CN117093667A - Abnormality detection method and related equipment - Google Patents

Abstract

The disclosure provides an anomaly detection method and related equipment. The method comprises the following steps: receiving target feedback information; extracting a first vectorized representation of the target feedback information; determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold; determining timing information of the target feedback information based on the target feedback information and feedback information corresponding to the at least one second vectorized representation; extracting at least one keyword of the target feedback information; and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

Description

Anomaly detection methods and related equipment

Technical field

The present disclosure relates to the field of computer technology, and in particular, to an anomaly detection method and related equipment.

Background technique

The anomaly discovery algorithm is a computer technology that identifies hot abnormal topics in customer complaint data streams. It borrows natural language processing methods to gather feedback texts on the same topic together to determine whether it is an abnormal issue that requires attention. However, the inventors of the present disclosure found that it is difficult for existing clustering methods to achieve real-time and accurate anomaly detection.

Contents of the invention

The present disclosure proposes an anomaly detection method and related equipment to solve or partially solve the above problems.

A first aspect of this disclosure provides an anomaly detection method, including:

Receive target feedback information;

Extracting a first vectorized representation of the target feedback information;

Determine at least one second vectorized representation based on the first vectorized representation and historical feedback information, and the similarity between the second vectorized representation and the first vectorized representation is greater than a preset similarity threshold;

Obtain timing information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vectorized representation;

Extract at least one keyword of the target feedback information; and

An anomaly detection result is determined based on the at least one keyword of the target feedback information and the timing information.

A second aspect of the present disclosure provides an anomaly detection device, including:

The receiving module is configured to: receive target feedback information;

A vector extraction module configured to: extract a first vectorized representation of the target feedback information;

an information extraction module configured to: determine at least one second vectorized representation based on the first vectorized representation and historical feedback information, where the similarity between the second vectorized representation and the first vectorized representation is greater than a preset Similarity threshold; based on the target feedback information and the feedback information corresponding to the at least one second vectorized representation, obtain the timing information of the target feedback information; and extract at least one keyword of the target feedback information; and

The detection module is configured to: determine an anomaly detection result based on the at least one keyword of the target feedback information and the timing information.

A third aspect of the present disclosure provides a computer device, including one or more processors, a memory; and one or more programs, wherein the one or more programs are stored in the memory, and are Executed by one or more processors, the program includes instructions for performing the method according to the first aspect.

A fourth aspect of the present disclosure provides a non-volatile computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the processor causes the processor to execute the first aspect. Methods.

A fifth aspect of the present disclosure provides a computer program product, which includes computer program instructions. When the computer program instructions are run on a computer, they cause the computer to execute the method described in the first aspect.

The anomaly detection method and related equipment provided by the present disclosure generate corresponding timing information based on a vectorized representation similar to the vectorized representation of target feedback information, and then combine the keywords of the target feedback information and the timing information to detect abnormalities. Detection, on the one hand, can realize real-time detection of anomalies, on the other hand, it can simultaneously use keyword features and timing features for anomaly detection, thereby obtaining more accurate anomaly detection results.

Description of the drawings

In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings needed to be used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings in the following description are only for illustration of the present disclosure. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative efforts.

FIG. 1 shows a schematic diagram of an exemplary system provided by an embodiment of the present disclosure.

Figure 2A shows a schematic diagram of an exemplary text representation model according to an embodiment of the present disclosure.

Figure 2B shows a schematic diagram of an exemplary timing histogram according to an embodiment of the present disclosure.

FIG. 2C shows a schematic diagram of another exemplary timing histogram according to an embodiment of the present disclosure.

Figure 2D shows a schematic diagram of an exemplary anomaly detection model according to an embodiment of the present disclosure.

FIG. 3 shows a schematic flowchart of an exemplary method provided by an embodiment of the present disclosure.

FIG. 4 shows a schematic diagram of the hardware structure of an exemplary computer device provided by an embodiment of the present disclosure.

