CN117093667A

CN117093667A - Abnormality detection method and related equipment

Info

Publication number: CN117093667A
Application number: CN202210507874.0A
Authority: CN
Inventors: 费志辉; 万明阳; 薛驰; 马国俊
Original assignee: Beijing Zitiao Network Technology Co Ltd
Current assignee: Beijing Zitiao Network Technology Co Ltd
Priority date: 2022-05-10
Filing date: 2022-05-10
Publication date: 2023-11-21

Abstract

The disclosure provides an anomaly detection method and related equipment. The method comprises the following steps: receiving target feedback information; extracting a first vectorized representation of the target feedback information; determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold; determining timing information of the target feedback information based on the target feedback information and feedback information corresponding to the at least one second vectorized representation; extracting at least one keyword of the target feedback information; and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

Description

Abnormality detection method and related equipment

Technical Field

The disclosure relates to the field of computer technology, and in particular, to an anomaly detection method and related equipment.

Background

The anomaly discovery algorithm is a computer technology for identifying hot anomaly topics in a customer complaint data stream, and is a method for processing by means of natural language, and feedback texts of the same topics are gathered together to judge whether the feedback texts are anomaly problems needing to be focused. However, the inventors of the present disclosure found that it is difficult to implement real-time accurate anomaly detection with existing clustering methods.

Disclosure of Invention

The present disclosure proposes an anomaly detection method and related apparatus to solve or partially solve the above-mentioned problems.

In a first aspect of the present disclosure, there is provided an abnormality detection method including:

receiving target feedback information;

extracting a first vectorized representation of the target feedback information;

determining that at least one obtained second vectorized representation is based on the first vectorized representation and the historical feedback information, wherein the similarity between the second vectorized representation and the first vectorized representation is larger than a preset similarity threshold;

obtaining time sequence information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vector representation;

extracting at least one keyword of the target feedback information; and

and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

In a second aspect of the present disclosure, there is provided an abnormality detection apparatus including:

a receiving module configured to: receiving target feedback information;

a vector extraction module configured to: extracting a first vectorized representation of the target feedback information;

an information extraction module configured to: determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold; obtaining time sequence information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vector representation; extracting at least one keyword of the target feedback information; and

A detection module configured to: and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

In a third aspect of the disclosure, a computer device is provided that includes one or more processors, memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, the programs comprising instructions for performing the method of the first aspect.

In a fourth aspect of the present disclosure, there is provided a non-transitory computer readable storage medium containing a computer program which, when executed by one or more processors, causes the processors to perform the method of the first aspect.

In a fifth aspect of the present disclosure, there is provided a computer program product comprising computer program instructions which, when run on a computer, cause the computer to perform the method of the first aspect.

According to the abnormality detection method and the related equipment, corresponding time sequence information is generated based on the vectorization representation similar to the vectorization representation of the target feedback information, and then the keyword of the target feedback information and the time sequence information are combined together to perform abnormality detection, so that on one hand, real-time abnormality detection can be realized, and on the other hand, abnormality detection can be performed by simultaneously utilizing the keyword characteristic and the time sequence characteristic, and therefore a more accurate abnormality detection result is obtained.

Drawings

In order to more clearly illustrate the technical solutions of the present disclosure or related art, the drawings required for the embodiments or related art description will be briefly described below, and it is apparent that the drawings in the following description are only embodiments of the present disclosure, and other drawings may be obtained according to these drawings without inventive effort to those of ordinary skill in the art.

Fig. 1 shows a schematic diagram of an exemplary system provided by an embodiment of the present disclosure.

FIG. 2A shows a schematic diagram of an exemplary text representation model, according to an embodiment of the present disclosure.

Fig. 2B shows a schematic diagram of an exemplary time sequence histogram according to an embodiment of the present disclosure.

Fig. 2C shows a schematic diagram of another exemplary timing histogram in accordance with an embodiment of the present disclosure.

FIG. 2D shows a schematic diagram of an exemplary anomaly detection model, according to an embodiment of the present disclosure.

Fig. 3 shows a flow diagram of an exemplary method provided by an embodiment of the present disclosure.

Fig. 4 shows a schematic hardware structure of an exemplary computer device provided by an embodiment of the disclosure.

