network to obtain N feature extraction disturbance results; the N feature extraction disturbance results comprise: the ith feature extraction disturbance module outputs an ith level feature extraction disturbance result; wherein i is an integer which sequentially takes values from [1, N ].

In the implementation, N feature extraction disturbance modules based on the graph neural network are connected in series in the feature extraction disturbance networkFeature extraction is carried out on the time sequence signal sample data to obtain N feature extraction disturbance results, wherein the feature extraction disturbance results comprise: inputting the time sequence sample data into a first feature extraction disturbance module in the feature extraction disturbance network to obtain a first-stage feature extraction disturbance result output by the first feature extraction disturbance module; inputting an ith level of feature extraction result output by an ith feature extraction module in the feature extraction network into an (i+1) th feature extraction disturbance module in the feature extraction disturbance network to obtain an (i+1) th level of feature extraction disturbance result output by the (i+1) th feature extraction disturbance module, thereby obtaining N feature extraction disturbance results output by the feature extraction disturbance network

In an alternative embodiment of the present embodiment, fig. 5 is a schematic structural diagram of a feature extraction perturbation module in an initial data anomaly detection model according to an embodiment of the present invention, and as shown in fig. 5, an ith feature extraction perturbation module based on a graph neural network includes: a signal dimension graph neural network disturbance layer and a time dimension graph neural network disturbance layer which are connected in series; the signal dimension graph neural network disturbance layer of the ith feature extraction disturbance module based on the graph neural network is used for carrying out graph neural network disturbance feature calculation of signal dimension on input data to obtain the feature of the signal dimension; wherein, when i=1, the input data is the time sequence signal sample data; when i is more than or equal to 2 and less than or equal to N, the input data is i-1 th level feature extraction result output by i-1 th feature extraction module based on the graph neural network; the time dimension graph neural network disturbance layer of the feature extraction disturbance module is used for performing time dimension graph neural network disturbance feature calculation on the feature of the signal dimension to obtain an ith level feature extraction disturbance result

In this embodiment, the time-series sample data is input to a first feature extraction perturbation module in the feature extraction perturbation network to obtain The obtaining of the first-stage feature extraction disturbance result output by the first feature extraction disturbance module comprises the following steps: inputting the time sequence sample data into a signal dimension graph neural network disturbance layer of the first feature extraction disturbance module, and obtaining first-stage signal dimension graph neural network disturbance features obtained by calculating graph neural network disturbance features of signal dimensions of the signal dimension graph neural network disturbance layer; inputting the disturbance characteristics of the first-stage signal dimension graph neural network into a time dimension graph neural network disturbance layer of the first characteristic extraction module to obtain a first-stage characteristic extraction disturbance result obtained by calculating the disturbance characteristics of the graph neural network in the time dimension by the time dimension graph neural network disturbance layer

Similarly, inputting the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network into the i+1th feature extraction disturbance module in the feature extraction network, and obtaining the i+1th level feature extraction disturbance result output by the i+1th feature extraction disturbance module includes: extracting the i-th level characteristicInputting a signal dimension graph neural network disturbance layer of an i+1th feature extraction disturbance module, and obtaining i+1th level signal dimension graph neural network disturbance features obtained by performing graph neural network disturbance feature calculation of a signal dimension by the signal dimension graph neural network disturbance layer; inputting disturbance characteristics of the i+1st-level signal dimension graph neural network into a time dimension graph neural network disturbance layer of the i+1th characteristic extraction disturbance module to obtain an i+1st-level characteristic extraction disturbance result +. >

S250, inputting the plurality of feature extraction results into a feature fusion network to obtain a feature fusion result, and inputting the feature fusion result into a reconstruction network to obtain a data reconstruction result.

S260, calculating an ith level comparison learning loss function value according to an ith level feature extraction result output by an ith feature extraction module in the feature extraction network and an ith level feature extraction disturbance result output by an ith feature extraction disturbance module in the feature extraction disturbance network; and determining the sum of the comparison learning loss function values of all levels as a total comparison learning loss function value.

In this embodiment, the total contrast learning loss function value may be:

wherein, loss _Comparisons Learning a loss function value for the total contrast; comparizons is a contrast learning function;extracting results for the ith grade of characteristics; />And extracting a disturbance result for the ith grade of characteristics. />

S270, calculating a reconstruction loss function value between the data reconstruction result and the time sequence signal sample data.

In this embodiment, the reconstruction loss function value may be:

Loss _{reconstruction} ＝Mean_Square_Error(X,R)；

wherein, loss _{reconstruction} To reconstruct the loss function value; mean_square_error is the Mean Square Error function; x is time sequence signal sample data; r is a data reconstruction result.