FIG. 5 shows a schematic diagram of an exemplary device provided by an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present disclosure more clear, the present disclosure will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of this disclosure should have the usual meanings understood by those with ordinary skills in the field to which this disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Words such as "include" or "comprising" mean that the elements or things appearing before the word include the elements or things listed after the word and their equivalents, without excluding other elements or things. Words such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right", etc. are only used to express relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

The anomaly discovery algorithm in the field of customer service is a computer technology that identifies hot abnormal topics in the customer complaint data stream. It borrows natural language processing methods to gather feedback texts on the same topic together to determine whether it is an issue that requires attention. abnormal problem.

For example, in the user feedback scenario of a certain platform, timely discovery of hot abnormal issues in the feedback data is extremely important for the operation and maintenance of video information streaming products.

One possible hotspot (anomaly) discovery algorithm mainly relies on text clustering technology. Since text clustering is an unsupervised method, the effect of the clustering algorithm is usually very limited, and the category granularity is difficult to control (for example, due to the different situations of different problems in different time periods, the threshold used to determine abnormal problems during clustering is difficult to control). Fixed), the accuracy of mining hot issues through clustering algorithm is not high, and the real-time performance of the clustering algorithm is difficult to guarantee, making it difficult to timely capture online abnormal issues.

For example, in a user feedback scenario on a certain platform, different user feedback on the same issue may be very different in expression, but may have roughly the same semantic information. It is also difficult for unsupervised vector representation methods to learn whether different expression texts are feedback. It is the same problem, so it is difficult to meet the needs of hot spot discovery in user feedback scenarios.

In view of this, embodiments of the present disclosure provide an anomaly detection method and related equipment, which generate corresponding timing information based on a vectorized representation similar to the vectorized representation of target feedback information, and then combine the keywords of the target feedback information with the timing The information is combined for anomaly detection. On the one hand, it can achieve real-time detection of anomalies. On the other hand, it can simultaneously use keyword features and timing features for anomaly detection, thereby obtaining more accurate anomaly detection results.

FIG. 1 shows a schematic diagram of an exemplary system 100 provided by an embodiment of the present disclosure.

The system 100 can be used to process target feedback information (for example, user feedback through the platform's customer service portal) and perform anomaly detection based on the target feedback information. As shown in Figure 1, the system 100 may include a server 200 and a terminal device 300.

The server 200 may be a server deployed within the enterprise or a commercial server purchased or rented by the enterprise. The number of servers 200 may be one or more. When there are multiple servers 200 , a distributed architecture may be used to form a server cluster. In some embodiments, as shown in Figure 1, the system 100 may further include a database server 202, which may be used to store data, and the server 200 may call corresponding data from the database server 202 as needed. . In some embodiments, the database server 202 may be an ElasticSearch cluster.

The terminal device 300 may be various types of fixed terminals or mobile terminals. For example, the terminal device 300 may be a mobile phone, a tablet computer, a personal computer, a notebook computer, and other devices. The terminal device 300 and the server 200 can communicate through a wired network or a wireless network to achieve data interaction.

In some embodiments, the user can use the terminal device 300 to send some feedback information to the server 200 . For example, the user can input some feedback information through the user feedback entrance (for example, the feedback interface in the APP) of the application program (APP) installed in the terminal device 300, and the terminal device 300 sends the feedback information to the server 200.

After receiving the feedback information, the server 200 may first preprocess the feedback information for abnormality detection.

In some embodiments, the server 200 may process each feedback information received, for example, vectorize the text of the feedback information.

There are many ways to vectorize the text of feedback information. In some embodiments, a text representation model may be constructed in the server 200 to vectorize the text of the feedback information. The text representation model can adopt various algorithm models for text processing. In some embodiments, a BERT model may be employed.

Figure 2A shows a schematic diagram of an exemplary text representation model 204 in accordance with an embodiment of the present disclosure.

As an optional embodiment, the text representation model can use the pre-trained model 2042 as the model basis, and then use the historical feedback information of the target platform (the platform to be anomaly detected) (for example, the target platform within a historical period ( For example, user feedback information collected within one year, within half a year, within three months, etc.) to continue training the pre-training model 2042, thereby obtaining a text representation model 2044. Among them, the pre-training model 2042 can use the pre-trained BERT model provided by the open source platform, or build an initialized BERT model, and then use the open source corpus to pre-train the initialized model to obtain the pre-trained BERT model. .