Fig. 5 shows a schematic diagram of an exemplary apparatus provided by an embodiment of the present disclosure.

Detailed Description

For the purposes of promoting an understanding of the principles and advantages of the disclosure, reference will now be made to the embodiments illustrated in the drawings and specific language will be used to describe the same.

It should be noted that unless otherwise defined, technical or scientific terms used in the embodiments of the present disclosure should be given the ordinary meaning as understood by one of ordinary skill in the art to which the present disclosure pertains. The terms "first," "second," and the like, as used in embodiments of the present disclosure, do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. The word "comprising" or "comprises", and the like, means that elements or items preceding the word are included in the element or item listed after the word and equivalents thereof, but does not exclude other elements or items. The terms "connected" or "connected," and the like, are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "upper", "lower", "left", "right", etc. are used merely to indicate relative positional relationships, which may also be changed when the absolute position of the object to be described is changed.

An anomaly discovery algorithm in the customer service field is a computer technology for identifying hot anomaly topics in customer complaint data streams, and is a method for processing by means of natural language, and feedback texts of the same subject are gathered together to judge whether the feedback texts are anomaly problems needing to be focused.

For example, in a user feedback scene of a certain platform, a hotspot abnormality problem in feedback data is found in time, and the method plays an extremely important role in the operation and maintenance of video information stream products.

One possible hot spot (anomaly) discovery algorithm relies primarily on text clustering techniques. Since text clustering is an unsupervised method, the effect of a clustering algorithm is usually very limited, the granularity of categories is difficult to control (for example, the threshold value for determining abnormal problems is difficult to fix during clustering due to different conditions of different problems and different time periods), the accuracy of mining hot spot problems through the clustering algorithm is not high, the instantaneity of the clustering algorithm is difficult to ensure, and the online abnormal problems are difficult to capture in time.

For example, in a user feedback scenario of a certain platform, different user feedback of the same problem may have a large difference in terms of expressions, but may be substantially the same in terms of semantic information, and it is difficult for an unsupervised vectorized representation method to learn whether different expression texts are fed back to the same problem, so that it is also difficult to meet the requirement of hot spot discovery in the user feedback scenario.

In view of this, the embodiments of the present disclosure provide an anomaly detection method and related apparatus, which generate corresponding timing information based on a vectorized representation similar to a vectorized representation of target feedback information, and then combine keywords of the target feedback information and the timing information together to perform anomaly detection, so that on the one hand, real-time anomaly detection can be achieved, and on the other hand, anomaly detection can be performed by using both the keyword feature and the timing feature, thereby obtaining a more accurate anomaly detection result.

Fig. 1 shows a schematic diagram of an exemplary system 100 provided by an embodiment of the present disclosure.

The system 100 may be used to process target feedback information (e.g., comments fed back by a user through a customer service portal of a platform) and to perform anomaly detection based on the target feedback information. As shown in fig. 1, the system 100 may include a server 200 and a terminal device 300.

Server 200 may be a server deployed within an enterprise or a business server purchased or rented by an enterprise. The number of servers 200 may be one or more, and in the case where the number of servers 200 is plural, a server cluster may be formed using a distributed architecture. In some embodiments, as shown in FIG. 1, the system 100 may further include a database server 202, the database server 202 may be used to store data, and the server 200 may call corresponding data from the database server 202 as needed. In some embodiments, the database server 202 may be an elastosearch cluster.

The terminal device 300 may be various types of fixed terminals or mobile terminals. For example, the terminal device 300 may be a mobile phone, a tablet computer, a personal computer, a notebook computer, or the like. The terminal device 300 and the server 200 may communicate through a wired network or a wireless network, thereby realizing data interaction.

In some embodiments, the user may send some feedback information to the server 200 using the terminal device 300. For example, a user may input some feedback information through a user feedback portal (e.g., opinion feedback interface in APP) of an application program (APP) installed in the terminal device 300, and the feedback information is transmitted to the server 200 by the terminal device 300.

The server 200 receives the feedback information, and may pre-process the feedback information for anomaly detection.

In some embodiments, server 200 may process each feedback information received, for example, vectorizing the text of the feedback information.