And S280, carrying out weighted summation on the total contrast learning loss function value and the reconstruction loss function value to obtain a total loss function value.

In this embodiment, the total loss function value is:

Loss _total ＝αLoss _Comparosons +βLoss _{reconstruction} ；

wherein, loss _total Alpha is the weight corresponding to the total comparison learning loss function value; beta is the weight corresponding to the reconstruction loss function value; and α+β=1. The specific values of alpha and beta are not limited in the embodiment of the invention, and can be determined according to the data characteristics of practical application.

And S290, adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain a target data anomaly detection model.

According to the technical scheme, the training of the data anomaly detection model is performed by a multi-level contrast learning method of network parameter disturbance, the graph neural network is combined with graph contrast learning, and the feature learning is performed by the multi-dimensional graph neural network, so that the feature representation capability is improved; the disturbance of network parameters is extracted through the features, disturbance branches are generated, and the disturbance branches and normal branches are subjected to contrast learning, so that damage to internal association features of data caused by the change of data characteristics generated by data enhancement is avoided, and the feature learning capability and the generalization and adaptation capability of the model are improved; meanwhile, training a data anomaly detection model based on a multi-dimensional graph neural network alternating characteristic representation method; the deep data mode can be mined to the greatest extent, and the characteristic representation capability, the characteristic learning capability and the model stability are further improved; the accuracy of the data anomaly detection method based on the target data anomaly model is further improved.

Fig. 6 is a flowchart of a data anomaly detection method according to an embodiment of the present invention, where the embodiment is applicable to a case where anomaly detection is performed on cloud network status data to be detected by using an anomaly detection model obtained by using the training method of the data anomaly detection model, and the method may be performed by a data anomaly detection device, and the data anomaly detection device may be implemented in a form of hardware and/or software, and the data anomaly detection device may be configured in an electronic device. As shown in fig. 6, the method includes:

s310, acquiring cloud network data to be detected.

The cloud network state data to be detected refers to cloud network state data which needs to be detected for abnormal data, and the cloud network state data refers to collected data which can represent the use and running states of cloud network resources at a certain moment.

In an optional embodiment of the present embodiment, cloud network state data in a preset period of time is collected, and the cloud network state data is normalized to obtain a cloud network state number to be detected X' =n×w, where n is the number of signals and w is the size of a time window.

S320, inputting cloud network state data to be detected into a target data anomaly detection model obtained by training by using the training method of the data anomaly detection model, and obtaining a cloud network state data reconstruction result.

The target data anomaly detection model is a complete model obtained by training by the training method of the data anomaly detection model provided by the embodiment of the invention. The cloud network state data reconstruction result is a result output by the target data anomaly detection model.

Fig. 7 is a schematic structural diagram of a target data anomaly detection model according to an embodiment of the present invention. As shown in fig. 7, in the present embodiment, the target data abnormality detection model includes: the method comprises a feature extraction network, a feature fusion network and a reconstruction network based on a graph neural network. Inputting cloud network data to be detected into a target data anomaly detection model; feature extraction is carried out on time sequence signal sample data through a feature extraction network based on a graph neural network in a target data anomaly detection model, so that a plurality of feature extraction results are obtained; inputting a plurality of feature extraction results into a feature fusion network to obtain a feature fusion result; and inputting the feature fusion result into a reconstruction network to obtain a cloud network state data reconstruction result.

In an optional embodiment of this embodiment, the graph neural network-based feature extraction network includes N graph neural network-based feature extraction modules connected in series; the plurality of feature extraction results includes: the ith feature extraction module outputs an ith level feature extraction result. The ith feature extraction module based on the graph neural network comprises: a signal dimension graph neural network layer and a time dimension graph neural network layer connected in series; the i-th graph neural network-based feature extraction module is used for performing graph neural network feature calculation of signal dimension on input data to obtain features of the signal dimension; when i=1, the input data is cloud network state data to be detected; when i is more than or equal to 2 and less than or equal to N, the input data is i-1 th level feature extraction result output by i-1 th feature extraction module based on the graph neural network; and the ith graph neural network-based feature extraction module is used for performing time dimension graph neural network feature calculation on the signal dimension features to obtain an ith level feature extraction result.

S330, determining a data detection result of the cloud network state data to be detected according to the reconstruction error between the cloud network state data to be detected and the cloud network state data reconstruction result.

The reconstruction error may be calculated using a standard mean square error loss function Mean Squared Loss. The data detection result may include data normal or data abnormal.