Continuing to train the pre-training model 2042 can be implemented by using a Mask Language Model (MLM for short) method.

In some embodiments, multiple historical feedback information are used to form a training data set, and each historical feedback information can be processed to obtain training samples. Since the mask language model mechanism needs to mask the text using a mask identifier, each historical feedback information can be masked to obtain historical feedback information with a mask identifier.

Furthermore, in order to help the model learn the semantic information that "feedback information with the same label is close in the vector space, feedback information with different labels is far apart in the vector space", historical feedback with masked identifiers can be Information is labeled with corresponding classification labels.

When there are large differences in the text expressions of feedback information from different users, it is difficult for traditional unsupervised text representation methods to accurately obtain the deep semantic information of the feedback text. Specific examples are shown in Table 1.

Table 1

User feedback text Label I’ve only been using it for a while, but my phone is getting very hot. Functional failure - phone gets hot I just upgraded and my phone got hot. What's going on? Functional failure - phone gets hot What's wrong with your product? My phone burned to death after playing with it for a while. Functional failure - phone gets hot How can you recommend videos that I don’t like? Ecological style - not recommended

It can be seen that using the label information carried by the feedback information can better help the text representation model learn the semantic information of the sentence. Therefore, as a preferred embodiment, the classification label may be a label associated with the historical feedback information. For example, the tag carried by the feedback information when the user provides the feedback information. The label can be a label selected by the user, a label assigned by an online natural language processing (NLP) classification model, or a label generated by manual correction, etc.

Generally, in the MLM mechanism, a certain proportion (for example, 15%) of words (or characters) are randomly selected from the text for masking processing (the [Mask] symbol is used to replace the original words), and then based on the BERT model Extract feedback text information with masked identifiers, and then predict the information of the masked words. In order to enhance the text representation model 2044's representation of key information of the feedback text, in some embodiments, the masking probability of keywords in the text can be increased. As an optional embodiment, the keyword extraction algorithm (TF-IDF) can be used to design the mask probability. For example, calculate the TF-IDF score for each word in the historical feedback information, and then normalize it based on the TF-IDF scores of all words in the historical feedback information to obtain the weight of each word, and then use this weight as the starting point. The probability of selecting words for masking based on historical feedback information. Since the TF-IDF score reflects the importance of a word in a text set to a certain text, such processing can increase the probability of masking keywords, thereby enhancing the model's representation of key information in the feedback text. It can be understood that the text set used to calculate the TF-IDF score selects the historical feedback information set of the target platform (the platform to be anomaly detected), which can further improve the model's representation of key information of the feedback information.

After obtaining the training data set, the training data set can be used to continue training the pre-training model 2042 based on the MLM mechanism, thereby obtaining the text representation model 2044. Subsequently, the text representation model 2044 can be used to vectorize the target feedback information received in real time. representation.

In some embodiments, the server 200 can use the text representation model 2044 to process each piece of received feedback information to obtain a vectorized representation, and then store it in the database server 202 (for example, an ElasticSearch cluster) for subsequent extraction of the corresponding feedback information. Timing characteristics. Correspondingly, the user's feedback information may also be stored in the database server 202 .

Returning to FIG. 1 , for the target feedback information 302 received in real time, the server 200 may first use the text representation model 2044 to extract a first vectorized representation of the target feedback information 302 .

Then, the server 200 may obtain a plurality of second vectorized representations similar to the first vectorized representation based on the first vectorized representation. For example, the first vectorized representation is input to a vector retrieval engine (such as ByteES, Faiss, etc.) of the database server 202 (such as an ElasticSearch cluster) for retrieval, and a plurality of vectorized representations whose similarity to the first vectorized representation is greater than predetermined are obtained. Let the second vectorized representation of the similarity threshold (eg, cosine similarity greater than 0.92).