There are many ways to vectorize the text of the feedback information. In some embodiments, a text representation model may be built in the server 200 to vectorize the text of the feedback information. The text representation model may employ various algorithmic models for text processing. In some embodiments, a BERT model may be employed.

FIG. 2A shows a schematic diagram of an exemplary text representation model 204, according to an embodiment of the present disclosure.

As an alternative embodiment, the text representation model may use the pre-training model 2042 as a model basis, and then continue training the pre-training model 2042 using historical feedback information of the target platform (the platform on which anomaly detection is to be performed) (e.g., feedback information of the user collected by the target platform over a historical period of time (e.g., 1 year, half year, three months, etc.), to obtain the text representation model 2044. The pre-training model 2042 may be an already pre-trained BERT model provided by the open source platform, or an initialized BERT model is built, and then the initial model is pre-trained by using an open source corpus, so as to obtain the pre-trained BERT model.

Continuing to train the pre-training model 2042 may be implemented using a masking language model (Mask Language Model, abbreviated as MLM).

In some embodiments, a training data set is formed using a plurality of historical feedback information, each of which may be processed to obtain training samples. Since the masking language model mechanism requires masking the text with a masking identifier, each of the historical feedback information may be masked to obtain the masked-identifier historical feedback information.

Further, in order to help the model learn semantic information that feedback information of the same tag is closer in vector space and feedback information of different tags is farther in vector space, historical feedback information with a mask identifier can be labeled with a corresponding classification tag.

When the text expression of feedback information of different users has large difference, the traditional unsupervised text characterization method is difficult to accurately obtain deep semantic information of the feedback text. Specific examples are shown in table 1.

TABLE 1

User feedback text	Label (Label)
		After a while, the mobile phone heats up seriously	Functional failure-mobile phone hair-ironing
Just upgrading, the mobile phone scalds, how to get back	Functional failure-mobile phone hair-ironing
		How to get back for your product, play a while and burn the mobile phone	Functional failure-mobile phone hair-ironing
How to recommend disliked videos to me	Ecological wind-drawing-recommendation inaccuracy

Therefore, if the tag information carried by the feedback information is used, the text representation model can be better helped to learn the semantic information of the sentence. Thus, as a preferred embodiment, the classification tag may be a tag associated with the historical feedback information. For example, a tag carried by the feedback information when the feedback information is provided by the user. The label may be a label selected by the user himself, a label printed on an online Natural Language Processing (NLP) classification model, or a label generated by manual correction, etc.

Generally, in the MLM mechanism, a certain proportion (e.g., 15%) of words (or words) are randomly selected from text to be masked (original words are replaced with Mask symbols), and then feedback text information with a Mask identifier is extracted based on the BERT model, so as to predict information of the masked words. To enhance the representation of feedback text key information by text representation model 2044, in some embodiments, the probability of masking keywords in text may be increased. As an alternative embodiment, the mask probabilities may be designed using a keyword extraction algorithm (TF-IDF). For example, a TF-IDF score is calculated for each word in the historical feedback information, then normalized based on TF-IDF scores of all words in the historical feedback information, resulting in a weight for each word, which is then used as a probability of selecting a word from the historical feedback information for masking. The TF-IDF score reflects the importance degree of a word in a text set to a certain text, so that the probability of masking keywords can be increased by the processing, and further, the representation of the feedback text key information by the model can be enhanced. It can be understood that the text set used for calculating the TF-IDF score is a historical feedback information set of a target platform (a platform to be subjected to anomaly detection), so that the representation of the model on key information of the feedback information can be further improved.

After the training data set is obtained, the training data set may be used to continue training the pre-training model 2042 based on the MLM mechanism, so as to obtain the text representation model 2044, and then the text representation model 2044 may be used to vectorize the target feedback information received in real time.

In some embodiments, the server 200 may process each piece of received feedback information using the text representation model 2044 to obtain a vectorized representation, which is then stored in the database server 202 (e.g., an elastic search cluster) for subsequent extraction of timing characteristics corresponding to the feedback information. Accordingly, the feedback information of the user may also be stored in the database server 202.

Returning to fig. 1, for target feedback information 302 received in real-time, server 200 may first extract a first vectorized representation of the target feedback information 302 using the text representation model 2044.