In this embodiment, error calculation is performed on cloud network state data to be detected and a cloud network state data reconstruction result to obtain a reconstruction error, and whether the cloud network state data to be detected is abnormal is determined according to the reconstruction error to obtain a data detection result. The method includes determining that a data detection result of cloud network state data to be detected is abnormal if the reconstruction error is greater than a preset error threshold, and determining that the data detection result of the cloud network state data to be detected is normal if the reconstruction error is less than or equal to the preset error threshold.

According to the technical scheme, cloud network state data to be detected are obtained; inputting cloud network state data to be detected into a target data anomaly detection model obtained by training by a training method of the data anomaly detection model, and obtaining a cloud network state data reconstruction result; according to the reconstruction error between the cloud network state data to be detected and the cloud network state data reconstruction result, the data detection result of the cloud network state data to be detected is determined, and the accuracy and stability of abnormal data detection are improved.

Fig. 8 is a schematic structural diagram of a training device for a data anomaly detection model according to an embodiment of the present invention. As shown in fig. 8, the apparatus includes: an input module 410, a feature extraction module 420, a feature extraction perturbation module 430, a feature fusion module 440, and a parameter adjustment module 450; wherein,

an input module 410 for inputting the time-series signal sample data into an initial data anomaly detection model; wherein the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network;

the feature extraction module 420 is configured to perform feature extraction on the time-series signal sample data through the feature extraction network to obtain a plurality of feature extraction results;

the feature extraction disturbance module 430 is configured to perform parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on a graph neural network; performing feature extraction on the time sequence signal sample data through the feature extraction disturbance network to obtain a plurality of feature extraction disturbance results;

a feature fusion module 440, configured to input the plurality of feature extraction results into the feature fusion network to obtain a feature fusion result; inputting the feature fusion result into the reconstruction network to obtain a data reconstruction result;

A parameter adjustment module 450, configured to calculate a total loss function value according to a total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results, and a reconstruction loss function value between the data reconstruction result and the time-series signal sample data; and adjusting network parameters in the initial data anomaly detection model according to the total loss function value to obtain a target data anomaly detection model.

According to the technical scheme, time sequence signal sample data are input into an initial data anomaly detection model; the initial data anomaly detection model comprises: a feature extraction network, a feature fusion network and a reconstruction network based on the graph neural network; performing feature extraction on the time sequence signal sample data through a feature extraction network to obtain a plurality of feature extraction results; performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network based on a graph neural network; feature extraction is carried out on time sequence signal sample data through a feature extraction disturbance network, and a plurality of feature extraction disturbance results are obtained; inputting a plurality of feature extraction results into a feature fusion network to obtain a feature fusion result; inputting the feature fusion result into a reconstruction network to obtain a data reconstruction result; calculating a total loss function value according to the total contrast learning loss function value between the plurality of feature extraction results and the plurality of feature extraction disturbance results and the reconstruction loss function value between the data reconstruction result and the time sequence signal sample data; and the network parameters in the initial data anomaly detection model are adjusted according to the total loss function value to obtain a target data anomaly detection model, so that the characteristic representation capability, the characteristic learning capability and the generalization and adaptation capability of the model are improved.

On the basis of the foregoing embodiment, the graph neural network-based feature extraction network includes N graph neural network-based feature extraction modules connected in series, and the plurality of feature extraction results include: the ith feature extraction module outputs an ith level feature extraction result;

the characteristic extraction disturbance network based on the graph neural network comprises N characteristic extraction disturbance modules based on the graph neural network, wherein the N characteristic extraction disturbance modules are connected in series, and the characteristic extraction disturbance results comprise: the ith feature extraction disturbance module outputs an ith level feature extraction disturbance result; wherein i is an integer which sequentially takes values from [1, N ].

On the basis of the above embodiment, the ith feature extraction module based on the graph neural network includes: a signal dimension graph neural network layer and a time dimension graph neural network layer connected in series;

the i-th graph neural network-based feature extraction module is used for performing graph neural network feature calculation of signal dimension on input data to obtain features of the signal dimension; wherein, when i=1, the input data is the time sequence signal sample data; when i is more than or equal to 2 and less than or equal to N, the input data is i-1 th level feature extraction result output by i-1 th feature extraction module based on the graph neural network;

And the ith graph neural network-based feature extraction module is used for performing time dimension graph neural network feature calculation on the signal dimension features to obtain an ith level feature extraction result.

On the basis of the embodiment, the ith feature extraction disturbance module is obtained by performing parameter disturbance on the ith feature extraction module by a random disturbance sequence with normal distribution.