Then, the server 200 can obtain feedback information corresponding to each second vectorized representation from the database server 202 based on these second vectorized representations.

For example, users submitted a common feedback question - "Why does it freeze?". After vectorizing the feedback question through the text representation model 2044, some similar vectorized representations can be retrieved using a vector retrieval engine. Then, based on these similar vectorized representations, the server 200 can obtain information related to "Why is it stuck?" Pause?" Similar feedback information.

It can be considered that these similar feedback messages all describe the same problem, and then based on the user submission time of each feedback message, users are drawn in preset time intervals (for example, 10 minutes, half an hour, 1 hour, etc.) The timing histogram 206a of the feedback information is used as the timing information of the feedback information, for example, as shown in FIG. 2B.

For another example, if the user feedback is an abnormal problem - "the phone gets hot after brushing for a while". The server 200 can also use the same method to perform text vectorization on the feedback information, store it in a vector retrieval database, and perform vector retrieval and other operations. Then get similar feedback as shown in Table 2. The timing histogram 206b may be as shown in Figure 2C.

Table 2

User submission time customer feedback 2021 12-24 17:30:41 I’ve only been using it for a while, but my phone is getting very hot. 2021 12-24 17:30:56 I just upgraded and my phone got hot. What's going on? 2021 12-24 17:31:11 What's wrong with your product? My phone burned to death after playing with it for a while. 2021 12-24 17:31:38 The phone is too hot 2021 12-24 17:32:16 The phone is very hot

As shown in Figure 2C, it can be seen that the abnormal problem is characterized by cyclical fluctuations in the early stage, but an abnormal magnitude is emerging in the near future. Judging from the timing histogram 206b, the problem of "the phone becomes hot after a while of swiping" is generally lower than 5 every 10 minutes under normal circumstances. However, recently, the magnitude has reached 25 every 10 minutes, which means that "mobile phones may become hot". "Hot" abnormality.

It can be seen that the timing histogram reflects the timing characteristics of a problem corresponding to feedback information over a period of time.

Next, the server 200 may extract the keywords of the target feedback information 302, and then obtain an anomaly detection result based on the keywords of the target feedback information 302 and the timing information.

There are many ways to extract keywords, and some common keyword extraction methods can be used to extract keywords from the target feedback information 302. For example, algorithms such as TF-IDF, TextRank, and LDA can be used to extract keywords. As an optional embodiment, use the TF-IDF algorithm to calculate the TF-IDF score of each word (or character), and then use the word with a higher score as a keyword. For example, the words with the highest and second highest scores can be selected as keywords, or the words with scores above a score threshold can be selected as keywords. In order to ensure that keywords can be extracted normally, the score threshold needs to be set so that keywords can be extracted from each feedback information. Alternatively, when there is no word that meets the score threshold, the word with the highest score can be selected as the keyword.

In some embodiments, the server 200 can input the keywords and the timing information into an anomaly detection model, and then the anomaly detection model outputs the anomaly detection results.

In actual abnormal problem detection, different problems require different thresholds at different times (thresholds that reflect the problem as an abnormal problem). Therefore, a fixed threshold cannot be used, and the threshold needs to be determined based on the content (keywords) and time characteristics (histogram trend) of the specific question. Therefore, this embodiment uses a question classification model based on keywords and time series information as an anomaly detection model to directly predict whether the candidate question (feedback information 302) is an anomaly question.

Figure 2D shows a schematic diagram of an exemplary anomaly detection model 208 in accordance with an embodiment of the present disclosure.

As shown in FIG. 2D , the anomaly detection model 208 may include a keyword feature extraction layer 2082 , a temporal feature extraction layer 2084 and a classification layer 2086 .

The keyword feature extraction layer 2082 may extract corresponding keyword features from the keywords input to the anomaly detection model 208 . In some embodiments, the keyword feature extraction layer 2082 may be a word embedding layer.

The temporal feature extraction layer 2084 may extract corresponding temporal features from the temporal information (eg, temporal histogram) input to the anomaly detection model 208. In some embodiments, the temporal feature extraction layer 2084 may be composed of a long short-term memory network (LSTM).