The server 200 may then derive a plurality of second quantized representations similar to the first quantized representation based on the first quantized representation. For example, the first vectorized representation is input to a vector search engine (e.g., byteES, faiss, etc.) of a database server 202 (e.g., an elastic search cluster) for searching, resulting in a plurality of second vectorized representations having a similarity to the first vectorized representation greater than a preset similarity threshold (e.g., cosine similarity greater than 0.92).

The server 200 may then obtain, based on these second quantized representations, corresponding feedback information for each second quantized representation from the database server 202.

For example, the user submitted a common feedback question-why will the click? ". After vectorizing the feedback problem by the text representation model 2044, some similar vectorized representations may be retrieved by a vector retrieval engine, and based on these similar vectorized representations, the server 200 may then obtain a vector representation of "why will it be stuck? "similar feedback information.

It can be considered that these similar feedback information describe the same problem, and then, based on the user submission time of each piece of feedback information, the time sequence histogram 206a of the feedback information of the user is drawn as the time sequence information of the feedback information in units of a preset time interval (e.g., 10 minutes, half hour, 1 hour, etc.), for example, as shown in fig. 2B.

For another example, if the user feedback is an abnormal problem-the mobile phone heats up after a while. The server 200 may also perform text vectorization, vector search library, vector search, and the like on the feedback information in the same manner. Similar feedback as shown in table 2 was then obtained. The time sequence histogram 206b thereof may be as shown in fig. 2C.

TABLE 2

User submission time	User feedback
		2021 12-24 17:30:41	After a while, the mobile phone heats up seriously
2021 12-24 17:30:56	Just upgrading, the mobile phone scalds, how to get back
		2021 12-24 17:31:11	How to get back for your product, play a while and burn the mobile phone
2021 12-24 17:31:38	The mobile phone is too hot
		2021 12-24 17:32:16	The mobile phone heats seriously

As can be seen from the illustration of fig. 2C, the anomaly problem is characterized by periodic fluctuations in the early stage, but is on the order of an anomaly in the near future. From the time series histogram 206b, the problem of "swiping for a while about heating the handset" is normally below 5 on the order of magnitude of every 10 minutes, but in the near future, on the order of magnitude of 25 every 10 minutes, indicates that an abnormality of "heating the handset" may be occurring.

It can be seen that the time sequence histogram represents the time sequence characteristics of a problem corresponding to feedback information in a period of time.

Then, the server 200 may extract the keywords of the target feedback information 302, and then obtain an abnormality detection result based on the keywords of the target feedback information 302 and the timing information.

There are many ways to extract the keywords, and some common keyword extraction methods may be used to extract the keywords of the target feedback information 302. For example, the keywords may be extracted using an algorithm such as TF-IDF, textRank, LDA. As an alternative embodiment, TF-IDF scores are calculated for each word (or word) using TF-IDF algorithm, and then the higher scoring word is used as the keyword. For example, the word having the highest score and the second highest score may be selected as the keyword, or the word having the score higher than the score threshold may be selected as the keyword. In order to ensure that the keywords can be extracted normally, the score threshold needs to be set so as to satisfy each feedback information as much as possible, or when no word satisfying the score threshold is present, the word with the highest score may be selected as the keyword.

In some embodiments, the server 200 may input the keyword and the timing information into an anomaly detection model, and further output the anomaly detection result by the anomaly detection model.

In actual abnormal problem detection, different thresholds (thresholds reflecting the problem as an abnormal problem) are required for different problems at different times. Therefore, a fixed threshold cannot be used, and the threshold needs to be determined in conjunction with the content (keywords), temporal characteristics (histogram trend) of a specific problem. Therefore, the present embodiment adopts a problem classification model based on the keywords and the time series information as the abnormality detection model, thereby directly predicting whether the candidate problem (feedback information 302) is an abnormality problem.

FIG. 2D shows a schematic diagram of an exemplary anomaly detection model 208 in accordance with an embodiment of the present disclosure.

As shown in fig. 2D, the anomaly detection model 208 may include a keyword feature extraction layer 2082, a timing feature extraction layer 2084, and a classification layer 2086.