On the basis of the above embodiment, the parameter adjustment module 450 includes:

the comparison learning loss calculation unit is used for calculating an ith comparison learning loss function value according to an ith characteristic extraction result output by an ith characteristic extraction module in the characteristic extraction network and an ith characteristic extraction disturbance result output by an ith characteristic extraction disturbance module in the characteristic extraction disturbance network;

a total contrast learning loss calculation unit that calculates a total sum of the contrast learning loss function values of each level as the total contrast learning loss function value;

a reconstruction loss calculation unit for calculating a reconstruction loss function value between the data reconstruction result and the time sequence signal sample data;

and the total loss calculation unit is used for carrying out weighted summation on the total comparison learning loss function value and the reconstruction loss function value to obtain a total loss function value.

The training device for the data anomaly detection model provided by the embodiment of the invention can execute the training method for the data anomaly detection model provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

Fig. 9 is a schematic structural diagram of a data anomaly detection device according to an embodiment of the present invention. As shown in fig. 9, the apparatus includes: a data acquisition module 510, a data detection module 520, and a detection result determination module 530; wherein,

the data acquisition module 510 is configured to acquire cloud network data to be detected;

the data detection module 520 is configured to input the cloud network state data to be detected into a target data anomaly detection model obtained by training the training method of the data anomaly detection model, so as to obtain a cloud network state data reconstruction result;

the detection result determining module 530 is configured to determine a data detection result of the cloud network state data to be detected according to a reconstruction error between the cloud network state data to be detected and the cloud network state data reconstruction result.

According to the technical scheme, cloud network state data to be detected are obtained; inputting cloud network data to be detected into a target data anomaly detection model obtained by training a training method of the data anomaly detection model; and the data abnormality detection result output by the target data abnormality detection model is obtained, so that the accuracy and stability of abnormal data detection are improved.

Fig. 10 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 10, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the respective methods and processes described above, for example, a training method of a data abnormality detection model or a data abnormality detection method.

In some embodiments, the training method of the data anomaly detection model or the data anomaly detection method may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the training method of the data abnormality detection model or the data abnormality detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the training method of the data anomaly detection model or the data anomaly detection method in any other suitable manner (e.g., by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which a user can provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.

The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.

The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims

1. The training method of the data anomaly detection model is characterized by comprising the following steps of:

2. The method of claim 1, wherein the graph neural network-based feature extraction network comprises N graph neural network-based feature extraction modules in series, the plurality of feature extraction results comprising: the ith feature extraction module outputs an ith level feature extraction result;

3. The method of claim 2, wherein the ith neural network-based feature extraction module comprises: a signal dimension graph neural network layer and a time dimension graph neural network layer connected in series;

4. A method according to any one of claims 2-3, wherein the i-th feature extraction perturbation module is obtained by performing parameter perturbation on the i-th feature extraction module by a normally distributed random perturbation sequence.

5. The method of claim 1, wherein the computing an overall loss function value from an overall contrast learning loss function value between the feature extraction result and the feature extraction disturbance result, and a reconstruction loss function value between the data reconstruction result and the time-series signal sample data, comprises:

calculating an ith-level comparison learning loss function value according to an ith-level feature extraction result output by an ith feature extraction module in the feature extraction network and an ith-level feature extraction disturbance result output by an ith feature extraction disturbance module in the feature extraction disturbance network;

determining the sum of the comparison learning loss function values of all levels as the total comparison learning loss function value;

calculating a reconstruction loss function value between the data reconstruction result and the time sequence signal sample data;

and carrying out weighted summation on the total contrast learning loss function value and the reconstruction loss function value to obtain a total loss function value.

6. A data anomaly detection method, comprising:

acquiring cloud network data to be detected;

inputting the cloud network state data to be detected into a target data anomaly detection model obtained by training by the training method of the data anomaly detection model according to any one of claims 1-5, and obtaining a cloud network state data reconstruction result;

7. A training device for a data anomaly detection model, comprising:

8. A data anomaly detection device, comprising:

the data detection module is used for inputting the cloud network state data to be detected into a target data anomaly detection model obtained by training the training method of the data anomaly detection model according to any one of claims 1-5, and obtaining a cloud network state data reconstruction result;

9. An electronic device, the electronic device comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the training method of the data anomaly detection model of any one of claims 1 to 5 or the data anomaly detection method of claim 6.

10. A computer readable storage medium storing computer instructions for causing a processor to implement the training method of the data anomaly detection model of any one of claims 1-5 or the data anomaly detection method of claim 6 when executed.