The classification layer 2086 can splice the keyword features and time series features input therein to obtain the overall features of the candidate anomaly, and finally predict the category of the target feedback information 302 to obtain the anomaly detection result. For example, Yes indicates that the problem expressed by the target feedback information 302 is an abnormal problem, and No indicates that the problem expressed by the target feedback information 302 is not an abnormal problem. In some embodiments, the classification layer 2086 can be a fully connected neural network model, in which the number of hidden layers and the number of neurons in each layer can be set as needed.

It can be seen that the anomaly detection model 208 can mainly include the input of two types of features: a) keyword features are used to describe the content information of the candidate questions; b) timing features are used to describe the timing feature information of the occurrence of the candidate questions. The anomaly detection model 208 performs splicing based on these two features, then performs information fusion at the fully connected neural network layer, and finally predicts whether the candidate question is an anomaly.

In some embodiments, the anomaly detection model 208 may also be trained based on historical feedback information. As an optional embodiment, the training sample set of the anomaly detection model 208 may include multiple training samples, and these training samples may further include positive samples (belonging to historical accidents) and negative samples (not belonging to historical accidents). Among them, the ratio of positive samples to negative samples can be, for example, 1:10.

Among them, the positive samples are abnormal feedback information in the historical feedback information (for example, why the mobile phone is so hot). In most cases, historical accidents or anomalies are generally archived, such as accident tags, accident descriptions, accident-related feedback, accident occurrence time and trends, etc. Based on these archived data, accident-related keywords and time series histogram features of the accident can be manually constructed, that is, historical accident data for a period of time are collected and labeled as positive examples as positive examples for model training.

Negative example samples are feedback information randomly selected from historical feedback information and labeled as negative examples. Since randomly selected feedback information has a very small probability of being an accident or abnormal feedback, it can be used as a negative sample for model training, making the processing easier and more efficient.

Then, the server 200 can find its similar feedback information based on the vector retrieval engine, and then count the keywords and time series histograms of these similar feedback information.

Then, these keywords and time series histograms can be used to train an anomaly detection model. Based on the predicted categories and the true categories of the training data, a cross-entropy loss is constructed, and the model parameters are optimized based on the gradient descent method until convergence, thereby completing the model training and obtaining the final anomaly detection model 208. In this way, by inputting the keywords and time series information (for example, time series histogram) of the target feedback information 302 into the anomaly detection model 208, the detection result of whether there is an abnormality can be obtained.

In some embodiments, when the server 200 determines that the anomaly detection result is Yes, the server 200 can also send an alarm prompt to a specific person (for example, send a risk prompt to the device of the background monitoring person), so that the relevant personnel can be informed in time. abnormal problems occur, and respond in a timely manner.

It can be seen from the above embodiments that the anomaly detection system 100 proposed in the embodiment of the present disclosure can dig out abnormal problems that may be occurring in real time from user feedback data. The algorithm has strong fault tolerance and high real-time performance.

Embodiments of the present disclosure also provide an anomaly detection method. Figure 3 shows a schematic flowchart of an embodiment method 400 provided by an embodiment of the present disclosure. The method 400 may be implemented by the server 200 of FIG. 1 , and may further include the following steps, as shown in FIG. 3 .

At step 402, the server 200 may receive target feedback information 302.

In step 404, the server 200 may extract a first vectorized representation of the target feedback information.

In some embodiments, extracting the first vectorized representation of the target feedback information includes: inputting the target feedback information into a text representation model (eg, model 2044 in Figure 2A), and outputting the first vectorized representation. Wherein, the text representation model is trained based on historical feedback information.

In some embodiments, the training sample set of the text representation model includes multiple training samples, the training samples are historical feedback information with masked identifiers, and the training samples have classification labels, and the classification labels are The tags associated with the historical feedback information enable the model to learn the semantic information that "feedback information with the same tag is close in the vector space, and feedback information with different tags is far apart in the vector space."

In some embodiments, the historical feedback information includes multiple words, and the mask probability of the mask identifier corresponding to the word is determined based on the keyword extraction algorithm score of the word, which can enhance the model's understanding of the key information of the feedback text. express.