The keyword feature extraction layer 2082 may extract corresponding keyword features from keywords input to the anomaly detection model 208. In some embodiments, the keyword feature extraction layer 2082 may be a word embedding layer (word embedding).

The timing feature extraction layer 2084 may extract corresponding timing features from the timing information (e.g., timing histogram) input to the anomaly detection model 208. In some embodiments, the timing feature extraction layer 2084 may be comprised of a long short term memory network (LSTM).

The classification layer 2086 may splice the keyword features and the timing features input therein to obtain overall features of the candidate anomalies, and finally predict the category of the target feedback information 302, thereby obtaining the anomaly detection result. For example, yes indicates that the problem expressed by the target feedback information 302 is an abnormal problem, and No indicates that the problem expressed by the target feedback information 302 is not an abnormal problem. In some embodiments, the classification layer 2086 may be a fully connected neural network model, where the number of hidden layers and the number of neurons for each layer may be set as desired.

It can be seen that the anomaly detection model 208 can contain primarily inputs for two features: a) The keyword features are used to describe content information of candidate questions; b) The timing characteristics are used to describe timing characteristic information of candidate problem occurrence. Based on the two features, the anomaly detection model 208 performs stitching, then performs information fusion on the fully connected neural network layer, and finally predicts whether the candidate problem is an anomaly problem.

In some embodiments, anomaly detection model 208 may also be trained based on historical feedback information. As an alternative embodiment, the training sample set of anomaly detection model 208 may include a plurality of training samples, which may further include positive examples (belonging to historical incidents) and negative examples (not belonging to historical incidents). The ratio of the positive example sample to the negative example sample may be, for example, 1:10.

wherein the positive example is abnormal feedback information (e.g. why the mobile phone is heated up too much) in the historical feedback information. In most cases, historical incidents or anomalies are typically archived, such as incident labels, incident descriptions, incident-related feedback, incident occurrence times and trends, and so forth. Based on the archive data, the time sequence histogram features of the accident related keywords and the accident can be constructed manually, namely, historical accident data of a period of time are collected and labeled with a positive example as a positive example sample of model training.

The negative example sample is feedback information randomly selected from historical feedback information and is marked with a negative example label. Because the randomly extracted feedback information has extremely low probability of being in accident or abnormal feedback, the feedback information can be used as a negative example sample of model training, and the processing can be simpler and easier to implement and the efficiency can be improved.

The server 200 may then find its similar feedback information based on the vector search engine and then count keywords and time series histograms of these similar feedback information.

These keywords and time series histograms may then be used to train the anomaly detection model. Based on the predicted category and the real category of the training data, cross entropy loss is constructed, model parameters are optimized based on a gradient descent method until convergence is achieved, and therefore model training is completed, and a final anomaly detection model 208 is obtained. Thus, by inputting the keyword of the target feedback information 302 and the time series information (for example, the time series histogram) into the abnormality detection model 208, it is possible to derive a detection result of whether or not there is an abnormality.

In some embodiments, the server 200 may also send an alarm prompt to a specific person (for example, send a risk prompt to a device of a background monitor) when the abnormality detection result is Yes, so that the related person can learn about the occurrence of the abnormality in time, and then respond in time.

As can be seen from the above embodiments, the anomaly detection system 100 provided by the embodiments of the present disclosure can extract the anomaly problem that may occur in real time from the feedback data of the user, and has strong algorithm fault tolerance and high real-time performance.

The embodiment of the disclosure also provides an abnormality detection method. Fig. 3 shows a flow diagram of an embodiment method 400 provided by an embodiment of the present disclosure. The method 400 may be implemented by the server 200 of fig. 1 and may further include the following steps, as shown in fig. 3.

In step 402, the server 200 may receive the target feedback information 302.

At step 404, the server 200 may extract a first vectorized representation of the target feedback information.

In some embodiments, extracting the first vectorized representation of the target feedback information includes: the target feedback information is input to a text representation model (e.g., model 2044 of fig. 2A) and the first vectorized representation is output. Wherein the text representation model is trained based on historical feedback information.

In some embodiments, the training sample set of the text representation model includes a plurality of training samples, the training samples are historical feedback information with mask identifiers, and the training samples have classification labels, the classification labels are labels associated with the historical feedback information, so that the model can learn semantic information that "feedback information of the same label is closer in vector space, feedback information of different labels is farther in vector space.