In step 406, the server 200 may determine at least one second vectorized representation based on the first vectorized representation and historical feedback information (eg, feedback information stored in the database server 202 of FIG. 1), the second vectorized representation Indicates that the similarity with the first vectorized representation is greater than the preset similarity threshold.

In some embodiments, determining at least one second vectorized representation based on the first vectorized representation and historical feedback information includes: inputting the first vectorized representation into a vector retrieval engine and outputting the second vectorized representation .

In step 408, the server 200 may obtain the timing information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vectorized representation.

In some embodiments, the timing information is a timing histogram generated based on the target feedback information and at least one feedback information corresponding to the at least one second vectorized representation.

In step 410, the server 200 may extract keywords of the target feedback information.

In step 412, the server 200 may determine an anomaly detection result based on the at least one keyword of the target feedback information and the timing information.

In some embodiments, determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information includes: inputting the keyword and the timing information into an anomaly detection model (for example, FIG. 2D model 208), outputs the anomaly detection result; wherein the anomaly detection model is trained based on historical feedback information.

In some embodiments, the training sample set of the anomaly detection model includes multiple training samples, and the multiple training samples include positive samples and negative samples, wherein the positive samples are from the historical feedback information. abnormal feedback information, and the negative sample is feedback information randomly selected from the historical feedback information.

In some embodiments, determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information includes: extracting at least one keyword feature from the at least one keyword; Extract temporal features from the temporal information; splice the at least one keyword feature and the temporal features into target features; perform classification prediction based on the target features, and output the anomaly detection results.

It should be noted that the methods in the embodiments of the present disclosure can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario, and is completed by multiple devices cooperating with each other. In this distributed scenario, one device among the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete all the steps. method described.

It should be noted that some embodiments of the present disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the above-described embodiments and still achieve the desired results. Additionally, the processes depicted in the figures do not necessarily require the specific order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain implementations.

An embodiment of the present disclosure also provides a computer device for implementing the above-mentioned anomaly detection method 400. FIG. 4 shows a schematic hardware structure diagram of an exemplary computer device 500 provided by an embodiment of the present disclosure. The computer device 500 can be used to implement the server 200 or the terminal device 300 . As shown in Figure 4, computer device 500 may include: processor 502, memory 504, network module 506, peripheral interface 508, and bus 510. Among them, the processor 502, the memory 504, the network module 506 and the peripheral interface 508 implement communication connections between each other within the computer device 500 through the bus 510.

The processor 502 may be a central processing unit (CPU), an image processor, a neural network processor (NPU), a microcontroller (MCU), a programmable logic device, a digital signal processor (DSP), an application-specific Integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits. Processor 502 may be used to perform functions related to the techniques described in this disclosure. In some embodiments, processor 502 may also include multiple processors integrated into a single logical component. For example, as shown in Figure 5, processor 502 may include multiple processors 502a, 502b, and 502c.

Memory 504 may be configured to store data (eg, instructions, computer code, etc.). As shown in Figure 5, the data stored in the memory 504 may include program instructions (for example, program instructions for implementing the anomaly detection method of the embodiment of the present disclosure) and data to be processed (for example, the memory may store configuration files of other modules, etc. ). Processor 502 may also access program instructions and data stored in memory 504 and execute the program instructions to operate on data to be processed. Memory 504 may include volatile storage or non-volatile storage. In some embodiments, memory 504 may include random access memory (RAM), read only memory (ROM), optical disks, magnetic disks, hard drives, solid state drives (SSD), flash memory, memory sticks, and the like.

Network interface 506 may be configured to provide communication to computer device 500 with other external devices via a network. The network can be any wired or wireless network capable of transmitting and receiving data. For example, the network may be a wired network, a local wireless network (eg, Bluetooth, WiFi, Near Field Communication (NFC), etc.), a cellular network, the Internet, or a combination thereof. It is understood that the type of network is not limited to the specific examples above.

Peripheral interface 508 may be configured to connect computer device 500 with one or more peripheral devices to enable information input and output. For example, peripheral devices may include input devices such as keyboards, mice, touch pads, touch screens, microphones, and various sensors, as well as output devices such as displays, speakers, vibrators, and indicator lights.

Bus 510 may be configured to transport information between various components of computer device 500 (eg, processor 502, memory 504, network interface 506, and peripheral interface 508), such as an internal bus (eg, processor-memory bus), an external bus (USB port, PCI-E bus), etc.

It should be noted that although the above architecture of the computer device 500 only shows the processor 502, the memory 504, the network interface 506, the peripheral interface 508 and the bus 510, during specific implementation, the architecture of the computer device 500 may also include Implement other components necessary for proper functioning. In addition, those skilled in the art can understand that the architecture of the computer device 500 may only include components necessary to implement the embodiments of the present disclosure, and does not necessarily include all components shown in the figures.

An embodiment of the present disclosure also provides a device for detecting frame rate. FIG. 5 shows a schematic diagram of an exemplary device 600 provided by an embodiment of the present disclosure. The device 600 may include the following structures.

The receiving module 602 is configured to: receive target feedback information;

The vector extraction module 604 is configured to: extract the first vectorized representation of the target feedback information;

The information extraction module 606 is configured to: determine at least one second vectorized representation based on the first vectorized representation and historical feedback information, and the similarity between the second vectorized representation and the first vectorized representation is greater than a predetermined degree. Set a similarity threshold; obtain the timing information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vectorized representation; and extract at least one keyword of the target feedback information; as well as

The detection module 608 is configured to determine an anomaly detection result based on the at least one keyword of the target feedback information and the timing information.

In some embodiments, the vector extraction module 604 is configured to: input the target feedback information into a text representation model and output the first vectorized representation; wherein the text representation model is trained based on historical feedback information .

In some embodiments, the training sample set of the text representation model includes multiple training samples, the training samples are historical feedback information with masked identifiers, and the training samples have classification labels, and the classification labels are Tags associated with the historical feedback information.

In some embodiments, the historical feedback information includes multiple words, and the masking probability of the mask identifier corresponding to the word is determined based on the keyword extraction algorithm score of the word.

In some embodiments, the information extraction module 606 is configured to input the first vectorized representation into a vector retrieval engine and output the at least one second vectorized representation.

In some embodiments, the timing information is a timing histogram generated based on the target feedback information and feedback information corresponding to the at least one second vectorized representation.

In some embodiments, the detection module 608 is configured to: input the at least one keyword and the timing information into an anomaly detection model, and output the anomaly detection result; wherein the anomaly detection model is based on historical feedback information Trained.

In some embodiments, the training sample set of the anomaly detection model includes multiple training samples, and the multiple training samples include positive samples and negative samples, wherein the positive samples are from the historical feedback information. abnormal feedback information, and the negative sample is feedback information randomly selected from the historical feedback information.

In some embodiments, the detection module 608 is configured to: extract at least one keyword feature from the at least one keyword; extract timing features from the timing information; combine the at least one keyword feature with the splicing time series features into target features; performing classification prediction based on the target features, and outputting the anomaly detection results.

For the convenience of description, when describing the above device, the functions are divided into various modules and described separately. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and/or hardware.

The devices of the above embodiments are used to implement the corresponding method 400 in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be described again here.

Based on the same inventive concept, corresponding to any of the above embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions use To enable the computer to execute the method 400 as described in any of the above embodiments.

The computer-readable media in this embodiment include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information may be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory. (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

The computer instructions stored in the storage media of the above embodiments are used to cause the computer to execute the method 400 as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be described again here.

Based on the same inventive concept, corresponding to the method 400 in any of the above embodiments, the present disclosure also provides a computer program product, which includes a computer program. In some embodiments, the computer program is executable by one or more processors such that the processors perform the method 300 . Corresponding to the execution subject corresponding to each step in each embodiment of method 400, the processor that executes the corresponding step may belong to the corresponding execution subject.

The computer program product of the above embodiments is used to cause the processor to execute the method 400 as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described again here.