In some embodiments, the historical feedback information includes a plurality of words, and the mask probabilities of mask identifiers corresponding to the words are determined based on keyword extraction algorithm scores of the words, so that the representation of feedback text key information by the model can be enhanced.

At step 406, the server 200 may determine at least one second vectorized representation based on the first vectorized representation and historical feedback information (e.g., feedback information stored in the database server 202 of fig. 1), the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold.

In some embodiments, determining at least one second vectorized representation based on the first vectorized representation and historical feedback information comprises: inputting the first vector representation to a vector retrieval engine, outputting the second vector representation.

In step 408, the server 200 may obtain timing information of the target feedback information based on the target feedback information and the at least one second quantized representation of the corresponding feedback information.

In some embodiments, the timing information is a timing histogram generated based on the target feedback information and the at least one feedback information corresponding to the at least one second quantized representation.

In step 410, the server 200 may extract keywords of the target feedback information.

In step 412, the server 200 may determine an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

In some embodiments, determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information includes: inputting the keyword and the timing information into an anomaly detection model (e.g., model 208 of fig. 2D), outputting the anomaly detection result; wherein the anomaly detection model is trained based on historical feedback information.

In some embodiments, the training sample set of the anomaly detection model includes a plurality of training samples, the plurality of training samples including a positive example sample and a negative example sample, wherein the positive example sample is anomaly feedback information in the historical feedback information, and the negative example sample is feedback information randomly selected from the historical feedback information.

In some embodiments, determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information includes: extracting at least one keyword feature from the at least one keyword; extracting time sequence characteristics from the time sequence information; splicing the at least one keyword feature and the time sequence feature into a target feature; and performing classification prediction based on the target features, and outputting the abnormality detection result.

It should be noted that the method of the embodiments of the present disclosure may be performed by a single device, such as a computer or a server. The method of the embodiment can also be applied to a distributed scene, and is completed by mutually matching a plurality of devices. In the case of such a distributed scenario, one of the devices may perform only one or more steps of the methods of embodiments of the present disclosure, the devices interacting with each other to accomplish the methods.

It should be noted that the foregoing describes some embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments described above and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The embodiment of the present disclosure also provides a computer device, configured to implement the anomaly detection method 400 described above. Fig. 4 shows a hardware architecture diagram of an exemplary computer device 500 provided by an embodiment of the present disclosure. The computer device 500 may be used to implement the server 200 as well as the terminal device 300. As shown in fig. 4, the computer device 500 may include: processor 502, memory 504, network module 506, peripheral interface 508, and bus 510. Wherein the processor 502, the memory 504, the network module 506 and the peripheral interface 508 enable a communication connection therebetween within the computer device 500 via the bus 510.

The processor 502 may be a central processing unit (Central Processing Unit, CPU), an image processor, a neural Network Processor (NPU), a Microcontroller (MCU), a programmable logic device, a Digital Signal Processor (DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits. The processor 502 may be used to perform functions related to the techniques described in this disclosure. In some embodiments, processor 502 may also include multiple processors integrated as a single logical component. For example, as shown in fig. 5, the processor 502 may include a plurality of processors 502a, 502b, and 502c.

Memory 504 may be configured to store data (e.g., instructions, computer code, etc.). As shown in fig. 5, the data stored by the memory 504 may include program instructions (e.g., program instructions for implementing the anomaly detection method of an embodiment of the present disclosure) as well as data to be processed (e.g., the memory may store configuration files of other modules, etc.). The processor 502 may also access program instructions and data stored in the memory 504 and execute the program instructions to perform operations on the data to be processed. Memory 504 may include volatile storage or nonvolatile storage. In some embodiments, memory 504 may include Random Access Memory (RAM), read Only Memory (ROM), optical disks, magnetic disks, hard disks, solid State Disks (SSD), flash memory, memory sticks, and the like.

The network interface 506 may be configured to provide the computer device 500 with communications with other external devices via a network. The network may be any wired or wireless network capable of transmitting and receiving data. For example, the network may be a wired network, a local wireless network (e.g., bluetooth, wiFi, near Field Communication (NFC), etc.), a cellular network, the internet, or a combination of the foregoing. It will be appreciated that the type of network is not limited to the specific examples described above.