Those of ordinary skill in the art should understand that the discussion of any above embodiments is only illustrative, and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples; under the spirit of the present disclosure, the above embodiments or Technical features in different embodiments may also be combined, steps may be implemented in any order, and there are many other variations of different aspects of the disclosed embodiments as described above, which are not provided in detail for the sake of brevity.

Additionally, to simplify illustration and discussion, and so as not to obscure embodiments of the present disclosure, well-known power supplies/components with integrated circuit (IC) chips and other components may or may not be shown in the provided figures. Ground connection. Furthermore, devices may be shown in block diagram form in order to avoid obscuring the embodiments of the present disclosure, and this also takes into account the fact that details regarding the implementation of these block diagram devices are highly dependent on the implementation of the disclosed embodiments. platform (i.e., these details should be well within the understanding of those skilled in the art). Where specific details (eg, circuits) are set forth to describe exemplary embodiments of the present disclosure, it will be apparent to those skilled in the art that systems may be constructed without these specific details or with changes in these specific details. The embodiments of the present disclosure are implemented below. Accordingly, these descriptions should be considered illustrative rather than restrictive.

Although the present disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures such as dynamic RAM (DRAM) may use the discussed embodiments.

The disclosed embodiments are intended to embrace all such alternatives, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (13)

1. An anomaly detection method, comprising:

receiving target feedback information;

extracting a first vectorized representation of the target feedback information;

determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold;

determining timing information of the target feedback information based on the target feedback information and feedback information corresponding to the at least one second vectorized representation;

extracting at least one keyword of the target feedback information; and

and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

2. The method of claim 1, wherein extracting the first vectorized representation of the target feedback information comprises:

Inputting the target feedback information into a text representation model, and outputting the first vectorized representation;

wherein the text representation model is trained based on historical feedback information.

3. The method of claim 2, wherein the training sample set of the text representation model includes a plurality of training samples, the training samples being historical feedback information with a mask identifier, and the training samples having classification tags, the classification tags being tags associated with the historical feedback information.

4. The method of claim 3, wherein the historical feedback information includes a plurality of words, the mask probabilities of the mask identifiers corresponding to the words being determined based on keyword extraction algorithm scores of the words.

5. The method of claim 1, wherein determining at least one second vectorized representation based on the first vectorized representation and historical feedback information comprises:

the first quantized representation is input to a vector retrieval engine and the at least one second quantized representation is output.

6. The method of claim 1, wherein the timing information is a timing histogram generated based on the target feedback information and the at least one second quantized representation corresponding feedback information.

7. The method of claim 1, wherein determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information comprises:

inputting the at least one keyword and the time sequence information into an abnormality detection model, and outputting an abnormality detection result;

wherein the anomaly detection model is trained based on historical feedback information.

8. The method of claim 7, wherein the training sample set of the anomaly detection model comprises a plurality of training samples including a positive example sample and a negative example sample, wherein the positive example sample is anomaly feedback information in the historical feedback information and the negative example sample is feedback information randomly selected from the historical feedback information.

9. The method of claim 1, 7 or 8, wherein determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information comprises:

extracting at least one keyword feature from the at least one keyword;

extracting time sequence characteristics from the time sequence information;

splicing the at least one keyword feature and the time sequence feature into a target feature; and

And carrying out classification prediction based on the target characteristics, and outputting the abnormality detection result.

10. An abnormality detection apparatus comprising:

a receiving module configured to: receiving target feedback information;

a vector extraction module configured to: extracting a first vectorized representation of the target feedback information;

an information extraction module configured to: determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold; obtaining time sequence information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vector representation; extracting at least one keyword of the target feedback information; and

a detection module configured to: and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

11. A computer device comprising one or more processors, memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, the programs comprising instructions for performing the method of any of claims 1-9.

12. A non-transitory computer readable storage medium containing a computer program which, when executed by one or more processors, causes the processors to perform the method of any of claims 1-9.

13. A computer program product comprising computer program instructions which, when run on a computer, cause the computer to perform the method of any of claims 1-9.