Peripheral interface 508 may be configured to connect computer apparatus 500 with one or more peripheral devices to enable information input and output. For example, the peripheral devices may include input devices such as keyboards, mice, touchpads, touch screens, microphones, various types of sensors, and output devices such as displays, speakers, vibrators, and indicators.

Bus 510 may be configured to transfer information between the various components of computer device 500 (e.g., processor 502, memory 504, network interface 506, and peripheral interface 508), such as an internal bus (e.g., processor-memory bus), an external bus (USB port, PCI-E bus), etc.

It should be noted that, although the architecture of the computer device 500 described above illustrates only the processor 502, the memory 504, the network interface 506, the peripheral interface 508, and the bus 510, in a specific implementation, the architecture of the computer device 500 may also include other components necessary to achieve proper operation. Moreover, those skilled in the art will appreciate that the architecture of the computer device 500 described above may include only the components necessary to implement the disclosed embodiments, and not all of the components shown in the figures.

The embodiment of the disclosure also provides a device for detecting the frame rate. Fig. 5 shows a schematic diagram of an exemplary apparatus 600 provided by an embodiment of the present disclosure. The apparatus 600 may include the following structure.

A receiving module 602 configured to: receiving target feedback information;

the vector extraction module 604 is configured to: extracting a first vectorized representation of the target feedback information;

an information extraction module 606 configured to: determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold; obtaining time sequence information of the target feedback information based on the target feedback information and the feedback information corresponding to the at least one second vector representation; extracting at least one keyword of the target feedback information; and

a detection module 608 configured to: and determining an abnormality detection result based on the at least one keyword of the target feedback information and the timing information.

In some embodiments, vector extraction module 604 is configured to: inputting the target feedback information into a text representation model, and outputting the first vectorized representation; wherein the text representation model is trained based on historical feedback information.

In some embodiments, the training sample set of the text representation model includes a plurality of training samples, the training samples being historical feedback information with a mask identifier, and the training samples having classification tags, the classification tags being tags associated with the historical feedback information.

In some embodiments, the historical feedback information includes a plurality of words, and the mask probabilities of the mask identifiers corresponding to the words are determined based on keyword extraction algorithm scores of the words.

In some embodiments, the information extraction module 606 is configured to: the first quantized representation is input to a vector retrieval engine and the at least one second quantized representation is output.

In some embodiments, the timing information is a timing histogram generated based on the target feedback information and the at least one second quantized representation corresponding to the feedback information.

In some embodiments, detection module 608 is configured to: inputting the at least one keyword and the time sequence information into an abnormality detection model, and outputting an abnormality detection result; wherein the anomaly detection model is trained based on historical feedback information.

In some embodiments, detection module 608 is configured to: extracting at least one keyword feature from the at least one keyword; extracting time sequence characteristics from the time sequence information; splicing the at least one keyword feature and the time sequence feature into a target feature; and performing classification prediction based on the target features, and outputting the abnormality detection result.

For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, the functions of the various modules may be implemented in the same one or more pieces of software and/or hardware when implementing the present disclosure.

The apparatus of the foregoing embodiments is configured to implement the corresponding method 400 in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described herein.

Based on the same inventive concept, corresponding to any of the above-described embodiments of the method, the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method 400 as described in any of the above-described embodiments.

The computer readable media of the present embodiments, including both permanent and non-permanent, removable and non-removable media, may be used to implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Disks (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.

The storage medium of the foregoing embodiments stores computer instructions for causing the computer to perform the method 400 described in any of the foregoing embodiments, and has the advantages of the corresponding method embodiments, which are not described herein.

Based on the same inventive concept, the present disclosure also provides a computer program product, corresponding to any of the embodiment methods 400 described above, comprising a computer program. In some embodiments, the computer program is executable by one or more processors to cause the processors to perform the described method 300. Corresponding to the execution bodies to which the steps in the embodiments of the method 400 correspond, the processor that executes the corresponding step may belong to the corresponding execution body.

The computer program product of the above embodiment is configured to cause a processor to perform the method 400 of any of the above embodiments, and has the advantages of the corresponding method embodiments, which are not described herein.

Those of ordinary skill in the art will appreciate that: the discussion of any of the embodiments above is merely exemplary and is not intended to suggest that the scope of the disclosure, including the claims, is limited to these examples; the technical features of the above embodiments or in the different embodiments may also be combined under the idea of the present disclosure, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in details for the sake of brevity.

Additionally, well-known power/ground connections to Integrated Circuit (IC) chips and other components may or may not be shown within the provided figures, in order to simplify the illustration and discussion, and so as not to obscure the embodiments of the present disclosure. Furthermore, the devices may be shown in block diagram form in order to avoid obscuring the embodiments of the present disclosure, and this also accounts for the fact that specifics with respect to implementation of such block diagram devices are highly dependent upon the platform on which the embodiments of the present disclosure are to be implemented (i.e., such specifics should be well within purview of one skilled in the art). Where specific details (e.g., circuits) are set forth in order to describe example embodiments of the disclosure, it should be apparent to one skilled in the art that embodiments of the disclosure can be practiced without, or with variation of, these specific details. Accordingly, the description is to be regarded as illustrative in nature and not as restrictive.

While the present disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of those embodiments will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

The disclosed embodiments are intended to embrace all such alternatives, modifications and variances which fall within the broad scope of the appended claims. Accordingly, any omissions, modifications, equivalents, improvements, and the like, which are within the spirit and principles of the embodiments of the disclosure, are intended to be included within the scope of the disclosure.

Claims

1. An anomaly detection method, comprising:

receiving target feedback information;

determining at least one second vectorized representation based on the first vectorized representation and historical feedback information, the second vectorized representation having a similarity to the first vectorized representation greater than a preset similarity threshold;

determining timing information of the target feedback information based on the target feedback information and feedback information corresponding to the at least one second vectorized representation;

extracting at least one keyword of the target feedback information; and

2. The method of claim 1, wherein extracting the first vectorized representation of the target feedback information comprises:

Inputting the target feedback information into a text representation model, and outputting the first vectorized representation;

wherein the text representation model is trained based on historical feedback information.

3. The method of claim 2, wherein the training sample set of the text representation model includes a plurality of training samples, the training samples being historical feedback information with a mask identifier, and the training samples having classification tags, the classification tags being tags associated with the historical feedback information.

4. The method of claim 3, wherein the historical feedback information includes a plurality of words, the mask probabilities of the mask identifiers corresponding to the words being determined based on keyword extraction algorithm scores of the words.

5. The method of claim 1, wherein determining at least one second vectorized representation based on the first vectorized representation and historical feedback information comprises:

the first quantized representation is input to a vector retrieval engine and the at least one second quantized representation is output.

6. The method of claim 1, wherein the timing information is a timing histogram generated based on the target feedback information and the at least one second quantized representation corresponding feedback information.

7. The method of claim 1, wherein determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information comprises:

inputting the at least one keyword and the time sequence information into an abnormality detection model, and outputting an abnormality detection result;

wherein the anomaly detection model is trained based on historical feedback information.

8. The method of claim 7, wherein the training sample set of the anomaly detection model comprises a plurality of training samples including a positive example sample and a negative example sample, wherein the positive example sample is anomaly feedback information in the historical feedback information and the negative example sample is feedback information randomly selected from the historical feedback information.

9. The method of claim 1, 7 or 8, wherein determining an anomaly detection result based on the at least one keyword of the target feedback information and the timing information comprises:

extracting at least one keyword feature from the at least one keyword;

extracting time sequence characteristics from the time sequence information;

splicing the at least one keyword feature and the time sequence feature into a target feature; and

And carrying out classification prediction based on the target characteristics, and outputting the abnormality detection result.

10. An abnormality detection apparatus comprising:

a receiving module configured to: receiving target feedback information;

11. A computer device comprising one or more processors, memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, the programs comprising instructions for performing the method of any of claims 1-9.

12. A non-transitory computer readable storage medium containing a computer program which, when executed by one or more processors, causes the processors to perform the method of any of claims 1-9.

13. A computer program product comprising computer program instructions which, when run on a computer, cause the computer to perform the method of any of claims 1-9.